Easy BACnet- Home
- BACnet points lists
- WEG
- CFW503 (BACnet MS/TP)
Variable frequency drive · BACnet points list
WEG CFW503 (BACnet MS/TP) BACnet points list
Updated 28 October 2026
The CFW503 runs BACnet MS/TP on its RS-485 port and maps drive parameters to fixed objects: AVs for readings, ramps, PID values and the network speed reference, BVs for the status word (P0680) and control word (P0682), plus digital and analog I/O. A mailbox (AV 100/101, BV 100/101) reads or writes any parameter by number.
This page lists 77 BACnet objects for the WEG CFW503 (BACnet MS/TP) — 41 of them writable — with each object’s type, instance number, name, engineering units and access. It is re-typed from WEG’s own free documentation, linked below.
- Manufacturer
- WEG
- Model
- CFW503 (BACnet MS/TP)
- Equipment
- Variable frequency drive
- Equipment type
- VFDs & pumps
- BACnet objects
- 77 (41 writable)
- Transport
- BACnet MS/TP
- Firmware
- Not stated
- Default device instance
- 359000 + serial address (P0308) when P0760 and P0761 are 0
- Also known as
- CFW503, WEG CFW503, CFW503 BACnet, 10012735607
BMS integration notes: WEG CFW503 (BACnet MS/TP)
Set P0312 to BACnet, the address in P0308 and the baud rate in P0310, then set P0220-P0228 so run/stop, direction and reference come from Serial/USB. Write BV 16 run/stop with BV 17 general enable and the speed reference to AV 17 (8192 = motor rated frequency). Read BV 8, AV 3, AV 1 and BV 15, and reset faults with BV 23.
Minimum points to map
The short list most integrators start with — enough to run the unit from a BMS. Map more as the job needs.
| Object | Name | Why | Access |
|---|---|---|---|
| BV 16 | Run/Stop | Start/stop from the BMS | Command |
| BV 17 | General Enable | General enable; must be on to run | Command |
| BV 20 | Remote | Remote mode when P0220 selects Serial/USB | Command |
| AV 17 | Serial/USB Speed Ref. | Speed reference, 8192 = rated frequency | Command |
| BV 23 | Fault Reset | Reset a tripped drive | Command |
| BV 8 | Running | Running status | Read |
| AV 3 | Motor Frequency | Output frequency in Hz | Read |
| AV 1 | Motor Current | Motor amps | Read |
| BV 15 | Fault | Any active drive fault | Read |
| AV 13 | Present Fault | Active fault number | Command |
Enable & remote start
Network commands only act when P0220-P0228 select Serial/USB: P0220 = 5/6 lets the control word set local/remote (BV 20), P0222 = 9 takes the reference from P0683 (AV 17), P0227 = 2 takes run/stop from the control word and P0226 = 5/6 sets direction. The drive needs both BV 17 General Enable and BV 16 Run/Stop.
Heartbeat & communication loss
P0314 Serial Watchdog (time limit 0-999, the manual gives no unit; 0 = off, factory 0): if no valid telegram arrives within that time the drive shows alarm A0128 (or fault F0228) and runs the P0313 action: 0 none, 1 ramp stop (factory), 2 general disable, 3 go to local, 4 local keeping commands, 5 fault. Timing starts at the first valid telegram after power-up.
Sensors & values from the BMS
AV 21/AV 25 take the main and external PID automatic setpoints and AV 23/AV 27 the PID feedbacks when the drive's PID is used.
Network setup
- P0312 = 3 (BACnet-1) for the standard port, or 9 for the second port of a plug-in module; reinitialize after changing.
- P0308 MS/TP address 0-254 (factory 1); P0310 baud 9600, 19200 (factory) or 38400; P0311 must be 8N1.
- Device instance: P0760 x 10000 + P0761; with both at 0 the drive uses 359000 + P0308 (WEG vendor ID 359).
- P0762 max master (factory 127), P0763 max info frames (factory 1), P0764 sends I-Am at power-up only (factory) or continuously.
Watch out for
- Speed reference AV 17 is a 13-bit value, not Hz or %: 8192 = motor rated frequency (P0403); negative values reverse.
- Unit column in the manual is shifted for AV 6-11; see notes.
- Ramp times AV 14/15 and the mailbox write change drive parameters; don't write them cyclically.
- P0313 = 0 keeps the drive running at the last command after a comm loss.
