Why a Modbus point reads the wrong register

Everything a Modbus device exposes falls into one of four groups, and the leading digit of the address the vendor publishes is what tells them apart.

A device is under no obligation to implement all four. A meter may have holding registers and nothing else.

Decimal and hex addressing on the wire is zero-based: the first item in a group is item 0. So holding register 108 is addressed as 107 decimal, or 006B hex. Vendor documentation, meanwhile, almost always lists a five-digit Modbus address starting at 40001 — which is one-based.

Those two conventions differ by exactly one, which is why the symptom is a point that reads a plausible but wrong value rather than a fault. Coil Modbus 109 is decimal 108 and hex 6D. Read the neighbouring register of a meter and you get a number, just not the one on the label.

Modbus does not describe its own payloads. The protocol moves 16-bit registers; what those registers mean is entirely the vendor's choice, and the only place it is written down is their documentation. Get it wrong and the point still polls happily.

Two things follow from the multi-register types. The first is that byte order is configured at the device, or globally at the network — so one wrong setting scrambles every float on that device at once, which at least makes it obvious. The second is that a float consumes the register you addressed and the next one, so point counts and address planning have to allow for it.

Writes round before they go out. Integer and Signed Integer round to the nearest whole number and clamp to their range; Long and Long 64-bit round; Float and Double do not round at all. A write of 20.6 to an integer holding register arrives as 21, and nothing reports that it was changed.

Vendors routinely pack several unrelated values into one 16-bit register. The driver handles this with bit-level proxy extensions — NumericBits and EnumBits variants — where several points share the same Data Address and differ only in Beginning Bit and Number Bits.

A meter's tariff configuration is the classic case: one holding register where bits 8–15 hold the tariff number, bits 2–7 the start hour and bits 0–1 the start quarter-hour. Three points, one address, three bit windows. Reading that register as a plain integer produces a large meaningless number, which is what usually gets reported as "the meter is sending rubbish".

Unlike most drivers, the Modbus point manager has no learn mode: no Discover button, no Discovered and Database panes. The protocol carries no self-description, so there is nothing to discover. Every point is created by hand from the vendor's register map.

What the New Points window does give you is Number To Add, which creates consecutively addressed points from a starting address in one go. Since devices normally address related data consecutively, that covers most of a register map in a handful of operations.

Open the point and read ProxyExt > Fault Cause. It normally contains the Modbus exception verbatim, such as Read fault: illegal data address. That string distinguishes the three failures people conflate: the address does not exist, the device is not answering at all, and the address exists but the data type is wrong — only the first two produce a fault.

Running the station as a Modbus server is the mirror image, and adds one rule worth knowing before you start: every server point must fall inside a declared register range or it sits in fault.

The four range tables — coils, status, holding registers, input registers — each arrive from the palette enabled, with a starting address offset of 1 and a size of 64. A holding-register range with starting address 250 and size 75 covers Modbus 40250 to 40325. You can add further ranges, or disable one entirely so that a master querying it gets an exception response, which is occasionally the honest answer.