You’ve got your Solis inverter wired to a USB-to-RS485 adapter, QModMaster is talking to it (wrong slave address gives timeouts, the right one answers) — but every register read comes back Exception Code 02: Illegal Address. The wiring is fine, the baud rate is fine, and the slave ID is right. The trap is in the register address itself, and it’s documented by a real Solis owner’s debugging session on the DIY Solar Forum: Solis’s official documentation lists register addresses like 33025 with the note “no further offset or other conversion is required” — and it means it literally. Type the full address.

The trap: 33025 means 33025, not 3025

Most Modbus tools and tutorials teach you to strip the leading digit off 3xxxx/4xxxx addresses: “input register 33025” becomes protocol address 3024 (or 3025, depending on the tool’s convention). For Solis inverters, that habit breaks everything. The forum poster (RHI-5K-48ES-5G) got Illegal Address errors on every read until he typed the complete address: a 3-register read of 33025–33027 immediately returned a live hh:mm:ss clock value from the inverter.

So in QModMaster: enter 33025 in the address field — don’t subtract 1, don’t strip the leading 3, don’t convert. If the manual’s address table says 33000, you read 33000. Trust the manual’s literal numbers.

Baseline settings that must be right first

From the same real-world session, the working baseline for talking to a Solis inverter over its COM connector:

• Mode: Modbus RTU over RS485 (2-core cable to the COM connector’s A/B pins).
• Serial: 9600 bps, 8 data bits, 1 stop bit, no parity (8N1).
• Slave address: must match the address set on the inverter itself. A wrong slave ID gives timeouts; the right ID with a wrong register gives Illegal Address — that difference is actually a useful diagnostic.
• Function code: 0x04 (Read Input Registers) for the 3xxxx measurement registers.

Always confirm these against your own Solis manual — settings and pinouts can vary between models and firmware generations.

Watch the byte order on multi-register values

The forum session also surfaced a second quirk: some multi-byte values came back looking byte-swapped until interpreted the other way round (the poster saw an unfeasibly large decimal where a small value was expected, and the swap theory led to the breakthrough). If your single-register reads are fine but 32-bit values look wrong, try the swapped byte/word interpretation in QModMaster’s View menu before assuming the address is wrong — and cross-check the expected byte order in your Solis documentation.

The hardware you need

USB-to-RS485 adapter (Amazon) — the forum poster’s setup used a USB-RS485 serial adapter straight to a laptop. A dependable FTDI-based adapter is the safest first purchase; unstable adapters mimic the exact “timeout vs Illegal Address” confusion this page helps you avoid.

FAQ

QModMaster says “Illegal Address” on my Solis inverter but the wiring seems fine. What’s wrong?
Almost certainly the address format: type the full address from the Solis manual (e.g. 33025), not a stripped or minus-1 variant. The official Solis documentation states no offset or conversion is required — take it literally.

How do I tell a wiring problem from an addressing problem?
Change the slave address to a wrong value: timeouts mean the wiring/serial settings are wrong; the correct slave ID with wrong register addresses gives Illegal Address (exception 02). That distinction tells you which half of the setup to fix.

My 32-bit Solis values are huge nonsense numbers. Offset problem?
Probably not an offset — single registers reading fine points to byte/word order instead. Try the swapped interpretation in QModMaster’s View menu and verify against your manual.

Related Guides

• QModMaster tutorial: your first register read
• USB-to-RS485 adapter buying guide

The full-address finding (33025–33027 returning live data) comes from a real owner’s debugging thread on the DIY Solar Forum (Solis/Ginlong Modbus Comms). Solis register tables, serial settings, and pinouts vary by model — always confirm against your own inverter’s manual. qmodmaster.com is an independent community resource for the upstream QModMaster project (LGPLv3) and is not affiliated with Solis.

You’ve got the Carlo Gavazzi EM24 energy meter wired up, QModMaster returns registers without errors — and the numbers are nonsense. Voltage reads as millions of volts, or the power figure is off by a factor of 65,536. Before you rewire anything: the EM24 uses little-endian word order (low word at the lower address), the opposite of what most Modbus devices use. That single reversed assumption is the #1 cause of wrong EM24 readings, and it’s documented in the EM24 register-map reference used by the victron-grid-meter-esphome project, which emulates an EM24 over Modbus TCP: “All multi-register values use little-endian word order (low word at lower address)”.

What “little-endian word order” means in practice

A 32-bit value spans two 16-bit registers. On most devices the high word sits at the lower address (big-endian words: high word first). On the EM24 it’s flipped — the low word comes first:

Registers at 0x0000, 0x0001 hold a 32-bit voltage value
  0x0000 = LOW word    (EM24: low word at lower address)
  0x0001 = HIGH word

  value = LOW + HIGH × 65536        (then apply the scale)

Wrong assumption (big-endian words):
  value = HIGH + LOW × 65536        → garbage / millions

So if you decode EM24 registers the “normal” way, every 32-bit reading — voltage, current, power, energy — comes out wrong. It’s not a wiring problem and it’s not a bad meter. It’s the word order.

