KEBA · EV charger
KeContact P40 / P40 Pro Modbus register map
Default configuration
- Protocol
- Modbus TCP
- Port
- 502
- Unit ID
- 255
- Addressing
- 0-based
- Byte order
- Big endian
- Word order
- High word first
Register map
| Address | Count | Name | Type | Unit | Scale | Access |
|---|---|---|---|---|---|---|
| 1000 | 2 | Charging state 0 = start-up, 1 = not ready for charging (no vehicle, locked by the authorization function or another mechanism), 2 = ready and waiting for the vehicle, 3 = charging, 4 = error, 5 = interrupted because of overtemperature or suspended mode. | UInt32 | - | 1 | R |
| 1004 | 2 | Cable state Cable variants: 3 = cable connected to the station, 7 = cable connected to the station and the vehicle. Socket variants: 0 = no cable plugged, 1 = cable at the station only, 3 = cable at the station and locked, 5 = cable and vehicle connected, 7 = cable and vehicle connected and locked (charging). | UInt32 | - | 1 | R |
| 1006 | 2 | Error code 0 = no error. Other values are the EVSE error code in decimal, visible while the charging state is 4. | UInt32 | - | 1 | R |
| 1008 | 2 | Charging current L1 Measured current on phase 1, raw value in mA. | UInt32 | A | 0.001 | R |
| 1010 | 2 | Charging current L2 Measured current on phase 2, raw value in mA. | UInt32 | A | 0.001 | R |
| 1012 | 2 | Charging current L3 Measured current on phase 3, raw value in mA. | UInt32 | A | 0.001 | R |
| 1014 | 2 | Serial number Serial number of the charging station as a decimal number. | UInt32 | - | 1 | R |
| 1016 | 2 | Product type and features Product key: product family (4 = KC-P40) | device current (1 = 16 A, 2 = 32 A) | connector (1 = cable, 2 = socket) | phases (1 = 1 phase, 2 = 3 phases, 3 = 3-to-1 switching, 4 = rotation) | metering (0 = none, 1 = energy meter, 2 = MID meter, 3 = legal meter) | RFID (0/1) | button (0/1). The guide's worked example, 4212311, belongs to KC-P40-32EU0-C633ALP0-LS1R1111BL0-CL00. | UInt32 | - | 1 | R |
| 1018 | 2 | Software package version Release without the dots, two digits per field: 10000 = 1.0.0. | UInt32 | - | 1 | R |
| 1020 | 2 | Active power Active power of the charging station, raw value in mW. | UInt32 | W | 0.001 | R |
| 1036 | 2 | Total energy Persistent, device-related total energy in 0.1 Wh. Below software 1.2.1 the register reports Wh instead (documented in the guide's known-bugs section), so this scale is a factor of ten off on those units. | UInt32 | kWh | 0.0001 | R |
| 1040 | 2 | Voltage L1 | UInt32 | V | 1 | R |
| 1042 | 2 | Voltage L2 | UInt32 | V | 1 | R |
| 1044 | 2 | Voltage L3 | UInt32 | V | 1 | R |
| 1046 | 2 | Power factor cos phi, raw value in 0.1 %. | UInt32 | % | 0.1 | R |
| 1100 | 2 | Max charging current Maximum charging current of the charging station, raw value in mA. | UInt32 | A | 0.001 | R |
| 1110 | 2 | Max supported current Maximum current supported by the hardware, including the installer-mode setting, cable coding and temperature reductions, raw value in mA. | UInt32 | A | 0.001 | R |
| 1200 | 2 | Fast charging state 0 = fast charging deactivated, 1 = fast charging active and the current cannot be controlled via Modbus TCP. | UInt32 | - | 1 | R |
| 1500 | 2 | RFID card First four bytes of the UID of the card that authorized the session, as a decimal number that has to be converted to hex. Reading RFID data has to be enabled additionally. | UInt32 | - | 1 | R |
| 1502 | 2 | Charged energy, current session Energy transferred in the running charging session in 0.1 Wh. Below software 1.2.1 the register reports Wh instead (known-bugs section). | UInt32 | kWh | 0.0001 | R |
| 1550 | 2 | Phase switching source 0 = no phase toggle source available, 1 = OCPP, 2 = direct REST API command, 3 = Modbus TCP. | UInt32 | - | 1 | R |
| 1552 | 2 | Phase switching state 1 = single-phase charging is used, 3 = three-phase charging is possible. | UInt32 | - | 1 | R |
