- October 18, 2026
- Posted by: editor
- Category: RECD & Emission Control Devices
The RECD controller says the differential pressure is 45.2 mbar. The Building Management System says 452. On a freezing morning, the outlet temperature on the BMS reads 65,534 °C before the generator has even started. The running-hours counter jumps from 12,000 to several billion overnight.
None of these are sensor faults. They’re Modbus mapping errors, among the most common problems when a Retrofit Emission Control Device controller is connected to a BMS, SCADA system or data logger. Modbus is simple and widely supported, but it carries raw numbers, not meanings. Units, scaling, data types and word order all have to be agreed and configured correctly on both ends.
This guide explains the key concepts in plain terms, works through the errors above, and gives a step-by-step method for mapping and testing RECD Modbus data. All register addresses and values in this article are illustrative examples. Always use the register map supplied with your own RECD controller.
Modbus in Five Minutes
Modbus is a communication protocol in which a master (also called a client), such as a BMS controller or gateway, asks a slave (also called a server), such as the RECD controller, for data. The slave replies with the requested values. The protocol specifications are published by the Modbus Organization.
Two versions are common:
| Modbus RTU | Modbus TCP | |
|---|---|---|
| Physical layer | RS-485 serial cable (two-wire plus reference) | Ethernet |
| Addressing | Slave ID (1–247) on a shared bus | IP address (plus unit ID) |
| Typical settings to match | Baud rate, parity, stop bits, slave ID | IP address, port (normally 502), unit ID |
| Typical use | Short to medium distances in plant rooms | Sites with an OT Ethernet network |
Data tables
Modbus organises data into four tables:
| Table | Size | Access | Typical RECD use |
|---|---|---|---|
| Coils | 1 bit | Read/write | Rarely used; sometimes commands |
| Discrete inputs | 1 bit | Read only | Status flags (regeneration active, alarm) |
| Input registers | 16 bits | Read only | Measured values (ΔP, temperatures) |
| Holding registers | 16 bits | Read/write | Values, settings, sometimes measurements too |
Many devices put everything, measurements and statuses alike, into holding registers for simplicity. The register map tells you which.
Function codes you’ll meet
| Code | Purpose |
|---|---|
| 01 | Read coils |
| 02 | Read discrete inputs |
| 03 | Read holding registers |
| 04 | Read input registers |
| 05 / 06 | Write single coil / single register |
| 16 | Write multiple registers |
For monitoring, you normally only need read functions (02, 03, 04). Avoid writing to an RECD controller unless the supplier explicitly documents and approves it, because some registers may hold settings that affect regeneration or alarms.
Addressing: The Off-by-One Trap
Register numbers appear in two different styles, and confusing them is the single most common Modbus problem.
- Documentation style (one-based, with a prefix): holding registers are written as 40001, 40002 and so on, and input registers as 30001, 30002 and so on.
- Protocol style (zero-based offsets): the address actually sent in the message. Holding register 40001 is offset 0, 40002 is offset 1, and so on.
So if a register map lists “ΔP at 40011”, the BMS may need to be configured with holding register, offset 10, or with 40011, depending on how the BMS software expects addresses.
Symptom of getting it wrong: every value is shifted by one register. ΔP shows the inlet temperature, inlet temperature shows the outlet temperature, and so on. If values look plausible but are attached to the wrong names, suspect an off-by-one error.
Fix: check the BMS or gateway documentation for whether it uses one-based or zero-based addresses, then test one known value. See the testing method later in this article.
Data Types: What’s Inside a Register
A single Modbus register holds 16 bits. Those bits can represent different things:
| Data type | Registers | Range | Typical RECD use |
|---|---|---|---|
| Unsigned 16-bit integer (UINT16) | 1 | 0 to 65,535 | ΔP, pressures, counts |
| Signed 16-bit integer (INT16) | 1 | −32,768 to 32,767 | Temperatures that can be negative |
| Unsigned 32-bit integer (UINT32) | 2 | 0 to about 4.29 billion | Running hours, regeneration counters |
| 32-bit floating point (FLOAT32, IEEE 754) | 2 | Wide range with decimals | Measured values on some controllers |
| Bit field | 1 | 16 individual flags | Status and alarm bits |
The register map should state the data type of every point. If it doesn’t, ask.
