Easy Modbus- Home
- Modbus register maps
- Siemens
- VersiCharge AC series wallbox (Modbus map)
EV charger · Modbus register map
Siemens VersiCharge AC series wallbox (Modbus map) Modbus register map
Updated 28 October 2026
The Siemens VersiCharge AC wallbox has a Modbus server on both RS-485 (RTU) and Ethernet (TCP) once Modbus is enabled for the charger in the cloud configuration. Everything is a holding register. This map covers identity and hardware data, the J1772 and OCPP state, error codes, per-phase current, voltage, power, power factor and energy, the Modbus charging-current limit with its fallback current and timeout and the reset/address registers.
This page lists 53 Modbus registers for the Siemens VersiCharge AC series wallbox (Modbus map) — 7 writable — with the table, 0-based wire address, data type, word order, scale, units and access of each, re-typed from Siemens’s own free documentation (linked below) and checked against it.
- Manufacturer
- Siemens
- Model
- VersiCharge AC series wallbox (Modbus map)
- Equipment type
- EV charger
- Registers
- 53 (7 writable)
- Transport
- Modbus RTU, Modbus TCP
- Default unit ID
- 2
- Default serial
- 38400 baud, 8E1
- TCP port
- 502
- Documented addressing
- Modicon 3xxxx/4xxxx (drop the prefix, subtract 1)
- 32-bit word order
- ABCD high word first (big-endian)
- Firmware
- V2.135 or higher
- Also known as
- VersiCharge, VersiCharge AC
Integration notes: Siemens VersiCharge AC series wallbox (Modbus map)
Poll internal 1599-1602 for state and faults and 1647-1677 for live values with function 3. To manage load, set the fallback current (1660) and fallback time (1661) once after every reboot, then write the charging current limit to 1633 inside that time window.
Minimum registers to map
Addresses are 0-based wire addresses. Enough to monitor and run the unit; map more as the job needs.
| Register | Name | Type | Why | Access |
|---|---|---|---|---|
| HR 1599 | EVSE state | STRING[2] | J1772 charging state | Read |
| HR 1600 | EVSE error code | INT16 | Active fault code | Read |
| HR 1665 | Charging power total | UINT16 | Total charging power | Read |
| HR 1647 | Charging current L1 | UINT16 | Phase L1 current | Read |
| HR 1692 | Real energy consumed | UINT32 ABCD | Energy counter | Read |
| HR 1633 | Charging current limit | UINT16 | Charging current limit (write) | Read/write |
| HR 1660 | Fallback current phase sum | UINT16 | Fallback current | Read/write |
| HR 1661 | Fallback time | UINT16 | Fallback time | Read/write |
Enable Modbus control & writes
The charger must be commissioned (register 27 shows the link used), and the 'Modbus' setting must be True in the charger's VersiCloud group; otherwise the Modbus application does not start.
Communication loss & watchdog
If Modbus traffic stops for the Fallback Time (1661, 0 or 60-600 s), the charger applies the Fallback Current Phase Sum (1660). Both registers reset at power cycle or Modbus soft reset and must be written again.
Byte order & addressing
- Registers are documented as 40001-style external numbers next to internal (wire) numbers; use the internal number in the request.
- Supported functions: 03 read, 06 and 16 write (per register as listed in the map).
- The charging current limit accepts amps or hundredths of amps depending on the size of the value written, but always reads back in amps.
- Dynamic values may take several poll cycles to update after a change.
Network setup
- RTU: 38400 baud, 8 data bits, even parity, 1 stop bit, default address 2 (change at internal 1825, about 20 s to apply; write 1 to 1878 to restore 2).
- TCP: port 502, fixed, IPv4.
- Minimum timeout setting 10 s and minimum poll interval 5 s on both transports.
Watch out for
- A soft reset (write 1 to 1826) restarts the Modbus application, which takes about 60 s to come back.
- Fallback current and fallback time are not persistent; re-write them after every reboot or soft reset.
