Electools EXM-3112 Modbus register map

Modbus RTU extension module with 12 digital inputs and 12 relay outputs: input and relay states, pulse counters, status, channel settings, local DI-to-relay switching and a master watchdog

Verified
111 registers
Modbus RTU
Revision 3 · 2026-11-08
Identity: model, firmware, serial number

Verified: Tested on a real device.

Download .mbmap.json Raw JSON View on GitHub Suggest a correction Report a problem

Communication

Protocol: Modbus RTU
Unit ID: 1
Serial: 9600 8E1 · 9600 baud, 8 data bits, even parity, 1 stop bit
Byte / word order: ABCD · bytes big-endian, words high first
Addresses: 0-based

Connection values are defaults: the device may be configured differently.

Map

Registers: 60 holding registers, 19 input registers, 20 coils, 12 discrete inputs
Groups: 12
Translation tables: 7
Revision: 3 · 2026-11-08
Added: 2026-11-04 (2026-11-04)
File: maps/electools/exm-3112.mbmap.json · 23 KB · history
SHA-256: de08054023ccf7d436f3f0caed2938b60a149bd96d1bf73afca8b39939cf1270
Manufacturer: electools.com.br

Device identity

What a tool can read to check that this map fits the connected device (SPEC.md section 4.7). Registers with a role are read like any other register.

Registers
Role	Register	Address	Type	Values
Model	Model code	holding 1808	uint16	3112 = EXM-3112
Firmware	Firmware version	holding 1810	uint16
Serial number	Serial number	holding 1811	uint16

Sources and notes

Electools Linha Extensão Modbus - Mapa de Registradores Modbus RTU (EXM-3112) · 2026-11-03
linked in issue #112
Mapa Modbus EXM (corrected) · 2026-11-07
serial format codes, channel count layout and register 128 access; attached to test report #139

Source: Electools Linha Extensão Modbus register map for the EXM-3112 (attached to issue #112)

Functions: FC01, FC05 and FC15 for coils, FC02 for discrete inputs, FC04 for input registers, FC03, FC06 and FC16 for holding registers. Addresses are 0-based, as sent on the wire.
The 32-bit bitmaps have bits 16-31 at the lower address and bits 0-15 at the higher one. Read and write both registers together: FC06 or a partial write fails. Bit N stands for channel N+1, and the bits above channel 12 are reserved.
Factory defaults: 9600 bit/s, 8E1. The Modbus address is 1 unless the ADDR1/2/4 DIP switches are set (1-7); when they are, they always take precedence over register 1792.
The document does not say whether changed settings apply at once. Coil 240 saves the configuration to flash.
The factory reset (coil 242) does not restore the input inversion, DirectSwitch, idle state, output inversion or watchdog enable, timeout and action settings: those are kept in FRAM.
Register 128 (relay state bitmap) is read-only: the first document marked it read/write, but a write returns exception 3 and the corrected document marks it read-only. Relays are written through the coils.
Tested on an EXM-3112, firmware V1.00 (hardware v1.0), November 2026: identity, uptime, digital inputs, relays and their bitmap, debounce and pulse width. A pulse counter past 65535 was not tested.