WEG CFW503 (BACnet MS/TP) BACnet objects
Type: AI, AO, AV, BI, BO, BV, MI/MO/MV (multi-state) · Access: Read read-only, Write writable, Command writable with a priority array.
| Description | States | |||||
|---|---|---|---|---|---|---|
| AI | 0 | AI1 Value | Analog input 1 level (P018) | % | Read | |
| AI | 1 | AI2 Value | Analog input 2 level (P019) | % | Read | |
| AI | 2 | AI3 Value | Analog input 3 level (P020) | % | Read | |
| AO | 0 | AOx Value 1 | Network value for an analog output (P0696) | Command | ||
| AO | 1 | AOx Value 2 | Network value for an analog output (P0697) | Command | ||
| AO | 2 | AOx Value 3 | Network value for an analog output (P0698) | Command | ||
| AV | 0 | Motor Speed | Motor speed (P0002) | rpm | Read | |
| AVmin | 1 | Motor Current | Motor current (P0003) | A | Read | |
| AV | 2 | DC Link Voltage (Ud) | DC bus voltage (P0004) | V | Read | |
| AVmin | 3 | Motor Frequency | Output frequency (P0005) | Hz | Read | |
| AV | 4 | Motor Voltage | Output voltage (P0007) | V | Read | |
| AV | 5 | Motor Torque | Motor torque (P0009) | % | Read | |
| AV | 6 | Output Power | Output power; unit cell blank in the shifted table (P0010) | Read | ||
| AV | 7 | Heatsink Temperature | Heatsink temperature (P0030) | °C | Read | |
| AV | 9 | Time Powered | Powered hours counter (P0042) | h | Command | |
| AV | 10 | Time Enabled | Enabled hours counter (P0043) | h | Command | |
| AV | 11 | kWh Output Energy | Energy counter (P0044) | kWh | Read | |
| AV | 12 | Present Alarm | Active alarm number (P0048) | Command | ||
| AVmin | 13 | Present Fault | Active fault number (P0049) | Command | ||
| AV | 14 | Acceleration Time | Acceleration ramp time (P0100) | s | Command | |
| AV | 15 | Deceleration Time | Deceleration ramp time (P0101) | s | Command | |
| AV | 16 | Speed in 13 bits | Motor speed, 13-bit scale (8192 = rated frequency) (P0681) | Command | ||
| AVmin | 17 | Serial/USB Speed Ref. | Speed reference, 13-bit scale (8192 = rated frequency) (P0683) | Command | ||
| AV | 18 | SoftPLC Parameter 3 | SoftPLC user parameter (P1012) | Command | ||
| AV | 19 | SoftPLC Parameter 4 | SoftPLC user parameter (P1013) | Command | ||
| AV | 20 | SoftPLC Parameter 16 | SoftPLC user parameter (P1025) | Command | ||
| AV | 21 | Main PID Aut. Setpoint | Main PID automatic setpoint (P1011) | Command | ||
| AV | 22 | Main PID Man. Setpoint | Main PID manual setpoint (P1014) | % | Command | |
| AV | 23 | Main PID Feedback | Main PID feedback (P1015) | Command | ||
| AV | 24 | Main PID Output | Main PID output (P1016) | % | Command | |
| AV | 25 | External PID Auto Setpoint | External PID automatic setpoint (P1060) | Command | ||
| AV | 26 | External PID Man. Setpoint | External PID manual setpoint (P1061) | % | Command | |
| AV | 27 | External PID Feedback | External PID feedback (P1062) | Command | ||
| AV | 28 | External PID Output | External PID output (P1063) | % | Command | |
| AV | 100 | Mailbox: param. number | Parameter number for mailbox access | Write | ||
| AV | 101 | Mailbox: param. value | Value read from or to write to the parameter | Write | ||
| BI | 0 | DI1 | Digital input 1 (P012 bit 0) | Read | 0=Off, 1=On | |
| BI | 1 | DI2 | Digital input 2 (P012 bit 1) | Read | 0=Off, 1=On | |
