1.

01 (0x01) Read Coils

This function code is used to read from 1 to 2000 contiguous status of coils in a remote device. The Request PDU
specifies the starting address, i.e. the address of the first coil specified, and the number of coils. In the PDU Coils are
addressed starting at zero. Therefore coils numbered 1-16 are addressed as 0-15.
The coils in the response message are packed as one coil per bit of the data field. Status is indicated as 1= ON and
0= OFF. The LSB of the first data byte contains the output addressed in the query. The other coils follow toward the
high order end of this byte, and from low order to high order in subsequent bytes.
If the returned output quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with
zeros (toward the high order end of the byte). The Byte Count field specifies the quantity of complete bytes of data.
Request
Function code
Starting Address
Quantity of coils

1 Byte
2 Bytes
2 Bytes

0x01
0x0000 to 0xFFFF
1 to 2000 (0x7D0)

1 Byte
1 Byte
n Byte

0x01
N*
n = N or N+1

Response
Function code
Byte count
Coil Status

*N = Quantity of Outputs / 8, if the remainder is different of 0 N = N+1 Error

Function code
Exception code

1 Byte
1 Byte

Function code + 0x80

01 or 02 or 03 or 04

Here is an example of a request to read discrete outputs 2038:

Request
Field Name
Function
Starting Address Hi
Starting Address Lo
Quantity of Outputs Hi
Quantity of Outputs Lo

Response
(Hex)
01
00
13
00
13

Field Name
Function
Byte Count
Outputs status 27-20
Outputs status 35-28
Outputs status 38-36

(Hex)
01
03
CD
6B
05

The status of outputs 2720 is shown as the byte value CD hex, or binary 1100 1101. Output 27 is the MSB of this
byte, and output 20 is the LSB.
By convention, bits within a byte are shown with the MSB to the left, and the LSB to the right. Thus the outputs in the
first byte are 27 through 20, from left to right. The next byte has outputs 35 through 28, left to right. As the bits are
transmitted serially, they flow from LSB to MSB: 20 . . . 27, 28 . . . 35, and so on.
In the last data byte, the status of outputs 38-36 is shown as the byte value 05 hex, or binary 0000 0101. Output 38 is
in the sixth bit position from the left, and output 36 is the LSB of this byte. The five remaining high order bits are zero
filled.
1.2

02 (0x02) Read Discrete Inputs

This function code is used to read from 1 to 2000 contiguous status of discrete inputs in a remote device. The
Request PDU specifies the starting address, i.e. the address of the first input specified, and the number of inputs. In
the PDU Discrete Inputs are addressed starting at zero. Therefore Discrete inputs numbered 1-16 are addressed as
0-15.
The discrete inputs in the response message are packed as one input per bit of the data field. Status is indicated as
1= ON; 0= OFF. The LSB of the first data byte contains the input addressed in the query. The other inputs follow
toward the high order end of this byte, and from low order to high order in subsequent bytes.
If the returned input quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with
zeros (toward the high order end of the byte). The Byte Count field specifies the quantity of complete bytes of data.
Request
Function code

1 Byte

0x02

Starting Address

2 Bytes

0x0000 to 0xFFFF

Quantity of Inputs

2 Bytes

1 to 2000 (0x7D0)

Response

Function code

1 Byte

0x02

Byte count

1 Byte

N*

Input Status
N* x 1 Byte
*N = Quantity of Inputs / 8 if the remainder is different of 0 N = N+1 Error
Error code

1 Byte

0x82

Exception code

1 Byte

01 or 02 or 03 or 04

Here is an example of a request to read discrete inputs 197 218:

Request
Field Name
Function
Starting Address Hi
Starting Address Lo
Quantity of Inputs Hi
Quantity of Inputs Lo

Response
(Hex)
02
00
C4
00
16

Field Name
Function
Byte Count
Inputs Status 204-197
Inputs Status 212-205
Inputs Status 218-213

(Hex)
02
03
AC
DB
35

The status of discrete inputs 204197 is shown as the byte value AC hex, or binary 1010 1100. Input 204 is the MSB
of this byte, and input 197 is the LSB.
The status of discrete inputs 218213 is shown as the byte value 35 hex, or binary 0011 0101. Input 218 is in the third
bit position from the left, and input 213 is the LSB.

