There is no standard answer, because Modbus does not define one. Every drive family picks its own speed reference register, its own scaling and its own control word. Here are the addresses for four families we document in detail — and the part nobody puts in the table, which is how to get the scaling right on the drive in front of you.
Windows 10/11 · RTU, ASCII & TCP · one-time license · 14-day trial
Each of these comes from the manufacturer's own documentation and is covered in full on our per-drive page, linked in the last column. Addresses are given the way that family's manual gives them — note that ABB uses 4xxxx reference numbering while the others print raw hex.
| Drive family | Speed / frequency reference | Start–stop word | Scaling | Detail |
|---|---|---|---|---|
| ABB ACS580 ABB Drives profile |
40002 Reference 1 |
40001 Control Word |
20000 = 100% documented |
ACS580 guide |
| ABB ACS880 ABB Drives profile |
40002 Reference 1 |
40001 Control Word |
20000 = 100% documented |
ACS880 guide |
| Yaskawa V1000 also GA500, 1000-series |
0002H Frequency reference |
0001H Operation command |
derive it — see below | V1000 guide |
| DURApulse GS20 also GS20X |
0x2001 (8193) Control Word 2 |
0x2000 (8192) Control Word 1 |
derive it — see below | GS20 guide |
| PowerFlex 525 520-series |
Check 520-UM001 for your firmware. Logic Command is 8192 or 8193 depending on whether your master counts from 0 or 1 — Rockwell documents both. |
derive it — see below | PowerFlex guide | |
We publish a scaling factor only where the manufacturer documents one plainly, as ABB does. For the rest, the figures circulating on forums and in scraped register tables contradict each other — including on the speed reference address itself. Two writes on your own drive settle it in about a minute, and that number is true for the drive you actually have. The method is below.
Modbus specifies how a master asks for register 8193 and how a slave answers. It says nothing whatsoever about what register 8193 means. That is left entirely to the device maker, which is why a VFD speed reference has no universal address and never will.
The consequence catches people out in mixed panels. DURApulse GS20 and Allen-Bradley PowerFlex drives both use 0x2000 and 0x2001 for their command and reference words. The addresses are identical; the bit meanings and the scaling are not. A write that ramps one drive to half speed can do something quite different to the other.
So the only safe sequence is: get the address from the manual for your exact drive and firmware, then confirm on the drive that the address does what you think, before anything downstream depends on it.
0x2001 on a GS20
→ commanded frequency
0x2001 on a PowerFlex
→ adjacent to Logic Command — and which of 8192/8193 you need depends on your master's numbering
In a panel that mixes families, read each drive's status word and watch it change before writing anything.
Finding the register takes one look at the manual. Working out what number to put in it is where commissioning days go. Is 6000 equal to 60.00 Hz, or 60 percent of maximum, or 6000 rpm? Published tables disagree, and the answer shifts with the drive's own maximum frequency setting. You do not have to guess: the drive will tell you.
This works on every family, including the ones where the scaling is documented — on an ABB drive it simply confirms that Reference 1 is behaving as 20000 = 100% and that the maximum is configured where you think it is. It costs two minutes and removes a whole class of "the drive runs at the wrong speed" call-outs.
The speed reference says how fast, not whether. Start, stop and fault reset live in a separate control word: 40001 on ABB, 0001H on Yaskawa, 0x2000 on GS20, the Logic Command word on PowerFlex. On an ABB drive using the ABB Drives profile, 0x047F in the control word is the value that has the drive accelerate to the reference. Write the reference all day and a stopped drive stays stopped.
Every family has a setting that selects where the command and the reference come from — keypad, terminals or fieldbus. On the ACS880 that is the embedded fieldbus configuration in parameter groups 19 and 20. Until it points at the fieldbus, the drive accepts your write into the register quite happily and then runs from the potentiometer. Reading the register back shows your value sitting there, which makes this failure especially convincing and especially wrong.
Not every drive accepts every write function. Yaskawa's MEMOBUS implementation supports 03H for reading, 08H for a loopback test and 10H for writing — and rejects 06H, write-single-register, even at a perfectly valid address. Send it as function code 16 with a quantity of one and the same address accepts it. If your tool only offers FC06, that is a tool limitation showing up as a drive fault.
Some masters number registers from 0 and some from 1, while the wire always carries the zero-based number. The same physical register is therefore legitimately called 8192 by one tool and 8193 by another. Rockwell states this plainly in the 520-series manual and gives exactly that example for the Logic Command word. If a value comes back that looks like it belongs to the neighbouring register, this is almost always why — the PowerFlex addressing page works through it in full.
Every problem above — the address, the offset, the function code, the command source, the scaling — is far cheaper to settle with a Windows Modbus master and a USB RS-485 adapter than inside a PLC program. There is no download, no scan cycle to reason about, and you can see the raw request and response.
In ModbusManager Pro you read the status word and write the reference from the same window, with every value shown in decimal, hex and binary at once, and each request and response logged. Write a reference, watch the keypad, write another. When the numbers are confirmed, the PLC gets written once against values you have already seen move the drive.
If the drive's serial settings are unknown too, auto-detect will find the baud rate, parity and slave ID before you start. And for a line of several drives, the gateway function merges the registers you choose into one map the PLC reads over a single connection.
This page is the cross-brand summary. Each guide below goes through that family's addressing scheme, control word bits, function-code support and the traps specific to it:
Read the status word, write the reference, watch the keypad. Two values and you have the scaling for the drive in front of you — before a line of PLC code is written.
Take the address from the manual. Take the offset and the scaling from the drive. Never take either from a forum post — including this one.
We use Google Analytics cookies to see how the site is used. You can accept or decline — declining keeps analytics off. See our Privacy Policy.