Electromagnetic Flow Meters

M2000 Modbus Memory Map

MAG-AS-01087-EN-08 (July 2024) Application Data Sheet

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Page ii MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

CONTENTS

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Write Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Register Name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Register Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Register Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
Read/Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
FNC Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Memory Maps by Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7

Product Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Meter Calibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Meter Measurement Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
Digital Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Analog Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
Output #1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Output #2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Output #3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Output #4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Port A Diagnostic Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Port B Diagnostic Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
Meter Diagnostic Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Miscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Verification Tool Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Empty Pipe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Control Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Software Filters: Median (MDN) Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
Software Filters: Zero Flow Stability (ZFS) Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Daughterboard Settings: Modbus TCP/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

M2000 Memory Map by Register Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

M2000 Register Write Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

July 2024 MAG-AS-01087-EN-08 Page iii

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Page iv MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

OVERVIEW
The M2000 flow meter supports Modbus RTU communications. Port A (pins 5,6,7) support Modbus RTU using RS232. The
RS485 is supported as an accessory daughterboard. This daughterboard is supplied under badger meter p/n 67079-003.
The tables to follow identify the Modbus registers and attributes that exist in the M2000 flow meter. Each register has
attributes that are also specified in the tables.

Write Security
Write Security identifies the required security level of the register in order to be successfully written. This attribute does not
apply to the readability of the register and registers listed with ADMIN, SERVICE or USER are unprotected if the meter is not
secured (that is, Admin pin is not programmed.)
• FIRMWARE – Typically, read-only registers. This means only the flow meter firmware has the privilege to update the register.
• FACTORY – Includes registers that can only be written by the factory
• ADMIN – Registers that require admin level access
• SERVICE – Registers that require service level access
• USER – Registers that require user level access
• NONE – Register is always unprotected
All registers can be protected by enabling security on the flow meter. Once the flow meter is secured, all registers are write-
protected unless remote privilege is granted. All read accesses to registers are still accepted when the flow meter is secured.
Obtaining remote privilege for write operations requires a sequence of Modbus actions to take place. Remote login process is
encrypted to ensure protection of the login pins.
1. Read the random value register (Address 0x012B).
2. Perform necessary calculations (contact Badger Meter for details).
3. Write the remote login register (Address 0x012F).
It is advised that a support application is written to perform this process and embedded within the main application software
used to access the flow meter.

Register Name
When applicable, describes the parameter so it can be associated within the display menu items. Please note, not all registers
are directly modifiable via the menu manager. Also, some registers are not accessible via the menu manager.

Register Address
Register Address defines the physical address that is required to be transmitted over the Modbus RTU serial link. Some third-
party applications require the use of logical addressing when communicating over Modbus. The logical address determines
the Modbus function code that is transmitted over the serial link.
Two logical address ranges are supported, 3xxxx and 4xxxx. Logical address range 3xxxx issues the Read Input Register
function code 0x04. Logical address range 4xxxx issues the Read Holding Register function code 0x03. All logical addresses
start at index 1 (example, 30001 and 40001).
For example, suppose the application requires logical addressing and is targeting to access the “Flow Rate [User Units]”
register. The physical address for this register is 0xF1 or 241d. This register can be read from two different logical addresses
(30242 or 40242). The logical address is calculated by adding the physical address to the logical start address (30001 or
40001).
• 30001 + 241 = 30242 (Issues function code 0x04 – Read Input Register)
• 40001 + 241 = 40242 (Issues function code 0x03 – Read Holding Register)

July 2024 MAG-AS-01087-EN-08 Page 5

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Register Type
Register Type identifies the number of registers the parameter requires. Each register is 16 bits. Supported Register
Types include:
Number of
Register Type Description Modbus Registers
UCHAR16 Unsigned Character (16 bits) 1
UCHAR16[x] Unsigned Character Array x
UINT16 Unsigned Integer (16 bits) 1
SINT16 Signed Integer (16 bits) 1
UINT32 Unsigned Integer (32 bits) 2
FLOAT32 Floating Point (32 bits) 2
For FLOAT32 register types, these registers make use of IEEE-754 floating point standard. For example, 1.0 is transmitted as
0x3F800000. Modbus serial link will transmit the most significant byte first, 0x3F, followed by 0x80, 0x00, 0x00.

Read/Write
The Read/Write attribute identifies if the parameter is read-only or writeable. Parameters that are read-only are specified as
such, otherwise, the parameter can be considered accessible with write commands.

FNC Support
FNC Support identifies the Modbus function codes (commands) available to access the register. Supported Modbus function
codes include:
Modbus Function Code Description
0x03 Read Holding Register
0x04 Read Input Register
0x06 Preset Single Register (Write)
0x10 Preset Multiple Registers (Write Multiple)

IMPORTANT
Write function codes are not accepted while menu navigation is in process.

Write function codes update only the working register located in volatile memory. Any sequence of writes must be
followed by a write of value 0x01 to the “Command Action Request Register”, address 0x0125. Otherwise changes will be
lost if the flow meter is power cycled or reset.

For efficiency, it is possible with read function codes, 0x03 and 0x04, to read blocks of registers. This allows for the ability
to read multiple registers in one transmission.

Page 6 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

MEMORY MAPS BY CATEGORY

Product Identification
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
1 FIRMWARE Product Code 0x0000 UINT16 Read-Only 0x03, 0x04
2 FIRMWARE Product Name 0x0001 UCHAR16[8] Read-Only 0x03, 0x04
3 FIRMWARE Firmware Name 0x0009 UCHAR16[16] Read-Only 0x03, 0x04
4 FACTORY Application Version 0x0019 UCHAR16[10] — 0x03, 0x04, 0x06, 0x10
5 FIRMWARE Compile Date [MM:DD:YYYY] 0x0023 UCHAR16[16] Read-Only 0x03, 0x04
6 FIRMWARE Compile Time [HH:MM:SS] 0x0033 UCHAR16[16] Read-Only 0x03, 0x04
7 FACTORY PCB Serial Number 0x0043 UCHAR16[5] — 0x03, 0x04, 0x10
8 FIRMWARE OTP Boot Checksum 0x0048 UCHAR16[3] Read-Only 0x03, 0x04
9 FIRMWARE Flash OS Checksum 0x004B UCHAR16[3] Read-Only 0x03, 0x04
10* FIRMWARE Boot Version 0x004E UCHAR16[5] Read-Only 0x03, 0x04
10 SERVICE Customer Serial Number 0x004E UINT32 — 0x03, 0x04, 0x06, 0x10
11 FACTORY Device Serial Number 0x0050 UINT32 Read-Only 0x03, 0x04
12 FIRMWARE OS Version 0x0053 UCHAR16[4] Read-Only 0x03, 0x04
13 NONE Daughterboard Product Type 0x0057 UINT16 Port B 0x03, 0x04, 0x06, 0x10
14 NONE Daughterboard Major Version 0x0058 UINT16 Port B 0x03, 0x04, 0x06, 0x10
15 NONE Daughterboard Minor Version 0x0059 UINT16 Port B 0x03, 0x04, 0x06, 0x10
16 FACTORY Power On Splash Line 1 0x005A UCHAR16[11] — 0x03, 0x04, 0x06, 0x10
17 FACTORY Power On Splash Line 2 0x0156 UCHAR16[11] — 0x03, 0x04, 0x06, 0x10
18 NONE Meter Tag Name 0x0161 UCHAR16[17] — 0x03, 0x04, 0x06, 0x10
19 FACTORY PCB Serial Number Integer 0x0065 UINT32 Read-Only 0x03, 0x04
* Properties for register 0x004E on M2000 firmware version [0x0019] v1.23 and older.

