Cleaver-Brooks CB Falcon boiler control

Register map(s) for this device, with a note of how far each has been checked. Addresses are 0-based, as on the wire. Scale and byte order are confirmed only at the hardware-verified rung.

coherence-checked

Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.

point	address (0-based)	type	scale	unit
status_change	0	U16	1
digital_io	2	U16	1
outlet_sensor	7	I16	0.1	°C
firing_rate	8	U16	1	%
fan_speed	9	U16	1	RPM
flame_signal	10	U16	0.01	V
inlet_sensor	11	I16	0.1	°C
dhw_sensor	12	I16	0.1	°C
s5_sensor	13	I16	0.1	°C
stack_sensor	14	I16	0.1	°C
remote_control_input	15	U16	0.1	mA
active_ch_setpoint	16	I16	0.1	°C
active_dhw_setpoint	17	I16	0.1	°C
active_ll_setpoint	18	I16	0.1
steam_pressure	20	U16	0.1	psi
analog_modulation_input	21	U16	0.1	mA
active_ch_pressure_setpoint	22	U16	0.1	psi
burner_control_status	32	U16	1
burner_control_state	33	U16	1
lockout_code	34	U16	1
alarm_reason	35	U16	1
sequence_time	38	U16	1	s
delay_time	39	U16	1	s
outlet_operation_sensor	43	I16	0.1	°C
dhw_operation_sensor	44	I16	0.1	°C
stack_or_hx_operation_sensor	45	I16	0.1	°C
burner_cycle_count	128	U32BE	1
burner_run_time	130	U32BE	1	h
outdoor_temperature	170	I16	0.1	°C
outlet_t_rise_rate	172	I16	0.1	°C/s
exchanger_t_rise_rate	173	I16	0.1	°C/s
s10_sensor_reading	174	I16	0.1	°C

link settings as documented (unverified): RTU; default 38400 8N1; unit ID 121; FC 03,06,16,17; Half duplex, LSB first, Idle line for 3.5 or more characters

bench facts as documented (unverified)

terminals	1: Data + (a), 2: Data - (b), 3: Common (c)
A/B polarity	Data + (a), Data - (b)
connector	3-pin connector
wiring notes	RS-485 connectors that use the Modbus communication protocol on either the MB1 or MB2 Modbus port.
max registers/read	125
sentinel values	0x8FFF for UNCONFIGURED temperature
protocol notes	All 32-bit data items are accessed as two consecutive, 16-bit holding registers. Variable length data must be accessed individually.
model register	0176
serial register	0186
firmware register	0188
identification notes	Burner name is at register 0183, OEM ID is at register 0185.
FC 43 device ID	not supported
accuracy	Temperature registers have 0.1°C precision.
doc revision	750-308

⚠ disputed: default_unit_id 121 — disputed by Cleaver-Brooks CFC-E Falcon Parameters Guide, which states that all controllers are programmed with a default address of 1 [3.4.3]

field reports — community-sourced, unverified (checked 2026-06-11)

confirmed: baud_rates [38400], default_baud 38400, framing [RTU], parity N, stop_bits 1 — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: terminals 1: Data + (a), 2: Data - (b), 3: Common (c) — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: sentinels 0x8FFF for UNCONFIGURED temperature — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: accuracy Temperature registers have 0.1°C precision — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: max_read_registers 125 — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: model_register 0176, firmware_register 0188 — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)

The trust ladder

Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.

generated — A prompt produced it. Unproven — anyone can regenerate this.
structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
coherence-checked — Round-trips through a real Modbus stack with no overlapping addresses and a word-order-sensitive codec — the map is internally coherent and wire-decodable. Does NOT prove byte-order or scaling match a real device: the emulator is seeded from the map's own types, so a uniformly wrong byte-order still round-trips. Only hardware-verified confirms byte-order/scale on the wire.
hardware-verified (software-key) x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.

Device not here? Upload its manual and get a checked map back. It's free.

Want it confirmed against your own device? Order hardware verification. If it doesn't check out, you don't pay.

Building on a lot of devices? License the library — machine-readable maps, the firmware matrix, and API access.