Modbus IP — configuration and status monitoring

Connection parameters

The EZF controller is a Modbus TCP server; the BMS or tester is the client. This guide describes register map v1, available from firmware 10.38.

Parameter	Value
Host	Current controller IP address
Port	502
MBAP Protocol ID	0
Concurrent clients	Maximum 2
Read	FC03 or FC04, 1–125 registers
Write command	FC16, exactly 7 registers starting at 0x0100
Word	16 bits, big endian
uint32	Most significant word first
Addresses in this guide	Zero based, without the 4xxxx prefix

An idle connection may close after 3 seconds; the client must be able to reconnect. Modbus has no authentication. Restrict access to a trusted monitoring network.

Enable it on the controller

1. Open Settings → External communication and enable Modbus TCP. Appropriate access rights are required; exact menu wording depends on the display version.
2. When using the local web settings, confirm saving with the service PIN. Controller access codes →
3. Wait for the scheduled restart and for the controller to return.
4. Enter its IP, port 502 and an appropriate Unit ID in the tester.
5. Read its identity: register 0 should be 0x455A, and register 1 should show map version 1.
6. Read the luminaire list and compare it with the controller. Do not enable remote tests for monitoring alone.

TCP, RTU and remote test permission are disabled by default. In luminaire test results, TCP also denotes the duration/autonomy test; distinguish this from the Modbus TCP network transport.

First reads

HEX address (decimal)	Words	Contents
0x0000 (0)	2	Signature and map version
0x0002 (2)	1	Controller status flags
0x0007 (7)	1	Remote tests permitted: 0/1
0x0008 (8)	2	Uptime in seconds
0x0010 (16)	2	Current boot identifier
0x0020 (32)	16	ASCII serial number, 2 characters per word
0x0100 (256)	8	Last job and its state
0x0200 (512)	16	AirBus group A; B=0x0210, C=0x0220, D=0x0230

Register 0x0002 flags: bit 0 fault, 1 communication error, 2 inhibition, 3 search, 4 initialisation/configuration, 5 FRAM memory error. Do not enter register 0 as 40001 unless your client explicitly converts 4xxxx notation to zero-based addresses.

Luminaire map

BUS1 starts at 0x1000 (200 slots), BUS2 at 0x3000 (200) and AirBus at 0x5000 (500). Each slot occupies 16 words. Slot i, counting from 1, starts at base + 16 × (i−1). A slot is a list position, not a physical luminaire address. All words in an empty slot are zero.

Slot offset	Contents
0 / 1 / 2	Channel / physical address / present: 0 or 1
3–7	Status bytes D1–D5
8 / 9	TF / duration test: 0 unknown, 1 running, 2 OK, 3 fault
10	Communication error 0/1
11 / 12	Luminaire type / group
13	NVG: LED1 in bits 0–1, LED2 in bits 8–9; other types 0xFFFF
14	Luminaire inhibition 0/1
15	Confirmed AirBus result: 0 OK; bits 0x20 battery/duration, 0x40 LED/current, 0x80 communication

A result of 0xFFFF means unknown, stale or wired luminaire — not a pass. When a FRAM error is reported, some status fields may be unconfirmed even if the list can still be read. Live reads do not replace archived test reports.

Remote AirBus test

Read first. Then allow remote tests locally on the controller and confirm write access, serial number and the individual command in the tester. This map controls AirBus luminaires and groups. BUS1/BUS2 provide monitoring; attempting to start a wired luminaire test returns exception 01.

FC16 writes exactly seven words starting at 0x0100:

Words	Meaning
0–1	Nonzero, increasing uint32 job ID
2	1 = TF, 2 = duration test, 3 = STOP
3	0 = individual AirBus luminaire, 1 = AirBus group
4–5	Luminaire UID or group number 0–3 (A–D)
6	Confirmation marker 0xA55A

Example: TF for AirBus 42, UID=196650, job 1: 0000 0001 0001 0000 0003 002A A55A.

UID = channel × 65536 + address. Check the current UID before sending. A common supervisory system should assign job IDs for both transports. Repeating an identical ID and command does not start a second test; changing the payload for that ID is an error.

After FC16 is accepted, read 0x0100–0x0107. State 1 = queued, 2 = accepted/running, 3 = results collected, 4 = rejected, 5 = STOP accepted. State 3 does not mean every luminaire passed. Check individual results and group counters. State 5 does not prove every luminaire received STOP. After a restart, read the boot identifier and current state; do not automatically replay an old command.

Errors and diagnostics

Exception	Meaning	Action
01	Unsupported function	Check FC and supported channel
02	Invalid address	Check zero-based address and range
03	Invalid data	Check all 7 words, ID, UID and marker
04	Device error / unavailable data	Check controller messages; do not display OK
06	Busy	Command was not accepted; retrying the same ID is allowed

For connection problems, check IP, port, TCP enablement, restart, firewall and the client limit. Save TX/RX telegrams and JSON/CSV exports from the tester.

Optional: Modbus RTU

RTU uses the same map: 19200 bit/s, 8E1, address 1–247, default 1. It requires a free BUS1 or BUS2 without stored luminaires. Do not mix Modbus RTU and the EZF luminaire protocol on the same port. Broadcast address 0 executes no commands.

See Windows/macOS testers and local exercises.