Meter Calibration
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
20 ADMIN Detector Diameter 0x006F UINT16 — 0x03, 0x04, 0x06, 0x10
21 ADMIN Detector Diameter Other [mm] 0x0070 UINT16 — 0x03, 0x04, 0x06, 0x10
22 ADMIN Detector Factor 0x0071 FLOAT32 — 0x03, 0x04, 0x10
23 FIRMWARE [FACTORY] Detector Factor 0x0073 FLOAT32 Read-Only 0x03, 0x04
24 ADMIN Detector Offset [m/s] 0x0075 FLOAT32 — 0x03, 0x04, 0x10
25 FIRMWARE [FACTORY] Detector Offset 0x0077 FLOAT32 Read-Only 0x03, 0x04
26 ADMIN Amplifier Factor 0x0079 FLOAT32 — 0x03, 0x04, 0x10
27 FIRMWARE [FACTORY] Amplifier Factor 0x007B FLOAT32 Read-Only 0x03, 0x04
28 ADMIN Detector Current [mA] 0x007D FLOAT32 — 0x03, 0x04, 0x10
29 FIRMWARE [FACTORY] Detector Current [mA] 0x007F FLOAT32 Read-Only 0x03, 0x04
30 SERVICE Power Line Frequency [Hz] 0x0081 UINT16 — 0x03, 0x04, 0x06, 0x10
31 ADMIN Excitation Frequency [Hz] 0x0082 UINT16 — 0x03, 0x04, 0x06, 0x10
32 SERVICE Scale Factor [%] 0x010B FLOAT32 — 0x03, 0x04, 0x10

July 2024 MAG-AS-01087-EN-08 Page 7

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Meter Measurement Settings

Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
33 USER Velocity Units 0x0113 UINT16 — 0x03, 0x04, 0x06, 0x10
34 USER Flow Unit 0x0083 UINT16 — 0x03, 0x04, 0x06, 0x10
35 USER Volume Unit 0x0084 UINT16 — 0x03, 0x04, 0x06, 0x10
36 USER Unit Multiplier 0x0085 UINT16 — 0x03, 0x04, 0x06, 0x10
37 USER Zero Scale Flow [User Units] 0x010D FLOAT32 — 0x03, 0x04, 0x10
38 USER Full Scale Velocity [m/s] 0x0086 FLOAT32 — 0x03, 0x04, 0x10
39 USER Full Scale Flow [User Units] 0x0090 FLOAT32 — 0x03, 0x04, 0x10
40 USER Low Flow Cutoff [%] 0x008E FLOAT32 — 0x03, 0x04, 0x10
41 USER Flow Direction Measurement Type 0x0092 UINT16 — 0x03, 0x04, 0x06, 0x10
42 USER Damping Factor [s] 0x0093 UINT16 — 0x03, 0x04, 0x06, 0x10
Digital Input
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
43 SERVICE Digital Input: Input Operation 0x0094 UINT16 — 0x03, 0x04, 0x06, 0x10
44 FIRMWARE Digital Input: Status 0x0155 UINT16 Read-Only 0x03, 0x04
Analog Output
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
45 SERVICE Analog Output Range 0x0095 UINT16 — 0x03, 0x04, 0x06, 0x10
46 FIRMWARE Analog Output Offset 0x0096 FLOAT32 Read-Only 0x03, 0x04
47 ADMIN Analog Output Calibration Point A [A] 0x0126 FLOAT32 — 0x03, 0x04, 0x10
48 ADMIN Analog Output Calibration Point B [A] 0x0128 FLOAT32 — 0x03, 0x04, 0x10
[FACTORY] : Analog Output
49 FIRMWARE 0x0088 FLOAT32 Read-Only 0x03, 0x04
Calibration Point A [A]
[FACTORY] : Analog Output
50 FIRMWARE 0x008C FLOAT32 Read-Only 0x03, 0x04
Calibration Point B [A]
51 FIRMWARE Analog Output Slope 0x0131 FLOAT32 Read-Only 0x03, 0x04
52 SERVICE Analog Customer Offset 4 mA [A] 0x0133 FLOAT32 — 0x03, 0x04, 0x10
53 SERVICE Analog Customer Offset 20 mA [A] 0x0135 FLOAT32 — 0x03, 0x04, 0x10
54 FIRMWARE Analog Output Current [ A ] 0x014E FLOAT32 Read-Only 0x03, 0x04
55 FIRMWARE Analog Output Current String [mA] 0x0150 UCHAR16[4] Read-Only 0x03, 0x04
56 SERVICE Alarm Mode 0x012E UINT16 — 0x03, 0x04, 0x06, 0x10
57 NONE Fixed Current Mode 0x008A FLOAT32 Port B 0x03, 0x04, 0x10

