Mastering Modbus Register Offsets

The Modbus protocol is the backbone of industrial automation, yet register mapping remains a source of endless troubleshooting. Whether you are integrating a new PLC or commissioning a sensor, the “off-by-one” error is the most common hurdle. This guide provides a clear path to understanding why these mismatches happen and how to resolve them systematically.

Why the Wire Lies: Protocol Address vs. Data Model

To debug Modbus, you must first accept that your vendor manual and the network wire speak different languages.

Think of a hotel with 100 rooms. A guest asks for Room 1 (the first room). However, the hotel’s digital key system identifies rooms by how many doors are past the entrance. The first room is 0 doors away.

In Modbus, we have the same split:

Data Model Address (1-based): Used in vendor manuals and human-readable documentation (e.g., 40003).
Wire Address (0-based): The actual hex value sent over the network.

When your software sends a request for register 40003, it doesn’t send 40003. It sends a function code (e.g., 0x03 for Read Holding Registers) and a starting address of 2 (the 3rd register in the 0-based index). If your manual assumes 1-based indexing but your device hardware expects 0-based, your poll will be misaligned, leading to nonsensical data.

The Anatomy of a Misaligned Packet

A 32-bit floating-point value requires two 16-bit registers. If your polling starts at the wrong address, you aren’t just reading the “wrong” number — you are reading a “Franken-value” composed of the second half of one variable and the first half of another.

Serialization in Python

To see exactly what happens on the wire, we can serialize a Modbus TCP request. This script demonstrates how to construct the PDU (Protocol Data Unit) to verify your addressing strategy:

import struct

# Constructing a Modbus TCP PDU
# Function Code: 0x03 (Read Holding Registers)
# Starting Address: 0x0002 (The physical 3rd register)
# Quantity: 0x0002 (Two registers for a 32-bit float)

def create_modbus_frame(address, quantity):
    # Function Code + Start Address (H) + Quantity (H)
    return struct.pack(">BHH", 0x03, address, quantity)

# Requesting register 3 (0x0002)
frame = create_modbus_frame(0x0002, 2)
print(f"Hex output for address 0x0002: {frame.hex()}")
# Output: 0300020002

By manually toggling the address variable in this frame, you can test if your slave device reacts to 0x0002 (3rd register) or 0x0003 (4th register).

Beyond Offsets: Byte and Word Swapping

If you have confirmed your register address is correct and you are still receiving garbage values, you are likely facing an Endianness issue.

Modbus transmits 16-bit words. A 32-bit float is composed of two words. Depending on the manufacturer, these might be ordered:

Order	Notation	Notes
Big-Endian	ABCD	Most common standard
Word-Swapped	CDAB	Very common in many PLC brands
Byte-Swapped	BADC	Less common, prevalent in legacy hardware

If the registers are correct but the data looks like chaotic scientific notation (e.g., 2.1894e-41), do not move the register address again. Instead, toggle the byte/word swap settings in your polling software.

A Systematic Diagnostic Workflow

Instead of guessing, follow this sequence to isolate the issue:

Expand the Window

Stop polling just two registers. Poll ten. If you are offset by one, you will see your target data shifted by a single word in the register array, making the pattern obvious.

Verify the Base

If you suspect an off-by-one error, try the address N-1. If the data suddenly makes physical sense (e.g., a temperature reading of 22.5 instead of 0 or inf), you have found the shift.

Check Endianness

Only after confirming the address is stable should you troubleshoot the byte order. These are independent variables — fix them one at a time.

Use Diagnostic Tools

For quick field verification, tools like Modbus Connect allow you to toggle offsets and byte-ordering in real-time. By isolating the “Offset” toggle from the “Endianness” toggle, you can identify the culprit in seconds rather than through trial-and-error manual edits.

Summary

▸The “4” in 40001 is just a category marker. Discard it. Your address is 0.
▸Always poll a larger block of registers. Visibility into the adjacent data is your best debugging tool.
▸Address ≠ Byte Order. Fix the register offset first, then troubleshoot byte/word swaps.

Mastering these two variables — address indexing and data endianness — will resolve 99% of your Modbus integration headaches.

Debug Register Offsets Faster

Modbus Connect lets you toggle address offsets and byte/word-swap settings in real-time so you can isolate addressing issues in seconds, not hours.

Download Free Beta →

Beyond the Manual: Mastering Modbus Register Offsets