Siemens VersiCharge AC series wallbox (Modbus map) Modbus registers
Address = 0-based wire address (the documented number is shown under it when it differs) · Order: ABCD = high word first, CDAB = low word first · Scale: engineering value = raw × scale.
| Table | Address | Name | Description | Type | Order | Scale | Units | Access | Values / bits |
|---|---|---|---|---|---|---|---|---|---|
| HR | 0doc 40001 | Manufacturer name | ASCII text, reads Siemens AG. | STRING[10] | Read | ||||
| HR | 5doc 40006 | Production year | Word 1 of the production date (YYYY), taken from the serial number. | UINT16 | Read | ||||
| HR | 7doc 40008 | Serial number | STRING[10] | Read | |||||
| HR | 12doc 40013 | MLFB number | Siemens catalog (order) number as ASCII text. | STRING[20] | Read | ||||
| HR | 22doc 40023 | Platform type | UINT16 | Read | 1 = Residential; 2 = Commercial; 3 = ERK | ||||
| HR | 24doc 40025 | Number of outlets | UINT16 | Read | 1 = 1 outlet; 2 = 2 outlets | ||||
| HR | 25doc 40026 | Type of outlet | Connector type, derived from the catalog number. | UINT16 | Read | 0 = Left: socket type 2; 1 = Left: cable with plug type 2 (7 m); 2 = Left: socket with shutters type 2 - France; 3 = Left: cable with plug type 1 (7 m); 4 = Left: cable with plug type GB/T (6 m); 5 = Front SAE J1772 (20 ft); 6 = Front SAE J1772 (25 ft); 7 = Right: socket type 2; 8 = Right: cable with plug type 2 (7 m); 9 = Right: cover type 2 with shutter and E-plug; 10 = Right: cable with plug type 1 (7 m); 11 = Right: cover type 2 with shutter and F-plug; 12 = Right: cover type 2 with shutter only; 14 = Left and right: socket type 2; 15 = Left and right: cable with plug type 2 (7 m); 16 = Left and right: cover type 2 - France (7 m); 17 = Left and right: cable with plug type 1 (7 m); 18 = Left and right: cable with plug type GB/T (7 m); 19 = CCS1/J1772 (25 ft); 22 = Blocked | |||
| HR | 26doc 40027 | Delay button status | Charging delay chosen with the delay button. | UINT16 | Read | 0 = No delay; 1 = 2 hours delay; 2 = 4 hours delay; 3 = 6 hours delay; 4 = 8 hours delay | |||
| HR | 27doc 40028 | Utilized connectivity stream | Link the charger was commissioned over; Modbus needs a commissioned charger. | UINT16 | Read | 0 = Not commissioned; 1 = Wi-Fi; 2 = Cellular; 3 = Ethernet | |||
| HR | 28doc 40029 | Rated current | Maximum current of the hardware (6-80 A). | UINT16 | A | Read | |||
| HR | 29doc 40030 | Installation current (DIP switch) | Derated current from the amp DIP switch, capped at the rated current. | UINT16 | A | Read | |||
| HR | 30doc 40031 | Meter type | UINT16 | Read | 0 = No metering; 1 = Basic; 2 = ANSI; 3 = MID; 4 = Integrated meter MID; 5 = Eichrechtskonform metering (ERK); 7 = CMC meter; 9 = Onboard CMC; 25 = Blocked | ||||
| HR | 31doc 40032 | A8 firmware version | Main (A8) processor firmware as ASCII text, e.g. 2.135. | STRING[10] | Read | ||||
| HR | 41doc 40042 | Modbus app version | UINT16 | Read | |||||
| HR | 79doc 40080 | RFID authorization status | Read or switch RFID card authorization. | UINT16 | Read/write | 0 = RFID authorization disabled; 1 = RFID authorization enabled | |||
| HR | 1599doc 41600 | EVSE state | J1772 state as two ASCII characters (A1, A2, B1, B2, C1, C2, F). | STRING[2] | Read | ||||
