Modbus RTU Function 03 'Read Holding Registers'
To read a word (16 bits) from a register you send the following:
Byte 0 Modbus Device Address (1 to 247)
Byte 1 Function Code / Message Type (0x03)
Byte 2 Register Number (high byte)
Byte 3 Register Number (low byte)
Byte 4 Data Length (high byte, specified in Words) (1)
Byte 5 Data Length (low byte)
Byte 6 CRC of bytes 1 to 6 (high byte)
Byte 7 CRC of bytes 1 to 6 (low byte)
The response is sent as follows:
Byte 0 Modbus Device Address
Byte 1 Function Code / Message Type (0x03)
Byte 2 Number of bytes returned (specified in bytes, 1 register x 2 bytes = 2)
Byte 3 Data0
Byte 4 Data1
Byte 5 CRC of bytes 1 to 5 (high byte)
Byte 6 CRC of bytes 1 to 5 (low byte)
To read 3 words (16 bits) from 3 registers you send the following:
Byte 0 Modbus Device Address (1 to 247)
Byte 1 Function Code / Message Type (0x03)
Byte 2 Register Number (high byte)
Byte 3 Register Number (low byte)
Byte 4 Data Length (high byte, specified in Words) (1)
Byte 5 Data Length (low byte)
Byte 6 CRC of bytes 1 to 6 (high byte)
Byte 7 CRC of bytes 1 to 6 (low byte)
The response is sent as follows:
Byte 0 Modbus Device Address
Byte 1 Function Code / Message Type (0x03)
Byte 2 Number of bytes returned (specified in bytes, 3 registers x 2 bytes = 6)
Byte 3 Data0
Byte 4 Data1
Byte 5 Data2
Byte 6 Data3
Byte 7 Data4
Byte 8 Data5
Byte 9 CRC of bytes 1 to 5 (high byte)
Byte 10 CRC of bytes 1 to 5 (low byte)