Modbus reference tablesModbus 速查表

Function codes, exception codes, limits, defaults.

功能码、异常码、限制、默认参数。

Function codes功能码

Code	Name	Used for	Max per request	Response PDU
0x01	Read Coils	Read on/off outputs, read-write	2000 bits	fc, count, packed bits
0x02	Read Discrete Inputs	Read on/off inputs, read-only	2000 bits	fc, count, packed bits
0x03	Read Holding Registers	Read 16-bit read/write words	125 regs	fc, byte count, words
0x04	Read Input Registers	Read 16-bit read-only words	125 regs	fc, byte count, words
0x05	Write Single Coil	Force one output ON or OFF	1 bit	echo of request
0x06	Write Single Register	Write one 16-bit word	1 reg	echo of request
0x07	Read Exception Status	Read 8 device status bits	—	fc, status byte
0x08	Diagnostics	Loopback test, counters, listen-only	—	fc, sub-function, data
0x0B	Get Comm Event Counter	Event counter and status word	—	fc, status, count
0x0C	Get Comm Event Log	Event log with run indicator	—	fc, byte count, events
0x0F	Write Multiple Coils	Force 1–1968 outputs at once	1968 bits	fc, start, quantity
0x10	Write Multiple Registers	Write 1–123 words at once	123 regs	fc, start, quantity
0x11	Report Server ID	Device type, run state, product string	—	fc, count, id bytes
0x14	Read File Record	Read a record from a file	—	fc, count, sub-responses
0x15	Write File Record	Write a record to a file	—	echo of request
0x16	Mask Write Register	AND/OR mask on one register	1 reg	echo of request
0x17	Read/Write Multiple Registers	Write then read in one transaction	read 125 / write 121	fc, byte count, words
0x18	Read FIFO Queue	Read a first-in-first-out register queue	31 regs	fc, byte count, fifo count

Codes 0x09–0x0A, 0x0D–0x0E are unassigned, 0x12–0x13 legacy, 0x19–0x2A reserved, 0x2B–0x40 for newer specifications. Everything above 0x80 in the first PDU byte means "exception".0x09–0x0A、0x0D–0x0E 未分配，0x12–0x13 为历史功能，0x19–0x2A 保留，0x2B–0x40 属于较新的规范。PDU 首字节高于 0x80 表示"异常应答"。

Exception codes异常码

Code	Name	What it actually means	Where to look first
0x01	Illegal Function	The device does not implement this function code	Manual's supported code list
0x02	Illegal Data Address	That address or range does not exist	Base address off by one? Wrong 30001/40001 prefix?
0x03	Illegal Data Value	Quantity, value or byte count out of range	Too many registers? FC05 value not 0xFF00/0x0000?
0x04	Server Device Failure	The device failed while executing	Device state, power, internal fault log
0x05	Acknowledge	Accepted, still processing — poll again	Long operations; wait and repeat
0x06	Server Device Busy	Busy with another command	Retry after a longer delay
0x07	Negative Acknowledge	Program function cannot be performed	Device-specific programming state
0x08	Memory Parity Error	Internal memory check failed	Hardware fault, RMA
0x0A	Gateway Path Unavailable	Gateway has no route to that unit	Unit ID mapping, gateway configuration
0x0B	Gateway Target Failed To Respond	Gateway reached nothing behind it	Device offline, wrong ID, wrong bus wiring

An exception response is the function code with the high bit set plus one byte: 01 83 02 C0 F1 means unit 1, function 03, exception 02.

异常应答 = 功能码置最高位 + 一个字节：01 83 02 C0 F1 表示从站 1、功能码 03、异常码 02。

Address conventions地址习惯

Data model	Prefix	Documented as	Protocol address (what goes on the wire)
Coils (read/write bits)	0xxxx	00001	0
Discrete inputs	1xxxx	10001	0
Input registers	3xxxx	30001	0
Holding registers	4xxxx	40001	0
Holding register 11	4xxxx	40011	10

The prefix is documentation only — it never appears in the frame. The only number that matters is the protocol address, which is zero-based. Off-by-one errors here are the single most common cause of exception 02.

前缀只是文档写法，不会出现在报文里。报文里只有 0 基址的协议地址。这里差一位，是异常码 02 最常见的原因。

Data types in registers寄存器里的数据类型

Type	Registers	Bytes	Range / notes
coil / bit	—	1 bit	Packed 8 per byte, least significant bit first
uint16	1	2	0 … 65535
int16	1	2	−32768 … 32767, two's complement
uint32 / int32	2	4	Word order must be known: ABCD or CDAB mostly
float32	2	4	IEEE 754 single precision, ~7 significant digits
float64	4	8	IEEE 754 double, 4-register word order varies
scaled integer	1–2	2–4	Value ÷ 10, ÷ 100 or ÷ 1000 per the manual — e.g. 235 means 23.5 °C

Limits and defaults限制与默认值

Frame size limits帧长限制

PDU: 253 bytes maximum (1 function code + 252 data).
RTU frame: 256 bytes including address and CRC.
TCP ADU: 260 bytes including the 7-byte MBAP header.
Unit address: 1–247 on serial, 0 is broadcast (no reply), 255 is often "any".

PDU 最大 253 字节（1 字节功能码 + 252 字节数据）。
RTU 整帧最大 256 字节（含地址与 CRC）。
TCP ADU 最大 260 字节（含 7 字节 MBAP 头）。
从站地址：串口 1–247，0 为广播（不应答），255 常表示"任意"。

Serial line defaults串口默认参数

Spec default: 9600 baud, 8 data bits, even parity, 1 stop bit (8E1).
8N1 is at least as common in practice — the manual wins.
RS-485: 32 unit loads per segment without a repeater, 1200 m at low baud.
120 Ω termination at both physical ends; bias resistors on one node.

规范默认：9600、8 数据位、偶校验、1 停止位（8E1）。
实际产品里 8N1 至少一样常见——以手册为准。
RS-485：不加中继一段最多 32 个单位负载，低波特率下最长 1200 m。
物理两端各 120 Ω 终端电阻；偏置电阻只在一处加。

RTU inter-frame timing (3.5 characters)RTU 帧间隔（3.5 个字符时间）

Baud	Time per character (8N1)	3.5 chars — frame gap	1.5 chars — intra-frame gap
9600	1.042 ms	3.65 ms	1.56 ms
19200	0.521 ms	1.82 ms	0.78 ms
38400	0.260 ms	0.91 ms	0.39 ms
57600	0.174 ms	0.61 ms	0.26 ms
115200	0.087 ms	0.30 ms	0.13 ms

Above 19200 baud the specification allows a fixed 1.75 ms inter-frame delay instead of the calculated 3.5 characters, because character timing becomes imprecise.波特率高于 19200 时，规范允许用固定的 1.75 ms 帧间隔代替按 3.5 字符计算，因为此时字符时间已经不够精确。