Weintek Modbus Values Are Wrong: Register Offsets, Data Types and Word Order

kwoco-plc.com

A temperature of 25.0 appears as 250. A negative reading becomes a number above 65,000. A floating-point value turns into an enormous integer. These symptoms can occur while Modbus communication is working.

The useful question is: which register bytes arrived, and how did the HMI interpret them?

Start with the register address, then verify the data type, word order and scaling. Changing all four together can produce a believable number without fixing the underlying mistake.

This guide covers Weintek EasyBuilder Pro projects reading Modbus TCP or RTU devices. Exact address types and conversion options depend on the selected driver and software version.

Read the raw registers before changing the display

Save the HMI project, then choose one affected value whose expected reading can be checked independently.

For that value, collect:

The server device, station or unit identifier.
The register-map entry, including its address convention.
Whether it belongs to input registers or holding registers.
Its length, data type, word order and engineering-unit scale.
The HMI object’s address and numeric format.

Where practical, use temporary read-only objects to inspect each underlying 16-bit register in hexadecimal. Compare those words with the server’s own monitoring tool or a captured response. Account for any driver conversion already enabled—the HMI’s diagnostic display may itself be showing converted data.

Do not write test patterns into live setpoints or output registers. Use an isolated test device or an explicitly reserved test area when controlled values are needed.

If the object disappears or reports failed communication, first establish a successful read. The separate guide to Weintek HMI objects disappearing during Modbus communication covers that problem.

Register 40001 and address 0 can describe the same location

Modbus request addresses start at zero. The device manufacturer determines how its application variables map into that address space. The familiar reference number in a manual is therefore not always the number entered into the HMI. Modbus Application Protocol V1.1b3, sections 4.3–4.4.

For a device using conventional holding-register references:

Description	First holding register	Eleventh holding register
Conventional reference	40001	40011
Zero-based protocol address	0	10
One-based register index	1	11

This is an illustrative mapping, not a universal interpretation of every manufacturer’s address column. A manual may instead give a literal protocol address, sometimes in hexadecimal.

Weintek’s standard MODBUS TCP/IP guide lists 3x and 4x addresses beginning at 1. Verify the selected driver’s convention before entering an offset taken from another client. Weintek MODBUS TCP/IP Connection Guide, pages 1–2.

An off-by-one error can still return valid data. The HMI may read the adjacent parameter, or combine half of one 32-bit value with half of the next. A successful response does not prove that the requested location is correct.

Also verify the data area. Holding-register reads use function 03; input-register reads use function 04. Matching the numeric address alone is insufficient.

Need a Replacement Altivar Drive?

Browse new original Altivar drives for maintenance, troubleshooting, and replacement projects.

The same bits can represent very different numbers

A Modbus register carries 16 bits. The application determines whether those bits represent an unsigned number, a signed number, packed BCD, flags or part of a larger value.

These calculated examples show why display format matters:

Raw pattern	Interpretation	Result
`0xFF9C`	Unsigned 16-bit integer	65436
`0xFF9C`	Signed 16-bit integer	−100
`0x1234`	Unsigned binary integer	4660
`0x1234`	Packed BCD	1234
`0x41480000`	IEEE 754 32-bit float	12.5
`0x41480000`	Unsigned 32-bit integer	1095237632

The last two rows use the same complete 32-bit pattern. Changing decimal places cannot turn the integer interpretation into the floating-point interpretation.

A useful clue is when the error begins. If positive values look right but negative values become large positive numbers, inspect signedness. If a counter fails only after passing 32,767, a signed 16-bit interpretation deserves attention.

For a 32-bit value stored in ordinary 16-bit Modbus registers, verify both registers and their starting location. Selecting a 32-bit format does not make the second register valid or move the starting address automatically.

Word order and byte order are separate checks

Modbus sends the high byte of a 16-bit register before its low byte. That rule does not establish how every manufacturer stores an application’s 32-bit value across two registers. Follow the server’s register map for that arrangement.

Consider an illustrative floating-point value of 12.5, whose IEEE 754 pattern is 0x41480000:

Server’s register arrangement	Register N	Register N+1
High word first	`0x4148`	`0x0000`
Low word first	`0x0000`	`0x4148`

The HMI must assemble those words into the intended pattern before interpreting it as a float.

