Repository navigation
Modbus Register Reference (EN)
Consolidated from the official data-point list 83807301 (1/2025-11), the manufacturer xlsx (2022), and the weishaupt_modbus Home Assistant integration — live-verified on a WBB unit (July and September 2026: full-range scan 30000-49999, block-width probes, menu ranges).
Disclaimer — community reference, no guarantee. Rows marked
⚠️ are not in the official documentation (found via the integration or register scans; live-checked but unofficial). Writing to registers can change how the heat pump operates and the controller EEPROM has a limited number of write cycles — use at your own risk.
| Parameter | Value |
|---|---|
| TCP port / Slave ID |
502 / 1 (all devices use the same ID; distinguished by IP) |
| Addressing | literal: doc address 30001 = protocol address 30001 (no ±1 offset). Depending on your Modbus software, ±1 may be required. |
| Function codes |
3xxxx → FC4 (input, read) · 4xxxx → FC3 (holding, read) / FC6 (write) |
| Block read | data-point list: max. 5 registers; live: any width inside an address band, see Address bands |
| Write limit 100,000 accesses over lifetime → write setpoints rarely! | |
| Internal operating states can override Modbus commands → read status (30006 / 33101) regularly. |
| Format | Type | Value range / encoding |
|---|---|---|
| Temperature | signed short | −500…5000 = −50.0…500.0 °C (÷10) |
| Percent / humidity | unsigned short | 0…100 % · 0xFFFF (65535) = no value |
| Setpoint | signed short | −32768 = no setpoint demand active · 1 = same · 50…5000 = 5.0…500.0 °C (2025 list). For the writable setpoints with an "off" (41109–41112, 42105) 0x8000 is a settable state: the controller's menu offers Aus beside the value |
| Heating curve | unsigned short | 0 = OFF · 5…150 = 0.05…1.50 (÷100) |
| Flow rate | unsigned short | ÷100 → m³/h |
| Energy | unsigned short | 0…65535 kWh (16-bit, overflows!) |
| Digital | unsigned short | 0 = OFF · 1 = ON · 2…65535 = undefined |
| Operating hours / counter | unsigned short | 0…65535 h |
Re-evaluate on each poll — these are not permanent states.
| signed | unsigned / hex | Meaning |
|---|---|---|
| −32768 | 32768 · 0x8000
|
no sensor installed |
| −32767 | 32769 · 0x8001
|
sensor open circuit (faulty) |
| −32766 | 32770 · 0x8002
|
sensor short circuit |
| −32758 | 32778 · 0x800A
|
sensor digital status OFF |
| −32757 | 32779 · 0x800B
|
sensor digital status ON |
| Address | Name | FC | Access | Format | Value range / encoding |
|---|---|---|---|---|---|
30001 |
Outdoor temperature 1 | 4 | R | Temperature | −50.0…500.0 °C (÷10) |
30002 |
Outdoor temperature 2 (air intake) | 4 | R | Temperature | −50.0…500.0 °C |
30003 |
Error | 4 | R | Error code | N = error code · 65535 = no error |
30004 |
Warning | 4 | R | Error code | N = warning code · 65535 = no warning |
30005 |
Error-free | 4 | R | Status | 0 = error active · 1 = fault-free operation |
30006 |
Operating status display | 4 | R | Status | 0…43 → code table below |
40001 |
System operating mode | 3 | R/W | Selection | 0=AUTO · 1=HEATING · 2=COOLING · 3=SUMMER · 4=STANDBY · 5=2nd heat gen. · 0 and 2 only with cooling enabled (data-point list 2025; WBB manual ch. 6.7.2, cooling release in the heating circuit), 5 only with a second heat source set up. Without the release the controller acknowledges a 0 (counts as a write) but keeps the previous mode (live) |
40002 |
SollwertPV (PV power setpoint) | 3 | R/W | PV | unsigned 0…65535 W; 0 = function off. Not stored in EEPROM, so no write limit. Documented in data-point list ch. 3.2 / 4.3 |
HC2–4: same registers with offset +100 / +200 / +300 (data-point list). HC5 (+400)
