Data model
Modbus register addressing: 40001 and PDU offsets
A familiar reference such as 40001 is documentation notation. A Modbus request carries a 16-bit address field in its PDU. Confusing the two is a common cause of requests that start one item too early or too late.
Data areas and function codes
| Area | Typical reference | Access function | Value size |
|---|---|---|---|
| Coils | 0xxxx | FC01 read; FC05/FC15 write | 1 bit |
| Discrete inputs | 1xxxx | FC02 read | 1 bit |
| Input registers | 3xxxx | FC04 read | 16 bits |
| Holding registers | 4xxxx | FC03 read; FC06/FC16 write | 16 bits |
The reference prefixes conventionally distinguish four logical data areas. The prefix is not transmitted as part of the PDU address. The function code selects the area and operation; the address field selects a location within that area.
Example: reference 40001
In a common one-based reference scheme, holding register 40001 corresponds to PDU address 0. The next reference, 40002, corresponds to PDU address 1. For example, a request to read 40001 and 40002 with FC03 uses start address 0 and quantity 2.
Documented holding-register reference: 40001
PDU start address in a common convention: 0
FC03 request address bytes: 00 00Read the device map carefully
Not every vendor document uses the same notation. A map may show zero-based offsets, one-based register numbers, a 4xxxx reference, or an address written in hexadecimal. Some master tools ask for a reference number, while others expect the raw PDU offset. Never subtract one blindly: first identify what the document and client field mean.
For each point, record the data area, function code, address convention, offset and number of 16-bit registers. A 32-bit value commonly occupies two adjacent registers, but byte and word ordering are device-specific. A single 16-bit register does not by itself define signedness, scaling or engineering units.
A reliable address check
- Identify the area: coil, discrete input, input register or holding register.
- Choose the function code that reads or writes that area.
- Translate the reference into the PDU offset according to the device map and master software.
- Read one known value and compare it with the device display or manual before expanding the range.
The ModbusLab register table labels its configured address as a raw PDU offset. For request structure, see FC03 request and response examples.
Sources
- Modbus Application Protocol Specification V1.1b3, especially the data model and function definitions.
- Modbus Organization: Introduction to Modbus, register model and addressing overview.
- Modbus Organization specifications.