| HR | 1600doc 41601 | EVSE error code | Active charger fault; 0 = no fault. | INT16 | Read | 0 = No fault; 2 = Line phase A under volt; 3 = Line phase B under volt; 4 = Line phase C under volt; 6 = Line phase A over volt; 7 = Line phase B over volt; 8 = Line phase C over volt; 10 = Line phase A zero volt; 11 = Line phase B zero volt; 12 = Line phase C zero volt; 22 = Load phase A zero volt; 23 = Load phase B zero volt; 24 = Load phase C zero volt; 25 = Bad pilot voltage; 26 = Bad amp switch position; 27 = ADC fault; 28 = Static memory fault; 29 = CCID fault; 30 = CCID self test fault; 35 = EEPROM rw fault; 36 = FRAM rw fault; 37 = Metering chip rw fault; 38 = CCID close ON fault; 40 = Connector lock fault; 41 = Cable max temperature fault; 42 = Welded contact phase A fault; 43 = Welded contact phase B fault; 44 = Welded contact phase C fault; 45 = Diode fault; 46 = Ground monitoring fault; 47 = On-board temperature fault; 48 = Over current fault | |||
| HR | 1601doc 41602 | OCPP state | Connector status from the OCPP backend; reads 1 when no backend is connected. | UINT16 | Read | 1 = Available; 2 = Preparing; 3 = Charging; 4 = Suspended EV; 5 = Suspended EVSE; 6 = Faulted; 7 = Finishing | |||
| HR | 1602doc 41603 | PCBA temperature | Board temperature. | INT16 | °C | Read | |||
| HR | 1633doc 41634 | Charging current limit | Modbus current limit; reads back in whole amps (0-80), see notes for writing. | UINT16 | A | Read/write | |||
| HR | 1642doc 41643 | Charger phase | UINT16 | Read | 0 = 1-phase charger; 1 = 3-phase charger | ||||
| HR | 1647doc 41648 | Charging current L1 | UINT16 | A | Read | ||||
| HR | 1648doc 41649 | Charging current L2 | 3-phase chargers only. | UINT16 | A | Read | |||
| HR | 1649doc 41650 | Charging current L3 | 3-phase chargers only. | UINT16 | A | Read | |||
| HR | 1650doc 41651 | Average charging current | UINT16 | A | Read | ||||
| HR | 1651doc 41652 | Charging voltage L1-N | UINT16 | V | Read | ||||
| HR | 1652doc 41653 | Charging voltage L2-N | 3-phase chargers only. | UINT16 | V | Read | |||
| HR | 1653doc 41654 | Charging voltage L3-N | 3-phase chargers only. | UINT16 | V | Read | |||
| HR | 1654doc 41655 | Charging voltage L1-L2 | 3-phase chargers; reads 0 on the ERK variant. | UINT16 | V | Read | |||
| HR | 1655doc 41656 | Charging voltage L2-L3 | 3-phase chargers; reads 0 on the ERK variant. | UINT16 | V | Read | |||
| HR | 1656doc 41657 | Charging voltage L3-L1 | 3-phase chargers; reads 0 on the ERK variant. | UINT16 | V | Read | |||
| HR | 1660doc 41661 | Fallback current phase sum | Current used when Modbus is lost for the fallback time; not persistent. | UINT16 | A | Read/write | |||
| HR | 1661doc 41662 | Fallback time | 0 or 60-600 s of Modbus silence before the fallback current applies; not persistent. | UINT16 | s | Read/write | |||
| HR | 1662doc 41663 | Charging power L1 | Active power, phase 1. | UINT16 | W | Read | |||
| HR | 1663doc 41664 | Charging power L2 | 3-phase chargers only. | UINT16 | W | Read | |||
| HR | 1664doc 41665 | Charging power L3 | 3-phase chargers only. | UINT16 | W | Read | |||
| HR | 1665doc 41666 | Charging power total | Total active power (use this on 1-phase chargers). | UINT16 | W | Read | |||
| HR | 1666doc 41667 | Power factor L1 | UINT16 | × 0.001 | Read | ||||
| HR | 1667doc 41668 | Power factor L2 | 3-phase chargers only. | UINT16 | × 0.001 | Read | |||
