Easy Modbus- Home
- Modbus register maps
- Intesis (HMS Networks)
- INMBSTOS001R000 Toshiba AC to Modbus RTU gateway
VRF / split AC gateway · Modbus register map
Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway Modbus register map
Updated 16 October 2026
Modbus RTU server on the AB remote-controller bus of Toshiba Digital Inverter (RAV) and VRF indoor units. Basic holding registers cover on/off, mode, fan, vane, setpoint, room temperature, alarm and error code; with a unit type chosen on SW1 it also exposes per-indoor-unit diagnostics such as room and suction temperatures, defrost and filter alarm.
This page lists 36 Modbus registers for the Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway — 13 writable — with the table, 0-based wire address, data type, word order, scale, units and access of each, re-typed from Intesis (HMS Networks)’s own free documentation (linked below) and checked against it.
- Manufacturer
- Intesis (HMS Networks)
- Model
- INMBSTOS001R000 Toshiba AC to Modbus RTU gateway
- Equipment type
- VRF / split AC gateway
- Registers
- 36 (13 writable)
- Transport
- Modbus RTU
- Default unit ID
- 1
- Default serial
- 9600 baud, 8N2
- Documented addressing
- 0-based (the number printed is the address on the wire)
- Also known as
- INMBSTOS001R000, INMBSTOS001R0xx, Intesis Toshiba Modbus
Integration notes: Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway
Leave SW1 at the defaults for plain control (gateway is AB-bus master), set address and baud on SW3/SW4, power-cycle, then poll holding registers 0-11 with function 03 and write with 06. Select RAV or VRF on SW1 only if you need the 4000+ diagnostics.
Minimum registers to map
Addresses are 0-based wire addresses. Enough to monitor and run the unit; map more as the job needs.
| Register | Name | Type | Why | Access |
|---|---|---|---|---|
| HR 0 | AC unit On/Off | UINT16 | On/off | Read/write |
| HR 1 | AC unit mode | UINT16 | Mode | Read/write |
| HR 2 | AC unit fan speed | UINT16 | Fan speed | Read/write |
| HR 4 | AC unit temperature setpoint | UINT16 | Setpoint | Read/write |
| HR 5 | AC unit temperature reference | UINT16 | Room temperature | Read |
| HR 10 | AC unit alarm status | UINT16 | Alarm flag | Read |
| HR 11 | Error code | UINT16 | Error code | Read |
Enable Modbus control & writes
No enable step; register 7 (gateway disablement) must be 0 for commands to reach the unit.
Byte order & addressing
- Diagnostic addresses are per indoor unit: (IU - 1) * 25 + 4000 + offset.
- Register 5 reads the Modbus-supplied temperature (reg 22) when one is valid, and is offset ±0.5 °C by mode.
- 8-N-2 by default; 8-N-1 is auto-detected.
Network setup
- SW1: indoor unit type (default 'not specified'; RAV / VRF SMMS / VRF SHRM enable diagnostics) and AB-bus role (master by default; slave if a Toshiba remote is the header).
- SW3: slave address; SW3/SW4: baud (9600 default).
- SW4: x1/x10, °C/°F and 120 Ω termination.
- DIP changes need a power cycle.
Watch out for
- Writes made while the gateway is still initialising are not applied; some registers read undetermined values until start-up completes.
- Error code 65535 means the gateway lost the indoor unit.
Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway Modbus registers
Address = 0-based wire address (the documented number is shown under it when it differs) · Order: ABCD = high word first, CDAB = low word first · Scale: engineering value = raw × scale.
| Table | Address | Name | Description | Type | Order | Scale | Units | Access | Values / bits |
|---|---|---|---|---|---|---|---|---|---|
| HR | 0 | AC unit On/Off | UINT16 | Read/write | 0 = Off; 1 = On | ||||
| HR | 1 | AC unit mode | Available modes depend on the indoor unit. | UINT16 | Read/write | 0 = Auto; 1 = Heat; 2 = Dry; 3 = Fan; 4 = Cool | |||
| HR | 2 | AC unit fan speed | Available speeds depend on the indoor unit. | UINT16 | Read/write | 0 = Auto; 1 = Low; 2 = Mid; 3 = High | |||
| HR | 3 | AC unit vane position | Availability depends on the indoor unit. | UINT16 | Read/write | 1 = POS1 (Horizontal); 2 = POS2 (Horizontal); 3 = POS3 (Medium); 4 = POS4 (Vertical); 5 = POS5 (Vertical); 6 = POS6; 7 = POS7; 10 = Swing | |||
| HR | 4 | AC unit temperature setpoint | Setpoint 16..32 °C (61..90 °F). SW4 x1 °C assumed (x10: 0.1, or °F). | UINT16 | °C | Read/write | 32768 = Not initialised / no value (0x8000; manual writes -32768) | ||
| HR | 5 | AC unit temperature reference | Control temperature (reg 22 if valid). SW4 x1 °C assumed (x10: 0.1, or °F). | UINT16 | °C | Read | 32768 = Not initialised / no value (0x8000; manual writes -32768) | ||
| HR | 6 | Window contact | Virtual window contact written from Modbus. | UINT16 | Read/write | 0 = Closed; 1 = Open | |||
| HR | 7 | Gateway disablement | Stops the gateway passing commands; stored in NVM. | UINT16 | Read/write | 0 = INMBSTOS001R000 enabled; 1 = INMBSTOS001R000 disabled | |||
| HR | 8 | AC remote control disablement | Blocks the Toshiba wired remote; stored in NVM. | UINT16 | Read/write | 0 = Remote control enabled; 1 = Remote control disabled | |||
| HR | 9 | AC unit operation time | Hours the unit has been on; stored in NVM. | UINT16 | h | Read/write | |||
| HR | 10 | AC unit alarm status | UINT16 | Read | 0 = No alarm condition; 1 = Alarm condition | ||||
| HR | 11 | Error code | Toshiba error number (manual section 7); 65535 = no comms with indoor unit. | UINT16 | Read | 0 = No error active; 65535 = Communication error with AC indoor unit | |||
| HR | 13 | Open window switch-off timeout | Countdown after window opens before switch-off (0..30, default 30). | UINT16 | min | Read/write | |||
| HR | 14 | Modbus RTU baud rate | Baud rate in use (38400-115200 need FW 2.3+). | UINT16 | Read | ||||
| HR | 15 | Modbus slave address | Range 1..63. | UINT16 | Read | ||||
| HR | 21 | Max number of fan speeds | UINT16 | Read | |||||
| HR | 22 | External ambient temperature (Modbus) | Room temperature written from Modbus. SW4 x1 °C assumed (x10: 0.1, or °F). | UINT16 | °C | Read/write | 32768 = Not initialised / no value (0x8000; manual writes -32768) | ||
| HR | 23 | AC real temperature setpoint | Setpoint in use; equals register 4. SW4 x1 °C assumed (x10: 0.1, or °F). | UINT16 | °C | Read | |||
| HR | 49 | Device ID | Reads 0x1F00. | UINT16 | Read | ||||
| HR | 50 | Software version | UINT16 | Read | |||||
| HR | 97 | Block periodic sendings | 1 = only forward Modbus writes that change the value (FW 2.3+). | UINT16 | Read/write | 0 = Non-blocked; 1 = Blocked | |||
| HR | 4000doc (IU - 1) * 25 + 4000 | IU1 indoor unit exist | IU 1 (advanced, SW1 type set). | UINT16 | Read | 0 = Doesn't exist; 1 = Exist | |||