Step 1: Prove your link with the Model ID register

Before touching multi-register values, read a single 16-bit register that has a known answer. The EM24 register map lists address 0x000B as the Model ID, which should read 1648 (EM24DINAV23XE1X). In QModMaster:

• Function code 0x03 or 0x04 (the EM24 map supports both for reads), Unit ID matching your meter’s slave address.
• Read 1 register at address 0x000B.
• Expect 1648. If you get it, your link, baud rate, and addressing are all correct — anything weird after this point is data interpretation, not communication.

Step 2: Read voltage and test both word orders

Now read 2 registers starting at 0x0000 (Voltage L1, int32, scale ÷10 V) and display them as raw hex (QModMaster’s View menu lets you switch the display format). Then decode both ways by hand:

Example: registers read back as 0x0000 = 0x08FC, 0x0001 = 0x0000

Little-endian words (correct for EM24):
  value = 0x08FC + 0x0000 × 65536 = 2300  →  2300 ÷ 10 = 230.0 V  ✓

Big-endian words (wrong for EM24):
  value = 0x0000 + 0x08FC × 65536 = 587,202,560  → garbage  ✗

Whichever decoding matches your multimeter / the meter display is your answer. For the EM24, it will be the little-endian one. Apply the same low-word-first rule to every 32-bit register.

EM24 register map (Ethernet model, excerpt)

From the community-documented EM24 register map — confirm every address against your own Carlo Gavazzi manual, as variants differ:

Per-phase registers step by 2 per phase: L1 at the base address, L2 at base+2, L3 at base+4. Power is signed (negative = exporting); current is always a positive magnitude with direction taken from the power sign.

Wiring the meter to your PC

USB-to-RS485 adapter (Amazon) — to read an EM24 over its serial port you’ll need a USB-to-RS485 adapter on the PC side. Get an FTDI-based one; flaky adapters are the classic source of intermittent Modbus timeouts.

FAQ

My EM24 voltage reads in the millions. Is the meter broken?
No — you’re decoding with big-endian word order. The EM24 puts the low word first. Re-decode as low + high × 65536 and the value will snap to something sensible.

How do I confirm my communication settings are right before worrying about word order?
Read address 0x000B (Model ID). It should return 1648 on an EM24DINAV23XE1X. If it does, your link is fine and any wrong values are an interpretation problem.

Does the word order apply to energy registers too?
Yes — every multi-register (32-bit) value on the EM24 uses little-endian word order, including power and energy. Single 16-bit registers (like 0x000B and 0x0033) are unaffected.

Related Guides

• QModMaster tutorial: your first register read
• USB-to-RS485 adapter buying guide

The little-endian word order and register map above are documented in the remcom/victron-grid-meter-esphome project (an EM24 Modbus TCP emulation whose register table mirrors the meter). Register addresses, scales, and word order can vary between EM24 variants — always confirm against your Carlo Gavazzi manual. qmodmaster.com is an independent community resource for the upstream QModMaster project (LGPLv3) and is not affiliated with Carlo Gavazzi.

Writing a Home Assistant register definition for a Deye inverter from the Modbus manual alone is how garbage sensors get born. The advice from the Deye Modbus TCP integration project (leonelfaugusto/deye-modbus-tcp) is blunt: use a Modbus client like QModMaster to verify every register against the live inverter before writing the definition. This page shows you exactly how to do that verification pass, including the temperature offset trap that catches almost everyone once.

Before you open QModMaster: the Deye preconditions

Deye inverters are usually reached through an RS485 bridge (e.g. a Waveshare RS485-to-WiFi/ETH module) in Modbus TCP mode. The integration’s tested setup pins down the preconditions — verify each on your hardware first:

• Inverter Modbus SN = 01. Set under “Advanced Function” on the inverter display — this is the slave ID your Modbus client must use.
• Baud rate 9600 bps, 8N1. It must match on both the bridge and the inverter.
• Bridge in Modbus TCP ⇄ Modbus RTU mode, not Transparent. Transparent mode passes raw frames and the framing is different — your reads will fail or decode as garbage.

QModMaster connection settings

Go to Options → Modbus TCP and set:

Use function code 0x03 (Read Holding Registers) — Deye’s sensor map lives in holding registers, per the integration’s register definitions.

Verify registers one at a time, against the inverter screen

Don’t bulk-scan the whole map in one go. Read each register individually, apply its scale factor, and compare the result with the value shown on the inverter’s display:

• Read a register and note the raw value.
• Apply the scale multiplier from the manual (e.g. 0.1).
• Stand in front of the inverter (or open its local monitoring page) and compare. If the numbers disagree, your address, function code, or scale is wrong — not the inverter.
• Pay attention to signed vs unsigned: power and current values that can go negative are typically int16; reading them as unsigned flips the sign.