Example: the signed temperature problem
Suppose the RECD outlet temperature is stored as INT16 in whole degrees, and it’s a cold morning in a hill-station plant room where the outlet sensor reads −2 °C before start-up.
- The raw 16 bits represent −2 in two’s complement, which is 0xFFFE.
- If the BMS reads the register as UINT16, it interprets 0xFFFE as 65,534.
The BMS shows 65,534 °C and raises an alarm. Configure the point as signed (INT16) and it shows −2 °C correctly.
Scaling: Turning Integers Into Engineering Units
Many controllers store decimal values as integers and expect the reader to scale them. The general formula is:
Engineering value = (Raw value × Scale factor) + Offset
The register map should give the scale factor, offset (often zero) and units for each point.
Example: the ΔP problem
The register map says:
- ΔP: UINT16, scale 0.1, units mbar
The controller’s local display shows 45.2 mbar. The raw register value is 452.
- Correct: 452 × 0.1 = 45.2 mbar
- If scaling is missing in the BMS: 452 mbar displayed, wrong by a factor of ten
A factor-of-ten error like this can make alarms fire constantly, or never. Always verify scaling against the local display.
Example: an offset
Some devices store temperatures with an offset to avoid negative numbers, for example as UINT16 with offset −50 and scale 1.
- Raw value 450 → 450 × 1 + (−50) = 400 °C
- Raw value 48 → −2 °C
Units: write them down
Make sure the BMS shows the same units as the RECD controller and the alarm response matrix. Mixing mbar, kPa and mm H₂O on different screens confuses operators. If a conversion is needed, do it once, in the BMS configuration, and document it. For reference: 1 kPa = 10 mbar, and 1 mbar ≈ 10.2 mm H₂O.
Word Order: The 32-Bit Trap
A 32-bit value (UINT32 or FLOAT32) occupies two consecutive registers. The Modbus standard defines the byte order within each 16-bit register, but not the order of the two registers. Some devices send the high word first, others the low word first. This is often called word order or word swap.
If the BMS and the controller disagree, 32-bit values come out as nonsense.
Example: running hours
The RECD controller stores running hours as UINT32 in tenths of an hour. The true value is 12,345.6 hours, so the stored integer is 123,456.
- 123,456 in hexadecimal is 0x0001E240
- High word = 0x0001 (1), low word = 0xE240 (57,920)
If the controller sends high word first (register n = 0x0001, register n+1 = 0xE240) and the BMS reads it that way:
(1 × 65,536) + 57,920 = 123,456 → × 0.1 = 12,345.6 h ✓
If the BMS assumes low word first, it combines them as 0xE2400001:
(57,920 × 65,536) + 1 = 3,795,845,121 → × 0.1 = 379,584,512.1 h ✗
That’s the “jumps to billions” symptom.
Example: a floating-point value
The ΔP of 45.2 mbar stored as FLOAT32 is represented in IEEE 754 as 0x4234CCCD, so register n = 0x4234 and register n+1 = 0xCCCD.
With the wrong word order, the BMS reads 0xCCCD4234, which decodes to a large negative number. If a float value looks absurd, try swapping the word order in the BMS or gateway settings.
Status Registers and Bit Fields
Status and alarm information is often packed into a single 16-bit register, with each bit meaning something different. An illustrative example:
| Bit | Meaning when 1 |
|---|---|
| 0 | Regeneration active |
| 1 | Heater on |
| 2 | Common alarm |
| 3 | High ΔP warning |
| 4 | High ΔP critical |
| 5 | Low ΔP |
| 6 | High back-pressure |
| 7 | High outlet temperature |
| 8 | Sensor fault |
| 9–15 | Reserved |
If the register reads 9 (binary 0000 0000 0000 1001), bits 0 and 3 are set: regeneration active and high ΔP warning. That’s a sensible combination, because a regeneration often starts when ΔP is high.
