The address inside a Modbus request frame is always a 0-based number from 0 to 65535 — this guide calls it the «wire address». Device manuals and PLC or HMI software, however, write the same address in several ways. Misreading the notation shifts values by one or triggers exception 02 (illegal data address).
Three notations
| Notation | First holding register | Wire address |
|---|---|---|
| 0-based | 0 (0x0000) | as is |
| 1-based (register number) | 1 | number − 1 |
| PLC notation, 5 digits | 40001 | last four digits − 1 (first digit = table) |
| PLC notation, 6 digits | 400001 | last five digits − 1 (first digit = table) |
The first digit names the table
| Prefix | Table | Read function | Write function |
|---|---|---|---|
| 0xxxx | Coils | 01 | 05 · 0F |
| 1xxxx | Discrete inputs | 02 | — (read only) |
| 3xxxx | Input registers | 04 | — (read only) |
| 4xxxx | Holding registers | 03 | 06 · 10 |
The prefix never goes on the wire. The function code selects the table and the address is the 0-based index inside it, so 30001 and 40001 are both wire address 0 — sent with different functions (04 and 03). Five digits only reach the 9999th entry; beyond that six digits are used, so 410000 is holding register wire address 9999.
How real manuals write it
First entries from the manuals of the devices on this site. Each device page shows «Manual» and «Wire» addresses side by side.
| Device | Manual | Wire | How to read it |
|---|---|---|---|
| LS ELECTRIC GIMAC1000 | 30001 | 0 | PLC notation; the map also has a 0-based ADDRESS column |
| Hanyoung Nux LC | 30104 (0067) | 103 | PLC number plus the hex wire address in brackets |
| Autonics TK | 301001 (03E8) | 1000 | Six-digit reference plus the hex wire address in brackets |
| Rootech Accura 3300E | 10000 | 9999 | 1-based register number (number − 1) |
| LS ELECTRIC LSLV-S100 | 0h0001 | 0 | Hex number; the manual's frame example sends «address − 1» |
| Hanyoung Nux VX | D-register 0 / Address 1 | 0 | D-register column is 0-based, Address column 1-based |
A hex address is not necessarily 0-based (see 0h0001 above). If the manual has a frame example, compare its start-address bytes with the map — that is the most reliable check, and how most of the devices above were verified. The page references are in each device page's notes.
When values look shifted by one
- If you read the value you expected from the neighbouring register, 0-based and 1-based are mixed up. Move the start address by one.
- Exception 02 means a notation mix-up or reading past the end. Many devices also return 02 for gaps in the map, so read contiguous blocks only.
- Typing 40001 into a 0-based field reads wire address 40001 — usually exception 02.
- If only 32-bit values (U32, F32) look wrong, suspect the word order (ABCD, CDAB) before the address.
In PortDock
- Modbus Master: set «Addresses» — 0-based, 1-based or PLC (40001) — and cells, the start field and the decoded log all use it. The address sent is the same.
- With 0-based or 1-based selected, typing 40001 or 30001 reads exactly that, but a yellow notice says «in PLC notation it is address 0 (FC03)» with a [Switch to PLC notation] button.
- In PLC notation, typing an address with another prefix such as 30001 switches the function to that table (04).
- The «Modbus RTU Request Builder» web tool accepts 0-based and PLC notation and builds the request bytes with CRC — no install needed.
Published 2026-10-19