The temperature offset trap: subtract 1000 first

This is the Deye-specific gotcha that makes temperatures read as hundreds of degrees. Some Deye temperature registers (the integration documents this for registers like 100/101 on supported models) encode the value with an offset of 1000:

real_value = (raw - 1000) × scale

Concrete example from the integration docs: raw 1250 with scale 0.1 → (1250 − 1000) × 0.1 = 25.0 °C. If your QModMaster read shows a raw value around 1200–1400 on a temperature register, don’t panic — subtract 1000 first, then scale. When writing your HA definition, flag these addresses as temperature registers so the offset is applied automatically. Which addresses carry the offset depends on your exact inverter model and firmware — confirm against your Deye Modbus manual.

Connecting over RS485 instead of a bridge?

USB-to-RS485 adapter (Amazon) — if you skip the network bridge and wire the inverter’s RS485 terminals straight to your PC, a dependable FTDI-based adapter is the first thing to buy; cheap adapters are a classic source of intermittent Modbus timeouts.

FAQ

QModMaster returns values but they’re all wrong-looking. Where do I start?
Check function code first (0x03 holding registers for Deye sensor data), then signed vs unsigned interpretation, then the scale factor — and for temperature registers, the −1000 offset. One of those four explains nearly every “wrong value” report.

My temperature reads ~125 °C. Is the inverter overheating?
Almost certainly not — you’re seeing the raw value before the offset is applied. (1250 − 1000) × 0.1 = 25.0 °C is the correct decoding.

Reads work in QModMaster but my HA definition shows nothing.
Your HA config is asking for different addresses, a different Unit ID, or reading in blocks with gaps the bridge can’t serve. Since QModMaster proves the hardware path works, the bug is in the definition — re-verify each address against what QModMaster returned.

Related Guides

• QModMaster tutorial: your first register read
• USB-to-RS485 adapter buying guide

Verification workflow and the temperature-offset formula are documented in the leonelfaugusto/deye-modbus-tcp project README. Register addresses, scales, and which registers carry the offset vary by Deye model and firmware — always confirm against your inverter’s Modbus manual. qmodmaster.com is an independent community resource for the upstream QModMaster project (LGPLv3) and is not affiliated with Deye or the integration’s authors.

If you’re wiring a Sungrow SH-series inverter into Home Assistant and the sensors come up empty, don’t start by rewriting your YAML. The troubleshooting guide of the popular Sungrow Modbus integration (mkaiser) recommends the same first step: check whether the Modbus connection works at all, using QModMaster — their Check #3. This page walks you through that pre-check so you can tell a hardware problem from a configuration problem in five minutes.

Step 0: Ping the inverter before you touch Modbus

Before opening QModMaster, confirm the inverter is actually on your network. Find its IP in your router’s DHCP client list (or set a DHCP reservation so it doesn’t move), then ping it:

ping 192.168.1.50   # replace with your inverter's IP

If the ping fails, stop — no Modbus client can reach a host the PC can’t see. Fix the network first (cable, switch, Wi-Fi credentials on the dongle), then come back.

Step 1: Use the internal LAN port, not the WiNet-S dongle

This is the single most common Sungrow gotcha. Recent Sungrow inverters ship with a WiNet-S dongle whose main job is talking to Sungrow’s iSolarCloud servers — its local Modbus access is a low-priority side feature, and some registers available on the internal LAN port simply aren’t exposed through it. The integration’s troubleshooting guide (Check #1) strongly recommends the inverter’s internal LAN port and treats the WiNet-S as a usual suspect for flaky Modbus. Connect the cable directly to the internal port, then make sure the inverter picks up an IP — some units only get an address on a cold boot, so a full power cycle (AC off, wait, battery/DC off, wait, then back on) can be necessary.

Step 2: Set the QModMaster TCP parameters

In QModMaster, go to Options → Modbus TCP and set the TCP options, then fill in these connection parameters. Each one must match your own setup — the integration’s guide maps them directly to your Home Assistant secrets.yaml values:

Note: 502 is the standard Modbus TCP port. If your setup routes Modbus through a gateway or bridge on a different port, use that port instead — always confirm against your own device manual and configuration.

Step 3: Read a register and sanity-check the value

With the TCP settings in place, request a read (function code 0x04, Read Input Registers) of a register your inverter actually supports and compare the result with what the inverter display shows. A sensible number means the link is healthy and the problem is in your Home Assistant configuration (entity mapping, scan interval, wrong Unit ID there). A timeout or an exception response means the problem is below Home Assistant — go back to Steps 0–2.

Two Sungrow-specific notes from the integration’s guide: users with single-phase inverters (SH3.RS style) report that only a subset of the documented registers answer — register availability is decided by Sungrow’s firmware, and no client-side tweak can unlock more. And if nothing answers at all after a firmware update, power-cycle the inverter as described in Step 1.

Do you need an adapter at all?

This pre-check runs over your LAN (Modbus TCP) — no serial hardware needed. If instead you plan to reach the inverter over its RS485 terminals, you’ll need a USB-to-RS485 adapter on the PC side:

USB-to-RS485 adapter (Amazon) — grab a reliable FTDI-based adapter before you start debugging; flaky adapters cause half the “mystery timeouts” in Modbus troubleshooting.

FAQ

QModMaster times out but the inverter pings fine. What now?
Check three things: you’re on the internal LAN port (not WiNet-S), the Unit ID matches your inverter’s slave number, and the inverter actually has an IP (cold-boot it if it was only recently plugged in). A ping only proves the network stack is up, not that Modbus TCP is listening.