To distinguish the possible rearrangements, label four distinct bytes A B C D:

Operation	Resulting byte sequence
No rearrangement	A B C D
Exchange the two 16-bit words	C D A B
Exchange bytes within each word	B A D C
Perform both operations	D C B A

“Swap” is too vague for a maintenance note. Record which operation was required and where it was applied.

Where Weintek handles the conversion

The TCP/IP guide documents System Parameter Settings → Device Properties → Conversion for supported address types. It also identifies 5x as the holding-register double-word-swap form. 5x is a driver convention, not an additional standard Modbus register area.

The RTU/RTU-over-TCP guide specifically instructs users to select 3x_Double or 4x_Double when using its ABCD → CDAB conversion. Apply the instructions for the driver actually installed in the project.

Before adding a conversion, inspect existing macros and data transfers. Two word swaps can cancel each other. A device-level change may also affect objects that were already correct.

Find the Right PLC for Your System

Explore new original PLC CPUs, I/O modules, power supplies, and communication units for maintenance and automation projects.

Apply scaling after decoding is correct

Suppose a device documents temperature as a signed integer in tenths of a degree. A raw value of 253 then represents 25.3 °C.

That is different from a device transmitting the floating-point value 25.3.

Trace the value through the project:

Server registers → decoded number → engineering conversion → displayed value

Identify what each stage does. If the PLC already converts a measurement into engineering units and the HMI divides it again, the screen will show the wrong magnitude despite correct addressing and word order.

Decimal formatting, linear scaling and unit conversion should each have a documented purpose. Avoid adjusting them merely until one reading looks plausible.

Use several comparison points. A zero reading cannot reveal a factor-of-ten error, and one mid-range value may conceal an incorrect offset.

Upgrade or Replace Your HMI

Find compatible HMI panels for discontinued models, machine upgrades, and operator interface replacement.

Frequently Asked Questions

Should I subtract one from every Modbus address?

No. First determine whether the device manual gives a conventional reference, a one-based index or a zero-based protocol address. Then check how the selected driver translates its entry. Subtracting one when the driver already performs the conversion introduces a new offset error.

Why does a 16-bit value work while a 32-bit value is wrong?

The second value introduces additional requirements: the next register must belong to the same value, both words must be assembled correctly, and the resulting pattern must use the intended numeric type. Compare the two raw words before changing scaling.

Does 5x mean a different Modbus register bank?

No. Weintek documents it as a holding-register access form with word swapping. It still uses holding-register read function 03. Selecting it changes interpretation; it does not locate an unrelated register bank.

Why does the HMI read correctly but fail to write?

Check the server’s supported write operations as well as the address and permissions. Weintek’s documented TCP driver uses function 16 for 4x writes and function 06 for 6x single-register writes. A device’s write requirements may differ from its read requirements.

Can a value that looks reasonable still be wrong?

Yes. An adjacent register may contain a similar measurement, and an incorrect conversion may produce a believable result at one operating point. Compare several known values and confirm the requested address, raw words and engineering units. A plausible number is not a substitute for a verified mapping.

Power your projects with brand-new, original Omron, Weintek, Proface HMI – in stock, ready now!

Verify the correction beyond one object

Once the raw words and interpreted value agree, change only the identified setting in a controlled project copy.

Check a small set of representative values: positive, negative where applicable, fractional and near the expected operating limits. For a device-level conversion change, revisit other objects using the same driver.

Then check any dependent alarms, trends, recipes and macros. A corrected numeric display does not necessarily correct another function that reads the same registers independently.

Writing needs its own validation. A correct read does not prove that the write address, encoding or accepted function code is correct. Test command values only through the approved machine procedure, with a backup and recovery plan.

If a replacement HMI is being considered, provide Kwoco with the current panel model, required interfaces and project requirements. Incorrect numeric readings alone are not evidence that the panel hardware has failed.

Contact Us

Just fill out your name, email address, and a brief description of your inquiry in this form. We will contact you within 24 hours.

Product Category

Hot Sale Products

Omron CPU Unit CJ2M-CPU32

Omron PLC CJ1W-PA202 Supplier in China

Mitsubishi MR-JE Series 400w Servo Drive MR-JE-40A

Need a Fast Match?

Share your model or spec and our team will help you find the right fit-fast.

Weintek Modbus Values Are Wrong: Register Offsets, Data Types and Word Order

Table of Contents

Read the raw registers before changing the display