Area	Address	Type	Access	Unit	Scale	Description
CO	0	bool	RW			RO1; starts from the idle state in register 1024
CO	1	bool	RW			RO2; starts from the idle state in register 1024
CO	2	bool	RW			RO3; starts from the idle state in register 1024
CO	3	bool	RW			RO4; starts from the idle state in register 1024
CO	4	bool	RW			RO5; starts from the idle state in register 1024
CO	5	bool	RW			RO6; starts from the idle state in register 1024
CO	6	bool	RW			RO7; starts from the idle state in register 1024
CO	7	bool	RW			RO8; starts from the idle state in register 1024
CO	8	bool	RW			RO9; starts from the idle state in register 1024
CO	9	bool	RW			RO10; starts from the idle state in register 1024
CO	10	bool	RW			RO11; starts from the idle state in register 1024
CO	11	bool	RW			RO12; starts from the idle state in register 1024
HR	128	uint32 ABCD	R			Physical relay state after inversion, not the commanded coil value. Bit 0 = RO1 ... bit 11 = RO12
DI	0	bool	R			DI1 after debounce and inversion
DI	1	bool	R			DI2 after debounce and inversion
DI	2	bool	R			DI3 after debounce and inversion
DI	3	bool	R			DI4 after debounce and inversion
DI	4	bool	R			DI5 after debounce and inversion
DI	5	bool	R			DI6 after debounce and inversion
DI	6	bool	R			DI7 after debounce and inversion
DI	7	bool	R			DI8 after debounce and inversion
DI	8	bool	R			DI9 after debounce and inversion
DI	9	bool	R			DI10 after debounce and inversion
DI	10	bool	R			DI11 after debounce and inversion
DI	11	bool	R			DI12 after debounce and inversion
IR	128	uint32 ABCD	R			Bit 0 = DI1 ... bit 11 = DI12
IR	144	uint32 ABCD	R
IR	146	uint32 ABCD	R
IR	148	uint32 ABCD	R
IR	150	uint32 ABCD	R
IR	152	uint32 ABCD	R
IR	154	uint32 ABCD	R
IR	156	uint32 ABCD	R
IR	158	uint32 ABCD	R
IR	160	uint32 ABCD	R
IR	162	uint32 ABCD	R
IR	164	uint32 ABCD	R
IR	166	uint32 ABCD	R
IR	132	bool bit 0	R
IR	132	bool bit 1	R
IR	132	bool bit 2	R			The document lists no analog channels for this model
IR	132	bool bit 3	R
IR	133	uint16	R	%		0-100
IR	134	uint32 ABCD	R	s		Since the last boot
CO	32	bool	RW
CO	33	bool	RW
CO	34	bool	RW
CO	240	bool	W			Write 1 to save to flash; clears itself
CO	241	bool	W			Write 1; clears itself
CO	242	bool	W			Write 1; clears itself. Does not restore the settings kept in FRAM (see notes)
CO	243	bool	W			Write 1 to acknowledge and clear the flag; clears itself
CO	244	bool	W			Write 1 to zero all the digital input counters; clears itself
HR	768	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	769	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	770	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	771	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	772	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	773	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	774	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	775	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	776	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	777	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	778	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	779	uint16	RW	ms	×0.1	Default 200 raw (20 ms)
HR	800	uint32 ABCD	RW			Bit N = DI(N+1)
HR	848	uint32 ABCD	RW			Bit N links DI(N+1) to RO(N+1), so it works without the master
HR	850	uint32 ABCD	RW			Bit N = DI(N+1)/RO(N+1); only with toggle off
HR	852	uint32 ABCD	RW			Bit N = DI(N+1)/RO(N+1); switch mode, on the rising edge
HR	1024	uint32 ABCD	RW			Idle and power-on state; bit N = RO(N+1)
HR	1026	uint32 ABCD	RW			Physical inversion, also affects the state bitmap and LED; bit N = RO(N+1)
HR	1040	uint16	RW
HR	1041	uint16	RW
HR	1042	uint16	RW
HR	1043	uint16	RW
HR	1044	uint16	RW
HR	1045	uint16	RW
HR	1046	uint16	RW
HR	1047	uint16	RW
HR	1048	uint16	RW
HR	1049	uint16	RW
HR	1050	uint16	RW
HR	1051	uint16	RW
HR	1072	uint16	RW	ms		Default 500
HR	1073	uint16	RW	ms		Default 500
HR	1074	uint16	RW	ms		Default 500
HR	1075	uint16	RW	ms		Default 500
HR	1076	uint16	RW	ms		Default 500
HR	1077	uint16	RW	ms		Default 500
HR	1078	uint16	RW	ms		Default 500
HR	1079	uint16	RW	ms		Default 500
HR	1080	uint16	RW	ms		Default 500
HR	1081	uint16	RW	ms		Default 500
HR	1082	uint16	RW	ms		Default 500
HR	1083	uint16	RW	ms		Default 500
HR	1280	uint16	RW
HR	1281	uint16	RW	ms		Default 5000
HR	1282	uint16	RW			What happens on timeout; does not apply to channels with DirectSwitch active
HR	1283	uint16	RW			Write to clear; not saved, 0 after boot
HR	1792	uint16	RW			The DIP switches take precedence when set
HR	1793	uint16	RW

Help improve this map

I tested it on a deviceReport whether it worked, even if you did not write the map.
Suggest a correctionEdit the file on GitHub; it opens a pull request.
Report a problemA wrong address, type, scale or byte order.
Read the formatWhat each key of the file means (SPEC.md).