Application protocol

Modbus function codes, with an FC03 example

A function code tells a Modbus server what operation the client requests. The code is followed by operation-specific fields in the request and result-specific fields in the response.

Common function codes

Common function codes from the Modbus application protocol
Code	Operation	Data model
`01`	Read Coils	Coils, bit values
`02`	Read Discrete Inputs	Discrete inputs, bit values
`03`	Read Holding Registers	Holding registers, 16-bit values
`04`	Read Input Registers	Input registers, 16-bit values
`05`	Write Single Coil	One coil
`06`	Write Single Register	One holding register
`15`	Write Multiple Coils	A range of coils
`16`	Write Multiple Registers	A range of holding registers

Each function operates on a defined data area. For example, FC03 reads holding registers; it does not read input registers. A device may support only a subset, so check its documentation and the response from the device.

FC03 request

The FC03 request PDU contains the function code, a starting address and a quantity. The start address and quantity are each two bytes, transmitted most-significant byte first. A request may ask for 1 to 125 contiguous holding registers.

03 00 00 00 02
│  └────┘ └────┘
│  start   quantity
function   address   2 registers

This PDU requests two holding registers beginning at PDU address 0. A complete RTU ADU also has a unit address before the PDU and a CRC after it.

FC03 normal response

The normal response contains the function code, a byte count and the register data. Each register contributes two bytes, most-significant byte first. For example:

03 04 02 2B 00 7B
│  │  └─────┘ └─────┘
│  │  value 1 value 2
│  byte count: 4 bytes
function: 03

The two returned 16-bit values are 555 (0x022B) and 123 (0x007B). This is an FC03 response PDU, without RTU address and CRC.

The maximum FC03 response data is 250 bytes because 125 registers are returned at two bytes each. A client should validate that the response function and byte count match its request before using the values.

Exception response

If the server cannot perform a request, it can return an exception response. The response function code is the requested function with its high bit set. For FC03, that is 83. The following byte is the exception code, for example 02 for Illegal Data Address.

Frequently encountered exception codes
Code	Name	Interpretation
`01`	Illegal Function	The server does not support the requested function.
`02`	Illegal Data Address	The requested address or range is not valid for that operation.
`03`	Illegal Data Value	A request field contains a value the server rejects.
`04`	Server Device Failure	The server encountered an error while processing the request.

An exception is a valid protocol response, not the same as a timeout or CRC failure. Address notation is another frequent source of mismatches; see register addressing.

Sources

Modbus Application Protocol Specification V1.1b3, sections 6.1-6.6 and 7.
Modbus Organization specifications.