Modbus Thermostat Examples: How to Read and Write Data
In this article, you will learn:
· Common Modbus Function Codes – Modbus Thermostat Examples.
· Reading Temperature and Setpoint (0x03)
· Writing a New Setpoint (0x06)
· Writing Multiple Parameters (0x10)
· Troubleshooting Common Read/Write Errors
Click any topic above to jump directly to that section.
Modbus Thermostat examples start with reading and writing data. Once you have set up the RS485 bus and configured the correct Modbus addresses, the next step is to actually read and write data. This is where Modbus becomes truly useful — instead of manually adjusting each thermostat, you can read temperatures, change setpoints, and control fan speeds from a central system.
This article covers practical Modbus examples for HVAC thermostat control. In this guide, we will walk through the most common Modbus operations using real examples. The principles apply to most Modbus RTU thermostats used in HVAC systems.
Common Modbus Function Codes – Modbus Thermostat Examples.
Modbus defines a set of function codes that tell the slave device what action to perform. For HVAC thermostats, you will typically use three function codes:
| Function Code | Name | Use Case |
|---|---|---|
| 0x03 | Read Holding Registers | Read current temperature, setpoint, fan speed, and other parameters |
| 0x06 | Write Single Register | Change a single parameter, such as setpoint or fan speed |
| 0x10 | Write Multiple Registers | Change multiple parameters at once (e.g., setpoint + mode + fan speed) |
These Modbus thermostat examples use the three function codes listed above to control HVAC systems.
Function code 0x03 reads data from the thermostat, while 0x06 and 0x10 are used to write data to it. The response for a write operation is typically an echo of the request, confirming that the device accepted the command.
Reading Temperature and Setpoint (0x03)
The most common Modbus operation is reading the current room temperature from a thermostat. This is done using function code 0x03 (Read Holding Registers).
Example: Read Current Temperature
Assume we have a thermostat with slave address 0x01, and the current temperature is stored in holding register 0x0000 (the actual register address depends on your product’s Modbus map).
Request Frame (Master → Thermostat):
| Byte | Value | Description |
|---|---|---|
| Byte 0 | 0x01 | Slave address |
| Byte 1 | 0x03 | Function code (read) |
| Byte 2-3 | 0x0000 | Starting register address |
| Byte 4-5 | 0x0001 | Number of registers to read (1) |
| Byte 6-7 | CRC | Error check |
Response Frame (Thermostat → Master):
| Byte | Value | Description |
|---|---|---|
| Byte 0 | 0x01 | Slave address |
| Byte 1 | 0x03 | Function code |
| Byte 2 | 0x02 | Number of data bytes (2 bytes per register) |
| Byte 3-4 | 0x0190 | Register value (0x0190 = 400 decimal = 25.0°C, assuming 10x scaling) |
| Byte 5-6 | CRC | Error check |
If the thermostat reports a temperature of 25.0°C, the register value would be 0x0190 (400 decimal, assuming the value is stored with 10x scaling).
Writing a New Setpoint (0x06)
To change a single parameter, such as the temperature setpoint, use function code 0x06 (Write Single Register).
Example: Change Setpoint to 22.0°C
Assume the setpoint is stored in holding register 0x0001, and we want to set it to 22.0°C (stored as 220, or 0x00DC).
Request Frame (Master → Thermostat):
| Byte | Value | Description |
|---|---|---|
| Byte 0 | 0x01 | Slave address |
| Byte 1 | 0x06 | Function code (write single) |
| Byte 2-3 | 0x0001 | Register address (setpoint) |
| Byte 4-5 | 0x00DC | Value to write (220 = 22.0°C) |
| Byte 6-7 | CRC | Error check |
Response Frame (Thermostat → Master):
The normal response is an echo of the request, confirming that the write was successful. This allows the master to verify that the command was received and executed correctly.
| Byte | Value | Description |
|---|---|---|
| Byte 0 | 0x01 | Slave address |
| Byte 1 | 0x06 | Function code |
| Byte 2-3 | 0x0001 | Register address |
| Byte 4-5 | 0x00DC | Value written |
| Byte 6-7 | CRC | Error check |
In practice, if you are using a Modbus debugging tool like ModScan or QModMaster, you would enter the slave address, function code 06, the register address, and the value, and the software would handle the CRC calculation automatically.
Writing Multiple Parameters (0x10)
If you need to change several parameters at once — for example, setpoint, fan speed, and operating mode — use function code 0x10 (Write Multiple Registers).
Example: Change Setpoint, Fan Speed, and Mode
Assume:
· Setpoint register 0x0001 → set to 22.0°C (0x00DC)
· Fan speed register 0x0002 → set to Auto (0x0003)
· Mode register 0x0003 → set to Cooling (0x0001)
Request Frame (Master → Thermostat):
| Byte | Value | Description |
|---|---|---|
| Byte 0 | 0x01 | Slave address |
| Byte 1 | 0x10 | Function code (write multiple) |
| Byte 2-3 | 0x0001 | Starting register address |
| Byte 4-5 | 0x0003 | Number of registers to write |
| Byte 6 | 0x06 | Number of data bytes (3 registers × 2 bytes) |
| Byte 7-8 | 0x00DC | Value for register 0x0001 (22.0°C) |
| Byte 9-10 | 0x0003 | Value for register 0x0002 (Auto fan) |
| Byte 11-12 | 0x0001 | Value for register 0x0003 (Cooling mode) |
| Byte 13-14 | CRC | Error check |
Response Frame (Thermostat → Master):
| Byte | Value | Description |
|---|---|---|
| Byte 0 | 0x01 | Slave address |
| Byte 1 | 0x10 | Function code |
| Byte 2-3 | 0x0001 | Starting register address |
| Byte 4-5 | 0x0003 | Number of registers written |
| Byte 6-7 | CRC | Error check |
Using 0x10 is the preferred method when updating multiple related values that should change together — for example, if the fan speed should only change when the mode changes.
Troubleshooting Common Read/Write Errors
Even with correct wiring and addressing, communication issues can occur. Here are the most common errors and how to fix them:
| Symptom | Likely Cause | Solution |
|---|---|---|
| No response from device | Incorrect slave address or wiring issue | Verify the address matches the thermostat’s setting. Check RS485 wiring. |
Device responds with 0x01 | Illegal function — the device does not support the function code | Use only supported codes: 0x03, 0x06, 0x10. |
Device responds with 0x02 | Invalid data address — the register address does not exist | Check the register address against your product’s Modbus map. |
Device responds with 0x03 | Invalid data value — the value is out of range | Ensure the value is within the allowed range. |
| Timeout or no response | Communication parameters mismatch | Verify baud rate, parity, and stop bits match the thermostat’s settings. |
Exception Response Example
If the master sends an unsupported function code (e.g., 0x04), the thermostat will return an exception response with the highest bit of the function code set to 1. For example, if the master requests 0x04, the thermostat will respond with 0x84 and an error code indicating the reason.
For more detailed protocol information, visit the official Modbus website.
Looking for a Modbus thermostat for your HVAC project? Browse our product range for FCU and floor heating models.
Related Reading
· What is Modbus RTU and How Does It Work in HVAC Systems?
· Modbus Addressing Explained: A Simple Guide for HVAC Installers
· RS485 Modbus Thermostat Setup: Step-by-Step Guide
For more technical guides and product information, browse our blog or contact our engineering team for a free consultation.
Detailed Modbus protocol specifications are available on the official website.