Page 8 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Output #1
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
58 SERVICE Output #1: Pulses Per Unit [m3] 0x0098 FLOAT32 — 0x03, 0x04, 0x10
59 SERVICE Output #1: Pulses Per Unit [user units] 0x009C FLOAT32 — 0x03, 0x04, 0x10
60 SERVICE Output #1: Pulse Width [ms] 0x00A0 UINT16 — 0x03, 0x04, 0x06, 0x10
61 SERVICE Output #1: Full Scale Frequency [Hz] 0x0174 UINT16 — 0x03, 0x04, 0x06, 0x10
62 SERVICE Output #1: Flow Alarm Minimum [%] 0x00A1 UINT16 — 0x03, 0x04, 0x06, 0x10
63 SERVICE Output #1: Flow Alarm Maximum [%] 0x00A2 UINT16 — 0x03, 0x04, 0x06, 0x10
64 SERVICE Output #1: Output Mode 0x00A3 UINT16 — 0x03, 0x04, 0x06, 0x10
65 SERVICE Output #1: Output Operation 0x00A4 UINT16 — 0x03, 0x04, 0x06, 0x10
Output #2
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
66 SERVICE Output #2: Pulses Per Unit [m3] 0x00A5 FLOAT32 — 0x03, 0x04, 0x10
67 SERVICE Output #2: Pulses Per Unit [user units] 0x00A9 FLOAT32 — 0x03, 0x04, 0x10
68 SERVICE Output #2: Pulse Width [ms] 0x00AD UINT16 — 0x03, 0x04, 0x06, 0x10
69 SERVICE Output #2: Full Scale Frequency [Hz] 0x0175 UINT16 — 0x03, 0x04, 0x06, 0x10
70 SERVICE Output #2: Flow Alarm Minimum [%] 0x00AE UINT16 — 0x03, 0x04, 0x06, 0x10
71 SERVICE Output #2: Flow Alarm Maximum [%] 0x00AF UINT16 — 0x03, 0x04, 0x06, 0x10
72 SERVICE Output #2: Output Mode 0x00B0 UINT16 — 0x03, 0x04, 0x06, 0x10
73 SERVICE Output #2: Output Operation 0x00B1 UINT16 — 0x03, 0x04, 0x06, 0x10
Output #3
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
74 SERVICE Output #3: Full Scale Frequency [Hz] 0x00B2 UINT16 — 0x03, 0x04, 0x06, 0x10
75 SERVICE Output #3: Flow Alarm Minimum [%] 0x00B3 UINT16 — 0x03, 0x04, 0x06, 0x10
76 SERVICE Output #3: Flow Alarm Maximum [%] 0x00B4 UINT16 — 0x03, 0x04, 0x06, 0x10
77 SERVICE Output #3: Output Mode 0x00B5 UINT16 — 0x03, 0x04, 0x06, 0x10
78 SERVICE Output #3: Hardware Select 0x00B6 UINT16 — 0x03, 0x04, 0x06, 0x10
79 SERVICE Output #3: Output Operation 0x00B7 UINT16 — 0x03, 0x04, 0x06, 0x10
Output #4
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
80 SERVICE Output #4: Flow Alarm Minimum [%] 0x00B8 UINT16 — 0x03, 0x04, 0x06, 0x10
81 SERVICE Output #4: Flow Alarm Maximum [%] 0x00B9 UINT16 — 0x03, 0x04, 0x06, 0x10
82 SERVICE Output #4: Output Mode 0x00BA UINT16 — 0x03, 0x04, 0x06, 0x10
83 SERVICE Output #4: Hardware Select 0x00BB UINT16 — 0x03, 0x04, 0x06, 0x10
84 SERVICE Output #4: Output Operation 0x00BC UINT16 — 0x03, 0x04, 0x06, 0x10

July 2024 MAG-AS-01087-EN-08 Page 9

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Port A Diagnostic Counters

Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
85 FIRMWARE Port A: Packets Processed 0x00BD UINT16 Read-Only 0x03, 0x04
86 FIRMWARE Port A: Broadcast Packets 0x00BE UINT16 Read-Only 0x03, 0x04
87 FIRMWARE Port A: CRC Errors 0x00BF UINT16 Read-Only 0x03, 0x04
88 FIRMWARE Port A: Packets Received 0x00C0 UINT16 Read-Only 0x03, 0x04
89 FIRMWARE Port A: Packets Sent 0x00C1 UINT16 Read-Only 0x03, 0x04
90 FIRMWARE Port A: Parity Errors 0x00C2 UINT16 Read-Only 0x03, 0x04
91 FIRMWARE Port A: Framing Errors 0x00C3 UINT16 Read-Only 0x03, 0x04
92 FIRMWARE Port A: Overrun Errors 0x00C4 UINT16 Read-Only 0x03, 0x04
93 FIRMWARE Port A: Break Detects 0x00C5 UINT16 Read-Only 0x03, 0x04
Port B Diagnostic Counters
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
94 FIRMWARE Port B: Packets Processed 0x00C6 UINT16 Read-Only 0x03, 0x04
95 FIRMWARE Port B: Broadcast Packets 0x00C7 UINT16 Read-Only 0x03, 0x04
96 FIRMWARE Port B: CRC Errors 0x00C8 UINT16 Read-Only 0x03, 0x04
97 FIRMWARE Port B: Packets Received 0x00C9 UINT16 Read-Only 0x03, 0x04
98 FIRMWARE Port B: Packets Sent 0x00CA UINT16 Read-Only 0x03, 0x04
99 FIRMWARE Port B: Parity Errors 0x00CB UINT16 Read-Only 0x03, 0x04
100 FIRMWARE Port B: Framing Errors 0x00CC UINT16 Read-Only 0x03, 0x04
101 FIRMWARE Port B: Overrun Errors 0x00CD UINT16 Read-Only 0x03, 0x04
102 FIRMWARE Port B: Break Detects 0x00CE UINT16 Read-Only 0x03, 0x04
Measurements
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
103 FIRMWARE T1 / T+ [m3] 0x00CF FLOAT32 Read-Only 0x03, 0x04
104 FIRMWARE T1 / T+ [User Units] 0x00D3 FLOAT32 Read-Only 0x03, 0x04
105 FIRMWARE T1 / T+ Display String 0x0137 UCHAR16[8] Read-Only 0x03, 0x04
106 FIRMWARE T2 / T- [m3] 0x00D7 FLOAT32 Read-Only 0x03, 0x04
107 FIRMWARE T2 / T– [User Units] 0x00DB FLOAT32 Read-Only 0x03, 0x04
108 FIRMWARE T2 / T– Display String 0x013F UCHAR16[8] Read-Only 0x03, 0x04
109 FIRMWARE T3 / TN [m3] 0x00DF FLOAT32 Read-Only 0x03, 0x04
110 FIRMWARE T3 / TN [User Units] 0x00E3 FLOAT32 Read-Only 0x03, 0x04
111 FIRMWARE T3 / TN Display String 0x0147 UCHAR16[8] Read-Only 0x03, 0x04
112 FIRMWARE T1 / T+ Rollover Counter 0x0176 UINT32 Read-Only 0x03, 0x04
113 FIRMWARE T2 / T– Rollover Counter 0x0178 UINT32 Read-Only 0x03, 0x04
114 FIRMWARE T3 / TN Rollover Counter 0x017A UINT32 Read-Only 0x03, 0x04
115 FIRMWARE Flow Velocity [m/s] 0x00E9 FLOAT32 Read-Only 0x03, 0x04
116 FIRMWARE Flow Velocity [User Units] 0x0172 FLOAT32 Read-Only 0x03, 0x04
117 FIRMWARE Flow Rate [m3/s] 0x00ED FLOAT32 Read-Only 0x03, 0x04
118 FIRMWARE Flow Rate [User Units] 0x00F1 FLOAT32 Read-Only 0x03, 0x04
119 FIRMWARE Relative Flow Rate [ % ] 0x00F3 FLOAT32 Read-Only 0x03, 0x04
120 FIRMWARE Preset Batch Totalizer [m3] 0x00EB FLOAT32 Read-Only 0x03, 0x04
121 FIRMWARE Preset Batch Totalizer [User Units] 0x00EF FLOAT32 Read-Only 0x03, 0x04
122 FIRMWARE Flow Direction Indicator 0x012D UINT16 Read-Only 0x03, 0x04

Page 10 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Meter Diagnostic Counters

Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
123 FIRMWARE Polarization Voltage [V DC] 0x009A FLOAT Read-Only 0x03, 0x04
124 FIRMWARE Power Up Counter 0x00F5 UINT16 Read-Only 0x03, 0x04
125 FIRMWARE Detector Error Counter 0x00F6 UINT16 Read-Only 0x03, 0x04
126 FIRMWARE Empty Pipe Counter 0x00F7 UINT16 Read-Only 0x03, 0x04
127 FIRMWARE Full Scale Counter 0x00F8 UINT16 Read-Only 0x03, 0x04
128 FIRMWARE Totalizer Overflow Counter 0x00F9 UINT16 Read-Only 0x03, 0x04
129 FIRMWARE Pulse Sync Counter 0x00FC UINT16 Read-Only 0x03, 0x04
130 FIRMWARE ADC Interrupt Counter 0x00FD UINT16 Read-Only 0x03, 0x04
131 FIRMWARE ADC Range Counter 0x00FE UINT16 Read-Only 0x03, 0x04
132 FIRMWARE Reserved 0x00FF UINT16 Read-Only 0x03, 0x04
133 FIRMWARE Reserved 0x0100 UINT16 Read-Only 0x03, 0x04
134 FIRMWARE System Error # 0x0101 UINT16 Read-Only 0x03, 0x04
135 FIRMWARE Token Error Counter 0x0102 UINT16 Read-Only 0x03, 0x04
136 FIRMWARE Meter Status 0x0106 UINT16 Read-Only 0x03, 0x04
137 FIRMWARE Action Request Overflows 0x0109 UINT16 Read-Only 0x03, 0x04
138 FIRMWARE Measurement Overflows 0x010A UINT16 Read-Only 0x03, 0x04
139 FIRMWARE Remote Resets 0x0154 UINT16 Read-Only 0x03, 0x04
Miscellaneous
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
140 FIRMWARE Power Loss Totalizer [ seconds ] 0x0107 UINT32 Read-Only 0x03, 0x04
141 USER Display Backlight Mode 0x010F UINT16 — 0x03, 0x04, 0x06, 0x10
142 SERVICE Preset Batch Amount [m3] 0x0110 FLOAT — 0x03, 0x04, 0x10
143 ADMIN Menu Reset Allowed 0x0112 UINT16 — 0x03, 0x04, 0x06, 0x10
144 USER Menu Language Setting 0x0114 UINT16 — 0x03, 0x04, 0x06, 0x10
File System – Number of Records to
145 USER 0x0117 UINT16 — 0x03, 0x04, 0x06, 0x10
Read
146 NONE Configuration Status 0x011D UINT16 Port B 0x03, 0x04, 0x06, 0x10
147 NONE Port B Extended Address 0x0118 UINT16 Port B 0x03, 0x04, 0x06, 0x10
Verification Tool Support
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
148 FIRMWARE Analog Input Measure Value 0x0115 FLOAT Read-Only 0x03, 0x04
149 ADMIN Analog Input Measure Counter 0x0119 UINT16 — 0x03, 0x04, 06, 0x10
150 FIRMWARE Empty Pipe Actual Resistance [Ohms] 0x011A FLOAT Read-Only 0x03, 0x04

July 2024 MAG-AS-01087-EN-08 Page 11

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Empty Pipe
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
151 ADMIN Empty Pipe Calibration [Volts] 0x011E FLOAT32 — 0x03, 0x04, 0x10
152 FIRMWARE Empty Pipe Measure Value [Volts] 0x0120 FLOAT32 Read-Only 0x03, 0x04
153 ADMIN Full Pipe Calibration [Volts] 0x0122 FLOAT32 — 0x03, 0x04, 0x10
154 SERVICE Empty Pipe Mode 0x0124 UINT16 — 0x03, 0x04, 0x06, 0x10

Control Commands
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
155 NONE Command Action Request 0x0125 UINT16 Write-Only 0x03, 0x04, 0x06, 0x10
156 SERVICE Flow Simulation 0x012A SINT16 — 0x03, 0x04, 0x06, 0x10

Security
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
157 FIRMWARE Security Status 0x011C UINT16 Read-Only 0x03, 0x04
158 FIRMWARE Random Value 0x012B UINT32 Read-Only 0x03, 0x04
159 NONE Remote Login 0x012F UINT32 Write-Only 0x10

Software Filters: Median (MDN) Filter

Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
160 FIRMWARE Software Median Filter Selection 0x0267 UINT16 — 0x03, 0x04, 0x06, 0x10
Software Filters: Infinite Impulse Response (IIR) Filter
Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
161 ADMIN IIR Coefficient Actual Value 0x02C9 FLOAT Read-Only 0x03, 0x04
162 ADMIN IIR Activation State 0x02CB UINT16 — 0x03, 0x04, 0x06, 0x10
163 ADMIN IIR Minimum Coefficient Value 0x02CC FLOAT — 0x03, 0x04, 0x10
164 ADMIN IIR Maximum Coefficient Value 0x02CE FLOAT — 0x03, 0x04, 0x10
165 ADMIN IIR Hysteresis Value 0x02D0 FLOAT — 0x03, 0x04, 0x10
166 ADMIN IIR Sensitivity Value 0x02D4 FLOAT — 0x03, 0x04, 0x10

Software Filters: Zero Flow Stability (ZFS) Filter

Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
167 ADMIN ZFS Bucket Size (user units) 0x02D8 FLOAT — 0x03, 0x04
168 ADMIN ZFS Bucket Timeout (seconds) 0x02DA UINT16 — 0x03, 0x04, 0x06, 0x10
169 ADMIN ZFS Bucket Volume (user units) 0x02DB FLOAT Read-Only 0x03, 0x04
170 ADMIN ZFS Bucket Timer Value (seconds) 0x02DD UINT16 Read-Only 0x03, 0x04

Page 12 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Daughterboard Settings: Modbus TCP/IP

Write Register Read /
No. Register Name Register Type FNC Support
Security Address Write
171 FIRMWARE DHCP Enable 0x0180 UINT16 — 0x03, 0x04, 0x06, 0x10
172 FIRMWARE IP Address 0x0181 UINT32 — 0x03, 0x04
173 FIRMWARE Subnet Mask 0x0183 UINT32 — 0x03, 0x04
174 FIRMWARE Gateway IP Address 0x0185 UINT32 — 0x03, 0x04
175 FIRMWARE TCP Timeout 0x0187 UINT16 — 0x03, 0x04, 0x06, 0x10
176 FIRMWARE ModbusTCP Port 0x0188 UINT16 — 0x03, 0x04, 0x06, 0x10
177 FIRMWARE Ethernet MAC Address 0x0190 UINT16 Read-Only 0x03, 0x04
178 FIRMWARE Webserver Access 0x0196 UINT16 — 0x03, 0x04, 0x06, 0x10

