KATHREIN · EV charger
KWB AC35 / AC40 (ACxx(E) wallbox) Modbus register map
Default configuration
- Protocol
- Modbus TCP
- Port
- 502
- Unit ID
- 0
- Addressing
- 0-based
- Byte order
- Big endian
- Word order
- High word first
Register map
| Address | Count | Name | Type | Unit | Scale | Access |
|---|---|---|---|---|---|---|
| 0 | 1 | Mapping version Header: decimal version of this register mapping, current version 0x0001. | UInt16 | - | 1 | R |
| 1 | 8 | Device number Device number, format "620xxxxx(-yyyy)". | Ascii | - | 1 | R |
| 9 | 8 | Device type Device type, format "ACxx(E)". | Ascii | - | 1 | R |
| 17 | 8 | Device serial number Serial number, format "G0Rxxxxxxx". | Ascii | - | 1 | R |
| 25 | 1 | Device info Bit field. Bits 0-1 = power class (0x0001 = 11 kW, 0x0002 = 22 kW), bit 4 = cable/plug (0x0010 = plug, 0 = cable), bit 7 = Eichrecht (0x0080), bits 8-15 = relay capability (0x0100 L1, 0x0200 L2, 0x0400 L3, 0x1000 L1+L2, 0x2000 L1+L3, 0x4000 L2+L3, 0x8000 L1+L2+L3). | Binary | - | 1 | R |
| 26 | 1 | Device line mapping 0 = L1-L2-L3 (default), 1 = L1-L3-L2 (invalid rotation), 2 = L2-L3-L1, 3 = L2-L1-L3 (invalid rotation), 4 = L3-L1-L2, 5 = L3-L2-L1 (invalid rotation). | UInt16 | - | 1 | R |
| 48 | 2 | Meter U1 Line 1 to neutral voltage. | Float32 | V | 1 | R |
| 50 | 2 | Meter U2 Line 2 to neutral voltage. | Float32 | V | 1 | R |
| 52 | 2 | Meter U3 Line 3 to neutral voltage. | Float32 | V | 1 | R |
| 54 | 2 | Meter I1 Line 1 current. | Float32 | A | 1 | R |
| 56 | 2 | Meter I2 Line 2 current. | Float32 | A | 1 | R |
| 58 | 2 | Meter I3 Line 3 current. | Float32 | A | 1 | R |
| 60 | 2 | Meter P1 Active power on line 1. | Float32 | W | 1 | R |
| 62 | 2 | Meter P2 Active power on line 2. | Float32 | W | 1 | R |
| 64 | 2 | Meter P3 Active power on line 3. | Float32 | W | 1 | R |
| 66 | 2 | Meter S1 Apparent power on line 1. | Float32 | VA | 1 | R |
| 68 | 2 | Meter S2 Apparent power on line 2. | Float32 | VA | 1 | R |
| 70 | 2 | Meter S3 Apparent power on line 3. | Float32 | VA | 1 | R |
| 72 | 2 | Meter Q1 Reactive power on line 1. | Float32 | VAr | 1 | R |
| 74 | 2 | Meter Q2 Reactive power on line 2. | Float32 | VAr | 1 | R |
| 76 | 2 | Meter Q3 Reactive power on line 3. | Float32 | VAr | 1 | R |
| 78 | 2 | Meter PF1 Power factor (cos phi) on line 1, 0.0 to 1.0. | Float32 | - | 1 | R |
| 80 | 2 | Meter PF2 Power factor (cos phi) on line 2, 0.0 to 1.0. | Float32 | - | 1 | R |
| 82 | 2 | Meter PF3 Power factor (cos phi) on line 3, 0.0 to 1.0. | Float32 | - | 1 | R |
| 84 | 2 | Meter P total Total active power. | Float32 | W | 1 | R |
| 86 | 2 | Meter S total Total apparent power. | Float32 | VA | 1 | R |
| 88 | 2 | Meter Q total Total reactive power. | Float32 | VAr | 1 | R |
| 90 | 2 | Meter PF total Total power factor (cos phi), 0.0 to 1.0. | Float32 | - | 1 | R |
| 92 | 2 | Meter W total Total energy since production. | Float32 | kWh | 1 | R |
| 94 | 2 | Meter frequency Line frequency. | Float32 | Hz | 1 | R |
| 96 | 1 | EVSE charging state 0 = idle, 1 = EV connected, 2 = authentication waiting, 3 = authentication confirmed, 4 = charging active, 5 = charging paused, 6 = charging completed, 7 = RFID pairing, 0xFFFF = error. | UInt16 | - | 1 | R |
| 97 | 1 | EVSE error state Bit field: 0x0000 no error, 0x0001 relay welded, 0x0002 residual DC current detected (RCD), 0x0004 socket lock-detection error, 0x0008 charging overcurrent, 0x0010 CP-D ventilation not available, 0x0020 CP-E short circuit, 0x0040 CP-F loop broken, 0x0080 PP error (short circuit), 0x8000 internal error. | Binary | - | 1 | R |
| 98 | 1 | EVSE PP state Plug variant: 0 = cable not connected (then 13, 20, 32, 63 A and 0xFFFF error follow the PP resistor); cable variant: 0 = fixed cable mounted. | UInt16 | - | 1 | R |
