Siemens SEM3 Dual Phase Modbus register map

SEM3 embedded micro metering module, two-pole monitors (Modbus RTU and TCP)

Official
3,105 registers
Modbus RTU
Revision 3 · 2026-10-18
Identity: firmware, serial number

Official: Written from the manufacturer's documentation, but not tested on a device yet. Check the map against the manufacturer's documentation before you write to a live device. Tested it? Report a test.

Download .mbmap.json Raw JSON View on GitHub Suggest a correction Report a problem

Communication

Protocol: Modbus RTU
Unit ID: 126
Serial: 38400 8E1 · 38400 baud, 8 data bits, even parity, 1 stop bit
Byte / word order: ABCD · bytes big-endian, words high first
Addresses: 0-based

Connection values are defaults: the device may be configured differently.

Map

Registers: 3105 holding registers
Groups: 71
Revision: 3 · 2026-10-18
Added: 2026-10-14 (2026-10-14)
File: maps/siemens/sem3-dual-phase.mbmap.json · 680 KB · history
SHA-256: d12246ba78ed07b48ce200463dd81a555a749e50b9eb4b95dc7b175dea5fab59
Manufacturer: siemens.com

Device identity

What a tool can read to check that this map fits the connected device (SPEC.md section 4.7). Registers with a role are read like any other register.

Registers
Role	Register	Address	Type	Values
Firmware	Firmware version	holding 20000	string[4]
Serial number	Serial number	holding 20004	string[16]

Sources and notes

SEM3 - Embedded Micro Metering Module User Manual
file SIE_MA16_SEM3UserManual_201707060739103020.pdf, Modbus Information: alarm, monitor data, system and double precision energy registers

Source: Siemens, "SEM3 Embedded Micro Metering Module User Manual", chapter Modbus Information

Addresses are the wire addresses: the manual's external addresses (40001 for the first register) minus 40001. The double precision energy registers are given by the manual with an internal address, which is used as it is.
Each monitor has its own block of registers: two-pole monitors start at a fixed base address plus the size of the block times the monitor number.
The mini-monitor registers (10 registers per monitor, from address 40301) hold up to 10 data points chosen in the web interface, so their content depends on the configuration and they are not in this map.
The manual does not state the order of the two registers of a 32-bit value or the byte order of floats; this map assumes the most significant register first.
Factory settings of the RS-485 port: address 126, 38400 baud, even parity.
The manual lists the monitor values in kilowatts, kilovolt-amperes and kilovolt-ampere-hours with a resolution of 0.001; the units shown are those names.

