User’s Manual – Modbus
EMX-IP – User Interface and Modbus
Communications Guide
Senva Sensors
1825 NW 167th PL
Beaverton, OR 97006

154-0050-0A

EMX-IP User Interface and Modbus

Rev.	Release Date	By	Description of Change	ECR
0A	10/14/2024	CJL	Initial Release	01350
				—
				—
				—

Copyright ©2025. All rights reserved. This document contains Senva Sensors proprietary information and may not be reproduced or distributed without written permission.

See Also:
152-0430 EMX-IP Installation Instructions
154-0049 EMX-IP BACnet Protocol Guide
154-0051 EMX-IP Navigation Guide

Display Navigation

Congratulations on installing your new Senva EMX-IP energy meter! This Modbus Protocol Guide assumes the first stage of installation is complete, with the meter and any CTs connected and powered. The OLED display should show the home screen when any
button is pressed. If not, refer to the separate Installation Instructions before continuing.
Now, only the network configuration remains between you and the data.
From any screen, press the ENTER button to access the settings menu.
You can make selections using the UP and DOWN arrows and then pressing ENTER to proceed to that menu or setting.
From any menu, press the ESC button to go back one menu.

To change a value, use the UP and DOWN arrows to set each digit and the ENTER button to move the cursor left.
Once each digit has been set, hit ENTER a final time to return to the previous menu.
To abandon changes at any time, you may hit ESC.

Setup Registers and Parameters

Setup registers and parameters are available in 5 groups in the settings menu using the display or they may also be accessed using Modbus communications.

Settings
Settings are available in the following groups on the display. A parameter list is provided in the following sections.

• Metering – Adjust metering parameters such as voltage and current scaling, phase sequencing, and display units.
• Pulse Config – Read the count of the two pulse inputs.
• Communications – See IPv4 and IPv6 values.
• Alarms – Enable or disable alarms and set trip points.
• Real-Time Clock – Set the date and time.
• Logging – Enable or disable logging as well as setting trigger source and what is logged.
• Passcode – Choose a passcode to lock device.
• Advanced – View firmware versions or initiate a factory reset.

The following sections detail how to adjust settings over the Modbus interface. All settings are stored in non-volatile memory. Stored values will not be lost if the meter experiences a power loss.

R/W:
R = Readable Only
R/W = Read and writeable

Type, Min, Max:

ENUM = UINT16 16-bit unsigned integer that maps to a defined list of values
U8 = UINT8 8-bit unsigned integer; 0 to 1
U16 = UINT16 16-bit unsigned integer; min/max values listed
I16 = INT16 16-bit integer; -768 to 768

Scale:
Values must be multiplied by this scale factor to be read correctly. 15 * 0.1 = 1.5. When writing the value should be divided by the scale before being written. 1.5 / 0.1 = 15.
Modbus Function Codes:
The EMX setting registers support the following Modbus function codes:

• 0x03 Read Holding Registers
• 0x04 Read Input Register
• 0x06 Read Single Holding Register
• 0x10 Write Multiple Holding Registers

Metering

Description		Reg.	R/W	Type	Min	Max	Default	Scale	Units
Phase Configuration	0-3PH ABCN, 1-3PH ABC, 2-1PH ABN, 3-1PH AB, 4-SplitPH ABN	2000	R/W	ENUM	0	4	0	N/A	N/A
Current Element	0-Current Transformer, 1-Rogowski Coil	2001	R/W	ENUM	0	1	0	N/A	N/A
Current Scale	See note 1	2002	R/W	U16	10	60000	10	0.1	Amps per 0.333 Volts
Current Orientation	For phases A, B, C: 0-  +, +, + 1-  +, +, – 2-  +, -, + 3-  +, -, – 4-  -, +, + 5-  -, +, – 6-  -, -, + 7-  -, -, –	2003	R/W	ENUM	0	7	0	N/A	N/A
Voltage Scale	See note 2	2004	R/W	U16	10	32000	100	0.01	Unitless
Display Units	0- IEC Units, 1- IEEE Units	2005	R/W	ENUM	0	1	1	N/A	N/A

1. Current scale is the primary side current of a 0.333V CT. CTs with an output voltage exceeding 0.333V should not be used. For a CT ratio of 20A / 0.333 V this will be 20.0 * 10 = 200. If a Rogowski coil is installed this value will need to be calculated from the coils mV/1000A rating. Rogowski conversion is calculated by (333.33 mV / x mV) *1000A * 10(scale).
2. Voltage scale is the PT ratio expressed as a decimal and multiplied by 100. A potential transformer of 25:10 would give a ratio of 25 / 10 = 2.5, appropriately scaled it would be 2.5*100 = 250.

