# Reading Modbus Address over 32767 **URL:** \ **Category:** Ignition\ **Tags:** modbus\ **Created:** [October 17, 2024, 3:55am UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363 "2024-10-17T03:55:43Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![jean.arnosti](https://avatars.discourse-cdn.com/v4/letter/j/90db22/32.png) [@jean.arnosti](https://forum.inductiveautomation.com/u/jean.arnosti)\ **Post date:** [October 17, 2024, 3:55am UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/1 "2024-10-17T03:55:43Z")
Hi, I am trying to read Modbus address above 32767 using ModBusTCP. Anyone can help me? I would like to know the syntax to reed register 33792 as shown below. I tried IRUS33792, IRUS33791 and IRUS33793 without success. Here is the list of Register I need to read. Thank you for your help. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/1/d1144b5844e41ee58e0caab6a59ff55041142490.png) ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [October 17, 2024, 4:36am UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/2 "2024-10-17T04:36:26Z")
Are you able to read other registers in lower ranges? I ask because there could be some configuration of the device that's wrong. Also, make sure the OPC path is in the form of ```python ns=1;s=[DeviceName]1.IRUS33792 ``` Where the 1 after the device name is the node address of the modbus device. Edit: Are you getting an error or just data that doesn't look correct? Screenshots of relevant configurations and errors can help. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [October 17, 2024, 12:24pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/3 "2024-10-17T12:24:46Z")
When hex addresses are displayed, they are always **zero-based** , in my experience. IA's driver defaults to using **one-based** addresses. Double check your device's advanced settings. ---
**Author:** ![jean.arnosti](https://avatars.discourse-cdn.com/v4/letter/j/90db22/32.png) [@jean.arnosti](https://forum.inductiveautomation.com/u/jean.arnosti)\ **Post date:** [October 17, 2024, 11:09pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/4 "2024-10-17T23:09:08Z")
Hi Michael, Here is my config. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/3/335c889391f19023cfbe3e1d06359141eb5c61e4.png) Also I have this error in the log page each time the query is sent. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/6/d6bf90186d45e960e55070a396bd714a819be444.png) I think the ModbusTCP driver is not able to parse the response from the device. I tried using ModbusPoll tool for a test and here is the result. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/f/8fd85d40ae14a9de1010ef398a519dcb7a73249f.png) Any clue on what is wrong? Thank you ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [October 17, 2024, 11:17pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/5 "2024-10-17T23:17:59Z")
> [@jean.arnosti](#): > > I think the ModbusTCP driver is not able to parse the response from the device. That's not what it says. It's saying you are getting an exception response from the device with exception code 0x03. Compare Wireshark traffic between Modbus Poll and Ignition to see what's different about the request/response. Your Ignition logs are referencing address 31745, not 33792, which is odd. Might be best for you to disable all but one tag while you figure this out. ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [October 18, 2024, 3:58am UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/6 "2024-10-18T03:58:02Z")
I think it's showing -31745, which is odd because if you take 33792 in binary is: ```python 1000 0100 0000 0000 ``` and when converted to a 16-bit integer is: -31744 So just 1 off of the -31745 it shows which if you offset the 33792 by 1 to 33791, then you get -31745 and in binary: ```python 1000 0011 1111 1111 ``` So could be the logs incorrectly formatting the address. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [October 18, 2024, 12:57pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/7 "2024-10-18T12:57:15Z")
Good eye. I think that's just a formatting bug in the logs. So, @jean.arnosti try addressing 33793, or keep 33792 and configure the driver to be in zero-based addressing mode. ---
**Author:** ![jean.arnosti](https://avatars.discourse-cdn.com/v4/letter/j/90db22/32.png) [@jean.arnosti](https://forum.inductiveautomation.com/u/jean.arnosti)\ **Post date:** [October 18, 2024, 1:10pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/8 "2024-10-18T13:10:29Z")
Ok will try this today and let you know. I will also put Wireshark and look at the request and response. Will put the result later ---
**Author:** ![jean.arnosti](https://avatars.discourse-cdn.com/v4/letter/j/90db22/32.png) [@jean.arnosti](https://forum.inductiveautomation.com/u/jean.arnosti)\ **Post date:** [October 18, 2024, 3:27pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/9 "2024-10-18T15:27:55Z")
Hi Kevin, Here is the result on my test. I set the ModbusTCP as Zero-based adressing and OpcItemPath as ns=1;s=[ModbusTCP]1.IRUS33792 as you and Michael suggested. The Query and response from the I/A ModbusTCP driver are OK. But in the Ignition log there a timeout message. Still have bad value at the tag . (Only one tag query in the test) What would cause this timeout message? Here is a snap shot of WireShark with result ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/1/c17b2c9751b1ece9ec1fd4bab1a3978ea9bd2ac5.png) There is no timeout Modbus/TCP Transaction Identifier: 148 Protocol Identifier: 0 Length: 6 Unit Identifier: 1 Modbus .000 0100 = Function Code: Read Input Registers (4) Reference Number: 33792 Word Count: 1 * * * ModbusPoll Response 00 94 00 00 00 04 01 04 02 17 Wireshark result Modbus/TCP Transaction Identifier: 148 Protocol Identifier: 0 Length: 4 Unit Identifier: 1 Modbus .000 0100 = Function Code: Read Input Registers (4) [Request Frame: 9] [Time from request: 0.082751000 seconds] Byte Count: 2 Data: 17 * * * Ignition Query 00 05 00 00 00 06 01 04 84 00 00 01 Wireshark result Modbus/TCP Transaction Identifier: 5 Protocol Identifier: 0 Length: 6 Unit Identifier: 1 Modbus .000 0100 = Function Code: Read Input Registers (4) Reference Number: 33792 Word Count: 1 * * * Ignition Response 00 05 00 00 00 04 01 04 02 17 Wireshark result Modbus/TCP Transaction Identifier: 5 Protocol Identifier: 0 Length: 4 Unit Identifier: 1 Modbus .000 0100 = Function Code: Read Input Registers (4) [Request Frame: 22] [Time from request: 0.086050000 seconds] Byte Count: 2 Data: 17 * * * I still have a bad as value of the tag ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/c/0cfc77fbfb79a96cc617ad3c21030ec150e7e715.png) Here is a snap shot of the Ignition log ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/1/c117711ceb1635233e9196ce3f8c2ba4a73a0fa0.png) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [October 18, 2024, 3:34pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/10 "2024-10-18T15:34:17Z")
> [@jean.arnosti](#): > > Ignition Response > > 00 05 00 00 00 04 01 04 02 17 You seem to be communicating with a broken Modbus implementation. This isn't a valid response to a Read Input Registers request. ```python 00 05 transaction id 00 00 protocol id 00 04 length 01 unit id 04 function code 02 byte count 17 only 1 byte? ``` in your previous modpoll screenshots it looks like the device might actually be returning `17 6E`, but since it seems to be incorrectly calculating the frame size in the MBAP header that doesn't end up being read or seen by the driver. The length indicated by the header in this case should be 5, not 4. ---
**Author:** ![jean.arnosti](https://avatars.discourse-cdn.com/v4/letter/j/90db22/32.png) [@jean.arnosti](https://forum.inductiveautomation.com/u/jean.arnosti)\ **Post date:** [November 6, 2024, 7:23pm UTC](https://forum.inductiveautomation.com/t/reading-modbus-address-over-32767/97363/11 "2024-11-06T19:23:28Z")
Problem solved. Manufacturer fix the broken Modbus implementation I would like to point out that ModBusPoll tool do not check nor verify the lenght of response. This is why there is no error in ModbusPoll. Thank you for your help