| Address | Name | FC | Access | Format | Value range / encoding |
|---|---|---|---|---|---|
31101 |
Room setpoint temperature | 4 | R | Setpoint | −32768 / 1 = no demand · 50…5000 = 5.0…500.0 °C |
31102 |
Room temperature | 4 | R | Temperature | −50…500 °C · 0x8000 = no room sensor |
31103 |
Room humidity | 4 | R | Percent | 0…100 % · 0xFFFF = no value |
31104 |
Flow setpoint temperature | 4 | R | Setpoint | −32768 / 1 = no demand · 50…5000 = 5.0…500.0 °C |
31105 |
Flow temperature (heating) | 4 | R | Temperature | −50…500 °C |
31106 |
Operating mode (copy) |
4 | R | Status | undocumented · copy of 41103 (0=AUTO · 1=COMFORT · 2=NORMAL · 3=LOWERING seen); followed every mode change in the same poll, read 0 in AUTO with a time program fixed at comfort, so not the effective level. Room unit, holiday program, lock input untested |
41101 |
Heating configuration | 3 | R | Status | 0=OFF · 1=PUMP CIRCUIT · 2=MIXED CIRCUIT · 3=SETPOINT (pump M1) |
41102 |
Demand type |
3 | R/W | Selection | 0=OFF · 1=weather-compensated · 2=room-guided · 3=constant. Live-verified on WSB8 and WBB20 (upstream #126); the menu offers room-guided only with a room unit. The 2022 xlsx (2=constant) is wrong; not in the 2025 list |
41103 |
Operating mode | 3 | R/W | Selection | 0=AUTO · 1=COMFORT · 2=NORMAL · 3=SETBACK · 4=STANDBY |
41104 |
Pause / Party | 3 | R/W | Selection | 1…24 = pause 12.0…0.5 h · 25 = off · 26…49 = party 0.5…12.0 h |
41105 |
Room setpoint Comfort | 3 | R/W | Temperature | 16…28 °C (step 0.5) |
41106 |
Room setpoint Normal | 3 | R/W | Temperature | 16…28 °C |
41107 |
Room setpoint Setback | 3 | R/W | Temperature | 16…28 °C |
41108 |
Heating curve | 3 | R/W | Curve | 0 = OFF (setpoint shutdown) · 5…150 = 0.05…1.50 |
41109 |
Summer/winter switchover | 3 | R/W | Temperature | 3.0…30.0 °C · 32768 = no summer shutdown |
41110 |
Heating constant temperature | 3 | R/W | Setpoint | 7…66 °C (controller menu; further clamped by the circuit's own min/max flow settings, which have no register; 2022 xlsx said 20…45) · 0x8000 = off (live) |
41111 |
Heating constant temp. setback | 3 | R/W | Setpoint | 7…66 °C (like 41110) · 0x8000 = off (live: off) |
41112 |
Cooling constant temperature | 3 | R/W | Setpoint | 7…30 °C (controller menu; setback 18.5…29.5, cooling min/max 7…30) · 0x8000 = off |
| Address | Name | FC | Access | Format | Value range / encoding |
|---|---|---|---|---|---|
32101 |
DHW setpoint temperature | 4 | R | Setpoint | the DHW setpoint in force right now (e.g. normal or setback), not the flow setpoint the heat pump runs during a DHW charge – that one has no register (only the local web interface shows it, Info › Wärmepumpe › "Solltemperatur"). −32768 / 1 = no demand · 50…5000 = 5.0…500.0 °C |
32102 |
DHW temperature | 4 | R | Temperature | −50…500 °C |
42101 |
DHW configuration | 3 | R | Status | 0 = OFF · 1 = diverter valve · 8 = pump |
42102 |
DHW push | 3 | R/W | Selection | 0 = OFF · 5…240 min |
42103 |
DHW Normal | 3 | R/W | Setpoint | 20 °C … DHW maximum temperature (a menu setting without register, itself 20…80 °C) |
42104 |
DHW Setback | 3 | R/W | Setpoint | 10 °C … DHW Normal |
42105 |
SG-Ready boost | 3 | R/W | Setpoint | 0…30 °C · 0x8000 = off (settable; live: off) |
| Address | Name | FC | Access | Format | Value range / encoding |
|---|---|---|---|---|---|
33101 |
Operation | 4 | R | Status | 0…43 → code table below |
33102 |
Fault message | 4 | R | Status | 0 = fault · 1 = fault-free |
33103 |
Power demand | 4 | R | Percent | 0…100 % |
33104 |
Flow temperature | 4 | R | Temperature | −50…500 °C · sensor B4, the condenser flow sensor (manual WBB 12…20, ch. 6.7.1.2), right at the heat pump's outlet. Live in 0.5 K steps |
