Register map(s) for this device, each at the trust rung it earned. Addresses are 0-based as on the wire; word order and scaling are only confirmed at the hardware-verified rung.
Read + decoded cleanly over a real network vs an independent third-party Modbus test server (transport and framing; reads are remapped into the server's register window, so the map's own addresses are NOT exercised). Does NOT prove word order/scaling against the actual device.
| point | address (0-based) | type | scale | unit |
|---|---|---|---|---|
| status_change | 0 | U16 | 1 | |
| digital_io | 2 | U16 | 1 | |
| limits | 4 | U16 | 1 | |
| demand_source | 6 | U16 | 1 | |
| outlet_sensor_temp | 7 | U16 | 0.1 | °C |
| firing_rate | 8 | U16 | 0.1 | % |
| fan_speed | 9 | U16 | 1 | RPM |
| flame_signal | 10 | U16 | 0.01 | V |
| inlet_sensor_temp | 11 | U16 | 0.1 | °C |
| dhw_sensor_temp | 12 | U16 | 0.1 | °C |
| s5_sensor_temp | 13 | U16 | 0.1 | °C |
| stack_sensor_temp | 14 | U16 | 0.1 | °C |
| remote_control_input_ma | 15 | U16 | 0.1 | mA |
| active_ch_setpoint | 16 | U16 | 0.1 | °C |
| active_dhw_setpoint | 17 | U16 | 0.1 | °C |
| active_ll_setpoint | 18 | U16 | 0.1 | °C |
| steam_pressure | 20 | U16 | 0.1 | psi |
| analog_modulation_input | 21 | U16 | 0.1 | mA |
| active_ch_pressure_setpoint | 22 | U16 | 0.1 | psi |
| active_ch_operating_point | 25 | U16 | 0.1 | °C |
| active_dhw_operating_point | 26 | U16 | 0.1 | °C |
| active_lead_lag_operating_point | 27 | U16 | 0.1 | °C |
| active_system_operating_point | 28 | U16 | 0.1 | °C |
| active_system_setpoint | 29 | U16 | 0.1 | °C |
| burner_control_status | 32 | U16 | 1 | |
| burner_control_state | 33 | U16 | 1 | |
| lockout_code | 34 | U16 | 1 | |
| sequence_time | 38 | U16 | 1 | s |
| delay_time | 39 | U16 | 1 | s |
| burner_control_flags | 41 | U16 | 1 | |
| outlet_operation_temp | 43 | U16 | 0.1 | °C |
| dhw_operation_temp | 44 | U16 | 0.1 | °C |
| stack_or_heat_exchanger_operation_temp | 45 | U16 | 0.1 | °C |
| ch_status | 64 | U16 | 1 | |
| ch_requested_rate | 68 | U16 | 0.1 | |
| dhw_status | 80 | U16 | 1 | |
| dhw_requested_rate | 85 | U16 | 0.1 | |
| burner_cycle_count | 128 | U32BE | 1 | |
| burner_run_time | 130 | U32BE | 1 | |
| ch_pump_cycle_count | 132 | U32BE | 1 | |
| dhw_pump_cycle_count | 134 | U32BE | 1 | |
| system_pump_cycle_count | 136 | U32BE | 1 | |
| boiler_pump_cycle_count | 138 | U32BE | 1 | |
| outdoor_temperature | 170 | U16 | 0.1 | °C |
| outlet_t_rise_rate | 172 | U16 | 0.1 | °C/s |
| exchanger_t_rise_rate | 173 | U16 | 0.1 | °C/s |
| s10_sensor_reading | 174 | U16 | 0.1 | °C |
| terminals | 3-pin connector |
| A/B polarity | Terminal 1: Data + (a), Terminal 2: Data - (b), Terminal 3: Common (c) |
| connector | 3-pin connector |
| wiring notes | MB1 or MB2 Modbus ports |
| max registers/read | 125 |
| sentinel values | 0x8FFF for unconfigured temperature parameters, 0x7FFF or 0x8200 for no sensor configured, 0x8000 for shorted, 0x8100 for open, 0x8300 for outside high range, 0x8400 for outside low range, 0x8500 for not reliable. |
| protocol notes | Except for variable length data items, registers can be accessed as a single register or up to 20 registers for writes and 125 registers for reads. Variable length data must be accessed individually. |
| model register | 176 |
| firmware register | 186 |
| identification notes | Report Slave ID (FC17) returns OS number and Burner name. OS number is also at register 186, Burner name is at 183. |
| FC 43 device ID | not supported |
| doc revision | 4.1.1 |
Each rung states what it proved and what it did not. Gray until proven; green is earned by hardware only.
Have a device that isn't here? Upload its register map — generation is free, and the connector earns its rung by being proven, not claimed.
Need it proven on your own device? Hardware verification — if it doesn't verify, you don't pay.
Building a platform? License the verified library — machine-readable maps, firmware matrix, API access.