Easy Modbus- Home
- Modbus register maps
- Siemens
- SINAMICS G120 / G120C (Modbus RTU)
Variable frequency drive · Modbus register map
Siemens SINAMICS G120 / G120C (Modbus RTU) Modbus register map
Updated 24 October 2026
Siemens' modular drive family (Control Unit plus Power Module) and its compact G120C variant. Control Units with an RS485 port run Modbus RTU as a slave when p2030 = 2. Holding registers 40100-40111 carry the PROFIdrive control word, main setpoint, status word and actual value; 40200-40522 map I/O, drive data, measurements, fault numbers and technology (PID) controller settings. This map covers that whole table except two registers: one with an inconsistent scaling entry and one with no stated bit polarity.
This page lists 56 Modbus registers for the Siemens SINAMICS G120 / G120C (Modbus RTU) — 18 writable — with the table, 0-based wire address, data type, word order, scale, units and access of each, re-typed from Siemens’s own free documentation (linked below) and checked against it.
- Manufacturer
- Siemens
- Model
- SINAMICS G120 / G120C (Modbus RTU)
- Equipment type
- Variable frequency drive
- Registers
- 56 (18 writable)
- Transport
- Modbus RTU
- Default unit ID
- 1
- Default serial
- 19200 baud, 8E1
- Documented addressing
- Modicon 3xxxx/4xxxx (drop the prefix, subtract 1)
- Firmware
- V4.7
- Also known as
- G120C USS/MB, CU230P-2 HVAC, CU230P-2 BT, CU240B-2, CU240E-2, CU240E-2 F, CU250S-2, G110M CU240M USS, G120P
Integration notes: Siemens SINAMICS G120 / G120C (Modbus RTU)
Set p0015 = 21 (USS fieldbus macro), then p2030 = 2 (Modbus), the address and baud rate. Write 047E hex to 40100, then 047F hex (bit 0 going 0 to 1 = ON) to start, the speed setpoint to 40101 (4000 hex = p2000), and poll 40110/40111 plus 40342-40347 for frequency, current and power.
Minimum registers to map
Addresses are 0-based wire addresses. Enough to monitor and run the unit; map more as the job needs.
| Register | Name | Type | Why | Access |
|---|---|---|---|---|
| HR 99 | Control word | BITMAP16 | Control word STW1 | Read/write |
| HR 100 | Main setpoint | INT16 | Main setpoint, 4000 hex = p2000 | Read/write |
| HR 109 | Status word | BITMAP16 | Status word ZSW1 | Read |
| HR 110 | Main actual value | INT16 | Main actual value | Read |
| HR 341 | Output frequency | INT16 | Output frequency in 0.01 Hz | Read |
| HR 344 | Actual current value | UINT16 | Output current in 0.01 A | Read |
| HR 346 | Actual active power | UINT16 | Active power in 0.01 kW | Read |
| HR 399 | Failure number r0947[0] | UINT16 | Latest fault number | Read |
Enable Modbus control & writes
p0015 = 21 'USS fieldbus' (CU230P-2 HVAC/BT can instead use macro 109 'BT Mac 9: Modbus RTU Fieldbus'), then p2030 = 2 for Modbus, p2020 for baud rate (factory 7 = 19200 bit/s, range 4800-187500), and the address via the Control Unit's address switches or p2021. With STARTER, save the settings afterwards.
Communication loss & watchdog
p2040 fieldbus monitoring time (factory 100 ms, 0 disables): if no process data (40100, 40101, 40110, 40111) is accessed within this time, the drive trips with F01910 'setpoint timeout'. Accessing only parameter registers 40200-40522 does not keep it alive.
Byte order & addressing
- Only FC03 (read, up to 125 registers) and FC06 (single write); there is no FC16.
- Valid registers are 40001-40065 and 40100-40522; anything else returns exception 02. Reading a reserved or write-only register returns zeros.
- Writing a read-only or reserved register returns exception 04; the reason is in 40499.
