How to Read Any Modbus Register Map
Every Modbus device ships with its own register-map table — and every table has its own quirks. Learn the four data types, the read/write function codes, and the two mistakes that trip up even experienced integrators.
Reading a register map in four steps
Identify the data type
Check whether the value sits in a coil, discrete input, input register or holding register — that determines which function code and access rights apply.
Match the function code
Use FC03/FC04 to read holding or input registers, and FC06/FC16 to write single or multiple registers. Reading with the wrong code returns an exception, not data.
Resolve the addressing offset
Work out whether the documentation lists Modicon-style numbers (e.g. 40001) or the 0-based protocol address actually sent on the wire — mixing the two is the single most common integration bug.
Confirm byte and word order
For any 32-bit value spanning two registers, verify the manufacturer's word order with a known test value before trusting the scaled result.
What actually trips people up
The addressing offset trap
Modicon numbering starts registers at 40001, but the address sent on the wire is 0-based — so register 40001 is protocol address 0. Get this wrong and every read is off by one.
Four data types, two access rights
Coils and discrete inputs are single-bit values; input and holding registers are 16-bit words. Only coils and holding registers can be written — input data and discrete inputs are read-only by design.
Function codes decide what you can do
FC01/02 read coils and discrete inputs, FC03/04 read holding and input registers, FC05/06 write a single coil or register, FC15/16 write multiple. The device rejects any code it doesn't support for that data type.
The 40001/30001 offset trap
Historic Modicon-style numbering (40001, 30001...) does not match the 0-based address sent on the wire. Always check which convention a given datasheet uses before wiring up a poll.
Word order isn't standardised
When two 16-bit registers combine into a 32-bit value, manufacturers differ on which register holds the high word. A wrong assumption produces numbers that look plausible but are wrong.
No built-in authentication
Modbus RTU and classic Modbus TCP were never designed with security in mind — any device on the bus or network can issue a valid command. Segmentation and gateway filtering do the job the protocol doesn't.
Engineering support for Modbus integration
When a register map doesn't behave as documented, our engineers help you verify it before it becomes a commissioning delay.
- Register-map read-through against the device's own documentation
- Function-code and addressing-convention verification before commissioning
- RS-485 network topology and termination review
- Word-order/endianness checks for multi-register values
- Panel assembly and integration support to IEC 61439
Frequently asked questions
What's the difference between a holding register and an input register?
Both are 16-bit words, but holding registers are read/write (function code 03 to read, 06/16 to write) while input registers are read-only (function code 04). The distinction is set by the device firmware, not by you — check the datasheet to see which one holds the value you need.
Why is my Modbus reading exactly double or half the correct value, or completely wrong?
This is almost always a word-order (endianness) mismatch when a 32-bit value is split across two 16-bit registers. Manufacturers don't agree on whether the high or low word comes first — swap the register order and recheck against a known reference value.
Why does register 40001 in the datasheet correspond to address 0 on the wire?
It comes from Modbus history: the historic Modicon numbering convention starts holding registers at 40001, but the actual protocol address transmitted on the wire is 0-based. Register 40001 = protocol address 0, register 40002 = address 1, and so on.
Which function code should I use to write a value to a Modbus device?
Use FC06 to write a single holding register or FC05 for a single coil. Use FC16 to write multiple holding registers in one transaction, or FC15 for multiple coils. You can never write to input registers or discrete inputs — they're read-only by design.
Does Modbus have any built-in security?
No. Neither Modbus RTU nor classic Modbus TCP includes authentication or encryption in the specification — any node on the bus or network can send a valid command. Security has to come from outside the protocol: network segmentation, a protocol-aware gateway, and restricting who can reach the automation network at all.
Need a second pair of eyes on a Modbus integration?
Our engineers review register maps, wiring and commissioning plans before they become a delay on site. Get in touch.