Development Protocol
Function Code Introduction
| Function Code | Description | |
|---|---|---|
| 01 | Read Coil Status | Read output channel status |
| 02 | Read Discrete Input Status | Read input status |
| 03 | Read Holding Registers | Read address and version |
| 05 | Write Single Coil | Write a single output channel |
| 06 | Write Single Register | Set baud rate and address |
| 0F | Write Multiple Coils | Write output channel status |
| 10 | Write Multiple Registers | Set multiple registers |
Modbus Data Types
The Modbus protocol defines 4 types of data areas, usually represented by 0x, 1x, 3x, and 4x for different address types.
| Address Type | Address Range | Basic Storage Unit | Read/Write Attribute | Function Code |
|---|---|---|---|---|
| Coils | 0x0000-0xFFFF | 1 bit | Read/Write | 01H, 05H, 0FH |
| Discrete Inputs | 1x0000-1xFFFF | 1 bit | Read-only | 02H |
| Input Registers | 3x0000-3xFFFF | 16 bit / Register | Read-only | 04H |
| Holding Registers | 4x0000-4xFFFF | 16 bit / Register | Read/Write | 03H, 06H, 10H |
The above is the standard Modbus data type classification. A device does not necessarily implement all 4 data areas at the same time, nor does it necessarily support all the function codes listed in the table.
Register Address Description
| Address (HEX) | Address Storage Content | Register Value | Access | Modbus Function Code |
|---|---|---|---|---|
| 0x0000 - 0x0007 | Output channel 1-8 address | 0xFF00: output channel on; 0x0000: output channel off; 0x5500: output channel toggle; | Read/Write | 0x01, 0x05, 0x0F |
| 0x00FF | Operate all output channels | 0xFF00: all output channels on; 0x0000: all output channels off; 0x5500: all output channels toggle; | Write | 0x05 |
| 0x0100 - 0x0107 | Output channel 1-8 toggle address | 0xFF00: output channel toggle; 0x0000: output channel unchanged; | Write | 0x05, 0x0F |
| 0x01FF | Operate all output channel toggle | 0xFF00: all output channels toggle; 0x0000: all output channels unchanged; | Write | 0x05 |
| 0x0200 - 0x0207 | Output channel 1-8 flash-on | Delay time = data * 100 ms Value: 0x0007, delay: 7 * 100 ms = 700 ms | Write | 0x05 |
| 0x0400 - 0x0407 | Output channel 1-8 flash-off | Delay time = data * 100 ms Value: 0x0007, delay: 7 * 100 ms = 700 ms | Write | 0x05 |
| 1x0000 - 1x0007 | Channel 1-8 input address | Indicates input channel 1-8 status | Read | 0x02 |
| 4x1000 - 4x1007 | Output channel 1-8 control mode | 00 - 03, four control modes | Read/Write | 0x03, 0x06, 0x10 |
| 4x4000 | Device address | Stores the Modbus address directly Device address: 0x0001 | Read | 0x03 |
| 4x8000 | Software version | Convert to decimal and move the decimal point two places to the left to indicate the software version 0x0064 = 100 = V1.00 | Read | 0x03 |
Command Operation Introduction
Control a Single Output Channel
Send Code: 01 05 00 00 FF 00 8C 3A
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 05 | 05 Command | Control output channel command |
| 00 00 | Address | Register address of output channel to control, 0x0000-0x0007 |
| FF 00 | Command | 0xFF00: output channel on; 0x0000: output channel off; 0x5500: output channel toggle; |
| 8C 3A | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 05 00 00 FF 00 8C 3A
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 05 | 05 Command | Control output channel command |
| 00 00 | Address | Register address of output channel to control, 0x0000-0x0007 |
| FF 00 | Command | 0xFF00: output channel on; 0x0000: output channel off; 0x5500: output channel toggle; |
| 8C 3A | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1:
Output channel 1 on: 01 05 00 00 FF 00 8C 3A
Output channel 1 off: 01 05 00 00 00 00 CD CA
Output channel 2 on: 01 05 00 01 FF 00 DD FA
Output channel 2 off: 01 05 00 01 00 00 9C 0A
Output channel 3 on: 01 05 00 02 FF 00 2D FA
Output channel 3 off: 01 05 00 02 00 00 6C 0A
Output channel 4 on: 01 05 00 03 FF 00 7C 3A
Output channel 4 off: 01 05 00 03 00 00 3D CA
Output channel 1 toggle: 01 05 00 00 55 00 F2 9A
Output channel 2 toggle: 01 05 00 01 55 00 A3 5A
Output channel 3 toggle: 01 05 00 02 55 00 53 5A
Output channel 4 toggle: 01 05 00 03 55 00 02 9A
Control All Output Channels
Send code: 01 05 00 FF FF 00 BC 0A
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 05 | 05 Command | Control output channel command |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00: all output channels on; 0x0000: all output channels off; 0x5500: all output channels toggle; |
| BC 0A | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 05 00 FF FF 00 BC 0A