1.3

03 (0x03) Read Holding Registers

This function code is used to read the contents of a contiguous block of holding registers in a remote device. The
Request PDU specifies the starting register address and the number of registers. In the PDU Registers are addressed
starting at zero. Therefore registers numbered 1-16 are addressed as 0-15.
The register data in the response message are packed as two bytes per register, with the binary contents right
justified within each byte. For each register, the first byte contains the high order bits and the second contains the low
order bits.
Request
Function code
Starting Address
Quantity of Registers

1 Byte
2 Bytes
2 Bytes

0x03
0x0000 to 0xFFFF
1 to 125 (0x7D)

1 Byte
1 Byte
N* x 2 Bytes

0x03
2 x N*

Response
Function code
Byte count
Register value

*N = Quantity of Registers Error

Error code
Exception code

1 Byte
1 Byte

0x83
01 or 02 or 03 or 04

Here is an example of a request to read registers 108 110:

Request
Field Name
Function
Starting Address Hi
Starting Address Lo
No. of Registers Hi
No. of Registers Lo

Response
(Hex)
03
00
6B
00
03

Field Name
Function
Byte Count
Register value Hi (108)
Register value Lo (108)
Register value Hi (109)
Register value Lo (109)
Register value Hi (110)
Register value Lo (110)

(Hex)
03
06
02
2B
00
00
00
64

The contents of register 108 are shown as the two byte values of 02 2B hex, or 555 decimal. The contents of registers
109110 are 00 00 and 00 64 hex, or 0 and 100 decimal, respectively.

1.4

04 (0x04) Read Input Registers

This function code is used to read from 1 to 125 contiguous input registers in a remote device. The Request PDU
specifies the starting register address and the number of registers. In the PDU Registers are addressed starting at
zero. Therefore input registers numbered 1-16 are addressed as 0-15.
The register data in the response message are packed as two bytes per register, with the binary contents right
justified within each byte. For each register, the first byte contains the high order bits and the second contains the low
order bits. Request
Function code
Starting Address
Quantity of Input Registers

1 Byte
2 Bytes
2 Bytes

0x04
0x0000 to 0xFFFF
0x0001 to 0x007D

1 Byte
1 Byte
N* x 2 Bytes

0x04
2 x N*

Response
Function code
Byte count
Input Registers

*N = Quantity of Input Registers

Error
Error code
Exception code

1 Byte
1 Byte

0x84
01 or 02 or 03 or 04

Here is an example of a request to read input register 9:

Request
Field Name
Function
Starting Address Hi
Starting Address Lo
Quantity of Input Reg. Hi Quantity
of Input Reg. Lo

Response
(Hex)
04
00
08
00
01

Field Name
Function
Byte Count
Input Reg. 9 Hi
Input Reg. 9 Lo

(Hex)
04
02
00
0A

The contents of input register 9 are shown as the two byte values of 00 0A hex, or 10 decimal.

1.5

05 (0x05) Write Single Coil

This function code is used to write a single output to either ON or OFF in a remote device.
The requested ON/OFF state is specified by a constant in the request data field. A value of FF 00 hex requests the
output to be ON. A value of 00 00 requests it to be OFF. All other values are illegal and will not affect the output.
The Request PDU specifies the address of the coil to be forced. Coils are addressed starting at zero. Therefore coil
numbered 1 is addressed as 0. The requested ON/OFF state is specified by a constant in the Coil Value field. A value
of 0XFF00 requests the coil to be ON. A value of 0X0000 requests the coil to be off. All other values are illegal and will
not affect the coil.
The normal response is an echo of the request, returned after the coil state has been written. Request
Function code
Output Address
Output Value

