# Read/Write Memory - Read Command (03)

{% hint style="info" %}
When reading large values using different data formats (e.g., Float32 or Int64) and performing conversions, very small differences may occur due to internal calculation methods, typically less than 1/10,000, which is considered normal.

Registers from different parameter categories cannot be read across categories. A single read command can access up to 40 registers. Requests exceeding this length will be ignored.
{% endhint %}

#### **Function Code:** 03

This command can read single or multiple holding registers, used to access configuration parameters defined in the device’s Holding Registers.

#### **Read/Write Memory – Read Command (03) Format**

![](https://4028902321-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSBz5Tlpy8GCIkK4ygkgZ%2Fuploads%2Fi8RrD76NW3UTPTgMJvLR%2Fmodbus-03-TX-diagram-en.png?alt=media\&token=4ee38fc3-1e50-4370-a334-058fd901ef32)

![](https://4028902321-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSBz5Tlpy8GCIkK4ygkgZ%2Fuploads%2FCSwfoy6XhE4g9ogeNj4M%2Fmodbus-03-RX-diagram-en.png?alt=media\&token=78c65b76-de86-4411-98e9-92875473b288)

#### Modbus RTU **Example of Reading Read/Write Memory Holding Registers (03)**

Using Function Code 03 to read the **A02 Preset Pipe Spec** register as an example:

According to the Read/Write Memory – Read List, the starting address is **00 00**, register length is 3 (reading three registers: A02, A03, and first register of A04), data type is Int16 (16-bit integer), and byte order is **Big Endian**.

**Master Sends Read Command (TX Frame)**\
**TX Request Command:**

```
TX: 01 03 00 00 00 03 05 CB
```

* Slave Address = 01
* Function Code = 03
* Starting Register Address = 00 00 (starting address of A02 Preset Pipe Spec)
* Number of Registers to Read = 00 03 (read 3 registers starting from 00 00)
* CRC Checksum = 05 CB (calculated using the CRC algorithm)

**Slave Response Data (RX Frame)**

The master sends the read command to the slave (flow meter), which responds with the corresponding data.

**RX Response Data:**

```
RX: 01 03 06 00 06 00 00 42 41 59 E5
```

* Slave Address = 01
* Function Code = 03
* Byte Count = 06 (3 registers = 6 bytes)
* Data Bytes:
  * `00 06` — A02 Preset Pipe Spec = code 6 (astm sch 80 pvc)
  * `00 00` — A03 Pipe Geo Unit = 0 (mm)
  * `42 41` — first register of A04 Pipe Outer Diameter (Float32, high bytes)
* CRC = 59 E5 (calculated using the CRC algorithm)

#### **Data Parsing and Conversion (to Decimal)**

#### **Step A** – Arrange the Data

* Received Data: 0003
* Data Type: Int16 (16-bit integer)

#### **Step B – Convert to Decimal and Map Material**

* Convert the hexadecimal value 0003 to decimal:\
  Decimal Calculation: (0 × 256) + 3 = 3\
  Final Value: 3
* Material Mapping: Refer to the A08 Pipe Material list. The value 3 corresponds to PP material.

### **FAQ**

* **Why is there a difference between the “Memory Map” and the “PLC Read Address”?**

Users may see that the memory map shows **40005**, but in the PLC, **you need to enter 4 (or 0004) to read the correct value**.

This is due to Modbus addressing: human-readable addresses (memory map) and actual device read addresses (communication addresses) have a fixed offset.

For **Function Code 03**, **40001** is the base address. Reading starts from this base, so 40001 corresponds to offset **0000** and read address **0000**.

<div align="left"><figure><img src="https://4028902321-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSBz5Tlpy8GCIkK4ygkgZ%2Fuploads%2Fe6GjR9TfOh0BsMXi0cqL%2Fmodbus-img4.jpeg?alt=media&#x26;token=01462037-b1e1-4353-abe6-fe5c9b0eeaa9" alt="" width="540"><figcaption></figcaption></figure></div>

Therefore, when the document indicates reading **40005**, the actual starting address in the Modbus **Function Code 03** packet is **0004**, i.e.:

**Actual communication address=Document address−40001**

{% hint style="info" %}
**Note:** Modbus uses 0-based addressing (communication packets start from 0), So, in general : Actual communication address=Document address−40001.

**BUT, i**f the PLC or HMI is set to 1-based addressing (software adds 1), enter the starting address according to the software’s rules to read the correct register.
{% endhint %}