AJapps

SCADA Value Converter — Modbus, IEC 104 & IEC 61850

The conversions SCADA engineers do by hand when a value looks wrong: two Modbus registers to a float or 32-bit integer in all four byte orders, Modbus register notation to the protocol address, IEC 60870-5-104 normalised and short-float values, the CP56Time2a time tag, and the quality bits of IEC 104 and IEC 61850.

Modbus: two registers → value

All four byte orders

OrderBytesfloat32int32uint32
ABCD41 48 00 0012.510952376321095237632
CDAB00 00 41 482.341850e-411671216712
BADC48 41 00 0019763212122193921212219392
DCBA00 00 48 412.591982e-411849718497

Register 1 alone: uint16 16712, int16 16712, hex 4148, BCD 4148.

The right order is the one that matches the value on the device's display. Values like 1e-41 or 1e+38 mean the order is wrong.

Modbus: float → registers to write

Registers to write

ABCD16712 , 0 (0x4148 0x0000)
CDAB0 , 16712 (0x0000 0x4148)
BADC18497 , 0 (0x4841 0x0000)
DCBA0 , 18497 (0x0000 0x4841)

Modbus: register notation

What it means on the wire

TableHolding registers (read/write words)
Protocol address (0-based)0 (0x0000)
Notation40001 / 400001
Read with03 Read Holding Registers
Write with06 Write Single Register / 16 Write Multiple Registers

Many manuals list 1-based register numbers while the protocol sends the 0-based address. If every value is shifted by one register, this is the reason.

IEC 104: normalised value (M_ME_NA_1)

Normalised value

Raw → NVA0.880004883 (× full scale = 132.000732)
Engineering → NVA0.880004883, raw 28836 (0x70A4)
Resolution0.00457763672 per bit
Short float 132 on the wire (M_ME_NC_1)00 00 04 43

NVA covers −1 to +1 − 2⁻¹⁵. Both ends must use the same full scale; a value that saturates at ±1 means the full scale is too small.

IEC 104: CP56Time2a time tag

Decoded time

Date and time2026-11-13 14:05:37.250 (Fri)
Invalid (IV) / summer time (SU)valid / standard

Byte order: milliseconds (2 bytes, low first), minutes + IV, hours + SU, day of month + day of week, month, year (00–99).

IEC 104 quality descriptor

Flags set: IV

StateDPI = 2 (ON)
  • BL 0Blocked: the value is blocked for transmission and frozen at its last value.
  • SB 0Substituted: the value was set by an operator or an automatic source, not measured.
  • NT 0Not topical: the value was not updated successfully in the last refresh period.
  • IV 1Invalid: the value is incorrect (acquisition failure); do not use it.

IEC 61850 quality

Validity: invalid

Flags setnone

Validity good = 00, invalid = 01, reserved = 10, questionable = 11. “test” means the value comes from a device in test mode; “source = substituted” means it was not measured.

Tool guide · know before you use

What this tool is, how it works and how far to trust it

A set of converters for the values SCADA engineers decode by hand: Modbus register pairs and notation, IEC 104 normalised, short-float and time values, and IEC 104 / IEC 61850 quality.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Show two Modbus registers as float32, int32 and uint32 in all four byte orders, and one register as uint16, int16, hex and BCD.
  • Give the two registers to write for a float, in each order.
  • Translate Modbus notation (40001, 400001, 30010) into the table, the 0-based protocol address and the function codes.
  • Convert IEC 104 normalised values to and from raw and engineering values, show the short-float bytes on the wire, and decode or check a CP56Time2a time tag.
  • Decode IEC 104 QDS, SIQ and DIQ bytes and IEC 61850 quality flag by flag.

Why you need it

  • A value that is 'wrong' between a device and SCADA is usually an encoding mismatch, not a fault: word order, a one-register offset, a full-scale mismatch or an unread quality flag.
  • Seeing every interpretation side by side shows the right setting in seconds instead of trial and error on a live system.

Understand this first

  • Modbus registers are 16 bits; 32-bit values span two registers and the standard does not fix their order, so devices differ.
  • Manuals often number registers from 1 (40001) while the protocol sends the address from 0.
  • An IEC 104 normalised value is a fraction of a full scale agreed by both ends; the full scale is not sent.
  • A quality flag such as IV (invalid) or NT (not topical) means the value must not be used as a measurement, whatever its number.

What you need before you start

  • The raw register values or bytes from the device, the gateway diagnostics or a capture, and ideally the true value shown on the device's display.
  • The device's register map or IEC 104 interoperability list.
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Pick the section for your problem: Modbus registers, register notation, IEC 104 values, CP56Time2a or quality.
  • Enter the raw values exactly as the device, gateway diagnostics or capture shows them (decimal or hex).
  • Compare each interpretation with the true value on the device display and choose the one that matches.
  • Apply that setting (byte order, address offset, full scale) in the SCADA or gateway configuration and confirm with a known value.

What you get

  • All interpretations of the registers, the registers to write, the protocol address and function codes, NVA and resolution, the decoded time with its flags, and the meaning of each quality bit.

How to read the results

  • The correct byte order is the one whose value matches the device display; huge or tiny values (1e38, 1e-41) mean the order is wrong.
  • Every value shifted by one register means a 0-based / 1-based addressing mismatch.
  • An NVA stuck at ±1 means the configured full scale is too small; poor resolution means it is too large.
  • A CP56Time2a with IV set comes from a clock that is not synchronised: the event order may still be right, the absolute time is not.

Technical basis

  • IEEE 754 single precision; byte orders ABCD (big-endian, Modbus standard), CDAB (word swap), BADC (byte swap), DCBA (little-endian).
  • Modbus Application Protocol V1.1b3: function codes 01–06, 15, 16 and the register tables.
  • IEC 60870-5-101/104: NVA = raw / 32768 (−1 … +1 − 2⁻¹⁵); short float as IEEE 754 sent least significant byte first; CP56Time2a field layout; QDS, SIQ and DIQ bit positions.
  • IEC 61850-7-3 quality: validity (good 00, invalid 01, reserved 10, questionable 11) and detail flags in bits 2–12.

Limits: when not to rely on it

  • It interprets numbers you enter; it does not read from a device.
  • Vendor-specific encodings (scaled integers with private factors, 64-bit values, strings) are not covered.

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 424d8a2 · 2026-11-12