Development Protocol
Function Code Introduction
| Function Code | Description |
|---|---|
| 03 | Read Holding Registers |
| 04 | Read Input Registers |
| 06 | Write Single Holding Register |
| 10 | Write Multiple Holding Registers |
Modbus Data Types
The Modbus protocol defines 4 types of data areas, usually represented by 0x, 1x, 3x, and 4x for different address types.
| Address Type | Address Range | Basic Storage Unit | Read/Write Attribute | Function Code |
|---|---|---|---|---|
| Coils | 0x0000-0xFFFF | 1 bit | Read/Write | 01H, 05H, 0FH |
| Discrete Inputs | 1x0000-1xFFFF | 1 bit | Read-only | 02H |
| Input Registers | 3x0000-3xFFFF | 16 bit / Register | Read-only | 04H |
| Holding Registers | 4x0000-4xFFFF | 16 bit / Register | Read/Write | 03H, 06H, 10H |
The above is the standard Modbus data type classification. A device does not necessarily implement all 4 data areas at the same time, nor does it necessarily support all the function codes listed in the table.
Additional Notes on Register-Type Data
In Modbus, the basic width of each register is 16 bit. Actual data can occupy one or more consecutive registers:
- 16-bit data: occupies 1 register
- 32 bit data: occupies 2 consecutive registers
For example, 32-bit big-endian data 0x12345678:
| Register | Data |
|---|---|
| Register N | 0x1234 |
| Register N + 1 | 0x5678 |
That is, the byte order is 12 34 56 78.
The specific data length, data type, and byte order / word order of multi-register data should be based on the register description of the corresponding device.
Register Address Description
| Address (HEX) | Register Content | Register Value | Access | Modbus Function Code |
|---|---|---|---|---|
| 3x0000 3x0001 | Channel 1 Frequency High 16 bits Channel 1 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x0002 | Channel 1 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 3x0003 3x0004 | Channel 2 Frequency High 16 bits Channel 2 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x0005 | Channel 2 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 3x0006 3x0007 | Channel 3 Frequency High 16 bits Channel 3 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x0008 | Channel 3 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 3x0009 3x000A | Channel 4 Frequency High 16 bits Channel 4 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x000B | Channel 4 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 3x000C 3x000D | Channel 5 Frequency High 16 bits Channel 5 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x000E | Channel 5 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 3x000F 3x0010 | Channel 6 Frequency High 16 bits Channel 6 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x0011 | Channel 6 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 3x0012 3x0013 | Channel 7 Frequency High 16 bits Channel 7 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x0014 | Channel 7 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 3x0015 3x0016 | Channel 8 Frequency High 16 bits Channel 8 Frequency Low 16 bits | Unsigned 32‑bit value, unit 0.01 Hz, range: 40000 - 5000000, i.e., 400 Hz - 50 kHz | Read | 0x04 |
| 3x0017 | Channel 8 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0-10000, i.e., 0-100% | Read | 0x04 |
| 4x2000 | Serial Port Parameters | High byte: parity mode: 0x00-0x02 Low byte: baud rate mode: 0x00-0x07 | Read/Write | 0x03, 0x06 |
| 4x4000 | Device Address | Stores Modbus address directly Device address: 0x0001-0x00FF | Read/Write | 0x03, 0x06 |
| 4x8000 | Software Version | Convert to decimal, then shift decimal point two places left for version 0x0064 = 100 = V1.00 | Read | 0x03 |
Command Operation Introduction
Read Pulse Input Command
Send: 01 04 00 00 00 03 B0 0B
| Field | Description | Note |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 04 | 04 Command | Read Input Registers |
| 00 00 | Register Start Address | Starting register for channel read. Each channel occupies three registers: first two store frequency, last stores duty cycle |
| 00 03 | Number of Registers | Number of registers to read, cannot exceed maximum register count |
| B0 0B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 04 06 00 3B 83 A5 03 01 7D C1
| Field | Description | Note |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 04 | 04 Command | Read Input Registers |
| 06 | Byte Count | Data length |
| 3B 83 A5 03 03 01 | Register Data Frequency High 16-bit Frequency Low 16-bit Duty Cycle | Each channel occupies three registers: first two store frequency, last stores duty cycle Frequency is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 40000-5000000 (400 Hz - 50 kHz) Duty cycle: unsigned 16‑bit, unit 0.01%, range 0-10000 (0-100%) |
