Modbus register maps, checked against the manual

What every map gives you

• The address on the wire. Every register is listed by its 0-based protocol address, with the manual’s own 40001-style number beside it when the two differ — the off-by-one is settled for you.
• Data type and word order. 16-bit, 32-bit, float or text, and for 32-bit values whether the high word comes first (ABCD) or second (CDAB).
• Scale, units and access. The multiplier that turns the raw number into an engineering value, the units, and which registers are writable.
• The source. A link to the manufacturer’s free public document, so you can check any row yourself, plus CSV and JSON downloads.

Free tools

Quick browser calculators for the two arithmetic problems that come up most. Nothing is uploaded.

• Modbus float and byte-order decoder
  Paste two Modbus registers and see the 32-bit float and integer in all four word orders (ABCD, CDAB, BADC, DCBA).
• Modbus address converter
  Convert any Modbus address between Modicon (40001), prefixed (4x00001), 1-based and 0-based forms.

Guides

If Modbus is new to you, read what is Modbus? first. It explains the one thing that causes most of the difficulty: a Modbus device will happily tell you the contents of slot number 7, and will never tell you what slot 7 is.

• What is Modbus?
  Modbus is a simple protocol for reading and writing numbered registers on industrial and building equipment.
• What is a Modbus register map?
  A Modbus register map ties each address to what it means: data type, scaling, word order and units.
• How do I find my Modbus register map?
  Build a Modbus register map from a live device: read blocks, decode each value's type and scaling, name it, and export the map as a CSV.
• Why is my Modbus address off by one?
  40001, 4x00001, register 1 and address 0 are all the same Modbus register. Here is why the conventions conflict, and how to tell which one your document uses.
• Why does my Modbus value look wrong?
  A Modbus value that reads wrong is usually scaling or byte/word order. How to spot 32-bit floats, word swaps and multipliers, and fix them.
• Why can't I find my Modbus devices on the network?
  Modbus has no discovery at all — devices never announce themselves. Here is why scanning is the only option, and the six things to check when nothing answers.
• Modbus TCP, Modbus RTU or RS-485 — which do I have?
  How to tell Modbus TCP from Modbus RTU and RTU-over-TCP by looking at the equipment, and why mistaking one for the other looks exactly like a dead device.
• What is a Modbus unit ID or slave ID?
  The Modbus unit ID (slave ID) picks which device answers on a shared line or gateway. What it is, why it matters, and how to find the right one.
• What are Modbus function codes?
  Function codes 1, 2, 3, 4, 5, 6, 15 and 16 explained in plain English, plus what each exception code means when a device refuses a request.
• Is it safe to write to a Modbus register?
  Modbus writes take effect instantly and have no undo. What that means, when writing is safe, and the habits that reduce the risk.
• A vendor asked for my Modbus information — what do I send?
  What to hand a vendor or integrator who asks for your Modbus details: IP, unit ID, and a full register map with types and scaling, exported as a CSV.
• What is the difference between Modbus and BACnet?
  Modbus sends bare 16-bit values and explains nothing; BACnet describes itself with names, units and discovery.
• Why is my Modbus reading slow or unreliable?
  Slow or intermittent Modbus reads: block sizes, serial turnaround, connection limits, polling collisions and stale replies, and how to fix each.
• How do I write to a Modbus register safely, and put it back afterwards?
  How to write a value to a Modbus holding register or coil: which function code to use, how scaling and word order change the raw value, reading it back, and putting it back.
• What is a good free alternative to Modbus Poll?
  Modbus Poll is a paid Windows master with a time-limited trial. The free tools people use instead, what they are good at, and the step none of them does for you.
• Why is my Modbus request timing out with no response?
  A Modbus timeout means your request left but nothing came back. The seven causes in order of likelihood, and how to tell a network fault from a framing one.
• What do Modbus exception codes mean?
  Modbus exception codes 01, 02, 03, 04, 06, 0A and 0B in plain English: what each means, what caused it, and the fix.
• What causes a Modbus CRC error, and how do I fix it?
  A Modbus CRC error means the message arrived corrupted. The real causes: noise, termination, baud mismatch, and RTU/TCP framing confusion, and how to fix each.
• Why does my Modbus register read 0?
  A Modbus register reading 0 is usually the wrong function code, an off-by-one address, or a value split across two registers, not a dead device.
• What does Modbus connection refused (Errno 111) mean?
  Connection refused means something is at that IP but nothing listens on the Modbus port. The causes (wrong port, Modbus off, wrong host, limit) and fixes.
• How do I find an unknown Modbus device's baud rate and parity?
  No display, no paperwork, and a serial Modbus device that won't answer? How to find the baud rate, parity and unit ID by trying the few combinations that occur.
• How do I read an Eastron SDM power meter over Modbus?
  Eastron SDM120/SDM220/SDM630 meters report each value as a 32-bit float over Modbus. The settings, function code, word order, and how to read them over a network.

Before you connect

• Get onto the same network as the equipment. Controls gear is usually on its own VLAN, and guest Wi-Fi will not reach it.
• Modbus TCP is port 502. 503 and 5020 are both seen.
• Finding equipment means sweeping the subnet, because Modbus devices never announce themselves. On a monitored network that looks like a port scan, so tell whoever runs it.
• Reading is harmless. Writing has no undo — no priorities, no timeout, no release. Read the writing guide before changing anything on live equipment.