ModBus Pro has 80+ built-in register maps
Stop hunting through PDFs for register addresses. ModBus Pro ships with pre-loaded Modbus maps for ABB, Schneider, Siemens, Phoenix Contact, and more. Scan address ranges to find devices on your network and instantly see every register, correctly decoded.
Before You Start — What You Need
To read Modbus data from any device, you need three things: the device's Modbus register map (or a tool that has it built-in), a connection method (RS485 serial or TCP/IP Ethernet), and a Modbus master/client to send requests.
The register map is the critical piece. It tells you which register addresses hold which values, what data type each register uses (UINT16, INT32, FLOAT32, etc.), and which Modbus function code to use. Without the correct register map, you're flying blind — and this is where most engineers lose hours.
Rather than spending 30 minutes tracking down a PDF register map from a manufacturer's website, ModBus Pro's Auto-Scan feature can scan address ranges to find devices on your network. It includes 80+ built-in register maps for common device families, saving you the manual steps below.
Step 1 — Find the Register Map
Every Modbus slave device has a register map — a document that defines what data lives at which address. For example, an ABB REX615 protection relay publishes its map in the "Modbus Protocol" technical document (2NGA001860), while ABB M4M energy meters use a completely different map starting at register 0x5B00 (23296 decimal).
Where manufacturers hide the register map
The map is typically found in the device's "Communication Protocol" or "Modbus Protocol" manual — not the main user guide. For ABB devices, check library.e.abb.com. For Schneider, check the "Modbus" section of the device's ION setup guide.
Many ABB meters share similar housings but have completely different register maps. An M4M 20, M4M 30, and MVM all look the same but use different starting addresses. We've seen sites where voltage and current read correctly but power values were garbage — the registers overlapped by coincidence for V and I but diverged for P and Q.
Skip the PDF hunt entirely
ModBus Pro ships with verified register maps for these device families and hundreds more:
Each map is tested against real hardware and includes the correct byte order, data types, and scaling factors.
Browse Device Library →Step 2 — Understand Function Codes
Modbus defines different function codes for different types of data:
| FC | Name | Usage | Range |
|---|---|---|---|
| 01 | Read Coils | Digital outputs (R/W) | 0xxxx |
| 02 | Read Discrete Inputs | Digital inputs (RO) | 1xxxx |
| 03 | Read Holding Registers | Analog values (R/W) | 4xxxx |
| 04 | Read Input Registers | Analog inputs (RO) | 3xxxx |
For power monitoring — meters, relays, EMS systems — you'll almost always use FC03 or FC04. The ABB REX615 uses FC03 for measurement data starting around register 2999.
Step 3 — Read Your First Registers
Practical example reading voltage from an ABB energy meter at register 23296 (0x5B00):
Step 4 — Handle Data Types Correctly
A Modbus register is 16 bits. Real-world values don't fit in 16 bits, so manufacturers pack them across multiple registers:
| Type | Regs | Range | Example Use |
|---|---|---|---|
| UINT16 | 1 | 0 – 65,535 | Status codes, counters |
| INT16 | 1 | -32,768 – 32,767 | Temperature |
| UINT32/INT32 | 2 | 0 – 4.29B | Energy totals |
| FLOAT32 | 2 | ±3.4×10³⁸ | Voltage, current, power |
The same 4 bytes can be interpreted 4 ways: ABCD (big-endian), CDAB (word swap), BADC (byte swap), or DCBA (little-endian). If your voltage reads as 2.84e-29 instead of 236.4, your byte order is wrong.
Use our Modbus Number Converter to test all 4 byte orders — or let ModBus Pro compare all 4 byte orders side-by-side in real time.
Step 5 — Verify with a Known Value
Always start by reading a register whose value you can physically verify. Voltage is ideal — measure with a multimeter, compare to your Modbus read. If they match, your connection, address, function code, and byte order are all correct.
Real-World Device Examples
ABB REX615 / REF615 Protection Relay
FC03, FLOAT32 values, big-endian (ABCD). Measurements start around register 2999. Available registers depend on configured protection functions.
ABB M4M / EV3 Energy Meters
Start at 23296 (0x5B00). FLOAT32 ABCD. Critical gotcha: active/reactive power registers aren't contiguous with voltage/current — there are gaps in the map.
Envision EMS (BESS)
FC03 with mixed UINT16 status words and signed INT16/INT32 for power (signed because charge/discharge).
Don't create your own register maps
ModBus Pro's Auto-Scan probes identification registers, matches against our database, and loads the complete map with correct data types and byte ordering. For unknown devices, Smart Scan reads every register range and decodes the most likely data type — turning hours of work into seconds.
Download ModBus Pro →Common Pitfalls
Reading garbage values?
Check byte order first (ABCD vs CDAB), then confirm register count for data type (2 for FLOAT32). Finally verify the function code — some devices respond to FC03 but not FC04 for the same addresses.
Exception Code 02 — Illegal Data Address?
Register maps are often 1-based in docs but 0-based on the wire. Manual says 40001? Send address 0. See our Register Offset Guide.
Timeout / No response?
Check slave ID, baud rate (RTU), or IP/port (TCP). For RS485, reversed A/B lines cause silence, not errors. See our Timeout Guide.