How do I find my Modbus register map?
Four routes, easiest first: search the manufacturer's site for the model number plus “Modbus”, look in the installation or integration manual rather than the user manual, ask your controls contractor for the submittal documents, or connect to the device and work backwards from the values it reports. The last one sounds hardest but is often fastest, because it is the only method that does not depend on someone else answering an email.
1. The manufacturer's website
Search for the exact model number from the equipment label plus the word Modbus. The document you want is usually called one of:
- Modbus register map or Modbus point list
- Integration guide or Integration manual
- BMS interface manual or Communications manual
- Installation and operation manual — the Modbus table is frequently an appendix at the back
Two things worth knowing. The user manual almost never has it — you want the installer or integrator document. And the map is often specific to a firmware version, so check the revision against the label on the equipment.
2. The equipment label and the controller itself
Get the model number, serial number and firmware version off the nameplate before you start searching. On equipment with a display, the Modbus settings screen is also worth finding: it usually shows the baud rate, the unit ID, and sometimes the protocol, all of which you will need anyway and none of which can be guessed reliably.
3. Your controls contractor
Whoever installed or maintains the building automation system normally holds the submittals, which include integration documents. This is the fastest route when it works. The caveat is the usual one: the documents describe the design, and the installed system may have moved on.
4. Read the device and work backwards
This is more practical than it sounds, and for undocumented equipment it is the only option. The method:
- Read a block of holding registers — addresses 0 to 32 is a good first try — and look at what comes back.
- Ignore everything reading zero and everything reading 0xFFFF. Those are usually unused or faulted.
- For the rest, compare against what the equipment's own display says. If the unit shows 72.4°F and a register reads 724, you have found it and you have found the multiplier at the same time.
- Look for pairs of registers where one half is zero — that pattern is a 32-bit value, usually a running total like energy or hours.
- Look for runs of registers holding printable characters. That is the model number or serial number in text, and it is a useful landmark for where the map begins.
Values that change when you change something physical are the most reliable evidence of all. Turn the fan up and see which register moves.
Doing this from a phone
Easy Modbus is built for exactly this job. It sweeps the network for equipment, reads blocks of registers and shows them in hex and decimal, and for each one offers the plausible interpretations with the reasoning — “12.75 as a 32-bit float with the words swapped, which is a sensible engineering magnitude”. When a number looks right, you name it and the app remembers the whole interpretation, so nobody has to work it out again. The result exports as a CSV, which is how an undocumented device ends up documented.
When none of it works
Ask the vendor directly, with the model and firmware version, for the Modbus register map. It is a normal request and they have the document. If the equipment is out of support and the manufacturer is gone, the reverse-engineering route above is what remains — and a map you build yourself, exported and filed somewhere, is worth more to the next person than anything else you could leave them.