Virtual slave · Coils · Discrete · Holding · Input registers · Live read/write
When to use: Use this to learn how a Modbus master talks to a slave device. The device exposes four data tables — Coils (R/W bits), Discrete Inputs (RO bits), Holding Registers (R/W 16-bit), and Input Registers (RO 16-bit). Choose a function code, address (0–15), and value, then Execute to read or write. Enable Live to watch input registers update like real field sensors. The transaction log shows each request just like a Modbus poll trace.
The Modbus Register Explorer provides a virtual Modbus slave device with all four data tables — Coils, Discrete Inputs, Input Registers, and Holding Registers — so engineers and technicians can practice issuing read and write requests with different function codes and immediately see the effect on the register map. It is an interactive reference for learning Modbus data types, byte order, and function code behavior before connecting to real field devices.
Modbus defines four separate data tables accessed by different function codes. Coils (0xxxx) are read/write single bits — FC 01 reads, FC 05 writes a single coil, FC 15 writes multiple coils. Discrete Inputs (1xxxx) are read-only bits from field sensors — FC 02. Holding Registers (4xxxx) are read/write 16-bit words — FC 03 reads, FC 06 writes one, FC 16 writes multiple. Input Registers (3xxxx) are read-only 16-bit analog measurement values — FC 04.
Registers store 16-bit unsigned integers (0–65535), but 32-bit IEEE 754 floats, 32-bit integers, and BCD values are common in field devices. A 32-bit float occupies two consecutive registers. Modbus standard is big-endian (high word at lower register address), but many manufacturers reverse this, requiring byte-swap or word-swap configuration in the SCADA driver.
The Modbus Application Protocol Specification V1.1b3 (Modbus.org) is the governing document for all Modbus implementations. It defines all valid function codes (01–06, 07, 08, 11, 12, 15, 16, 17, 22, 23, 24, 43), exception codes, and the PDU structure. For serial implementations, TIA/EIA-485 governs the physical layer. Modbus TCP uses TCP port 502 and adds the 7-byte MBAP header. IEC 61158 includes Modbus as a standardized fieldbus. ODVA publishes EtherNet/IP (CIP) as an alternative for applications requiring faster update rates.
The most important design decision when integrating a Modbus device is confirming the data type and byte order for each register. Sixteen-bit integers are unambiguous, but 32-bit floats stored in two registers have four possible byte-order combinations: big-endian (standard), little-endian, mixed (big-endian bytes, little-endian words), and swapped. Configuring the wrong byte order produces completely wrong values — a 3.14 float becomes a nonsense number — and the error is not always obvious from the magnitude alone.
Poll block size should be tuned to the device limit: reading a block of registers in one FC 03 request is far more efficient than polling each register individually. Most PLCs and RTUs support blocks of 16–64 registers per request. Avoid mixing read-only and read/write registers in the same poll block unless the device supports it.
Select a function code from the master request panel — read codes (FC 01–04) or write codes (FC 05, 06) — and enter the address (0–15 in this virtual device). For write operations, enter the value to write. Click Execute to send the request to the virtual slave. The transaction log records each request with a timestamp, function code, address, and result. Enable Live mode to watch input registers change in real time, simulating a live field sensor. The register map tables update immediately to reflect writes and live changes.
Input registers (3xxxx, FC 04) are read-only 16-bit registers that represent current field measurements — sensor readings, process values, status words. They are updated each device scan from the field. Holding registers (4xxxx, FC 03/06/16) are read/write registers used for configuration, setpoints, and parameters. The distinction is enforced by the function code: writing to an input register address using FC 06 returns exception code 01 (Illegal Function).
Use FC 03 to read two consecutive holding registers starting at the address of the high word. The 32-bit float is reconstructed by combining the two 16-bit values according to the device's byte order. For Modbus standard (big-endian), the high word is at the lower address. Check the device manual for the exact byte order. In your SCADA or OPC server, configure the tag as a 32-bit float with the correct byte order; the driver handles reconstruction automatically.
When a Modbus device cannot process a request, it returns an exception response with the function code ORed with 0x80 and a one-byte exception code. Exception 01 = Illegal Function (the device does not support this FC). Exception 02 = Illegal Data Address (the address is outside the valid range). Exception 03 = Illegal Data Value (the value is out of range for this register). Exception 04 = Slave Device Failure (internal device error).
No. Discrete inputs (1xxxx) and input registers (3xxxx) are read-only by the Modbus protocol definition. The Modbus spec does not define a write function code for these table types. Some devices implement proprietary extensions that allow firmware updates to these registers, but this is non-standard. If you need writable bit fields, use coils (0xxxx); for writable word values, use holding registers (4xxxx).
Modbus RTU poll frequency is limited by baud rate and the response time of the device. At 9600 baud, a request/response cycle for 10 registers takes approximately 30–50 ms including inter-frame gaps, limiting polling to roughly 20–30 Hz per device. At 115200 baud, cycle time drops to approximately 5–10 ms. Modbus TCP on a 100 Mbps LAN has much lower serialization latency but is still limited by device processing time (typically 1–10 ms per request).
Try our SCADA Studio
More calculators, simulators, and guides for this discipline.