Area	Address	Type	Access	Unit	Description
HR	19900	float32 ABCD	R	kWh
HR	19902	float32 ABCD	R	kvarh
HR	19904	uint32 ABCD	R
HR	19906	uint32 ABCD	R
HR	19908	uint16	R		Set when any mini-monitor sets the same alarm bit; cleared with the global resets register
HR	20000	string[4]	R
HR	20004	string[16]	R
HR	20020	string[32]	RW		Free text; default spaces
HR	20052	uint16	RW		Default 15
HR	20053	uint16	RW	min	Default 1
HR	20054	uint16	RW		Type of transformer providing the voltage signal; default 0
HR	20055	uint16	RW	V	Line to neutral voltage; default 120
HR	20056	uint16	RW	V	Default 120
HR	20057	uint16	RW	V	Default 120
HR	20058	uint16	RW	V	0 disables
HR	20059	uint16	RW	s
HR	20060	uint16	RW	V	0 disables
HR	20061	uint16	RW	s
HR	20062	uint16	RW		0x0001 under voltage, 0x0002 over voltage; write 1 to a bit to clear the alarm
HR	20063	uint32 ABCD	RW		0 disables; a write overwrites the local monitor settings
HR	20065	uint16	RW	s
HR	20066	uint16	RW		A write overwrites the local monitor settings
HR	20067	uint16	RW	s
HR	20068	uint16	RW		0 disables
HR	20069	uint16	RW	s
HR	20070	uint16	RW		0 disables
HR	20071	uint16	RW	s
HR	20072	uint16	W		Write 1 to a bit: 0x0001 new demand interval, 0x0002 reset all demands, 0x0004 reset maximum demand values, 0x0008 reset all energy values, 0x0010 reset maximum currents, 0x0020 reset maximum kW values, 0x0040 reset pulse input 1 count, 0x0080 reset pulse input 2 count, 0x0100 reset mini-monitor alarm flags
HR	20073	uint16	RW
HR	20074	uint16	RW
HR	20075	uint16	RW
HR	20076	uint16	RW
HR	20077	uint32 ABCD	RW	s	Seconds since the UTC epoch
HR	20300	uint16	R		One bit per monitor, bit 0 = monitor 1
HR	20301	uint16	R		One bit per monitor, bit 0 = monitor 17
HR	20302	uint16	R		One bit per monitor, bit 0 = monitor 33
HR	20303	uint16	R		One bit per monitor, bit 0 = monitor 49
HR	20400	uint16	RW		Default 126
HR	20401	uint16	RW		Default 5 = 38400
HR	20402	uint16	RW		Default 0 = even
HR	20403	uint16	RW	s	Default 30
HR	20404	uint16	RW
HR	20405	uint16	RW		IPv4 or IPv6
HR	20406	uint16	RW		IPv4: one octet per word
HR	20407	uint16	RW		IPv4: one octet per word
HR	20408	uint16	RW		IPv4: one octet per word
HR	20409	uint16	RW		IPv4: one octet per word
HR	20410	uint16	RW		IPv4: one octet per word
HR	20411	uint16	RW		IPv4: one octet per word
HR	20412	uint16	RW		IPv4: one octet per word
HR	20413	uint16	RW		IPv4: one octet per word
HR	20414	uint16	RW		IPv4: one octet per word
HR	20415	uint16	RW		IPv4: one octet per word
HR	20416	uint16	RW		IPv4: one octet per word
HR	20417	uint16	RW		IPv4: one octet per word
HR	20418	uint16	RW		IPv4: one octet per word
HR	20419	uint16	RW		IPv4: one octet per word
HR	20420	uint16	RW		IPv4: one octet per word
HR	20421	uint16	RW		IPv4: one octet per word
HR	20422	uint16	RW		IPv4: one octet per word
HR	20423	uint16	RW		IPv4: one octet per word
HR	20424	uint16	RW		IPv4: one octet per word
HR	20425	uint16	RW		IPv4: one octet per word
HR	20426	uint16	RW		IPv4: one octet per word
HR	20427	uint16	RW		IPv4: one octet per word
HR	20428	uint16	RW		IPv4: one octet per word
HR	20429	uint16	RW		IPv4: one octet per word
HR	100	uint16	RW		Write 1 to an alarm bit to clear it
HR	101	uint16	RW		Write 1 to an alarm bit to clear it
HR	102	uint16	RW		Write 1 to an alarm bit to clear it
HR	103	uint16	RW		Write 1 to an alarm bit to clear it
HR	104	uint16	RW		Write 1 to an alarm bit to clear it
HR	105	uint16	RW		Write 1 to an alarm bit to clear it
HR	106	uint16	RW		Write 1 to an alarm bit to clear it
HR	107	uint16	RW		Write 1 to an alarm bit to clear it
HR	108	uint16	RW		Write 1 to an alarm bit to clear it
HR	109	uint16	RW		Write 1 to an alarm bit to clear it
HR	110	uint16	RW		Write 1 to an alarm bit to clear it
HR	111	uint16	RW		Write 1 to an alarm bit to clear it
HR	112	uint16	RW		Write 1 to an alarm bit to clear it
HR	113	uint16	RW		Write 1 to an alarm bit to clear it
HR	114	uint16	RW		Write 1 to an alarm bit to clear it
HR	115	uint16	RW		Write 1 to an alarm bit to clear it
HR	116	uint16	RW		Write 1 to an alarm bit to clear it
HR	117	uint16	RW		Write 1 to an alarm bit to clear it
HR	118	uint16	RW		Write 1 to an alarm bit to clear it
HR	119	uint16	RW		Write 1 to an alarm bit to clear it
HR	120	uint16	RW		Write 1 to an alarm bit to clear it
HR	121	uint16	RW		Write 1 to an alarm bit to clear it
HR	122	uint16	RW		Write 1 to an alarm bit to clear it
HR	123	uint16	RW		Write 1 to an alarm bit to clear it
HR	124	uint16	RW		Write 1 to an alarm bit to clear it
HR	125	uint16	RW		Write 1 to an alarm bit to clear it
HR	126	uint16	RW		Write 1 to an alarm bit to clear it
HR	127	uint16	RW		Write 1 to an alarm bit to clear it
HR	128	uint16	RW		Write 1 to an alarm bit to clear it
HR	129	uint16	RW		Write 1 to an alarm bit to clear it
HR	130	uint16	RW		Write 1 to an alarm bit to clear it
HR	131	uint16	RW		Write 1 to an alarm bit to clear it
HR	132	uint16	RW		Write 1 to an alarm bit to clear it

Help improve this map

I tested it on a deviceReport whether it worked, even if you did not write the map.
Suggest a correctionEdit the file on GitHub; it opens a pull request.
Report a problemA wrong address, type, scale or byte order.
Read the formatWhat each key of the file means (SPEC.md).