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 05 | 05 Command | Control output channel command |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00: all output channels on; 0x0000: all output channels off; 0x5500: all output channels toggle; |
| BC 0A | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1:
All output channels ON : 01 05 00 FF FF 00 BC 0A
All output channels OFF : 01 05 00 FF 00 00 FD FA
All output channels TOGGLE: 01 05 00 FF 55 00 C2 AA
Read Output Channel Status
Send Code: 01 01 00 00 00 08 3D CC
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 01 | Command 01 | Query output channel status |
| 00 00 | Start Address | Output channel start address, 0x0000 - 0x0007 |
| 00 08 | Output Channel Count | Cannot exceed the maximum number of output channels |
| 3D CC | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 01 01 00 51 88
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 01 | Command 01 | Query output channel status |
| 01 | Byte count | Total number of bytes in the status information |
| 00 | Queried Status | Returned output channel status Bit0: start output channel status; Bit1: next output channel status, and so on; unused high bits are zero |
| 51 88 | CRC16 | CRC16 checksum of the first 4 bytes of data |
Example: Device with address 1
Send: 01 01 00 00 00 08 3D CC //Query all output channels
Return: 01 01 01 00 51 88 //All output channels off
Send: 01 01 00 02 00 01 5C 0A //Query output channel 2
Return: 01 01 01 01 90 48 //Output channel 2 on
Send: 01 01 00 01 00 03 2D CB //Query output channels 1, 2, and 3 status
Return: 01 01 01 05 91 8B //Output channels 1 and 3 on, output channel 2 off
Write Output Channel Status
Send code: 01 0F 00 00 00 08 01 FF BE D5
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 0F | Command 0F | Write output channel status |
| 00 00 | Output start address | Register address of output channel to control, 0x0000-0x0007 |
| 00 08 | Number of output channels | Number of output channels to operate, cannot exceed max |
| 01 | Byte count | Number of status bytes |
| FF | Output channel status | Bit0: start output channel status; Bit1: next output channel status, and so on; unused high bits are zero |
| BE D5 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 0F 00 00 00 08 54 0D
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 0F | Command 0F | Write relay status command |
| 00 00 | Address | Output channel start address |
| 00 08 | Output channel count | Number of output channels written |
| 54 0D | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
All output channels on: 01 0F 00 00 00 08 01 FF BE D5
All output channels off: 01 0F 00 00 00 08 01 00 FE 95
0-1 on; 3-7 off: 01 0F 00 00 00 08 01 03 BE 94
output channels 1, 2, and 3 on: 01 0F 00 01 00 03 01 07 F3 55
Output Channel Flash ON/OFF Command
Send Code: 01 05 02 00 00 07 8D B0
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 05 | Command 05 | Single control command |
| 02 | Start Address (big-endian) | 02 is the start address of the flash-on function, 04 is the start address of the flash-off function |
| 00 | Output Channel Address | Address of the output channel to control, 0x00 - 0x07 |
| 00 07 | Interval time | Delay time = data * 100 ms Value: 0x0007, Delay: 7 * 100 ms = 700 ms Maximum time for momentary ON/OFF is 0x7FFF |
| 8D B0 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 05 02 00 00 07 8D B0
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 05 | Command 05 | Single control command |
| 02 | Start Address (big-endian) | 02 is the start address of the flash-on function, 04 is the start address of the flash-off function |
| 00 | Output Channel Address | Address of the output channel to control, 0x00 - 0x07 |
| 00 07 | Interval time | Delay time = data * 100 ms Value: 0x0007, Delay: 7 * 100 ms = 700 ms Maximum time for momentary ON/OFF is 0x7FFF |
| 8D B0 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Output channel 0 flash ON: 01 05 02 00 00 07 8D B0 //700MS = 7*100MS = 700MS
Output channel 1 flash ON: 01 05 02 01 00 08 9C 74 //800MS
Output channel 0 flash OFF: 01 05 04 00 00 05 0C F9 //500MS
Output channel 1 flash OFF: 01 05 04 01 00 06 1D 38 //600MS
Read Input Status
Send Code: 01 02 00 00 00 08 79 CC
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 02 | Command 02 | Read input status command |
| 00 00 | Input start address | Input start address, 0x0000 - 0x0007 |
| 00 08 | Number of registers | Number of input channels to read, cannot exceed the maximum number of input channels |
| 79 CC | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 02 01 00 A1 88
