Modbus Function Code 4

Read Input Registers on Modbus

It is used for reading from 1 to 125 contiguous input registers in a remote device. The Request PDU specifies the starting register address and the number of registers. In the PDU Registers are addressed starting at zero. Therefore input registers numbered 1-16 are addressed as 0-15.

Request

Function code1 Byte0x04
Starting Address2 Bytes0x0000 to 0xFFFF
Quantity of Input Registers2 Bytes0x0001 to 0x007D
Table 1 - Command structure

Response

The register data in the response message are packed as two bytes per input register (Table 2). For each register, the first byte contains the high order bits and the second contains the low order bits.

Function code1 Byte0x04
Byte count1 Byte2 x N*
Input RegistersN* x 2 Bytes
*N = Quantity of Input Registers
Table 2 - Response structure

Error

Error code1 Byte0x84
Exception code1 Byte01 or 02 or 03 or 04
Table 3 - Error structure. Scroll below for details.

Example

Request

This command is requesting the content of analog input register #30011 from the slave device with address 11. Each register contains 16 bits.

0B 04 000A 0001 1162
  • 0B: The Slave Address (0B hex = address 11)
  • 04: The Function Code 4 (Read Input Registers)
  • 000A: The Data Address of the first register requested (000A hex = 10, + 30001 offset = input register #30011)
  • 0001: The total number of registers requested (read 1 register).
  • 1162: The CRC (Cyclic Redundancy Check) for error checking.

Response

0B 04 02 102F 6D2D
  • 0B: The Slave Address (0B hex = address 11)
  • 04: The Function Code 4 (Read Input Registers)
  • 02: The number of data bytes to follow (1 registers x 2 bytes each = 2 bytes)
  • 102F: The contents of register 30011
  • 6D2D: The CRC (Cyclic Redundancy Check).

Workflow Diagram for Modbus FC 4

read states of input registers
Figure 1 - Read states of Input Registers

Contents retrieved from

  • http://modbus.org/
  • http://www.simplymodbus.ca/

More information