Complete Guide to Delta DVP PLC Modbus RTU Register Address Mapping

1. Overview

Delta DVP-series PLCs (DVP-ES2/EX2/SS2/SA2/SX2/SE, EH3, etc.) have a built-in COM2 RS-485 port that natively supports standard Modbus ASCII/RTU. They can act either as a Master, actively reading and writing slaves such as VFDs, temperature controllers and meters, or as a Slave, passively responding to read/write requests from an HMI, SCADA or another PLC. This guide is written strictly from Delta's official DVP-PLC Application Manual (Programming/Communication), the DVP Series PLC Communication Protocol and the DVP-ES2 Operation Manual; every device address, instruction operand and special relay/register follows the official manuals.

The two Modbus operating modes of a DVP PLC:

• Modbus Master: actively initiate communication with the three dedicated instructions MODRD (API 100, read), MODWR (API 101, write) and MODRW (API 150, universal read/write).
• Modbus Slave: only the communication format and station number need to be configured; the PLC answers automatically according to the built-in protocol and no communication program is required.

A key point that must be clarified first: on the Modbus wire, the internal DVP devices (X/Y/M/S/T/C/D) use fixed hexadecimal communication addresses (for example X0=0400H, Y0=0500H, M0=0800H, D0=1000H). The scheme circulated in some online tutorials—putting a "device-type code in the high byte (H1/H3/H4/H10) and the number in the low word" to build 24-bit addresses such as H100064 or H100100—does not exist in Delta's official manuals. The address operand of MODRW/MODRD is 16-bit, so H100064 is itself an illegal value. Sections 3 and 4 explain the official addressing scheme thoroughly.

2. Modbus Function Codes and Accessible Devices

The function codes supported by a DVP slave and the internal devices they access are listed below (source: Delta DVP Series PLC Communication Protocol):

Function code (dec/hex)	Name	Accessible DVP devices	Data type	Read/Write
01 (H01)	Read Coil Status	S, Y, M, T (contact), C (contact)	bit	Read
02 (H02)	Read Input Status (discrete inputs)	S, X, Y, M, T, C	bit	Read
03 (H03)	Read Holding Registers	T (current value), C (current value), D	word	Read
05 (H05)	Force Single Coil	S, Y, M, T, C	bit	Write
06 (H06)	Preset Single Register	T, C, D	word	Write
15 (H0F)	Force Multiple Coils	S, Y, M, T, C	bit	Write
16 (H10)	Preset Multiple Registers	T, C, D	word	Write
17 (H11)	Report Slave ID	— (returns slave status)	—	Read

Two important differences from the "standard Modicon address model":

• The DVP does not use function code 04 (read input registers). The input relays X are read with function code 02 (on Delta, 02 can access all bit devices S/X/Y/M/T/C).
• Bit devices (S/Y/M/T/C contacts) use function codes 01/02/05/15; word devices (current values of T/C/D) use 03/06/16. Timers T and counters C occupy both a "contact (bit)" address area and a "current value (word)" address area.

3. DVP as Slave: Internal Device Communication Address Map (Core)

When a DVP acts as a Modbus slave, an external master (HMI, SCADA, another PLC, Modbus Poll, etc.) must use the hexadecimal communication addresses (0-based PDU addresses) in the table below to access its internal devices.

3.1 Device communication address overview (official table)

Device	Type	Numbering	Communication address (hex)	Device range	Function codes
S (step relays)	bit	decimal	0000H–03FFH	S0–S1023 (one block per 256 points)	01/02/05/0F
X (input relays)	bit	octal	0400H–04FFH	X0–X377 (octal, 256 points)	02
Y (output relays)	bit	octal	0500H–05FFH	Y0–Y377 (octal, 256 points)	01/02/05/0F
T (timers)	bit/word	decimal	0600H–06FFH	T0–T255 (contacts 01/02, current values 03)	01/02/03/05/06/0F/10
M (auxiliary relays)	bit	decimal	0800H–0DFFH; B000H–B9FFH	M0–M1535; M1536–M4095	01/02/05/0F
C (counters)	bit/word	decimal	0E00H–0EFFH	C0–C199 (16-bit); C200–C255 (32-bit)	01/02/03/05/06/0F/10
D (data registers)	word	decimal	1000H–1FFFH; 9000H–A70FH	D0–D4095; D4096–D9999	03/06/10

Note: ranges such as 0700H and 0F00H–0FFFH are reserved and cannot be accessed. The actual number of devices differs by model (ES2/SS2/SA2/EH3); refer to the corresponding model manual.