| 7D C1 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Read channels 1-8 : 01 04 00 00 00 18 F0 00
Read channel 2 : 01 04 00 03 00 03 40 0B
Read channels 3-5 : 01 04 00 06 00 09 D0 0D
Read channel 1 : 01 04 00 00 00 03 B0 0B
Return: 01 04 06 00 00 9C 40 13 88 42 41 //Channel 1, 400 Hz, 50% duty cycle
Set Baud Rate Command
Send Code: 00 06 20 00 00 05 43 D8
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 20 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 | Parity Mode | 0x00 for no parity, 0x01 for odd parity, 0x02 for even parity |
| 05 | Baud Rate Value | Baud rate value mapping: 0x00: 4800 0x01: 9600 0x02: 19200 0x03: 38400 0x04: 57600 0x05: 115200 0x06: 128000 0x07: 256000 |
| 43 D8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 00 06 20 00 00 05 43 D8
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 20 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 | Parity Mode | 0x00 for no parity, 0x01 for odd parity, 0x02 for even parity |
| 05 | Baud Rate | Baud rate value mapping: 0x00: 4800 0x01: 9600 0x02: 19200 0x03: 38400 0x04: 57600 0x05: 115200 0x06: 128000 0x07: 256000 |
| 43 D8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set baud rate 4800 : 00 06 20 00 00 00 83 DB
Set baud rate 9600 : 00 06 20 00 00 01 42 1B
Set baud rate 115200 : 00 06 20 00 00 05 43 D8
Set Device Address Command
Send Code: 00 06 40 00 00 01 5C 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 40 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 01 | Device Address | Device address set, 0x0001-0x00FF |
| 5C 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 00 06 40 00 00 01 5C 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 40 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 01 | Device Address | Device address set, 0x0001-0x00FF |
| 5C 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set device address to 0x01 : 00 06 40 00 00 01 5C 1B
Set device address to 0x02 : 00 06 40 00 00 02 1C 1A
Set device address to 0x03 : 00 06 40 00 00 03 DD DA
Read Device Address Command
Send code: 00 03 40 00 00 01 90 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read device address command |
| 40 00 | Command Register | 0x4000 for reading device address, 0x8000 for reading software version |
| 00 01 | Byte Count | Fixed 0x0001 |
| 90 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return code: 01 03 02 00 01 79 84
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read software version, read device address command |
| 02 | Byte Count | Returned byte count |
| 00 01 | Device Address | Device address set, 0x0001-0x00FF |
| 79 84 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 2
Send Code: 00 03 40 00 00 01 90 1B
Return code : 02 03 02 00 02 7D 85 //Address 0x02
Read Software Version Command
Send Code: 00 03 80 00 00 01 AC 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read software version, read device address command |
| 80 00 | Command Register | 0x4000 for reading device address, 0x8000 for reading software version |
| 00 01 | Byte Count | Fixed 0x0001 |
| AC 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 03 02 00 64 B9 AF
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read software version, read device address command |
| 02 | Byte Count | Returned byte count |
| 00 64 | Software Version | Convert to decimal, then shift decimal point two places left for version 0x0064 = 100 = V1.00 |
| B9 AF | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Send Code: 00 03 80 00 00 01 AC 1B
Return Code: 01 03 02 00 64 B9 AF //0x0064 = 100 =V1.00
Exception Function Codes
If the received command is incorrect or an exception occurs, the device will return an exception response. The exception response format is as follows:
Return Code: 01 85 03 02 91
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 85 | Exception Function Code | Exception function code = Request function code + 0x80 |
| 03 | Byte Count | Exception code |
| 02 91 | CRC16 | CRC16 checksum of the first 6 bytes of data |
The exception code is a single-byte value indicating the type of error. Several common exception codes defined by the Modbus protocol:
| Exception Code | Name | Description |
|---|---|---|
| 0x01 | Illegal Function | The requested function code is not supported |
| 0x02 | Illegal Data Address | The requested data address is incorrect |
| 0x03 | Illegal Data Value | The requested data value or operation cannot be performed |
| 0x04 | Server Failure | Server device failure |
| 0x05 | Acknowledge | Request received and processing |
| 0x06 | Device Busy | Device is busy and cannot execute the requested operation |