- The manual states the Control Unit runs Modbus RTU with even parity; no parity parameter is described.
- The unit switchover function must not be used with Modbus.
Network setup
- RS485 on connector X128 (CU) pins 2 = RS485P, 3 = RS485N, 1 = 0 V, 4 = shield; G110M uses M12 X03/X04.
- Switch on the bus terminating resistor at the first and last node; both must be powered.
- Address 1-247: DIP switches set 1-127 and override p2021; set all switches to 0 to use p2021 (needed for 128-247). Power-cycle until all LEDs go dark after changing the address.
- p2024[0..2] set slave response time, character delay and inter-telegram gap; p2024[1] and [2] are 0 from the factory, which lets the drive derive them from the baud rate.
- Maximum cable length 100 m; r2029 shows receive error statistics.
Watch out for
- The factory protocol on the RS485 port is USS; nothing answers Modbus until p2030 = 2.
- If the address switches hold a valid address, p2021 cannot be changed and is ignored.
- With p2040 > 0 a master that only polls 40200+ will still trip F01910; include the process-data registers in the poll.
Siemens SINAMICS G120 / G120C (Modbus RTU) Modbus registers
Address = 0-based wire address (the documented number is shown under it when it differs) · Order: ABCD = high word first, CDAB = low word first · Scale: engineering value = raw × scale.
| Table | Address | Name | Description | Type | Order | Scale | Units | Access | Values / bits |
|---|---|---|---|---|---|---|---|---|---|
| HR | 99doc 40100 | Control word | Process data 1 (STW1). | BITMAP16 | Read/write | bit 0 = ON/OFF1 (0 = OFF1 ramp stop, 0->1 = ON); bit 1 = 0 = OFF2 coast stop (1 = no OFF2); bit 2 = 0 = OFF3 quick stop (1 = no OFF3); bit 3 = 1 = Enable operation (0 = inhibit, pulses off); bit 4 = 1 = Do not disable RFG; bit 5 = 1 = Enable RFG (0 = hold RFG output); bit 6 = 1 = Enable setpoint; bit 7 = 0->1 = Acknowledge faults; bit 10 = 1 = Control via PLC (process data accepted); bit 11 = Direction reversal (setpoint inversion, p1113); bit 13 = 1 = MOP up; bit 14 = 1 = MOP down | |||
| HR | 100doc 40101 | Main setpoint | Process data 2; 4000 hex = 100 % of p2000. | INT16 | Read/write | ||||
| HR | 109doc 40110 | Status word | Process data 1 (ZSW1). | BITMAP16 | Read | bit 0 = Ready to start; bit 1 = Ready; bit 2 = Operation enabled; bit 3 = Fault active; bit 4 = 1 = OFF2 inactive; bit 5 = 1 = OFF3 inactive; bit 6 = Closing lockout active; bit 7 = Alarm active; bit 8 = Speed deviation within tolerance; bit 9 = Master control requested; bit 10 = Comparison speed reached or exceeded; bit 11 = Torque limit reached; bit 12 = Holding brake open; bit 13 = 0 = alarm, motor overtemperature; bit 14 = 1 = clockwise, 0 = counterclockwise; bit 15 = 0 = alarm, inverter thermal overload | |||
| HR | 110doc 40111 | Main actual value | Process data 2; 4000 hex = 100 % of p2000. | INT16 | Read | ||||
| HR | 199doc 40200 | DO 0 | Mapped to p0730, r0747.0 and p0748.0. | UINT16 | Read/write | 0 = LOW; 1 = HIGH | |||
| HR | 200doc 40201 | DO 1 | Mapped to p0731, r0747.1 and p0748.1. | UINT16 | Read/write | 0 = LOW; 1 = HIGH | |||
| HR | 201doc 40202 | DO 2 | Mapped to p0732, r0747.2 and p0748.2. | UINT16 | Read/write | 0 = LOW; 1 = HIGH | |||