I can read some registers but not others. Is my setup broken?
Probably not. Sungrow’s firmware decides which registers exist — single-phase models expose fewer than three-phase ones. Match your expectations to your model’s register table, not the other way round.

QModMaster reads fine, but Home Assistant shows nothing. What’s the difference?
Then the link is healthy and the bug is in your HA config: wrong Unit ID there, wrong register addresses, or a scan interval the inverter can’t keep up with. Fix it in the YAML, not on the wire.

Related Guides

• QModMaster tutorial: your first register read
• USB-to-RS485 adapter buying guide

Connection parameters here are adapted from the mkaiser Sungrow-SHx Modbus Home Assistant integration troubleshooting doc (Check #3). Exact Unit IDs and register availability vary by model and firmware — always confirm against your inverter’s manual and your own configuration. qmodmaster.com is an independent community resource for the upstream QModMaster project (LGPLv3) and is not affiliated with Sungrow or the integration’s authors.

Waveshare’s RS-485-to-Ethernet gateways ship with two completely different operating modes, and picking the wrong one is why your QModMaster connection either works perfectly or fails in confusing ways. This guide explains ModbusTCP conversion mode (port 502) vs transparent transmission mode (port 8899), which one to choose, and exactly how to configure QModMaster for each.

Mode 1: ModbusTCP conversion mode (port 502)

In conversion mode the gateway is a protocol translator. On the Ethernet side it speaks real Modbus TCP — it parses the 7-byte MBAP header, reads the Unit ID byte, and rebuilds the request as a Modbus RTU frame on the RS-485 bus addressed to that slave. Replies travel the reverse path. This is the mode that makes multi-slave setups work: each Unit ID in your TCP request reaches a different RTU device (see our Unit ID gateway guide for the details).

Choose conversion mode when your master software speaks native Modbus TCP — which includes QModMaster’s TCP mode. The Home Assistant community documents this split clearly: integrations use type: tcp against Waveshare gateways in conversion mode, while type: rtuovertcp is reserved for transparent bridges (see the ha-toshiba-modbus docs, which spell out exactly this mapping).

Mode 2: Transparent transmission mode (port 8899)

In transparent mode the gateway is a dumb pipe: raw RS-485 bytes go in one end and come out the other, wrapped in nothing but a TCP stream. There is no MBAP header, no Unit ID parsing, no protocol conversion. Whatever bytes your software sends to port 8899 appear verbatim on the RS-485 bus.

This is the mode behind the well-known port 8899 in the Home Assistant world — Waveshare gateways in transparent mode are reached as “raw RTU over TCP”, which is why HA configs use rtuovertcp for them (documented in the Solis-Local gateway docs: TCP⇔RTU conversion vs transparent raw-RTU-over-TCP). Choose transparent mode when your master only speaks Modbus RTU and you want the Ethernet link to behave exactly like a very long serial cable.

How to connect each mode from QModMaster

Here is the part that trips everyone up: QModMaster only offers two modes — RTU (serial port) and TCP. It has no native RTU-over-TCP option. So the correct QModMaster setup depends entirely on the gateway mode:

• Gateway in ModbusTCP conversion mode → QModMaster in TCP mode. Enter the gateway IP, port 502, and set the Slave ID field to the Unit ID of the device you want (this fills the MBAP Unit ID byte). This is the straightforward, recommended combination for QModMaster users.
• Gateway in transparent mode (8899) → QModMaster in RTU mode via a virtual serial port. Since QModMaster can’t send raw RTU frames over TCP by itself, install a virtual COM port driver that maps a virtual serial port to the gateway’s IP:8899, then open that virtual port in QModMaster’s RTU mode with the correct baud/parity settings. The gateway then acts as a transparent serial extension.

The most common misconfiguration: the gateway sits in transparent mode on 8899 while QModMaster connects in TCP mode to 502 — QModMaster sends MBAP-framed requests into a pipe that forwards the bytes raw, the slaves see garbage framing, and nothing answers. Match the QModMaster mode to the gateway mode and the problem disappears.

This is a first-read walkthrough for Growatt solar inverters using QModMaster, the free open-source (LGPLv3) Modbus master simulator from the upstream project. The settings below come from a community-tested setup — a Growatt SPH10000TL3 BH-UP read through a PUSR gateway, with function code 0x04 starting at address 1000 — not from a manual, and that is the point: these are values someone actually got data back with.

What You Need

• A Growatt inverter with an RS485/Modbus port. Community reports cover the SPH10000TL3 BH-UP and the MIN 4600 TL-XH; older TLS units have been reported as not answering Modbus at all.
• One connection path: a USB-to-RS485 adapter wired from your PC to the inverter, or a serial-to-TCP gateway on your LAN (community members used the PUSR USR-TCP232-410S and the USR-DR164).
• QModMaster from the upstream project, installed on a computer that can reach the adapter or gateway.

