Overview Modbus Master



This function block configures the Modbus master function. The configuration is divided into slaves and registers. A slave here means a Modbus ID; several slaves can also use the same interface. If several interfaces are configured, they are read out one after the other.

The function block is limited to 128 register rows; if more registers are needed, they can be split across several function blocks. Each register row occupies as many outputs as are set under "Block read count".

Important: Variables must always be connected to the function blocks. When the variables are created, this happens automatically.

Integrated device templates and troubleshooting tips are located at the end of this page; see Templates, Troubleshooting RTU (RS485) and Troubleshooting Modbus TCP.

Table of contents


Parameters
Disable With this parameter the block is disabled and the registers are no longer queried. This can be used for diagnostics to temporarily hide certain registers.
Modbus ID
 Modbus ID (slave address) of the device, range 0 to 255.
Telegram interval Minimal telegram interval. According to the Modbus specification the minimal telegram interval is 3.5 characters and at least 1.75 ms; this is too short for some devices. This parameter is added to the standard interval.
Timeout
 Time to wait for a response from the slave before an error is detected.
Protocol
 Selection of the protocol

  • Modbus RTU (RS485)
  • Modbus TCP
Interface
 When the protocol Modbus RTU is selected, the interface parameters are set here. Important: Via USB converters only non-critical components may be used.

Important: If several Modbus slaves are operated on one interface, all function blocks must have the same interface parameters.
IP address, port
 When the protocol Modbus TCP is selected, the IP address and the port are set here; the standard port for Modbus is 502.
Register addresses Here it can be set whether the register addresses start at 0 or 1. With "start at 1", 1 is subtracted from every register address entered before the telegram is sent. This allows the addresses to be entered exactly as they are listed in the description of the device.
Registers Opens the list of registers. The same list is also opened with a right click on the block. The parameters of the list are described below.
Combine connections Only with TCP. With this option devices with the same IP address and port number are read out via a shared connection. By default all function blocks are read out via separate connections. Combining connections can be necessary with devices that only allow a limited number of simultaneous connections.

Register parameters
The list of registers is opened with the parameter "Registers" or with a right click on the block. In the toolbar of the list, rows can be added, deleted, moved and duplicated, "Template" loads the configuration of an already integrated device and "Ex-Import" exports the list to a file or imports it (see below). If "Register hex" is selected, the register addresses are displayed and entered in hexadecimal.
Active
 If this option is not selected, the register is neither queried nor written.
Name
 Designation of the register. The name is used when the variables are created automatically.
Register address
 Register address according to the description of the slave. Whether the count starts at 0 or at 1 is set with the parameter "Register addresses".
Length
 Length of the variable in bits. A Modbus register is always 16 bits (2 bytes). The length therefore defines how many consecutive registers are combined into one value:
  • 16 bit: 1 register (2 bytes)
  • 32 bit: 2 registers (4 bytes)
  • 64 bit: 4 registers (8 bytes)
With register data type "float" at least 32 bits are required, 16 bit is set to 32 bit automatically. 32 bit corresponds to a floating point number with single precision (IEEE 754), 64 bit to one with double precision.

For bit commands (coils, discrete inputs) this value is ignored. When writing registers, only 16 and 32 bits are transmitted.
Block read count
 Number of variables to be read with one query (1 to 32). The variables must follow one another without gaps in the slave and all have the same length; each variable occupies its own output of the block. In this way "block read count" times "length" registers are read with one telegram.

