Modbus addressing — 40001 vs. offset 0

The four Modbus data tables, 00001/10001/30001/40001 notation, zero-based vs. one-based addressing and how to avoid off-by-one errors.

The four tables

TablePrefix in documentationRead functionsWrite functions
Coils0xxxx0105, 15
Discrete Inputs1xxxx02—
Input Registers3xxxx04—
Holding Registers4xxxx0306, 16

The function code selects the table, not the address. Function 03 at address 0 always reads the first holding register; function 04 at address 0 reads the first input register. These are different areas of the device (although some vendors map them onto the same data).

40001 is a documentation convention

The specification distinguishes:

  • the data model — elements of each table are numbered 1 to n;
  • the PDU (message on the wire) — an element is addressed 0 to 65535.

Element number X is sent with address X − 1. The Modicon notation puts the table in the first digit and the one-based element number in the remaining digits.

In documentationTableElement numberAddress in the request
00001Coil10x0000
10010Discrete Input100x0009
30001Input Register10x0000
40001Holding Register10x0000
40100Holding Register1000x0063 (99)
400001Holding Register10x0000

Five-digit notation covers element numbers 1…9999; six-digit notation (400001…465536) covers the full range.

The number 40001 is never transmitted. "Address 40001" means function 03, starting address 0.

Why off-by-one errors happen

Vendors document registers in different ways:

  1. 4xxxx notation — 40101 means address 100.
  2. One-based register number — "register 101" also means address 100.
  3. Zero-based PDU address — "register 100" or 0x0064 means address 100.
  4. Hex addresses — usually zero-based (0x2000), but not always.

SCADA and PLC drivers differ too: some expect 40101, others the offset 100, some have a "zero-based addressing" option. If a value looks like a neighbouring parameter or half of another number, check for an off-by-one first.

Practical trick: find a parameter with a known value in the register map (rated voltage, serial number, firmware version), read a few registers around it and see where the value matches.

Bits inside registers

Many devices pack flags into a register (status word, alarm word). Bits are usually numbered from the least significant: bit 0 = 0x0001, bit 15 = 0x8000. Decode such words with the Bit / Byte Tool.

Example

Meter manual: "Phase A voltage — 30001, FLOAT32, 2 registers". This is function 04, starting address 0, quantity 2. The two registers form one 32-bit value; the word order must be taken from the manual (see Byte and word order).

Loading the map…

Sources

  1. MODBUS Application Protocol Specification V1.1b3, section 4.3 "MODBUS Data model" — Modbus Organization

Updated 2026-10-01