Alarms

Description		Reg.	R/W	Type	Min	Max	Default	Scale	Units
Alarm – Voltage Out of Range Enable	0-Disable 1-Enable	2016	R/W	ENUM	0	1	0	N/A	N/A
Alarm – Voltage Out of Range Nominal	Set nominal L-L voltage for out-of- range alarm, least significant digit is 1/10th of a Volt.	2017	R/W	U16	10	60000	2400	0.1	Volts
Alarm – Voltage Out of Range Threshold	The percent above or below the nominal voltage setting (2017) at which a fault will trigger.	2018	R/W	U16	1	20	10	1	%
Alarm – Current Out of Range Enable	0-Disable 1-Enable	2019	R/W	ENUM	0	1	0	N/A	N/A
Alarm – Current Out of Range Nominal	Set nominal current for out-of- range alarm, least significant digit is 1/10th of an Amp.	2020	R/W	U16	10	60000	50	0.1	Amps
Alarm – Current Out of Range Threshold	The percent above or below the nominal current setting (2020) at which a fault will trigger.	2021	R/W	U16	1	20	10	1	%
Alarm Ground Current Out of Range Enable	0-Disable 1-Enable	2022	R/W	ENUM	0	1	0	N/A	N/A
Alarm Ground Current Out of Range Nominal	Set nominal ground current for out-of-range alarm, least significant digit is 1/10th of an Amp.	2023	R/W	U16	10	60000	50	0.1	Amps
Alarm Ground Current Out of Range Threshold	The percent above the nominal ground current setting (2023) which a fault will trigger.	2024	R/W	U16	1	20	10	1	%
Alarm Frequency Out of Range Enable	0-Disable 1-Enable	2025	R/W	ENUM	0	1	1	N/A	N/A
Alarm Frequency Out of Range Nominal	Set nominal frequency for out- of-range alarm, least significant digit is 1/100th of a Hertz.	2026	R/W	U16	450	650	600	0.1	Hz
Alarm Frequency Out of Range Threshold	The percent above or below the nominal frequency setting (2026) at which a fault will trigger.	2027	R/W	U16	1	20	10	1	%
Alarm Voltage Phase Loss Enable	0-Disable 1-Enable	2028	R/W	ENUM	0	1	1	N/A	N/A
Alarm Voltage Phase Loss Threshold	A phase-to-phase comparison of L-N voltages is performed. If any phase’s L-N voltage is below the others by the threshold amount, a fault will trigger. Only applicable to 3Φ configurations (ABC or ABCN). Single phase installations will power off during phase loss event.	2029	R/W	U16	1	20	10	1	%
Alarm Voltage Phase Imbalance Enable	0-Disable, 1-Enable	2030	R/W	ENUM	0	1	1	N/A	N/A
Alarm Voltage Phase Imbalance Threshold	The percent of phase-to-phase imbalance above which a fault will trigger. For a three-phase Y system, both VL-L and VL-N are examined. For a three-phase delta, only VL-L measurements are compared. In a single split- phase, only VL-N are compared.	2031	R/W	U16	1	20	10	1	%
Alarm Power Factor Low Enable	0-Disable 1-Enable	2032	R/W	ENUM	0	1	1	1	N/A
Alarm Power Factor Low Threshold	Set the (unitless) PF value, below which a fault will trigger.	2033	R/W	U16	1	99	50	0.01	Unitless

Advanced 

Description		Reg.	R/W	Type	Min	Max	Default
Reset Wh	Writing 1 will reset all the stored Wh, VAh and VARh values.	2034	R/W	U16	0	1	0
Count of Wh Resets	Number of times the Wh has been reset.	2035	R	U16	0	65535	0
Reset Run time	Writing 1 will reset the system run time (37 and 38), but not the system power on time (35 and 36).	2036	R/W	U16	0	1	0
Count of run time Resets	Number of times the system run time has been reset.	2037	R	U16	0	65535	0
Reset Pulse Counts	Writing 1 will reset the pulse input counters (41 through 44).	2038	R/W	U16	0	1	0
Reboot EMX	Reboots the EMX. When written, this point may not give a response or may return an error due to the reset process. The point will still accept the value.	2042	R/W	U8	0	1	0
Reset Log Content	Writing a 1 value to this register reset all the stored log entries. This will break communications and display connection for approx. 25 seconds. Do not remove power during this update. When written, this point may not give a response or may return an error due to the reset process. The point will still accept the value.	2043	R/W	U16	0	1	0
Phase Angle Compensation		2044	R/W	I16	-768	768	0
Passcode	Set display passcode	2045	R/W	U16	0	9999	0

Metering Registers

The following table describes each of the power and energy readings provided over Modbus from the device.

R/W:
R = Read Only
R/W = Read and Write

Type, Min, Max:
ENUM = UINT16 16-bit unsigned integer that maps to a defined list of values
U8 = UINT8 8-bit unsigned integer; 0 to 255, unless otherwise noted
U16 = UINT16 16-bit unsigned integer; 0 to 65535 (0xFFFF), unless otherwise noted
I16 = INT16 16-bit integer; -32768 to 32767, unless otherwise noted
U32 = UINT32 32-bit unsigned integer; 0 to 4294967295 (0xFFFFFFFF), unless otherwise noted
U64 = UINT64 64-bit unsigned integer; 0 to 18.466e+18
I64 = INT64 64-bit signed integer; -9.233e+18 to 9.233e+18

Scale: 
Values must be multiplied by this scale factor to be read correctly. For some power, current, and voltage readings, the scale factor will be automatically set based on the user settings for voltage and current scale. These multipliers can be read in registers 030-032.
Store: 
Values marked “yes” will be stored in non-volatile memory. Stored values will not be lost if the meter experiences a power loss.