When writing registers the number must be 1. For bit commands (coils, discrete inputs) this is the number of coils; with function code 15 the whole block is written with one telegram.
Register data type
 Selection between integer and float according to the description of the slave.
Sign
 Only with data type integer: selection between unsigned and signed. With 64 bits the value is always read as signed.
Variable data type
 EIS type of the connected variable. By default EIS 9 (floating point 4 bytes). See common parameters for a description of the EIS types.
Byte order
  • Big Endian (ABCD): Default setting
  • Mid-Little Endian (CDAB): When reading two registers the hi/lo word is swapped.
  • Little Endian (DCBA): All bytes are swapped.
Function code
 Modbus function code according to the description of the slave: 01 read coils, 02 read discrete input, 03 read holding register, 04 read input register, 05 write single coil, 06 write single register, 15 write multiple coils, 16 write multiple register.
Update variable on
  • Change: Default setting. The connected variable is only updated when the value read has changed.
  • Always: The variable is updated after every successful query, even if the value has not changed. This allows the communication to be monitored: if the update stops, the slave no longer responds. This is monitored with the function block KNX monitoring.
Applies to read commands only.
Write on
 For write commands only:
  • Change: Variable is written on change.
  • On start + change: Variable is written once at startup of the controller and afterwards on every change.
  • Cyclic: Variable is written cyclically. Time from parameter interval.
Factor
 Scaling factor between register and connected variable. When reading the register value is multiplied by the factor, when writing the variable value is divided by the factor. This allows the same factor to be used in both directions; for example 0.001 converts W to kW when reading and kW back to W when writing. Default value: 1.
Offset
 When reading, the offset is added after the multiplication with the factor, for example to correct a temperature or meter value. Note: Unlike the factor, the offset does not act symmetrically in both directions, it is added when writing as well. For write registers the offset should therefore remain 0.
Interval
 Interval at which the register is read out. For write commands only if "write on" is set to cyclic. With the value 0 the register is queried as fast as the interface allows.

CSV Import / Export

Via the Ex-Import button in the toolbar of the register list all configuration data can be exported and imported again. The format is tab-separated (TSV), UTF-8 encoded. Lines beginning with # are column headers and are ignored on import; the exported header line is written in German. The column names below are used for explanation only.

File structure:

# Protocol<TAB>IP-Address<TAB>Port<TAB>Node-ID<TAB>Register-Offset<TAB>Serial-Interface<TAB>Timeout(ms)<TAB>Telegram-Wait-Time(ms)<TAB>TCP-combine
{9 connection values}
# Active<TAB>Name<TAB>Register-Address<TAB>Length<TAB>Block-Count<TAB>Register-Data-Type<TAB>Sign<TAB>Variable-Data-Type<TAB>Byte-Order<TAB>Function-Code<TAB>Variable-Update<TAB>Write-On<TAB>Factor<TAB>Offset<TAB>Interval
{15 fields per register line}
...

Connection parameters (line 2, 9 fields)
Protocol 0 = Modbus RTU (RS485)   1 = Modbus TCP
IP-Address IP address of the slave (TCP only), e. g. 192.168.1.100. Leave empty for RTU.
Port TCP port (TCP only), default 502. Leave empty for RTU.
Node-ID Modbus slave ID, value range 0–255.
Register-Offset 0 = register address starts at 0   1 = register address starts at 1
Serial-Interface Interface parameter string (RTU only), e. g. COM1,9600,8,N,1. Leave empty for TCP.
Timeout(ms) Wait time for response in milliseconds, e. g. 1000.
Telegram-Wait-Time(ms) Additional pause between telegrams in milliseconds, default 0.
TCP-combine 0 = separate connections   1 = combine connections with the same IP

Register parameters (from line 4, 15 fields per line)
Active 0 = register disabled   1 = register active
Name Designation of the register. No tab character allowed.
Register-Address Modbus register address, value range 0–65535.
Length Length of the variable: 1 = 16 bit (1 register)   2 = 32 bit (2 registers)   3 = 64 bit (4 registers)
Block-Count Number of variables read with one query (1–32). For write commands the value must be 1.
Register-Data-Type 0 = Integer   1 = Float
Sign 0 = Unsigned   1 = Signed (only with data type integer)
Variable-Data-Type Index of the variable type:
0 EIS 0: Constant
1 EIS 1: Switch bit (bit)
2 EIS 2: Dimming (4 bit)
3 EIS 3: Time (3 bytes)
4 EIS 4: Date (3 bytes)
5 EIS 5: Floating point (2 bytes)
6 EIS 6: Relative value 0–100% (1 byte)
7 EIS 7: Drive control (bit)
8 EIS 8: Forced control/priority (2 bit)
9 EIS 9: Floating point (4 bytes) – most common use
10 EIS 10: Counter value 16 bit (2 bytes)
11 EIS 11: Counter value 32 bit (4 bytes)
12 EIS 12: Access control (4 bytes)
13 EIS 13: ASCII character (1 byte)
14 EIS 14: Counter value (1 byte)
15 EIS 15: Character string (14/255 bytes)
16 EIS 16: Counter value (8 bytes)
17 EIS 17: Floating point (8 bytes)
Byte-Order 0 = Big Endian (ABCD) – default
1 = Mid-Little Endian (CDAB)
2 = Little Endian (DCBA)
Function-Code Real Modbus function code (not the index):
1 = Read Coils
2 = Read Discrete Input
3 = Read Holding Register
4 = Read Input Register
5 = Write Single Coil
6 = Write Single Register
15 = Write Multiple Coils
16 = Write Multiple Registers
Variable-Update 0 = only on change   1 = always (even without value change)
Write-On 0 = change   1 = start + change   2 = cyclic
Factor Scaling factor (decimal number), default 1. When reading, the register value is multiplied by the factor, when writing it is divided — the same value can therefore be used in both directions. Example: 0.001 to convert Wh to kWh when reading (and vice versa when writing).
Offset Value added to the register value (decimal number), default 0.
Interval Query interval in milliseconds. For write commands only relevant when Write-On = cyclic.

