Reference · Appendices A–E

Quick Reference

The book's appendices in one place: material to return to long after the first read.

A · Function Code Reference

The eight common codes do almost all everyday work; the rest appear mainly on specific devices. Codes are shown in decimal and hex, since manuals vary.

The common function codes

Less-common function codes

Request and response data fields

For the common codes, the PDU is the function code byte followed by these fields (byte counts in parentheses). All multi-byte values are big-endian, high byte first.

For Write Single Coil (0x05), the value is 0xFF00 for ON and 0x0000 for OFF; no other value is valid. Coil reads return bits packed eight per byte, the first requested coil in the least significant bit.

Per-request limits

Frame sizes for a register read (FC03 / FC04, N registers)

An exception response returns the function code with its high bit set (the original plus 0x80), followed by one exception code byte (Appendix B). A failed 0x03 returns 0x83.

↑ Back to top

B · Exception Code Reference

When a server understands a request but can't perform it, it returns the requested function code with its high bit set (code + 0x80), then one of these codes. A 0x03 request fails as 0x83, a 0x10 as 0x90.

Diagnosing the common three

• 02 Illegal Data Address: the most common, and almost always an addressing error: a forgotten 4xxxx reference-number conversion, a count running past the end of a table, or the wrong table entirely.
• 03 Illegal Data Value: a rule was broken, such as asking for more than 125 registers or writing a coil value other than 0xFF00/0x0000. It's about a number's validity for this request, not its meaning.
• 01 Illegal Function: the device simply doesn't implement the function code you sent; check its manual for supported codes.

An exception is better news than silence: it proves the device received and understood the request. A request that draws no reply at all is a connection problem, not an exception; see Appendix D and Chapter 16.

↑ Back to top

C · pymodbus Quick Reference

The pymodbus patterns used in this course, for pymodbus version 3. This course pins 3.7.4:

pip install "pymodbus==3.7.4" pyserial

When something fails, check your installed version with pip show pymodbus.

Connecting

from pymodbus.client import ModbusTcpClient
client = ModbusTcpClient("192.168.1.50",
                         port=502)
client.connect()

from pymodbus.client import ModbusSerialClient
client = ModbusSerialClient(
    port="/dev/ttyUSB0", baudrate=9600,
    parity="N", stopbits=1, bytesize=8)
client.connect()

Reading

rc = client.read_coils(0, count=8)
rd = client.read_discrete_inputs(0, count=8)
rh = client.read_holding_registers(0, count=4)
ri = client.read_input_registers(0, count=2)

if not rh.isError():
    print(rh.registers)   # list of ints
if not rc.isError():
    print(rc.bits)        # list of bools

On a serial bus, add the unit address to each call, e.g. read_holding_registers(0, count=4, slave=1).

Writing

client.write_coil(0, True)
client.write_register(0, 1500)
client.write_coils(0, [True, False, True])
client.write_registers(0, [10, 20, 30])

Decoding wide values

import struct

def to_signed16(v):
    return v - 65536 if v >= 32768 else v

def regs_to_float(regs, order="big"):
    if order == "little":
        regs = [regs[1], regs[0]]
    raw = struct.pack(">HH", regs[0], regs[1])
    return struct.unpack(">f", raw)[0]

Here order is the word order: "big" means the high word is in the first register; "little" means the low word comes first.

A minimal server

from pymodbus.server import StartTcpServer
from pymodbus.datastore import (
    ModbusSequentialDataBlock,
    ModbusSlaveContext, ModbusServerContext)

block = ModbusSequentialDataBlock(0, [0]*100)
dev = ModbusSlaveContext(
    di=block, co=block, hr=block, ir=block,
    zero_mode=True)
ctx = ModbusServerContext(slaves=dev,
                          single=True)
StartTcpServer(context=ctx,
               address=("0.0.0.0", 5020))

This sketch shares one block across all four tables for brevity, so a write to a holding register also shows up as an input register; give each table its own block (as in Chapter 12) when that matters. Always close a client with client.close() when finished, and check the result of client.connect(), which returns False if the server can't be reached.

↑ Back to top

D · Wiring and Settings Reference

The physical side of Modbus RTU over RS-485. The protocol logic is identical everywhere; these are the hardware details that change from site to site.

RS-485 wiring

• A two-wire RS-485 bus is a daisy chain, not a star: the pair runs device to device in one line.
• Connect A to A and B to B across all devices; join the signal grounds. If labels disagree between makers and you get silence, try swapping the two data wires.
• Place a termination resistor (typically 120 Ω) at each far end of the line on longer or faster runs; short bench links usually work without.
• Add bias resistors somewhere on the bus to hold the line in a known idle state between messages when devices behave erratically.

Serial settings

Both ends of a serial link must use identical settings. Modbus RTU always uses 8 data bits. Settings are written compactly: 9600 8-E-1 means 9600 baud, 8 data bits, even parity, 1 stop bit.

Either way each byte is an 11-bit character (start + 8 data + parity + 1 stop, or start + 8 data + 2 stops). Devices that use 8N1 (10-bit characters) are common too; they simply must match.

USB-to-RS-485 adapters on Linux

• A plugged-in adapter usually appears as /dev/ttyUSB0. Confirm with ls /dev/ttyUSB* or dmesg | grep ttyUSB.
• Serial-port access requires membership in the dialout group: sudo usermod -a -G dialout $USER, then log out and back in.
• A "permission denied" on the port almost always means the dialout membership is missing, not a wiring fault.

ls /dev/ttyUSB*
dmesg | grep ttyUSB
sudo usermod -a -G dialout $USER

Modbus TCP defaults

Quick silence checklist

When a bus returns nothing, check in order, most common first.

On Windows, Test-NetConnection <ip> -Port 502 checks TCP reachability and the port in one line.

↑ Back to top

E · Glossary

Concise definitions of the terms used in the course. For deeper treatment, see the chapter that introduces each: the data model in Part I, frames and transports in Part II, the hands-on code in Part III, and deployment in Part IV.

No terms match that filter.

↑ Back to top