July 2024 MAG-AS-01087-EN-08 Page 13

Electromagnetic Flow Meters, M2000 Modbus Memory Map

M2000 MEMORY MAP BY REGISTER ADDRESS

Register Address Register Name Register Type
0x0000 Product Code UINT16
0x0001 Product Name UCHAR16[8]
0x0009 Firmware Name UCHAR16[16]
0x0013 Reserved UINT16
0x0019 Application Version UCHAR16[10]
0x0023 Compile Date [MM:DD:YYYY] UCHAR16[16]
0x0033 Compile Time [HH:MM:SS] UCHAR16[16]
0x0043 PCB Serial Number UCHAR16[5]
0x0048 OTP Boot Checksum UCHAR16[3]
0x004B Flash OS Checksum UCHAR16[3]
0x004E* Boot Version UCHAR16[5]
0x004E Customer Serial Number UINT32
0x0050 Device Serial Number UINT32
0x0053 OS Version UCHAR16[4]
0x0057 Daughterboard Product Type UINT16
0x0058 Daughterboard Major Version UINT16
0x0059 Daughterboard Minor Version UINT16
0x005A Power On Splash Line 1 UCHAR16[11]
0x0065 PCB Serial Number Integer UINT32
0x006F Detector Diameter UINT16
0x0070 Detector Diameter Other [mm] UINT16
0x0071 Detector Factor FLOAT32
0x0073 [FACTORY] Detector Factor FLOAT32
0x0075 Detector Offset [m/s] FLOAT32
0x0077 [FACTORY] Detector Offset FLOAT32
0x0079 Amplifier Factor FLOAT32
0x007B [FACTORY] Amplifier Factor FLOAT32
0x007D Detector Current [mA] FLOAT32
0x007F [FACTORY] Detector Current [mA] FLOAT32
0x0081 Power Line Frequency [Hz] UINT16
0x0082 Excitation Frequency [Hz] UINT16
0x0083 Flow Unit UINT16
0x0084 Volume Unit UINT16
0x0085 Unit Multiplier UINT16
0x0086 Full Scale Velocity [m/s] FLOAT32
0x0088 [FACTORY] : Analog Output Calibration Point A [A] FLOAT32
0x008A Fixed Current Mode FLOAT32
0x008C [FACTORY] : Analog Output Calibration Point B [A] FLOAT32
0x008E Low Flow Cutoff [%] FLOAT32
* Properties for register 0x004E on M2000 firmware version [0x0019] v1.23 and older.

Page 14 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Register Address Register Name Register Type

0x0090 Full Scale Flow [User Units] FLOAT32
0x0092 Flow Direction UINT16
0x0093 Damping Factor [s] UINT16
0x0094 Digital Input: Input Operation UINT16
0x0095 Analog Output Range UINT16
0x0096 Analog Output Offset FLOAT32
0x0098 Output #1: Pulses Per Unit [m3] FLOAT32
0x009A Polarization Voltage [V] FLOAT32
0x009C Output #1: Pulses Per Unit [User Units] FLOAT32
0x009E Reserved (to addr 0x009F) UINT16 [ 2 ]
0x00A0 Output #1: Pulse Width [ms] UINT16
0x00A1 Output #1: Flow Alarm Minimum [%] UINT16
0x00A2 Output #1: Flow Alarm Maximum [%] UINT16
0x00A3 Output #1: Output Mode UINT16
0x00A4 Output #1: Output Operation UINT16
0x00A5 Output #2: Pulses Per Unit [m3] FLOAT32
0x00A7 Reserved (to addr 0x00A8) UINT16 [ 2 ]
0x00A9 Output #2: Pulses Per Unit [User Units] FLOAT32
0x00AB Reserved (to addr 0x00AC) UINT16 [ 2 ]
0x00AD Output #2: Pulse Width [ms] UINT16
0x00AE Output #2: Flow Alarm Minimum [%] UINT16
0x00AF Output #2: Flow Alarm Maximum [%] UINT16
0x00B0 Output #2: Output Mode UINT16
0x00B1 Output #2: Output Operation UINT16
0x00B2 Output #3: Full Scale Frequency [Hz] UINT16
0x00B3 Output #3: Flow Alarm Minimum [%] UINT16
0x00B4 Output #3: Flow Alarm Maximum [%] UINT16
0x00B5 Output #3: Output Mode UINT16
0x00B6 Output #3: Hardware Select UINT16
0x00B7 Output #3: Output Operation UINT16
0x00B8 Output #4: Flow Alarm Minimum [%] UINT16
0x00B9 Output #4: Flow Alarm Maximum [%] UINT16
0x00BA Output #4: Output Mode UINT16
0x00BB Output #4: Hardware Select UINT16
0x00BC Output #4: Output Operation UINT16
0x00BD Port A: Packets Processed UINT16
0x00BE Port A: Broadcast Packets UINT16
0x00BF Port A: CRC Errors UINT16
0x00C0 Port A: Packets Received UINT16
0x00C1 Port A: Packets Sent UINT16
0x00C2 Port A: Parity Errors UINT16

July 2024 MAG-AS-01087-EN-08 Page 15

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Register Address Register Name Register Type

0x00C3 Port A: Framing Errors UINT16
0x00C4 Port A: Overrun Errors UINT16
0x00C5 Port A: Break Detects UINT16
0x00C6 Port B: Packets Processed UINT16
0x00C7 Port B: Broadcast Packets UINT16
0x00C8 Port B: CRC Errors UINT16
0x00C9 Port B: Packets Received UINT16
0x00CA Port B: Packets Sent UINT16
0x00CB Port B: Parity Errors UINT16
0x00CC Port B: Framing Errors UINT16
0x00CD Port B: Overrun Errors UINT16
0x00CE Port B: Break Detects UINT16
0x00CF T1 / T+ [m3] FLOAT32
0x00D1 Reserved (to addr 0x00D2) – FLOAT 64 UINT16 [ 2 ]
0x00D3 T1 / T+ [user units] FLOAT32
0x00D5 Reserved (to addr 0x00D6) – FLOAT 64 UINT16 [ 2 ]
0x00D7 T2 / T– [m3] FLOAT32
0x00D9 Reserved (to addr 0x00DA) – FLOAT 64 UINT16 [ 2 ]
0x00DB T2 / T– [user units] FLOAT32
0x00DD Reserved (to addr 0x00DE) – FLOAT 64 UINT16 [ 2 ]
0x00DF T3 / TN [m3] FLOAT32
0x00E1 Reserved (to addr 0x00E2) – FLOAT 64 UINT16 [ 2 ]
0x00E3 T3 / TN [user units] FLOAT32
0x00E5 Reserved (to addr 0x00E6) – FLOAT 64 UINT16 [ 2 ]
0x00E9 Flow Velocity [m/s] FLOAT32
0x00EB Preset Batch Totalizer [m3] FLOAT32
0x00ED Flow Rate [m3 /s] FLOAT32
0x00EF Preset Batch Totalizer [user units] FLOAT32
0x00F1 Flow Rate [user units] FLOAT32
0x00F3 Relative Flow Rate [ % ] FLOAT32
0x00F5 Power Up Counter UINT16
0x00F6 Detector Error Counter UINT16
0x00F7 Empty Pipe Counter UINT16
0x00F8 Full Scale Counter UINT16
0x00F9 Totalizer Overflow Counter UINT16
0x00FA Reserved UINT16
0x00FB Reserved UINT16
0x00FC Pulse Sync Counter UINT16
0x00FD ADC Interrupt Counter UINT16
0x00FE ADC Range Counter UINT16
0x00FF WDT Resets Counter UINT16

