Modbus is an application-layer protocol widely used by industrial devices. A client sends a request; a server replies according to a function code. The protocol defines messages and a data model, but each manufacturer decides where a measurement lives. Keep the device register map beside you when configuring a real connection.Function codes and message bytes in this article are hexadecimal: 0F is decimal 15, and 10 is decimal 16.
1. The four data areas
- Coils: single bits that can be read and written; common function codes are 01, 05, and 0F.
- Discrete inputs: read-only bits; read with 02.
- Input registers: read-only 16-bit words; read with 04.
- Holding registers: 16-bit words that the protocol model permits reading and writing; read with 03, write one with 06, or several with 10. An individual device may still restrict writes.
Function code 03 and 04 both read 16-bit words, but from different areas. Check the device manual for the function code, register number, data type, scaling, and access rights.
2. Modbus RTU versus Modbus TCP
RTU commonly runs over a serial link such as RS-485. A frame contains a station address, function code and data, then a CRC16. Devices on one bus need distinct station addresses, and the peers must agree on baud rate, data bits, parity, and stop bits. The low CRC byte is transmitted first.
Modbus TCP uses TCP/IP, typically on port 502. Its seven-byte MBAP header carries a transaction identifier, protocol identifier, length, and unit identifier. There is no Modbus RTU CRC at the end of a TCP frame. Through a TCP-to-serial gateway, the unit identifier commonly selects the downstream device.
3. Why 40001 can mean address zero
A document label such as 40001 commonly denotes the first holding register. The leading 4 identifies the area; the starting address placed in the request is a zero-based offset. Under this convention, 40001 is function 03 at address 0000, and 40002 is address 0001. Manuals and tools may display one-based numbers or zero-based offsets. Resolve the convention before reading or writing nearby values.
One register holds 16 bits. A 32-bit integer or floating-point value generally occupies two registers, but the order of those words is device-specific. Scaling such as dividing a temperature by ten also comes from the device map, not Modbus itself.
4. Worked request and response
Assume a device maps temperature and humidity to holding registers 40001 and 40002. Their raw values are 250 and 400, each with a documented scale of 0.1. We read two registers from offset zero using function 03. These example values and units are illustrative, not universal.
PDU request: 03 00 00 00 02
PDU response: 03 04 00 FA 01 90
TCP request: 00 01 00 00 00 06 01 03 00 00 00 02
TCP response: 00 01 00 00 00 07 01 03 04 00 FA 01 90In the request PDU, 03 is the function code, 00 00 the starting offset, and 00 02 the quantity. In the response, 04 counts the following data bytes; 00 FA is 250 and 01 90 is 400. The assumed scaling gives 25.0 °C and 40.0%. The TCP transaction identifier is 0001, protocol identifier 0000, unit identifier 01, and MBAP lengths 0006 and 0007. Over RTU, the same PDU also needs a station address and a correctly computed CRC16.
5. First connection checklist
- Start with a documented read-only test value. Check the interface, station address or IP, port, and serial settings.
- Select the correct data area and function code. Find out whether your tool expects “40001” or offset “0”.
- Read a small quantity, verify the function code and byte count, then interpret the raw values using the manual.
- For a timeout, inspect wiring or network and addressing. 83 02 means function 03 returned exception 02 (illegal data address); check the starting offset and quantity. It is not a measurement.
Safety and references
Reading and especially writing can affect real equipment. Avoid write functions during initial testing and restrict access to production networks. Do not expose traditional Modbus TCP directly to the public Internet; consider supported Modbus Security or network isolation where appropriate.
