AERCO BMS/C-More boiler controller

Register map(s) for this device, with a note of how far each has been checked. Addresses are 0-based, as on the wire. Scale and byte order are confirmed only at the hardware-verified rung.

coherence-checked

Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.

point	address (0-based)	type	scale	unit
Net Remote Set Point	0	U16	1
Default Message Display Code	0	U16	1
Net Direct Drive	1	U16	1	%
Unit Status	1	U16	1
Modbus Password	2	U16	1
Outlet Temp	2	U16	1
Password	3	U16	1
Inlet Temp	3	U16	1
Internal Set Point	4	U16	1
Aux Temp	4	U16	1
Outdoor Temp	5	U16	1
Time	6	U16	1
Exhaust Temp	6	U16	1
Date	7	U16	1
FFWD Temp	7	U16	1
Unit of Temp	8	U16	1
Fire Rate Out	8	U16	1	%
Baud Rate	9	U16	1
O2 Level	9	U16	1	%
Unit Type	10	U16	1
CO Level	10	U16	1	PPM
Unit Size	11	U16	1
Run Cycles Low (LSB)	11	U16	1
Boiler Mode	12	U16	1
Run Cycles High (MSB)	12	U16	1
Remote Signal	13	U16	1
Run Hours Low (LSB)	13	U16	1
Bldg Ref Temp	14	U16	1
Run Hours High (MSB)	14	U16	1
Reset Ratio	15	U16	1
Flame Strength	15	U16	1	%
Outdoor Sensor Enable	16	U16	1
Active Set point	16	U16	1
System Start Temp	17	U16	1
Fire Rate In	17	U16	1	%
Set Point Lo Limit	18	U16	1
Manual Fire Rate	18	U16	1	%
Set Point Hi Limit	19	U16	1
Comm Address	19	U16	1
Temp Hi Limit	20	U16	1
Software Version	20	U16	1
Max Fire Rate	21	U16	1	%
Pump Delay Timer	22	U16	1	MIN_UNITS
C-More: Fault Log Code	23	U16	1
C-More: Fault Log Cycle (LOW)	24	U16	1
C-More: Fault Log Cycle (HIGH)	25	U16	1
C-More: Fault Log Date	26	U16	1
C-More: Fault Log Time	27	U16	1
C-More: Sensor Log Active Setpoint	28	U16	1	DEGREES_1
C-More: Sensor Log Outlet Temp	29	U16	1	DEGREES_1
C-More: Sensor Log Inlet Temp	30	U16	1	DEGREES_1
C-More: Sensor Log FFWD Temp	31	U16	1	DEGREES_1
C-More: Sensor Log Exhaust Temp	32	U16	1	DEGREES_3
C-More: Sensor Log Outdoor Temp	33	U16	1	DEGREES_2
C-More: Sensor Log Aux Temp	34	U16	1	DEGREES_1
C-More: Sensor Log CO xmitter	35	U16	1	PPM_UNITS
C-More: Sensor Log O2 xmitter	36	U16	1	%
C-More: Sensor Log Flow Meter	37	U16	1	GPM_UNITS
C-More: Time Log Status	38	U16	1
C-More: Time Log Fire Rate	39	U16	1	%
C-More: Time Log Flame Strength	40	U16	1	%
C-More: Time Log Run Length	41	U16	1
C-More: Time Log Date	42	U16	1
C-More: Time Log Time	43	U16	1
BMS: Boiler 28 Status (BMS) / Boiler 20 Status (BMS II)	44	U16	1
BMS: Boiler 29 Status (BMS) / Boiler 21 Status (BMS II)	45	U16	1
BMS: Boiler 30 Status (BMS) / Boiler 22 Status (BMS II)	46	U16	1
BMS: Boiler 31 Status (BMS) / Boiler 23 Status (BMS II)	47	U16	1
BMS: Boiler 32 Status (BMS) / Boiler 24 Status (BMS II)	48	U16	1
BMS: Boiler 33 Status (BMS) / Boiler 25 Status (BMS II)	49	U16	1
BMS: Boiler 34 Status (BMS) / Boiler 26 Status (BMS II)	50	U16	1
BMS: Boiler 35 Status (BMS) / Boiler 27 Status (BMS II)	51	U16	1
BMS: Boiler 36 Status (BMS) / Boiler 28 Status (BMS II)	52	U16	1
BMS: Boiler 37 Status (BMS) / Boiler 29 Status (BMS II)	53	U16	1
BMS: Boiler 38 Status (BMS) / Boiler 30 Status (BMS II)	54	U16	1
