Reference
Modbus Cheat Sheet
One-page reference. Print-friendly. Open from anywhere with ⌘K → “Cheat sheet”.
Function codes
| Hex | Name | Notes |
|---|---|---|
| 01 | Read Coils | Read 1-bit outputs (R/W) |
| 02 | Read Discrete Inputs | Read 1-bit inputs (RO) |
| 03 | Read Holding Registers | Read 16-bit R/W registers |
| 04 | Read Input Registers | Read 16-bit RO registers |
| 05 | Write Single Coil | 0x0000 = OFF, 0xFF00 = ON |
| 06 | Write Single Register | Write one 16-bit value |
| 07 | Read Exception Status | Serial only — quick status byte |
| 08 | Diagnostics | Serial only — sub-functions |
| 0B | Get Comm Event Counter | Serial only |
| 0F | Write Multiple Coils | Up to 1968 coils |
| 10 | Write Multiple Registers | Up to 123 registers |
| 11 | Report Server ID | Vendor / model info |
| 14 | Read File Record | Rare |
| 15 | Write File Record | Rare |
| 16 | Mask Write Register | AND/OR mask in place |
| 17 | Read/Write Multiple Registers | Write, then read in one transaction |
| 18 | Read FIFO Queue | Rare |
| 2B | Encapsulated Interface | MEI — device identification |
Exception codes
| Hex | Name | Meaning |
|---|---|---|
| 01 | Illegal Function | Function code not supported |
| 02 | Illegal Data Address | Address not in valid range |
| 03 | Illegal Data Value | Value out of allowed range |
| 04 | Server Device Failure | Unrecoverable error on server |
| 05 | Acknowledge | Long operation accepted — poll later |
| 06 | Server Device Busy | Retry later |
| 08 | Memory Parity Error | File record memory error |
| 0A | Gateway Path Unavailable | Gateway misconfigured |
| 0B | Gateway Target No Response | Downstream device silent |
Framing & transports
| Topic | Value |
|---|---|
| RTU silent interval | ≥ 3.5 character times between frames |
| RTU inter-char gap | > 1.5 char times restarts framing |
| RTU CRC | CRC-16, poly 0xA001, init 0xFFFF, LO byte first |
| ASCII frame | Starts ':' (0x3A), ends CR LF (0x0D 0x0A) |
| ASCII LRC | Two's complement of sum, hex-encoded |
| TCP MBAP | TxID(2) + ProtoID(2)=0 + Length(2) + UnitID(1) |
| TCP port | 502 (default) |
| TCP unit ID | Direct: 0xFF recommended or 0; gateway routing is product-specific |
Addressing (1-based docs ↔ 0-based wire)
| Table | Doc range | Function codes |
|---|---|---|
| Coils | 00001–09999 | FC 01, 05, 0F · wire 0x0000+ |
| Discrete Inputs | 10001–19999 | FC 02 · wire 0x0000+ |
| Input Registers | 30001–39999 | FC 04 · wire 0x0000+ |
| Holding Registers | 40001–49999 | FC 03, 06, 10, 17 · wire 0x0000+ |
Wire address = documented address − base (e.g. 40001 → 0x0000).
Serial defaults
| Topic | Value |
|---|---|
| Common baud | 9600, 19200, 38400, 57600, 115200 |
| Default frame | 8 data, Even parity, 1 stop (8E1) |
| No parity | Use 8N2 (two stop bits) per spec |
| RS-485 loading | 32 standard unit loads; above 32 needs documented unit-load or repeater evidence |
| Termination | Near both trunk ends; use the documented network values |
| Bias | One bus-wide network only when connected devices require it |
Quick checks
- › Exception response = function code | 0x80, followed by 1-byte exception code.
- › RTU silent gap missing → frames concatenate; check 3.5-char timer.
- › Wrong word order on 32-bit → swap word pairs (CDAB vs ABCD) before scaling.
- › TCP timeout but no exception → check unit ID and gateway routing.