Resolving Modbus FC03 Holding Register Addressing: PDU vs 40001

Overview: The Modbus Holding Register Addressing Question

When integrating a Modbus RTU slave device such as a Siemens SINAMICS S200 drive into a Siemens WinCC flexible HMI or SIMATIC S7 controller, the most common configuration mistake is treating the human-readable "register number" (e.g., 40001, 40108) as the value loaded into the Protocol Data Unit (PDU) starting address field. The Modbus Application Protocol Specification V1.1b3 defines FC 03 (Read Holding Registers) as reading the binary contents of holding registers, but it deliberately leaves the actual on-wire starting register address as a zero-based offset. This produces the well-documented confusion between addresses 40000 and 40001.

This reference clarifies the difference between the PDU starting address (zero-based, range 0x0000–0xFFFF, 16-bit unsigned) and the remote device register number (one-based, conventional 4xxxx prefix shown in vendor documentation and I/O schedules). It also covers the exact FC 03 request/response frame layout, the byte-order and quantity limits, and how to enter the address correctly in WinCC flexible, TIA Portal, and third-party Modbus masters.

Prerequisites

• A copy of the Modbus Application Protocol Specification V1.1b3 (or later revision) for reference.
• The target slave device's register map (vendor-specific), expressed in 4xxxx form.
• The master configuration tool: WinCC flexible 2008 SP5 or later, TIA Portal V13 SP1 or later, or any Modbus master (OPC server, SCADA node, gateway).
• A serial line analyzer (e.g., Modbus Poll, Wireshark with the Modbus dissector, or a dedicated protocol tap) for verification.
• Knowledge of the slave's RS-485 termination, baud rate, parity, and unit identifier (slave address 1–247).

Modbus Addressing Models: Three Different Numbers, One Register

Every holding register can be identified by three numerically different addresses depending on which layer of the protocol you are looking at. Engineers must keep all three straight when building an I/O schedule.

The conversion rule defined by the Modbus Organization is unambiguous:

• PDU Starting Address = (Conventional Register Number) − 1
• Conventional Register Number = (PDU Starting Address) + 1

Therefore, the first holding register visible as "40001" in vendor documentation is sent on the wire as 0x0000. The register shown as "40108" goes on the wire as 0x006B (decimal 107). The register shown as "40000" is not a valid Modbus register — it is an off-by-one artifact introduced either by tooling that already subtracted one for you, or by a typographical error in the I/O schedule.

Function Code 03 — Read Holding Registers Specification

Per FC 03 of the Modbus specification, the request and response PDU frames have the following structure. The Application Data Unit (ADU) adds the unit identifier and (for RTU) a 16-bit CRC.

Request Frame (Master → Slave)

Response Frame (Slave → Master)

Limits and Exception Codes

Worked Example: Reading Holding Registers 40108–40110

Following the canonical example documented at Simply Modbus FC 03 message example, the request reads three consecutive registers from slave address 17 (0x11).

Conventional register numbers: 40108, 40109, 40110

PDU starting addresses (after subtracting 1): 40108 − 1 = 40107, 40110 − 1 = 40109

Quantity of Registers: 3 (i.e., 40107, 40108, 40109 in PDU terms)

Hexadecimal Form for the Wire

Decimal 40107 = 0x9CCB. Decimal 3 = 0x0003. The full RTU request becomes:

Request:  11 03 9C CB 00 03 [CRC Lo] [CRC Hi]
Response: 11 03 06 [R1 Hi] [R1 Lo] [R2 Hi] [R2 Lo] [R3 Hi] [R3 Lo] [CRC Lo] [CRC Hi]

The byte count in the response is 6 because three 16-bit registers occupy 6 bytes. If the slave returns 11 83 02, the master is reading an illegal address — most often because the PDU offset points one register too high (i.e., the master accidentally sent 0x9CCC, which is decimal 40108, instead of 0x9CCB).

