What always happens
- The client initiates every normal transaction.
- Only the addressed server replies on serial buses.
- PDU addresses are zero-based even when manuals label coils/registers with 0x, 1x, 3x, or 4x prefixes.
Modbus Protocol Simulator Workbench
Simulate complete Modbus requests, responses, exceptions, and transport framing.
animation
modbus
industrial
protocols
Learner-ready Modbus protocol simulator with RTU/TCP/ASCII framing, function-code controls, device memory feedback, exception responses, timing context, quick reference cards, source links, and mobile-safe Playwright-verified interaction.
Modbus Protocol Simulator Workbench
Configure a client request, watch the frame cross the selected transport, inspect the addressed device table, and compare normal, exception, and timeout responses. The default state shows the full request-response loop before the learner changes anything.
Mode
RTU serial
Slave / Unit
17
Function
FC04 read input registers
Result
Normal response
1. Configure
2. Request
3. Transport
4. Device
5. Response
6. Diagnose
Configure transaction
00001
Input register 30002
2 registers
25.1 C, 53.6 %RH
Response behavior
Client / master
Builds FC04 for unit 17, starting at PDU address 2.
RTU serial frame
RTU wraps the PDU with slave address and CRC-16, then relies on silent intervals between frames.
Addressed device
Unit 17 checks the function code, address range, and quantity before returning register values.
Request PDU
04 00 01 00 02
Response PDU
04 04 00 FB 02 18
Addressing
PDU 1 maps to 30002
Timing
RTU approx. 27.5 ms at 9600 bit/s
Request frame
Client sends address, function, starting address, quantity, then the transport check or header.
Response frame
A normal response echoes useful data; an exception response returns function code plus 0x80 and one exception byte.
Coils 0x
Read/write bit outputs.
Discrete inputs 1x
Read-only bit inputs.
Input registers 3x
Read-only 16-bit measurements.
Holding registers 4x
Read/write 16-bit settings.
Normal response: addressed table and range are valid
The client is reading two input registers. The device returns a byte count of 4 followed by two big-endian 16-bit values.
Quick reference
Transport differences
- RTU uses slave address, PDU, and CRC-16 with the CRC low byte transmitted first.
- TCP uses an MBAP header; TCP frames do not carry the Modbus CRC.
- ASCII sends printable hex after a colon and ends with carriage return plus line feed.
Error interpretation
- Exception function code equals request function code plus 0x80.
- Exception 02 means the requested address range is not implemented.
- Timeouts are not Modbus exception frames; they are missing responses.
Technical accuracy notes
Byte order and limits
Modbus fields inside the PDU are big-endian. The application protocol limits the PDU to 253 bytes, so large reads and writes must respect function-code-specific limits.
Broadcast and gateways
Serial broadcast address 0 is write-only from the client perspective because servers do not send normal replies. TCP gateways carry a Unit Identifier so a TCP client can address a downstream serial device.
Timing model
The timing readout is a teaching estimate. RTU framing uses silent intervals; at 9600 bit/s a character is typically modeled as 11 bits, with 3.5 character times separating frames.