Wire It Up

• SPH series: use the RS485-1 port and set the port mode to VPP in the inverter settings — this is the configuration the community-tested setup used. (One SPH owner found the usable A/B pair inside the SYS COM connector on pins 3/4. Always power everything off before opening connectors.)
• Keep the RS485 run short and properly shielded; 9600 baud is the forgiving starting point — higher baud rates get picky about cable quality fast.
• Gateway path: set the PUSR to working mode TCP Server / ModbusTCP and note the IP address your router assigns it (pin it with a DHCP reservation so it doesn’t move).

QModMaster Settings: The Verified First Read

These are the exact settings a community member used to verify the link before writing any Home Assistant config (“Verify the connection with qModMaster… read with function code 0x04 address 1000 decimal and try to read”):

• 1. Options → Modbus TCP. IP address = your gateway’s IP, port = 502.
• 2. Set Unit ID = 1.
• 3. Press Connect.
• 4. Function Code = Read Input Registers (0x04).
• 5. Start Address = 1000 (decimal). Number of Registers: start with 10 and expand once it works.
• 6. Press Scan. If values come back, you are reading the inverter. If you get timeouts instead, see the no-response fix guide.

Community-Tested Registers (SPH10000TL3 BH-UP)

Once the first read works, these addresses were verified in a working Home Assistant configuration against the same inverter — all read with function code 04, slave 1. Probe each one in QModMaster before trusting it:

Again: these held true for an SPH10000TL3 BH-UP. MIC, MIN, and TL-X series may use different maps — your model’s manual is the authority, QModMaster is the lie detector.

Carry It Into Home Assistant

Once an address returns sane data in QModMaster, copy it straight into your Modbus config: type: tcp, host: your gateway IP, port: 502, slave: 1, input_type: input, address: the verified address, data_type per the table above. This “QModMaster first” method — the bisection framework plus the complete field-to-YAML mapping — is documented on the hub page: Test Modbus with QModMaster Before Home Assistant.

Gotchas

• The inverter has to be producing — expect data to flow when the sun is shining, not at midnight.
• On SPH models the RS485 port must be in VPP mode (not Battery) for Modbus to answer.
• A MIN 4600 TL-XH was reported working with a sub-€2 USB-to-RS485 adapter — you don’t need expensive hardware for a first read.
• If QModMaster times out too, the problem is the link, not your config: check A/B wiring, gateway mode (TCP Server / ModbusTCP), and Unit ID 1.

FAQ

Which Growatt models does this work for?

Community reports confirm the SPH10000TL3 BH-UP (via PUSR gateway) and the MIN 4600 TL-XH (via USB-to-RS485 adapter). Older TLS units have been reported as not answering Modbus at all. Register maps differ by series — check your model’s manual.

Direct USB adapter or TCP gateway?

Both work. A cheap USB-to-RS485 adapter is enough for a first read from a PC; a PUSR gateway puts the inverter on your LAN so Home Assistant can poll it continuously.

What serial parameters should I use for a direct RTU connection?

The community-tested path used a TCP gateway, so baud rate never entered the picture. For direct RS485, start at 9600 8N1 and match whatever your inverter’s port is configured for — your model’s manual is the authority here.

QModMaster connects but reads return timeouts. Now what?

Work the physical layer: swap A/B, confirm the gateway is in TCP Server / ModbusTCP mode, confirm Unit ID 1, and on SPH models confirm the port is in VPP mode. The timeout fix guide walks through this systematically.

Related Guides

• Test Modbus with QModMaster Before Home Assistant
• QModMaster Tutorial: First Connection Step by Step
• USB-to-RS485 Adapter Buying Guide
• Modbus Float Shows Wrong Value: Byte Order Fix

The Eastron SDM230 is a single-phase DIN-rail energy meter that publishes voltage, current, active power, power factor and cumulative kWh over RS-485 using Modbus RTU. It is one of the most common meters in home-energy monitoring projects, and it is an ideal first device to read with QModMaster (free, open source, LGPLv3) because its register map is simple and well documented.

The parameters below come from Eastron’s SDM230 Modbus protocol document via the Ubidots help article “Connect Eastron SDM230 to Ubidots over Modbus RTU”, which states its table was verified against that document (their note, August 2026). Eastron has changed register maps between hardware revisions (SDM230-Modbus, SDM230M, V2, V3) — confirm your exact variant against the current document before trusting an address in production.

Step 1 — Wire the meter and set the serial parameters

Connect the SDM230 to your power network per the datasheet, then connect the meter’s RS-485 A and B terminals to your USB-to-RS485 adapter. Practical wiring rules from the evidence source:

• Terminate the bus with 120 Ω at both physical ends only.
• Run the RS-485 pair in a separate conduit from the power conductors.
• If the meter does not answer, swap A and B — the labelling is not standardised between vendors.

All four are changeable from the meter’s front panel (or by writing the holding registers shown), but the master has to match all four exactly. Set them on the bench before the meter goes into the panel — it is far harder once it is behind a cover.