Modbus Function Codes:
The EMX metering registers support the following Modbus function codes:

• 0x03 Read Holding Registers
• 0x04 Read Input Register

Some registers span multiple Modbus addresses. Two consecutive registers defined as XXX/YYY indicates a pair of aligned registers, that must be merged into a 32-bit value.
Four consecutive registers require merging the results into a 64-bit value. See data type conversions section for more information and examples.

Description		Reg.	R/W	Type	Min	Max	Scale	Units	Store
V-LN Average		001	R	U16	0	65535	V-scale	V(rms)	No
V-LL Average		002	R	U16	0	65535	V-scale	V(rms)	No
Current Average		003	R	U16	0	65535	I-scale	A(rms)	No
Current Sum		004	R	U16	0	65535	I-scale	A(rms)	No
Real power total		005	R	I16	-32768	32767	P-scale	W	No
Reactive power total		006	R	I16	-32768	32767	P-scale	VAR	No
Apparent power total		007	R	I16	-32768	32767	P-scale	VA	No
V-LN Phase A		008	R	U16	0	65535	V-scale	V(rms)	No
V-LN Phase B		009	R	U16	0	65535	V-scale	V(rms)	No
V-LN Phase C		010	R	U16	0	65535	V-scale	V(rms)	No
V-LL Phase A-B		011	R	U16	0	65535	V-scale	V(rms)	No
V-LL Phase B-C		012	R	U16	0	65535	V-scale	V(rms)	No
V-LL Phase C-A		013	R	U16	0	65535	V-scale	V(rms)	No
Current Phase A		014	R	U16	0	65535	I-scale	A(rms)	No
Current Phase B		015	R	U16	0	65535	I-scale	A(rms)	No
Current Phase C		016	R	U16	0	65535	I-scale	A(rms)	No
Power Factor Phase A		017	R	I16	-1000	1000	0.001	Unitless	No
Power Factor Phase B		018	R	I16	-1000	1000	0.001	Unitless	No
Power Factor Phase C		019	R	I16	-1000	1000	0.001	Unitless	No
Frequency (Phase A)		020	R	U16	480	620	0.1	Hz	No
Real power Phase A		021	R	I16	32768	32767	P-scale	W	No
Real power Phase B		022	R	I16	32768	32767	P-scale	W	No
Real power Phase C		023	R	I16	32768	32767	P-scale	W	No
Reactive power Phase A		024	R	I16	32768	32767	P-scale	VAR	No
Reactive power Phase B		025	R	I16	32768	32767	P-scale	VAR	No
Reactive power Phase C		026	R	I16	32768	32767	P-scale	VAR	No
Apparent power Phase A		027	R	I16	32768	32767	P-scale	VA	No
Apparent power Phase B		028	R	I16	32768	32767	P-scale	VA	No
Apparent power Phase C		029	R	I16	32768	32767	P-scale	VA	No
Voltage Scale Factor (V-scale)	-4:0.0001 -3:0.001 -2:0.01 -1:0.1 0:1 1:10 2:100 3:1000 4:10000 5:100000 6:1000000	030	R	I16	-2	2	1	N/A	No
Current Scale Factor (I-scale)		031	R	I16	-3	1	1	N/A	No
Power Scale Factor (P-scale)		032	R	I16	-4	6	1	N/A	No

Description		Reg.	R/W	Type	Min	Max	Scale	Units	Store
Alarm Status Bitfield	Bit 0: Pulse configuration error Bit 1: Pulse overrun error Bit 2: Voltage out of range Bit 3: Current out of range Bit 4: Current sum (neutral current) out of range Bit 5: Freq. out of range Bit 6: Voltage phase loss Bit 7: Voltage phase unbalance Bit 8: Power factor low Bit 9: Accumulator loss Bit 10: RTC error Bit 11: Logs full Bit 12: Meter settings error Bit 13 – 15: Reserved	033	R	U16	0	0xFFFF	1	N/A	No
Load Status	0: No load detected 1: Load above threshold	034	R	ENUM	0	1	1	N/A	No
System power on time		035 036	R	U32	0	4294967295	1	Seconds	Yes
System run time		037 038	R	U32	0	4294967295	1	Seconds	Yes
Power Reset Count		039 040	R	U32	0	4294967295	1	N/A	Yes
Pulse Count 1		041 042	R	U32	0	4294967295	1	N/A	Yes
Pulse Count 2		043 044	R	U32	0	4294967295	1	N/A	Yes
Real Net Energy total		045 046 047 048	R	I64	-9.233e+18	9.233e+18	0.00000001	Wh	Yes
Real Net Energy Phase A		049 050 051 052	R	I64	-9.233e+18	9.233e+18	0.00000001	Wh	Yes
Real Net Energy Phase B		053 054 055 056	R	I64	-9.233e+18	9.233e+18	0.00000001	Wh	Yes