| HR | 219doc 40220 | AO 0 | r0774.0. | INT16 | × 0.01 | % | Read | ||
| HR | 220doc 40221 | AO 1 | r0774.1. | INT16 | × 0.01 | % | Read | ||
| HR | 239doc 40240 | DI 0 | r0722.0. | UINT16 | Read | 0 = LOW; 1 = HIGH | |||
| HR | 240doc 40241 | DI 1 | r0722.1. | UINT16 | Read | 0 = LOW; 1 = HIGH | |||
| HR | 241doc 40242 | DI 2 | r0722.2. | UINT16 | Read | 0 = LOW; 1 = HIGH | |||
| HR | 242doc 40243 | DI 3 | r0722.3. | UINT16 | Read | 0 = LOW; 1 = HIGH | |||
| HR | 243doc 40244 | DI 4 | r0722.4. | UINT16 | Read | 0 = LOW; 1 = HIGH | |||
| HR | 244doc 40245 | DI 5 | r0722.5. | UINT16 | Read | 0 = LOW; 1 = HIGH | |||
| HR | 259doc 40260 | AI 0 | r0755[0], -300.0 to 300.0 %. | INT16 | × 0.01 | % | Read | ||
| HR | 260doc 40261 | AI 1 | r0755[1], -300.0 to 300.0 %. | INT16 | × 0.01 | % | Read | ||
| HR | 261doc 40262 | AI 2 | r0755[2], -300.0 to 300.0 %. | INT16 | × 0.01 | % | Read | ||
| HR | 262doc 40263 | AI 3 | r0755[3], -300.0 to 300.0 %. | INT16 | × 0.01 | % | Read | ||
| HR | 299doc 40300 | Powerstack number | r0200 power unit code. | UINT16 | Read | ||||
| HR | 319doc 40320 | Rated power of the power unit | r0206. | UINT16 | × 0.01 | kW | Read | ||
| HR | 320doc 40321 | Current limit | p0640, 10.0-400.0 %. | UINT16 | × 0.1 | % | Read/write | ||
| HR | 321doc 40322 | Ramp-up time | p1120, 0.00-650.0 s (raw up to 65000). | UINT16 | × 0.01 | s | Read/write | ||
| HR | 322doc 40323 | Ramp-down time | p1121, 0.00-650.0 s (raw up to 65000). | UINT16 | × 0.01 | s | Read/write | ||
| HR | 323doc 40324 | Reference speed | p2000: speed that 4000 hex represents. | UINT16 | rpm | Read/write | |||
| HR | 339doc 40340 | Speed setpoint | r0020. | INT16 | rpm | Read | |||
| HR | 340doc 40341 | Actual speed value | r0022. | INT16 | rpm | Read | |||
| HR | 341doc 40342 | Output frequency | r0024. | INT16 | × 0.01 | Hz | Read | ||
| HR | 342doc 40343 | Output voltage | r0025. | UINT16 | V | Read | |||
| HR | 343doc 40344 | DC-link voltage | r0026. | UINT16 | V | Read | |||
| HR | 344doc 40345 | Actual current value | r0027. | UINT16 | × 0.01 | A | Read | ||
| HR | 345doc 40346 | Actual torque value | r0031. | INT16 | × 0.01 | Nm | Read | ||
| HR | 346doc 40347 | Actual active power | r0032. | UINT16 | × 0.01 | kW | Read | ||
| HR | 347doc 40348 | Energy consumption | r0039. | UINT16 | kWh | Read | |||
| HR | 399doc 40400 | Failure number r0947[0] | Most recent fault number. | UINT16 | Read | ||||
| HR | 400doc 40401 | Failure number r0947[1] | Fault history entry. | UINT16 | Read | ||||
| HR | 401doc 40402 | Failure number r0947[2] | Fault history entry. | UINT16 | Read | ||||
| HR | 402doc 40403 | Failure number r0947[3] | Fault history entry. | UINT16 | Read | ||||
| HR | 403doc 40404 | Failure number r0947[4] | Fault history entry. | UINT16 | Read | ||||
| HR | 404doc 40405 | Failure number r0947[5] | Fault history entry. | UINT16 | Read | ||||
| HR | 405doc 40406 | Failure number r0947[6] | Fault history entry. | UINT16 | Read | ||||
| HR | 406doc 40407 | Failure number r0947[7] | Fault history entry. | UINT16 | Read | ||||
| HR | 407doc 40408 | Alarm number | r2110[0]. | UINT16 | Read | ||||
| HR | 498doc 40499 | PRM ERROR code | 0-99; why the last register access failed. | UINT16 | Read | ||||
