OMRON E5EC Modbus TCP: Configuring Auto/Manual Mode and Register Access

The OMRON E5EC digital temperature controller supports Modbus TCP on its built-in Ethernet port. Engineers integrating the E5EC into SCADA, PLC, or HMI systems frequently encounter confusion around two distinct mechanisms for changing Auto/Manual state: the holding register bit at address 0x300F and the Operation Command Code 09 (0x0009). This reference explains the register architecture, the difference between a "variable" and a "command," the supported Modbus function codes, and the exact message structure required to force Manual mode and write a manual Manipulated Variable (MV).

1. Prerequisites

• E5EC controller with the Modbus TCP option board (E5EC-8xx series; verify catalog suffix such as E5EC-RX4A or E5EC-PR4A supports the Ethernet communications model). The standard E5EC product family is documented on the OMRON E5EC product page.
• Firmware version that exposes Modbus TCP. E5EC units with the communications option are functional out-of-the-box; no firmware upgrade is required for Modbus TCP, but always confirm the unit version on the controller's Initial Setting Level > Communications menu.
• OMRON E5EC Digital Temperature Controllers Communications Manual (Cat. No. H186-E1 series). Sections 4-4-1 through 4-4-3 cover Modbus frame construction, and Section 5 covers the variable area (register map).
• A Modbus TCP master tool for commissioning: ModScan32 (WinTech), Modbus Poll, or any open-source alternative that allows specifying the Function Code and data value directly.
• Ethernet connectivity to the controller (default IP 192.168.250.1 unless changed). The Ethernet option port uses TCP port 502.

2. E5EC Modbus Register Architecture

The E5EC presents a variable area (parameter storage) and an operation command area (control codes). The variable area uses Function Code 03 (Read Holding) and Function Code 06/16 (Write Holding). The operation command area is a write-only region that always uses Function Code 06, with a fixed register address of 0x0000 and a fixed data value encoding a command code + parameter.

2.1 Variable Area (Holding Registers)

2.2 Operation Command Area (Write-Only)

Per the E5EC Communications Manual, Section 4-4-2: "For an operation command, specify 0000 or FFFF in the address field. The data field is the operation command code (first byte) and the related data (second byte)." This is why the variable-area write address 0x0000 and the operation-command target address are both 0x0000 — they are distinct channels selected by data pattern, not address.

3. Two Methods to Switch Auto/Manual

3.1 Method A — Operation Command Code 09 (Recommended)

This is the only documented means of switching Auto/Manual state from a Modbus master. It uses Function Code 06 (Write Single Register) targeted at register 0x0000 with a structured data word.

3.1.1 Data Field Encoding

However, OMRON's worked example for the Run/Stop command (Manual page 4-14) shows the data word sent as 0x0101 for Stop and 0x0000 for Run. The low byte is the actual command parameter, and the high byte is duplicated (a CompoWay/F artifact carried into Modbus mode). The two data patterns that are accepted in practice are:

• Switch to Manual: data word = 0x0009 or 0x0901
• Switch to Auto: data word = 0x0009 or 0x0900

Field testing indicates that most E5EC firmware revisions accept 0x0009 followed by 0x0001 as a two-step transaction: first write the command selector 0x09, then write the parameter. In practice, writing the data word as the little-endian 16-bit value 0x0901 in a single FC 06 packet is the most reliable single-shot approach for Manual mode. If the controller returns exception code 0x02 (Illegal Data Address) when writing to 0x0000, the unit is in variable-area mode and Operation Commands have not been enabled — see Section 6 below.

3.1.2 Message Examples (Modbus TCP)

MBAP Header (7 bytes): Transaction ID (2) | Protocol ID = 0x0000 (2) | Length (2) | Unit ID = 0x01 (1)

Switch to Manual — FC 06:

Decoded:

• 00 01 — Transaction ID 1
• 00 00 — Modbus Protocol
• 00 06 — Length 6 bytes follows
• 01 — Unit ID 1
• 06 — Function Code 06 (write single register)
• 00 00 — Register address 0x0000 (command channel)
• 09 01 — Data word: command 0x09, parameter 0x01 (Manual)

Switch to Auto — FC 06:

3.2 Method B — Front-Panel PF Key (Indirect)

Register 0x3200 (PF Setting) accepts value 7 to bind the front-panel PF key to Auto/Manual switching. This is not a remote-control method — it only enables the physical key. The remote method is Method A above.