Step 2 — The SDM230 register map (from the evidence source)

All measurements live in input registers, read with function code 04. Holding registers (4xxxx) hold configuration only — baud rate, parity, node address, register order — and are read with FC03 / written with FC16. Every value is a 32-bit IEEE-754 float across two registers:

Note the two address columns: the meter’s documentation numbers registers as 30001, but the protocol-level (0-based) address of that register is 0. QModMaster’s Start Address field takes the decimal address — so you enter 0, not 30001. The full story is in our Modbus register address offset guide.

Step 3 — First read in QModMaster: line voltage

• In QModMaster, select Modbus RTU mode.
• Choose your adapter’s serial port and set 9600 baud, 8 data bits, no parity, 1 stop bit (unless you changed the meter from factory defaults).
• Set Slave ID to 1 (the factory default).
• Select FC04 — Read Input Registers.
• Set Start Address to 0, Quantity to 2 — this reads “Line to neutral volts” (register 30001).
• Click Connect / Read, then use the View menu to switch the display to Float: the two raw registers combine into one IEEE-754 value.

On a live single-phase circuit you should see something near your mains voltage (e.g. ~230 V in Europe). Next, read current (Start Address 6, Quantity 2) and active power (Start Address 12, Quantity 2) the same way. For lifetime energy, read Start Address 342, Quantity 2 (total active energy, kWh).

Step 4 — When the readings are wrong

• Garbage values or NaN: this is the signature of a byte/word order mismatch, not a wiring fault. The SDM230 sends the most significant register first by default. If QModMaster assumes the opposite order, swap the two 16-bit words before reinterpreting as a float, or change the meter’s “Register Order” holding register to match your master. Details: Modbus float wrong value — byte order fix.
• No response at all: the master must match baud, parity, stop bits and slave ID exactly. Try swapping A/B, check that the slave ID is still 1 (or the value you set), and confirm the bus is terminated with 120 Ω at both ends.
• Plausible but wrong values: double-check the offset — entering 30001 instead of 0 in the Start Address field reads the wrong register. See the address offset guide.

Frequently asked questions

Related Guides

• Modbus Float Wrong Value — Byte Order Fix
• USB to RS485 Adapter Buying Guide
• QModMaster Tutorial: First Steps with Modbus
• Modbus Register Address Offset Guide (the −1 problem)

Before wiring a home automation system into your SMA Sunny Boy inverter, test the connection with a standalone Modbus master. QModMaster is free, open source (LGPLv3), and does exactly one job well: it lets you talk to a Modbus device manually and see the raw values. The approach below follows a working field report from the openHAB community, where a user tested a SMA Sunny Boy 3.6 with a tool like QModMaster before building their permanent integration. I use QModMaster for first contact and hand over to openHAB, Home Assistant, or similar once the registers check out.

Fair warning: nothing here replaces your inverter’s manual. SMA firmware and model variants differ, and register maps change between generations. Treat your SMA documentation as the authority, and the addresses below as a reported example.

Step 1 — Enable Modbus on the inverter

SMA inverters ship with the Modbus interface available, but it must be enabled in the inverter’s settings before anything can connect. Depending on your model this can require installer or technician privileges, so check the official SMA documentation for the exact menu path on your unit.

• Confirm Modbus is enabled and the inverter is listening on port 502 (the standard Modbus TCP port).
• Note the inverter’s IP address on your local network and the configured slave (unit) ID.
• Watch out for firmware updates: several users in the field report that a firmware update disabled the Modbus interface, and the inverter’s embedded web server can get overloaded by aggressive polling. Keep your test traffic light, and if the inverter goes quiet, re-check the Modbus enable setting and restart the unit.

Step 2 — What one working setup looked like

The openHAB community report that verified this approach used a SMA Sunny Boy 3.6. These are the connection values that worked in that report — not a datasheet, but real-world numbers that give you a sane starting point:

Source: openHAB community thread “Modbus binding with Sunny Boy SMA inverter” (page 10). Your manual may list different registers — confirm before building anything permanent.

Step 3 — First read in QModMaster

• Open QModMaster, set Modbus TCP mode, and enter the inverter’s IP address and port 502.
• Set Slave ID to the value configured on your inverter (3 in the report above).
• Select FC03 — Read Holding Registers.
• Set Start Address to the SMA register number minus 1 (see the offset trap below). For register 30535, enter 30534.
• Set Quantity to a small block (e.g. 8–40 registers) and hit Connect / Read.
• If the register holds a 32-bit value like daily yield, use QModMaster’s View menu to display it as an unsigned 32-bit number.

The −1 address offset trap: SMA vs QModMaster

This is where most first reads fail. SMA’s documentation numbers registers starting at 1 (e.g. register 30535), but QModMaster’s Start Address field is 0-based. Convert by subtracting 1:

Address numbering is a tool convention, not the wire protocol — different software counts from different bases. The full explanation is in our Modbus register address offset guide.