Page 16 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Register Address Register Name Register Type

0x0100 WDT Location UINT16
0x0101 System Error # UINT16
0x0102 Reserved UINT16
0x0103 Reserved UINT16
0x0104 Reserved UINT16
0x0105 Reserved UINT16
0x0106 Meter Status UINT16
0x0107 Power Loss Totalizer [ seconds ] UINT32
0x0109 Action Request Overflows UINT16
0x010A Measurement Overflows UINT16
0x010B Scale Factor [%] FLOAT32
0x010D Zero Scale Flow [User Units] FLOAT32
0x010F Display Backlight Mode UINT16
0x0110 Preset Batch Amount [m3] FLOAT32
0x0112 Menu Reset Allowed UINT16
0x0114 Menu Language Setting UINT16
0x0115 Analog Input Measure Value FLOAT32
0x0117 File System – Number of Records to Read UINT16
0x0118 Port B Extended Address UINT16
0x0119 Analog Input Measure Counter UINT16
0x011A Empty Pipe Actual Resistance [Ohms] FLOAT32
0x011C Security Status UINT16
0x011D Configuration Status UINT16
0x011E Empty Pipe Calibration [Volts] FLOAT32
0x0120 Empty Pipe Measure Value [Volts] FLOAT32
0x0122 Full Pipe Calibration [Volts] FLOAT32
0x0124 Empty Pipe Mode UINT16
0x0125 Command Action Request UINT16
0x0126 Analog Output Calibration Point A [A] FLOAT32
0x0128 Analog Output Calibration Point B [A] FLOAT32
0x012A Flow Simulation SINT16
0x012B Random Value UINT32
0x012D Flow Direction UINT16
0x012E Alarm Mode UINT16
0x012F Remote Login UINT32
0x0131 Analog Output Slope FLOAT32
0x0133 Analog Customer Offset 4 mA [A] FLOAT32
0x0135 Analog Customer Offset 20 mA [A] FLOAT32
0x0137 T1 / T+ Display String UCHAR16[8]
0x013F T2 / T- Display String UCHAR16[8]
0x0147 T3 / TN Display String UCHAR16[8]

July 2024 MAG-AS-01087-EN-08 Page 17

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Register Address Register Name Register Type

0x014E Analog Output Current [ A ] FLOAT32
0x0150 Analog Output Current String [mA] UCHAR16[4]
0x0154 Remote Resets UINT16
0x0155 Digital Input: Status UINT16
0x0156 Power On Splash Line 2 UCHAR16[11]
0x0161 Meter Tag Name UCHAR16[17]
0x0172 Flow Velocity User Units FLOAT32
0x0174 Out1_FS_Freq UINT16
0x0175 Out2_FS_Freq UINT16
0x0176 T1 / T+ Rollover Counter UINT32
0x0178 T2 / T- Rollover Counter UINT32
0x017A T3 / TN Rollover Counter UINT32
0x0180 DHCP Used UINT16
0x0181 IP Address UINT32
0x0183 Subnet Mask UINT32
0x0185 Gateway IP Addr UINT32
0x0187 TCP Timeout UINT16
0x0188 Modbus TCP Port UINT16
0x0190 Ethernet MAC Addr UINT16
0x0196 Webserver Access UINT16
0x0267 Software Median Flt UINT16
0x02C9 IIR Coef Actual Val FLOAT32
0x02CB IIR Actual State UINT16
0x02CC IIR Coef Min FLOAT32
0x02CE IIR Coef Max FLOAT32
0x02D0 IIR Hysteresis FLOAT32
0x02D4 IIR Sensitivity FLOAT32
0x02D8 ZFlow Stab Size FLOAT32
0x02DA ZFlow Stab Exp UINT16
0x02DB ZFlow Stab Acc FLOAT32
0x02DD ZFlow Stab Timer UINT16

Page 18 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

M2000 REGISTER WRITE PROPERTIES

Register Min. ** Req. Action
No.: Register Name Max. Value Value Definition
Address Value Request
0 = Other
1 = DN6
2 = DN8
3 = DN10
4 = DN15
5 = DN20
6 = DN25
7 = DN32
8 = DN40
9 = DN50
10 = DN65
11 = DN80
12 = DN100
13 = DN125
14 = DN150
15 = DN200
16 = DN250
19 Detector Diameter 0x006F 0 34 17 = DN300 YES
18 = DN350
19 = DN400
20 = DN450
21 = DN500
22 = DN550
23 = DN600
24 = DN700
25 = DN750
26 = DN800
27 = DN900
28 = DN1000
29 = DN1050
30 = DN1200
31 = DN1400
32 = DN1600
33 = DN1800
34 = DN2000
20 Detector Diameter Actual [mm] 0x0070 0 2032 — YES
21 Detector Factor 0x0071 0 9999.99 — YES
23 Detector Offset [m/s] 0x0075 –10 .00 10 .00 — YES
25 Amplifier Factor 0x0079 1 9,999,999,999 — YES
27 Detector Current [mA] 0x007D 0.1 0.4 — YES
0 = 50 Hz
29 Power Line Frequency [Hz] 0x0081 0 1 YES
1 = 60 Hz
0 = 1 Hz
1 = 3 .125 Hz or 3 .75 Hz
30 Excitation Frequency [Hz] 0x0082 0 3 YES
2 = 6 .25 Hz or 7 .5 Hz
3 = 12 .5 Hz or 15 Hz
** Command action code 0x01 should be issued to the command action request register immediately following any non-volatile
register update **

July 2024 MAG-AS-01087-EN-08 Page 19

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Register Min. ** Req. Action

