How does Modbus RTU work?

One master polls slave devices over an RS-485 bus. Each request names a slave address, a function code, and a register range, protected by a CRC; the addressed slave replies with the data. Only one device talks at a time, and slaves never speak unless asked.

What are the Modbus register types?

Coils are read-write single bits, discrete inputs are read-only bits, input registers are read-only 16-bit values, and holding registers are read-write 16-bit values. Meters expose most measurements in input or holding registers.

What are the most common Modbus function codes?

01 read coils, 02 read discrete inputs, 03 read holding registers, 04 read input registers, 05 / 06 write a single coil or register, and 15 / 16 write multiples. In the field, 03 and 04 do most of the work.

Can two masters share one Modbus RTU bus?

Not directly — Modbus RTU allows exactly one master per bus, and a second master causes collisions. To let a PLC and an IoT gateway poll the same meters, use a multi-master arbiter such as the Wiman WT20C, which interleaves both masters onto one slave bus.

Why do 32-bit Modbus values need byte ordering?

A 32-bit value spans two 16-bit registers, and vendors differ on the word and byte order — ABCD, BADC, CDAB or DCBA. Reading with the wrong order produces wildly wrong numbers; if a float looks like garbage, try the other orders.

Resources · Interactive Guide

How Modbus RTU Works

The protocol every RS-485 device speaks. Watch a master poll three real slaves in turn — a meter, a VFD and a sensor — then see the four register types and function codes behind it.

Watch it work

a master polling every slave on the bus — live

120 Ω

Master

gateway

Slave 1

ID 1 · Meter

Slave 2

ID 2 · VFD

Slave 3

ID 5 · Sensor

120 Ω

One twisted pair(A/B), daisy-chained · every device at the same 9600 8N1 · each slave a unique ID · 120 Ω at both ends

Master · PLC / Gateway

Now polling

—

RS-485 · one twisted pair · up to 247 slaves

Slave 1 · Meter

Master asks, slave answers — one question at a time.

Transaction log — every slave polled in turn

The four register types

this is Modbus’s whole data model

CoilsRead / Write

0xxxx reference range · 1 bit each

On/off outputs you can switch — relays, valves, LEDs.

FC 01FC 05FC 15

Discrete InputsRead only

1xxxx reference range · 1 bit each

On/off inputs you can only read — switches, status bits.

FC 02

Input RegistersRead only

3xxxx reference range · 16 bit each

Measured analog values, read-only — voltage, current, temp.

FC 04

Holding RegistersRead / Write

4xxxx reference range · 16 bit each

Settings & setpoints you read and write — config, thresholds.

FC 03FC 06FC 16

Function codes

the verb — what to do to which table

Code	Name	Acts on	R/W
1 · 0x01	Read Coils	Coils	Read
2 · 0x02	Read Discrete Inputs	Discrete Inputs	Read
3 · 0x03	Read Holding Registers	Holding Registers	Read
4 · 0x04	Read Input Registers	Input Registers	Read
5 · 0x05	Write Single Coil	Coils	Write
6 · 0x06	Write Single Register	Holding Registers	Write
15 · 0x0F	Write Multiple Coils	Coils	Write
16 · 0x10	Write Multiple Registers	Holding Registers	Write

Bus rules to remember

get these right and the bus just works

Same speed for everyone

Every device on the bus must use the identical baud rate and framing — e.g. 9600 8N1. One device at the wrong speed and its data comes back as garbage.

Each slave has a unique ID

Every slave needs its own address 1–247 — no duplicates on one bus, or two devices answer at once and collide. IDs don't have to be sequential.

One twisted pair, daisy-chained

RS-485 runs on a single twisted pair (A/B), device to device in a line — not a star. Fit a 120 Ω terminator at each far end to stop reflections.

One master, many slaves

The master always speaks first. Only the addressed slave replies — everyone else stays quiet. Address 0 is a broadcast to all.

Request → response, every time

Nothing happens until the master asks. The slave answers that one question, then waits. No unsolicited data from a slave.

Errors come back as exceptions

Ask for a register that doesn't exist and the slave replies with an exception (e.g. 02 illegal address) instead of data.

Runs entirely in your browser — a Modbus RTU teaching simulator, no hardware needed.

Loading…

Code

Name

Acts on

R/W

1 · 0x01

Read Coils

Coils

Read

2 · 0x02

Read Discrete Inputs

Discrete Inputs

Read

3 · 0x03

Read Holding Registers

Holding Registers

Read

4 · 0x04

Read Input Registers

Input Registers

Read

5 · 0x05

Write Single Coil

Coils

Write

6 · 0x06

Write Single Register

Holding Registers

Write

15 · 0x0F

Write Multiple Coils

Coils

Write

16 · 0x10

Write Multiple Registers

Holding Registers

Write