| HR | 4001doc (IU - 1) * 25 + 4001 | IU1 indoor unit address | High byte = outdoor unit address, low byte = indoor unit address. | UINT16 | Read | ||||
| HR | 4002doc (IU - 1) * 25 + 4002 | IU1 indoor unit duty | Range 0..15. IU 1 (advanced, SW1 type set). | UINT16 | Read | ||||
| HR | 4003doc (IU - 1) * 25 + 4003 | IU1 indoor unit defrost | IU 1 (advanced, SW1 type set). | UINT16 | Read | 0 = Off; 1 = On | |||
| HR | 4004doc (IU - 1) * 25 + 4004 | IU1 indoor unit filter alarm | IU 1 (advanced, SW1 type set). | UINT16 | Read | 0 = No alarm; 1 = Alarm | |||
| HR | 4005doc (IU - 1) * 25 + 4005 | IU1 indoor unit thermo ON | Printed as '11hermos ON'. IU 1 (advanced, SW1 type set). | UINT16 | Read | 0 = Cool; 1 = Heat | |||
| HR | 4010doc (IU - 1) * 25 + 4010 | IU1 room temperature (during control) | x1 °C. IU 1 (advanced, SW1 type set). | UINT16 | °C | Read | |||
| HR | 4011doc (IU - 1) * 25 + 4011 | IU1 room temperature (remote controller) | x1 °C. IU 1 (advanced, SW1 type set). | UINT16 | °C | Read | |||
| HR | 4012doc (IU - 1) * 25 + 4012 | IU1 indoor suction temperature (TA) | x1 °C. IU 1 (advanced, SW1 type set). | UINT16 | °C | Read | |||
| HR | 4016doc (IU - 1) * 25 + 4016 | IU1 indoor discharge temperature (TF) | x1 °C, VRF systems only. | UINT16 | °C | Read | |||
| HR | 4017doc (IU - 1) * 25 + 4017 | IU1 revolutions indoor fan | RAV systems only. | UINT16 | rps | Read | |||
| HR | 4020doc (IU - 1) * 25 + 4020 | IU1 time filter sign | RAV systems only. | UINT16 | h | Read | |||
| HR | 4021doc (IU - 1) * 25 + 4021 | IU1 estimated supply air temperature | x1 °C, RAV systems only. | UINT16 | °C | Read | |||
| HR | 4450 | Indoor unit type | Mirrors the SW1 unit-type selection. | UINT16 | Read | 0 = Not defined (extra signals disabled); 1 = RAV; 2 = VRF (SMMSi); 3 = VRF (SHRM/SMMS) | |||
| HR | 4451 | Refresh time adjust | High-priority polls per low-priority poll (1..4). | UINT16 | Read/write |
Notes on this map
- Every register is documented as a 16-bit unsigned holding register and no temperature range in the manual goes below zero, so temperatures are UINT16. The 'no value' marker the manual writes as -32768 is raw 0x8000 (32768) and is listed as an enum entry. Temperature registers depend on DIP SW4: x1 °C, x10 °C (decidegrees) or °F (no °F x10). The register-table footnote calls x10 the default, but the SW4 table and the quick-start page (all other switches off) give x1 °C as the factory setting, so scale 1 / °C is used. Read SW4 position 1-2 on site: if x10 is set use scale 0.1; if °F is set the values are whole °F.
- Advanced diagnostic temperatures (4010-4012, 4016, 4021) are printed as 'x1 °C' and kept as UINT16 per the manual; the manual never says how a sub-zero value would be encoded.
- Left out: indoor fan-coil temperatures TCJ, TC2 and TC1 (4013-4015). Coil temperatures can fall below 0 °C and the manual gives no signed encoding for these unsigned registers.
- Left out because the printed scale is ambiguous: indoor PMV opening ('x1, x10 Pulses', 4018) and running hours indoor fan ('x100 hours', 4019).
- Left out: outdoor-unit diagnostic blocks for VRF-SMMSi (4200+), VRF-SHRM/SMMS and RAV systems. They mix 'x10 A', 'X100 MPa', 'x10 RPS' and 'x100 hours' notations whose direction (multiply or divide) is not defined, and outdoor temperatures can go below zero with no signedness stated.
