Modbus Map | LabJack
« Close

Datasheets and User Guides

App Notes

Software & Driver


Modbus Map

3.1 Modbus Map [T-Series Datasheet]

Modbus Map Tool

The filter and search tool above displays information about the Modbus registers of T-series devices.

  • Name:  The string name that can be used with the LJM library to access each register.
  • Address:  The starting address of each register, which can be used through LJM or with direct Modbus.
  • Details:  A quick description of the register.
  • Type:  Specifies the datatype, which specifies how many registers each value uses.
  • Access:  Each register is readable, writable, or both.
  • Tags:  Used to associate registers with particular functionality.  Useful for filtering.

For the U3, U6 and UE9, see the deprecated Modbus system called UD Modbus.

For a printer-friendly version, see the printable Modbus map.

Also On This Page

  • 0-Based Addressing
  • Single Overlapping Map of Addresses from 0-65535
  • Big-Endian
  • Data Type Constants
  • Sequential Addresses
  • ljm_constants.json


T-series devices are controlled by reading or writing Modbus registers as described on the Communication page.


Modbus protocol is described on the Protocol Details page.

Zero-Based Addressing

Zero-Based Addressing means that the addresses defined in the map above are the same addresses in the actual Modbus packet, and range from 0 to 65535.

Some clients subtract 1 from all addresses.  You tell the client you want to read address 2000, but the client puts 1999 in the actual Modbus packet.  That means if you want to read Modbus address 2000, you have to tell the client 2001.  We use 0-65535 addressing everywhere, so if you want to read an address we document as 2000, then 2000 should be in the Modbus packet. 

Single Overlapping Map of Addresses from 0-65535

T-series devices have a single map of addresses from 0 to 65535.  Any type of register can be located anywhere in that range regardless of data type or whether it is read-only, write-only, or read-write.

The Modbus map is considered overlapping because some registers are used to access more data than what would normally fit within the Modbus address range. We refer to such registers as "Buffer Registers". See section 3.1.1 for more information on Buffer Registers.

Some Modbus client programs use addresses written as 4xxxx.  In this case, the 4 is a special code that means to use the Modbus read function 0x03 and the xxxx is an address from 0-9999 that might additionally have 1 subtracted before being put in the Modbus packet.  The magic number of 40000 (or 40001) has no mention in the Modbus spec that we can find.  What this means in terms of how to talk to the LabJack depends on what exactly the client is doing, but if you want to read from an address we have defined as x (0-65535), then x should be the address in the Modbus packet sent out over TCP.


Modbus is specified as big-endian, which means the most significant value is at the lowest address.  With a read of a 16-bit (single register) value, the 1st byte returned is the MSB (most significant byte) and the 2nd byte returned is the LSB (least significant byte).  With a read of a 32-bit (2 register) value, the value is returned MSW then LSW, where each word is returned MSB then LSB, so the 4 bytes come in order from most significant to least significant.

We have seen some clients that expect Modbus to be implemented with big-endian bytes but with the least significant word before the most significant word. In other words, the client software flips the order of the words within a 32-bit value.  For example, a read of TEST (address 55100) should return 0x00112233, but the client returns 0x22330011. Most client programs provide options to change the data interpretation.

Data Type Constants

Each entry in the map has an associated data type. The data type tells us know to format data being sent to the device and how to interpret data from the device. The raw data in the map contains the integer values below. The Map above displays the type name instead of the integer value.

Type Integer Value

Sequential Addresses

Many registers are sequentially addressed.  The Modbus Map gives you the starting address for the first register, and then—depending on whether the data type is 16-bits or 32-bits—you increment the address by 1 or 2 to get the next value:

Address = StartingAddress + 1*Channel#    (UINT16)

Address = StartingAddress + 2*Channel#    (UINT32, INT32, FLOAT32)

Note that the term "register" is used 2 different ways throughout documentation:

  • A "register" is a location that has a value you might want to read or write (e.g. AIN0 or DAC0).
  • The term "Modbus register" generally refers to the Modbus use of the term, which is a 16-bit value pointed to by an address of 0-65535.

Therefore, most "registers" consist of 1 or 2 "Modbus registers".

For example, the first entry in the Modbus Map has the name AIN#(0:254), which is shorthand notation for 255 registers named AIN0, AIN1, AIN2, ..., AIN254.  The AIN# data type is FLOAT32, so each value needs 2 Modbus registers, an thus the address for a given analog input is channel*2.


LabJack distributes a constants file called ljm_constants.json that defines information about the Modbus register map. The filter and search tool above pulls data from that JSON file.

The ljm_constants GitHub repository contains up-to-date text versions of the Modbus register map: