Each message has the same structure, which is independent of the type of network. On a plain serial network the message structure is the same as the structure transmitted over TCP/IP (Ethernet). Messages consist of four parts: device address, function code, data and error check.
The address field in the query from a master defines which slave device should respond to the message. All other network nodes ignore the message if it is not addressed to them. The address field in the response from the slave contains the slave device address, which confirms to the master that the slave is replying to the query.
A device address of zero (0) indicates a broadcast message, which the master sends to all slaves and does not require a response from any slave.
Following each address field in a query is a function code, which identifies the type of information requested by the master. Function codes are also used for verification in slave responses back to the master device. Example codes are READ COIL STATUS and READ HOLDING REGISTERS.
The Modbus protocol defines 24 function codes. Few devices support all function codes. A vendor’s documentation for a Modbus device should state which function codes are supported. The following table shows the function codes supported by this Modbus driver.
| Code | Function Name | Operation in a controller master |
|---|---|---|
| 01 | READ COIL STATUS | Provide normal data polling of all read-only and writable proxy points. |
| 02 | READ INPUT STATUS | |
| 03 | READ HOLDING REGISTERS | |
| 04 | READ INPUT REGISTERS | |
| 05 | FORCE SINGLE COIL | Manage change of values at inputs and/or invoked actions of writable proxy points or client preset components. |
| 06 | PRESET SINGLE REGISTER | |
| 07 | READ EXCEPTION STATUS | Poll device for exception status, output values and bits set. |
| 15 | FORCE MULTIPLE COILS | Manage change of values at inputs and/or invoked actions of writable proxy points or client preset components. |
| 16 | PRESET MULTIPLE REGISTERS | |
| 20 | READ FILE RECORD | Use ModbusClientStringRecord to read and write file records in which data are converted to ASCII characters and displayed as a string. |
| 21 | WRITE FILE RECORD |
If the slave was able to perform the requested function, it returns an exact copy of the function code originally sent by the master. If the slave was unable to perform the requested function, it returns an exception response.
This message field describes the particulars for the function code. For example, it may contain a register address (and a range) to read, or a coil address to write. Data fields return the information requested by the master.
This field confirms the integrity of the message as received from the master. If the slave detects an error in a query, the slave ignores the query and waits for the next query addressed to it.
In the response from the slave, this field confirms the integrity of the message as received from the slave. If the master detects an error, the master ignores the response.
The error-checking method depends on the Modbus transmission mode. Modbus RTU, the most prevalent mode, uses a CRC (cyclical redundancy checksum) method. The Modbus TCP/IP protocol has a similar message format for query and response messages. However, Modbus TCP/IP is freed from error check routines. Instead, it uses the error-checking mechanisms built into the lower-level TCP/IP and link layers (that is, Ethernet).
The following is an example query and response message pair from a ModbusAsyncNetwork to a Modbus RTU (serial) device:
020300030004B43A
For device 02, function code 03, starting address 0003, number of registers 04, error checksum B43A
02030800510052003C003CA387
From device 02, function code 03, number bytes returned 08, data (00510052003C003C), error checksum A387