3.2 Bit-device address conversion

• X (octal numbering): address = 0400H + the decimal ordinal of the octal number. X0=0400H, X7=0407H, X10=0408H (note that X8 and X9 are skipped), X377=04FFH.
• Y (octal numbering): address = 0500H + ordinal. The official communication example states Y0 = H0500; Y17 (octal, i.e. the 15th point in decimal) = 050FH.
• M (decimal numbering): for M0–M1535 address = 0800H + n, e.g. M0=0800H, M100=0864H; M1536–M4095 are mapped to B000H–B9FFH.
• S (decimal numbering): address = 0000H + n, e.g. S0=0000H, S100=0064H.

Device	Number	Communication address (hex)	Function code
Input	X0 / X7 / X10	0400H / 0407H / 0408H	02
Output	Y0 / Y17 (octal)	0500H / 050FH	01/02/05/0F
Auxiliary relay	M0 / M100 / M1535	0800H / 0864H / 0DFFH	01/02/05/0F
Step relay	S0 / S100	0000H / 0064H	01/02/05/0F

3.3 Word-device (T/C/D) address conversion

• Timer current value Tn: 0600H + n, e.g. T0=0600H (the official write-single-register example is exactly 06H 00H).
• Counter current value Cn: 0E00H + n, e.g. C0=0E00H, C232=0EE8H (official example 0EH E8H). C0–C199 are 16-bit counters; C200–C255 are 32-bit high-speed counters (occupying double-word length).
• Data register Dn (n=0–4095): 1000H + n, e.g. D0=1000H, D10=100AH, D100=1064H, D1000=13E8H (all are official-manual examples); D4096–D9999 are remapped from 9000H, i.e. address = 9000H + (n − 4096).

Device	Number	Communication address (hex)	Official frame example (FC06 write single register)
Timer	T0	0600H	01 06 06 00 12 34 …
Counter	C0 / C232	0E00H / 0EE8H	01 06 0E 00 … / 01 06 0E E8 …
Data register	D10	100AH	01 06 10 0A 12 34 …
Data register	D1000	13E8H	01 06 13 E8 12 34 …

3.4 Address correspondence for third-party master software (Modbus Poll / SCADA / HMI)

What is transmitted in the Modbus frame is the 0-based PDU address above (the hex communication address). However, many host software packages and HMIs ask for a 1-based "reference number" (4xxxx / 0xxxx / 1xxxx). The conversion is as follows:

• Holding-register reference = 40001 + the decimal value of the hex address. For example D0's address 1000H = decimal 4096, so the reference = 40001 + 4096 = 44097; D100's address 1064H = 4196, reference = 44197.
• Coil reference = 1 + address value; discrete-input reference = 10001 + address value. For example M0 (0800H=2048) coil reference = 2049; X0 (0400H=1024) discrete-input reference = 11025.
• If the software supports a "0-based / PLC address" mode, entering the decimal value of the hex address directly (e.g. 4096 for D0) is the least error-prone.

Device	Communication address (hex)	Decimal offset	1-based reference	Function-code area
D0	1000H	4096	44097	Holding registers 4xxxx
D100	1064H	4196	44197	Holding registers 4xxxx
M0	0800H	2048	02049	Coils 0xxxx
X0	0400H	1024	11025	Discrete inputs 1xxxx
Y0	0500H	1280	01281	Coils 0xxxx

The octal issue again: X and Y device numbers are octal (there is no X8/X9), but the communication addresses are consecutive—X7 (0407H) is immediately followed by X10 (0408H); 0408H does not correspond to an "X8".