- Advanced registers are only populated when SW1 selects a unit type other than the default; the Priority column (0 start-up, 1 high, 2 low) sets how often each is refreshed, tuned with register 4451.
- Error code enum (Toshiba codes) not reproduced; see manual section 7.
- Register 5 is marked R/W in the register table but described as read-only in the temperature section; it is listed read-only here. Use register 22 to supply an external temperature.
- Default slave address: the quick-start page and register 15 range (1..63) give 1, while the SW3 table labels the all-off position (address 0) as default. Unit ID 1 is listed; check SW3 on site.
Check it against the live device. A register map tells you what the controller can expose; the unit in front of you may differ by firmware or options. Read a few registers and compare them with the unit’s own display; for a 32-bit value the float and byte-order decoder shows all four word orders at once, so a wrong word order or scale is obvious. New to this? Read what a register map is and why addresses are off by one.
Questions about the Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway
What Modbus registers does the Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway have?
This map lists 36 registers: 36 holding registers. 13 of them can be written. Registers vary with firmware, options and configuration, so confirm against the device.
Are the Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway Modbus addresses 0-based or 1-based?
The manufacturer's document numbers registers 0-based (the number printed is the address on the wire). Every address on this page is the 0-based wire address you put in the request; the documented number is shown under it where it differs. Tables give a 'protocol address' (base 0) and a 'PLC address' (base 1); the protocol address is the wire address. Per-indoor-unit diagnostics are printed as a formula, (IU - 1) * 25 + 4000 + n; this file lists IU 1 only (4000-4021, without 4013-4015 and 4018-4019). For IU 2 add 25, and so on.
What are the minimum Modbus registers to integrate the Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway?
Start with HR 0 AC unit On/Off (On/off); HR 1 AC unit mode (Mode); HR 2 AC unit fan speed (Fan speed); HR 4 AC unit temperature setpoint (Setpoint); HR 5 AC unit temperature reference (Room temperature); HR 10 AC unit alarm status (Alarm flag); HR 11 Error code (Error code).
How do I enable Modbus control of the Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway?
No enable step; register 7 (gateway disablement) must be 0 for commands to reach the unit.
Where is the official Intesis (HMS Networks) INMBSTOS001R000 Toshiba AC to Modbus RTU gateway Modbus documentation?
The source is Intesis INMBSTOS001R0xx Modbus RTU (EIA-485) Interface for Toshiba air conditioners - User's Manual (User's Manual r2.9 EN), revision 2024-01, published free by Intesis (HMS Networks) at https://www.hms-networks.com/docs/default-source/products/intesis/manuals-and-guides---manuals/user-manual-inmbstos001r000.pdf.
More Intesis (HMS Networks) Modbus register maps
- Heat pump gateway (VRF / split AC gateway)
Intesis (HMS Networks) IN485MIT001A000 Mitsubishi Electric Ecodan air-to-water to Modbus RTU / BACnet MS/TP gateway
Intesis (HMS Networks) IN485MIT001A000 gateway on the CN105 socket of Mitsubishi Electric Ecodan air-to-water heat pumps, set to Modbus RTU, per user manual version 1.0.3 (2025-12-02).
Also known as: IN485MIT001A000, Ecodan Modbus, Mitsubishi Ecodan Modbus RTU, Intesis Ecodan, HMS Ecodan gateway - VRF / split AC gateway
Intesis (HMS Networks) INMBSDAI001I000 Daikin domestic AC to Modbus RTU gateway
Single Daikin domestic (S21-connector) indoor unit via INMBSDAI001I000, user manual v1.0.2.
Also known as: INMBSDAI001I000, Intesis Daikin domestic Modbus - VRF / split AC gateway
Intesis (HMS Networks) INMBSDAI001R000 Daikin VRV / Sky Air to Modbus RTU gateway
One Daikin VRV or Sky Air indoor unit (or group) on the P1P2 bus via INMBSDAI001R000, user manual v1.0.1.
