Modbus Register Viewer Modbus
Decode a Modbus register the way the device sees it.
Inputs are seeded with an example — edit them to your numbers.
Input
Bit 15 = MSB (top-left) · Bit 0 = LSB (bottom-right) · click to toggle
Output
Input — two consecutive registers
Modbus transmits the first register's high byte first.
Call the four bytes A B C D in transmission
order — so Register 1 carries AB and
Register 2 carries CD. The table on the
right shows the 32-bit value under each of the four
byte-ordering conventions vendors use.
Register 1 (bytes A B)
Register 2 (bytes C D)
Output — all four byte orderings
| Order | int32 | uint32 | float (IEEE-754) |
|---|---|---|---|
| ABCD | — | — | — |
| CDAB | — | — | — |
| BADC | — | — | — |
| DCBA | — | — | — |
ABCD is big-endian word + big-endian byte — the Modbus standard's stated ordering. CDAB is the "Modicon word-swap" form common on legacy gear. BADC swaps bytes within each register; DCBA reverses everything. When a float looks like nonsense at one ordering and plausible at another, the other ordering is the vendor's.
Input
Two-way: type the address from the points list, or pick a table and type the offset off the wire.
Output
Why the off-by-one
The 5-digit number in a points list is a documentation convention: the first digit names the table, the rest count from 1. The request that goes out on the wire carries a 16-bit offset that counts from 0 — so "40001" is holding-table offset 0, and vendor address 43021 is polled as offset 3020 with FC03. Both shifts bite: forget the table prefix and you poll the wrong kind of point; forget the −1 and every value is one register off. Modbus Decoding walks the trap with worked frames.
Modbus essentials
A handful of subtle gotchas catch most people up on Modbus — less the protocol itself than what you have to know on top of it to interpret what comes back. The tips below cover the ones worth knowing before you start integrating.
Modbus is dumb on purpose — a register is just 16 bits, with no metadata about what those bits mean. The vendor's docs are load-bearing.
- Register addressing offset. "40001" in vendor docs is holding register 0 on the wire — the 4xxxx / 3xxxx / 1xxxx / 0xxxx 5-digit numbering is a documentation convention, not a wire address. Off-by- one bugs live here.
- Signed vs unsigned. A raw 16-bit value of 65535 is also −1 — same bits, different intent. Use the toggle on the Single Register tab to flip between interpretations.
- Word / byte order. 32-bit floats and int32s span two registers, and four byte orderings exist in the wild (ABCD / CDAB / BADC / DCBA). The 32-bit Pair tab shows all four side-by-side; pick the one that produces a plausible value.
- Read FC03 vs FC04. Holding registers
(FC03) are read/write; input registers (FC04) are
read-only. Write FC06 vs FC16.
FC06 writes a single register, FC16 writes many.
Wrong FC →
illegal functionexception. - Exception responses set the high bit of FC.
A request with FC
0x03that errors comes back as0x83(FC | 0x80) followed by a 1-byte exception code (0x02= illegal data address,0x03= illegal data value, etc.).
Modbus Basics covers the protocol shape end-to-end — the data tables, the function codes, the request frame, and exception responses. Modbus Decoding is the companion page on the gotchas behind these tips — the 5-digit register trap, signed vs unsigned, the four byte orders, and scaling.
Function codes
| FC | Hex | Function |
|---|---|---|
| 01 | 0x01 | Read Coils |
| 02 | 0x02 | Read Discrete Inputs |
| 03 | 0x03 | Read Holding Registers |
| 04 | 0x04 | Read Input Registers |
| 05 | 0x05 | Write Single Coil |
| 06 | 0x06 | Write Single Register |
| 15 | 0x0F | Write Multiple Coils |
| 16 | 0x10 | Write Multiple Registers |
Coils and discrete inputs are 1-bit; holding and input registers are 16-bit — this tool views one of those. Discrete inputs and input registers are read-only; coils and holding registers are read/write.