Free tool
Modbus register decoder
Paste the raw values a Modbus device returned and see every way to read them: 16, 32 and 64-bit integers, floats in all four byte and word orders, and text. The right reading is the one that matches the device.
0x4366 0x8000 → 230.5 V
The basics
Reading Modbus registers
A Modbus register is one 16-bit word. Everything else, from a temperature with one decimal to a 64-bit energy counter, is built from those words.
- Holding and input registers
- Holding registers are read with function code 03 and, where the device allows it, written with 06 or 16: setpoints, settings and, on many meters, the measurements too. Input registers are read with function code 04 and are read-only. The register map says which table a value is in.
- 40001 or 0?
- Datasheets often number holding registers from 40001 and input registers from 30001: the first digit names the table and the rest counts from 1. The request carries a zero-based offset, so 40001 is offset 0 and 40101 is offset 100. Some manuals list the offset directly; if every value looks shifted by one register, try the address one lower or higher.
- Wider values
- A 32-bit integer or float takes two registers, a 64-bit counter or double takes four, and text takes two characters per register. The register map gives the type, the length and, ideally, the byte order.
Worked example
How 0x4366 0x8000 becomes 230.5
A power meter returns two holding registers for the L1 voltage, 0x4366 0x8000, and its register map says float32, big-endian. These are the values the decoder opens with.
- Registers to bytes 0x4366 0x8000 → 43 66 80 00
- Bytes to bits 0100 0011 0110 0110 1000 0000 0000 0000
- Sign, 1 bit 0 → positive
- Exponent, 8 bits 10000110 = 134; 134 − 127 = 7
- Mantissa, 23 bits 1 + 0x668000 ÷ 2^23 = 1.80078125
- Value 1.80078125 × 2^7 = 230.5
If the meter swaps words
A meter that sends the low word first returns the same reading as 0x8000 0x4366. Read big-endian, those bytes give -2.4178e-41, a number no meter reports. Read as CDAB (word swap), they give 230.5 again.
Byte and word order
Why the same value arrives four ways
Modbus fixes the order inside one register, high byte first, and says nothing about values wider than one register. Each vendor chose which register of a pair comes first. Devices built around little-endian processors often send the low word first; byte swap and full little-endian are rarer, but they exist.
How to tell which order is right
Read a value you can check, such as the voltage on the meter’s display or the mains frequency, and decode it here. The right order is the one that gives a physically plausible number: 230.5 V, not 2.3021767e+23 or -2.4178e-41. A device normally uses the same order for all its 32-bit values, so one checked value settles the rest.
| Order | Also called | 230.5 on the wire |
|---|---|---|
| ABCD | Big-endian, high word first | 0x4366 0x8000 |
| CDAB | Word swap, low word first | 0x8000 0x4366 |
| BADC | Byte swap | 0x6643 0x0080 |
| DCBA | Little-endian | 0x0080 0x6643 |
Beyond the decoder
Set the byte order once, read every value right
A decoder helps you work out one register. Proxus reads Modbus TCP devices, and RTU or ASCII devices over TCP, directly on the edge gateway and turns every register into a named tag with its data type.
- Datasheet addresses such as 40001 are entered as written and converted to the offset on the wire for you.
- Byte order is set once in the device profile, and every device that uses the profile decodes the same way.
- Open register maps for meters, drives and inverters list the address, type, byte order and scale of each register.
Questions
Modbus decoding questions, answered.
- How do I convert two Modbus registers to a float?
- Put the two 16-bit registers together into four bytes and read them as an IEEE 754 single-precision float. 0x4366 followed by 0x8000 gives the bytes 43 66 80 00, which is 230.5. If the result is absurdly large, tiny or NaN, the device uses another order: try word swap (CDAB) first, then byte swap (BADC) and little-endian (DCBA). The decoder on this page shows all four at once.
- What is word swap in Modbus?
- Word swap means the device sends the low 16-bit word of a 32-bit value first. The value 0x43668000 then arrives as 0x8000 0x4366 instead of 0x4366 0x8000. It is written CDAB, against ABCD for big-endian. Register maps also call it “word swapped”, “low word first” or “little-endian word order”.
- Is Modbus register 40001 address 0 or 1?
- Address 0. In the 40001 convention the 4 names the holding register table and the remaining digits count from 1, so 40001 is the first holding register and the request carries offset 0. 40101 is offset 100, and 30001 is input register offset 0. Six-digit references such as 400001 work the same way and reach offsets above 9998.
- How are 32-bit values stored in Modbus?
- In two consecutive 16-bit registers. Modbus defines the byte order inside one register, high byte first, but not which register of a pair comes first, so devices differ. A 32-bit value can be an unsigned integer, a signed integer or a float; the register map names the type, and the decoder shows all three in every order.
- What are the Modbus function codes?
- 01 reads coils and 02 reads discrete inputs, both single bits. 03 reads holding registers and 04 reads input registers, up to 125 registers per request. 05 writes one coil, 06 writes one holding register, 15 writes several coils and 16 writes several holding registers. Discrete inputs and input registers cannot be written.