Free engineering calculators and unit convertersceo@instrumentationblog.in
Cheat Sheets · Free PDF

Modbus and HART Cheat Sheet

Modbus RTU and TCP, RS485 and HART on one page: function codes, register numbering, frame layout, timing, wiring rules and HART basics.

One page A4Print ready PDFFree, no sign up

Download

Modbus and HART Cheat Sheet PDF preview

A one page A4 sheet to print, pin up in the workshop or keep on your phone. Everything on it is also shown below.

Download PDF A4 · 81 KB

Function codes

CodeAction
01Read coils
02Read discrete inputs
03Read holding registers
04Read input registers
05Write single coil
06Write single register
15Write multiple coils
16Write multiple registers

Register numbering

TypeDoc. numberAccess
Coils0xxxxRead/write bit
Discrete inputs1xxxxRead bit
Input registers3xxxxRead 16 bit
Holding registers4xxxxRead/write 16 bit

Protocol addresses are 0 based: 40001 is holding register address 0.

RTU frame

FrameAddress | Function | Data | CRC (low byte first)
Slave address1 to 247 (0 = broadcast)
Character11 bits (start, 8 data, parity or 2nd stop, stop)
Frame gap≥ 3.5 character times
CRCCRC 16, polynomial 0xA001 (reflected)
Advertisement

Modbus TCP

Port502
Header (MBAP)7 bytes: transaction, protocol, length, unit ID
Error checkBy TCP (no CRC)

Floats and longs

  • 32 bit values use two registers.
  • IEEE 754 float; word order varies by device (big or little endian, swapped).
  • If values look huge or tiny, try swapping words.

RS485 rules

  • Daisy chain, no stars; short stubs.
  • 120 Ω termination at both ends only.
  • Bias resistors at one point.
  • 32 unit loads per segment; up to about 1200 m at low baud.
  • Twisted pair plus common reference; screen earthed at one point.

HART essentials

SignalFSK 1200 Hz = 1, 2200 Hz = 0, 1200 bit/s
Loop resistance≥ 250 Ω (typically 230 to 1100 Ω)
ConnectAcross the transmitter or the loop resistor

Common HART commands

NoCommand
0Read unique identifier
1Read primary variable
2Read loop current and % range
3Read dynamic variables and current
6Write polling address
12Read message
13Read tag, descriptor, date
15Read device information
17Write message
18Write tag, descriptor, date

Troubleshooting

  • No response: address, baud, parity, A/B swapped, termination.
  • CRC errors: noise, grounding, wrong baud or stubs.
  • Wrong values: register offset of one, word order, scaling.

Related Calculators and Tools

Advertisement

Frequently Asked Questions

Why is 40001 address 0?

Documentation numbers are 1 based with a type prefix; the protocol sends a 0 based address.

How long is a 3.5 character gap at 9600 baud?

About 4 ms (11 bits per character); above 19,200 baud a fixed 1.75 ms is used.

Why can my HART communicator not connect?

Usually loop resistance below 250 Ω or wrong connection points.

You May Also Like

Learn more on the blog

Modbus RTU troubleshooting: CRC, no response and fault table

A practical guide on instrumentationblog.in that explains the theory behind this cheat sheet.

Read Full Article

More Cheat Sheets