Modbus Addressing Schemes

This section explains the different addressing schemes used with Modbus and how they relate to each other.

Logical Addressing

Within the messages passed between Modbus devices, the addresses for registers, coils and inputs are always two-byte values, which can express values from 0 to 65535. Each of the types of addressable object (coils, discrete inputs, holding registers and input registers) have their own independent "address space": there can be a coil with address 123 and a holding register with address 123, and there is no relationship implied between them.

Hexadecimal Notation

When using logical addressing, the type of object/access type always has to be stated as well. A logical address may be written as a decimal or a hexadecimal number. We write them as hexadecimal, indicated by a 0x prefix.

984 Style Addressing

Modbus started life as a proprietary standard based on a family of programmable controllers, and the addressing notation from the early version of this standard, although now officially superseded, is still widely used. It is often called 984 addressing, after the model of programmable controller which popularised it.

In this address notation:

• The address is always written in decimal
• An offset of 1 from the logical address is applied
• The address is padded with leading zeroes to 4 digits
• A prefix digit is added to indicate which address space is used (making a 5-digit written address)

Example: Logical address 20 would become:

• 00021 for a coil address
• 10021 for a discrete input
• 30021 for an input register
• 40021 for a holding register

984 Addresses	Type	Logical Addresses
00001-09999	Coil	0-9998 (decimal) / 0x0000-0x270E (hex)
10001-19999	Discrete input	0-9998 (decimal) / 0x0000-0x270E (hex)
30001-39999	Input register	0-9998 (decimal) / 0x0000-0x270E (hex)
40001-49999	Holding register	0-9998 (decimal) / 0x0000-0x270E (hex)

Prefix Shorthand

The prefix digit is sometimes used as shorthand for the type of access:

• 0x - Coils (not to be confused with the 0x indicating hexadecimal!)
• 1x - Discrete inputs
• 3x - Input registers
• 4x - Holding registers

IEC 61131 Addressing

Programmable controllers and HMIs often use the IEC 61131 standard for referring to internal values:

• %M0, %M1, ... - 1-bit values (mapped to Modbus coils)
• %MW0, %MW1, ... - 16-bit values (mapped to Modbus holding registers)

Limited Coverage

There is no way in this scheme to represent the read-only types (discrete inputs and input registers).

IEC 61131 Addresses	Type	Logical Addresses
%M0 - %M65535	Coil	0-65535 (decimal) / 0x0000-0xFFFF (hex)
N/A	Discrete input	Not accessible in this format
N/A	Input register	Not accessible in this format
%MW0 - %MW65535	Holding register	0-65535 (decimal) / 0x0000-0xFFFF (hex)

Modbus 1.1b3 Standard Addressing

The latest version (1.1b3) of the Modbus standard uses a "Modbus data model" where the address of each object starts at 1 (i.e., it is the logical address plus 1).

You can see in the examples that the object addresses are always 1 greater than the values actually transferred in Modbus data packets. Like the logical address, an address written this way does not specify what is being addressed; the type of object/access needs to be stated as well.

Modbus Data Model Addresses	Type	Logical Addresses
1-65536	Coil (1 bit)	0-65535 (decimal) / 0x0000-0xFFFF (hex)
1-65536	Discrete input (1 bit)	0-65535 (decimal) / 0x0000-0xFFFF (hex)
1-65536	Input register (16 bit)	0-65535 (decimal) / 0x0000-0xFFFF (hex)
1-65536	Holding register (16 bit)	0-65535 (decimal) / 0x0000-0xFFFF (hex)