Modbus Read Request Planner

How the grouping works

• The table sets the function code: coils 01, discrete inputs 02, holding registers 03, input registers 04. Different tables cannot share a request.
• A request reads one contiguous run from its start address. To read two separated addresses in one go you must read everything in between.
• Values are sorted by address. If the gap to the next value is within the allowed gap and the quantity stays within the limit, the current request grows; otherwise a new one starts.
• A two-register value written as 40021*2 is never split across requests; if it would cross the limit, it moves whole to the next request.
• RTU bytes: 03/04 request 8, response 5 + 2 × quantity · 01/02 response 5 + ⌈quantity ÷ 8⌉. TCP swaps the 3 bytes of slave ID and CRC for the 7-byte MBAP header.
• Poll cycle = sum over requests of (request time + device delay + response time + 3.5 characters before the next request).

By allowed gap (default list, 9600 bps 8E1, 10 ms device delay)

Reading the same list one value at a time takes 27 requests, 397 bytes and 833.177 ms per cycle. Every request carries a device delay and a 3.5-character pause, so cutting the number of requests saves more time than cutting bytes.

How to read it

• «Unused» registers are read along with the list but are not in it. Some devices reject the whole request with exception 02 (Illegal Data Address) if it touches an undefined address — for those, set the allowed gap to 0.
• The specification limit is 125 registers or 2000 bits. Many devices accept fewer (see «Max per request» on the device map). Going over gives exception 03 (Illegal Data Value).
• Over TCP there is no serial transmission time, so the number of requests is the number of round trips. Device processing and network round trip are added per request, so grouping still pays off.
• You can also poll fast-changing values (measurements) and rarely changing ones (settings) at different rates — split the list in two and group each.

Where it is used

• Building Modbus master tag lists in an HMI, SCADA or PLC — sort tags by address to cut the number of blocks (requests).
• When the poll cycle comes out longer than planned: see how many requests there are and which ones were split by gaps.
• When a device returns exception 02: check whether a grouped request includes an address the device does not have.

FAQ

How many registers can one Modbus request read?

The specification (Application Protocol V1.1b3 §6.3, §6.4) allows 1–125 for functions 03 and 04, and 1–2000 bits for 01 and 02. Devices may accept fewer, so follow the manual's limit.

Can I read two separated addresses in one request?

A request reads a contiguous run, so the registers in between are read too. If the device does not define one of them, it may answer with exception 02.

Can 40001 and 30001 go in one request?

No. 40001 is a holding register (function 03) and 30001 an input register (function 04), so they need separate requests. Both are wire address 0.

What if a 32-bit value (float) falls on a request boundary?

If the two words are read in different requests, the value can change in between and the halves no longer match. This planner never splits a value written with «*2».

To build the frame for one request, use the Modbus RTU Request Builder. For character time and timeouts by baud rate, use the Serial Timing Calculator. For why exceptions 02 and 03 happen, see the Modbus exception codes guide. For each device's addresses and request limit, see the device register maps.

Basis

MODBUS Application Protocol Specification V1.1b3 (2012-04-26) — §4.4 addressing model (number X is PDU address X−1, pp. 7–8), §6.1/6.2 reads of 1–2000 (pp. 11–12), §6.3/6.4 reads of 1–125 (pp. 15–16), and each function's request and response layout. The 3.5-character time is from MODBUS over Serial Line V1.02 §2.5.1.1. The specifications are on the Modbus Organization specifications page.