3.1 Modbus Map [T-Series Datasheet] | LabJack
« Close

Datasheets and User Guides

App Notes

Software & Driver


3.1 Modbus Map [T-Series Datasheet]

Modbus Map Tool

The filter and search tool above displays information about the Modbus registers of T-series devices.

  • Name:  The string name that can be used with the LJM library to access each register.
  • Address:  The starting address of each register, which can be used through LJM or with direct Modbus.
  • Details:  A quick description of the register.
  • Type:  Specifies the datatype, which specifies how many registers each value uses.
  • Access:  Each register is readable, writable, or both.
  • Tags:  Used to associate registers with particular functionality.  Useful for filtering.

For the U3, U6 and UE9, see the deprecated Modbus system called UD Modbus.

For a printer-friendly version, see the printable Modbus map.

Also On This Page

  • 0-Based Addressing
  • Single Overlapping Map of Addresses from 0-65535
  • Big-Endian
  • Data Type Constants
  • Sequential Addresses
  • ljm_constants.json


T-series devices are controlled by reading or writing Modbus registers as described on the Communication page.


Modbus TCP is described further on the Protocol Details page.

Address Mapping

T-series devices have a single map of addresses from 0 to 65535.  Any type of register can be located anywhere in that address range, regardless of the data type or whether it is read-only, write-only, or read-write.

Some addresses point to buffers that can access more data than what would normally fit within the Modbus address range. See section 3.1.1 for more information on Buffer Registers.

Sequential Addresses

Many registers are sequentially addressed.  The Modbus Map gives you the starting address for the first register, and then—depending on whether the data type is 16-bits or 32-bits—you increment the address by 1 or 2 to get the next value:

Address = StartingAddress + 1*Channel#    (UINT16)

Address = StartingAddress + 2*Channel#    (UINT32, INT32, FLOAT32)

Note that the term "register" is used 2 different ways throughout documentation:

  • A "register" is a location that has a value you might want to read or write (e.g. AIN0 or DAC0).
  • The term "Modbus register" generally refers to the Modbus use of the term, which is a 16-bit value pointed to by an address of 0-65535.

Therefore, most "registers" consist of 1 or 2 "Modbus registers".

For example, the first entry (starting address of 0) in the Modbus Map has the name AIN#(0:254), which is shorthand notation for 255 registers named AIN0, AIN1, AIN2, ..., AIN254.  The AIN# data type is FLOAT32, so each value needs 2 Modbus registers, thus the address for a given analog input is channel*2.

Zero-Based Addressing

Zero-Based Addressing means that the addresses defined in the Modbus Map are the addresses that should be used in the actual Modbus TCP packets.

Some Modbus TCP client software subtracts 1 from all addresses.  For example, you tell the client software you want to read address 2000, but it puts 1999 in the actual Modbus TCP packet.  That means if you want to read Modbus address 2000 you have to pass 2001 to the client software.  We use 0-65535 addressing everywhere, so if you want to read an address we document as 2000, then 2000 should be in the Modbus TCP packet. 

Some Modbus TCP client programs use addresses written as 4xxxx, which can refer to the "Holding Register" address block in some Modbus addressing schemes. However, this addressing scheme is not defined as a part of the Modbus specification and LabJack devices do not use this form for addressing. If 4xxxx addressing is encountered in a client program, the xxxx will often refer to the address used in the Modbus packet, or it might also have 1 subtracted before being put into the Modbus packet. For example, address 2000 on the LabJack may be accessible by passing 42000 or 42001 to the client software.


Modbus is specified as big-endian, which means the most significant value is at the lowest address.  With a read of a 16-bit (single register) value, the 1st byte returned is the MSB (most significant byte) and the 2nd byte returned is the LSB (least significant byte).  With a read of a 32-bit (2 register) value, the value is returned MSW then LSW, where each word is returned MSB then LSB, so the 4 bytes come in order from most significant to least significant.

Some Modbus TCP clients expect Modbus to be implemented with big-endian bytes but with the least significant word before the most significant word. In other words, the client software flips the order of the words within a 32-bit value.  For example, a read of TEST (address 55100) should return 0x00112233, but the client returns 0x22330011. Most client programs provide options to change the data interpretation.

Data Type Constants

Each entry in the map has an associated data type. The data type tells us know to format data being sent to the device and how to interpret data from the device. The raw data in the map contains the integer values below. The Map above displays the type name instead of the integer value.

Type Integer Value


LabJack distributes a constants file called ljm_constants.json that defines information about the Modbus register map. The filter and search tool above pulls data from that JSON file.

The ljm_constants GitHub repository contains up-to-date text versions of the Modbus register map: