Symptom
Polled values are wrong, out of range, negative when they should be positive, off by a fixed factor, jump to huge values at certain readings, or belong to a different measurement; the device display shows the right value; the poll itself succeeds with no exception.
The short answer
Wrong Register Data
A device that answers a poll has sent exactly the bytes it was asked for, and wrong data means the request asked for the wrong bytes or the master interprets them wrongly. Each mistake leaves a signature: a value that is the neighbor of what you expected is an offset by one; a value that is plausible but belongs to another measurement is the wrong table or the wrong starting address; a huge or tiny number from a 32-bit register is a word or byte order problem; a value that reads correctly until it passes 32767 and then goes negative is a signed and unsigned mismatch; a value that is a thousand times too large is an unapplied scale factor; a value that never changes from a gateway is a stale mapping. Reading the raw registers with a test tool alongside the device display resolves nearly all of them in minutes.
Key points
- The device sent what it was asked for; the request or the interpretation is wrong.
- Off by one is the zero-based and one-based offset convention; check it first.
- Huge or tiny values from a 32-bit register mean word or byte order; negative values past 32767 mean signed against unsigned.
- Read the raw registers with a test tool beside the device display and match them by hand.
- Gateways add a second mapping that can be stale, offset, or scaled differently from the device.
Possible causes and what to check
| Possible cause | What to check |
|---|---|
| Offset by one | Every value is the neighbor register: the driver counts from zero and the manual from one, or the reverse. Shift the starting address by one and compare with the display. |
| Wrong table | Holding registers read where input registers were meant, or coils where discrete inputs were; the values are plausible but belong elsewhere. Match the function code to the table in the map. |
| Word order in 32-bit values | A float or a long that reads as an enormous or minuscule number; the two 16-bit halves are in the other order. Swap the word order in the driver. |
| Byte order within a word | Values scrambled within each register; less common, some devices and gateways send little-endian words. Set the byte swap in the driver. |
| Float read as integer or the reverse | A float register interpreted as two integers gives two meaningless numbers; an integer read as a float gives a tiny or denormal value. Match the data type to the map. |
| Signed and unsigned mismatch | Values correct up to 32767 and then negative, or negative values shown as numbers above 32768. Set the type to match. |
| Scale factor not applied | A value ten, a hundred, or a thousand times too large or small; the map says the register holds tenths or hundredths. Apply the scale in the driver or the controller. |
| Gateway mapping stale or wrong | A value that never changes, or changes late; the gateway copies from the wrong source or stopped updating. Read the device directly and compare. |
| Wrong unit identifier or device address | Another device with the same map answering; a gateway routing by unit identifier to the wrong port. Confirm the unit identifier with a value only that device has. |
| Register map from a different firmware or model | A map from an older manual with different addresses; a device replaced by a newer model. Get the map for the installed firmware. |
Signatures
| What you see | Likely mistake | Try |
|---|---|---|
| The value next door; everything shifted | Offset convention | Start address plus or minus one |
| Plausible values, wrong measurements | Wrong table or wrong block start | Function code and the map |
| About 1e-40, or 1e30, or wildly varying | Float word order | Swap words |
| Value scrambled per register | Byte order | Swap bytes |
| Two odd integers where one value belongs | Float read as integers | Set the type to float, two registers |
| Correct, then negative past 32767 | Signed versus unsigned | Set the type |
| Off by 10, 100, or 1000 | Scale factor | Apply the multiplier from the map |
| Never changes | Stale gateway mapping, or a register that is not what you think | Read the device directly |
| Changes but tracks a different device | Unit identifier or address | Confirm the identifier |
Reading it raw
- 1
Get the map for the installed device
The manual for the model and firmware actually installed, with the addressing convention it uses stated on the page.
- 2
Poll with a test tool
A laptop master reading a block of raw registers as unsigned 16-bit integers, with no type or scaling applied.
- 3
Match by hand
Find the values on the device display in the raw block: a temperature of 72.4 shows up as 724 in a tenths register, a pressure of 45.2 as two registers that form a float, a status as a bit pattern.
- 4
Derive the settings
From where each value sits and how it is encoded: the offset, the table, the type, the word order, and the scale. Set them in the driver.
- 5
Verify across the range
Watch a value cross zero, cross 32767, and go to its maximum; each crossing exposes a type or order mistake that a single reading hides.
- 6
Document
The verified settings in the network schedule and the driver configuration, so the next replacement does not start over.
Device display: flow 123.4 gpm
Raw registers 40001..40004 as unsigned: 1234 0 17141 52429
Register 40001 = 1234 -> flow in tenths (scale 0.1)
Registers 40003..40004 = 17141, 52429 -> float 123.4 when read high word first
(if read low word first: 4.1e-06, which is the word order signature)Gateways in the middle
A protocol gateway has its own map: it polls the device with one set of settings and presents the data to the master with another. A value can be right at the device and wrong at the master because the gateway applied a type or a scale, or presented registers in a different order, or copies a block that starts one register off. Read the device directly with the test tool, then read the gateway, and the two blocks side by side show what the gateway did.
Frequently asked questions
- The value is right most of the time and occasionally garbage for one scan.
- A 32-bit value read as two separate 16-bit registers in two requests can be torn: one half from before an update, the other from after. Read both registers in one request, or use a driver that reads the pair atomically.
- The manual says register 40010 but nothing sensible is there.
- Try 40009 and 40011, then the input register table at 30010. Then confirm the firmware version against the manual. Register numbering with a table prefix, addressing with an offset from zero, and a manual for a different model account for nearly every case.
- Can the device be sending wrong data?
- Rarely, but a device that reports a measured value in a register may also report a status that says the value is invalid, and the master that ignores the status shows the stale or default number. Read the status register with the value.
- How do I tell which word order a device uses without the manual?
- Read a known float as raw registers and try both orders; one gives the display value and the other gives something absurd. Do the same for a known long integer. Then apply the finding to the whole map, since a device is consistent within itself.
Related topics
- Modbus TCPModbus over Ethernet: what the MBAP header changes, why the CRC disappears, how the unit identifier works, and what does not get easier just because it is on Ethernet.
- Modbus RTUSerial Modbus over RS-485: function codes, register addressing, the off-by-one that catches everyone, and the physical layer details that decide whether a bus is stable.
- Protocol GatewaysProtocol converters between a controller and devices that do not speak its language: what a gateway does, the common pairings in water and wastewater, the mapping table that is the whole configuration, the failure modes a gateway adds, and when to use a native interface instead.
- Read Works but Write FailsPolling a device returns good data and writing a setpoint does nothing or returns an exception: a write-protected device, a read-only register, the wrong function code, a wrong address or type, logic that overwrites the value, a security rule, or a local mode.
- How to Configure a Modbus ConnectionSet up a Modbus RTU or TCP link between a controller and a device: get the register map, match the physical and protocol settings, build the reads and writes, handle data types and the addressing offset, and verify with a protocol tool before trusting a value.
- Raw CountsWhat an analog input module actually hands the program: the count range, where 4 mA and 20 mA fall in it, how under-range and over-range show up, and why the module manual is the only source that counts.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.