When to use: Use this when integrating a Modbus device whose documentation gives a 1-based PLC reference (like 40001) but your SCADA/driver expects the 0-based protocol (PDU) address — or vice-versa. Holding registers map to 4xxxx, input registers to 3xxxx, coils to 0xxxx, and discrete inputs to 1xxxx. The protocol address sent on the wire is always zero-based: offset = reference − base (e.g. 40001 → 0).
Modbus is the most widely deployed serial communication protocol in industrial automation, and its address space divides into four distinct data tables — coils, discrete inputs, input registers, and holding registers — each with a 1-based PLC reference and a 0-based protocol (PDU) address. This calculator converts between the two numbering conventions so engineers can correctly configure SCADA drivers, OPC servers, and data acquisition software to poll the right registers.
Modbus defines four data tables: Coils (0xxxx, read/write single bits, FC 01/05/15), Discrete Inputs (1xxxx, read-only bits, FC 02), Input Registers (3xxxx, read-only 16-bit words, FC 04), and Holding Registers (4xxxx, read/write 16-bit words, FC 03/06/16). The 1-based PLC reference used in documentation (e.g., 40001 for the first holding register) is a human-readable convention; the actual address transmitted on the wire (the PDU address) is zero-based: PDU address = PLC reference − base (e.g., 40001 − 40001 = 0).
This one-off difference is the source of the most common Modbus integration errors. A device manual saying "read register 40001" means PDU address 0x0000, and a SCADA driver configured for address 1 will read the second register (40002). Always verify whether a driver uses 0-based or 1-based addressing and apply the appropriate offset.
The normative reference for Modbus is the Modbus Application Protocol Specification V1.1b3, published by Modbus.org. This document defines the PDU structure, function codes, exception codes, and data model. Modbus RTU (serial, TIA/EIA-485 physical layer) and Modbus TCP (Ethernet, TCP port 502) share the same application-layer PDU structure; only the framing differs. IEC 61158 includes Modbus as a fieldbus profile. IEC 62443 cybersecurity guidelines apply to Modbus TCP deployments that are exposed across network boundaries.
The most critical design consideration is consistency between the device data sheet addressing convention and the SCADA or DCS driver configuration. Some older SCADA software uses 1-based addressing internally and subtracts 1 before sending the request; others send the entered address directly as the PDU address. Always test with a Modbus master simulator (such as Modbus Poll or the Modbus Register Explorer) to verify the first register reads the expected value before commissioning.
For 32-bit floating point values stored in two consecutive 16-bit holding registers, confirm the byte order (big-endian is Modbus standard, but many devices use little-endian or mixed/swapped word order). Function code 23 (Read/Write Multiple Registers) allows atomic read-write in a single transaction, which is important for setpoint updates where the old value must not be read between the write and the next read cycle.
Select the data type (Coil, Discrete Input, Input Register, or Holding Register) and choose whether you are starting from a PLC reference (1-based, as shown in the device manual) or a protocol address (0-based, as configured in the driver). Enter the address value and the calculator outputs both the PLC reference and the PDU protocol address, plus the hexadecimal representation and the read function code. Use this when configuring SCADA poll lists, OPC UA node IDs, or verifying a data sheet entry against a driver configuration.
The most common cause is a mismatch between 0-based and 1-based addressing. If the device manual shows holding register 40001 and your SCADA driver is configured for address 1, you are actually reading 40002 (PDU address 1). Configure the driver for PDU address 0 (or reference 40001, depending on the driver convention) to read the first holding register.
The PDU address (the register number sent in the request) is identical between Modbus RTU and Modbus TCP. The only differences are the framing: RTU uses CRC-16 error checking and RS-485 physical layer; TCP wraps the PDU in a MBAP header (unit identifier, protocol identifier, length) and sends over TCP port 502. The data model and function codes are the same in both variants.
Modbus registers are 16-bit, so a 32-bit float or integer occupies two consecutive holding registers. The standard byte order is big-endian (high word first), but many devices use little-endian, mixed-endian, or byte-swapped order. Always check the device documentation and test with a known value. IEC 60870 and PROFINET provide native support for 32-bit types, which eliminates this ambiguity.
FC 03 (Read Holding Registers) allows a maximum of 125 registers (0x7D) per request. FC 01 (Read Coils) allows a maximum of 2000 coils per request. Exceeding these limits returns an exception code 03 (Illegal Data Value). In practice, many devices have lower limits documented in their data sheets, and SCADA systems poll in blocks matched to the device limit.
Input registers (3xxxx) are read-only registers that map directly to sensor/field values and are updated by the device firmware each scan. Use FC 04 (Read Input Registers) with the PDU address = PLC reference − 30001. For example, input register 30005 is read with FC 04 at PDU address 4 (0x0004). Holding registers (4xxxx) read with FC 03 — using the wrong function code returns an exception code 01 (Illegal Function).
Try our SCADA Studio
More calculators, simulators, and guides for this discipline.