1 Byte
2 Bytes
2 Bytes

0x05
0x0000 to 0xFFFF
0x0000 or 0xFF00

Function code
Output Address
Output Value

1 Byte
2 Bytes
2 Bytes

0x05
0x0000 to 0xFFFF
0x0000 or 0xFF00

Error code
Exception code

1 Byte
1 Byte

0x85
01 or 02 or 03 or 04

Response

Error

Here is an example of a request to write Coil 173 ON:

Request
Field Name
Function
Output Address Hi
Output Address Lo
Output Value Hi

Response
(Hex)
05
00
AC
FF

Field Name
Function
Output Address Hi
Output Address Lo
Output Value Hi

(Hex)
05
00
AC
FF

Output Value Lo

1.6

00

Output Value Lo

00

06 (0x06) Write Single Register

This function code is used to write a single holding register in a remote device.
The Request PDU specifies the address of the register to be written. Registers are addressed starting at zero.
Therefore register numbered 1 is addressed as 0.
The normal response is an echo of the request, returned after the register contents have been written.
Request
Function code
Register Address
Register Value

1 Byte
2 Bytes
2 Bytes

0x06
0x0000 to 0xFFFF
0x0000 to 0xFFFF

Function code
Register Address
Register Value

1 Byte
2 Bytes
2 Bytes

0x06
0x0000 to 0xFFFF
0x0000 to 0xFFFF

Error code
Exception code

1 Byte
1 Byte

0x86
01 or 02 or 03 or 04

Response

Error

Here is an example of a request to write register 2 to 00 03 hex:

Request
Field Name
Function
Register Address Hi
Register Address Lo Register
Value Hi
Register Value Lo

1.7

Response
(Hex)
06
00
01
00
03

Field Name
Function
Register Address Hi
Register Address Lo Register
Value Hi
Register Value Lo

(Hex)
06
00
01
00
03

15 (0x0F) Write Multiple Coils

This function code is used to force each coil in a sequence of coils to either ON or OFF in a remote device. The
Request PDU specifies the coil references to be forced. Coils are addressed starting at zero. Therefore coil
numbered 1 is addressed as 0.
The requested ON/OFF states are specified by contents of the request data field. A logical '1' in a bit position of the
field requests the corresponding output to be ON. A logical '0' requests it to be OFF.
The normal response returns the function code, starting address, and quantity of coils forced.
Request PDU
Function code
Starting Address
Quantity of Outputs
Byte Count
Outputs Value

1 Byte
2 Bytes
2 Bytes
1 Byte
N* x 1 Byte

0x0F
0x0000 to 0xFFFF
0x0001 to 0x07B0
N*

*N = Quantity of Outputs / 8, if the remainder is different of 0 N = N+1

Response PDU
Function code
Starting Address
Quantity of Outputs

1 Byte
2 Bytes
2 Bytes

0x0F
0x0000 to 0xFFFF
0x0001 to 0x07B0

Error code
Exception code

1 Byte
1 Byte

0x8F
01 or 02 or 03 or 04

Error

Here is an example of a request to write a series of 10 coils starting at coil 20:

The request data contents are two bytes: CD 01 hex (1100 1101 0000 0001 binary). The binary bits correspond to the
outputs in the following way:
Bit:
1
1
0
0
1
1
0
1
0
0
0
0
0
0
0
1
Output:
27 26 25 24 23 22 21 20

29 28

The first byte transmitted (CD hex) addresses outputs 27-20, with the least significant bit addressing the lowest output
(20) in this set.
The next byte transmitted (01 hex) addresses outputs 29-28, with the least significant bit addressing the lowest output
(28) in this set. Unused bits in the last data byte should be zerofilled.
Request
Field Name
Function
Starting Address Hi
Starting Address Lo
Quantity of Outputs Hi
Quantity of Outputs Lo
Byte Count
Outputs Value Hi
Outputs Value Lo