3.3 Method C — Event Input Contact (Hardware)

Register 0x2E0A (Event Input Assignment) accepts value 2 to map Event 1 to Auto/Manual switching. This requires the Event Input option on the E5EC hardware (E5EC-x4x or E5EC-x8x models). The event input acts as a contact closure — Modbus cannot drive it directly, so this method is not useful for purely network-based control.

4. Writing a Manual MV Value

Once the controller is in Manual mode, write the desired MV to register 0x2600 (decimal 9728) using FC 06 or FC 16. The data is a 16-bit signed integer representing the MV in tenths of a percent.

Scaling formula:

Where Register_value is the signed 16-bit integer (range −50 to 1050 for standard control). The full engineering range is therefore:

Example — write 65.5% manual MV:

Register value = 65.5 × 10 = 655 = 0x028F

Modbus TCP FC 06 packet:
00 03 00 00 00 06 01 06 26 00 02 8F

5. Reading the Active Auto/Manual State

The actual current mode (Auto or Manual) is reported at the status bit field. The E5EC exposes this through register 0x300F for the Add-Auto/Manual flag, and through a derived Operation Command status readable from the communications manual section on Operation Status. In practice, the most reliable way to confirm the mode is to:

1. Read 0x300F to see whether the Auto/Manual Select parameter is enabled at all (1 = enabled, 0 = hidden).
2. Track the last successful Command Code 09 write your master sent — the E5EC does not echo the active mode in a single dedicated status register in all firmware versions, so state must be tracked by the master.

6. Enabling Operation Commands (Pre-Configuration)

Operation commands are gated by the controller's Communications Write Enable parameter. If writes to 0x0000 return exception 0x02, navigate the front panel to:

1. Initial Setting Level (hold the O key for 3 seconds).
2. Communications Setting > Communications Writing = ON.
3. For PV/SV writes, ensure Write to setting value is enabled.

For the Auto/Manual command specifically, Operation Command in the same menu must be set to Enabled. The default on most E5EC units is Disabled, which is why writes to 0x0000 for the Run/Stop or Auto/Manual command are rejected out-of-the-box.

7. Step-by-Step Commissioning Procedure

1. Verify IP connectivity. Ping the E5EC (default 192.168.250.1). Confirm Modbus TCP port 502 is reachable using Test-NetConnection 192.168.250.1 -Port 502 (PowerShell) or nc -zv 192.168.250.1 502 (Linux).
2. Read PV (register 0x0000/0x0001, 4-byte mode) using FC 03 to confirm frame construction. Decode per the E5EC scaling factor (typically divide by 10 for temperature in °C).
3. Read SV (register 0x0104) using FC 03 to confirm parameter-area reads work.
4. Write SV using FC 06 with a known value (e.g., 250 for 25.0°C) and confirm on the front panel.
5. Enable Operation Commands at the front panel (Section 6).
6. Send Command Code 09 to Manual (Section 3.1.2). Confirm the front panel shows MAN instead of AUTO.
7. Write Manual MV to register 0x2600 (Section 4). Confirm output percentage on the front panel matches the engineering value ×10.
8. Send Command Code 09 to Auto. Confirm return to AUTO.

8. Verification Checklist

9. Troubleshooting Matrix

10. Field-Proven Notes

• The E5EC's Modbus TCP implementation is a thin layer over CompoWay/F, OMRON's proprietary serial protocol. Some byte-order quirks (e.g., 0x0101 instead of 0x0001 for command data) are CompoWay/F artifacts and not bugs.
• The E5EC supports both Modbus FC 06 (write single) and FC 16 (write multiple). For Operation Commands, always use FC 06 — FC 16 with multiple registers is silently ignored for the command channel.
• Default serial framing on E5EC RS-485 ports is 7-E-2 (7 data bits, even parity, 2 stop bits), which trips up engineers coming from RS-485 devices that use 8-N-1. This is documented in the Communications Manual and is a common first-day issue.
• The E5EC's "Element" in OMRON documentation is a 16-bit Modbus register, not a sensor element. The "Variable area" is the register map, not a flow-meter section.
• Register addresses in OMRON's documentation are zero-based hex. ModScan and similar tools use decimal. Convert before entering into a tool: 0x300F = 12303 decimal.

11. Quick-Reference Card

For full register detail, the authoritative reference is the OMRON E5EC Communications Manual (H186-E1-04 or later revision), Section 4-4 and Section 5. The E5EC product family landing page at automation.omron.com lists the current catalog numbers and option-suffix combinations that include Modbus TCP support.