Description	Reg.	R/W	Type	Min	Max	Scale	Units	Store
Real Net Energy Phase C	057 058 059 060	R	I64	-9.233e+18	9.233e+18	0.00000001	Wh	Yes
Reactive Net Energy total	061 062 063 064	R	I64	-9.233e+18	9.233e+18	0.00000001	VARh	Yes
Reactive Net Energy Phase A	065 066 067 068	R	I64	-9.233e+18	9.233e+18	0.00000001	VARh	Yes
Reactive Net Energy Phase B	069 070 071 072	R	I64	-9.233e+18	9.233e+18	0.00000001	VARh	Yes
Reactive Net Energy Phase C	073 074 075 076	R	I64	-9.233e+18	9.233e+18	0.00000001	VARh	Yes
Apparent Net Energy total	077 078 079 080	R	I64	-9.233e+18	9.233e+18	0.00000001	VAh	Yes
Apparent Net Energy Phase A	081 082 083 084	R	I64	-9.233e+18	9.233e+18	0.00000001	VAh	Yes
Apparent Net Energy Phase B	085 086 087 088	R	I64	-9.233e+18	9.233e+18	0.00000001	VAh	Yes
Apparent Net Energy Phase C	089 090 091 092	R	I64	-9.233e+18	9.233e+18	0.00000001	VAh	Yes
Real Import Energy total	093 094 095 096	R	U64	0	18.446e+18	0.00000001	Wh	Yes
Real Import Energy Phase A	097 098 099 100	R	U64	0	18.446e+18	0.00000001	Wh	Yes
Real Import Energy Phase B	101 102 103 104	R	U64	0	18.446e+18	0.00000001	Wh	Yes
Real Import Energy Phase C	105 106 107 108	R	U64	0	18.446e+18	0.00000001	Wh	Yes

Description	Reg.	R/W	Type	Min	Max	Scale	Units	Store
Reactive Import Energy total	109 110 111 112	R	U64	0	18.446e+18	0.00000001	VARh	Yes
Reactive Import Energy Phase A	113 114 115 116	R	U64	0	18.446e+18	0.00000001	VARh	Yes
Reactive Import Energy Phase B	117 118 119 120	R	U64	0	18.446e+18	0.00000001	VARh	Yes
Reactive Import Energy Phase C	121 122 123 124	R	U64	0	18.446e+18	0.00000001	VARh	Yes
Apparent Import Energy total	125 126 127 128	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Apparent Import Energy Phase A	129 130 131 132	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Apparent Import Energy Phase B	133 134 135 136	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Apparent Import Energy Phase C	137 138 139 140	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Real Export Energy total	141 142 143 144	R	U64	0	18.446e+18	0.00000001	Wh	Yes
Real Export Energy Phase A	145 146 147 148	R	U64	0	18.446e+18	0.00000001	Wh	Yes
Real Export Energy Phase B	149 150 151 152	R	U64	0	18.446e+18	0.00000001	Wh	Yes
Real Export Energy Phase C	153 154 155 156	R	U64	0	18.446e+18	0.00000001	Wh	Yes
Reactive Export Energy total	157 158 159 160	R	U64	0	18.446e+18	0.00000001	VARh	Yes

Description	Reg.	R/W	Type	Min	Max	Scale	Units	Store
Reactive Export Energy Phase A	161 162 163 164	R	U64	0	18.446e+18	0.00000001	VARh	Yes
Reactive Export Energy Phase B	165 166 167 168	R	U64	0	18.446e+18	0.00000001	VARh	Yes
Reactive Export Energy Phase C	169 170 171 172	R	U64	0	18.446e+18	0.00000001	VARh	Yes
Apparent Export Energy total	173 174 175 176	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Apparent Export Energy Phase A	177 178 179 180	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Apparent Export Energy Phase B	181 182 183 184	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Apparent Export Energy Phase C	185 186 187 188	R	U64	0	18.446e+18	0.00000001	VAh	Yes
Meter Time Since Boot	189 190	R	U32	0	4294967295	1	Seconds	No