Why Your I/O Schedule Shows 40000 Instead of 40001

Several root causes exist for an I/O schedule that lists a first holding register as 40000 rather than the spec-mandated 40001:

1. Double-offsetting by the scheduler: Some legacy master tools accept the conventional number as input and automatically subtract 1 for the PDU. The scheduler's author then typed the conventional number manually, producing a "double-subtracted" entry of 40000. The correct fix is to enter 40001 in the conventional column.
2. Confusion with the legacy Modicon 984 base: Modicon PLCs historically numbered 400000–465535. A tool migrating an old project sometimes drops the leading digit.
3. Vendor documentation starts at zero: Some modern sensors publish their register map as 0–N. When the engineer copies the map into a Modbus-aware tool expecting the 4xxxx convention, no conversion is applied and the registers appear "off by one" downstream.
4. OPC-DA bridge auto-translation: An OPC server such as KEPServerEX or the Modbus driver in WinCC may apply its own +1 offset. The schedule reflects what the OPC layer exposes, not what goes on the wire.

In all four cases, the engineering rule is the same: trust the slave device register map, expressed in the conventional 4xxxx numbering, and let the master tool handle the PDU offset internally. If the master expects you to enter the PDU address directly, subtract one from every conventional number before typing it in.

Configuring the Address in WinCC flexible and TIA Portal

WinCC flexible (WinCC flexible 2008 SP5 and later)

1. Open the tag editor and create a new tag with connection type "Modicon MODBUS (984)" or "MODBUS RTU", depending on your CP driver.
2. Select "Holding Register (4xxxx)" as the address type.
3. Enter the conventional register number in the "Address" field. For 40108 type 40108, not 107.
4. Set the data type to match the slave encoding (typically WORD, INT, REAL, or DWORD).
5. For 32-bit values spanning two registers, enable "Word swap" or "Byte swap" per the slave's endianness. Siemens SIMATIC S7 and S200 drives default to Big-Endian for Modbus.

TIA Portal (V13 SP1+)

1. Add the Modbus_Comm_Load and Modbus_Master blocks from the "MODBUS" library (instructions catalog → Communication → MODBUS).
2. Configure the Mode parameter to 4 (Read Holding Registers) and the DataPtr to a data block with at least Quantity × 2 bytes allocated.
3. Set the DataAddr (the PDU starting address) to (conventional number − 1). For 40108, enter 40107.
4. Compile and download. The MB_HOLD_REG tag in the HMI tag table still uses the 4xxxx convention.

Verification Procedure

1. Connect a serial tap or Modbus Poll in slave-emulator mode between the master and the physical slave.
2. Force the master to read a single known register and capture the RTU frame. Confirm the starting address field equals (conventional − 1).
3. Compare the response payload to a vendor-supplied reference value. A correctly addressed read returns the documented register content.
4. Trigger a deliberate illegal read (e.g., address 0 with slave map starting at 40001) and confirm the slave responds with 83 02. This proves the wiring and CRC are healthy.
5. Repeat with the I/O schedule in question. If reading 40000 returns exception 02, the schedule is wrong by one. If reading 40001 returns the correct value, update the schedule.

Troubleshooting Matrix

Special Cases: 32-Bit and 64-Bit Values Across Two or Four Registers

Many process variables (REAL / FLOAT, DINT, LREAL) span multiple 16-bit holding registers. The Modbus specification is silent on byte order; the slave vendor chooses.

Siemens S200 drives typically use Big-Endian "ABCD" for REAL values. Schneider Electric Modicon M340 controllers and many ABB drives use "DCBA". Always consult the slave's register map before configuring swap logic in the master.

Register Count vs. Byte Count: Common Pitfall

FC 03 request carries the register count (e.g., 3). FC 03 response carries the byte count (e.g., 6). Confusing these two values is a frequent source of parser bugs in custom Modbus masters. The relationship is:

Byte Count = Quantity of Registers × 2

If the master requests 3 registers, the slave must reply with a byte count of 6, followed by exactly 6 bytes of register data and the CRC. Anything else means either an exception response or a corrupted frame.

Notes on TCP (Modbus TCP) vs. RTU

On Modbus TCP (port 502), the same FC 03 PDU is wrapped in an MBAP header (7 bytes: Transaction ID, Protocol ID 0x0000, Length, Unit Identifier). The PDU starting address rule is unchanged — the body of the MBAP payload still uses zero-based PDU addresses. Many gateways auto-translate between the wire format and the conventional 4xxxx numbering exposed to upstream tools, which is why a "connection problem" can suddenly appear as an "off-by-one addressing" problem when moving from a serial RTU master to a TCP master.