Example CSV (Fronius inverter, Modbus TCP)

# Protocol	IP-Address	Port	Node-ID	Register-Offset	Serial-Interface	Timeout(ms)	Telegram-Wait-Time(ms)	TCP-combine
1	192.168.1.100	502	1	0		1000	0	0
# Active	Name	Register-Address	Length	Block-Count	Register-Data-Type	Sign	Variable-Data-Type	Byte-Order	Function-Code	Variable-Update	Write-On	Factor	Offset	Interval
1	AC active power [W]	40092	2	1	1	0	9	0	3	0	0	1	0	5000
1	AC Lifetime Energy [kWh]	40102	2	1	1	0	9	0	3	0	0	0.001	0	60000
1	DC voltage [V]	40282	2	1	1	0	9	0	3	0	0	1	0	5000

Tip: Troubleshooting RTU (RS485)
Error messages in the log The runtime log (Diagnostics → Log) mainly shows two messages for communication problems:

RTU READ ERROR – no response, or no complete response, arrived within the configured timeout. This indicates a problem with the bus line (wiring, interface settings or missing termination) or that no device responds under this Modbus ID.

RTU CRC ERROR – a response arrived, but its checksum is invalid. The telegram was corrupted, usually due to interference, a baud rate that is too high for the cable length or multiple devices transmitting at the same time.

RTU ERROR messages mean that the device responded correctly but rejected the request. Common messages and causes are:
  • ILLEGAL FUNCTION – the device does not support the selected function code.
  • ILLEGAL DATA ADDRESS – the register does not exist or the "start at 0/1" setting is incorrect.
  • ILLEGAL DATA VALUE – the written value or the requested number of registers is invalid for the device.
  • SLAVE DEVICE FAILURE – the device could not execute the request because of an internal error.
  • SLAVE DEVICE BUSY – the device is temporarily busy; increase the query or telegram interval.
These messages are normally not caused by the bus wiring. Compare the register address, function code, length, block count and permitted value range with the device documentation.
A and B swapped This is the most common cause of an RTU READ ERROR on newly wired devices. Since manufacturers do not label A and B consistently (A/B, +/-, D+/D-), swap the two wires on one device as a quick test.
Interface settings Baud rate, data bits, parity and stop bits must exactly match the device. Otherwise no response or only an invalid response arrives, resulting in CRC or timeout errors. All slaves on the same interface must use the same interface settings.
Termination resistor Longer RS485 cables need a termination resistor (typically 120 ohms) at both physical ends. Missing termination causes reflections and often appears as sporadic CRC or timeout errors that are not visible with a short test cable.
Duplicate Modbus ID If two devices on the same bus have the same Modbus ID, both transmit simultaneously when queried. Their telegrams overlap and cause a CRC error or unusable response. Check every Modbus ID on the bus for uniqueness.
Troubleshooting procedure
  • Leave only one register active with a long interval and disable all others.
  • Check whether all devices are affected (wiring, termination or interface settings) or only one device (swapped A/B, duplicate ID or defective device).
  • Replace USB-RS485 or similar converters as a test.
  • Increase the telegram interval if the device cannot process requests at the minimum Modbus interval.