No.: Register Name Max. Value Value Definition
Address Value Request
31 Scale Factor [%] 0x010B –0.1 0.1 — YES
0 = m/sec
32 Velocity Unit 0x0113 0 1 YES
1= ft/sec
0 = LPS
1 = LPM
2 = LPH
3 = M3S
4 = M3M
5 = M3H
6 = F3S
7 = F3M
8 = F3H
33 Flow Unit 0x0083 0 18 9 = GPS YES
10 = GPM
11 = GPH
12 = MGD
13 = IPS
14 = IPM
15 = IPH
16 = LBM
17 = OZM
18 = BPM
0 = Liters
1 = Hectoliters
2 = Cubic meters
3 = Cubic feet
4 = US gallons
5 = Mega gallons
6 = UK gallons
34 Volume Unit 0x0084 0 13 YES
7 = Pounds
8 = Ounces
9 = Acre feet
10 = Barrels
11 = Mega UK Gallons
12 = Second Foot-Day
13 = Kilo Gallons
0 = Off
1 = 1 unit
10 = 10 units
100 = 100 units
1000 = 1000 units
35 Unit Multiplier 0x0085 0 32771 YES
10000 = 10000 units
32768 = 0.1 units
32769 = 0.01 units
32770 = 0.001 units
32771 = 0.0001 units
10% of Full
36 Zero Scale Flow [User Units] 0x010D 0 — YES
Scale
37 Full Scale Velocity [m/s] 0x0086 0 12 — YES
** Command action code 0x01 should be issued to the command action request register immediately following any non-volatile
register update **

Page 20 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Register Min. ** Req. Action

No.: Register Name Max. Value Value Definition
Address Value Request
38 Full Scale Flow [User Units] 0x0090 0 VARIABLE — YES
39 Low Flow Cutoff [%] 0x008E 0 0.099 — YES
0 = uni-directional
40 Flow Direction Configuration 0x0092 0 1 YES
1 = bi-directional
0 = 0 seconds
1 = 1 second
2 = 2 seconds
3 = 3 seconds
41 Damping Factor [s] 0x0093 0 30 4 = four seconds YES
5 = five seconds
10 = 10 seconds
20 = 20 seconds
30 = 30 seconds
0 = Off
1 = Remote reset
42 Digital Input: Input Operation 0x0094 0 3 YES
2 = Positive zero return
3 = Batch reset
1 = 4…20 mA
2 = 0…20 mA
44 Analog Output Range 0x0095 1 4 YES
3 = 0…10 mA
4 = 2…10 mA
46 Analog Output Calibration Point A [A] 0x0126 0 0.024 — YES
47 Analog Output Calibration Point B [A] 0x0128 0 0.024 — YES
51 Analog Customer Offset 4 mA [A] 0x0133 -0.0025 0 .0025 — YES
52 Analog Customer Offset 20 mA [A] 0x0135 -0.0025 0 .0025 — YES
0: Meter error has no influence
on analog output
1: Meter error drives output 2
55 Analog Output Alarm Mode 0x012E 0 2 YES
mA below minimum range
2: Meter error drives output 2
mA above maximum range
56 Fixed Current Mode 0x008A 0 0.02 — YES
57 Output #1: Pulses Per Unit [m3] 0x0098 0 9999999 .999 — YES
58 Output #1: Pulses Per Unit [user units] 0x009C 0 9999999 .999 — YES
59 Output #1: Pulse Width [ms] 0x00A0 0 9999 0 = 50% duty cycle YES
60 Output #1: Full-Scale Frequency [Hz] 0x0174 0 10000 — YES
1 = 1%
61 Output #1: Flow Alarm Minimum [%] 0x00A1 0 100 YES
100 = 100%
1 = 1%
62 Output #1: Flow Alarm Maximum [%] 0x00A2 0 100 YES
100 = 100%
0 = Normally open
63 Output #1: Output Mode 0x00A3 0 1 YES
1 = Normally closed
** Command action code 0x01 should be issued to the command action request register immediately following any non-volatile
register update **

July 2024 MAG-AS-01087-EN-08 Page 21

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Register Min. ** Req. Action

No.: Register Name Max. Value Value Definition
Address Value Request
0 = Off
1 = Flow alarm
2 = Empty pipe alarm
3 = Error alarm
4 = Forward pulse
5 = AMR pulse
6 = Reverse pulse
64 Output #1: Output Operation 0x00A4 0 13 YES
7 = Frequency output
8 = Preset batch output
9 = Flow direction
10 = Verification test
11 = 24V DC supply
12 = ADE
13 = Totalizer Alarm
65 Output #2: Pulses Per Unit [m3] 0x00A5 0 9999999 .999 — YES
Output #2: Pulses Per Unit [User
66 0x00A9 0 9999999 .999 — YES
Units]
67 Output #2: Pulse Width [ms] 0x00AD 0 9999 0 = 50% duty cycle YES
68 Output #2: Full-Scale Frequency [Hz] 0x0175 0 10000 — YES
1 = 1%
69 Output #2: Flow Alarm Minimum [%] 0x00AE 0 100 YES
100 = 100%
1 = 1%
70 Output #2: Flow Alarm Maximum [%] 0x00AF 0 100 YES
100 = 100%
0 = Normally open
71 Output #2: Output Mode 0x00B0 0 1 YES
1 = Normally closed
0 = Off
1 = Flow alarm
2 = Empty pipe alarm
3 = Error alarm
4 = Forward pulse
5 = Not Supported
6 = Reverse pulse
72 Output #2: Output Operation 0x00B1 0 13 YES
7 = Frequency output
8 = Preset batch output
9 = Flow direction
10 = Verification test
11 = 24V DC supply
12 = Not Supported
13 = Totalizer Alarm
73 Output #3: Full Scale Frequency [Hz] 0x00B2 0 10000 — YES
1 = 1%
74 Output #3: Flow Alarm Minimum [%] 0x00B3 0 100 YES
100 = 100%
1 = 1%
75 Output #3: Flow Alarm Maximum [%] 0x00B4 0 100 YES
100 = 100%
0 = Normally open
76 Output #3: Output Mode 0x00B5 0 1 YES
1 = Normally closed
0 = Relay
77 Output #3: Hardware Select 0x00B6 0 1 YES
1 = Open collector
** Command action code 0x01 should be issued to the command action request register immediately following any non-volatile
register update **

Page 22 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Register Min. ** Req. Action

No.: Register Name Max. Value Value Definition
Address Value Request
0 = Off
1 = Flow alarm
2 = Empty pipe alarm
3 = Error alarm
4 = Not Supported
5 = Not Supported
6 = Not Supported
78 Output #3: Output Operation 0x00B7 0 13 YES
7 = Frequency output
8 = Preset batch output
9 = Flow direction
10 = Verification test
11 = Not Supported
12 = Not Supported
13 = Totalizer Alarm
1 = 1%
79 Output #4: Flow Alarm Minimum [%] 0x00B8 0 100 YES
100 = 100%
1 = 1%
80 Output #4: Flow Alarm Maximum [%] 0x00B9 0 100 YES
100 = 100%
0 = Normally open
81 Output #4: Output Mode 0x00BA 0 1 YES
1 = Normally closed
0 = Relay
82 Output #4: Hardware Select 0x00BB 0 1 YES
1 = Open collector
0 = Off
1 = Flow alarm
2 = Empty pipe alarm
3 = Error alarm
4 = Not Supported
5 = Not Supported
6 = Not Supported
83 Output #4: Output Operation 0x00BC 0 13 YES
7 = Not Supported
8 = Preset batch output
9 = Flow direction
10 = Verification test
11 = Not Supported
12 = Not Supported
13 = Totalizer Alarm
0 = No Flow Detected
120 Flow Direction Status (READ-ONLY) 0x012D 0 2 1 = Forward Flow NO
2 = Reverse Flow
** Command action code 0x01 should be issued to the command action request register immediately following any non-volatile
register update **

