All register reads return errors or zero. What is wrong?

The FEMS Modbus/TCP interface requires the dedicated FEMS App to be installed and active. Without it, the TCP port will not respond. Confirm the app is licensed and running in the FEMS App Center, then retry. Also verify the client base address offset is set to 0, not 1: a base address of 1 shifts all register addresses by one and causes systematic read failures.

Cell section voltage registers 3020 to 3035 read as zero.

These registers are mapped at a different address block from the main ESS registers. Some Modbus masters batch all reads into a single range request. Split your polling into two requests: one for addresses 100 to 142 and one for 3020 to 3051. A single contiguous request spanning the gap will return an illegal data address exception.

Write setpoints for active power are accepted but the system ignores them.

The FEMS write interface has a built-in watchdog timeout, set to 60 seconds by default. A setpoint is only active for 60 seconds after it is written. Your ModbusCloud Gateway or control system must re-write the setpoint registers at an interval shorter than the timeout, otherwise the system reverts to its internal control strategy automatically.

Is it safe to write to set_active_power and set_work_state remotely?

Use write registers with care. Incorrect active power setpoints that exceed the BMS allowed charge or discharge power limits reported in registers 141 and 142 will be clamped by the system, but repeated out-of-range commands may trigger protection responses. Always read allowed_charge_power and allowed_discharge_power before writing power setpoints. Write to set_work_state only when you understand the state enumeration: commanding an incorrect state can suspend normal operation until manually cleared.

Free Modbus template: Fenecon Pro Ess

Name: Fenecon Pro Ess
Brand: Fenecon
SKU: 4ee5e914-ce03-40e8-9047-40f94399db0e

The Fenecon Pro Ess is a three-phase commercial battery energy storage system managed by the FEMS energy management platform. This template connects via Modbus TCP and reads system state, control mode, work mode, battery state of charge, voltage, current, power, cumulative charge and discharge energy, per-phase AC voltage, current, active and reactive power, grid frequency, BMS charge and discharge power limits, and per-section cell voltages and temperatures across sixteen sections. Write registers allow remote setpoints for per-phase active and reactive power, work state, PCS mode, setup mode, and real-time clock synchronization. Use it in your ModbusCloud portal to track battery health and dispatch performance across commercial installations.

Registers (78)

