# Modbus 4XXXXX extended register in Siemens S7-1510, RTU via MOXA MB3180 gateway **URL:** \ **Category:** Ignition\ **Created:** [June 30, 2026, 4:17pm UTC](https://forum.inductiveautomation.com/t/modbus-4xxxxx-extended-register-in-siemens-s7-1510-rtu-via-moxa-mb3180-gateway/116214 "2026-06-30T16:17:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jwilbourn](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@jwilbourn](https://forum.inductiveautomation.com/u/jwilbourn)\ **Post date:** [June 30, 2026, 4:17pm UTC](https://forum.inductiveautomation.com/t/modbus-4xxxxx-extended-register-in-siemens-s7-1510-rtu-via-moxa-mb3180-gateway/116214/1 "2026-06-30T16:17:46Z")
Hello. I have a Siemens S7-1510SP PLC that I am trying to communicate with via Modbus RTU, through a Moxa MB3180 RTU to TCP gateway. The PLC currently communicates successfully with a Kepware server in this configuration. The registers that I need to read are 401025, 401027, 401029 and 401031. The Modbus device ID is 22. I have Ignition Modbus TCP configured with the IP address of the Moxa. In the tag config I have: [modbusDevice]22.HRXXXXXX, but I cannot figure out how to address the appropriate registers. All the examples I can find use the 5-digit registers, not the 6-digit extended range. This is the only info I can find on in the Siemens literature. I do not have access to the PLC program. How should I configure the OPC tags in Ignition to read the registers 401025, 401027, 401029 and 401031? Thanks ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/5/e5dcb45e692477438ac9ba05d06c68781043c691.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 30, 2026, 4:24pm UTC](https://forum.inductiveautomation.com/t/modbus-4xxxxx-extended-register-in-siemens-s7-1510-rtu-via-moxa-mb3180-gateway/116214/2 "2026-06-30T16:24:13Z")
> [@jwilbourn](#): > > How should I configure the OPC tags in Ignition to read the registers 401025, 401027, 401029 and 401031? These are probably `[Device]22.HR1025`, `[Device]22.HR1027`, etc... (maybe plus or minus one, depending on zero-based addressing on either side) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 30, 2026, 4:55pm UTC](https://forum.inductiveautomation.com/t/modbus-4xxxxx-extended-register-in-siemens-s7-1510-rtu-via-moxa-mb3180-gateway/116214/3 "2026-06-30T16:55:16Z")
FWIW, the **protocol** on the wire is always extended, and supports XXXXX covering 2^16 addresses. The early Modicon PLCs that first implemented the protocol could only handle/use addresses 1 ≤ x ≤ 9999, and displayed five digits including the prefix. Those old PLCs also established the one-based convention: register/coil/input/discrete X=1 is actually address zero on the wire. Everybody and their brother has broken Modbus conventions since, including the successors of Gould Modicon (Schneider, now). ---
**Author:** ![jwilbourn](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@jwilbourn](https://forum.inductiveautomation.com/u/jwilbourn)\ **Post date:** [June 30, 2026, 5:11pm UTC](https://forum.inductiveautomation.com/t/modbus-4xxxxx-extended-register-in-siemens-s7-1510-rtu-via-moxa-mb3180-gateway/116214/4 "2026-06-30T17:11:21Z")
Thanks. I have got the communication working. However, I have some discrepancies between the values in Kepware vs Ignition. For example, here is the Setpoint value (changes very infrequently) from register 401029: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/8/18bca6859a7590b8fc0bf081eb031ffc43678393.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/6/a/6a1bb77e20ac621173e7044156ba8593280f33bd.png) Any idea what could be the cause of this? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 30, 2026, 5:12pm UTC](https://forum.inductiveautomation.com/t/modbus-4xxxxx-extended-register-in-siemens-s7-1510-rtu-via-moxa-mb3180-gateway/116214/5 "2026-06-30T17:12:54Z")
Could be off by one address and/or need to use reverse word order option. Could be something else. Get a Wireshark capture if you can, easy to see there. ---
**Author:** ![jwilbourn](https://avatars.discourse-cdn.com/v4/letter/j/67e7ee/32.png) [@jwilbourn](https://forum.inductiveautomation.com/u/jwilbourn)\ **Post date:** [June 30, 2026, 5:21pm UTC](https://forum.inductiveautomation.com/t/modbus-4xxxxx-extended-register-in-siemens-s7-1510-rtu-via-moxa-mb3180-gateway/116214/6 "2026-06-30T17:21:33Z")
Yep, combination of zero-based addressing and reversing word order fixed it. Thank you.