4. DVP as Master: MODRD / MODWR / MODRW Instructions

4.1 The three communication instructions at a glance

Instruction	API no.	Purpose	Supported function codes
MODRD	API 100	Read data from a slave	H02 (read bits), H03 (read words), etc.
MODWR	API 101	Write data to a slave	H05/H06/H0F/H10
MODRW	API 150	Universal read/write (most complete, recommended)	H01–H06, H0F, H10, H17

4.2 MODRW (API 150) operand definition (official)

Instruction format: MODRW S1 S2 S3 S n

Operand	Meaning	Allowed values / notes
S1	Slave communication address (node number)	K0–K254; K0 is broadcast (cannot be K0 for the read operations H02/H03/H04/H17)
S2	Function code	H01 read multiple bits / H02 read discrete bits / H03 read multiple words / H04 read input words / H05 write single bit / H06 write single word / H0F write multiple bits / H10 write multiple words / H17 read+write multiple words
S3	Start device address to read/write	The remote device's hex communication address, e.g. H0500 (Y0), H1064 (D100), H2100 (VFD status)
S	Data register	Local starting D where read-back / to-be-written data is stored (e.g. D0, D50); with H17, S is the read-data start and S+1 the write-data start
n	Data length	H01/H02/H0F in bits, H03/H04/H10 in words; with H05, n=0 means ON and n=1 means OFF; with H17, n is the word count read and n+1 the word count written

Pay special attention to operand positions: S2 is always the function code and S3 is the device address. Some online tutorials put the "device-type code" into the second operand (S2) of MODRD, which is wrong.

4.3 Official program examples (ready to use)

Example 1: read Y0–Y17 (16 points, bits) from another DVP (node 1) — source: MODRW Program Example 1 in the Delta DVP-ES2 Operation Manual.

Instruction	S1 node	S2 function code	S3 address	S data	n length
MODRW	K1	K2 (H02 read bits)	H0500 (Y0)	D0	K16 (16 bit)

ASCII request frame: 01 02 0500 0010; RTU request frame: 01 02 05 00 00 10 79 0A. The manual explicitly marks Data address Y0 = H0500.

Example 2: read D100 (1 word) from another DVP (node 1)

Instruction	S1 node	S2 function code	S3 address	S data	n length
MODRW	K1	K3 (H03 read words)	H1064 (D100 = 1000H + 100)	D0	K1 (1 word)

To read M100, change S3 to H0864 (M100 = 0800H + 100) and use function code H01.

Example 3: read six words of status/frequency etc. from a Delta VFD (node 1) — source: the official MODRW example in the Delta DVP-PLC Application Manual.

Instruction	S1 node	S2 function code	S3 address	S data	n length
MODRW	K1	K3 (H03)	H2100	D0	K6 (6 words)

ASCII request frame: 01 03 2100 0006, reading the six registers 2100H–2105H.

Example 4: write one run-command word to 2000H of a Delta VFD (node 1)

Instruction	S1 node	S2 function code	S3 address	S data	n length
MODRW	K1	K6 (H06 write single word)	H2000	D50 (data to write)	K1 (1 word)

ASCII request frame: 01 06 2000 [data] (in the official example, with D50=H1770 the frame is 01 06 0100 1770 for the older VFD-S address definition; the command-word address of newer models is 2000H).

Definitive conclusion on addresses like "H100064": S3 is filled directly with the remote device's consecutive hex communication address (use H1064 for D100, not H100100 or H100064). The MODRW address operand is 16-bit, so values over 16 bits or with self-contradictory encoding such as H100064 and H40100 are illegal in Delta instructions. The "high-byte device-type code table (X=H1, Y=H3, M=H4, D=H10)" given in some online sources is not a Delta official definition and must not be used in projects.

4.4 MODRW usage notes (official cautions)

• Each MODRW instruction must be immediately followed by its corresponding "send request" flag (SET M1122). Ports are resolved in the order COM1 → COM3 → COM2 to avoid data misplacement.
• Only one MODRW may execute on the same communication port at a time; wait for the send/receive-complete flag M1127 before issuing the next one (use M1127 as the step condition when polling).
• The driving contacts for the read function codes H01–H04 and H17 must not use rising/falling-edge contacts such as LDP/ANDP/ORP/LDF/ANDF/ORF, otherwise the received data will be wrong; use ordinary LD contacts.
• In ASCII mode, after the received data is stored in ASCII from the starting D, the PLC automatically converts it to hex in the special registers D1296–D1311 (M1131 is ON during conversion); data to be sent is placed in D1256–D1295. In RTU mode data is stored directly in hex.

5. Communication Parameters, Special Registers and Flags (COM2 RS-485)

5.1 Hardware wiring

1. COM2 of the DVP is an RS-485 port marked D+ (SG+) and D- (SG-): connect D+ to the bus A wire and D- to the bus B wire; daisy-chain multiple devices.
2. Install a 120Ω termination resistor at each of the two bus ends; use shielded twisted-pair cable, ground the shield at one end, and keep it away from power cables.
3. Baud rate, data bits, parity and stop bits must be identical on every master and slave; station numbers must not be duplicated.

