PLC Simulator
Modbus function reference

Modbus Function Code 03 — Read Holding Registers

Read 16-bit read/write register values

03
Load in Modbus sandbox

Data model

Holding registers (4xxxx reference family)

Access

Read 16-bit read/write register values

Protocol quantity

1–125 registers

Worked example

Read the PDU field by field.

Read two holding registers from protocol address 0. The response contains values 1250 and 678.

Typical use: Polling setpoints, configuration, commands and process values mapped in the holding-register table.

Example protocol data units

Request PDU

03 00 00 00 02

Normal response PDU

03 04 04 E2 02 A6

PDU examples omit the Modbus TCP MBAP header and the Modbus RTU unit-address/CRC envelope. Multi-byte values are shown in network byte order.

Common implementation mistakes

  • Sending 40001 instead of address 0
  • Reading across an unmapped gap
  • Assuming a 32-bit float word order without a documented test value

Run the reference

Turn a protocol table into evidence.

Compose the request publicly, then use Pro for advanced graded exceptions, saved fixtures, complete history and project sharing.

Open sandbox

Technical reference and worked-example guide

Modbus function 03 holding-register guide: field reference

Direct answer

The reader can construct a bounded request, reconcile zero- and one-based documentation, validate byte and word interpretation and handle exceptions or stale data.

Written for pLC, SCADA and integration learners reading holding registers over Modbus RTU or TCP and mapping words into engineering values.

a controls bench tracing generic PLC, remote I/O, serial and Ethernet paths into protocol diagnostics and mapped application data while studying Modbus function code 03 request, register mapping and diagnosis
System map / 02

NODE 01observable

Definition

Client, server, transport, unit or slave identity, starting address, quantity, documented register reference, word type, byte and word order, scale, units, freshness and exception handling.

NODE 02observable

Signal path

Application request through transport and device parser to holding-register words, typed conversion, engineering value, quality and consuming logic.

NODE 03observable

Worked example

Minimum legal representative quantity read from a known address and independently compared with the device state.

NODE 04observable

Limits

Address before first, last valid range, excessive quantity, exception response, timeout, restart, word swap, signed value and stale cache.

NODE 05observable

Common mistake

An identity, transport, function, base-address, quantity, map, byte-order, type, scale, freshness or application mismatch.

NODE 06observable

Verification

The request and interpretation checked against current device documentation and a known physical or simulated reference.

Answer surface / 07

What does Modbus function code 03 do?

It reads one or more holding registers from a server; the register meaning, addressing notation, data type and scale come from the device documentation.

Why is a Modbus register value wrong even when the read succeeds?

The address base, byte or word order, signedness, multi-register type, scale or units may be interpreted incorrectly.