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 02 | Command 02 | Read input status command |
| 01 | Byte count | Total number of bytes in the status information |
| 00 | Queried status | Returned input status Bit0: Starting input channel status; Bit1: Next input channel status, and so on. High unused bits are zero |
| A1 88 | CRC16 | CRC16 checksum of the first 4 bytes of data |
Example: Device with address 1
Send: 01 02 00 00 00 08 79 CC //Query all input channels
Return: 01 02 01 00 A1 88 //Inputs are all untriggered
Send: 01 02 00 00 00 08 79 CC //Query all input channels
Return: 01 02 01 41 61 B8 //Channels 1 and 7 input is triggered, and the rest of channels are not triggered
Send: 01 02 00 01 00 03 69 CB //Query input channels 2, 3, and 4
Return: 01 02 01 03 E1 89 //Channels 2 and 3 input is triggered, and channel 4 is not triggered
Read Output Channel Control Mode
Transmission Code: 01 03 10 00 00 08 40 CC
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 03 | Command 03 | Read holding registers |
| 10 00 | Register Start Address | 0x1000 - 0x1007 correspond to output channel 1-8 control modes |
| 00 08 | Number of registers | Number of registers to read, maximum 8 channels |
| 40 CC | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 59
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 03 | Command 03 | Read holding registers |
| 10 | Data Byte Length | Total number of bytes of returned status information |
| 00 00 - 00 00 | Control Mode | Indicates output channel 1 - 8 control modes. 0x0000 ~ 0x0003 represent four control modes: 0x0000: Normal mode, output channels are directly controlled by commands; 0x0001: Linkage mode, output channel status matches the corresponding input channel status; 0x0002: Toggle mode, each pulse input on the input channel toggles the corresponding output channel state once 0x0003: Edge trigger mode, each level transition on the input channel toggles the corresponding output channel state once ⚠️ Note: Except for linkage mode, the other modes also support controlling output channels via commands. |
| E4 59 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Read output channels 1-8 control mode: 01 03 10 00 00 08 40 CC
Read output channel 1 control mode : 01 03 10 00 00 01 80 CA
Read output channel 2 control mode : 01 03 10 01 00 01 D1 0A
Read output channels 3-5 control mode: 01 03 10 02 00 03 A0 CB
Set Single Output Channel Control Mode
Transmission Code: 01 06 10 00 00 01 4C CA
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 06 | Command 06 | Write single register command |
| 10 00 | Register start address | 0x1000-0x1007 corresponds to output channels 1-8 control mode |
| 00 01 | Control Mode | Indicates output channel 1 - 8 control modes. 0x0000 - 0x0003 represent four control modes: 0x0000: Normal mode, output channels are directly controlled by commands; 0x0001: Linkage mode, output channel status matches the corresponding input channel status; 0x0002: Toggle mode, each pulse input on the input channel toggles the corresponding output channel state once 0x0003: Edge trigger mode, each level transition on the input channel toggles the corresponding output channel state once ⚠️ Note: Except for linkage mode, the other modes also support controlling output channels via commands. |
| 4C CA | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 06 10 00 00 01 4C CA
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 06 | Command 06 | Write single register command |
| 10 00 | Register start address | 0x1000-0x1007 corresponds to output channels 1-8 control mode |
| 00 01 | Control mode | Output channel control modes, 0x0000~0x0003 indicate four control modes |
| 4C CA | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1:
Set output channel 1 to Linkage mode: 01 06 10 00 00 01 4C CA
Set output channel 2 to Toggle mode: 01 06 10 01 00 02 5D 0B
Set Multiple Output Channel Control Modes
Send Code: 01 10 10 00 00 08 10 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 7C B1
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 10 | Write multiple registers | - |
| 10 00 | Register start address | 0x1000-0x1007 corresponds to output channels 1-8 control mode |
| 00 08 | Number of registers | Number of registers to set, up to 8 channels |
| 10 | Byte count | - |
