Modbus Function Code Workbench

Choose the right Modbus operation, inspect its PDU bytes, and decode normal versus exception responses.

animation
modbus
industrial
protocols
Learner-ready Modbus function-code workbench with register-type decision support, request and response PDU byte strips, exception response transformation, scenario presets, Play/Step controls, and technical quick reference.
Modbus PDU Function code Exception response Register types

Modbus Function Code Workbench

Select an operation, then watch the request PDU, normal response, and exception response change together. The same function code byte tells the server whether the client wants bits, registers, a write echo, or an error report.

OperationFC03 read holding
Object typeHolding registers
Request PDU5 bytes
Exception FC0x83

Stage 1: choose the data table

Function codes are tied to the kind of object being addressed: coils, discrete inputs, input registers, or holding registers.

Coils

0x bit table Read/write boolean outputs. Read with FC01, write with FC05 or FC15.

Discrete inputs

1x bit table Read-only boolean inputs. Read with FC02.

Input registers

3x 16-bit table Read-only measured values. Read with FC04.

Holding registers

4x 16-bit table Read/write settings or state. Read with FC03, write with FC06 or FC16.

Request PDU

Client asks for holding registers starting at protocol address 0x006B.

Normal response

Read responses return byte count followed by data bytes.

Exception response

The server sets bit 7 of the original function code and returns one exception byte.

FC03 reads holding registers Use this when the device manual lists a 4x holding-register value and the value is readable without changing device state.

What to notice

    FC01

    Read coils

    Read one or more 0x boolean outputs.

    FC02

    Read discrete inputs

    Read one or more 1x boolean inputs.

    FC03

    Read holding registers

    Read one or more 4x 16-bit registers.

    FC04

    Read input registers

    Read one or more 3x 16-bit registers.

    FC05

    Write single coil

    Write ON as 0xFF00 or OFF as 0x0000.

    FC06

    Write single register

    Write one 4x 16-bit register and echo the request.

    FC15

    Write multiple coils

    Write packed boolean outputs; hexadecimal code is 0x0F.

    FC16

    Write multiple registers

    Write a block of 4x registers; hexadecimal code is 0x10.

    Core idea

    The function code is the first byte of the Modbus PDU. It selects the operation; the following bytes only make sense after that byte is known.

    Common trap

    FC15 and FC16 are decimal names. In packet bytes they appear as 0x0F and 0x10, so do not read the labels as hexadecimal values.

    Exception rule

    An exception response is not a different command. It is the original function code with bit 7 set, followed by a one-byte reason code.

    Quick reference and technical notes
    Primary data tablesCoils and discrete inputs are one-bit objects. Input and holding registers are 16-bit words.
    Read response shapeRead responses echo the function code, add a byte count, then return packed bits or register data.
    Write response shapeSingle writes echo address and value. Multiple writes echo starting address and quantity written.
    Address meaningThe PDU address is zero-based. A manual label like 40001 often maps to PDU address 0x0000.
    Common exception codes01 illegal function, 02 illegal address, 03 illegal value, 04 server device failure.
    Gateway exceptions0A means gateway path unavailable. 0B means the target device did not respond.
    More public functionsThe Modbus application protocol also defines services such as diagnostics 0x08, event counters 0x0B/0x0C, file records 0x14/0x15, mask write 0x16, read/write multiple 0x17, FIFO 0x18, and MEI 0x2B.
    Broadcast cautionOn serial Modbus, address 0 is broadcast. Slaves process eligible write requests but do not send normal responses.
    Data meaningModbus moves bits and 16-bit words. Scaling, units, byte order across multiple registers, and signedness come from the device manual.

    This workbench focuses on the Modbus PDU. RTU, ASCII, and TCP add different transport envelopes around the same function-code request.

    Modbus Application Protocol v1.1b3 Modbus frame structure workbench Modbus registers and communication