Recognize Modbus addressing and register documentation

What you should be able to do

Read the fields in a Modbus register map and turn an explicitly documented raw value into engineering units without guessing its address or encoding.

Scope

This is an offline interpretation lesson for low-voltage controls technicians. The register map and temperature values are fictional. No device request, scan, configuration change or write command is performed or authorized by this exercise. Use the correct model and firmware documentation for real equipment.

1. Start With The Map

A useful register record identifies the point, table, supported function, addressing convention, register count, representation, scale, units, access and special values. Save the document revision alongside those fields. A screenshot containing only an address and a number is not a complete integration record.

The original poster map defines: Point: room temperature. Table: holding registers. Read function:03. Printed reference:40001, explicitly using the traditional first-holding-register convention. Protocol data unit address:0. Quantity:1 register. Representation:signed16-bit integer. Engineering conversion:decoded integer ×0.1 degrees Celsius.

This fictional temperature is observed through a read operation. Its placement in the holding-register table does not authorize writing to it or mean the real product would support such a write.

2. Distinguish Table And Address

Modbus defines separate data areas, including coils, discrete inputs, input registers and holding registers. Register values are16-bit quantities at the protocol level; coils and discrete inputs represent bits. Function03 reads holding registers, while04 reads input registers. The selected table/function matters even when an address number looks identical.

Protocol addresses start at zero. Printed documentation and client interfaces may use reference numbers or one-based labels instead. Schneider Electric's overview illustrates traditional reference40001 as data address0. This is a convention to confirm, not an instruction to subtract40001 from every number found in every manual.

For the poster's declared convention only: 40001 corresponds to protocol address0. 40002 corresponds to protocol address1. 40010 corresponds to protocol address9.

A manual that already prints zero-based offsets needs no second subtraction. Client software may ask for a reference number, an offset or a one-based address. Read the field definition before entering anything.

3. Keep Device Identity Separate

The server identity selects which device is being addressed in the communication arrangement. The register address selects data within that device and table. The returned value is the content, not another address.

An original record might say server7, holding reference40001, decoded value235. Those three numbers serve different purposes. For an actual serial or TCP installation, use the documented device addressing and any gateway unit-identifier requirements. Do not infer that a TCP unit identifier always has exactly the same routing role as a serial device address.

Worked through

A register contains bits. The map tells you what those bits mean: for example an unsigned integer, signed integer, status bit field or part of a larger number. Modbus's protocol specification defines high-byte-first encoding for a16-bit data item. Multi-register values require their documented register ordering and representation; do not assume a universal32-bit word order from the16-bit rule alone.

The poster's positive raw integer235 becomes23.5°C after multiplication by0.1. For a negative example, a signed16-bit two's-complement pattern0xFFCE represents−50. Applying the same scale gives−5.0°C. If that bit pattern is mistakenly interpreted as unsigned65486, the result would be6548.6°C. The arithmetic might execute correctly while the interpretation is wrong.

First decode according to the map, then apply its defined conversion. Do not assume every device uses multiplication by0.1. A product may specify a divisor, offset, floating-point value or other representation. Record the formula explicitly.

5. Check Count, Units And Special Values

A32-bit value commonly occupies two16-bit registers, but its type and ordering still require documentation. Reading only one half is not a complete value. An adjacent register is not automatically a separate sensor.

Units must come from the map and configuration. A temperature number could be Celsius, Fahrenheit or a scaled integer. A status value may be a bit field rather than a measurement at all.

Review reserved or invalid-value codes before treating every returned bit pattern as a legitimate measurement. A code reserved for unavailable data must not be displayed as a real temperature. An exception response is also not a normal measurement. A communication timeout gives no new process value and should not be silently substituted with zero.

6. Keep Observations Reviewable

For an offline example, record the map revision, device model, point name, function, address convention, register count, raw data, decoding, scale, units and time associated with the saved sample. Preserve the original raw sample so another reviewer can reproduce the result.

If the number is plausible, still verify its identity. Reading an adjacent room's register could give a believable temperature. Plausibility is a reason to continue checking, not proof of correct addressing.

Do not try write functions to discover which address controls something. A write can change equipment operation. A read/write label describes a capability or map access category; it does not supply task authorization or establish a safe operating procedure.

Original Practice

1. Under the poster's declared convention, what protocol address corresponds to40005?4.
2. A manual already says offset4. Should you subtract1 again?No; confirm what the client field expects.
3. Raw integer187 with scale0.1°C becomes18.7°C.
4. Signed decoded integer−125 with scale0.1°C becomes−12.5°C.
5. A map specifies a32-bit value across two registers. Is one returned register sufficient?No.
6. Two devices use the same register offset for different quantities. Does that violate this lesson?No; register meanings are device-map-specific.
7. A holding-register read succeeds. Does that grant permission to write?No.
8. A timeout occurs. Is the actual room temperature0°C?That conclusion is unsupported.

Knowledge Check

Sources

Where beginners go wrong