Modbus Addressing Page 1 of 2

Modbus Addressing
For this driver, the terms Slave and Unsolicited are used interchangeably.

5 Digit Addressing vs. 6 Digit Addressing

In Modbus addressing, the first digit of the address specifies the primary table. The remaining digits represent the device's
data item. The maximum value is a two byte unsigned integer (65,535). Six digits are required to represent the entire
address table and item. As such, addresses that are specified in the device's manual as 0xxxx, 1xxxx, 3xxxx, or 4xxxx will
be padded with an extra zero once applied to the Address field of a Modbus tag.

Primary Table Description

0 Output Coils
1 Input Coils
3 Internal Registers
4 Holding Registers

Modbus Addressing in Decimal Format

The Function Codes are displayed in decimal. For more information, refer to Function Codes Description.

Address Type Range Data Type Access* Function Codes

Output Coils 000001-065536 Boolean Read/Write 01, 05, 15
Input Coils 100001-165536 Boolean Read Only 02
Internal Registers 300001-365536 Word, Short, BCD Read Only 04
300001-365535 Float, DWord, Long, LBCD Read Only 04
300001-365533 Double Read Only 04

xxxxx=1-65536 Boolean Read Only 04

bb=0/1-15/16**

300001.2H-365536.240H*** String Read Only 04

300001.2L-365536.240L*** String Read Only 04

Holding Registers 400001-465536 Word, Short, BCD Read/Write 03, 06, 16
400001-465535 Float, DWord, Long, LBCD Read/Write 03, 06, 16
400001-465533 Double Read/Write 03, 06, 16

xxxxx=1-65536 Boolean Read/Write 03, 06, 16, 22

bb=0/1-15/16*

400001.2H-465536.240H*** String Read/Write 03, 16

400001.2L-465536.240L*** String Read/Write 03, 16

*For slave devices, Read Only locations are Read/Write.

**For more information, refer to "Zero vs. One Based Addressing" in Settings.
***.Bit is string length, range 2 to 240 bytes.

Modbus Addressing in Hexadecimal Format

Address Type Range Data Type Access*
Output Coils H000001-H010000 Boolean Read/Write
Input Coils H100001-H110000 Boolean Read Only
Internal Registers H300001-H310000 Word, Short, BCD Read Only
H300001-H30FFFF Float, DWord, Long, LBCD Read Only
H300001-H30FFFD Double Read Only

yyyyy=1-10000 Boolean Read Only

cc=0/1-F/10

H300001.2H-H3FFFF.240H** String Read Only

H300001.2L-H3FFFF.240L** String Read Only

Holding Registers H400001-H410000 Word, Short, BCD Read/Write
H400001-H40FFFF Float, DWord, Long, LBCD Read/Write
H400001-H40FFFD Double Read/Write

yyyyy=1-10000 Boolean Read/Write

cc=0/1-F/10

H400001.2H-H4FFFF.240H String Read/Write

mk:@MSITStore:C:\Program%20Files%20(x86)\Proficy\Proficy%20View%20Integr... 02/08/2018
Modbus Addressing Page 2 of 2

H400001.2L-H4FFFF.240L String Read/Write

*For slave devices, Read Only locations are Read/Write.

**.Bit is string length, range 2 to 240 bytes.

Packed Coils
The Packed Coil address type allows access to multiple consecutive coils as an analog value. This feature is available for both
Input Coils and Output Coils when in Polled Mode only. It is not available to devices that are configured to access the
unsolicited memory map or that are in Mailbox Mode. The decimal syntax is 0xxxxx#nn, where:

 xxxxx is the address of the first coil (with a range of 000001-065521).

 nn is the number of coils that will be packed into an analog value (with a range of 01-16).

The hexadecimal syntax is H0yyyyy#nn, where:

 yyyyy is the address of the first coil (with a range of H000001-H000FFF1).

 nn is the number of coils that will be packed into an analog value (with a range of 01-16).

Note 1: The only valid data type is Word. Output Coils have Read/Write access, whereas Input Coils have Read Only access.
In decimal addressing, Output Coils support Function Codes 01 and 15, whereas Input Coils support Function Code 02.

Note 2: The bit order will be such that the start address will be the Least Significant Bit (LSB) of analog value.

Write Only Access

All Read/Write addresses may be set as Write Only by prefixing a "W" to the address such as "W40001", which will prevent
the driver from reading the register at the specified address. Any attempts by the client to read a Write Only tag will result
in obtaining the last successful write value to the specified address. If no successful writes have occurred, then the client will
receive 0/NULL for numeric/string values for an initial value.

Caution: Setting the Write Only tags client access privileges to Read Only will cause writes to these tags to fail and the
client to always receive 0/NULL for numeric/string values.

Mailbox Mode
Only Holding Registers are supported in Mailbox Mode. When read from a client, the data is read locally from a cache, not
from a physical device. When written to from a client, the data is written to both the local cache and the physical device as
determined by the Device ID routing path. For more information, refer to Mailbox Mode.

Note: The Double data type is not supported.

String Support
The Modbus model supports reading and writing holding register memory as an ASCII string. When using holding registers
for string data, each register will contain two bytes of ASCII data. The order of the ASCII data within a given register can be
selected when the string is defined. The length of the string can be from 2 to 240 bytes and is entered in place of a bit
number. The length must be entered as an even number. Appending either an "H" or "L" to the address specifies the byte
order.

Note: For more information on performing block reads on string tags for the Modbus model, refer to Block Sizes.

Examples
1. To address a string starting at 40200 with a length of 100 bytes and HiLo byte order, enter "40200.100H".
2. To address a string starting at 40500 with a length of 78 bytes and LoHi byte order, enter "40500.78L".

Note: String length may be limited by the maximum size of the write request allowed by the device. If the error message
"Unable to write to address <address> on device<device>: Device responded with exception code 3" is received in the
server event window, the device did not like the length of the string. If possible, try shortening the string.

Array Support
Arrays are supported both for internal and holding register locations (including all data types except Boolean and String) and
for input and output coils (Boolean data types). There are two ways to address an array. The following examples apply to
holding registers:

4xxxx [rows] [cols]

4xxxx [cols] with assumed row count of one.

For Word, Short and BCD arrays, the base address + (rows * cols) cannot exceed 65536. For Float, DWord, Long, and Long
BCD arrays, the base address + (rows * cols * 2) cannot exceed 65535. For all arrays, the total number of registers being
requested cannot exceed the holding register block size that was specified for this device.

mk:@MSITStore:C:\Program%20Files%20(x86)\Proficy\Proficy%20View%20Integr... 02/08/2018