.png)
Modbus Mask Writes: Change One Bit Without Replacing the Whole Register
A client needs to change one configuration bit, but a whole-register write also replaces neighbouring bits. Where the exact device supports it, Modbus Mask Write Register provides a defined way to preserve selected bits and set or clear others. Check the bit map and supported function before choosing the transaction.
Key takeaways |
An AND-mask bit of 1 preserves the current bit. An AND-mask bit of 0 selects the corresponding OR-mask bit. Device support and application ownership still need verification. |
1. Identify who owns every bit
Start with the exact device register map and firmware revision. Identify the writable register offset, the bit numbering convention, reserved bits and any local controller logic that also changes the word. A bit displayed by an HMI may be a command, a latched status or a read-only indication; these are different contracts.
When discussing a communications design around the BG200 industrial IIoT gateway, include the required function code in the interface schedule. A product’s support for Modbus does not establish that every function is supported or transparently forwarded. Ask for confirmation of the particular client, gateway and server path.
2. Apply the actual mask rule
Section 6.16 of the Modbus application specification defines function 22 decimal, written 0x16 in hexadecimal. Its calculation combines the current register, an AND mask and an OR mask: result = (current AND AND-mask) OR (OR-mask AND NOT AND-mask). Treat the complement within the 16-bit register width.
For each bit, an AND-mask value of 1 keeps the old value; an AND-mask value of 0 allows the OR mask to supply the replacement. An OR-mask 1 does not force a bit high when that bit is preserved by the AND mask. Write the intended result per bit before converting the masks to hexadecimal.
3. Work through a hypothetical bench example
Suppose an isolated simulator has a holding register containing 0x00A5. The requirement is to set bit 1 and clear bit 2, with bit 0 defined as the least-significant bit. The selected positions form 0x0006, so the preserving AND mask is 0xFFF9 and the replacement OR mask is 0x0002.
The intermediate preserved value is 0x00A1; the final result is 0x00A3. All other bits retain their starting values. This is an invented test word, not a command for any ProSense product. Never send these example values to operating plant.
Repeat the test with starting words in which the selected bits already have their target values. Also vary neighbouring bits in the simulator. Acceptance should show both the intended changes and preservation of unrelated positions, rather than one apparently successful final decimal value.
Diagnostic checks
Mask decision | Bit result |
AND = 1 | Keep current bit |
AND = 0; OR = 0 | Clear selected bit |
AND = 0; OR = 1 | Set selected bit |
4. Verify the transaction and its limits
A normal mask-write response echoes the request after the register has been written. It does not report the final register value. Use a documented readback where appropriate, and compare it with the approved expected word. Controller logic may subsequently change the register; capture that timing rather than treating a later difference as proof of a transport failure.
If the server rejects the function, do not silently substitute a read-modify-write sequence. Another writer can change the word between a read and a subsequent whole-word write. Agree a supported ownership or coordination method instead. A mask operation also does not authorise competing controllers to write the same application state.
5. Keep the test inside an approved boundary
Use an isolated simulator or an approved test register that cannot initiate process movement. Competent people must define test permissions, restoration and any effect on machine operation. A generic protocol command is not a safety function, and a successful response does not validate a machine-control design.
Record the model and firmware, function, zero-based protocol offset, bit map, original word, masks, expected result and actual readback. Preserve the failed case as well as the correction. If a gateway changes or filters function support, the test must cover that complete path.
Practical handover checklist
Confirm the exact register and supported function through current device documentation.
Mark preserved and changed positions in a 16-bit test word.
Calculate both masks and independently check the expected result.
Run an approved isolated test, then verify readback and restoration.
Recommended equipment / related solutions
BG200 industrial IIoT gateway — Review it for the communications part of an integration; confirm handling of the exact requested function before selection.
ProSense RTU Monitoring Kit — Discuss a complete monitoring scope and its point list rather than assuming the kit provides this mask-write operation.
Frequently asked question
Is function 22 the same as function 16?
No. Decimal 22 is hexadecimal 0x16 and performs a mask write. Decimal 16 is hexadecimal 0x10 and writes multiple registers. Record the number base explicitly.
Technical reference
Need help with your application?
Discuss this application and request a project assessment. Send the exact equipment models, interface documentation and a sanitised example. Confirm compatibility, supported functions and acceptance scope before purchase or deployment.