| HR | 1668doc 41669 | Power factor L3 | 3-phase chargers only. | UINT16 | × 0.001 | Read | |||
| HR | 1669doc 41670 | Average power factor | Average of the three phases on 3-phase chargers. | UINT16 | × 0.001 | Read | |||
| HR | 1670doc 41671 | Apparent power L1 | UINT16 | VA | Read | ||||
| HR | 1671doc 41672 | Apparent power L2 | 3-phase chargers only. | UINT16 | VA | Read | |||
| HR | 1672doc 41673 | Apparent power L3 | 3-phase chargers only. | UINT16 | VA | Read | |||
| HR | 1673doc 41674 | Apparent power total | UINT16 | VA | Read | ||||
| HR | 1674doc 41675 | Reactive power L1 | INT16 | var | Read | ||||
| HR | 1675doc 41676 | Reactive power L2 | 3-phase chargers only. | INT16 | var | Read | |||
| HR | 1676doc 41677 | Reactive power L3 | 3-phase chargers only. | INT16 | var | Read | |||
| HR | 1677doc 41678 | Reactive power total | UINT16 | var | Read | ||||
| HR | 1692doc 41693 | Real energy consumed | Total delivered energy counter. | UINT32 | ABCD | Wh | Read | ||
| HR | 1825doc 41826 | RTU slave address | Modbus RTU address 1-247; takes about 20 s to apply. | UINT16 | Read/write | ||||
| HR | 1826doc 41827 | Reboot charger | UINT16 | Write | 1 = Soft reset (Modbus application); 2 = Hard reset (A8 board) | ||||
| HR | 1878doc 41879 | Reset RTU slave address | Write 1 to restore the default RTU address 2. | UINT16 | Write | 1 = Reset to default address |
Notes on this map
- The energy counter (1692) is marked 'Uint32 (Big-endian)' in the map, so the high word comes first (ABCD).
- Charging current limit (internal 1633): written values of 100 or less are whole amps, values 101-8000 are hundredths of an amp (write 6 or 600 for 6 A, 850 for 8.5 A). A read always returns whole amps in the 0-80 range. Values above 8000 are rejected, and anything under 6 A pauses charging. Other limits (OCPP smart charging, cloud power level) still apply on top.
- Left out: the charging session energy target (internal 1640). Its units column says watt-hours but its description talks about kWh, so the scale cannot be settled from the map.
- Production date (5-6): only the first word (year) is listed; the second packs month and day as two bytes.
- Not listed: the five-register firmware strings for the M0 processor, the firmware variant and release-date strings, RFID card add/remove and whitelist blocks (40081-40338, 41853-41878) and the factory-reset salt/command registers, which are marked for internal use.
- The map warns that when the charger is controlled by OCPP, Modbus is mainly a monitoring interface.
Check it against the live device. A register map tells you what the controller can expose; the unit in front of you may differ by firmware or options. Read a few registers and compare them with the unit’s own display; for a 32-bit value the float and byte-order decoder shows all four word orders at once, so a wrong word order or scale is obvious. New to this? Read what a register map is and why addresses are off by one.
Questions about the Siemens VersiCharge AC series wallbox (Modbus map)
What Modbus registers does the Siemens VersiCharge AC series wallbox (Modbus map) have?
This map lists 53 registers: 53 holding registers. 7 of them can be written. Registers vary with firmware, options and configuration, so confirm against the device.
Are the Siemens VersiCharge AC series wallbox (Modbus map) Modbus addresses 0-based or 1-based?
