Any format works: spaces, no spaces, 0x prefixes, commas, colons or a pasted log.
A reply does not carry the address it answers, so the rows below are numbered from zero until you tell it.
Most meters publish a whole number and expect you to divide.
Reading this register once is a decoder. Reading it every ten seconds is a dashboard.
Synacl takes the same register from an ESP32 gateway and keeps it: live charts, history, alerts when it crosses a threshold, and an API. Free for five devices, no card.
- No firmware to write. The gateway is flashed from the browser and configured in a form.
- Five devices free. Then plans from a few dollars a month — compare them.
- Alerts that reach you. Email, webhook or MQTT when a register leaves its band.
- Test the bus first. The RTU tester reads a real slave from this browser.
The three things that go wrong
The address is off by one
A datasheet that says 40002 means the second holding register. The number that travels on the wire is 1, because addresses start at zero and the leading 4 is a type marker, not part of the address. Input registers use 3xxxx, discrete inputs 1xxxx and coils 0xxxx. Every address on this page is shown in all three forms so there is nothing to convert in your head.
The value is negative, not enormous
Modbus registers are 16 bits and carry no sign. A device reporting minus one sends 0xFFFF, which reads as 65535 unless you interpret it as signed. If a temperature reads 65526 in winter, it is minus one degree.
The float words are the other way round
A 32-bit float needs two registers and the standard does not say which comes first. Vendors split roughly evenly between ABCD and CDAB. This page shows all four orderings for every pair, so the one that looks like a real measurement is the one your device uses.
Questions this page gets asked
The same handful, every time.
How does it know whether a frame is a request or a reply?
Mostly from the CRC. A request and a reply for the same function code are usually different lengths, so only one reading produces a CRC that checks out. When both readings are valid — which happens when a read request and a three-byte reply are both eight bytes long — the tool says so and lets you pick. Write requests for function codes 05 and 06 are byte-for-byte identical to the reply that confirms them, so nothing can tell those apart and the tool says that too.
My datasheet says register 40002 but the tool shows address 1.
Both are right. Datasheets number registers from 1 and prefix them by type: 4xxxx for holding registers, 3xxxx for input registers, 1xxxx for discrete inputs and 0xxxx for coils. The address that travels on the wire is zero-based, so 40002 is the second holding register and goes out as address 1. This off-by-one is the single most common Modbus mistake, so every address here is shown in all three forms at once.
Why does my temperature read 65535?
Because the value is negative. Modbus registers are 16 bits with no sign of their own, so a device sending minus one sends 0xFFFF, and software that reads it as unsigned prints 65535. A reading of 65535, 65530 or similar almost always means a small negative number. The decoder shows both readings side by side and highlights the signed one when it looks more plausible.
My float value is nonsense — it reads 2.7e23.
That is a word-order mismatch. A 32-bit float spans two registers, and vendors disagree about which register comes first. The four combinations are usually written ABCD, CDAB, BADC and DCBA. The decoder shows all four for every register pair, so the one that reads like a real measurement is the order your device uses. CDAB is the most common alternative to the standard ABCD.
The CRC does not match. What causes that?
Four things account for nearly all of it. The two CRC bytes may be swapped, because Modbus sends the low byte first and many implementations print the value the other way round. The calculation may have started at zero instead of 0xFFFF, which is a different CRC-16 variant entirely. The CRC bytes themselves may have been included in the calculation. Or the frame may simply be corrupted on the wire, which usually means the baud rate or parity is wrong. On a live bus, wrong parity is the most common cause.
What is the difference between Modbus RTU and Modbus TCP here?
The same commands travel in a different envelope. RTU puts the slave address at the front and a CRC at the end. TCP replaces both with a six-byte header carrying a transaction id, a protocol id of zero and a length, because the network already guarantees delivery. The tool detects which one you pasted and can convert between them, which is handy when a gateway sits between the two.
Is the frame I paste uploaded anywhere?
No. Nothing you type or read leaves your browser. The only network request the tool makes is one anonymous ping (a GET to /tools/_/…, no cookies, no identifiers) when a decode or read succeeds, so we know the tool is used. The share link keeps the frame in the part of the URL after the # symbol, which browsers never send to a server.
Can Synacl store the values I am decoding?
Yes, with one limit worth knowing before you plan around it. A Synacl gateway reads one 16-bit register per tag, as an unsigned value, and applies a scale factor. It does not currently join two registers into a 32-bit float or interpret a register as signed. If your value is a 32-bit float, add the registers as separate tags or use the 16-bit register most meters also publish. The decoder says so whenever the reading you are looking at is one Synacl cannot store directly.