Tip: Troubleshooting Modbus TCP
Error messages in the log The runtime log (Diagnostics → Log) provides an initial indication of the cause:
  • TCP ERROR READ 1 ... TIMEOUT – no response arrived before the timeout. Check the IP address, port, network, firewall and whether Modbus TCP is enabled on the device.
  • TCP ERROR READ 2 or TCP ERROR READ 3 ... INCOMPLETE FRAME – the response is incomplete or has an invalid length. Check the connection, device and timeout.
  • TCP ERROR SEND – the request could not be sent on the existing connection. The device or network connection was probably disconnected.
  • TCP ERROR RESPONSE ID, RESPONSE FC or DATA SIZE – the Modbus ID, function code or response length does not match the request. Check the device and register parameters.
  • TCP ERROR TRANSACTION ID – the response does not belong to the expected request. This can be caused by an overloaded or faulty device or unsuitable connection combining.
  • TCP ERROR ... ILLEGAL FUNCTION, ILLEGAL DATA ADDRESS or ILLEGAL DATA VALUE – the device is reachable but rejects the function code, register address, block length or value. This is normally not a network error.
Check address and port Compare the IP address and port with the device configuration; the default port is 502. Check the subnet mask and gateway as required. A successful ping only confirms IP connectivity; Modbus TCP can still be disabled or blocked by a firewall.
Modbus TCP on the device Many devices require Modbus TCP to be enabled explicitly. Some devices also restrict permitted clients or require a specific Modbus ID (Unit ID). With TCP-to-RTU gateways, this ID selects the RTU slave.
Connections and load Some devices permit only one or a few simultaneous TCP connections. When several Modbus Master blocks use the same IP address, enable Combine connections. For sporadic errors, increase the query interval or timeout and reduce the number of registers queried at once.
Troubleshooting procedure
  • Check whether DHCP changed the device address; use a fixed address or DHCP reservation for permanently connected devices.
  • Leave only one known register active and verify its address, function code, Modbus ID and "start at 0/1" setting.
  • Check the network cable, switch port and status indicators; test the device in the same network segment.
  • With multiple blocks for the same IP, first leave only one active and then gradually increase the connection count and query load.
  • If errors occur only under load, reduce the block length and query rate or increase the timeout and telegram interval.

Templates
The following devices are already integrated as templates. Others can be configured manually. The template menu is grouped by device type; the topmost entry Search opens a menu with a search field that finds all templates regardless of their group.

Inverters / batteries:
    Fronius Symo Gen 24 Float (TCP)
    Fronius Symo Gen 24 Float Battery (TCP)
    Fronius Symo Gen 24 Float Smart Meter (TCP)
    Fronius Verto Float (TCP)
    Fronius Verto Float Battery (TCP)
    Huawei (TCP)
    Huawei Battery (TCP)
    Huawei EMMA (TCP)
    Kostal PIKO IQ / PLENTICORE (TCP)
    Solaredge (TCP)
    Solaredge (TCP) + Smartmeter
    Solax (TCP) + Smartmeter
    Solax EMS1000 (TCP)
    Solax EMS1000 Inverter/Battery (TCP)
    Solax EMS1000 Control TRENE (TCP)
    SOFAR BTS-5K 10-10 (RTU)
    SOFAR BTS-5K 10-10 Battery (RTU)
    Sungrow SH15/20/25T (TCP)
    Wattsonic Gen3 (RTU)
    Wattsonic Gen3 Battery (RTU)
    Wenergy battery Star289 (TCP)

Wallboxes:
    Wallbox KEBA KeContact P30 (TCP)
    Wallbox KEBA KeContact P40 / P40 Pro (TCP)
    Wallbox ABB Terra AC (TCP)
    Wallbox ABB Terra AC (RTU)
    Wallbox Siemens VersiCharge (TCP)
    Wallbox HAGER Witty Plus (TCP)
    Wallbox Alpitronic 150 (TCP)

Heat pumps / boilers:
    Ochsner (RTU)
    Fröhling Lamdatronic 3200 (RTU)
    OEKOBOILER (RTU)
    KNV (TCP)
    NIBE S series (TCP)
    Templari

Air conditioning:
    Samsung MIM-B19N (RTU)

Energy meters:
    Energy meter SDM 630 (RTU)
    Energy meter DS100 (RTU)
    EMU Professional II (RTU)
    SINEAX AMx000 (TCP)
    Janitza UMG 604 (TCP)

Weather stations:
    Weather station Thies (RTU)

