There are two devices:

  1. Eaton EM20/M (~like Northern Design Cube 400)
  2. Volison ADM-5850G

Connected them like:


Trying to get data from EM20/M which supports ModbusRTU(RS-485) protocol using ADM-5850G converter ModbusTCP<>ModbusRTU.

Converter(ADM-5850G) and Slave(EM20/M) are set for 9600 baud rate.
Also, the converter's settings:


Some EM20/M's programming pages:


Created a packet containing 00 01 00 00 00 06 01 03 9e 42 00 01 which should read 1 register at address 40515 from EM20/M which Slave ID is 1. Register's address got from references below(links).


Sent same packet using two tools(wireshark shows same result for both tools):

  1. modpoll(https://www.modbusdriver.com/modpoll.html)
    Command: modpoll -a 1 -r 40515 -c 1 -1 -l 1000 -o 0.5

  2. netcat
    Command: echo -en "\x00\x01\x00\x00\x00\x06\x01\x03\x9e\x42\x00\x01" | nc -w 1 502


  1. A "Cmd" on EM20/M led blinks one time after command having being sent and there's no response:

  2. 1 modpoll program outputs: Reply time-out!:


  1. 2 netcat just outputs nothing

The question:

Why is there no response?
Do we send a valid packet(also, note that "Cmd" led blinks shortly on EM20/M after command sent)?


  1. ModbusTCP: http://www.simplymodbus.ca/TCP.htm
  2. EM20/M manual we didn't find, but found Cube 400's: https://www.ndmeter.co.uk/brochures/Manuals/Cube%20400%20Manuals.zip
  • \$\begingroup\$ "like" Cube400 doesn't make it the same as EM20/M. aspects of the communications are likely different \$\endgroup\$ – JonRB Dec 31 '18 at 9:53
  • \$\begingroup\$ @JonBB, it's visually similar. There's no manuals for EM20/M at all. All aspects from manual of Cube400(programming, menu...) works well with EM20/M. \$\endgroup\$ – V.7 Dec 31 '18 at 9:59
  • \$\begingroup\$ Also, as you can see on programming page above(at EM20/M), it shows Cube Addr which means it's Cube's firmware. \$\endgroup\$ – V.7 Dec 31 '18 at 10:29

Try register 515 instead of 40515. the 4x prefix is just to say "holding registers" If that doesn't work, try 514, for register addresses vs register numbers.

The "comm light" can blink just because it received a modbus request it understood, but had no answer for. It's nice if devices reply with "illegal register" and it's in the protocol docs, but you can't force devices to follow it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.