Modbus holding registers

What a holding register is

A holding register is one 16-bit value (0 to 65535) at a numbered address. In the usual reference notation holding registers are written 4xxxx, so 40001 is the first one. On the wire the address is sent as a 16-bit number starting at 0, so 40001 becomes address 0. The addressing page explains the conversion and the off-by-one errors it causes.

Reading holding registers: function 03

Function 03 (0x03) reads a block of holding registers. One request can read at most 125 registers (0x7D). The request below reads 3 registers starting at address 107 (0x006B) from unit 1:

01 03 00 6B 00 03 74 17

The answer contains a byte count (6 bytes for 3 registers) followed by the values, high byte first. Function 04 reads input registers, which use the same frame layout but a different table.

Writing holding registers: functions 06 and 16

• Function 06 writes one register. The answer repeats the request, so a successful write is easy to check.
• Function 16 (0x10) writes several consecutive registers. One request can write at most 123 registers (0x7B).

Common problems

• Exception 02 (Illegal Data Address) on a read that looked correct: the address is off by one, or the block runs past the last register the device has.
• Exception 03 (Illegal Data Value): the quantity is zero or above the limit. Try 125 or fewer.
• A 32-bit value looks wrong: it uses two registers, and the byte and word order may differ from the device. See Modbus data types.

Test it in Busscope

A poll window in Busscope Master reads holding registers, shows each value in the format you choose and can write back a value after a confirmation. To check your reads against a known device, run Busscope Slave on the same PC and poll it.