Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

It's usually best to post a trace file in a publicly available location with a sample of the packets you have questions about. Text copies do not always yield the same information that a real trace may provide.

In this case, the reference number is the register start range from the request:

Function Code: Read Holding Registers (3) Reference Number: 8416 Word Count: 3

Start at holding register 8416 and read three registers (Word Count).

Modbus is classically all over the map when it comes to register numbering - some start counting at 0, others at 1. Also some use related, but different, numbering:

Holding register: 8416 Register: 48416 or 408416 <-- where the leading 4 implies holding register

Here is a paper on addressing: https://cdn.selinc.com/assets/Literature/Publications/White%20Papers/0020_ModbusRegister_CB_20160523.pdf?v=20170217-161433