5.2 D1120 communication format (official values)

D1120 value	Communication format	Typical use
H86	9600 bps, 7 data bits, even parity, 1 stop bit (9600,7,E,1)	Factory default, Modbus ASCII
H87	9600 bps, 8 data bits, even parity, 1 stop bit (9600,8,E,1)	Most common for Modbus RTU

The high nibble of D1120 selects the baud rate (H8=9600, H9=19200, HA=38400, HB=57600, HC=115200) and the low nibble selects data bits/parity/stop bits; after setting it you must SET M1120 to retain the format. Official VFD communication examples uniformly use MOV H87 D1120 + SET M1120.

5.3 D1121 communication station number

• D1121 sets the local station number (as a slave) or the target number; range 1–254, with 0 being the broadcast address.
• For example MOV K1 D1121 means station number 1. The factory-default station number is 1.

5.4 RTU/ASCII selection and send/receive flags (key correction)

Special relay / register	COM2 (RS-485) function
M1143	Protocol selection: OFF = ASCII mode, ON = RTU mode (RTU/ASCII is decided by M1143, not D1130)
M1120	When ON, retains the communication format set in D1120
M1122	Send-request flag; setting it ON triggers one MODRD/MODWR/MODRW transaction
M1127	Data send/receive-complete flag (set ON on completion, reset by the program)
M1140	Receive-data error flag (ON on checksum/format error)
M1141	Illegal communication address / data-return error flag
D1130	Communication error-code register: holds the error code when M1141 is ON (e.g. D1130=2 for "illegal data address" from the remote side). It is not the protocol-mode register
D1129	Communication timeout setting (official example K100 = 100 ms)

Standard initialization (RTU 9600,8,E,1, station 1): executed while M1002 is ON in the first scan after power-up:

LD   M1002
MOV  H87   D1120   // format 9600,8,E,1
SET  M1120          // retain communication format
MOV  K100  D1129   // communication timeout 100 ms
SET  M1143          // select RTU mode (OFF = ASCII)
MOV  K1    D1121   // local station number 1 (as slave)

When communication is needed, SET M1122 sends the request; wait for M1127 to indicate completion, then process the received data and RST M1127.

6. Reading/Writing Delta VFDs (common addresses for VFD-E / MS300 / C2000, etc.)

Delta VFDs generally use the communication addresses below (the exact units and bit definitions follow that model's Communication Protocol Manual):

Monitoring / control item	Communication address	Function code	Notes
Run/stop command	2000H	06 / 10 (write)	Bit-command word: bit0-1 run/stop/e-stop/JOG, bit2-3 forward/reverse; see the VFD manual for bit definitions
Frequency command	2001H	06 / 10 (write)	Set frequency, often in 0.01 Hz units (e.g. write 5000 for 50.00 Hz)
Run status word	2100H	03 (read)	Run/direction/fault status bits
Output frequency	2101H	03 (read)	Actual output frequency, 0.01 Hz
Output current	2102H	03 (read)	Output current, 0.01 A (the Delta VFD-B official example reads 2102H)
Output voltage / DC-bus voltage	2103H	03 (read)	Definition differs slightly between series

Corresponding MODRW instructions:

• Continuously read six words of status/frequency/current etc.: MODRW K1 K3 H2100 D0 K6
• Write a run command (forward run; place the data word in D50 beforehand according to the model's bit definition): MODRW K1 K6 H2000 D50 K1
• Write a 50.00 Hz frequency command (D51=K5000): MODRW K1 K6 H2001 D51 K1

On the VFD side you must also set the communication station number, baud rate and format to match the PLC, and set the run/frequency source to communication. Addresses and units differ between series (VFD-E, MS300, C2000, MH300); always check that VFD's communication protocol manual before implementation.

7. FAQ and Troubleshooting

7.1 No communication at all

• Wiring: are D+ (SG+)/D- (SG-) reversed, and do A/B match? For multiple stations, are devices daisy-chained without stubs?
• Format: is D1120 H87 (RTU 8E1) or H86 (ASCII 7E1), and do both sides agree? Was M1120 SET?
• Protocol mode: RTU requires SET M1143 and ASCII requires RST M1143; both sides must agree (one of the most common causes of "no connection").
• Station number: does D1121 match the target slave, and are bus node numbers unique?
• Termination: are 120Ω resistors fitted at both ends? When idle, the differential bus voltage should measure several hundred mV.