Real-Time Clock Registers

Description		Reg.	R/W	Type	Min	Max	Scale	Units	Store
RTC – Set Year		4000	R/W	U16	2022	2060	1	N/A	No
RTC – Set Month		4001	R/W	U8	1	12	1	N/A	No
RTC – Set Day of Month		4002	R/W	U8	1	31	1	N/A	No
RTC – Set Day of Week		4003	R/W	ENUM	0	6	1	N/A	No
RTC – Set Hours		4004	R/W	U8	0	23	1	Hrs	No
RTC – Set Minutes		4005	R/W	U8	0	59	1	Mins	No
RTC – Set Seconds		4006	R/W	U8	0	23	1	Secs	No
RTC – Commit time		4007	R/W	ENUM	0	1	1	N/A	Yes
RTC – Current Year		4100	R	U16	2022	2060	1	N/A	Yes
RTC – Current Month		4101	R	U8	1	12	1	N/A	Yes
RTC – Current Day of Month		4102	R	U8	1	31	1	N/A	Yes
RTC – Current Day of Week	0 = Sunday 6 = Saturday	4103	R	ENUM	0	6	1	N/A	Yes
RTC – Current Hours		4104	R	U8	0	0	1	Hrs	Yes
RTC – Current Minutes		4105	R	U8	0	0	1	Mins	Yes
RTC – Current Seconds		4106	R	U8	0	0	1	Secs	Yes
RTC – Current AM/PM Flag, or 0	If in 24-hour mode, will return 0, if in 12-hour mode: 1 = AM, 2 = PM	4107	R	ENUM	0	2	1	N/A	Yes

Logging Registers

Log Source 1 through Log source 12 sets the source for the logging. Write the Modbus register 1-190 to the desired source to log that point. If a log source register has multiple registers all registers need to be set. For example, if Real Net Energy total is desired to be logged all four registers need to be set.
To trigger a log event register 5000 (Logging – Trigger Source) needs to be set to the desired trigger mode, by default it is set to be disabled. Logging can be triggered with the timer, set on Modbus point 5001 (Logging – Trigger Interval) in seconds from 15-3600. Triggering can be set over COMMS by writing a ‘1’ to point 5015 (Logging – Trigger log creation), or Pulse In 1 or 2 can be set to trigger a log whenever a pulse is detected.

Description		Reg.	R/W	Type	Min	Max	Scale	Units	Store
Logging – Trigger Source	0 = Disabled 1 = Timer 2 = Comms 3 = Pulse In 1 4 = Pulse in 2	5000	R/W	ENUM	0	4	1	N/A	Yes
Logging – Trigger Interval		5001	R/W	U16	15	3600	1	Secs	Yes
Logging – Mode Select	0  – “Continuous” – continue logging and overwrite old entries, sequentially 1  – “One Shot” – log until EEPROM is full, then stop logging and throw alarm	5002	R/W	ENUM	0	1	1	N/A	Yes
Logging – Log Source 1		5003	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 2		5004	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 3		5005	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 4		5006	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 5		5007	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 6		5008	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 7		5009	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 8		5010	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 9		5011	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 10		5012	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 11		5013	R/W	U16	1	190	1	N/A	Yes
Logging – Log Source 12		5014	R/W	U16	1	190	1	N/A	Yes
Logging – Trigger log creation		5015	R/W	U16	0	1	1	N/A	Yes
Logging – Read log at index		5016	R/W	U16	0	4096	1	N/A	Yes
Logging – Oldest Index		5100	R	U16	0	4096	1	N/A	Yes
Logging – Count of log entries		5101	R	U16	0	4096	1	N/A	Yes
Logging – Current Index		5102	R	U16	0	4096	1	N/A	Yes
Logging – Log data 1		5103	R	U16	0	65535	1	N/A	Yes
Logging – Log data 2		5104	R	U16	0	65535	1	N/A	Yes
Logging – Log data 3		5105	R	U16	0	65535	1	N/A	Yes
Logging – Log data 4		5106	R	U16	0	65535	1	N/A	Yes
Logging – Log data 5		5107	R	U16	0	65535	1	N/A	Yes
Logging – Log data 6		5108	R	U16	0	65535	1	N/A	Yes
Logging – Log data 7		5109	R	U16	0	65535	1	N/A	Yes
Logging – Log data 8		5110	R	U16	0	65535	1	N/A	Yes
Logging – Log data 9		5111	R	U16	0	65535	1	N/A	Yes
Logging – Log data 10		5112	R	U16	0	65535	1	N/A	Yes
Logging – Log data 11		5113	R	U16	0	65535	1	N/A	Yes
Logging – Log data 12		5114	R	U16	0	65535	1	N/A	Yes
Logging – Log time stamp year		5115	R	U16	0	256	1	N/A	Yes
Logging – Log time stamp month		5116	R	U16	0	12	1	N/A	Yes
Logging – Log time stamp day of month		5117	R	U16	0	31	1	N/A	Yes
Logging – Log time stamp hours		5118	R	U16	0	23	1	N/A	Yes
Logging – Log time stamp minutes		5119	R	U16	0	59	1	N/A	Yes
Logging – Log time stamp seconds		5120	R	U16	0	59	1	N/A	Yes
Logging – CRC		5121	R	U16	0	65535	1	N/A	Yes

Modbus Functions
The EMX supports the following functions of the Modbus Application Protocol Specification, v1.1b3. Examples are intended to be representative; refer to the full specification for questions or clarification.

