How to Read Modbus Registers: Addresses, Data Types and Scaling

You’ve wired a sensor to RS485, the link is up, and your test tool returns a number: 215. Is that a temperature, a status code, or only half of a larger value? To read Modbus registers correctly, a working connection is not enough. Four pieces of information turn that number into a measurement: the right register type with its matching function code, the correct address without an off-by-one error, the data type including byte order, and the scaling factor with its unit.

The protocol itself is simple: four data tables, a start address and a count per request, and responses made of 16-bit words. Almost every real-world problem happens at the handoffs between the datasheet, your software and the device. Know those handoffs and most errors take minutes to find.

Modbus register types: coils, discrete inputs, input and holding registers

The Modbus data model has four areas. Two hold single bits and two hold 16-bit registers. Coils are bits you can read and write, traditionally used for relay outputs or on/off switches. Discrete inputs are also bits, but read-only, such as the state of a contact input. Input registers are read-only 16-bit words that typically carry measurements. Holding registers are 16-bit words with read and write access, intended for parameters, setpoints and configuration.

In practice, many manufacturers also put plain measurements into holding registers, because some controllers and gateways historically could only read that area. Only the datasheet tells you where a value lives.

The four areas are separate tables: holding register 0 and input register 0 are two different locations, and only the function code in the request decides which one is meant. The current specification, by the way, says client and server instead of master and slave. Both pairs mean the same thing.

Modbus function codes: which code reads which register?

Every Modbus request starts with a function code that picks the table and the operation. To read measurements you almost always need just two of them: FC03 for holding registers and FC04 for input registers. The table lists the common codes with the maximum quantity the specification allows per request.

A common mistake is the wrong code for the right value. Request a holding register with FC04 and the device answers with an exception, recognizable by the set top bit of the function code: 0x04 becomes 0x84, 0x03 becomes 0x83. The exception code that follows tells you why. Code 01 means the device doesn’t support the function, code 02 reports an illegal data address, and code 03 an illegal data value, such as a register count that is too large. No answer at all usually points lower down: wrong device address, wrong baud rate or swapped wires.

Leave the write function codes out of first commissioning. One accidentally overwritten register holding the device address or baud rate can make a device disappear from the bus.

Modbus address 40001 vs 0: how does the offset work?

This is where the classic Modbus mistake happens. Inside the protocol, every register is addressed from 0 to 65535. The specification states explicitly that the element numbered X is addressed in the request as X−1. Its own example: to read registers 108 to 110, you send the start address 107, which is 0x006B in hex.

A historical PLC notation adds an area digit in front: 0xxxx for coils, 1xxxx for discrete inputs, 3xxxx for input registers and 4xxxx for holding registers. The reference 40001 therefore means the first holding register, which has protocol address 0. Likewise 30001 is input register 0, and 40108 is holding register 107. Devices with more than 9999 registers sometimes use a six-digit form such as 400001.

Datasheets mix these conventions: some list 40001, some the zero-based address 0, some a one-based 1 without area digit, some hex. Tools differ too; many have a switch between protocol address and one-based numbering.

An offset error is sneaky because no error message appears; you simply read the neighboring register. Humidity shows up where temperature should be, or with a 32-bit value you combine the second half of one value with the first half of the next. So don’t just subtract one from every address. Instead, test with a register whose content you know for sure, such as the device address or a firmware version. If the address you entered returns exactly that value, your counting is right.

How to read 32-bit and float values from Modbus registers

A register holds 16 bits, and the manufacturer decides what they mean. As UINT16 they give a number from 0 to 65535; as INT16 in two’s complement, a number from −32768 to 32767. The same bit pattern 0xFFFB is 65531 unsigned and −5 signed. That’s where the famous 6553.1 °C readings in freezing weather come from: the probe reports −0.5 °C as −5 with a factor of 0.1, but the software interprets the register as unsigned.

An energy meter showing 100000 Wh needs 32 bits and occupies two consecutive registers, in this case 0x0001 and 0x86A0. A float32 value in IEEE 754 format also takes two registers. The temperature 21.5 °C as float32 sits in the registers 0x41AC and 0x0000. 64-bit values, INT64 or double, occupy four registers. Text such as serial numbers is often stored as ASCII, two characters per register.

Two rules follow. First, always read as many registers as the data type occupies, and do it in a single request. If you read the two halves of a meter reading at different moments, the value may change in between, and you end up joining halves of two different states. Second, never treat the individual registers of a float32 as separate values. The first register, 0x41AC, is 16812 as an integer, and that number has nothing to do with 21.5 °C.

Some registers aren’t numbers at all but bit fields. A status register can use individual bits to flag conditions such as a broken probe or an out-of-range measurement. Read as a number, that information is lost, so split it according to the manufacturer’s bit definitions.

Modbus byte order: big endian, little endian or word swap?

Within a single register, the specification requires big endian: high byte first. For values spanning several registers there is no binding rule, so each manufacturer decides whether the high word sits in the first or the second register and whether the bytes inside each word are swapped as well.

The four bytes of a 32-bit value are usually labeled A to D, with A as the most significant byte. The table shows what our example value of 21.5 °C becomes when your software applies each common order to registers the device sent as ABCD.