| 99 | 1 | EVSE CP state 0 = A (EV not detected, standby), 1 = B (EV detected, ready to charge), 2 = C (EV charging), 3 = D (EV charging with fan), 4 = E (CP short circuit), 5 = F (EVSE not available, CP = -12 VDC); any other value is undefined or an error. | UInt16 | - | 1 | R |
| 100 | 1 | EVSE relay state Bit field: 0x0000 relay off, 0x0001 L1 active, 0x0002 L2 active, 0x0004 L3 active. | Binary | - | 1 | R |
| 101 | 1 | EVSE granted current Charging current granted per line, related to the CP signal: 0 or 6000 to 32000 mA. | UInt16 | mA | 1 | R |
| 102 | 1 | EVSE granted power Granted charging power, power sum of all active lines, related to the CP signal: 1380 to 22080 W at 230 VAC depending on power class and active relays. | UInt16 | W | 1 | R |
| 103 | 2 | Charging duration Duration of the current charging session. | UInt32 | s | 1 | R |
| 105 | 2 | Charging energy Energy of the current charging session. | UInt32 | Wh | 1 | R |
| 160 | 1 | EMS control register 0x8000 enables EMS control; default 0x0000 (EMS control disabled). | UInt16 | - | 1 | RW |
| 161 | 1 | EMS setpoint relay matrix Lines to switch, according to the relay capability: 0x0001 line 1, 0x0002 line 2 (reserved for future use), 0x0004 line 3 (reserved for future use); default 0x0007 (three lines). Used together with the charging current setpoint. | Binary | - | 1 | RW |
| 162 | 1 | EMS setpoint charging current 0 pauses charging, 6000 to 32000 sets the current in mA, 0xFFFF cancels charging; default is the maximum current of the power class. | UInt16 | mA | 1 | RW |
| 163 | 1 | EMS timeout period 0 = timeout deactivated, greater than 0 = timeout active; each setpoint write resets the timer; default 0. | UInt16 | s | 1 | RW |
| 164 | 1 | EMS timeout fallback pattern Lines that are used when the timeout expires: 0x0001 line 1, 0x0002 line 2, 0x0004 line 3; default 0x0007. Unsupported lines are ignored. | Binary | - | 1 | RW |
| 165 | 1 | EMS timeout fallback current Fallback charging current when the timeout expires: 0 or 6000 to 32000 mA; default 6000. | UInt16 | mA | 1 | RW |
Read this device live with Modbus Connect, free for Windows, macOS and Linux
Related guides
Notes
Source: "KATHREIN-Wallbox - ModBus-Server - Register-Mapping", release version 1.3, release date 04.11.2024, the register mapping the KATHREIN wallbox business publishes together with its wallbox documentation; the PDF is served from the Amperfied download area (https://www.amperfied.de/wp-content/uploads/2025/06/Modbus-Server.pdf), which now runs the KATHREIN wallbox downloads, and the product page given as supplier_url is KATHREIN's own. The document fixes the transport: a Modbus TCP server on port 502 (IEC 61158 / IEC 61784-2 CPF 15/1), big-endian integers and words, only holding registers, function codes 0x03 (read multiple), 0x06 (write single) and 0x10 (write multiple); "At the moment, the Unit-ID is ignored, but 0x00 (Broadcast) is recommended", which is the unit ID recorded here. The register table starts at 0x0000, so the addresses below are the vendor's hex addresses as decimals and are declared zero_based. The Modbus server is disabled by factory default and has to be enabled in the easyOperate configuration panel. The device is the ACxx(E) family (device type register 0x0009), sold as KWB AC35 (11 kW) and KWB AC40 (22 kW). Left out on purpose: the local timestamp 0x001B (UINT64 over four registers - this schema has no 64-bit integer type), the reserved block 0x001F, the tariff registers 0x006B, 0x006C and 0x006D (marked "reserved for future use" in the document) and the reserved block 0x006E. The unit column of the PDF is set as its own right-hand column; every unit in this file was paired with its row by word coordinates, because plain text extraction shifts that column by several rows.