Notes:

• The device address defaults to 247 (0xF7).
• Refer to the Modbus standard for CRC/LRC calculation procedures.

Data Types
Natively, Modbus holding register functions only support the UINT16 type (2 bytes). The meter constructs additional types from two or more consecutive registers. Client interface software must support the same construction for proper communication:

# of Registers		Range (hexadecimal)
BOOL	1	0 to 1
ENUM	1	0 to specified upper limit
UINT8	1	0 to 255 (0x00FF), unless otherwise noted
UINT16	1	0 to 65535 (0xFFFF), unless otherwise noted
INT16	1	-32768 to -32767 (0xFFFF), unless otherwise noted
UINT32	2	0 to 4294967295 (0xFFFFFFFF), unless otherwise noted
UINT64	4	0 to 18.446e+18 (0xFFFFFFFFFFFFFFFF), unless otherwise noted
INT64	4	-9.233e+18 to 9.233e+18 (0xFFFFFFFFFFFFFFFF), unless otherwise noted

UINT32, UINT64, and INT64 data always occupies two or four registers (4 and 8 bytes) in network byte order (MSB first). Read and write operations should address both registers.
The following examples show UINT32 encodings in a Modbus PDU beginning at byte [n], register [r]:

Value	Decimal	[n]	[n+1]	[n+2]	[n+3]
0xAABBCCDD	2864434397	0xAA	0xBB	0xCC	0xDD
0x01234567	19088743	0x12	0x34	0x56	0x78
0x00010000	65536	0x00	0x01	0x00	0x00
REGISTER	[r]		[r+1]

0x03 Read Holding Registers
Returns one or more registers in a contiguous block:

Request	Size	Notes
[0] Device Address	1	Always 0x03 ? = 0 to 65535 (0xFFFF) ? = 1 to 125 registers
[1] Function Code	1
[2] Starting Address	2
[3] Register Count	2
[4] CRC	2

Successful reads return the contents of the requested registers:

Response	Size	Notes
[0] Device Address	1	Always 0x03 2 * ?
[1] Function Code	1
[2] Byte Count	1
[3] Register Data	2 * ?
[4] CRC	2

Example 1: Read the line frequency of ΦA (020).

0x04 Read Input Register
Reads one or more read only registers in a contiguous block:

Request	Size	Notes
[0] Device Address	1	Always 0x04 ? = 0 to 65535 (0xFFFF) ? = 1 to 125 registers
[1] Function Code	1
[2] Starting Address	2
[3] Register Count	2
[4] CRC	2

Successful reads return the contents of the requested registers:

Response	Size	Notes
[0] Device Address	1	Always 0x04 2 * ?
[1] Function Code	1
[2] Byte Count	1
[3] Register Data	2 * ?
[4] CRC	2

Example 1: Read the line frequency of ΦA (020).

0x06 Write Single Register
Writes a value to a single register:

Request	Size	Notes
[0] Device Address	1	Always 0x06 ? = 0 to 65535 (0xFFFF) ? = 0 to 65535 (0xFFFF)
[1] Function Code	1
[2] Register Address	2
[3] Register Value	2
[4] CRC	2

Successful writes echo the original request:

Response	Size
[0] Device Address	1	Always 0x06 ? ?
[1] Function Code	1
[2] Register Address	2
[3] Register Value	2
[4] CRC	2

Example 1: Change the phase configuration (2000).

0x10 Write Multiple Registers
Writes one or more registers in a contiguous block:

Request	Size	Notes
[0] Device Address	1	Always 0x10 ? = 0 to 65535 (0xFFFF) ? = 1 to 123 registers Always 2 * ? ? …
[1] Function Code	1
[2] Starting Address	2
[3] Write Count	2
[4] Byte Count	1
[5] Write Registers	2 * ?
[6] CRC	2

Successful writes echo the Starting Address and Write Count:

Request	Size	Notes
[0] Device Address	1	Always 0x10 ? ?
[1] Function Code	1
[2] Starting Address	2
[3] Write Count	2
[4] CRC	2

Example 1: Change phase configuration (2000) and CT type (2001) in one write:

MODBUS Exception Codes
When the Modbus interface encounters an error, it will return an exception code. The most common errors are described in the table below. Additional information about exception codes may be found in the reference document.
Reference: https://modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf

MODBUS Exception Codes
Code	Name	Meaning
01	ILLEGAL FUNCTION	The function code received in the query is not an allowable action for the server (or slave). This may be because the function code is only applicable to newer devices and was not implemented in the unit selected. It could also indicate that the server (or slave) is in the wrong state to process a request of this type, for example because it is unconfigured and is being asked to return register values.
02	ILLEGAL DATA ADDRESS	The data address received in the query is not an allowable address for the server (or slave). More specifically, the combination of reference number and transfer length is invalid. For a controller with 100 registers, the PDU addresses the first register as 0, and the last one as 99. If a request is submitted with a starting register address of 96 and a quantity of registers of 4, then this request will successfully operate (address-wise at least) on registers 96, 97, 98, 99. If a request is submitted with a starting register address of 96 and a quantity of registers of 5, then this request will fail with Exception Code 0x02 “Illegal Data Address” since it attempts to operate on registers 96, 97, 98, 99 and 100, and there is no register with address 100.
03	ILLEGAL DATA VALUE	A value contained in the query data field is not an allowable value for server (or slave). This indicates a fault in the structure of the remainder of a complex request, such as that the implied length is incorrect. It specifically does NOT mean that a data item submitted for storage in a register has a value outside the expectation of the application program, since the MODBUS protocol is unaware of the significance of any particular value of any particular register.

