ebm-papst EC fan (product range)
Register map(s) for this device, with a note of how far each has been checked. Addresses are
0-based, as on the wire. Scale and byte order are confirmed only at the hardware-verified rung.
coherence-checked
Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.
| point | address (0-based) | type | scale | unit |
|---|
| default_set_value | 53249 | U16 | 1 | |
| operating_hours_counter | 53257 | U16 | 1 | h |
| operating_minutes_counter | 53258 | U16 | 1 | min |
| actual_speed | 53264 | U16 | 1 | rpm |
| motor_status | 53265 | U16 | 1 | |
| warning | 53266 | U16 | 1 | |
| dc_link_voltage | 53267 | U16 | 1 | |
| dc_link_current | 53268 | U16 | 1 | |
| module_temperature | 53269 | I16 | 1 | |
| motor_temperature | 53270 | I16 | 1 | |
| electronics_interior_temperature | 53271 | I16 | 1 | |
| current_direction_of_rotation | 53272 | U16 | 1 | |
| current_modulation_level | 53273 | U16 | 0.0015258789 | |
| current_set_value | 53274 | U16 | 1 | % |
| actual_sensor_value | 53275 | U16 | 0.00015258789 | |
| enable_input_status | 53276 | U16 | 1 | |
| current_parameter_set | 53277 | U16 | 1 | |
| current_control_function | 53278 | U16 | 1 | |
| current_power | 53281 | U16 | 1 | |
| actual_sensor_value_1 | 53283 | U16 | 0.00015258789 | |
| actual_sensor_value_2 | 53284 | U16 | 0.00015258789 | |
| operating_hours_counter_backup | 53632 | U16 | 1 | h |
| reference_dc_link_voltage | 53664 | U16 | 0.02 | mV |
| reference_dc_link_current | 53665 | U16 | 0.002 | mA |
link settings as documented (unverified): RTU; default 19200 8E1; unit ID 1; FC 03,04,06,08,16,67,68,70,80; Maximum telegram length is 23 bytes. Custom function codes 0x43, 0x44, 0x46, 0x50 are supported for addressing via serial number.
bench facts as documented (unverified)
| terminals | RS485 twisted pair |
| wiring notes | A twisted pair wire with RS485 standard should preferably be used. |
| max registers/read | 9 |
| broadcast | supported |
| protocol notes | Maximum telegram length is 23 bytes. Holding registers range 0xD000 to 0xD37F, Input registers range 0xD000 to 0xD026. |
| model register | 53669 |
| serial register | 53666 |
| firmware register | 53251 |
| identification notes | Model register is D1A5 (Holding), Serial register is D1A2 (Holding), Firmware register is D003 (Input). |
| doc revision | V5.00 |
field reports — community-sourced, unverified (checked 2026-06-11)
- Many Modbus masters/PLCs apply a +1 register offset by default. If this offset is active, the fan will return unreliable/nonsense data without throwing a Modbus error. To verify correct alignment, ebm-papst recommends reading the analog port register (D023) while applying a variable 0-10V signal. [source]
- Because ebm-papst registers reside in the high address range (0xD000–0xD37F, which is 53248–54143 in decimal), older PLCs or Modbus masters that do not support 'extended referencing' (6-digit addressing or addressing beyond 9999/49999) cannot access these registers. [source]
- Certain holding registers require entering an OEM password ('epM EC' in ASCII or hex 65 70 4D 20 45 43) into registers D002–D004 to enable write access. This write permission automatically expires after approximately 4 minutes, requiring the password to be re-sent. [source]
- Careless or frequent writing to parameters with 'Save set value in EEPROM' enabled can lead to premature memory wear-out and device failure due to excessive write cycles. [source]
- On 'Modbus LITE' reduced-functionality fans, certain parameters such as 'Motor Temperature' (D016) are not available. [source]
- confirmed: Baud rates [1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200] with default 19200, Even parity, 1 stop bit, and RTU framing — confirmed by ebm-papst Modbus Parameter Specifications V5.00 and V6.3
- confirmed: Custom function codes 0x43, 0x44, 0x46, 0x50 for serial number addressing — confirmed by ebm-papst Modbus Parameter Specifications V5.00
- confirmed: Maximum telegram length of 23 bytes (limiting reads to 9 registers) — confirmed by ebm-papst Modbus Parameter Specifications V5.00 and Siemens S7-1200 integration guide
- confirmed: Register addresses (e.g., default_set_value @ 53249, actual_speed @ 53264, reference_dc_link_voltage @ 53664) — confirmed by Siemens S7-1200 integration guide and ebm-papst Modbus Parameter Specifications V5.00
The trust ladder
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
- generated — A prompt produced it. Unproven — anyone can regenerate this.
- structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
- coherence-checked — Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.
- hardware-verified (software-key) x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.