Cleaver-Brooks CB Falcon boiler control

Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based as on the wire. Word order and scaling are confirmed at the hardware-verified rung and at no rung below it.

interop-verified

Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.

point	address (0-based)	type	scale	unit
status_change	0	U16	1
digital_io	2	U16	1
outlet_sensor	7	I16	0.1	°C
firing_rate	8	U16	1	%
fan_speed	9	U16	1	RPM
flame_signal	10	U16	0.01	V
inlet_sensor	11	I16	0.1	°C
dhw_sensor	12	I16	0.1	°C
s5_sensor	13	I16	0.1	°C
stack_sensor	14	I16	0.1	°C
remote_control_input	15	U16	0.1	mA
active_ch_setpoint	16	I16	0.1	°C
active_dhw_setpoint	17	I16	0.1	°C
active_ll_setpoint	18	I16	0.1
steam_pressure	20	U16	0.1	psi
analog_modulation_input	21	U16	0.1	mA
active_ch_pressure_setpoint	22	U16	0.1	psi
burner_control_status	32	U16	1
burner_control_state	33	U16	1
lockout_code	34	U16	1
alarm_reason	35	U16	1
sequence_time	38	U16	1	s
delay_time	39	U16	1	s
outlet_operation_sensor	43	I16	0.1	°C
dhw_operation_sensor	44	I16	0.1	°C
stack_or_hx_operation_sensor	45	I16	0.1	°C
burner_cycle_count	128	U32BE	1
burner_run_time	130	U32BE	1	h
outdoor_temperature	170	I16	0.1	°C
outlet_t_rise_rate	172	I16	0.1	°C/s
exchanger_t_rise_rate	173	I16	0.1	°C/s
s10_sensor_reading	174	I16	0.1	°C

link settings as documented (unverified): RTU; default 38400 8N1; unit ID 121; FC 03,06,16,17; Half duplex, LSB first, Idle line for 3.5 or more characters

bench facts as documented (unverified)

terminals	1: Data + (a), 2: Data - (b), 3: Common (c)
A/B polarity	Data + (a), Data - (b)
connector	3-pin connector
wiring notes	RS-485 connectors that use the Modbus communication protocol on either the MB1 or MB2 Modbus port.
max registers/read	125
sentinel values	0x8FFF for UNCONFIGURED temperature
protocol notes	All 32-bit data items are accessed as two consecutive, 16-bit holding registers. Variable length data must be accessed individually.
model register	0176
serial register	0186
firmware register	0188
identification notes	Burner name is at register 0183, OEM ID is at register 0185.
FC 43 device ID	not supported
accuracy	Temperature registers have 0.1°C precision.
doc revision	750-308

⚠ disputed: default_unit_id 121 — disputed by Cleaver-Brooks CFC-E Falcon Parameters Guide, which states that all controllers are programmed with a default address of 1 [3.4.3]

field reports — community-sourced, unverified (checked 2026-06-11)

confirmed: baud_rates [38400], default_baud 38400, framing [RTU], parity N, stop_bits 1 — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: terminals 1: Data + (a), 2: Data - (b), 3: Common (c) — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: sentinels 0x8FFF for UNCONFIGURED temperature — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: accuracy Temperature registers have 0.1°C precision — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: max_read_registers 125 — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)
confirmed: model_register 0176, firmware_register 0188 — confirmed by Cleaver-Brooks Falcon Modbus manual (750-308)

The trust ladder

Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.

generated — A prompt produced it. Unproven — anyone can regenerate this.
structure-verified — Decode path is structurally sound (addresses, widths, finite values). Does NOT prove word order or scaling.
interop-verified — Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
simulator-verified — Decoded correctly against a protocol emulator seeded with known-true values — catches word-order/scaling errors vs the emulator, not the physical device.
hardware-verified x1 — Matched a real device with operator-attested readings as ground truth — the only rung that confirms word order + scaling on the wire.

If your device isn't here, upload its register map. Generation is free, and the connector keeps the rung it earns under testing.

To prove a connector against your own device, order hardware verification. If it doesn't verify, you don't pay.

Platform builders can license the verified library: machine-readable maps, the firmware matrix, API access.