With floats, a byte order mistake is usually obvious at once, because you get tiny or absurdly large numbers. Integers are subtler: our meter reading of 100000 becomes 2258632705 with swapped words. That stands out, but with smaller values the same error can pass for high consumption on a dashboard.

Good datasheets state the order, often as “high word first” or “low word first.” Otherwise, test against a known value. The Milesight UC100 offers four byte orders for 32-bit and float values and two for 16-bit values. Step through them with a value you can read from the device’s own display, and keep an eye on the raw words as you go.

Modbus scaling: how does a register value become a measurement?

Many devices send measurements as integers with a fixed factor instead of floats. A raw value of 215 with a factor of 0.1 gives 21.5 °C. A pH probe might return 712 with a factor of 0.01 for pH 7.12. The protocol knows no units or decimal places; both come from the datasheet.

The general formula is: measurement = raw value × factor + offset. An offset comes into play when the manufacturer wants to avoid negative numbers. A probe might, for example, transmit the temperature plus 40 degrees, times 10. Then a raw value of 615 with a factor of 0.1 and an offset of −40 gives 21.5 °C again. Some devices store the factor in its own register, often as a power of ten. If that register holds −2, divide the raw value by 100. If the factor changes with the measuring range, read it along with every value.

Some raw values aren’t measurements at all. Many devices use reserved values such as 0x7FFF, 0x8000 or 0xFFFF to signal “no valid value” or “probe not connected.” Scale those blindly and 3276.7 °C ends up in your chart. Check the datasheet for reserved values and filter them out before the conversion.

Write down the raw value, factor, offset and target unit together. If the displayed value later changes while the raw value stays the same, you’ll know right away that the problem is in the conversion, not in the device.

How to read a Modbus register map

The register map is the most important document in the whole integration. A complete map lists, for each value, the address, the area or function code, the access type (R for read, W for write, R/W for both), the data type, the number of registers, the unit, the factor or resolution, and the valid range.

Look closely at the address column: 0x0100 is hex for decimal 256, and 40257 is the reference notation for the same location. A footnote or the chapter introduction often explains how the map counts. Read those notes before you type in the first address.

Watch for gaps, too. Some maps mark registers as “reserved” or skip addresses, and a block spanning such a gap may be rejected entirely with exception 02, even though each value alone is readable. Start with a single value and only widen the block once that works.

Finally, the version: register maps can change with firmware. Note the model and firmware version alongside every map. If a replacement device suddenly returns different values, look there first.

Which tool should you use to test Modbus registers?

Check every value directly on the bus before it goes into a gateway or platform. For Modbus RTU you need a USB-to-RS485 adapter on your computer. For Modbus TCP a network connection is enough; the standard port is 502. Proven software options include the commercial Windows tool Modbus Poll, the free QModMaster interface, mbpoll for the command line and the Python library pymodbus for your own scripts.

With RTU, baud rate, parity, data bits, stop bits and device address must match the device exactly. If you get no response at all, check the A and B wires. Manufacturers label them inconsistently, and they get swapped a lot. On longer runs, each end of the bus needs a 120 Ω termination resistor.

Then read one known register and compare it with the device’s display or a reference measurement. Most tools show the raw value side by side as UINT16, INT16, hex and, for two registers, float32 in different byte orders, so you catch offset, type and order problems in one pass. Confirm the result at a second measuring point so a lucky match doesn’t slip through.

Once that works, transfer the settings to the device that will collect the value permanently. The Milesight UC100 works as a Modbus RTU client and polls up to 32 channels. For each channel you enter the device address, start address, register count, data type, byte order and sign. The Fetch function in its configuration tool sends a test read, so you can see immediately whether the result matches your computer test.

Where can you buy a Modbus RS485 converter?

Your register map tells you whether a converter fits. Check which areas it can read, from coils to holding registers, and whether it supports both FC03 and FC04. Compare the data types: if your values are stored as float32 or INT32, the converter has to read two registers together and let you set the matching byte order. For negative values, it needs an option for signed numbers.

Baud rate, parity and stop bits must match the device, and the number of channels must cover the values you need. A test function built into the configuration tool saves a lot of time during commissioning. And decide where scaling and offset will be calculated, in the converter or in the platform behind it.

Once you can read Modbus registers reliably and your map is complete, comparing options becomes straightforward. If you’re looking for a suitable converter, you’ll find our models in the Modbus category.

Modbus Registers FAQ

How many Modbus registers can you read at once?

The specification allows up to 125 registers per request with FC03 and FC04, and up to 2000 bits with FC01 and FC02. Many devices set lower limits or reject blocks that cross gaps. According to its documentation, the Milesight UC100 reads one or two registers per channel, across up to 32 channels.

Why does a Modbus register show the wrong value?

The most common causes are an off-by-one address offset, the wrong data type such as unsigned instead of signed, the wrong byte order on 32-bit values, or missing scaling. Test with a known value and look at the raw words before you start adjusting the conversion.

What is a Modbus holding register?

A holding register is a 16-bit register with read and write access. It is read with FC03 and written with FC06 or FC16. It holds parameters and settings, but on many devices it carries measurements too. In reference notation, the area starts at 40001.