English (GB)
43
13. Modbus RTU telegram examples
Note that CRC fields are not shown in the following examples.
13.1 Modbus telegram overview
The maximum size of a Modbus RTU telegram is 256 bytes.
Telegrams must be separated by a silent interval of at least 3.5
character times.
The standard Modbus RTU telegram format is shown in the table
below.
A telegram starts with the slave address occupying one byte.
Then comes a variable-size data field. For each telegram, a CRC
is calculated and appended to the telegram (two bytes total). All
bytes in the telegram, except for the CRC itself, are included in
the check.
Note that the CRC bytes are not shown in the examples in the
following sections.
13.2 Read holding registers, 0x03
This function is used for reading holding registers from the slave.
The request telegram specifies the starting address (the address
of the first register to be read) and the number of holding
registers to read. In the telegram, register addresses start from
zero, meaning that registers numbered 0-16 are addressed as 0-
15.
Example of request from master to slave
In the request, the slave with address 1 is asked to deliver three
contiguous registers starting from address 0x006b: 107, meaning
register 108.
Example of response from slave to master
In the response, the byte count is six since there are three
registers of two bytes. All three registers hold the value of
0x0001.
13.3 Read input registers, 0x04
This function is used for reading input registers from the slave.
Input registers are read-only registers by definition. The request
telegram specifies the starting address, that is the address of the
first register to be read, and the number of holding registers to
read. In the telegram, register addresses start from zero,
meaning that registers numbered 0-16 are addressed as 0-15.
Example of request from master to slave
In the request, the slave with address 1 is asked to deliver three
contiguous registers starting from address 0x1010: 4112,
meaning register 4113.
Example of response from slave to master
In the response, the byte count is six since there are three
registers of two bytes. All three registers hold the value of
0x2222.
13.4 Write single register, 0x06
This function is used for writing a single holding register in the
slave. The request telegram specifies the address of the register
that is to be written. Register addresses start from zero, meaning
that a register numbered 10 is addressed as 9.
The normal response is an echo of the request, indicating that the
value was written.
Example of request from master to slave
In the request, the slave with address 1 is asked to write the
value of 0xAFFE to the register at address 0x1000.
The Modbus data model states that registers
numbered X are addressed in telegrams as X - 1, for
example register 00104 (setpoint) is addressed as
00103 in a Modbus telegram.
Slave
address
Function
code
Data
CRC
1 byte
1 byte
0 to 252 bytes
2 bytes
Field
Value
Address
0x01
Function code
0x03
Start address HI
0x00
Start address LO
0x6B
Quantity HI
0x00
Quantity LO
0x03
Field
Value
Address
0x01
Function code
0x03
Byte count
0x06
Register 108 HI
0x00
Register 108 LO
0x01
Register 109 HI
0x00
Register 109 LO
0x01
Register 110 HI
0x00
Register 110 LO
0x01
Field
Value
Address
0x01
Function code
0x04
Start address HI
0x10
Start address LO
0x10
Quantity HI
0x00
Quantity LO
0x03
Field
Value
Address
0x01
Function code
0x04
Byte count
0x06
Register 4113 HI
0x22
Register 4113 LO
0x22
Register 4114 HI
0x22
Register 4114 LO
0x22
Register 4115 HI
0x22
Register 4115 LO
0x22
Field
Value
Address
0x01
Function code
0x06
Address HI
0x10
Address LO
0x00
Value HI
0xAF
Value LO
0xFE