| 00 01 - 00 01 | Control Mode | Indicates output channel 1 - 8 control modes. 0x0000 - 0x0003 represent four control modes: 0x0000: Normal mode, output channels are directly controlled by commands; 0x0001: Linkage mode, output channel status matches the corresponding input channel status; 0x0002: Toggle mode, each pulse input on the input channel toggles the corresponding output channel state once 0x0003: Edge trigger mode, each level transition on the input channel toggles the corresponding output channel state once ⚠️ Note: Except for linkage mode, the other modes also support controlling output channels via commands. |
| 7C B1 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 10 10 00 00 08 C5 0F
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 10 | Write multiple registers | - |
| 10 00 | Register start address | 0x1000-0x1007 corresponds to output channels 1-8 control mode |
| 00 08 | Number of registers | Number of registers to set, up to 8 channels |
| C5 0F | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1:
Set output channels 1-8 to normal mode: 01 10 10 00 00 08 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0B 5C
Set output channels 1-8 to linkage mode: 01 10 10 00 00 08 10 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 7C B1
Set output channels 3-5 to toggle mode: 01 10 10 02 00 03 06 00 02 00 02 00 02 4A 4B
Read Software Version Command
Transmission Code: 01 03 80 00 00 01 AD CA
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 03 | Command 03 | Read holding registers |
| 80 00 | Command register | 0x8000 for reading software version |
| 00 01 | Byte Count | Fixed 0x0001 |
| AD CA | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 03 02 00 64 B9 AF
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 03 | Command 03 | Read holding registers |
| 02 | Byte count | Returned byte count |
| 00 64 | Software Version | Convert to decimal, then shift decimal point two places left for version 0x0064 = 100 = V1.00 |
| B9 AF | CRC16 | CRC16 checksum of the first 5 bytes of data |
Example: Device with address 1:
Transmission Code: 01 03 80 00 00 01 AD CA
Return Code: 01 03 02 00 C8 B9 D2 //0x00C8 = 200 =V2.00
Exception Function Codes
If the received command is incorrect or an exception occurs, the device will return an exception response. The exception response format is as follows:
Return Code: 01 85 03 02 91
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 85 | Exception Function Code | Exception function code = Request function code + 0x80 |
| 03 | Exception Code | Illegal data value |
| 02 91 | CRC16 | CRC16 checksum of the first 3 bytes of data |
The exception code is a single-byte value indicating the type of error. Several common exception codes defined by the Modbus protocol:
| Exception Code | Name | Description |
|---|---|---|
| 0x01 | Illegal Function | The requested function code is not supported |
| 0x02 | Illegal Data Address | The requested data address is incorrect |
| 0x03 | Illegal Data Value | The requested data value or operation cannot be performed |
| 0x04 | Server Failure | Server device failure |
| 0x05 | Acknowledge | Request received and processing |
| 0x06 | Device Busy | Device is busy and cannot execute the requested operation |
Modbus TCP Command Overview
Here, we will briefly introduce the conversion between Modbus TCP and Modbus RTU protocols using the command to turn on the first output channel above as an example.
Modbus RTU command: 01 05 00 00 FF 00 8C 3A
| Field | Description | Notes |
|---|---|---|
| 01 | Device address | Fixed 0x01 |
| 05 | 05 Command | Control output channel command |
| 00 00 | Address | Register address of the output channel to control, 0x00, i.e., the first output channel |
| FF 00 | Command | 0xFF00: output channel on |
| 8C 3A | CRC16 | CRC16 checksum of the first 6 bytes of data |
Modbus TCP command: 00 00 00 00 00 06 01 05 00 00 FF 00
| Field | Description | Notes |
|---|---|---|
| 00 00 | Message identifier | Can be 0x00 |
| 00 00 | Modbus identifier | Must be 0, indicating Modbus communication |
| 00 06 | Byte length | Indicates the total number of subsequent bytes; 6 bytes follow |
| 01 | Device address | Fixed 0x01 |
| 05 | 05 Command | Control output channel command |
| 00 00 | Address | Register address of the output channel to control, 0x00, i.e., the first output channel |
| FF 00 | Command | 0xFF00: output channel on |
By comparing the commands above, it can be seen that removing the CRC checksum from the Modbus RTU command and prefixing it with five 0x00 and one byte length converts it to the Modbus TCP protocol.
For example, if the server's Ethernet port receives the Modbus TCP command 00 00 00 00 00 06 01 05 00 00 FF 00 (turn on the first output channel), the main controller receives the Modbus RTU command 01 05 00 00 FF 00 8C 3A.