Data Type Conversions
The following sections provide information on how to convert from the standard U16 registers that Modbus provides into other formats. Some controllers or Modbus interfaces provide these conversions, in which case the user should utilize those methods, instead of the following conversions.

U16 to I16 Conversion
Conversion from a signed requires checking if the value is value returned (VALUE) is greater than the maximum for a 16-bit integer (32767), if the value is greater than the value 65536 must be subtracted off to calculate a negative value.
If VALUE > 32767
Then: VALUE = VALUE – 65536
Otherwise: VALUE = VALUE (do nothing)

Example:
Reading register 005 (Real power total) the device responds with 64536. This value is greater than 32767, which means it must be adjusted. By subtracting 65536 we get 64536 – 65536 = -1000, which is the correct value for the real power. Please note that in practice a scale value will need to be determined and applied to this output to get the value into watts or whatever units are applicable.

U16 to U32 Conversion
Conversion from two unsigned 16-bit registers into a 32-bit value can be done by reading the two necessary registers and multiplying the first (lower register address) register by 32678 and adding the second register.
VALUE = (REGISTER_LOW * 65536) + REGISTER_HIGH
Example:
Reading registers 035 and 036 which together are the system power on time. Register 035 has a value (REGISTER_LOW) of 6, register 036 (REGISTER_HIGH) has a value of 38784. Using the calculation we get (6 * 65536) + 38784 = 432000. This corresponds to the time in seconds that the device has been powered on. 5 Days = 5 * 24 * 60 * 60 = 432000 seconds.

U16 to U64 Conversion
Conversion from 4 unsigned 16-bit registers to a 64-bit register is necessary for using the energy accumulators on the EMX. This is done to maintain system accuracy over long operating durations, and to avoid conditions where the energies appear to cease updating. This follows a similar pattern as the U32 conversion. All four registers must be read, preferably simultaneously with a multi-register read operation. The lowest address register is REG_1, the highest is REG_4.
VALUE = REG_1 * 2^48 + REG_2 * 2^32 + REG_3 * 2^16 + REG_4 Or without the power notation
VALUE = REG_1 * 281,474,976,710,656 + REG_2 * 4,294,967,296 + REG_3 * 65536 + REG_4

Example:
Reading registers 093/094/095/096 which corresponds to the Real Import Energy Total (how much energy has been consumed by downstream devices). Register 093 (REG_1) reads 0, register 094 (REG_2) reads 13, register 095 (REG_3) reads 63559 and register 096 (REG_4) reads 22528.
The calculation is 0 * 281,474,976,710,656 + 13 * 4,294,967,296 + 63559 * 65536 + 22528 = 60000000000 when scaled down by the scale of 0.00000001 given in the table it’s 600.0 which is the number of Watt Hours of energy that the device has metered at that point.

U16 to I64 Conversion
All the net energy registers are signed values. A negative sign indicates that net power has been exported, a positive sign indicates that net power has been imported (consumed). To convert from four U16 registers to an I64 register first perform a conversion as described above. Next perform the following step:
If VALUE > (2^63)- 1
Then VALUE = VALUE – 2^64
Otherwise VALUE = VALUE (do nothing).