7.2 Communication works but data cannot be read / illegal address reported

• Check the error flags: M1141 ON with a D1130 code (e.g. =2) means the S3 device address is illegal; verify against the hex table in Section 3.
• Function code vs device type: read X with 02, read D with 03, write Y/M with 05/0F and write D with 06/10—do not mix them.
• Octal check: X/Y numbers are octal, X10 immediately follows X7; addresses are converted by consecutive ordinal.
• Do not use H100064-type addresses: for D100 use H1064, for M100 use H0864.
• Timing: after SET M1122 do you wait for M1127? Are multiple MODRW instructions being issued concurrently on the same port?

7.3 Wrong or garbled data

• Data width: C200–C255 are 32-bit counters occupying two registers/double words; read them as double words.
• Byte/word order: for 32-bit data confirm the high/low byte and high/low word order matches the remote device.
• Scaling: restore engineering units for frequency 0.01 Hz, current 0.01 A etc. according to the manual.
• RTU/ASCII mix-up: inconsistent modes cause frame corruption or garbled text; confirm the M1143 state.

7.4 Intermittent communication failures

• Use shielded twisted pair with the shield grounded at one end; keep communication cables away from VFD output cables and other power wiring.
• Control bus length and node count (reduce baud rate if necessary) and add termination at both ends.
• Set the D1129 timeout and retries sensibly; use M1127/M1140/M1141 for completion and error handling to avoid piling up instructions.

8. Differences from Other PLC Brands

Item	Delta DVP	Mitsubishi FX3U	Siemens S7-200 SMART
X/Y addressing	Octal	Octal	Decimal
Internal device address	Fixed hex mapping (X0400/Y0500/M0800/D1000)	Fixed FX3U-MB mapping + assignable	Holding-register area configured via HoldStart / MaxHold
Master instruction	MODRD/MODWR/MODRW (API 100/101/150)	ADPRW (FNC276), one instruction reading/writing by function code	MBUS_CTRL / MBUS_MSG library instructions
RTU/ASCII selection	M1143 (OFF=ASCII, ON=RTU)	Set in communication parameters	Mode parameter of the library instruction (RTU only)
Communication port	Built-in COM2 (RS-485)	Requires external FX3U-485ADP-MB	On-board RS-485 port
Main configuration registers	D1120 (format) / D1121 (node) / M1143 (mode)	Special registers such as D8120/D8121	Library-instruction parameters (baud/parity/timeout)

9. Summary

Delta DVP Modbus communication can be summarized as follows:

• Slave device addresses (hex): S=0000H, X=0400H, Y=0500H, T=0600H, M=0800H, C=0E00H, D=1000H; X/Y use octal numbers but consecutive addresses, and D0–D4095 map to 1000H–1FFFH.
• Function codes: bit devices use 01/02/05/0F (X uses 02); word devices T/C/D use 03/06/10; Delta does not use function code 04.
• Master instruction: MODRW S1 (node) S2 (function code) S3 (hex device address) S (data D) n (length); S2 is the function code and S3 the address, filled directly in hex (D100=H1064).
• Communication configuration: D1120=H87 (RTU 9600,8,E,1) / H86 (ASCII 7E1), SET M1120, M1143 selects RTU/ASCII, D1121 sets the node, SET M1122 sends, M1127 completes, M1140/M1141/D1130 diagnose errors.
• Be sure to avoid: the circulated 24-bit addresses such as H100064 built from "H1/H4/H10 + number", putting a device code in S2, and mistaking D1130 for the protocol-mode register.

Before implementation, we recommend connecting a master tool such as Modbus Poll to the DVP slave and verifying each area against the hex table in this guide (to read D0 use address 4096 / reference 44097). Once address, function code and data format are all confirmed, write the MODRW master program.

10. Related Links

• Modbus RTU communication basics tutorial
• Delta DVP PLC Modbus communication configuration examples
• Modbus control guide for Delta VFDs (VFD-E/MS300/C2000)
• Mitsubishi FX3U / Siemens S7-200 SMART Modbus register mapping guides
• RS-485 bus wiring and termination-resistor specification