Reading Record-Indexed Modbus Registers with ModScan

Daniel Price2 min read
ModbusOther ManufacturerTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Why Standard Modbus Has No "Record Number" Parameter

The claim that a PC-based master such as ModScan cannot request "record 500 of register 0701" is true for the base protocol and false in practice. Standard Modbus function codes address only a contiguous block of registers: FC 03 (Read Holding Registers) and FC 04 (Read Input Registers) take a starting address and a quantity — there is no index, file, or record-number field in the PDU. However, nothing stops you from implementing the record selection yourself, because most devices that expose "records" behind a single register number do so with a two-step vendor mechanism that any Modbus master can drive.

How Record-Indexed Access Usually Works

The common vendor pattern (a hypothesis you must confirm against your specific device's register map, since the device model is not identified here) is: one register acts as a record selector, and a fixed data window — in this case register 0701 spanning 6 registers — returns the values for whichever record number was last written to the selector. Your six fields (temperature, pressure, etc.) then occupy the six consecutive registers of that window. If that is how your device works, ModScan is fully capable of the transaction; it simply requires two operations instead of one.

Pulling the Record with ModScan

  1. Identify the record-selector register address from the device documentation. If the manual does not document one, record-indexed access may not exist and 0701 may just be six ordinary registers — read them directly and skip to step 4.
  2. In ModScan, write the record number using FC 06 (Preset Single Register): set the selector register address and enter value 500. If the device requires a block write, use FC 16 (Preset Multiple Registers) instead.
  3. Open a second ModScan definition with FC 03, start address 0701, and length 6 to retrieve the record payload.
  4. Verify the six returned values against a known record. Change the selector to a different record number and confirm the window data changes accordingly — this proves the indexing mechanism rather than a static register block.

Addressing and Data-Width Pitfalls

Two assumptions need checking before the read returns sensible data. First, register numbering: if the manual's "0701" is a zero-based protocol address, ModScan's default 1-based reference expects 0702; if it is already a 4xxxx-style reference, enter 0701. A one-register offset in the returned data is the signature of getting this wrong — confirm ModScan's address-base setting and adjust. Second, register width: six data points only equal six registers if each value is a single 16-bit register.

FAQ

Can ModScan read a Modbus record by record number?

Not in a single request — Modbus FC 03/04 only reads a contiguous register block. Write the record number (e.g., 500) to the device's selector register with FC 06 first, then read the data window (e.g., 0701, length 6) with FC 03.

What Modbus function code reads holding registers in ModScan?

Use function code 03 (Read Holding Registers) with a start address and a register count. Use FC 06 to write the record-selector value, or FC 16 if the device requires multiple registers written at once.

Why is my ModScan register data shifted by one address?

A zero-based vs. one-based mismatch: if the manual lists address 0701 as a protocol address, enter 0702 in ModScan's 1-based address field. Check ModScan's address-base option and offset by one until the data aligns.

Back to blog