Modbus Function Code 02 (Read Discrete Inputs): Protocol Specification & Hex Analysis

In industrial automation systems, monitoring binary digital inputs—such as emergency stop buttons, inductive proximity sensors, motor overload contacts, and liquid level float switches—relies directly on Modbus Function Code 02 (Read Discrete Inputs / 0x02). Defined under the official Modbus Application Protocol Specification V1.1b3, Function Code 02 enables a client/master to poll between 1 and 2,000 contiguous 1-bit read-only inputs from a remote server/slave in a single request frame.

Whether you are commissioning a new SCADA polling driver, programming a PLC gateway, or debugging communication timeouts over RS-485 serial buses, understanding the exact bit-packing logic, zero-based wire addressing, and protocol exception handling of Function Code 02 is essential. This engineering guide breaks down the protocol specification, analyzes raw hexadecimal packet traces for Modbus RTU and Modbus TCP, provides working Python code, and demonstrates how to simulate discrete inputs in ModbusSimulator.

1. The Modbus Memory Model: Coils vs Discrete Inputs

The Modbus protocol defines four distinct register tables. Discrete Inputs occupy a specialized role as read-only physical status points:

Key Architectural Distinction: While both Coils (FC01) and Discrete Inputs (FC02) return binary 1 or 0 values, Discrete Inputs are strictly read-only from the network. They directly mirror the state of physical opto-isolated digital inputs on PLC terminal strips or RTU expansion racks. If a master attempts to issue a write command to an address mapped in the discrete input table, an industrial slave must respond with an error.

2. Protocol Data Unit (PDU) Specification

Under the Modbus standard, the Protocol Data Unit (PDU) is independent of the underlying physical transmission layer (whether RS-485 serial, RS-232, or Ethernet TCP/IP).

Request PDU Format (Client → Server)

The request PDU consists of exactly 5 bytes:

Response PDU Format (Server → Client)

The normal response PDU contains a byte count followed by the packed input data bytes:

3. Bit-Packing Algorithm & Hex Frame Analysis

Because discrete inputs are 1-bit values, Modbus packs up to 8 inputs into each payload byte to optimize industrial transmission bandwidth. The lowest-addressed input is placed into the Least Significant Bit (Bit 0) of the first data byte. If the requested quantity is not an exact multiple of 8, the unused high-order bits in the final byte are padded with zeros.

Worked Example: Reading 12 Discrete Inputs in Modbus RTU

Suppose an automation client wants to read 12 discrete inputs starting at PLC address 10197 from Slave ID 1.

• Slave ID: 0x01
• Function Code: 0x02
• Starting Address: 10197 in 1-based notation corresponds to wire offset 10197 - 10001 = 196 = 0x00C4.
• Quantity: 12 inputs = 0x000C.

Request Frame (Modbus RTU Hex):

01 02 00 C4 00 0C B9 D6

Simulated Input States:

Assume the 12 inputs on the server have the following states:

• Inputs 10197 – 10204 (first 8 inputs): ON, OFF, ON, ON, OFF, ON, OFF, ON → Binary: 10101101 = 0xAD
• Inputs 10205 – 10208 (last 4 inputs): ON, OFF, ON, OFF → Binary: 00000101 (padded with 4 leading zeros) = 0x05

Response Frame (Modbus RTU Hex):

01 02 02 AD 05 78 8B

4. Modbus TCP ADU Format (MBAP Header)

When transmitted over Ethernet networks using Modbus TCP (Port 502), the 2-byte CRC checksum is discarded. Instead, a 7-byte Modbus Application Protocol (MBAP) Header precedes the PDU:

[Transaction ID: 2B] [Protocol ID: 2B (0x0000)] [Length: 2B] [Unit ID: 1B] [PDU: 5B]

For the identical 12-input request over TCP with Transaction ID 0x0001:

00 01 00 00 00 06 01 02 00 C4 00 0C

• 00 01: Transaction Identifier
• 00 00: Protocol Identifier (0 = Modbus)
• 00 06: Length (6 bytes remaining: Unit ID + PDU)
• 01: Unit Identifier (Slave address)
• 02 00 C4 00 0C: Function Code 02 PDU

5. Error Handling & Exception Codes

When a slave device cannot successfully process a Function Code 02 request, it responds with an Exception Response. The function code in the response has its most significant bit set (0x02 + 0x80 = 0x82), followed by a 1-byte Exception Code:

6. Python Pymodbus Implementation Example

The following script demonstrates how to poll discrete inputs using the popular pymodbus library over Modbus TCP or RTU:

from pymodbus.client import ModbusTcpClient
import time

def read_discrete_sensors(host='127.0.0.1', port=502, slave_id=1):
    client = ModbusTcpClient(host=host, port=port)
    if not client.connect():
        print(f"[-] Connection failed to {host}:{port}")
        return

    try:
        # Read 16 discrete inputs starting at wire address 0 (PLC address 10001)
        response = client.read_discrete_inputs(address=0, count=16, slave=slave_id)

        if response.isError():
            print(f"[-] Modbus Error: {response}")
            return

        # response.bits is a list of booleans [True, False, True, ...]
        bits = response.bits[:16]
        print(f"[+] Successfully polled {len(bits)} Discrete Inputs from Slave {slave_id}:")
        for idx, state in enumerate(bits):
            wire_addr = idx
            plc_addr = 10001 + idx
            status_text = "ACTIVE (1)" if state else "INACTIVE (0)"
            print(f"    Input {plc_addr} [Wire 0x{wire_addr:04X}]: {status_text}")

    finally:
        client.close()

if __name__ == '__main__':
    read_discrete_sensors()

7. Simulating Discrete Inputs with ModbusSimulator

Testing SCADA dashboards and PLC communication routines before physical hardware is delivered is best accomplished using ModbusSimulator. You can configure multi-device virtual slaves with full discrete input table support:

• Multi-Slave Support: Run dozens of simulated slaves on separate Unit IDs or TCP ports simultaneously.
• Dynamic Scripting & Simulation: Automatically toggle discrete inputs using sine waves, random triggers, or custom timed sequences to test SCADA alarm annunciations.
• Live Hex Packet Sniffer: Inspect incoming FC02 requests and verify bit-packing responses directly in the real-time frame monitor without needing external Wireshark captures.
• Cross-Protocol Conversion: Test Modbus RTU serial (via virtual COM ports) and Modbus TCP seamlessly on Windows 10 and 11.

Frequently Asked Questions (FAQs)