Modbus function codes
The function code is the first byte of every Modbus request after the unit ID. It tells the device what to do: read coils, read registers, write a value, run a diagnostic. This page lists every function code, what it does and its limits.
Modbus function code table
Codes are shown in decimal, with hex in brackets where it differs from the decimal digits. The references in brackets in the Data column are the traditional 0xxxx to 4xxxx numbers; the protocol address is 0-based, so reference 40001 is address 0.
| Code | Name | Data | Type | Max per request | Notes |
|---|---|---|---|---|---|
| 01 | Read Coils | Coils (0xxxx) | Read | 2000 bits | Output bits such as relays and digital outputs. |
| 02 | Read Discrete Inputs | Discrete inputs (1xxxx) | Read | 2000 bits | Read-only input bits such as switches and sensors. |
| 03 | Read Holding Registers | Holding registers (4xxxx) | Read | 125 registers | The most used read: setpoints, configuration and most measured values. |
| 04 | Read Input Registers | Input registers (3xxxx) | Read | 125 registers | Read-only 16-bit values, often live measurements. |
| 05 | Write Single Coil | Coils | Write | 1 bit | Value is FF00 (on) or 0000 (off); anything else is rejected. |
| 06 | Write Single Register | Holding registers | Write | 1 register | The response echoes the request. |
| 07 | Read Exception Status | Device status | Read | 8 bits | Serial lines only. Rarely implemented. |
| 08 | Diagnostics | Device diagnostics | Test | Sub-function | Serial lines only in the original spec. Sub-function 00 echoes the data back and is the classic loopback test. |
| 11 (0x0B) | Get Comm Event Counter | Device status | Read | - | Serial lines only. Returns a status word and an event count. |
| 12 (0x0C) | Get Comm Event Log | Device status | Read | - | Serial lines only. |
| 15 (0x0F) | Write Multiple Coils | Coils | Write | 1968 bits | Writes a block of coils in one request. |
| 16 (0x10) | Write Multiple Registers | Holding registers | Write | 123 registers | Use it for 32-bit values and floats so both words arrive together. |
| 17 (0x11) | Report Server ID | Device identity | Read | - | Serial lines only. Content is vendor specific. |
| 20 (0x14) | Read File Record | File records | Read | - | Reads extended memory in files. Rarely implemented. |
| 21 (0x15) | Write File Record | File records | Write | - | Writes extended memory in files. Rarely implemented. |
| 22 (0x16) | Mask Write Register | Holding registers | Write | 1 register | Changes single bits of a register without a read-modify-write cycle. |
| 23 (0x17) | Read/Write Multiple Registers | Holding registers | Read + write | 125 read / 121 write | One request that writes first and then reads. |
| 24 (0x18) | Read FIFO Queue | FIFO | Read | 31 registers | Rarely implemented. |
| 43 (0x2B) | Encapsulated Interface Transport | Device identification (MEI 0x0E) | Read | - | Read Device Identification: vendor, product code and revision. |
The four data tables
Modbus has four data tables, and the function code decides which one a request touches:
- Coils: read/write single bits. Read with 01, write with 05 and 15.
- Discrete inputs: read-only single bits. Read with 02.
- Holding registers: read/write 16-bit words. Read with 03, write with 06, 16, 22 and 23.
- Input registers: read-only 16-bit words. Read with 04.
A device may place the same values in more than one table, or only in one. If a read with 03 returns exception 02 or 01, try 04 before you assume the register does not exist.
Which function code should I use?
- Read a measurement or setting: 03, or 04 if the manual lists it as an input register.
- Read on/off states: 01 for outputs, 02 for inputs.
- Write one value: 06 for a register, 05 for a coil.
- Write a 32-bit value or float: 16, so both registers are written in one request.
- Change a few bits: 22 if the device supports it; otherwise read with 03, change the bits and write back with 06.
- Test that a serial device responds: 08 with sub-function 00 (loopback).
- Identify an unknown device: 43 with MEI type 14 (Read Device Identification).
Function codes and exceptions
If the device does not support a function, or the request is not valid, it answers with the function code plus 0x80 and an exception code. Function 03 becomes 83, function 16 becomes 90. Exception 01 means the function is not supported, 02 means the address range is not valid and 03 means a value or the quantity is not allowed. Every code is described on the Modbus exception codes page.
Function codes in Busscope
A poll window reads with functions 01 to 04. Writes use 05, 06, 15, 16, 22 and 23, and every write asks for confirmation before it is sent. The Diagnostics window sends function 08 sub-functions, and the Request Runner can send any function code as a raw frame, which is useful for vendor-specific and rarely implemented functions. The traffic panel (F4) shows the exact bytes. Read more about the Modbus TCP tester.
Frequently asked questions
What are the most used Modbus function codes?
Function 03 (Read Holding Registers) is the most common read, followed by 04 (Read Input Registers), 01 (Read Coils) and 02 (Read Discrete Inputs). The most common writes are 06 (Write Single Register), 16 (Write Multiple Registers), 05 (Write Single Coil) and 15 (Write Multiple Coils).
What is the difference between function code 03 and 04?
Function 03 reads holding registers, which can be read and written. Function 04 reads input registers, which are read-only. Which table a value lives in is decided by the device, so check its manual.
What is the difference between function 06 and 16?
Function 06 writes one register, function 16 writes a block of up to 123 registers in one request. Use 16 for values that span more than one register, such as 32-bit integers and floats, so they are written together.
What does function code 0x83 mean?
A response function code with the highest bit set is an exception. 0x83 is the exception response to function 03; the next byte is the exception code. See the Modbus exception codes page.
How many registers can one Modbus request read?
Up to 125 registers (functions 03 and 04) or 2000 coils and discrete inputs (functions 01 and 02) per read, and up to 123 registers or 1968 coils per write.
Try Busscope
Install Busscope and run it without a license key to see whether it fits your work. Evaluation mode is for trying the tool, not for production or commercial use.