1.8

Response
(Hex)
0F
00
13
00
0A
02

Field Name
Function
Starting Address Hi
Starting Address Lo
Quantity of Outputs Hi
Quantity of Outputs Lo

(Hex)
0F
00
13
00
0A

CD
01

16 (0x10) Write Multiple registers

This function code is used to write a block of contiguous registers (1 to 123 registers) in a remote device.
The requested written values are specified in the request data field. Data is packed as two bytes per register.
The normal response returns the function code, starting address, and quantity of registers written.
Request
Function code
Starting Address
Quantity of Registers
Byte Count
Registers Value

1 Byte
2 Bytes
2 Bytes
1 Byte
N* x 2 Bytes

0x10
0x0000 to 0xFFFF
0x0001 to 0x007B
2 x N*
value

Function code
Starting Address
Quantity of Registers

1 Byte
2 Bytes
2 Bytes

0x10
0x0000 to 0xFFFF
1 to 123 (0x7B)

Error code

1 Byte

0x90

Exception code

1 Byte

01 or 02 or 03 or 04

*N = Quantity of Registers
Response

Error

Here is an example of a request to write two registers starting at 2 to 00 0A and 01 02 hex:

Request
Field Name
Function
Starting Address Hi
Starting Address Lo
Quantity of Registers Hi
Quantity of Registers Lo
Byte Count
Registers Value Hi
Registers Value Lo
Registers Value Hi
Registers Value Lo

Response
(Hex)
10
00
01
00
02
04

Field Name
Function
Starting Address Hi
Starting Address Lo
Quantity of Registers Hi
Quantity of Registers Lo

(Hex)
10
00
01
00
02

00
0A
01
02

1.9

23 (0x17) Read/Write Multiple registers

This function code performs a combination of one read operation and one write operation in a single MODBUS
transaction. The write operation is performed before the read.
Holding registers are addressed starting at zero. Therefore holding registers 1-16 are addressed in the PDU as 0-15.
The request specifies the starting address and number of holding registers to be read as well as the starting address,
number of holding registers, and the data to be written. The byte count specifies the number of bytes to follow in the
write data field.
The normal response contains the data from the group of registers that were read. The byte count field specifies the
quantity of bytes to follow in the read data field.

Request
Function code
Read Starting Address
Quantity to Read
Write Starting Address
Quantity to Write
Write Byte Count
Write Registers Value

1 Byte
2 Bytes
2 Bytes
2 Bytes
2 Bytes
1 Byte
N*x 2 Bytes

0x17
0x0000 to 0xFFFF
0x0001 to 0x007D
0x0000 to 0xFFFF
0x0001 to 0X0079
2 x N*

*N = Quantity to Write
Response
Function code
Byte Count
Read Registers value

1 Byte
1 Byte
N'* x 2 Bytes

0x17
2 x N'*

*N' = Quantity to Read

Error
Error code
Exception code

1 Byte
1 Byte

0x97
01 or 02 or 03 or 04

Here is an example of a request to read six registers starting at register 4, and to write three registers starting at
register 15:
Request
Field Name
Function
Read Starting Address Hi
Read Starting Address Lo
Quantity to Read Hi
Quantity to Read Lo
Write Starting Address Hi
Write Starting address Lo
Quantity to Write Hi
Quantity to Write Lo
Write Byte Count
Write Registers Value Hi
Write Registers Value Lo
Write Registers Value Hi
Write Registers Value Lo
Write Registers Value Hi
Write Registers Value Lo

Response
(Hex)
17
00
03
00
06
00
0E
00
03
06
00
FF
00
FF
00
FF

Field Name
Function
Byte Count
Read Registers value Hi
Read Registers value Lo
Read Registers value Hi
Read Registers value Lo
Read Registers value Hi
Read Registers value Lo
Read Registers value Hi
Read Registers value Lo
Read Registers value Hi
Read Registers value Lo
Read Registers value Hi
Read Registers value Lo

(Hex)
17
0C
00
FE
0A
CD
00
01
00
03
00
0D
00
FF