Modbus Data Address Format

Introduction

Data in Modbus PLCs is stored different four different data tables depending on the intended use of the data. The four data tables are:

Output Coils,
Discrete Inputs,
Holding Registers and
Input Registers.

The Modbus PLC Data Address Format is a string that specifies the location of data in a Modbus PLC. The address format follows the Modicon PLC convention of a data table number, followed by a 1-based number. The 1-based number defines the coil or register number:

Data Table	Format	Notes
Output Coils	0nnnn	Read-write
Discrete Inputs	1nnnn	Read-only
Input Registers	3nnnn	Read-only
Holding Registers	4nnnn	Read-write

Coil Number Register Number and Data Offset

The Modbus Protocol supports a number of commands to read and write data. These commands use a 16-bit 0-based number to define the location in the data table. The 16-bit number gives an address range of 0-65535.

The Modicon numbering convention uses 1 to indicate the first coil or register, 2 to indicate the second, and so on.

The Modicon numbering convention is offset from the Modbus protocol by 1. This can sometimes cause confusion. Traditional Modicon coil and register numbering use 5 digits to specify the data table and the coil or register number:

Coil or Register Number	Protocol Data Offset	Table Name
00001 - 09999	0000h-270Eh	Output coils
10001 - 19999	0000h-270Eh	Discrete inputs
30001 - 39999	0000h-270Eh	Input registers
40001 - 49999	0000h-270Eh	Holding registers

The traditional Modicon 5 digit addressing restricts the protocol to the first 9999 coils or registers.

To access the full range of data allowed by the Modbus protocol, 6-digit addressing is sometimes used:

Coil or Register Number	Protocol Data Offset	Table Name
000001 - 065536	0000h-FFFFh	Output coils
100001 - 165536	0000h-FFFFh	Discrete inputs
300001 - 365536	0000h-FFFFh	Input registers
400001 - 465536	0000h-FFFFh	Holding registers

Fernhill SCADA supports variable length Modbus addressing. For example the first discrete input can represented by 100001, 10001, 1001, 101, or just 11.

Where Used

The Modbus PLC Data Address Format is used in these contexts:

In the IOItemName field of an Analog IO Data Tag when the tag is associated with a Modbus PLC.
In the IOItemName field of a Digital IO Data Tag when the tag is associated with a Modbus PLC.
In the IOItemName field of a Double Word IO Data Tag when the tag is associated with a Modbus PLC.
In the IOItemName field of a Word IO Data Tag when the tag is associated with a Modbus PLC.
In the Register field of a Modbus Register Block.
In the DataAddress parameter of the DirectWriteBit tag command when used with a Modbus PLC.
In the DataAddress parameter of the DirectWriteWord tag command when used with a Modbus PLC.

Register Address Editor

You can use the Register Address Editor build Modbus Data Address Strings. You can access it by clicking the Browse button found at the right hand side of the Register field:

Further Information

Modbus Register Block Tag

To learn about Modbus Register Block Tags.

Modbus Driver

For an overview of the Modbus Driver.

Glossary

For the meaning of terms used in Fernhill SCADA.