Step 4 — Verify your first read

• Sanity-check values: daily yield should grow during daylight and stay flat at night; instantaneous power should track sunlight (zero at night). Implausible but non-zero numbers usually mean an address offset problem.
• Read a second block: if 30535 works, try the power block around 30776 to confirm your addressing is consistent.
• No response at all? Confirm Modbus is still enabled on the inverter (firmware updates can flip it off), that port 502 is reachable from your machine, and that the slave ID matches. As a last resort, restart the inverter — that fixed a similar outage in the field report.
• Timeouts or dropped connections? Slow down: long, heavy poll loops have knocked SMA web interfaces offline in reported cases. QModMaster is for manual tests, not 24/7 polling — hand over to your home automation platform for the permanent job.

Frequently asked questions

Related Guides

• Modbus Register Address Offset Guide (the −1 problem)
• Test Modbus with QModMaster Before Wiring It into Home Assistant
• QModMaster Tutorial: First Steps with Modbus

A Modbus RTU to TCP gateway (also called a serial server or serial device server) lets Modbus RTU devices on an RS485 bus appear as if they were Modbus TCP devices on your network. In one sentence: it translates between serial RTU frames and TCP packets, so your PC can reach serial field devices over Ethernet or Wi-Fi instead of being tethered by a USB cable.

When Do You Need a Gateway?

• Remote equipment: the PLC, sensor, or meter is in another building or on the plant floor, and running a USB cable (or RS485 cable back to your desk) is impractical.
• Ethernet modernization: you’re migrating a legacy serial installation to IP networking but the field devices are still Modbus RTU.
• Multiple consumers: several PCs or applications need to poll the same serial devices over the LAN, which a single USB adapter can’t share.
• Rack-mounted testing: you commission cabinets from a control room rather than standing at each cabinet with a laptop.

How a Gateway Works

The gateway has an RS485 port on the field side and an Ethernet (sometimes Wi-Fi) port on the network side. It continuously listens on the RS485 bus, wraps RTU request/response frames into TCP segments (Modbus TCP adds a 7-byte MBAP header), and routes them to the configured IP address and port — typically port 502. From QModMaster’s perspective, it’s just another Modbus TCP slave.

What to Look For When Buying

True Modbus gateway mode vs raw passthrough

Two operating modes exist. Modbus gateway mode understands the Modbus protocol: it converts RTU to Modbus TCP frames, so QModMaster talks standard Modbus TCP. Raw serial passthrough just tunnels serial bytes over TCP, which requires the PC-side software to speak raw serial-over-TCP — QModMaster can’t use that. Always confirm Modbus gateway mode (sometimes labeled “Modbus TCP to RTU” or “Modbus protocol conversion”).

Baud rate and serial parameters

The gateway must support the baud rate and parity/stop-bit combination your devices use. Common rates (9600, 19200, 115200) are universal; if your devices run an odd rate, check the spec sheet. Most gateways are configured through a built-in web interface.

Power supply and mounting

Cabinet installations favor DIN-rail mounting with DC terminal power (often 9–36V). PoE (Power over Ethernet) models reduce wiring to a single cable but cost more — check whether your switch actually provides PoE before paying the premium. Desk/lab use can be a simple wall-powered box.

Example Products (As Starting Points)

Two widely available product families, offered as examples only — not endorsements, and we list no prices because they change constantly. Check the vendor’s site for current specs and pricing:

• PUSR USR-TCP232 series — a long-running family of serial-to-Ethernet modules from PUSR (also sold under the USR-IOT brand), including DIN-rail models with Modbus gateway firmware. Check the vendor site for the exact model and firmware version that supports Modbus gateway mode.
• Waveshare RS485-to-Ethernet modules — compact industrial modules from Waveshare with a web configuration interface and Modbus gateway support on recent firmware. Confirm the firmware revision on the vendor’s site before buying.

Connecting QModMaster Through a Gateway

Once the gateway is on the network and its RS485 port is wired to the bus, the QModMaster side is straightforward:

1. In QModMaster, select Modbus TCP as the connection type (not RTU/serial).
2. Enter the gateway’s IP address and port (commonly 502, but check the gateway’s web config — some default to 8899 or similar).
3. Set the slave address to the address of the target device on the RTU bus behind the gateway.
4. Use function codes and register addresses exactly as you would for a direct RTU connection — the gateway handles the RTU/TCP frame conversion transparently.

If reads time out, suspect the gateway’s serial parameters (baud/parity must match the bus), its gateway-mode setting (must be Modbus, not raw passthrough), and any firewall between your PC and the gateway’s IP. Our timeout troubleshooting guide covers the rest.

Frequently Asked Questions

What is a Modbus RTU to TCP gateway?

A hardware device that bridges an RS485/Modbus RTU serial bus to an Ethernet network. It converts RTU frames to Modbus TCP packets (and back), letting software like QModMaster reach serial field devices over IP instead of a directly attached USB adapter.

Does QModMaster work through a gateway?

Yes. Set QModMaster to Modbus TCP mode and point it at the gateway’s IP and port; use the field device’s slave address as usual. The gateway must run in Modbus gateway mode — raw serial passthrough will not work with QModMaster.

Gateway vs USB to RS485 adapter — which should I buy?

Buy a USB to RS485 adapter for bench testing and direct, single-PC access — it’s cheaper and simpler (see our adapter buying guide). Buy a gateway when devices are remote, must be shared over the LAN, or you’re modernizing a serial installation to Ethernet.

