134
Rockwell Automation Publication 5069-UM003B-EN-P - January 2020
Appendix B
Modbus Command Codes
Because the slave interface device is serviced at the end of a controller's scan, the
data reflect input status at the end of the scan. Some slaves limit the quantity of
inputs provided each scan; thus, for large coil quantities, multiple PC
transactions must be made using coil status for sequential scans.
The status of inputs 10197…10204 is shown as AC (HEX) = 10101 1100
(binary). Reading left to right, this show that inputs 10204, 10202, and 10199
are all on. The other input data bytes are decoded similar.
Due to the quantity of input statuses that are requested, the last data field that is
shown as 35 HEX = 0011 0101 (binary) contains the status of only 6 inputs
(10213…102180) instead of 8 inputs. The two left-most bits are provided as
zeros to fill the 8-bit format.
Read Holding Registers (Function Code 03)
Query
This function allows you to retrieve the contents of holding registers 4xxxx
(Modbus 4x range) in the addressed slave. The registers can store the numerical
values of associated timers and counters that can be driven to external devices.
The addressing allows retrieving up to 125 registers at each request; however, the
specific slave device can have restrictions that lower this maximum quantity. The
registers are numbered form zero (40001 = zero, 40002 = one, and so on). The
broadcast mode is not allowed.
The following example reads registers 40108…40110 (three registers) from slave
number 11.
Node Address
Function Code
Byte Count
Data Discrete Input
10197…10204
Data Discrete Input
10205…10212
Data Discrete Input
10213…10218
Error Check Field
(2 bytes)
0B
02
03
AC
DB
35
CRC
TIP
This is the structure of the message being sent out to the Modbus network.
The following byte values are in hexadecimal display.
Node Address
Function Code
Data Start Registers
High
Data Start Registers
Low
Data Number of
Registers High
Data Number of
Registers Low
Error Check Field
(2 bytes)
0B
02
00
6B
00
03
CRC