| HR | 499doc 40500 | Technology controller enable | Writes p2200; reads r2349.0. | UINT16 | Read/write | 0 = Off; 1 = On | |||
| HR | 500doc 40501 | Technology controller MOP | p2240, -200.0 to 200.0 %. | INT16 | × 0.01 | % | Read/write | ||
| HR | 509doc 40510 | Tech. controller actual-value filter time | p2265, 0.00-60.0; no unit printed. | UINT16 | × 0.01 | Read/write | |||
| HR | 510doc 40511 | Tech. controller actual-value scaling | p2269, 0.00-500.00 %. | UINT16 | × 0.01 | % | Read/write | ||
| HR | 511doc 40512 | Tech. controller proportional gain | p2280, 0.000-65.000. | UINT16 | × 0.001 | Read/write | |||
| HR | 512doc 40513 | Tech. controller integral time | p2285, 0-60 s. | UINT16 | s | Read/write | |||
| HR | 513doc 40514 | Tech. controller D time constant | p2274, 0-60; no unit printed. | UINT16 | Read/write | ||||
| HR | 514doc 40515 | Tech. controller max. limit | p2291. | INT16 | × 0.01 | % | Read/write | ||
| HR | 515doc 40516 | Tech. controller min. limit | p2292. | INT16 | × 0.01 | % | Read/write | ||
| HR | 519doc 40520 | Tech. controller effective setpoint | r2250, after MOP ramp-function generator. | INT16 | × 0.01 | % | Read | ||
| HR | 520doc 40521 | Tech. controller actual value after filter | r2266. | INT16 | × 0.01 | % | Read | ||
| HR | 521doc 40522 | Tech. controller output | r2294. | INT16 | × 0.01 | % | Read |
Notes on this map
- All values are single 16-bit registers. The table's 'scaling factor' is what the engineering value is multiplied by before transmission (e.g. 100 for 0.01 Hz), so the scale here is 1 / factor.
- Signed/unsigned is not printed per register; registers with a negative range are INT16, the rest UINT16. Ramp times (650.0 s x 100) exceed 32767 raw, which only fits as unsigned.
- Control and status word bits are the PROFIdrive STW1/ZSW1 layout ('all other telegrams' column of the PROFIdrive section), which assumes the default interconnection of the received/sent process data; they change if that interconnection is altered (e.g. free telegram configuration via p0922/p2079 = 999 or BICO changes).
- Left out: 40301 Converter firmware (scaling factor 0.0001 contradicts its printed range 0.00-327.67) and 40349 Control priority (HAND/AUTO text without a stated bit polarity).
- Table 5-11 labels 40401-40407 as 'Failure number, index 1..6' with index 2 printed twice; the parameter column (r0947[1]..r0947[7]) is used here.
- 40001-40065 (MICROMASTER MM436 compatible range) is mentioned but not mapped in this manual, so it is not included.
- SINAMICS G120X is not covered by this manual; do not use this map for it without its own documentation.
Check it against the live device. A register map tells you what the controller can expose; the unit in front of you may differ by firmware or options. Read a few registers and compare them with the unit’s own display; for a 32-bit value the float and byte-order decoder shows all four word orders at once, so a wrong word order or scale is obvious. New to this? Read what a register map is and why addresses are off by one.
Questions about the Siemens SINAMICS G120 / G120C (Modbus RTU)
What Modbus registers does the Siemens SINAMICS G120 / G120C (Modbus RTU) have?