33105 |
Return temperature | 4 | R | Temperature | −50…500 °C · sensor B9 (manual). Live in 0.5 K steps. Spread over the heat pump = 33104 − 33105 |
33106 |
Evaporation temperature |
4 | R | Temperature | undocumented; plausible live |
33107 |
Compressor suction gas temp. |
4 | R | Temperature | undocumented; plausible live |
33108 |
Hydraulic separator | 4 | R | Temperature | −50…500 °C (2025 official) |
33109 |
Regenerative (flow demand) | 4 | R | Temperature | −50…500 °C (2025 official) |
33110 |
Buffer | 4 | R | Temperature | −50…500 °C (2025 official) |
33111 |
Common flow (B7) | 4 | R | Temperature | −50…500 °C (2025 official) · the manual's outlet flow sensor (B7), the heating circuit's flow temperature. 0.1 K steps, but refreshed by the controller only every ~3 minutes (live, October 2026): against the continuously refreshed return, B7 − 33105 goes negative while starting and double-digit after a stop. Equal to 33104 at rest |
33126 |
Electrical power consumption |
4 | R | Number, W | 0…65535 W, 0 at standstill; documented nowhere. Checked against an external meter on a WBB 12 (heating, up to 1 kW): tracks it with r = 0.97, about 80 W below — the circulation pump and the controller are not included. Older firmware may not serve it (unconfirmed). evcc reads it the same way. |
43101 |
Configuration | 3 | R | Status | config code (live 4) |
43102 |
Quiet mode | 3 | R | Selection | code (live 0) |
43103 |
Pump start mode | 3 | R | Selection | code (live 1) |
43104 |
Pump power heating | 3 | R | Percent | 0…100 % |
43105 |
Pump power cooling | 3 | R | Percent | 0…100 % |
43106 |
Pump power DHW | 3 | R | Percent | 0…100 % |
43107 |
Pump power defrost | 3 | R | Percent | 0…100 % |
43108 |
Flow rate heating | 3 | R | Flow rate | ÷100 → m³/h (live 1.68). The indoor unit's flow sensor is B10 per the manual; whether 43108–43110 carry its actual value or a setting is open. The local web interface shows the actual value (0.0 at rest, 1.7 m³/h during a DHW charge) |
43109 |
Flow rate cooling | 3 | R | Flow rate | ÷100 → m³/h |
43110 |
Flow rate DHW | 3 | R | Flow rate | ÷100 → m³/h |
⚠️ The table above is a WBB's, live-verified (43104–43107 = pump powers, 43108–43110 = flow rates). The manufacturer docs (2022) list 43101 twice (Configuration and Quiet mode) and end the block at 43109, one register shorter.
⚠️ Shorter block on a WSB 8 (WWP-CPU COM V5.2): 43110 is refused, and the pump powers sit one register lower, as in the manufacturer docs. This integration reads the block as a whole, so on such a controller all of 43101–43110 should go unavailable; older versions read each register and showed the wrong value, for example 253 % as the defrost pump power. Display and web interface fit heating, cooling and DHW there, though two equal values leave the roles to the docs; defrost and the flow rates are from the docs only, and which models have this layout is not known.
| Register | WBB (table above) | Manufacturer docs 2022, seen on a WSB 8 |
|---|---|---|
43102 |
Quiet mode | Pump start mode or Quiet mode (the docs disagree) |
43103 |
Pump start mode | Pump power heating |
43104 |
Pump power heating | Pump power cooling |
43105 |
Pump power cooling | Pump power DHW |
43106 |
Pump power DHW | Pump power defrost |
43107 |
Pump power defrost | Flow rate heating |
43108 |
Flow rate heating | Flow rate cooling |
43109 |
Flow rate cooling | Flow rate DHW |
43110 |
Flow rate DHW | not there (Illegal Data Address) |
ℹ️ 43102–43110 are holding registers, but the
weishaupt_modbusintegration exposes them read-only (NUMBER_RO).
