A vendor's Modbus table lists the supply-air temperature at 40123. What address do you put on the wire?

122. The leading 4 names the holding-register table — it's not part of the wire address. The remaining four digits are 1-based, so 40123 means "the 123rd holding register" — and the wire is 0-based, so the actual address is 123 − 1 = 122. Reading 40123 straight gets you an exception; reading 123 is the classic off-by-one.

You see 30005 in a vendor manual. Which function code reads it, and what is the wire address?

FC 04, wire address 4. Leading 3 = input-register table = FC 04. The remaining 0005 is 1-based, so the wire address is 4. FC 03 reads holding registers (leading 4). The classic mix-up is reaching for FC 03 on a leading-3 address and getting an exception.

A 16-bit register returns 0xFFF3. If the docs say the value is an INT16, the high bit being 1 means the decoded value is negative.

True. Two's complement: high bit set on a signed type means negative. 0xFFF3 as INT16 is −13; as UINT16 it's 65523. The bit pattern is identical — the interpretation choice is yours, and the docs are what tell you which is right.

An outdoor-air temperature sensor occasionally reads ≈ 65521 when the weather is cold. What's the most likely cause?

The register is signed (INT16), being read as unsigned.. Values pinned near 65535 on a sensor that physically can't reach that magnitude are the unmistakable signature of a signed value being read unsigned. 65521 as UINT16 is −15 as INT16 — a believable cold outdoor reading. Fix the type tag in the integration, not the sensor.

A vendor's docs say a 32-bit float at register 40101 reads 50.24 °F. You pull the two registers and see this on the wire. Which byte ordering is this device using? register 40101 (N+0): 0xF5C3 register 40102 (N+1): 0x4248

CDAB (Modicon word-swap). Reassemble what came off the wire: F5 C3 42 48. The IEEE-754 big-endian float of 0x4248F5C3 is ≈ 50.24, which means the bytes should be 42 48 F5 C3 in network order — and they're not. Swapping the two registers gives 4248 F5C3, which decodes correctly: that's CDAB. (Legacy Modicon PLCs forwarded their internal little-endian word layout to the wire this way.)

Once you've identified a device's 32-bit byte ordering, you can trust it to be the same across every 32-bit value on that device.

True. Manufacturers don't mix orderings within a product. Figure it out once at commissioning (the Modbus Register Viewer's 32-bit Pair tab is built for this), document it on the job, and move on. Don't re-test every register.

A holding register returns 523. The vendor docs say scale 0.1, units °F. What's the engineering value, in °F?

52.3 °F. Implicit decimal point: the register stores the value × 10 to preserve one decimal place in an integer. 523 × 0.1 = 52.3 °F. The most common Modbus scaling pattern.

A register returns 1024. The docs say the encoding is (actual − 100) × 10. What's the actual engineering value?

202.4. Reverse the encoding: actual = (raw / 10) + 100 = (1024 / 10) + 100 = 102.4 + 100 = 202.4. Offset-and-scale patterns name both numbers in the docs; both have to be applied. Older equipment that exposed calibration values directly tends to use this shape.

You read register 40050 on a device and get back exception code 0x02 (Illegal Data Address). The device responded — what's most likely going on?

The wire address is outside the device's implemented map (often an off-by-one on 5-digit numbering).. 0x02 = the function code was understood and the device responded, but the requested address (or address range) doesn't exist on this device. The most common cause on a freshly-integrated device is reading 40050 as wire address 50 instead of 49 — the 5-digit numbering trap, surfacing as an exception. Unsupported function code is 0x01 (Illegal Function), not 0x02.

A poll definition on a Niagara integration looks like this. What's wrong? Device: AHU-1 Function: ReadInputRegisters (FC 04) Start address: 0 Quantity: 10 Point maps: 40001..40010 → AI_01..AI_10

The point map uses 5-digit holding addresses (4xxxx) but the function code reads input registers — the function code and the table prefix have to match.. Leading 4 in the point names = holding registers = FC 03. Leading 3 = input registers = FC 04. This poll is asking for input registers but mapping them to addresses that document themselves as holding. Either change the function to ReadHoldingRegisters (FC 03), or change the point map to 30001..30010. Reading the wrong table is the #2 cause of "the read works but the value is garbage" — #1 being the 5-digit off-by-one above.

Practice · Modbus Decoding

Modbus Decoding Quiz Modbus

Read the Modbus Decoding lesson first, then test yourself — ten questions on the gotchas: the 5-digit numbering trap, signed vs unsigned interpretation, the four 32-bit byte orderings, scaling to engineering units, plus the FC03 / FC04 confusion and exception responses on the wire. Each reveal links back to the section of the lesson it came from.

← All practice