Modbus addressing — 40001 vs. offset 0
The four Modbus data tables, 00001/10001/30001/40001 notation, zero-based vs. one-based addressing and how to avoid off-by-one errors.
The four tables
| Table | Prefix in documentation | Read functions | Write functions |
|---|---|---|---|
| Coils | 0xxxx | 01 | 05, 15 |
| Discrete Inputs | 1xxxx | 02 | — |
| Input Registers | 3xxxx | 04 | — |
| Holding Registers | 4xxxx | 03 | 06, 16 |
The function code selects the table, not the address. Function 03 at address 0 always reads the first holding register; function 04 at address 0 reads the first input register. These are different areas of the device (although some vendors map them onto the same data).
40001 is a documentation convention
The specification distinguishes:
- the data model — elements of each table are numbered 1 to n;
- the PDU (message on the wire) — an element is addressed 0 to 65535.
Element number X is sent with address X − 1. The Modicon notation puts the table in the first digit and the one-based element number in the remaining digits.
| In documentation | Table | Element number | Address in the request |
|---|---|---|---|
| 00001 | Coil | 1 | 0x0000 |
| 10010 | Discrete Input | 10 | 0x0009 |
| 30001 | Input Register | 1 | 0x0000 |
| 40001 | Holding Register | 1 | 0x0000 |
| 40100 | Holding Register | 100 | 0x0063 (99) |
| 400001 | Holding Register | 1 | 0x0000 |
Five-digit notation covers element numbers 1…9999; six-digit notation (400001…465536) covers the full range.
The number 40001 is never transmitted. "Address 40001" means function 03, starting address 0.
Why off-by-one errors happen
Vendors document registers in different ways:
- 4xxxx notation —
40101means address 100. - One-based register number — "register 101" also means address 100.
- Zero-based PDU address — "register 100" or
0x0064means address 100. - Hex addresses — usually zero-based (
0x2000), but not always.
SCADA and PLC drivers differ too: some expect 40101, others the offset 100, some have a "zero-based addressing" option. If a value looks like a neighbouring parameter or half of another number, check for an off-by-one first.
Practical trick: find a parameter with a known value in the register map (rated voltage, serial number, firmware version), read a few registers around it and see where the value matches.
Bits inside registers
Many devices pack flags into a register (status word, alarm word). Bits are usually numbered from the least significant: bit 0 = 0x0001, bit 15 = 0x8000. Decode such words with the Bit / Byte Tool.
Example
Meter manual: "Phase A voltage — 30001, FLOAT32, 2 registers". This is function 04, starting address 0, quantity 2. The two registers form one 32-bit value; the word order must be taken from the manual (see Byte and word order).
Connections
Open in Knowledge Graph →Loading the map…
Sources
- MODBUS Application Protocol Specification V1.1b3, section 4.3 "MODBUS Data model" — Modbus Organization
Updated 2026-10-01