BMS: Boiler 39 Status (BMS) / Boiler 31 Status (BMS II)	55	U16	1
BMS: Boiler 40 Status (BMS) / Boiler 32 Status (BMS II)	56	U16	1
BMS: I/O Status	57	U16	1
BMS: Return Sensor Temp	58	U16	1	°F
BMS: Offset Enable	59	U16	1
C-More: Set Point Limiting	60	U16	1
C-More: Set Point Limit Band	61	U16	1	ABS_DEG_1
C-More: Sensor Log Interval	67	U16	1
C-More: Fault Log Pointer	68	U16	1
C-More: Sensor Log Pointer	69	U16	1
C-More: Time Log Pointer	70	U16	1
BMS: Offset Off Time Day 2 - Minutes	71	U16	1	Minutes
BMS: Offset Off Time Day 3 - Minutes	72	U16	1	Minutes
BMS: Offset Off Time Day 4 - Minutes	73	U16	1	Minutes
BMS: Offset Off Time Day 5 - Minutes	74	U16	1	Minutes
BMS: Offset Off Time Day 6 - Minutes	75	U16	1	Minutes
BMS: Offset Off Time Day 7 - Minutes	76	U16	1	Minutes
BMS: Offset Off Time Day 1 - Hours	77	U16	1	Hours
BMS: Offset Off Time Day 2 - Hours	78	U16	1	Hours
BMS: Offset Off Time Day 3 - Hours	79	U16	1	Hours
BMS: Offset Off Time Day 4 - Hours	80	U16	1	Hours
BMS: Offset Off Time Day 5 - Hours	81	U16	1	Hours
BMS: Offset Off Time Day 6 - Hours	82	U16	1	Hours
BMS: Offset Off Time Day 7 - Hours	83	U16	1	Hours
BMS: Indoor Air Input	85	U16	1
BMS: Remote Signal	86	U16	1
BMS: RS232 Mode	87	U16	1
BMS: RS232 Baud Rate	88	U16	1
BMS: Number Of Network Boilers	89	U16	1
BMS: Min Slave Address	90	U16	1
BMS: Max Slave Address	91	U16	1
BMS: Net Boiler 1 Address	92	U16	1
BMS: Net Boiler 2 Address	93	U16	1
BMS: Net Boiler 3 Address	94	U16	1
BMS: Net Boiler 4 Address	95	U16	1
BMS: Net Boiler 5 Address	96	U16	1
BMS: Net Boiler 6 Address	97	U16	1
BMS: Net Boiler 7 Address	98	U16	1
BMS: Net Boiler 8 Address	99	U16	1
BMS: Net Boiler 9 Address	100	U16	1
BMS: Net Boiler 10 Address	101	U16	1
BMS: Net Boiler 11address	102	U16	1
BMS: Net Boiler 12 Address	103	U16	1
BMS: Net Boiler 13 Address	104	U16	1
BMS: Net Boiler 14 Address	105	U16	1
BMS: Net Boiler 15 Address	106	U16	1
BMS: Net Boiler 16 Address	107	U16	1
BMS: Net Boiler 17 Address	108	U16	1
BMS: Net Boiler 18 Address	109	U16	1
BMS: Net Boiler 19 Address	110	U16	1
BMS: Net Boiler 20 Address	111	U16	1
BMS: Net Boiler 21 Address	112	U16	1
BMS: Net Boiler 22 Address	113	U16	1
BMS: Net Boiler 23 Address	114	U16	1
BMS: Net Boiler 24 Address	115	U16	1
BMS: Net Boiler 25 Address	116	U16	1
BMS: Net Boiler 26 Address	117	U16	1
BMS: Net Boiler 27 Address	118	U16	1
BMS: Net Boiler 28 Address	119	U16	1
BMS: Net Boiler 29 Address	120	U16	1
BMS: Net Boiler 30 Address	121	U16	1
BMS: Net Boiler 31 Address	122	U16	1
BMS: Net Boiler 32 Address	123	U16	1
BMS: Network Baud	124	U16	1
BMS: Network Timeout	125	U16	1	sec
BMS: Password Lo	126	U16	1
BMS: Password Hi	127	U16	1
BMS: Modbus Control Type	128	U16	1
BMS: Modbus Pass-Thru	129	U16	1
BMS: Header Dead Band	130	U16	1	°F
BMS: Outside Temp Sensor Offset	131	I16	1	°F
BMS: Ramp Up %/MIN	132	U16	1
BMS: Ramp Down %/MIN	133	U16	1
BMS: Fault Alarm Boilers	134	U16	1
BMS: 4 to 20 mA Current Offset	135	I16	0.01	mA
BMS: Return Sensor Offset	136	I16	0.1
BMS: Load Start Pct	137	U16	1
BMS: Load Stop Pct	138	U16	1