The manufacturer's document numbers registers Modicon 3xxxx/4xxxx (drop the prefix, subtract 1). Every address on this page is the 0-based wire address you put in the request; the documented number is shown under it where it differs. The map prints every register four ways: 'external' decimal (40001 style), 'internal' decimal, and both in hex. External 40001 is internal 0, so the internal number is the wire address: external 41634 = internal 1633 = 0x661. 'documented' below is the external number; 'address' is the internal one. The map's own notes mix the two (it cites both 'register 1633' and 'register 41661'), so check which one is meant.
What byte order does the Siemens VersiCharge AC series wallbox (Modbus map) use for 32-bit values?
Multi-register values in this map use ABCD (high word first (big-endian)). Set your client to this order for every 32/64-bit value in the table.
What are the minimum Modbus registers to integrate the Siemens VersiCharge AC series wallbox (Modbus map)?
Start with HR 1599 EVSE state (J1772 charging state); HR 1600 EVSE error code (Active fault code); HR 1665 Charging power total (Total charging power); HR 1647 Charging current L1 (Phase L1 current); HR 1692 Real energy consumed (Energy counter); HR 1633 Charging current limit (Charging current limit (write)); HR 1660 Fallback current phase sum (Fallback current); HR 1661 Fallback time (Fallback time).
How do I enable Modbus control of the Siemens VersiCharge AC series wallbox (Modbus map)?
The charger must be commissioned (register 27 shows the link used), and the 'Modbus' setting must be True in the charger's VersiCloud group; otherwise the Modbus application does not start.
What happens when the Siemens VersiCharge AC series wallbox (Modbus map) loses Modbus communication?
If Modbus traffic stops for the Fallback Time (1661, 0 or 60-600 s), the charger applies the Fallback Current Phase Sum (1660). Both registers reset at power cycle or Modbus soft reset and must be written again.
Where is the official Siemens VersiCharge AC series wallbox (Modbus map) Modbus documentation?
The source is VERSICHARGE AC SERIES ModBus Map (A5E52200882-AJ), revision 2024-06, published free by Siemens at https://cache.industry.siemens.com/dl/files/359/109814359/att_1291322/v1/versicharge_wallbox_modBus_map_en-US.pdf.
More Siemens Modbus register maps
- Energy meter
Siemens SENTRON PAC2200
SENTRON 7KM PAC2200 Modbus TCP and Modbus RTU variants (5 A and 65 A), per Equipment Manual 12/2022.
Also known as: 7KM PAC2200 - Power meter
Siemens SENTRON PAC3200
SENTRON PAC3200 (7KM2111/7KM2112), Ethernet port and optional PAC RS485 expansion module, per manual edition 02/2008.
Also known as: 7KM2112-0BA00-2AA0, 7KM2112-0BA00-3AA0, 7KM2111-1BA00-3AA0, 7KM PAC3200 - Variable frequency drive
Siemens SINAMICS G120 / G120C (Modbus RTU)
SINAMICS G120 with an RS485 Control Unit (CU230P-2 HVAC/BT, CU240B-2, CU240E-2 / -2 F, CU250S-2), G120C USS/MB and G110M CU240M USS, firmware V4.7, per Fieldbuses function manual A5E34229197B AA. Not SINAMICS G120X, which has its own documentation.
Also known as: G120C USS/MB, CU230P-2 HVAC, CU230P-2 BT, CU240B-2, CU240E-2, CU240E-2 F, CU250S-2, G110M CU240M USS, G120P - Variable frequency drive
Siemens SINAMICS V20 inverter (Modbus RTU)
SINAMICS V20 basic inverters (1AC 230 V 6SL3210-5BB.. and 3AC 400 V 6SL3210-5BE..) using the built-in RS485 port with P2023 = 2 (Modbus), per operating instructions A5E34559884-006 (11/2016).
Also known as: V20, 6SL3210-5BB, 6SL3210-5BE
Source: VERSICHARGE AC SERIES ModBus Map · A5E52200882-AJ · rev. 2024-06. Register numbers, types, scaling and units are reproduced as published; descriptions are our own.