Modbus RTU Protocol Basics

Message Structure

Here is an example Modbus RTU request message.

11 03 006B 0003 7687

The message structure depends on the function code.
A Modbus RTU read request message is only 8 bytes and includes:

11

Slave ID: The address of the target slave.

03

Function Code: The target data table and if you want to read from or write to the table.

006B

First Register: The register number for the start of the requested data block.

0003

No. of Registers: The size of the requested data block.

7687

CRC (Cyclic Redundancy Check): Error detection suffix calculated from the previous bytes

SlaveID

The SlaveID (or Modbus slave address) is a unique 8-bit identifier (from 1 to 247) assigned to each device on a Modbus serial network (RTU or ASCII). It is the first byte in modbus RTU messages. It allows the master to identify and communicate with specific devices, as slaves only respond to requests that start with their own address.

2 byte SlaveID

Since a single byte is normally used to define the slave address and each slave on a network requires a unique address, the number of slaves on a network is limited to 256. The limit defined in the modbus specification is even lower at 247.

To get beyond this limit, a modification can be made to the protocol to use two bytes for the address. The master and the slaves would all be required to support this modification. Two byte addressing extends the limit on the number of slaves in a network to 65535.

By default, the Simply Modbus software uses 1 byte addressing. When an address greater than 255 is entered, the software automatically switches to 2 byte addressing and stays in this mode for all addresses until the 2 byte addressing is manually turned off.

Function Codes

A Modbus function code is a 1-byte code sent as the 2nd byte in a modbus RTU message. This code dictates what action a slave device should perform, such as reading registers, or writing to a coil. The most commonly used function codes are shown in these tables.

16 bit Register Function Codes

Function Code	Action
04	Read Input Registers
03	Read Holding Registers
06	Write Single Holding Register
16	Write Multiple Holding Registers

1 bit Coil Function Codes

Function Code	Action
02	Read Discrete Inputs
01	Read Coils
05	Write Single Coil
15	Write Multiple Coils

Data Tables

Modbus data tables are the structured memory spaces within a Modbus server device (e.g., PLC, sensor). The data is organized into 4 distinct tables as shown to be read or written to by a client (master).
The lists of the Register or Coil numbers and what they represent are often termed "register maps" or "memory maps".

Register/Coil Numbers (decimal)	Offset	Data Addresses (Hexadecimal)	Table Name	Data size	Function code to read	Function code to write one	Function code to write multiple
1-9999	1	0000 to 270E	Coils	1 bit	01	05	15
10001-19999	10001	0000 to 270E	Discrete Inputs	1 bit	02	read only	read only
30001-39999	30001	0000 to 270E	Input Registers	16 bit	04	read only	read only
40001-49999	40001	0000 to 270E	Holding Registers	16 bit	03	06	16

The Data Addresses in hexadecimal are used in the messages, not the Register Numbers. Therefore, the register numbers are more like names that can be referenced to a table and data address.

For example, the first Holding Register, often given the number 40001, has the Data Address 0000 in the Holding Registers Table.
The difference between these two values is the offset. Each table has a different offset as shown above.

Extended Register Addresses

Since the range of the Holding Registers is 40001 to 49999, it implies that there cannot be more than 9999 registers. Although this is usually enough for most applications, there are cases where more registers would be beneficial.

Registers 40001 to 49999 correspond to data addresses 0000 to 270E. If we utilize the remaining data addresses 270F to FFFF, over six times as many registers are available, 65536 in total. This would correspond to register numbers from 40001 to 105536.

Many modbus software drivers (for Master PCs) were written with the 40001 to 49999 limits and cannot access extended registers in slave devices. And many slave devices do not support maps using the extended registers. But on the other hand, some slave devices do support these registers and some Master software can access it, especially if custom software is written.

CRC

CRC stands for Cyclic Redundancy check. The CRC is two bytes added to the end of every modbus message for error detection. All the preceding bytes in the message are used to calculate the CRC. The receiving device also calculates the CRC and compares it to the CRC in the message from the sending device. If even one bit in the message is received incorrectly, the CRCs will not match and the message will be rejected.

Here is a spreadsheet for messages up to 16 bytes. Download CRC calculator