ebm-papst EC fan (product range)
Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based
as on the wire. Word order and scaling are confirmed at the hardware-verified rung and at no rung below it.
interop-verified
Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
| point | address (0-based) | type | scale | unit |
|---|
| default_set_value | 53249 | U16 | 1 | |
| operating_hours_counter | 53257 | U16 | 1 | h |
| operating_minutes_counter | 53258 | U16 | 1 | min |
| actual_speed | 53264 | U16 | 1 | rpm |
| motor_status | 53265 | U16 | 1 | |
| warning | 53266 | U16 | 1 | |
| dc_link_voltage | 53267 | U16 | 1 | |
| dc_link_current | 53268 | U16 | 1 | |
| module_temperature | 53269 | I16 | 1 | |
| motor_temperature | 53270 | I16 | 1 | |
| electronics_interior_temperature | 53271 | I16 | 1 | |
| current_direction_of_rotation | 53272 | U16 | 1 | |
| current_modulation_level | 53273 | U16 | 0.0015258789 | |
| current_set_value | 53274 | U16 | 1 | % |
| actual_sensor_value | 53275 | U16 | 0.00015258789 | |
| enable_input_status | 53276 | U16 | 1 | |
| current_parameter_set | 53277 | U16 | 1 | |
| current_control_function | 53278 | U16 | 1 | |
| current_power | 53281 | U16 | 1 | |
| actual_sensor_value_1 | 53283 | U16 | 0.00015258789 | |
| actual_sensor_value_2 | 53284 | U16 | 0.00015258789 | |
| operating_hours_counter_backup | 53632 | U16 | 1 | h |
| reference_dc_link_voltage | 53664 | U16 | 0.02 | mV |
| reference_dc_link_current | 53665 | U16 | 0.002 | mA |
link settings as documented (unverified): RTU; default 19200 8E1; unit ID 1; FC 03,04,06,08,16,67,68,70,80; Maximum telegram length is 23 bytes. Custom function codes 0x43, 0x44, 0x46, 0x50 are supported for addressing via serial number.
bench facts as documented (unverified)
| terminals | RS485 twisted pair |
| wiring notes | A twisted pair wire with RS485 standard should preferably be used. |
| max registers/read | 9 |
| broadcast | supported |
| protocol notes | Maximum telegram length is 23 bytes. Holding registers range 0xD000 to 0xD37F, Input registers range 0xD000 to 0xD026. |
| model register | 53669 |
| serial register | 53666 |
| firmware register | 53251 |
| identification notes | Model register is D1A5 (Holding), Serial register is D1A2 (Holding), Firmware register is D003 (Input). |
| doc revision | V5.00 |
field reports — community-sourced, unverified (checked 2026-06-11)
- Many Modbus masters/PLCs apply a +1 register offset by default. If this offset is active, the fan will return unreliable/nonsense data without throwing a Modbus error. To verify correct alignment, ebm-papst recommends reading the analog port register (D023) while applying a variable 0-10V signal. [source]
- Because ebm-papst registers reside in the high address range (0xD000–0xD37F, which is 53248–54143 in decimal), older PLCs or Modbus masters that do not support 'extended referencing' (6-digit addressing or addressing beyond 9999/49999) cannot access these registers. [source]
- Certain holding registers require entering an OEM password ('epM EC' in ASCII or hex 65 70 4D 20 45 43) into registers D002–D004 to enable write access. This write permission automatically expires after approximately 4 minutes, requiring the password to be re-sent. [source]
- Careless or frequent writing to parameters with 'Save set value in EEPROM' enabled can lead to premature memory wear-out and device failure due to excessive write cycles. [source]
- On 'Modbus LITE' reduced-functionality fans, certain parameters such as 'Motor Temperature' (D016) are not available. [source]
- confirmed: Baud rates [1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200] with default 19200, Even parity, 1 stop bit, and RTU framing — confirmed by ebm-papst Modbus Parameter Specifications V5.00 and V6.3
- confirmed: Custom function codes 0x43, 0x44, 0x46, 0x50 for serial number addressing — confirmed by ebm-papst Modbus Parameter Specifications V5.00
- confirmed: Maximum telegram length of 23 bytes (limiting reads to 9 registers) — confirmed by ebm-papst Modbus Parameter Specifications V5.00 and Siemens S7-1200 integration guide
- confirmed: Register addresses (e.g., default_set_value @ 53249, actual_speed @ 53264, reference_dc_link_voltage @ 53664) — confirmed by Siemens S7-1200 integration guide and ebm-papst Modbus Parameter Specifications V5.00
The trust ladder
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
- generated — A prompt produced it. Unproven — anyone can regenerate this.
- structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
- interop-verified — Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
- simulator-verified — Decoded correctly against a protocol emulator seeded with known-true values — catches word-order/scaling errors vs the emulator, not the physical device.
- hardware-verified x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.