| 1600 | 2 | Failsafe current setting Current applied when the connection between the EMS and the station is lost, raw value in mA. | UInt32 | A | 0.001 | R |
| 1602 | 2 | Failsafe timeout setting Timeout between two Modbus TCP requests before the station enters failsafe charging with the current from 1600. | UInt32 | s | 1 | R |
| 1700 | 2 | Hardware revision, device | UInt32 | - | 1 | R |
| 1702 | 2 | Hardware revision, KC-MS10 | UInt32 | - | 1 | R |
| 5004 | 1 | Set charging current 0 = suspends the charging session, 6000 to 32000 = charging current in mA. The value stays active until the next write. The EMS has priority over OCPP, and a station cannot be connected to an EMS and an external meter at the same time. | UInt16 | A | 0.001 | W |
| 5010 | 1 | Set energy Energy limit for the running session in 10 Wh; the session is terminated when it is reached. 0 deletes a previously set limit. | UInt16 | kWh | 0.01 | W |
| 5012 | 1 | Unlock plug Writing 0 unlocks the connector and stops a running session. Locking the connector via Modbus TCP is not possible. | UInt16 | - | 1 | W |
| 5014 | 1 | Enable/disable charging station 0 = disable the station (state Unavailable), 1 = enable it. Available with later software according to the guide's revision record. | UInt16 | - | 1 | W |
| 5016 | 1 | Failsafe current 0 deactivates charging when the EMS connection is lost, 6000 to 32000 sets the failsafe current in mA. | UInt16 | A | 0.001 | W |
| 5018 | 1 | Failsafe timeout 0 deactivates the failsafe function (charging continues with the highest possible value), 5 to 600 sets the timeout in seconds. | UInt16 | s | 1 | W |
| 5050 | 1 | Set phase switching source 0 = phase switching deactivated, 1 = via profiles (OCPP, PV algorithm), 2 = REST API direct control, 3 = via Modbus TCP. | UInt16 | - | 1 | W |
| 5052 | 1 | Trigger phase switch 0 = 1 phase, 1 = 3 phases (default state). Only acts when 5050 is 3. | UInt16 | - | 1 | W |
| 5200 | 1 | Activate fast charging Writing 1 activates fast charging for the ongoing session. Fast charging cannot be deactivated via Modbus TCP. | UInt16 | - | 1 | W |
Read this device live with Modbus Connect, free for Windows, macOS and Linux
Related guides
Notes
Source: KEBA Energy Automation, "KeContact P40, P40 Pro - Charging Station, Modbus TCP Programmers Guide V 1.03", document no. 135655, published 08.2026, reached from the KEBA eMobility download page (https://www.keba.com/en/emobility/service-support/downloads/downloads -> https://a.storyblok.com/f/40131/x/e9c9ced3ac/kecontactp40modbustcp_pgen.pdf). Section 2 states the addressing and transport facts this file relies on: the Modbus TCP interface is a server on port 502 (configurable), the default unit ID is 255 (configurable, 0-255), the "starting register address count is 0" and the register numbers of the guide are therefore wire addresses, only FC3 (read) and FC6 (write single register) are supported, a single register cannot be read together with others because every return value is 32 bit, and registers must be polled at 0.5 s and written at 5 s intervals. Modbus TCP is off by default and has to be enabled in the KEBA eMobility App ("Enable" and, for card data, "Enable RFID"); reading RFID cards is a separate opt-in. Readings are FC3 holding registers, the writable registers are FC6 single-register writes. The write rows 5014, 5050 and 5052 are marked in the guide as available with later software only (5050/5052 from firmware 1.3.0, together with the phase-switching feature). Known bug quoted from the guide: below software 1.2.1 registers 1036 and 1502 report Wh instead of 0.1 Wh, which makes their scale a factor of ten off on those units. This is the P40 family; the P30 c-/x-series map is a different document and stays in keba-kecontact-p30.