40001 Modbus Address Utility

Modbus Address Calculator

Use this Modbus Address Calculator to convert conventional Modbus references such as 40001, 30001, 10001 and 00001 into the zero-based protocol address transmitted in a Modbus request. You can also convert a protocol offset back into a coil, discrete input, input register or holding register reference.

✓ 40001 Converter ✓ Zero-Based Offset ✓ Hex Address ✓ Function Code ✓ Reverse Conversion

ADDR

Convert Modbus Address

● Ready

Modbus Reference Examples: 00001, 10001, 30001, 40001, 40100.

Address Interpretation Explicit selection is useful when documentation omits the traditional prefix.

Important: The familiar 0xxxx / 1xxxx / 3xxxx / 4xxxx notation is a conventional reference scheme. The actual Modbus PDU carries a zero-based 16-bit address. Many modern device manuals use their own address notation, so always verify the manufacturer’s addressing convention.

Modbus Address Result Converted

Protocol Address –

Reference –

Zero-Based Decimal –

Hex Protocol Address –

PDU Address Bytes –

Data Type –

Read Function –

Write Function –

Element Number –

Address Calculation

–

What Is a Modbus Address Calculator?

A Modbus Address Calculator converts between the address notation commonly printed in PLC and industrial-device documentation and the zero-based address field transmitted in the Modbus protocol.

The distinction matters because a manual may describe the first holding register as 40001, while the Modbus request itself carries starting address 0x0000. The prefix identifies the traditional Modbus data table; it is not transmitted as part of the PDU address.

This calculator handles the four primary Modbus data types: coils, discrete inputs, input registers and holding registers.

Modbus 40001 to Protocol Address

Under conventional Modbus reference notation, holding register 40001 corresponds to the first element in the holding-register table.

Reference: 40001 Element number within holding-register table: 1 Zero-based protocol address: 1 – 1 = 0 Hexadecimal: 0x0000 PDU bytes: 00 00

So a request to read conventional register 40001 starts at protocol address zero.

Modbus Address Table

Traditional Reference	Data Type	Access	Common Read Function	First PDU Address
00001…	Coils	Read / Write	01	0x0000
10001…	Discrete Inputs	Read Only	02	0x0000
30001…	Input Registers	Read Only	04	0x0000
40001…	Holding Registers	Read / Write	03	0x0000

Modbus Addressing Formula

For the traditional five-digit reference model, the zero-based protocol address is the position of an element within its data table minus one.

Coil: 00001 → offset 0 00002 → offset 1 00100 → offset 99 Discrete Input: 10001 → offset 0 10100 → offset 99 Input Register: 30001 → offset 0 30100 → offset 99 Holding Register: 40001 → offset 0 40100 → offset 99

How to Use the Modbus Address Calculator

Enter the documented Modbus reference

For example, enter 40001, 40100, 30001 or 00001.

Select or detect the data type

The traditional leading digit identifies the Modbus data table.

Convert to the protocol offset

The calculator determines the zero-based decimal and hexadecimal address.

Read the PDU bytes

The 16-bit address is also shown as high and low bytes ready for a Modbus request.

Check the function code

The result shows the normal read and, where applicable, write functions for that data type.

40001 vs 0: Why Modbus Addresses Look Different

The Modbus data model numbers elements from one, while the protocol addressing field uses a zero-based address. This creates the familiar one-address difference.

Traditional documentation: Holding Register 40001 Modbus PDU: Starting Address = 0x0000 Traditional documentation: Holding Register 40002 Modbus PDU: Starting Address = 0x0001

Example: Convert 40100 to Modbus Address

Reference 40100 represents the 100th holding-register position in the traditional 4xxxx table.

Element = 100 Subtract one: 100 – 1 = 99 Decimal PDU address: 99 Hexadecimal: 0x0063 Address bytes: 00 63

Example: Convert 30015

Traditional input register 30015 corresponds to element 15 in the input register table.

15 – 1 = 14 decimal = 0x000E Therefore: 30015 → PDU address 0x000E

Coil Address Example

Coils are individual read/write bits. In traditional reference notation, coil 00001 corresponds to protocol address zero.

00001 → 0x0000 00002 → 0x0001 00100 → 0x0063

Function 01 is normally used to read coils, while functions 05 and 15 write single and multiple coils respectively.

Discrete Input Addressing

Discrete inputs are one-bit read-only values. Traditional references normally begin with the 1xxxx range.

10001 → protocol offset 0 10002 → protocol offset 1 10100 → protocol offset 99

Function code 02 reads discrete inputs.

Input Register Addressing

Input registers are 16-bit read-only values in the Modbus data model. Traditional reference notation commonly uses the 3xxxx range.

30001 → 0x0000 30002 → 0x0001 30100 → 0x0063

Function code 04 reads input registers.

Holding Register Addressing

Holding registers are 16-bit read/write values. Traditional references use the 4xxxx range.

40001 → 0x0000 40002 → 0x0001 40100 → 0x0063

Function code 03 reads holding registers. Common write operations include function 06 for one register and function 16 decimal, hexadecimal 10, for multiple registers.