| BI | 2 | DI3 | Digital input 3 (P012 bit 2) | Read | 0=Off, 1=On | |
| BI | 3 | DI4 | Digital input 4 (P012 bit 3) | Read | 0=Off, 1=On | |
| BI | 4 | DI5 | Digital input 5 (P012 bit 4) | Read | 0=Off, 1=On | |
| BI | 5 | DI6 | Digital input 6 (P012 bit 5) | Read | 0=Off, 1=On | |
| BI | 6 | DI7 | Digital input 7 (P012 bit 6) | Read | 0=Off, 1=On | |
| BI | 7 | DI8 | Digital input 8 (P012 bit 7) | Read | 0=Off, 1=On | |
| BO | 0 | DO1 | Digital output 1 (P695 bit 0) | Command | 0=Off, 1=On | |
| BO | 1 | DO2 | Digital output 2 (P695 bit 1) | Command | 0=Off, 1=On | |
| BO | 2 | DO3 | Digital output 3 (P695 bit 2) | Command | 0=Off, 1=On | |
| BO | 3 | DO4 | Digital output 4 (P695 bit 3) | Command | 0=Off, 1=On | |
| BO | 4 | DO5 | Digital output 5 (P695 bit 4) | Command | 0=Off, 1=On | |
| BV | 0 | Reserved | Status word bit, reserved (P680 bit 0) | Read | ||
| BV | 1 | Run Command | Status: run command active (P680 bit 1) | Read | ||
| BV | 2 | Fire mode | Status: fire mode (P680 bit 2) | Read | 0=Off, 1=On | |
| BV | 3 | Reserved | Status word bit, reserved (P680 bit 3) | Read | ||
| BV | 4 | Quick Stop | Status: quick stop (P680 bit 4) | Read | 0=Inactive, 1=Active | |
| BV | 5 | 2nd Ramp | Status: second ramp (P680 bit 5) | Read | 0=Off, 1=On | |
| BV | 6 | Config. Mode | Status: configuration mode (P680 bit 6) | Read | 0=Normal, 1=Config | |
| BV | 7 | Alarm | Status: alarm active (P680 bit 7) | Read | 0=No Alarm, 1=Alarm | |
| BVmin | 8 | Running | Status: motor running (P680 bit 8) | Read | 0=Stopped, 1=Running | |
| BV | 9 | Enabled | Status: general enable (P680 bit 9) | Read | 0=Disabled, 1=Enabled | |
| BV | 10 | Forward | Status: direction (P680 bit 10) | Read | 0=Reverse, 1=Forward | |
| BV | 11 | JOG | Status: JOG (P680 bit 11) | Read | 0=Off, 1=On | |
| BV | 12 | Remote | Status: remote or local (P680 bit 12) | Read | 0=Local, 1=Remote | |
| BV | 13 | Undervoltage | Status: undervoltage (P680 bit 13) | Read | 0=No, 1=Undervoltage | |
| BV | 14 | Automatic PID | Status: PID manual or auto (P680 bit 14) | Read | 0=Auto, 1=Manual | |
| BVmin | 15 | Fault | Status: fault active (P680 bit 15) | Read | 0=No Fault, 1=Fault | |
| BVmin | 16 | Run/Stop | Command: run/stop (P682 bit 0) | Command | 0=Stop, 1=Run | |
| BVmin | 17 | General Enable | Command: general enable (P682 bit 1) | Command | 0=Disable, 1=Enable | |
| BV | 18 | Run Forward | Command: direction (P682 bit 2) | Command | 0=Reverse, 1=Forward | |
| BV | 19 | JOG Enable | Command: JOG (P682 bit 3) | Command | 0=Off, 1=On | |
| BVmin | 20 | Remote | Command: remote/local select (P682 bit 4) | Command | 0=Local, 1=Remote | |
| BV | 21 | 2nd Ramp | Command: second ramp (P682 bit 5) | Command | 0=Off, 1=On | |
| BV | 22 | Quick Stop | Command: quick stop (P682 bit 6) | Command | 0=Off, 1=On | |
| BVmin | 23 | Fault Reset | Command: fault reset (P682 bit 7) | Command | 0=Off, 1=Reset | |
| BV | 29 | Intern PID | Command: internal PID manual/auto (P682 bit 13) | Command | 0=Auto, 1=Manual | |
| BV | 30 | Extern PID | Command: external PID manual/auto (P682 bit 14) | Command | 0=Auto, 1=Manual | |
| BV | 100 | Mailbox: exec. read | Mailbox read trigger | Write | 0=Off, 1=On | |
| BV | 101 | Mailbox: exec. write | Mailbox write trigger | Write | 0=Off, 1=On |
No points match these filters.
