How do I write to a Modbus register safely, and put it back afterwards?

Q: How do I write to a Modbus register safely, and put it back afterwards?

Use function code 06 to write one holding register, 16 to write several (a 32-bit value needs two, so it is always 16), and 05 to switch a single coil. Before writing, read the register and write down what it says. Convert the value you want into raw register contents using the register's scale and word order — a setpoint of 72.5 kept in tenths is written as 725. Afterwards, read it back. Modbus has no priority levels, no release and no timeout: whatever you write simply is the value until something overwrites it, so writing the original value back by hand is the only undo you get.

Updated 10 November 2026

Short answer

Use function code 06 to write one holding register, 16 to write several (a 32-bit value needs two, so it is always 16), and 05 to switch a single coil. Before writing, read the register and write down what it says. Convert the value you want into raw register contents using the register's scale and word order — a setpoint of 72.5 kept in tenths is written as 725. Afterwards, read it back. Modbus has no priority levels, no release and no timeout: whatever you write simply is the value until something overwrites it, so writing the original value back by hand is the only undo you get.

Why writing to Modbus deserves more care than BACnet

BACnet keeps a priority array: your override sits in a slot, and releasing the slot hands control back. Modbus has nothing of the kind. A holding register is a box with a number in it. Write 55 and it contains 55, full stop, until the equipment's own logic or another system writes something else — and many devices' logic never will. Read is it safe to write to a Modbus register? before touching anything on live plant.

Step 1 — Read it and write down what it says

Read the register first, from the right table at the right address, and note the value and the time. That note is your way back. If the map has a configuration section — unit ID, baud rate, parity — leave those addresses alone unless that is the job: a wrong write there can make the device stop answering.

Step 2 — Work out the raw value

A register holds a raw 16-bit number, not the engineering value you see on a display. Before writing, turn the value you want into what the register actually stores:

Scale. If the map says ×0.1, a setpoint of 72.5 is written as 725. Divide by the scale; do not write the engineering value as-is.
Sign. A negative value in a signed 16-bit register is written in two's complement: −5 is 65531 (0xFFFB).
32-bit values (floats, long counters) span two registers and must go in the same word order the device reads them in — ABCD or CDAB, usually. The float decoder shows how a value splits across the pair.
Coils are on or off. Function code 05 sends 0xFF00 for on and 0x0000 for off; most tools hide this behind a switch.

Step 3 — Write with the right function code

What you are writing	Function code
One coil (on/off)	05 — write single coil
Several coils	15 — write multiple coils
One 16-bit holding register	06 — write single register
Several registers, or any 32-bit value	16 — write multiple registers

Some devices accept only 16, even for a single register; if 06 comes back with an illegal function exception, try 16 with a count of one. See Modbus function codes explained.

Step 4 — Read it back

A successful reply only means the device accepted the request. Read the register again: what it holds now is the truth, not what you asked for. A device can clamp a value to its own limits, round it, or have its control logic overwrite it a second later — all things you only see by reading back.

Step 5 — Put it back

When the test is over, write the value you noted in step 1. It is not a true undo — if the equipment's own logic changed the register in between, "back" means back to what you found, not to what would be there had you never visited — but it is the closest Modbus allows.

If you overrode something to prove a point, put it back before you leave site. Nobody else can see that you did it, and nothing will time it out.

Registers you cannot write

Input registers and discrete inputs are read-only by definition — they report what the equipment measures.
Text packed as ASCII in holding registers is nearly always a name or a serial number, and changing it does nothing useful.
Some holding registers are read-only in practice; the device will answer your write with an illegal data address or illegal function exception. See Modbus exception codes.