In the BMS or gateway, each bit should be mapped to its own named digital point. Check whether the map numbers bits from 0 or 1, and from the least significant bit, which is the usual convention, or the most significant.
An Illustrative RECD Register Map
The map below is an example for explanation only. Your controller’s register map will differ.
| Doc address | Offset | Name | Type | Scale | Offset | Units | Access |
|---|---|---|---|---|---|---|---|
| 40001 | 0 | Status bits | Bit field | — | — | — | R |
| 40002 | 1 | ΔP across RECD | UINT16 | 0.1 | 0 | mbar | R |
| 40003 | 2 | Engine back-pressure | UINT16 | 0.1 | 0 | mbar | R |
| 40004 | 3 | Inlet temperature | INT16 | 1 | 0 | °C | R |
| 40005 | 4 | Outlet temperature | INT16 | 1 | 0 | °C | R |
| 40006–40007 | 5–6 | Running hours | UINT32 (high word first) | 0.1 | 0 | h | R |
| 40008–40009 | 7–8 | Regeneration count | UINT32 (high word first) | 1 | 0 | count | R |
| 40010 | 9 | Hours since last regeneration | UINT16 | 0.1 | 0 | h | R |
| 40011 | 10 | Heartbeat counter | UINT16 | 1 | 0 | — | R |
| 40012 | 11 | Firmware version | UINT16 | 0.01 | 0 | — | R |
A good register map includes all of these columns. If yours doesn’t, ask the RECD supplier to complete it before integration starts.
Detecting Silent Failures: Heartbeats and Comms Status
A frozen value can look perfectly normal. If the controller stops updating, or the link breaks and the BMS keeps showing the last value, operators may not notice for days.
Two safeguards help:
- Heartbeat counter: a register that the controller increments every few seconds. If the BMS sees it stop changing, it raises a “controller not updating” alarm.
- Communication status: the BMS or gateway monitors response timeouts and raises a “comms fail” alarm when the RECD controller stops replying.
Both should appear in the alarm response matrix. See how to design an RECD alarm response matrix for operators.
RS-485 Wiring Basics for Modbus RTU
Many Modbus RTU problems are physical, not configuration errors. Key points:
- Use twisted-pair shielded cable designed for RS-485, and keep it away from power cables and hot exhaust surfaces. See RECD cable routing near hot exhaust lines.
- Daisy-chain devices along a single bus. Avoid star wiring and long spurs.
- Terminate both ends of the bus with a resistor matching the cable’s characteristic impedance (typically 120 Ω), and only at the two ends.
- Provide biasing if the master or a device doesn’t already, so the line idles in a defined state.
- Connect the signal reference (common) between devices, as well as the two data lines.
- Ground the shield at one point only to avoid ground loops.
- Match communication settings on every device on the bus: baud rate, data bits, parity and stop bits. The Modbus serial guideline default is even parity. If no parity is used, two stop bits are normally expected, though many devices are configured differently in practice.
- Give every slave a unique ID.
Mixed-up A/B (or + / −) labelling between manufacturers is common. If nothing communicates, swapping the two data wires is a legitimate test.
Polling Settings
- Poll interval: RECD values change slowly, so a few seconds is plenty. Faster polling adds bus load without benefit.
- Read in blocks: read contiguous registers in one request rather than one register per request. Modbus allows up to 125 registers in one read.
- Timeouts and retries: set a sensible timeout (a second or so for RTU at common baud rates) and a small number of retries before declaring a communication failure.
- Multiple RECDs on one bus: stagger polling so one slow device doesn’t hold up the others.
A Step-by-Step Mapping and Test Method
- Get the official register map from the RECD supplier, with data types, scaling, offsets, units, word order and access for every point.
- Agree the points to integrate with the BMS contractor, using a points schedule. See integrating RECD monitoring with a building management system.
- Confirm communication settings: slave ID, baud rate, parity and stop bits (RTU), or IP address, port and unit ID (TCP).
- Test with a Modbus master tool on a laptop before configuring the BMS. Read raw registers and compare them with the controller’s local display.
- Identify one “anchor” value, such as firmware version or a fixed setting, to confirm addressing is correct (no off-by-one).