63 read / 15 write

Name	Address	Function	Type	Unit	Access
system_state Overall system operating state, encoded as enumeration.	100	FC03	uint16		R
control_mode Active control mode of the energy storage system.	101	FC03	uint16		R
work_mode Current work mode reported by the system.	102	FC03	uint16		R
active_charge_energy Cumulative AC energy charged into the battery, watt-hours.	104	FC03	uint32	Wh	R
active_discharge_energy Cumulative AC energy discharged from the battery, watt-hours.	106	FC03	uint32	Wh	R
battery_group_state Operational state of the battery group, enumeration.	108	FC03	uint16		R
soc Battery state of charge, 0 to 100 percent.	109	FC03	uint16	%	R
battery_voltage DC battery pack voltage, volts.	110	FC03	uint16	V	R
battery_current DC battery current, positive charging, negative discharging.	111	FC03	int16	A	R
battery_power DC battery power, positive charging, negative discharging.	112	FC03	int16	W	R
pcs_operation_state Power conversion system operational state, enumeration.	114	FC03	uint16		R
current_l1 AC phase L1 current, amperes, signed.	118	FC03	int16	A	R
current_l2 AC phase L2 current, amperes, signed.	119	FC03	int16	A	R
current_l3 AC phase L3 current, amperes, signed.	120	FC03	int16	A	R
voltage_l1 AC phase L1 voltage to neutral, volts.	121	FC03	uint16	V	R
voltage_l2 AC phase L2 voltage to neutral, volts.	122	FC03	uint16	V	R
voltage_l3 AC phase L3 voltage to neutral, volts.	123	FC03	uint16	V	R
active_power_l1 AC active power on phase L1, watts, signed.	124	FC03	int16	W	R
active_power_l2 AC active power on phase L2, watts, signed.	125	FC03	int16	W	R
active_power_l3 AC active power on phase L3, watts, signed.	126	FC03	int16	W	R
reactive_power_l1 AC reactive power on phase L1, signed.	127	FC03	int16	W	R
reactive_power_l2 AC reactive power on phase L2, signed.	128	FC03	int16	W	R
reactive_power_l3 AC reactive power on phase L3, signed.	129	FC03	int16	W	R
frequency_l1 AC grid frequency measured on phase L1.	131	FC03	uint16	Hz	R
frequency_l2 AC grid frequency measured on phase L2.	132	FC03	uint16	Hz	R
frequency_l3 AC grid frequency measured on phase L3.	133	FC03	uint16	Hz	R
single_phase_allowed_apparent Maximum allowed apparent power for a single phase.	134	FC03	uint16	VA	R
allowed_charge_power Maximum charge power currently permitted by the BMS, watts.	141	FC03	uint16	W	R
allowed_discharge_power Maximum discharge power currently permitted by the BMS, watts.	142	FC03	uint16	W	R
set_work_state Setpoint to command the system work state, enumeration.	200	FC16	uint16		W
set_active_power_l1 Active power setpoint for phase L1, watts, signed.	206	FC16	int16	W	W
set_reactive_power_l1 Reactive power setpoint for phase L1, signed.	207	FC16	int16	W	W
set_active_power_l2 Active power setpoint for phase L2, watts, signed.	208	FC16	int16	W	W
set_reactive_power_l2 Reactive power setpoint for phase L2, signed.	209	FC16	int16	W	W
set_active_power_l3 Active power setpoint for phase L3, watts, signed.	210	FC16	int16	W	W
set_reactive_power_l3 Reactive power setpoint for phase L3, signed.	211	FC16	int16	W	W
battery_voltage_section_1 Voltage of battery cell section 1, raw value.	3020	FC03	uint16	V	R
battery_voltage_section_2 Voltage of battery cell section 2, raw value.	3021	FC03	uint16	V	R
battery_voltage_section_3 Voltage of battery cell section 3, raw value.	3022	FC03	uint16	V	R
battery_voltage_section_4 Voltage of battery cell section 4, raw value.	3023	FC03	uint16	V	R
battery_voltage_section_5 Voltage of battery cell section 5, raw value.	3024	FC03	uint16	V	R
battery_voltage_section_6 Voltage of battery cell section 6, raw value.	3025	FC03	uint16	V	R
battery_voltage_section_7 Voltage of battery cell section 7, raw value.	3026	FC03	uint16	V	R
battery_voltage_section_8 Voltage of battery cell section 8, raw value.	3027	FC03	uint16	V	R
battery_voltage_section_9 Voltage of battery cell section 9, raw value.	3028	FC03	uint16	V	R
battery_voltage_section_10 Voltage of battery cell section 10, raw value.	3029	FC03	uint16	V	R
battery_voltage_section_11 Voltage of battery cell section 11, raw value.	3030	FC03	uint16	V	R
battery_voltage_section_12 Voltage of battery cell section 12, raw value.	3031	FC03	uint16	V	R
battery_voltage_section_13 Voltage of battery cell section 13, raw value.	3032	FC03	uint16	V	R
battery_voltage_section_14 Voltage of battery cell section 14, raw value.	3033	FC03	uint16	V	R
battery_voltage_section_15 Voltage of battery cell section 15, raw value.	3034	FC03	uint16	V	R
battery_voltage_section_16 Voltage of battery cell section 16, raw value.	3035	FC03	uint16	V	R
battery_temperature_section_1 Temperature of battery cell section 1, raw value.	3036	FC03	uint16	°C	R
battery_temperature_section_2 Temperature of battery cell section 2, raw value.	3037	FC03	uint16	°C	R
battery_temperature_section_3 Temperature of battery cell section 3, raw value.	3038	FC03	uint16	°C	R
battery_temperature_section_4 Temperature of battery cell section 4, raw value.	3039	FC03	uint16	°C	R
battery_temperature_section_5 Temperature of battery cell section 5, raw value.	3040	FC03	uint16	°C	R
battery_temperature_section_6 Temperature of battery cell section 6, raw value.	3041	FC03	uint16	°C	R
battery_temperature_section_7 Temperature of battery cell section 7, raw value.	3042	FC03	uint16	°C	R
battery_temperature_section_8 Temperature of battery cell section 8, raw value.	3043	FC03	uint16	°C	R
battery_temperature_section_9 Temperature of battery cell section 9, raw value.	3044	FC03	uint16	°C	R
battery_temperature_section_10 Temperature of battery cell section 10, raw value.	3045	FC03	uint16	°C	R
battery_temperature_section_11 Temperature of battery cell section 11, raw value.	3046	FC03	uint16	°C	R
battery_temperature_section_12 Temperature of battery cell section 12, raw value.	3047	FC03	uint16	°C	R
battery_temperature_section_13 Temperature of battery cell section 13, raw value.	3048	FC03	uint16	°C	R
battery_temperature_section_14 Temperature of battery cell section 14, raw value.	3049	FC03	uint16	°C	R
battery_temperature_section_15 Temperature of battery cell section 15, raw value.	3050	FC03	uint16	°C	R
battery_temperature_section_16 Temperature of battery cell section 16, raw value.	3051	FC03	uint16	°C	R
rtc_year Real-time clock year setpoint for system time sync.	9014	FC16	uint16		W
rtc_month Real-time clock month setpoint for system time sync.	9015	FC16	uint16		W
rtc_day Real-time clock day setpoint for system time sync.	9016	FC16	uint16		W
rtc_hour Real-time clock hour setpoint for system time sync.	9017	FC16	uint16		W
rtc_minute Real-time clock minute setpoint for system time sync.	9018	FC16	uint16		W
rtc_second Real-time clock second setpoint for system time sync.	9019	FC16	uint16		W
setup_mode_a Setup mode write register, activates or deactivates setup state.	30558	FC16	uint16		W
pcs_mode_a PCS mode write register, switches PCS between local and remote control.	30559	FC16	uint16		W
setup_mode_b Setup mode read-back register, confirms current setup state.	30157	FC03	uint16		R
pcs_mode_b PCS mode read-back register, confirms current PCS control mode.	30158	FC03	uint16		R