Appendix D: Hex and ASCII Conversions

HEX	DEC	ASCII	0x41	65	A	0x83	131	ƒ	0xC5	197	Å
0x00	0	NULL	0x42	66	B	0x84	132	„	0xC6	198	Æ
0x01	1		0x43	67	C	0x85	133	…	0xC7	199	Ç
0x02	2		0x44	68	D	0x86	134	†	0xC8	200	È
0x03	3		0x45	69	E	0x87	135	‡	0xC9	201	É
0x04	4		0x46	70	F	0x88	136	ˆ	0xCA	202	Ê
0x05	5		0x47	71	G	0x89	137	‰	0xCB	203	Ë
0x06	6		0x48	72	H	0x8A	138	Š	0xCC	204	Ì
0x07	7		0x49	73	I	0x8B	139	‹	0xCD	205	Í
0x08	8		0x4A	74	J	0x8C	140	Œ	0xCE	206	Î
0x09	9		0x4B	75	K	0x8D	141		0xCF	207	Ï
0x0A	10		0x4C	76	L	0x8E	142	Ž	0xD0	208	Ð
0x0B	11		0x4D	77	M	0x8F	143		0xD1	209	Ñ
0x0C	12		0x4E	78	N	0x90	144		0xD2	210	Ò
0x0D	13		0x4F	79	O	0x91	145	‘	0xD3	211	Ó
0x0E	14		0x50	80	P	0x92	146	’	0xD4	212	Ô
0x0F	15		0x51	81	Q	0x93	147	“	0xD5	213	Õ
0x10	16		0x52	82	R	0x94	148	”	0xD6	214	Ö
0x11	17		0x53	83	S	0x95	149	•	0xD7	215	×
0x12	18		0x54	84	T	0x96	150	–	0xD8	216	Ø
0x13	19		0x55	85	U	0x97	151	—	0xD9	217	Ù
0x14	20		0x56	86	V	0x98	152	˜	0xDA	218	Ú
0x15	21		0x57	87	W	0x99	153	™	0xDB	219	Û
0x16	22		0x58	88	X	0x9A	154	š	0xDC	220	Ü
0x17	23		0x59	89	Y	0x9B	155	›	0xDD	221	Ý
0x18	24		0x5A	90	Z	0x9C	156	œ	0xDE	222	Þ
0x19	25		0x5B	91	[	0x9D	157		0xDF	223	ß
0x1A	26		0x5C	92	\	0x9E	158	ž	0xE0	224	à
0x1B	27		0x5D	93	]	0x9F	159	Ÿ	0xE1	225	á
0x1C	28		0x5E	94	^	0xA0	160		0xE2	226	â
0x1D	29		0x5F	95	_	0xA1	161	¡	0xE3	227	ã
0x1E	30		0x60	96	`	0xA2	162	¢	0xE4	228	ä
0x1F	31		0x61	97	a	0xA3	163	£	0xE5	229	å
0x20	32		0x62	98	b	0xA4	164	¤	0xE6	230	æ
0x21	33	!	0x63	99	c	0xA5	165	¥	0xE7	231	ç
0x22	34	“	0x64	100	d	0xA6	166	¦	0xE8	232	è
0x23	35	#	0x65	101	e	0xA7	167	§	0xE9	233	é
0x24	36	$	0x66	102	f	0xA8	168	¨	0xEA	234	ê
0x25	37	%	0x67	103	g	0xA9	169	©	0xEB	235	ë
0x26	38	&	0x68	104	h	0xAA	170	ª	0xEC	236	ì
0x27	39	‘	0x69	105	i	0xAB	171	«	0xED	237	í
0x28	40	(	0x6A	106	j	0xAC	172	¬	0xEE	238	î
0x29	41	)	0x6B	107	k	0xAD	173	–	0xEF	239	ï
0x2A	42	*	0x6C	108	l	0xAE	174	®	0xF0	240	ð
0x2B	43	+	0x6D	109	m	0xAF	175	¯	0xF1	241	ñ
0x2C	44	,	0x6E	110	n	0xB0	176	°	0xF2	242	ò
0x2D	45	–	0x6F	111	o	0xB1	177	±	0xF3	243	ó
0x2E	46	.	0x70	112	p	0xB2	178	²	0xF4	244	ô
0x2F	47	/	0x71	113	q	0xB3	179	³	0xF5	245	õ
0x30	48	0	0x72	114	r	0xB4	180	´	0xF6	246	ö
0x31	49	1	0x73	115	s	0xB5	181	µ	0xF7	247	÷
0x32	50	2	0x74	116	t	0xB6	182	¶	0xF8	248	ø
0x33	51	3	0x75	117	u	0xB7	183	·	0xF9	249	ù
0x34	52	4	0x76	118	v	0xB8	184	¸	0xFA	250	ú
0x35	53	5	0x77	119	w	0xB9	185	¹	0xFB	251	û
0x36	54	6	0x78	120	x	0xBA	186	º	0xFC	252	ü
0x37	55	7	0x79	121	y	0xBB	187	»	0xFD	253	ý
0x38	56	8	0x7A	122	z	0xBC	188	¼	0xFE	254	þ
0x39	57	9	0x7B	123	{	0xBD	189	½	0xFF	255	ÿ
0x3A	58	:	0x7C	124	|	0xBE	190	¾
0x3B	59	;	0x7D	125	}	0xBF	191	¿
0x3C	60	<	0x7E	126	~	HEX	DEC	LATIN-1
0x3D	61	=	0x7F	127	0xC0	192	À
0x3E	62	>	HEX	DEC	LATIN-1	0xC1	193	Á
0x3F	63	?	0x80	128	€	0xC2	194	Â
HEX	DEC	ASCII	0x81		129	0xC3	195	Ã
0x40	64	@		0x82	‚130	0xC4	196	Ä

EMX-IP Modbus Protocol Guide
Page 22 of 23
154-0050-0A

Documents / Resources

SENVA EMX-IP User Interface and Modbus [pdf] User Manual 154-0050-0A, EMX-IP User Interface and Modbus, EMX-IP, User Interface and Modbus, Modbus

References

• User Manual