Why is my Modbus address off by one?
Because the same register is legitimately called four
different things. 40001, 4x00001, “holding
register 1” and “address 0” all refer to the identical slot
in the identical device. The number that actually travels in the Modbus packet
is the last one, counting from zero; most vendor documentation uses one of the
first three, counting from one. If your value is one register out —
you asked for the supply temperature and got the return temperature —
this is almost always why.
The four ways to write one address
| Written as | Called | Counts from | What goes on the wire |
|---|---|---|---|
40001 | Modicon five-digit | 1 | 0 |
4x00001 | Prefixed, explicit | 1 | 0 |
| “Holding register 1” | One-based register number | 1 | 0 |
| “Address 0” | Protocol address | 0 | 0 |
The leading digit in the first two forms is not part of the number — it says which of the four lists the value is in:
| Prefix | List | Example |
|---|---|---|
| 0 | Coils | 00001 or 0x00001 |
| 1 | Discrete inputs | 10001 or 1x00001 |
| 3 | Input registers | 30001 or 3x00001 |
| 4 | Holding registers | 40001 or 4x00001 |
A trap for programmers. In Modbus documentation
0x means the coil table. It is not hexadecimal. Hexadecimal
addresses are vanishingly rare in device manuals, so 0x10 in a
Modbus table almost certainly means coil number 10, not the number 16.
How to tell which convention a document uses
- Addresses in the 40001–49999 range — Modicon five-digit, counting from one. Subtract 40001 to get the wire address.
- Addresses starting at 1 with a separate “register type” column — one-based. Subtract one.
- Addresses starting at 0 — protocol addresses. Use them as they are.
- A column headed “offset” — almost always zero-based.
- Both a “register” and an “address” column, differing by one — the document is being helpful. Use the one your tool asks for.
How to confirm it without guessing
Read three registers in a row and compare all three against what the equipment's own display shows. If the value you wanted appears one slot earlier or later than the document says, you now know the convention and every other row in that document falls into place at once.
Some equipment documents are simply wrong about this, including from large manufacturers. Trusting the reading over the document is the right instinct.
Why it ended up like this
The five-digit notation comes from the original Modicon PLCs, where memory references were written that way and counted from one. The protocol itself always counted from zero. Forty-five years of documents later, both conventions are still in active use, often in the same building, sometimes in the same PDF.
Easy Modbus sidesteps the problem: type the
address however your manual writes it — 40007,
4x00007 or 6 — and it tells you how it read it
and which register that actually is, before you save anything.