Integration notes
- The manual's AV unit column is shifted one row from AV 6 to AV 11 (it prints °C for Output Power, h for Heatsink Temperature, kWh for Time Enabled). Units here follow the parameter: AV 6 is left blank, AV 7 °C, AV 9-10 h, AV 11 kWh.
- BV 1 Run Command and BV 0/3 have no state or access entry in the table; they are status-word bits and are listed here as read-only.
- BV 20 Remote (command) is printed with states 'Reset/Off' in the object table; the P0682 bit 4 description (0 = Local, 1 = Remote) is used here.
- Some digital outputs may be missing depending on the plug-in module; AO 2 drives the frequency output (FO).
- The table marks counters and fault/alarm codes (AV 9, 10, 12, 13) as commandable; treat them as readings.
- Mailbox: write the parameter number to AV 100, then 1 to BV 100 to read the value into AV 101, or set AV 101 and write 1 to BV 101 to write it.
Check it against the live device. A points list tells you what the controller can expose; the unit in front of you may differ by firmware or installed options. Easy BACnet scans a network for BACnet IP devices from an Android phone, reads every object on the CFW503 (BACnet MS/TP) and exports what it actually has to Excel — free. New to BACnet? Start with what a BACnet points list is and what the object types mean.
Questions about the WEG CFW503 (BACnet MS/TP)
How many BACnet points does the WEG CFW503 (BACnet MS/TP) have?
This list has 77 BACnet objects: 3 analog inputs, 3 analog outputs, 30 analog values, 8 binary inputs, 5 binary outputs, 28 binary values. The exact set on a given unit depends on its firmware, installed options and configuration.
Which WEG CFW503 (BACnet MS/TP) BACnet points are writable?
41 of the 77 objects accept a write. Points marked Command have a priority array: a write holds until it is released, so release it back to automatic when you are done.
Where is the official WEG CFW503 (BACnet MS/TP) BACnet documentation?
The source is CFW503 BACnet User's Guide (10012735607 Rev. 00), revision 2025-05, published free by WEG at https://static.weg.net/medias/downloadcenter/hed/h7a/WEG-CFW503-manual-bacnet-communication-manual-10012735607-en.pdf.
What are the minimum BACnet points to integrate the WEG CFW503 (BACnet MS/TP)?
Start with BV 16 Run/Stop (Start/stop from the BMS); BV 17 General Enable (General enable; must be on to run); BV 20 Remote (Remote mode when P0220 selects Serial/USB); AV 17 Serial/USB Speed Ref. (Speed reference, 8192 = rated frequency); BV 23 Fault Reset (Reset a tripped drive); BV 8 Running (Running status); AV 3 Motor Frequency (Output frequency in Hz); AV 1 Motor Current (Motor amps); BV 15 Fault (Any active drive fault); AV 13 Present Fault (Active fault number).
How do I enable BMS control of the WEG CFW503 (BACnet MS/TP)?
Network commands only act when P0220-P0228 select Serial/USB: P0220 = 5/6 lets the control word set local/remote (BV 20), P0222 = 9 takes the reference from P0683 (AV 17), P0227 = 2 takes run/stop from the control word and P0226 = 5/6 sets direction. The drive needs both BV 17 General Enable and BV 16 Run/Stop.
Does the WEG CFW503 (BACnet MS/TP) need a BACnet heartbeat or have a communication timeout?
P0314 Serial Watchdog (time limit 0-999, the manual gives no unit; 0 = off, factory 0): if no valid telegram arrives within that time the drive shows alarm A0128 (or fault F0228) and runs the P0313 action: 0 none, 1 ramp stop (factory), 2 general disable, 3 go to local, 4 local keeping commands, 5 fault. Timing starts at the first valid telegram after power-up.
Can the BMS supply sensor values to the WEG CFW503 (BACnet MS/TP)?
AV 21/AV 25 take the main and external PID automatic setpoints and AV 23/AV 27 the PID feedbacks when the drive's PID is used.
How do I check these points on the real CFW503 (BACnet MS/TP)?
Scan the network with a BACnet IP browser such as Easy BACnet, open the device and compare its object list with this table. Anything missing is usually an option that isn't installed or a point that is disabled in the controller's configuration.
More WEG BACnet points lists
Source: CFW503 BACnet User's Guide · 10012735607 Rev. 00 · rev. 2025-05. Object names, instances and units are reproduced as published; descriptions are our own.