July 2024 MAG-AS-01087-EN-08 Page 23

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Register Min. ** Req. Action

No.: Register Name Max. Value Value Definition
Address Value Request
0 = Detector error
1 = Empty pipe error
2 = Full scale flow error
3 = Totalizer rollover error
4 = Totalizer rollover warning
5 = Totalizer flow simulation
status
6 = Dig pulse sync status
134 Meter Status 0x0106 0 255 7 = Adc int error NO
8 = Adc range error
9 = Wdt reset error
10 = Wdt reset
11 = Fatal error
12 = Token error
13 = OIMLR49 checksum error
14 = Unused
15 = Unused
0 = Always On
139 Display Backlight Mode 0x010F 0 2 1 = Always Off YES
2 = Timed Off
295735.295 m3 =
140 Preset Batch Amount [m3] 0x0110 0 295735.295 YES
9,999,999,999 Oz
1 = All totalizers are resetable
141 Menu Reset Allowed 0x0112 0 1 YES
0 = Otherwise
0 = English
142 Menu Language Setting 0x0114 0 1 YES
1 = Alternate
File System – Number of Records to # of records to extract from
143 0x0117 0 10000 NO
Read memory token
147 Analog Input Measure Counter 0x0119 0 0 — NO
149 Empty Pipe Calibration [Volts] 0x011E 0 3 — YES
151 Full Pipe Calibration [Volts] 0x0122 0 3 — YES
0 = Off
152 Empty Pipe Mode 0x0124 0 5 1 = On YES
2-5 = Reserved
** Command action code 0x01 should be issued to the command action request register immediately following any non-volatile
register update **

Page 24 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

Register Min. ** Req. Action

No.: Register Name Max. Value Value Definition
Address Value Request
0 = No action
1 = Save RAM to EEPROM
2 = Load EEPROM to RAM
3, 4, 5 = Reserved
6 = Save totalizers to EEPROM
7 = Clear T1 or T+
8 = Clear T2 or T–
9 = Clear Tn
10 = Clear all totalizers
11 = Clear port A diagnostics
12 = Clear port B diagnostics
13 = Clear all error counts
14 - 20 = Reserved
153 Command Action Request 0 0x0125 30 YES
21 = Clear power off totalizer
22 = Reserved
23 = Remote reset
24 = Restore factory calibration
data
25 = Reserved
26 = Reserved
27 = Reset batch amount
28 = Remote logoff
29 = Save RAM to EEPROM
(port B only)
30 = Flow Simulation Start
Timer (60 minutes)
-128 (0xFF80) = Disable
-101 (0xFF9B) = Enable
Flow Simulation Factor Toggle (toggles between 2
154 0x012A -128 100 NO
[% of Full-Scale Flow] setpoints every 5 seconds)
1…100 = Percent of FSF to
simulate
157 Remote Login (Security) 0x012A 0 4294967295 — NO
158 Software Median Filter 0x0267 0 3.00 — YES
160 IIR Actual State 0x02CB 0 1 — YES
161 IIR Coef Min 0x02CC 0 1 — YES
162 IIR Coef Max 0x02CE 0 1 — YES
163 IIR Hysteresis 0x02D0 0 6 — YES
164 IIR Sensitivity 0x02D4 0 99.99 — YES
165 Zero Flow Bucket Size 0x02D8 0 999.9 — YES
166 Zero Flow Timeout 0x02DA 0 9999 — YES
** Command action code 0x01 should be issued to the command action request register immediately following any non-volatile
register update **

July 2024 MAG-AS-01087-EN-08 Page 25

Electromagnetic Flow Meters, M2000 Modbus Memory Map

** Power
Register Min.
No.: Register Name Max. Value Value Definition Cycle
Address Value
Req’d.
0 = DHCP Disabled
169 DHCP Used 0x0180 0 1 1 = DHCP Enabled YES
(Default)
Integer representation of
170 IP Address 0x0181 0 4294967295 the IP address YES
XXX.XXX.XXX.XXX
Integer representation of
171 Subnet Mask 0x0183 0 4294967295 the subnet mask YES
XXX.XXX.XXX.XXX
Integer representation of
172 Gateway IP Address 0x0185 0 4294967295 the Gateway address YES
XXX.XXX.XXX.XXX
173 TCP Timeout 0x0187 0 3600 — YES
174 Modbus TCP Port 0x0188 0 65535 — YES
0 = Webserver Disabled
185 Webserver Access 0x0196 0 1 1 = Webserver Enabled YES
(default)
** Power cycle to the M2000 is required when modifying these daughterboard communication parameters, in order
for the device to retain the new value(s) **

Page 26 MAG-AS-01087-EN-08 July 2024

 Application Data Sheet

TROUBLESHOOTING
Modbus transmissions can be rejected for various reasons:
• Write request received while menu navigation is in process.
• Write request received with an invalid value (out-of range value).
• Write request received to a secured meter.
• Invalid register address supplied in Modbus serial request.
• Invalid number of registers supplied in Modbus serial request (too many or too few).
• Invalid function code supplied in Modbus serial request.
• The following error response codes are returned.

Error Response Code Reason

0x01 – Illegal Function Code Request received with invalid function code.
0x02 – Illegal Data Address Write request received with invalid number of registers.
Write request received with address not supported.
Write request received to a read-only register.
0x03 – Illegal Data Value Read request received with invalid number of registers.
Write/Read request received has too many registers to read.
Write request received with invalid value.
0x04 – Device Failure Write request received to a protected parameter (secured device, menu navigation in
progress).
Modbus transmissions may not be responded to for various reasons:
• Bad CRC – Verify serial link is properly shielded.
• Framing / Parity Errors – Verify serial communication settings match for both the flow meter and application software.
• Wrong port address – Verify the flow meter is properly programmed with the correct node address.
• Duplicate port addresses on serial link – May cause collisions when multiple meters respond at the same time.
• Wrong serial wiring – verify wiring is appropriate.
• For RS485, lack of termination on end devices or lack of biasing by Modbus Master. Flow meter does not provide RS485 biasing. This is
assumed to be accomplished by the Modbus Master.

July 2024 MAG-AS-01087-EN-08 Page 27

Electromagnetic Flow Meters, M2000 Modbus Memory Map

Control. Manage. Optimize.

ModMAG is a registered trademark of Badger Meter, Inc. Other trademarks appearing in this document are the property of their respective entities. Due to continuous research,
product improvements and enhancements, Badger Meter reserves the right to change product or system specifications without notice, except to the extent an outstanding
contractual obligation exists. © 2024 Badger Meter, Inc. All rights reserved.
www.badgermeter.com