| Address | Name | FC | Access | Format | Value range / encoding |
|---|---|---|---|---|---|
34101 |
Status 2nd heat gen. | 4 | R | Digital | 0 = OFF · 1 = ON |
34102 |
Operating hours 2nd heat gen. | 4 | R | Counter | 0…65535 h |
34103 |
Switching cycles 2nd heat gen. | 4 | R | Counter | 0…65535 (old docs; no longer listed in the 2025 list) |
34104 |
Status electric heater 1 | 4 | R | Digital | 0 = OFF · 1 = ON |
34105 |
Status electric heater 2 | 4 | R | Digital | 0 = OFF · 1 = ON |
34106 |
Operating hours electric heater 1 | 4 | R | Counter | 0…65535 h |
34107 |
Operating hours electric heater 2 | 4 | R | Counter | 0…65535 h |
44101 |
W2 configuration | 3 | R | Status | config code · 255 = not present (live) |
44102 |
Configuration EP1 |
3 | R | Status | config code (live 5); not listed in docs |
44103 |
Configuration EP2 |
3 | R | Status | config code (live 6); not listed in docs |
44104 |
Limit temperature | 3 | R/W | Temperature | −20…40 °C · 0x8000 if inactive |
44105 |
Bivalence temperature | 3 | R/W | Temperature | −20…40 °C (live −20.0) |
44106 |
Bivalence temperature DHW | 3 | R/W | Temperature | −20…40 °C (live −20.0) |
⚠️ The manufacturer docs (2022) list limit/bivalence temperature at 44102–44104 — they are actually at 44104–44106 (EP1/EP2 config in between; live-verified).
| Address | Name | FC | Access | Format | Value range / encoding |
|---|---|---|---|---|---|
35101 |
SG-Ready 1 | 4 | R | Digital | 0 = OFF · 1 = ON · 2…65535 = undefined (live 0, config 45101 = 1) |
35102 |
SG-Ready 2 |
4 | R | Digital |
Documented inconsistently: the 2025 list gives Format FormatDigital but the value column says "counter 0…65535 h", a text otherwise used only for FormatBetriebsstunden rows (34102, 34106, 34107). Most likely a copy error and 0 = OFF · 1 = ON like SG-Ready 1. Live 0 (config 45102 = 2), so undecidable here |
35103 |
Input H1.2 | 4 | R | Sensor | temp −500…5000 = −50.0…500.0 °C · −32768 no sensor · −32767 open · −32766 short · −32758 / −32757 = digital OFF / ON when the input carries a contact. Live 0x800A (= −32758, digital OFF) with config 45103 = 3 |
35104 |
Input H1.3 | 4 | R | Sensor | like H1.2. Live 0x8000 (no sensor), config 45104 = 4 |
35105 |
Input H1.4 | 4 | R | Sensor | like H1.2. Live 0 with config 45105 = 3 - the same config code as H1.2, which reports the digital special value instead; meaning of 0 here unknown |
35106 |
Input H1.5 | 4 | R | Sensor | like H1.2. Live 0x8000 (no sensor), config 45106 = 4 |
35107 |
Input DE1 |
4 | R | Digital | same documented inconsistency as 35102 (Format Digital, value text "counter 0…65535 h"); most likely 0 = OFF · 1 = ON. Live 0, function off (45107 = 0xFFFF) |
35108 |
Input DE2 |
4 | R | Digital | as DE1. Live 0, function off (45108 = 0xFFFF) |
45101–45108
|
Configuration SGR1 · SGR2 · H1.2 · H1.3 · H1.4 · H1.5 · DE1 · DE2 | 3 | R | Status | the currently set function of the input, as a code. Checked live (October 2026): DE1 switched in the portal from off to utility lock → 45107 went from 0xFFFF to 1 at once, and back to 0xFFFF when reset. Codes – the values of the local web interface's selection lists, matching SGR1 = 1, SGR2 = 2 and the DE1 test: 0 = SG Ready (SGR1 only) · 1 = utility lock (EVU-Sperre) · 2 = elevated operation · 3 = heating-circuit lock · 4 = heat/cool switchover · 5 = quiet mode · 6 = emergency off · 7 = system standby · 8 / 9 / 10 = generator lock HC / DHW / HC and DHW · 11–14 = DHW standby / setback / normal / push · 15 = dew-point guard · 16–19 = heating circuit 1 standby / setback / normal / comfort · 33 = 2nd heat source · 34 = compressor lock · 35 = power limitation + lock (SGR1 only) · 36 = power limitation · 0xFFFF = off (no function). Live 1/2/3/4/3/4/0xFFFF/0xFFFF (SGR1 switched to utility lock, factory default SG Ready). |
ℹ️ The
weishaupt_modbusintegration still names H1.2–H1.5 (35103–35106) Ausgang (output) - the name carries the entity's unique id and cannot change; the data-point list calls them inputs (Eingang), multifunction terminals.