- Check each data type and scale against the local display, with the DG off and again with it running at load.
- Check 32-bit values for word order. Confirm the running hours match the controller’s display.
- Check signed values at a negative or low reading if possible, or by reviewing the raw hexadecimal.
- Check each status bit by creating or simulating the condition, where the controller allows.
- Test failure detection: disconnect the cable and confirm the BMS raises a communication alarm, and that the heartbeat alarm works.
- Document everything: final mapping file, gateway configuration backup and signed test sheet.
Documenting the Final Mapping
When integration is complete, record the final, tested configuration in one document. It should include, for every point:
- BMS point name and description
- Register type, address and the addressing convention used (zero- or one-based)
- Data type, word order (for 32-bit values), scale factor, offset and units
- Bit number, for points taken from status registers
- Test result: local display value and BMS value at the time of testing, with date and tester’s initials
Add the communication settings (slave IDs, baud rate, parity, IP addresses and polling interval) and a backup of the gateway configuration file. Keep a copy with the BMS documentation and another with the RECD’s records. When a controller is replaced or its firmware is updated, check this document against the new register map before reconnecting. A firmware change can sometimes move registers or change scaling.
Troubleshooting Table
| Symptom | Likely cause | Check |
|---|---|---|
| All values shifted to the wrong names | Off-by-one addressing | Zero-based vs one-based setting |
| Value 10× or 100× too large | Missing scale factor | Scale in BMS vs register map |
| Temperature shows ~65,000 when cold | Signed value read as unsigned | Set INT16 |
| 32-bit value huge or nonsensical | Word order mismatch | Swap word order |
| Float shows tiny or negative absurd value | Word or byte order mismatch | Swap word order; check float type |
| No response at all (RTU) | Wrong settings, wiring or slave ID | Baud/parity/ID; A/B swap; termination |
| Intermittent timeouts (RTU) | Noise, missing termination or bias, long spurs | Cable route, termination, biasing |
| Values frozen but no alarm | No comms or heartbeat monitoring | Add heartbeat and comms alarms |
Related Reading
- Integrating RECD monitoring with a building management system
- How to design an RECD alarm response matrix for operators
- Does an RECD need internet access to operate?
- RECD monitoring during a power failure: what should stay available?
- RECD controller and heater power supply requirements
Frequently Asked Questions
Does every RECD have a Modbus output?
No. Some RECDs have only local gauges or simple alarm contacts. Devices with electronic controllers often offer Modbus, but check with your supplier, and specify it at the ordering stage if you need it.
Is 40001 the same as register 0?
In the common convention, yes. 40001 is documentation shorthand for the first holding register, which is sent as offset 0 in the actual Modbus message. Whether your BMS expects “40001” or “0” depends on its software, so test with a known value.
Why does my float value look wrong when integers are fine?
Floats occupy two registers, so word order matters. Integers in a single register aren’t affected. Try swapping the word order setting for that point.
Should I read input registers or holding registers?
Whichever the register map specifies for each point. Some controllers put measured values in input registers (read with function 04) and settings in holding registers (function 03). Others put everything in holding registers. Using the wrong function code typically returns an error or the wrong data, so match the function code to the table named in the map.
Can I write settings to the RECD controller from the BMS?
Only if the supplier documents which registers are writable and approves it. Writing to the wrong register could change regeneration or alarm settings. For monitoring, read-only access is safest.
How many devices can share one RS-485 bus?
The protocol allows up to 247 slave addresses, but the practical limit depends on the RS-485 hardware’s electrical load and on cable length. For a few RECD controllers and DG controllers in one plant room, a single well-wired bus is usually fine.
Get the Numbers Right Before They Reach the Operator
A correct register map and a disciplined test method turn raw Modbus numbers into reliable RECD information. Aceget supplies CPCB type-approved Retrofit Emission Control Devices for DG sets from 25 kVA to 2500 kVA. We can confirm what monitoring outputs your device offers and support your BMS contractor during integration. See our certifications, or contact our team with your BMS or SCADA requirements.
[…] RECD Modbus data: units, scaling and register mapping explained […]