Overview
Modbus is everywhere — energy meters, VFDs, temperature controllers, flow meters. The protocol itself is simple, but getting usable values out of it trips up even experienced engineers. The most common problem: reading two 16-bit registers and turning them into a meaningful 32-bit float. This guide walks through the process step by step.
What You'll Need
- PLC programming software (Studio 5000, TIA Portal, or equivalent)
- Modbus poll/scan tool (for testing — CAS Modbus Scanner, QModMaster, or similar)
- Device documentation with register map
- Known reference value for validation (e.g., read a temperature sensor at a known temp)
Step-by-Step
Find the Register Address
Open the device manual and locate the register map. You're looking for the register number and data type. Modbus addresses use function codes — the most common are FC03 for holding registers (4xxxx range) and FC04 for input registers (3xxxx range).
Example: A power meter lists "Total kWh" at register 40001, data type Float32.
Calculate the Offset
Here's where it gets confusing. Modbus documentation can be 0-indexed or 1-indexed. Register "40001" in the manual may be address 0 on the wire (the actual Modbus request). Some devices use 40001 = address 0, others use 40001 = address 1.
If your first read returns garbage, try offset ±1. This is the most common Modbus commissioning issue.
Read Two Consecutive Registers
A 32-bit float requires two 16-bit Modbus registers. Read register N and N+1. Your PLC or scan tool will return two 16-bit values (0-65535 each).
Example: Reading registers 40001 and 40002 returns 16968 and 0.
Determine Byte Order
This is the critical step. A 32-bit float has 4 bytes (A, B, C, D). Different devices arrange these bytes differently across the two registers:
| Order | Name | Register 1 | Register 2 | Common In |
|---|---|---|---|---|
ABCD | Big Endian | AB | CD | Most Modbus devices |
CDAB | Word Swap | CD | AB | Some ABB, Schneider |
BADC | Byte Swap | BA | DC | Some older devices |
DCBA | Little Endian | DC | BA | PC-native order |
If you know the expected value (e.g., a temperature sensor reading 72°F), try all four byte orders. Only one will produce the correct number.
Convert to Float
Once the bytes are in the correct order, interpret the 32-bit value as an IEEE 754 single-precision float. In Studio 5000, use a COP instruction to copy from two INTs to a REAL. In TIA Portal, use MOVE or slice access. In most Modbus scan tools, set the data type to "Float 32" and select the matching byte order.
Common Problems
Value reads as 0.0 or a very small number (like 1.0e-38)
Registers are swapped. Try CDAB instead of ABCD (or vice versa). This is a word-swap issue.
Value reads as a huge number (like 4.29e+09) or NaN
Byte order is wrong. Try all four combinations. Also verify you're reading the correct register address.
Value is close but not exact (e.g., reading 7.2 when sensor shows 72)
Check the scaling factor. Some devices store values with implied decimal points or require multiplication.
CRC errors or timeouts
Check baud rate, parity, and stop bits. Both ends must match exactly. For Modbus RTU, common settings are 9600/8/N/1 or 19200/8/E/1.
Quick Reference
| Data Type | Registers | Range | Use Case |
|---|---|---|---|
| INT16 (signed) | 1 | -32,768 to 32,767 | Simple analog values |
| UINT16 (unsigned) | 1 | 0 to 65,535 | Raw counts, status words |
| INT32 (signed) | 2 | ±2.1 billion | Totals, large counts |
| FLOAT32 | 2 | ±3.4e38 | Temperature, pressure, flow |
| FLOAT64 | 4 | ±1.8e308 | Energy totals, high-precision |
Need Help With Modbus Integration?
We've commissioned hundreds of Modbus devices across power meters, VFDs, and process instruments. Let's get your system talking.
Talk to Us Call (615) 854-2420