All FC4, R, unsigned 0…65535 kWh. Suffix: x1 = today · x2 = yesterday · x3 = month · x4 = year.
| Base | Group | Notes |
|---|---|---|
36101–36104
|
Total energy | kWh |
36201–36204
|
Heating energy | kWh |
36301–36304
|
DHW energy | kWh |
36401–36404
|
Cooling energy | kWh |
36501–36504
|
Defrost energy |
kWh · undocumented, responds live |
36601–36604
|
Total energy II |
kWh · undocumented, responds live |
36701–36704
|
Electrical energy |
kWh · undocumented — useful for COP/SPF |
36801 |
unknown |
responds (live 0); meaning unclear |
⚠️ Year registers (x4) read 0 on every controller seen - a WBB in service for years (display and portal show 6705 kWh) and the Evoblock WEB scan in upstream #193. A full-range scan found the yearly total in no other register. Treat36x04as not served; the yearly total exists on the display, in the WEM portal and in the local web interface only (Info › Statistik, three decimals).ℹ️ Total energy II (366xx) equalled Total energy (361xx) on the WBB with defrost energy at 0 - possibly total including defrost; unconfirmed. Yesterday (x2) values change once a day and can fall: not a rising meter.
The controller serves its registers in contiguous bands. A block read of any width inside a band answers normally (12 registers tested); a block that crosses a band end - or an address in no band - answers a malformed exception frame whose code equals 2 x count. So the "max. 5" of the data-point list is a guideline for building automation, not a controller limit. A band the controller does not have (heating circuit 5 on the WBB, a second heat generator on many units) answers the same exception for the whole band.
| Space | Bands |
|---|---|
| Input | 30001-30006 · 31101-31106 (+100 per circuit, 2-5) · 32101-32102 · 33101-33111 · 33126 · 34101-34107 · 35101-35108 · 36101-36104 … 36701-36704 · 36801 |
| Holding | 40001-40002 · 41101-41112 (+100 per circuit, 2-5) · 42101-42105 · 43101-43110 · 44101-44103 · 44104-44106 · 45101-45108 |
Note the split between 44103 and 44104: one block over 44101-44106 is refused.
The band list is checked in the integration's tests against the addresses of
the data-point list (tests/documented_registers.json).
For registers 30006 & 33101 (per 2025 docs).
| Code | Meaning | Code | Meaning |
|---|---|---|---|
| 0 | undefined (the integration ≤1.x showed "PV Mode") | 22 | switchover heat/cool |
| 1 | relay test | 23 | cooling operation |
| 2 | emergency stop | 24 | passive cooling |
| 3 | diagnostics | 25 | summer operation |
| 4 | manual operation | 26 | swimming pool |
| 5 | manual operation heating | 27 | holiday |
| 6 | manual operation cooling | 28 | screed drying |
| 7 | manual defrost | 29 | locked |
| 8 | defrost | 30 | lockout (outdoor temp) |
| 9 | 2nd heat gen. | 31 | lockout (summer) |
| 10 | utility lockout | 32 | lockout (winter) |
| 11 | SG tariff | 33 | operating limit |
| 12 | SG maximum | 34 | heating-circuit lockout |
| 13 | tariff charging | 35 | standby / ready ¹ |
| 14 | boosted operation | 36 | regenerative ² |
| 15 | idle time | 37 | SGR3 heating ² |
| 16 | standby operation | 38 | SGR3 cooling ² |
| 17 | flushing operation | 39 | SGR3 DHW ² |
| 18 | frost protection | 40 | SGR4 heating ² |
| 19 | heating operation | 41 | SGR4 cooling ² |
| 20 | DHW operation | 42 | SGR4 DHW ² |
| 21 | anti-legionella | 43 | oil return ² |
| 44…65535 | undefined |
¹ Older docs / the integration call code 35 "Setback" — the 2025 docs say "STANDBY / READY". ² New in data-point list 1/2025-11.
Legend: R = read only · R/W = read/write (FC6) ·
Sources:
- Weishaupt data-point list Modbus TCP (WWP), doc. no. 83807301, 1/2025-11 (applies to WAB / WBB / WSB / WGB; the Evoblock WEB 7/10 serves the same register set per the scan in upstream #193)
- Controller menu and WEM portal of a WBB (setting ranges, September 2026); Weishaupt WBB 12-20 manual 83315301
- Upstream issue #126 (41102 code mapping, WSB8/WBB20)
- Manufacturer xlsx (2022)
-
OStrama/weishaupt_modbusintegration - Own live verification on a WBB unit (July 2026; September 2026: full-range scan, block widths, bands)
Weishaupt Modbus
- Home
- Installation and Setup
- Entities
- How Data Updates
- Web Interface
- Troubleshooting and Diagnostics
- Migration
Register reference