Modbus Protocol Address Range

The Modbus PDU contains a 16-bit address field. A zero-based protocol address therefore ranges from:

0x0000 to 0xFFFF or: 0 to 65535 decimal

Whether a particular device actually implements all of those addresses is entirely device-specific.

Modbus PDU Address Bytes

The protocol address is normally transmitted as a two-byte field with the higher-order address byte first.

For decimal address 99: 99 = 0x0063 Therefore the request contains: 00 63

This differs from the RTU CRC field, whose two bytes are transmitted in low-byte-first CRC order.

Modbus Function Codes by Address Type

Data Type	Read	Single Write	Multiple Write
Coils	01	05	15 / 0F hex
Discrete Inputs	02	—	—
Input Registers	04	—	—
Holding Registers	03	06	16 / 10 hex

Why Some Manuals Say Register 0 Instead of 40001

Modern Modbus devices do not all use traditional five-digit reference notation. A vendor may document the first holding register as register 0, register 1, address 0, 40001, 400001 or another convention.

The device may also use the function code or register-table heading to tell you which Modbus data table applies, making a 4xxxx prefix unnecessary.

Do not automatically subtract 40001 from every number containing a 4. First determine the addressing convention used by the actual device manual.

5-Digit vs 6-Digit Modbus References

Traditional examples often use references such as 40001 through 49999. Some software and documentation extends the visual reference notation to six digits, such as 400001.

These human-readable schemes should not be confused with the protocol’s own 16-bit starting-address field. The safest workflow is to identify the data table and the zero-based offset expected by the device.

This calculator intentionally focuses on the widely recognized traditional five-digit reference model plus direct protocol offsets. It does not silently guess a vendor-specific six-digit convention.

Zero-Based vs One-Based Modbus Addressing

Zero-Based Address

The first protocol location is offset zero. This is the value normally carried in a Modbus PDU starting-address field.

One-Based Element Number

Human documentation may label the first item as 1, which creates the familiar offset-by-one difference.

This is why an apparent address mismatch of exactly one is extremely common when connecting PLC software, gateways and Modbus test tools.

Common Modbus Addressing Mistakes

Sending 40001 Literally

Traditional reference 40001 represents a holding-register table location; the PDU address is zero.

Subtracting One Twice

Some software already expects the documentation’s address convention, so an extra manual adjustment can introduce an error.

Wrong Register Table

30001 and 40001 both map to offset zero but use different Modbus functions.

Ignoring Vendor Convention

Modern device manuals do not universally use the old 5-digit notation.

Confusing Decimal and Hex

Decimal address 100 is not hexadecimal 0x0100.

Confusing CRC Byte Order

Address words are high-byte first; the Modbus RTU CRC field uses low-byte-first wire order.

Modbus Address Calculator FAQs

What is the Modbus address for register 40001?

Under traditional Modbus reference notation, holding register 40001 maps to zero-based protocol address 0 or hexadecimal 0x0000.

What is the Modbus address for 40002?

40002 maps to protocol address 1, which is hexadecimal 0x0001.

What is the Modbus address for 40100?

40100 represents element 100 of the holding-register table, so the zero-based address is 99 decimal or 0x0063.

What does 40001 mean?

In traditional Modbus reference notation, the 4 indicates the holding-register table and 0001 identifies its first element.

What does 30001 mean?

It conventionally identifies the first input register and maps to protocol address zero when that notation is being used.

What does 10001 mean?

It traditionally identifies the first discrete input, read using Modbus function 02.

What does 00001 mean?

It traditionally identifies the first coil and corresponds to zero-based protocol address 0.

Are Modbus protocol addresses zero based?

The Modbus PDU addressing model uses addresses from 0 through 65535. Human-readable device documentation may use another numbering convention.

Why is 40001 sent as address 0000?

40001 is a reference notation for the first holding-register element. The protocol starting address identifies that first element with zero-based offset 0.

Is register 40001 transmitted as decimal 40001?

Not under the conventional reference model. The holding-register data type is indicated by the Modbus function, while the PDU contains the zero-based address.

What function code reads holding registers?

Function code 03 reads holding registers.

What function code reads input registers?

Function code 04 reads input registers.

What function code reads coils?

Function code 01 reads coils.

What function code reads discrete inputs?

Function code 02 reads discrete inputs.

What is the maximum Modbus protocol address?

The 16-bit PDU address field ranges through 0xFFFF, or 65535 decimal, although a particular device may implement a much smaller address range.

Why is my Modbus address off by one?

A common cause is mixing one-based documentation numbering with the zero-based protocol offset expected by a Modbus client or server.

Does every manufacturer use 40001 notation?

No. Many modern devices document register addresses as direct offsets or use vendor-specific numbering. Always check the device manual.

Convert Modbus Register References and Protocol Addresses

Enter a conventional coil, discrete-input, input-register or holding-register reference to calculate its zero-based decimal address, hexadecimal PDU address, address bytes and typical Modbus function codes.