link settings as documented (unverified): RTU; default 9600 8??; unit ID 128; FC 03,04,06,08,17; RTU transmission ONLY. C-More baud rate is fixed at 9600.

bench facts as documented (unverified)

terminals	RS485, 2-Wire Differential Bus With Shield
A/B polarity	It is imperative that polarity be maintained between all Modbus Network connections.
termination	A terminating resistor (120 ohms) on each end of the RS485 loop. BMS/BMS II has a built-in 120 ohm terminating resistor.
connector	RS232 (DB9-Female) and internal RS232 connector
isolation	232 ISO GND
shield/ground	twisted-pair wiring shield should only be terminated at the controlling Master Controller for the Modbus Network.
broadcast	supported
protocol notes	Heartbeat Timeout: Fixed at 10 seconds For C-More, Adjustable For BMS/BMS II: 5 to 240 Seconds
firmware register	20
FC 43 device ID	not supported
power	85-265 VAC
doc revision	REVISED FEBRUARY 17, 2011

field reports — community-sourced, unverified (checked 2026-06-11)

confirmed: comms defaults (baud rate 9600, default unit ID 128, RTU framing) — confirmed by AERCO Modbus Communication User Manual OMM-0035 (GF-114)
confirmed: physical layer (RS485 2-wire differential bus, 120 ohm termination, RS232 DB9 connector) — confirmed by AERCO Modbus Guidelines GF-2080 and OMM-0035
confirmed: register map summary (default_message_display_code @ 0, unit_status @ 1, outlet_temp @ 2, inlet_temp @ 3, aux_temp @ 4, outdoor_temp @ 5, exhaust_temp @ 6, ffwd_temp @ 7, fire_rate_out @ 8, o2_level @ 9, co_level @ 10, run_cycles_low @ 11, run_cycles_high @ 12, run_hours_low @ 13, run_hours_high @ 14, flame_strength @ 15, active_setpoint @ 16, fire_rate_in @ 17, manual_fire_rate @ 18) — confirmed by AERCO Modbus Communication User Manual OMM-0035 (GF-114) Standard Input Register Address Mapping

The trust ladder

Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.

generated — A prompt produced it. Unproven — anyone can regenerate this.
structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
coherence-checked — Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.
hardware-verified (software-key) x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.

Device not here? Upload its manual and get a checked map back. It's free.

Want it confirmed against your own device? Order hardware verification. If it doesn't check out, you don't pay.

Building on a lot of devices? License the library — machine-readable maps, the firmware matrix, and API access.