General:
    Victron Cerbo (TCP)
    SMARTFOX Pro (TCP)

KEBA charging stations
Supported devices
  • KeContact P30 c-series from firmware 3.10.16 and KeContact P30 x-series from software 1.11. The interface is enabled on the charging station with DIP switch DSW1.3 = ON. Modbus TCP and the UDP interface of the charging station are mutually exclusive, only one of them can be used. The b-series has no network interface and does not support Modbus.
  • KeContact P40 and P40 Pro. The interface is switched off by default and is enabled in the KEBA eMobility App or via OCPP. Reading the RFID card has to be permitted separately.
Connection Protocol TCP, port 502, Modbus ID 255 and register address starting with 0. The charging station only knows function codes 3 (read) and 6 (write, single register). Only one register is transferred per request, so the number of registers per block stays at 1. Every read value is 4 bytes, hence a length of 32 bits; writing uses 16 bits. KEBA recommends more than 0.5 s between two read requests and more than 5 s between two write operations.
Do not read write registers The registers from 5000 upwards are write only. If such a register is polled with function code 3, the charging station does not answer and the log continuously shows TCP ERROR READ 1 ... TIMEOUT. In the template these registers therefore use function code 6 and write on change; the polling interval has no meaning there.
Read registers
(function code 3)
  • 1000 charging state: 0 = start-up, 1 = not ready, 2 = ready and waiting for the vehicle, 3 = charging, 4 = error, 5 = interrupted (temperature too high or suspended)
  • 1004 cable state: 0 = no cable, 1 = cable connected to the charging station, 3 = cable connected to the charging station and locked, 5 = cable connected to charging station and vehicle, 7 = additionally locked
  • 1006 error code, 0 = no error
  • 1008 / 1010 / 1012 charging current L1 / L2 / L3 in mA
  • 1014 serial number
  • 1016 product type and features
  • 1018 firmware version (P30 to be read as hexadecimal, P40 as a decimal number, e.g. 10000 = 1.0.0)
  • 1020 active power in mW
  • 1036 total energy meter in 0.1 Wh
  • 1040 / 1042 / 1044 voltage L1 / L2 / L3 in V
  • 1046 power factor in 0.1 %
  • 1100 maximum charging current currently set, in mA
  • 1110 maximum current supported by the device, in mA (lowest value of DIP switches, cable coding and temperature monitoring)
  • 1200 fast charging (P40 only): 1 = switched on, the charging current can then not be controlled via Modbus
  • 1500 the first 4 bytes of the ID of the RFID card used
  • 1502 energy of the current charging session in 0.1 Wh
  • 1550 phase switching source, 1552 phase switching state (1 or 3)
  • 1600 failsafe current set, in mA, 1602 failsafe timeout set, in s
  • 1700 / 1702 hardware revision (P40 only)
Write registers
(function code 6)
  • 5004 charging current in mA. P30: 6000 to 63000. P40: additionally 0, which suspends the session; upper value 32000.
  • 5010 energy for the current charging session in 10 Wh. Once it is reached the session is terminated; 0 deletes the limit.
  • 5012 unlock plug, value 0. Charging has to be stopped beforehand.
  • 5014 enable charging station: 0 = disabled, 1 = enabled. A running session is stopped.
  • 5016 failsafe current in mA: 0 stops charging, otherwise 6000 to 32000.
  • 5018 failsafe timeout in s: 0 switches the monitoring off, otherwise 5 to 600.
  • 5020 store the failsafe settings permanently, value 1 (P30 only).
  • 5050 phase switching source, 5052 trigger phase switch (0 = 1-phase, 1 = 3-phase).
  • 5200 switch on fast charging for the current session, value 1 (P40 only). Switching it off via Modbus is not possible.
Failsafe So that the charging station does not keep charging with the last current given when the connection fails, a failsafe mode can be set. It only becomes active with a failsafe timeout greater than 0 in register 5018; the current in register 5016 alone is not enough. Every Modbus telegram received resets the timer – a read access as well. If it stays away, the charging station falls back to the failsafe current. To switch it off, 5018 is set to 0. In the templates these registers are present but not active.
Known deviation On the P40 with a software version below 1.2.1 the registers 1036 and 1502 report the value in Wh instead of 0.1 Wh. In that case the factor of both registers has to be multiplied by ten.

See also common parameters of all function blocks.