Why do my gateway reads time out?

Check three things in order: the gateway’s serial parameters match the bus (baud/parity/stop bits), the gateway is in Modbus gateway mode (not raw passthrough), and no firewall blocks the TCP port. Then work through the slave-side checks in our timeout fix guide.

Related Guides

• USB to RS485 Adapter Buying Guide for Modbus (2026)
• QModMaster Tutorial
• Modbus No-Response Timeout Fix
• RS485 RTS Control Guide
• Free Modbus Master Software
• Download QModMaster

QModMaster talks Modbus RTU over a serial port — but modern PCs don’t have serial ports. A USB to RS485 adapter is the piece of hardware that bridges that gap: it plugs into USB on one end and gives you the A/B (D+/D−) screw terminals your Modbus RTU devices expect on the other.

Why You Need One

Without a USB-to-RS485 adapter, QModMaster has no physical path to your RS485 bus. It’s that simple: no adapter, no connection. The adapter is the single most failure-prone link in the chain — a flaky adapter will make QModMaster time out, report “no response,” or drop bytes even when every setting (baud rate, parity, slave address) is correct. Choosing a decent adapter is the cheapest insurance for stable Modbus RTU debugging.

Chip Comparison: FTDI vs CH340 vs CP2102 vs PL2303

The chip inside the adapter matters more than the brand printed on the case. These four chips cover nearly everything sold online:

Prices move around and vary by seller — check current prices on Amazon before deciding. As a rule of thumb, FTDI-based adapters cost several times more than CH340-based ones, with CP2102 in between.

Auto Flow Control vs Manual RTS

RS485 is half-duplex: the adapter must switch between transmitting and receiving. Automatic flow-control adapters do this in hardware with no software support needed — they just work in QModMaster. Manual-RTS adapters require QModMaster to toggle the RTS line to enable the transmitter; QModMaster supports this through its RTS Control settings, so you must configure it correctly.

If you want zero configuration headaches, pick an auto flow-control adapter. If you already own a manual-RTS adapter, read our RS485 RTS Control Guide to set QModMaster’s RTS timing correctly and stop intermittent timeouts.

Isolated Adapters for Industrial Sites

On a workbench, a basic non-isolated adapter is fine. On an industrial site — with long cable runs, motors, and ground-potential differences — an optically isolated adapter (typically 1500V+ isolation) protects your laptop’s USB port from voltage spikes and kills ground-loop noise that corrupts Modbus frames. If the device cabinet and your PC are on different power feeds, isolation is strongly recommended.

Terminal Types and Cable Connections

Almost all adapters use screw terminals labeled A and B (sometimes D+ and D−). Prefer adapters with clearly labeled, generous terminals that accept twisted-pair cable without crimping. Some models add a GND terminal — use it for the shield wire on long runs. Watch out for adapters that only expose pins or a DB9-style header; you’ll need a terminal breakout anyway.

Pitfalls to Avoid

• Counterfeit FTDI chips: the cheapest “FTDI” adapters are often fakes, and official FTDI drivers can disable them. Buy from sellers with a track record.
• Obsolete PL2303 revisions: ancient PL2303HX chips will not load on Windows 11. Confirm the chip revision or skip PL2303 entirely.
• Missing driver for CH340: CH340 needs the vendor driver (download from the manufacturer site, not random forums). Without it, the adapter won’t appear as a COM port.
• No surge protection on the bench, fine — in the field, not fine: a non-isolated adapter on a noisy industrial bus is a recipe for corrupted reads and fried ports.

Frequently Asked Questions

Do I need a USB to RS485 adapter to use QModMaster?

Yes, for Modbus RTU over a serial bus. QModMaster is software — it needs a physical RS485 transceiver between your PC’s USB port and the A/B bus lines. The only exception is Modbus TCP, which runs over Ethernet and needs no adapter.

Which chip is best for QModMaster: FTDI, CH340, CP2102, or PL2303?

All four work when genuine and correctly drivered. FTDI offers the most mature drivers at the highest price; CH340 is the cheapest and very popular but needs the vendor driver installed; CP2102 sits in the middle; PL2303 is fine only with a current genuine chip revision — old revisions don’t load on Windows 11.

What is automatic flow control and do I need it?

RS485 is half-duplex, so something must switch the adapter between sending and receiving. Adapters with automatic flow control do it in hardware — no setup. Manual-RTS adapters need QModMaster’s RTS Control configured correctly. Automatic is simpler; see our RTS control guide if you use manual RTS.

Why does QModMaster time out even with a brand-new adapter?

Most often the adapter has no driver loaded (check Device Manager for a warning icon), or a manual-RTS adapter is waiting on RTS settings. Verify the COM port appears in Windows, confirm baud/parity/stop bits match the slave, and work through our timeout troubleshooting guide.

Related Guides

• Modbus RTU to TCP Gateway Guide (2026)
• RS485 RTS Control Guide
• Modbus No-Response Timeout Fix
• QModMaster Tutorial
• Free Modbus Master Software
• Download QModMaster