This map lists 56 registers: 56 holding registers. 18 of them can be written. Registers vary with firmware, options and configuration, so confirm against the device.
Are the Siemens SINAMICS G120 / G120C (Modbus RTU) Modbus addresses 0-based or 1-based?
The manufacturer's document numbers registers Modicon 3xxxx/4xxxx (drop the prefix, subtract 1). Every address on this page is the 0-based wire address you put in the request; the documented number is shown under it where it differs. Registers are printed as 40100-40522. The manual's request examples send 00 6D for register 40110 and 00 63 for 40100, so the wire address is the printed number minus 40001 (control word 40100 = address 99).
What are the minimum Modbus registers to integrate the Siemens SINAMICS G120 / G120C (Modbus RTU)?
Start with HR 99 Control word (Control word STW1); HR 100 Main setpoint (Main setpoint, 4000 hex = p2000); HR 109 Status word (Status word ZSW1); HR 110 Main actual value (Main actual value); HR 341 Output frequency (Output frequency in 0.01 Hz); HR 344 Actual current value (Output current in 0.01 A); HR 346 Actual active power (Active power in 0.01 kW); HR 399 Failure number r0947[0] (Latest fault number).
How do I enable Modbus control of the Siemens SINAMICS G120 / G120C (Modbus RTU)?
p0015 = 21 'USS fieldbus' (CU230P-2 HVAC/BT can instead use macro 109 'BT Mac 9: Modbus RTU Fieldbus'), then p2030 = 2 for Modbus, p2020 for baud rate (factory 7 = 19200 bit/s, range 4800-187500), and the address via the Control Unit's address switches or p2021. With STARTER, save the settings afterwards.
What happens when the Siemens SINAMICS G120 / G120C (Modbus RTU) loses Modbus communication?
p2040 fieldbus monitoring time (factory 100 ms, 0 disables): if no process data (40100, 40101, 40110, 40111) is accessed within this time, the drive trips with F01910 'setpoint timeout'. Accessing only parameter registers 40200-40522 does not keep it alive.
Where is the official Siemens SINAMICS G120 / G120C (Modbus RTU) Modbus documentation?
The source is SINAMICS G120, G120P, G120C, G120D, G110M Fieldbuses Function Manual (A5E34229197B AA), revision 2014-04, published free by Siemens at https://cache.industry.siemens.com/dl/files/275/109981275/att_1314024/v1/A6V10556730.pdf.
More Siemens Modbus register maps
- Energy meter
Siemens SENTRON PAC2200
SENTRON 7KM PAC2200 Modbus TCP and Modbus RTU variants (5 A and 65 A), per Equipment Manual 12/2022.
Also known as: 7KM PAC2200 - Power meter
Siemens SENTRON PAC3200
SENTRON PAC3200 (7KM2111/7KM2112), Ethernet port and optional PAC RS485 expansion module, per manual edition 02/2008.
Also known as: 7KM2112-0BA00-2AA0, 7KM2112-0BA00-3AA0, 7KM2111-1BA00-3AA0, 7KM PAC3200 - Variable frequency drive
Siemens SINAMICS V20 inverter (Modbus RTU)
SINAMICS V20 basic inverters (1AC 230 V 6SL3210-5BB.. and 3AC 400 V 6SL3210-5BE..) using the built-in RS485 port with P2023 = 2 (Modbus), per operating instructions A5E34559884-006 (11/2016).
Also known as: V20, 6SL3210-5BB, 6SL3210-5BE - EV charger
Siemens VersiCharge AC series wallbox (Modbus map)
VersiCharge AC series chargers with firmware V2.135 or later (per-register minimum firmware is given in the source).
Also known as: VersiCharge, VersiCharge AC
Source: SINAMICS G120, G120P, G120C, G120D, G110M Fieldbuses Function Manual · A5E34229197B AA · rev. 2014-04. Register numbers, types, scaling and units are reproduced as published; descriptions are our own.