Modbus register addresses: 40001 or 0?
A manual says 40001, your tool asks for 0 and the value is wrong by one. This page explains the two numbering styles and how to find the address a device really uses.
The protocol counts from 0
A Modbus request carries a 16-bit start address, and that address starts at 0. The first holding register of a device is address 0 in the frame. Many manuals instead print a reference number such as 40001 for the same register. The leading digit names the table and the rest is the position counted from 1, so 40001 is holding register address 0 and 40108 is address 107.
The four tables
| Table | Read with | Reference numbers | Size and access |
|---|---|---|---|
| Coils | 01 | 00001 and up | 1 bit, read and write |
| Discrete inputs | 02 | 10001 and up | 1 bit, read only |
| Input registers | 04 | 30001 and up | 16 bit, read only |
| Holding registers | 03 | 40001 and up | 16 bit, read and write |
The function code selects the table. The prefix digit is only a naming convention and is never sent. That is why reading 30001 means function 04 at address 0, not function 03 at address 30000.
Finding the off-by-one error
- The value belongs to the neighbour. You read address 100 and get the value that the manual lists for 101 (or 99). The manual uses 1-based numbering and the tool is 0-based, or the reverse. Move the start address by one.
- Exception 02 (Illegal Data Address). The first or the last register of the block is outside what the device implements, often because the numbering is shifted by one. See Modbus exception codes.
- The wrong table. Using function 03 for a value the device keeps in input registers returns a different value or exception 02. Try 04 at the same address.
- Five-digit numbers. Strip the prefix digit and subtract 1. For six-digit numbers such as 400001 strip the first two digits and subtract 1.
Check it in Busscope
Busscope sends and displays the address that goes into the frame, so it is 0-based: entering 0 reads the register that a manual calls 40001. If the first value looks like the neighbour's, change the start address by one and compare. In a poll definition you choose the function (1 to 4), the start address and the quantity.
When the documentation is missing or wrong, the Register Probe reads an address range in blocks and reports which ranges answer and which return an exception. The traffic panel (F4) shows the exact frame, so you can read the start address as hex and confirm what was sent.
Related guides
Try Busscope
Install Busscope and run it without a license key to see whether it fits your work. Evaluation mode is for trying the tool, not for production or commercial use.