Modbus TCP RTU protocol chart

MODBUS TCP

Read register request	Serial number	significance	Bytes taken	Byte storage format
	1	Transaction ID	2 Bytes	High byte first
	2	Protocol identification	2 Bytes	High byte first
	3	length	2 Bytes	High byte first
	4	element ID	1 Bytes	0x00-0xff
	5	Function code	1 Bytes	0x03
	6	Start register address	2 Bytes	High byte first
	7	Number of registers	2 Bytes	High byte first

Read register Respond	Serial number	significance	Bytes taken	Byte storage format
	1	Transaction ID	2 Bytes	High byte first
	2	Protocol identification	2 Bytes	High byte first
	3	length	2 Bytes	High byte first
	4	element ID	1 Bytes	0x00-0xff
	5	Function code	1 Bytes	0x03
	6	Data length	1 Bytes	Number of registers *2
	7	data	Number of registers *2 Bytes	Every register High byte first

Write a single register request	Serial number	significance	Bytes taken	Byte storage format
	1	Transaction ID	2 Bytes	High byte first
	2	Protocol identification	2 Bytes	High byte first
	3	length	2 Bytes	High byte first
	4	element ID	1 Bytes	0x00-0xff
	5	Function code	1 Bytes	0x10
	6	Register address	2 Bytes	High byte first
	7	Register value	2 Bytes	High byte first

Write a single register Respond	Serial number	significance	Bytes taken	Byte storage format
	1	Transaction ID	2 Bytes	High byte first
	2	Protocol identification	2 Bytes	High byte first
	3	length	2 Bytes	High byte first
	4	element ID	1 Bytes	0x00-0xff
	5	Function code	1 Bytes	0x10
	6	Register address	2 Bytes	High byte first
	7	Register value	2 Bytes	High byte first

Write more than one register request	Serial number	significance	Bytes taken	Byte storage format
	1	Transaction ID	2 Bytes	High byte first
	2	Protocol identification	2 Bytes	High byte first
	3	length	2 Bytes	High byte first
	4	element ID	1 Bytes	0x00-0xff
	5	Function code	1 Bytes	0x10
	6	Start register address	2 Bytes	High byte first
	7	Number of registers	2 Bytes	High byte first
	8	Data length	1 Bytes	Number of registers *2
	9	data	Number of registers *2 Bytes	Every register High byte first

Write more than one register Respond	Serial number	significance	Bytes taken	Byte storage format
	1	Transaction ID	2 Bytes	High byte first
	2	Protocol identification	2 Bytes	High byte first
	3	length	2 Bytes	High byte first
	4	element ID	1 Bytes	0x00-0xff
	5	Function code	1 Bytes	0x10
	6	Start register address	2 Bytes	High byte first
	7	Number of registers	2 Bytes	High byte first

Erroneous return	Serial number	significance	Bytes taken	Byte storage format
	1	Transaction ID	2 Bytes	High byte first
	2	Protocol identification	2 Bytes	High byte first
	3	length	2 Bytes	High byte first
	4	element ID	1 Bytes	0x00-0xff
	5	Function code	1 Bytes	Request function code +0x80
	6	Error code	1 Bytes	See the table for its code

Error code	Error code	significance
	0x01	This function code is not supported
	0x02	Transboundary
	0x03	The number of registers is out of range
	0x04	Read write error

MODBUS RTU

Read register request	Serial number	significance	Bytes taken	Byte storage format
	1	Slave device address	1 Bytes	0x00-0xff
	2	Function code	1 Bytes	0x03
	3	Start register address	2 Bytes	High byte first
	4	Number of registers	2 Bytes	High byte first
	5	CRC Check code	2 Bytes	Low bytes first

Read register Respond	Serial number	significance	Bytes taken	Byte storage format
	1	Slave device address	1 Bytes	0x00-0xff
	2	Function code	1 Bytes	0x03
	3	Data length	1 Bytes	Number of registers *2
	4	data	Number of registers *2 Bytes	Every register High byte first
	5	CRC Check code	2 Bytes	Low bytes first

Write a single register request	Serial number	significance	Bytes taken	Byte storage format
	1	Slave device address	1 Bytes	0x00-0xff
	2	Function code	1 Bytes	0x10
	3	Start register address	2 Bytes	High byte first
	4	Register value	2 Bytes	High byte first
	5	CRC Check code	2 Bytes	Low bytes first

Write a single register Respond	Serial number	significance	Bytes taken	Byte storage format
	1	Slave device address	1 Bytes	0x00-0xff
	2	Function code	1 Bytes	0x10
	3	Start register address	2 Bytes	High byte first
	4	Register value	2 Bytes	High byte first
	5	CRC Check code	2 Bytes	Low bytes first

Write more than one register request	Serial number	significance	Bytes taken	Byte storage format
	1	Slave device address	1 Bytes	0x00-0xff
	2	Function code	1 Bytes	0x10
	3	Start register address	2 Bytes	High byte first
	4	Number of registers	2 Bytes	High byte first
	5	Data length	1 Bytes	Number of registers *2
	6	data	Number of registers *2 Bytes	Every register High byte first
	7	CRC Check code	2 Bytes	Low bytes first

Write more than one register Respond	Serial number	significance	Bytes taken	Byte storage format
	1	Slave device address	1 Bytes	0x00-0xff
	2	Function code	1 Bytes	0x10
	3	Start register address	2 Bytes	High byte first
	4	Number of registers	2 Bytes	High byte first
	5	CRC Check code	2 Bytes	Low bytes first

Erroneous return	Serial number	significance	Bytes taken	Byte storage format
	1	Slave device address	1 Bytes	0x00-0xff
	2	Function code	1 Bytes	Request function code +0x80
	3	Error code	1 Bytes	See the table for its code
	4	CRC Check code	2 Bytes	Low bytes first

Error code	Error code	significance
	0x01	This function code is not supported
	0x02	Transboundary
	0x03	The number of registers is out of range
	0x04	Read write error

MODBUS RTU Function code

below “ coil ”,“ register ” In fact, they are “ Bit variable ”,“16 Bit variable ”.

Function code	significance
0x01	Read the coil
0x02	Read discrete input
0x03	Read holding register
0x04	Read input register
0x05	Write a single coil
0x06	Write a single register
0x0F	Write multiple coils
0x10	Write multiple registers

Modbus RTU And Modbus TCP Read instruction comparison

	MBAP Headline	Address code	function code	register Address	register Number	CRC check
RTU	nothing	01	03	01 8E	00 04	25 DE
TCP	00 00 00 00 00 06 00	nothing	03	01 8E	00 04	nothing

The meaning of the directive ： The slave address code is 01（TCP The protocol unit flag is 00） Module 0x18E(01 8E) Register address start reading （03） four （00 04） register .

Modbus RTU And Modbus TCP Write instruction comparison

	MBAP Headline	Address code	function code	register Address	register Number	data length	Text	CRC check
RTU	nothing	01	10	01 8E	00 01	02	00 00	A8 7E
TCP	00 00 00 00 00 09 00	nothing	10	01 8E	00 01	02	00 00	nothing

The meaning of the directive ： The slave address code is 01（TCP The protocol unit flag is 00） Module 0x18E(01 8E) Register address start writing （10） One （00 01） register , The specific data length is 2 Bytes （02）, The content of data body is 00 00（00 00）.