Also known as: INMBSDAI001R000, Intesis Daikin VRV Modbus - VRF / split AC gateway
Intesis (HMS Networks) INMBSFGL001I000 Fujitsu domestic AC to Modbus RTU gateway
One Fujitsu domestic (RAC) or compatible VRF indoor unit, connected to the CN65/CN12/CN6 socket on the indoor board via INMBSFGL001I000, user manual v1.5 (01/2024).
Also known as: INMBSFGL001I000, FJ-AC-MBS-1, Intesis Fujitsu domestic Modbus - VRF / split AC gateway
Intesis (HMS Networks) INMBSFGL001R000 Fujitsu AC to Modbus RTU gateway
One Fujitsu indoor unit, or a group of up to 16 controlled together as one, on the 3-wire BWR remote-controller bus via INMBSFGL001R000, user manual v2.4 (02/2025).
Also known as: INMBSFGL001R000, Intesis Fujitsu Modbus - VRF / split AC gateway
Intesis (HMS Networks) INMBSHIT001R000 Hitachi AC to Modbus RTU gateway
Intesis (HMS Networks) INMBSHIT001R000 interface on the AB bus of one Hitachi commercial-line indoor unit (or group), per user manual v1.6 (01/2024).
Also known as: INMBSHIT001R000, Hitachi Modbus gateway, Intesis Hitachi - VRF / split AC gateway
Intesis (HMS Networks) INMBSLGE001R000 LG AC to Modbus RTU gateway
One LG indoor unit on the BYR (wired remote) bus via INMBSLGE001R000 (legacy code LG-RC-MBS-1), user manual v1.9 (01/2024).
Also known as: INMBSLGE001R000, LG-RC-MBS-1, Intesis LG Modbus - VRF / split AC gateway
Intesis (HMS Networks) INMBSMHI001R000 Mitsubishi Heavy Industries AC to Modbus RTU gateway
Mitsubishi Heavy Industries indoor units (one, or up to 16 controlled together as one) on the XY remote-controller bus, user manual r6.4 (01/2024).
Also known as: INMBSMHI001R000, MH-RC-MBS-1, Intesis Mitsubishi Heavy Industries Modbus, Intesis MHI Modbus - VRF / split AC gateway
Intesis (HMS Networks) INMBSMIT001I000 Mitsubishi Electric AC to Modbus RTU gateway
One Mitsubishi Electric Domestic, Mr. Slim or City Multi indoor unit via INMBSMIT001I000, user manual r2.8 (11/2024).
Also known as: INMBSMIT001I000, Intesis Mitsubishi Electric Modbus - Heat pump gateway (VRF / split AC gateway)
Intesis (HMS Networks) INMBSPAN001A100 Panasonic Aquarea H/J/K/L/M air-to-water to Modbus RTU gateway
Intesis (HMS Networks) INMBSPAN001A100 gateway connected to Panasonic Aquarea H, J, K, L and M series air-to-water heat pumps, per user manual version 1.0.2 (2026-02-04).
Also known as: INMBSPAN001A100, Aquarea Modbus, Panasonic Aquarea Modbus RTU, Intesis Aquarea, INMBSPAN001A000 (legacy order code) - VRF / split AC gateway
Intesis (HMS Networks) INMBSPAN001R000 Panasonic AC to Modbus RTU gateway
Panasonic / Sanyo ECOi and PACi indoor units (one, or up to 16 controlled together as one) on the R1R2 remote-controller bus, user manual v2.8 (09/2025).
Also known as: INMBSPAN001R000, PA-RC2-MBS-1, Intesis Panasonic Modbus, Intesis Sanyo Modbus
Source: Intesis INMBSTOS001R0xx Modbus RTU (EIA-485) Interface for Toshiba air conditioners - User's Manual · User's Manual r2.9 EN · rev. 2024-01. Register numbers, types, scaling and units are reproduced as published; descriptions are our own.