Modbus Write command format


I'm trying to understand how to write to a Modbus register. When I tried address 1 to 4 it gives me "Illegal data address".

I am able to read the registers but cannot write and I am using Modbus poll.

Please find the attached document and advise what address can be used for writing.


From the document you attached under the Modbus RTU section, "Modbus addressing is offset 1 byte from the memory map. For instance the average rate, Bytes 1-4 correspond to Modbus Registers 40002 and 40003. Total information is in Bytes 21-24, or Modbus Registers 40012 and 40013."

I can't say that this description makes much sense to me, but it seems that if you simply divide the last byte number by 2, you get the register number (i.e. for Bytes 1 - 4, 4/2 = 2 (40002) and for Bytes 21 - 24, 24/2 = 12 (40012)).

The above register numbers use 1-based addressing. Modbus Poll uses 0-based addressing. Therefore, to write to the "average rate" register using Modbus Poll, create a Read/Write Definition with an Address of 1 (it should show "PLC address = 40002") and Quantity of 2. You also should use Function Code 16 so that you can write to both registers atomically, in a single write request. You'll also probably want to change the display format to the proper 32-bit format for your data so that Modbus Poll combines the two registers into one value.
Thank you for your reply.
I tried with a function code 16, address 1, quantity 2, PLC(BASE 1) it gives me "Illegal data address".
Also tried to display in 32-Bit and Binary format.
Checking the "PLC Addresses (Base 1)" changes how Modbus Poll interprets the Address field. Therefore, in your Read/Write Definition you must do one of the following:

  • Set the Address to 1 and leave the "PLC Addresses (Base 1)" option unchecked
  • Set the Address to 2 and check the "PLC Addresses (Base 1)" option

In either case, the text after the Address field should show "PLC address = 40002".

In order to figure out the proper 32 Bit format, you can create a Read/Write Definition using Function Code 03. You may need to select the different 32 Bit options until you see the correct value. You can then double-click on the cell to write a new value. Modbus Poll will automatically use function code 16 when writing a value that's displayed as 32 Bit.
I'm curious what value representing which variable did you write to (4)1025?

I can't make sense out of 1025 from the register listing in the manual provided.
I chose a binary format for 41025 to write(gave commands like reset total if the last byte is checked). In the next version, it was mentioned write registers start from 41025.