Watlow EZ-ZONE PM controller
Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based
as on the wire. Word order and scaling are confirmed at the hardware-verified rung and at no rung below it.
interop-verified
Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
| point | address (0-based) | type | scale | unit |
|---|
| analog_input_1_process_value | 360 | F32LE | 1 | °F |
| analog_input_1_error_status | 362 | U16 | 1 | |
| analog_input_2_process_value | 440 | F32LE | 1 | °F |
| analog_input_2_error_status | 442 | U16 | 1 | |
| digital_output_5_output_state | 1012 | U16 | 1 | |
| digital_input_5_event_status | 1328 | U16 | 1 | |
| digital_output_6_output_state | 1042 | U16 | 1 | |
| digital_input_6_event_status | 1348 | U16 | 1 | |
| limit_low_set_point | 684 | F32LE | 1 | °F |
| limit_high_set_point | 686 | F32LE | 1 | °F |
| limit_state | 690 | U16 | 1 | |
| monitor_control_mode_active | 1882 | U16 | 1 | |
| monitor_heat_power | 1904 | F32LE | 1 | % |
| monitor_cool_power | 1906 | F32LE | 1 | % |
| monitor_closed_loop_active_set_point | 2172 | F32LE | 1 | °F |
| monitor_open_loop_active_set_point | 2174 | F32LE | 1 | |
| monitor_alarm_1_state | 1496 | U16 | 1 | |
| monitor_alarm_2_state | 1546 | U16 | 1 | |
| monitor_alarm_3_state | 1596 | U16 | 1 | |
| monitor_alarm_4_state | 1646 | U16 | 1 | |
| monitor_ambient_temperature_input_1 | 366 | F32LE | 1 | |
| monitor_ambient_temperature_input_2 | 446 | F32LE | 1 | |
| monitor_control_loop_output_power | 1908 | F32LE | 1 | % |
| loop_closed_loop_set_point | 2160 | F32LE | 1 | °F |
link settings as documented (unverified): RTU/TCP; default 9600 8N1; unit ID 1; FC 03,05,06,16; Default serial data format is 9600 baud, 8 data bits, no parity, 1 stop bit. Modbus RTU is typically deployed over serial connections, Modbus TCP over Ethernet.
bench facts as documented (unverified)
| terminals | Slot C (A to CA, B to CB, GND to CC) |
| A/B polarity | A to CA, B to CB |
| connector | Slot C |
| wiring notes | EIA-485 converter connects to slot C. |
| response timeout | 1000 ms |
| inter-frame delay | 0 ms |
| protocol notes | Excessive writes to the PM may cause premature EEPROM failure. EEPROM is rated for 1,000,000 writes. By default, settings made through the network are not saved to nonvolatile memory. |
| model register | 0 |
| firmware register | 2 |
| identification notes | Hardware ID is at register 0, Firmware ID is at register 2, Software Revision is at register 4. |
| doc revision | 0600-0056-0000 Rev. B, November 2007 |
field reports — community-sourced, unverified (checked 2026-06-11)
- By default, the controller uses Low Word-High Word (LSW, MSW) order for 32-bit floating-point values, which is the opposite of standard Modbus big-endian word order. This causes incorrect decoding (e.g., reading values like 0.92E28 instead of the actual temperature) unless the word order is swapped in the controller's Setup menu ([M;hL]) or the client software. [source]
- Watlow documentation references registers using 1-based numbering, but the Modbus protocol uses 0-based addressing. This creates a discrepancy between document values and protocol addresses, requiring users to subtract 1 from the documented register number. [source]
- The Watlow EZ-ZONE PM features two sets of identically-labeled A/B connector terminals. Connecting to the wrong pair causes immediate communication failure. [source]
- confirmed: Document revision 0600-0056-0000 Rev. B, November 2007 corresponds to the EZ-ZONE PM Controller Communications Manual — confirmed by vendor document search [1.1.1]
- confirmed: Default serial data format is 9600 baud, 8 data bits, no parity, 1 stop bit — confirmed by EZ-ZONE PM Controller Communications Manual
- confirmed: Default unit ID is 1 — confirmed by EZ-ZONE PM Controller Communications Manual
- confirmed: EIA-485 converter connects to slot C with terminals A to CA, B to CB, and GND to CC — confirmed by EZ-ZONE PM Controller Communications Manual and wiring diagrams
- confirmed: Hardware ID is at register 0, Firmware ID is at register 2, and Software Revision is at register 4 — confirmed by EZ-ZONE PM Controller Communications Manual
- confirmed: EEPROM is rated for 1,000,000 writes and by default settings made through the network are not saved to nonvolatile memory — confirmed by EZ-ZONE PM Controller Communications Manual
- confirmed: Analog Input 1 Process Value is at register 360, Analog Input 2 Process Value is at register 440 — confirmed by EZ-ZONE PM Controller Communications Manual and TestEquity Modbus map
- confirmed: Closed Loop Set Point is at register 2160 — confirmed by EZ-ZONE PM Controller Communications Manual
The trust ladder
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
- generated — A prompt produced it. Unproven — anyone can regenerate this.
- structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
- interop-verified — Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
- simulator-verified — Decoded correctly against a protocol emulator seeded with known-true values — catches word-order/scaling errors vs the emulator, not the physical device.
- hardware-verified x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.