Modbus Addressing / Standard Modbus Data Address String / Modbus Function Codes

 

In a few words

• 0x01 Read Coils: Read the state of relays or digital outputs
• 0x02 Read Discrete Inputs: Read digital input signals such as push buttons
• 0x03 Read Holding Registers: Read process parameters or setpoints stored in holding registers
• 0x04 Read Input Registers: Read analog input values, such as sensor readings from a PLC
• 0x05 Write Single Coil: Set the state of a single digital output (ON/OFF), such as activating a relay
• 0x0F Write Multiple Coils: Set the states of multiple digital outputs (ON/OFF) in a single request
• 0x06 Write Single Holding Register: Write a single 16-bit value to a holding register, such as setting a parameter or command
• 0x10 Write Multiple Holding Registers: Write multiple 16-bit values to consecutive holding registers, such as multiple setpoints at once or updating a string

 

0x, 1x, 3x, 4x and FC01, FC02, FCxx,… I’m lost !

0x 1x 3x 4x do not define the Modbus function code. They only indicate the data area type : Coils, discrete inputs, holding register,…

The function code (FCxx) defines the operation performed on that data area.

Common logical mapping between 0x, 1x,.. and FC01, FC02,..

0x Coils
Read with FC01
Write with FC05 or FC15

1x Discrete Inputs
Read with FC02

3x Input Registers
Read with FC04

4x Holding Registers
Read with FC03
Write with FC06 or FC16

Important point : In a Modbus frame, there is never 0x 1x 3x or 4x. The frame contains only the function code the starting address the quantity.

The 0x 1x 3x 4x prefixes are a documentation and software convention, not a protocol rule.

Details

Coils = digital outputs equivalent to a coil in a relay scheme.
The Modbus data type is 0.
It is often noted as 0x, which makes addressing easier.
Data type 0x is available for reading and writing.
For reading, the function code 1 (FC01 and 01h in hexadecimal) is used.
To write such data, function code 5 (FC05 and 05h) is used.
For writing several consecutive data, function code 15 (0Fh) is used.
This data type is noted in different ways:
%M1, 00001, 000001 (for the first variable)…
According to the interpretation of the standard, the notation should be 0x0000 (up to 0xFFFF), in hexadecimal.

Input Status = digital inputs equivalent to a contact in a relay scheme.
The Modbus data type is 1.
It is often referred to as 1x, which makes addressing easier.
Data type 1x is available for reading only.
For reading, function code 2 (FC02 and 02h) is used.
This data type is noted in different ways:
%i1, 10001, 100001..,
The notation should be 1×0000 (up to 1xFFFF).

Input Registers = digital inputs equivalent to a register (hence the name), or a non-binary value (a 16-bit word).
At that time the choice was not like nowadays…
The Modbus data type is 3.
It is often referred to as 3x, which makes addressing easier.
Data type 3x is available for reading only.
For reading, function code 4 (FC04 and 04h) is used.
This data type is noted in different ways:
%IW1, 30001, 300001..,
The notation should be 3×0000 (up to 3xFFFF).

Holding Registers = digital outputs equivalent to a register (hence the name), or a non-binary value (a 16 bit word).
The Modbus data type is 4.
It is often referred to as 4x, which makes addressing easier.
Data type 4x is available for reading and writing
For reading, function code 3 (FC03 and 03h) is used.
To write data of this type, function code 6 (FC06 and 06h) is used.
For writing several consecutive data, function code 16 (10h) is used.
This type of data is noted in different ways:
%MW1, 40001, 400001..,
The notation should be 4×0000 (up to 4xFFFF).

There is often confusion between the notation (which is virtual) and the address.
The fact of using the address in hexadecimal, allows to get rid of the different notations as described above.
Indeed, for small applications, there will be no problem, the decimal value of the address is not higher than 9999.
But when you go to larger databases, it’s a mess

49999 is for example the 10000th word of type 4, what if the 10001st word should be used? In general, this is noted 410000 (but you change the scale, it is not practical), it is often e rit 50000 (but this is not very logical, the type is 4, not 5).
Some people also write it as 4×9999, then 4×10000…
By writing in hexadecimal, you can use all the available addresses and the notation is more readable.
The 10000th word is 4×2710, the next will be 4×2711… The conversion is easy with the Windows calculator, or in the PLC itself.