Modbus - There are (were) a Max of 9999 points of each data type
Modbus Addressing Limits: 9,999 Points and 5-Digit vs 6-Digit Addressing
A common source of confusion in Modbus projects is point numbering and “address ranges.” Historically, many Modbus references assumed a maximum of 9,999 points per data type (for example, coils, discrete inputs, input registers, and holding registers). In practice, many modern devices and client tools exceed this historical convention, but older clients may still enforce it.
This article explains (1) why the original “9,999” limit existed, (2) what the protocol actually supports using a 16-bit address field, and (3) why people refer to 5-digit versus 6-digit addressing in Modbus documentation.
Why 9,999 Points Was Considered a Limit
When Modbus was introduced, many implementations treated 9,999 items of each memory type as “enough.” As Modbus adoption expanded, vendors often ignored this guideline and produced clients that could read more, along with devices that could serve larger register maps.
The practical impact is that older Modbus clients may not poll beyond 9,999 items in a given range, even though many modern tools and devices can.
The Practical Protocol Limit: 16-bit Addressing
Regardless of naming conventions, Modbus messages use a 16-bit field to identify the point (address) being read or written. A 16-bit value can represent addresses up to 65,535. For that reason, many modern implementations allow access to any point number within this 16-bit range.
Where confusion starts is how people write those addresses. You may see references such as 40001, 40002, and so on, which are often used as “human-friendly” labels for holding registers. This can lead to inconsistencies between documentation and what a specific client tool expects.
5-Digit vs 6-Digit Addressing
Consider the holding register labels people commonly write as 40001 for the 1st register and 40002 for the 2nd. If you keep counting, you eventually reach 49999. The naming question becomes: what comes next?
Some conventions insert an additional zero to avoid ambiguity and to better align with larger maps. In those conventions, instead of writing 40001, you may see 400001. Likewise, 40002 may be written as 400002 (note: some documents contain typos here, so it is worth validating with the device map or client software).
Under that naming scheme, you may see sequences like:
400001, 400002 … 409999, 410000, 410001 …
This is commonly referred to as six-digit addressing.
The key takeaway is that these “4xxxx / 3xxxx / 1xxxx / 0xxxx” formats are often documentation conventions, not the raw Modbus address used in the protocol frame. Different software tools interpret these conventions differently, so always confirm whether the client expects: zero-based addressing (0–65535) or a one-based “4xxxx” style label.