What is the address range for Modbus holding registers?

Modbus holding registers use the 4x data model. In 1-based addressing: 40001 to 49999. In 0-based addressing (as sent in the PDU): 0 to 9999. So register 40001 in 1-based notation corresponds to address 0 in the actual Modbus request. Most device datasheets use 1-based notation — subtract 40001 to get the address to use in your master.

How do I simulate a 32-bit float in a Modbus holding register?

A 32-bit IEEE 754 float occupies two consecutive 16-bit holding registers. For example, a float value at 40001 uses registers 40001 and 40002. ModbusSimulator.com lets you enter the float value and select the byte order (ABCD Big Endian, DCBA Little Endian, BADC or CDAB mid-swapped) to match your device's register map documentation.

What Modbus function codes work with holding registers?

FC03 (Read Holding Registers): reads 1–125 registers in one request. FC06 (Write Single Register): writes a single 16-bit value to one register. FC16 (Write Multiple Registers): writes 1–123 registers in one request. FC23 (Read/Write Multiple Registers): combined read and write in one request. ModbusSimulator.com supports all four function codes in both master and slave modes.

Modbus Holding Register Simulator — Set & Test 4x Registers

Q: What are Modbus holding registers?

Modbus holding registers (also called 4x registers) are read-write 16-bit registers in the address range 40001–49999 (or 0-based: 0–9999). They store configuration setpoints, analog output values, and writable parameters. Modbus masters read them using FC03 and write to them using FC06 (single register) or FC16 (multiple registers). Holding registers are the most commonly used Modbus register type in industrial devices.

What Are Modbus Holding Registers?

Holding registers (data model prefix 4x) are the most versatile register type in Modbus. They are 16-bit, read-write registers accessible via three function codes: FC03 (read), FC06 (write single), FC16 (write multiple). Engineers use them to store setpoints, analog output values, configuration parameters, and any value that needs to be both read and written by the master.

A Modbus holding register simulator lets you define register values in software — so you can test a SCADA system, PLC program, or HMI application against a simulated device before the real hardware is available.

Modbus Register Type Reference

Type	Prefix	1-based Range	0-based PDU Range	Read FC	Write FC	Access
Coils	0x	00001–09999	0–9998	FC01	FC05, FC15	Read/Write
Discrete Inputs	1x	10001–19999	0–9998	FC02	—	Read-only
Input Registers	3x	30001–39999	0–9998	FC04	—	Read-only
Holding Registers	4x	40001–49999	0–9998	FC03	FC06, FC16	Read/Write

Holding Register Simulator Features

📊

65,535 Configurable Holding Registers

Set any value in registers 40001–65535. Use the grid editor to enter values individually, paste from a spreadsheet, or import from a CSV register map. Changes take effect instantly — the next master read gets the updated value.

🔢

All Data Types — INT16, UINT16, INT32, FLOAT32, DWORD

Display and set values as signed/unsigned 16-bit integers, 32-bit integers spanning two registers, IEEE 754 float32 across two registers, or raw hex. Choose the data type per register block to match your device's register map.

🔄

Four Byte Orders for 32-bit Values

32-bit values spanning two registers have four possible byte orderings: ABCD (Big Endian), DCBA (Little Endian), BADC (Mid-Big), CDAB (Mid-Little). Select the one matching your device spec — critical for energy meters and VFD drives.

✍️

FC16 Write Simulation — Test Master Writes

Your SCADA or PLC sends FC16 write requests to the simulator. The new values appear instantly in the register grid. Use this to validate that your master is sending the correct register addresses, data types, and values before deploying to production.

📋

Transaction Log — Every FC03/FC06/FC16 Logged

Every read and write is logged with timestamp, function code, starting address, register count, and values. Instantly see if your master is requesting the right address range, and verify writes arrived correctly.

📂

CSV Register Map Import

Have a device datasheet with a register map? Export it to CSV format and import directly into the simulator. Columns: address, value, data type, byte order, description. Populates all registers in one click.

Holding Register Addressing — 1-based vs 0-based

The most common source of confusion when working with Modbus holding registers is the offset between datasheet notation and the actual PDU address:

Datasheet says	PDU address (send in request)	FC03 request example
40001	0 (0x0000)	FC03, start=0, count=1
40002	1 (0x0001)	FC03, start=1, count=1
40100	99 (0x0063)	FC03, start=99, count=1
41000	999 (0x03E7)	FC03, start=999, count=1

Rule: PDU address = datasheet register number − 40001. ModbusSimulator.com shows both notations in the register grid — switch between 1-based and 0-based display with one click.

Common Use Cases

⚡ Energy Meter Simulation

Set voltage (40001), current (40003), power (40005) as 32-bit floats in ABCD byte order — typical of Eastron SDM and Schneider iEM meters.

🔧 VFD Drive Testing

Simulate speed setpoint (40001), status word (40003), output frequency (40005) — test SCADA speed control and fault monitoring logic before the drive arrives.

🌡️ Temperature Controller

Simulate process value (40001) and setpoint (40002) as INT16. Test your PLC's PID control loop reads the correct addresses before connecting the real controller.

🏗️ SCADA Driver Validation

Configure the simulator to match your device's register map. Connect Ignition, WinCC, or AVEVA and verify tags are bound to correct addresses with correct engineering unit scaling.

Frequently Asked Questions

What is the difference between holding registers and input registers?

Both are 16-bit registers, but with different access permissions. Holding registers (4x) are read-write — a master can both read them (FC03) and write to them (FC06/FC16). Input registers (3x) are read-only — the master can only read them (FC04), the slave device sets the values internally (e.g., a sensor reading). In ModbusSimulator.com, you can set values in both types, but only holding registers respond to FC16 write requests.

How do I set a 32-bit float in holding registers?

Select two consecutive registers (e.g., 40001 and 40002), set the data type to "FLOAT32", enter the float value (e.g., 98.6), and choose the byte order matching your device's spec. The simulator automatically splits the value across both registers. Common byte orders: energy meters often use ABCD Big Endian; some Schneider devices use CDAB. Check the device register map document.

My master can't read register 40001 — why?

Most Modbus masters send address 0 in the FC03 request to read register 40001 (0-based addressing). Some masters use 1-based addressing and send address 1 for register 40001. ModbusSimulator.com defaults to 0-based (register 40001 = address 0). If your master sends address 1 for 40001, enable the "1-based addressing" option in the simulator settings.

Can I simulate exception responses for specific register ranges?

Yes. You can configure the simulator to return FC03 exception code 02 (Illegal Data Address) for specific register ranges. This lets you test your master application's error handling for out-of-range addresses — without needing a real device that has the same restrictions.

Modbus Holding Register Simulator