Fireye NEXUS NX6100 series User manual

1

DESCRIPTION
The MODBUS interface is designed to c
onnect Fireye's NX6100 or PPC6000 Nexus
Controllers to other devices using the 'MODBUS RTU' or 'MODBUS TCP' protocols, using
3 wire RS485. This bulletin shows connections and the available MODBUS memory map for these
controls only.
NX6100/PPC6000 series controllers may be connected to a MODBUS communications system to
enable data collection and limited control functions. The controllers are connected to the MOD-
BUS via the Isolated RS485 Communications terminals on the NX6100 or PPC6000. The MODBUS
function requires a daughter board to be fitted to each controller.
The protocol supported is MODBUS RTU and the data configuration supported is 8-bits, no parity,
1-stop bit. This is the simplest and most common data configuration because the MODBUS protocol
includes 'crc' to ensure data packet integrity.
A network of up to 14 Fireye Nexus NX6100 or PPC6000 controls can be linked toMODBUS.
Consideration needs to be given to the total number of registers to be communicated, refer to page 4
for further details.
MODBUS RTU can be accessed via two daughter boards for the NX6100 or PPC6000. The NXD-
BMB (MODBUS only) or NXDBVSD (MODBUS and variable speed drive) allow access to the
NX6100/PPC6000 through the isolated RS485 terminals. See Figure 1, Section 1.2. Also, refer to
the appropriate bulletin, NEX-6101 or PPC-6001.
The touch-screen NXTSD104 or NX6330 is required to use BACNET/IP because it provides the
Ethernet interface. The protocol is implemented by the firmware running on the touch-screen hard-
ware. BACNET/IP is the only form of the BACNET protocol available for the 6000 series.
MOD-6001
NEXUS
NX6100/PPC6000 SERIES
MODBUS RTU / TCPIP,
and BACNET/IP
COMMUNICATIONS
September 24, 2018

2

Safety Information
When this equipment is fitted to an appliance due regard must also be given to the requirements of that
appliance.
Before attempting to install, commission or operate this equipment all relevant sections of this
document must be read and fully understood. If in doubt about any requirements consult Fireye.
Installation, commissioning or adjustment of this product MUST be carried out by suitably
trained engineers or personnel qualified by training and experience.
After installation or modifications to the installation all functions of the equipment MUST be
checked to ensure safe and reliable operation of the control.
The manufacturer of this equipment accepts no liability for any consequences resulting from
inappropriate, negligent or incorrect installation, commissioning or adjustment of operating parameters
of the equipment.
Control panels must not be left uncovered while power is on. If it is essential to do so while rectifying
faults only personnel qualified by training and experience should be involved.
The time any covers are off must be kept to a minimum and warning notices must be posted.
Before attempting any work on this equipment or any equipment controlled by or connected to this
equipment, all related electrical supplies must be isolated.
Safety interlocks must not be removed or over-ridden. Any faults once detected must be corrected
before the control is operated.
The manufacturer of this equipment has a policy of continual product improvement and reserves the
right to change the specification of the equipment and the contents of this manual without notice.
WARNING
The equipment described in this manual is capable of causing property damage, severe injury, or
death. It is the responsibility of the owner or user to ensure that the equipment described herenis
installed, operated and commissioned in compliance with the requirements of all national and local
legislation, which may prevail.

3

Table of contents
Please read the safety information at the front of this manual before proceeding
1. Introduction 4
1.1 Compatibility and Conventions 4
1.2 Overview 4
2. Wiring and Hardware Configuration 5
2.1 MODBUS cables 5
2.2 Screen termination 5
2.3 RS485 serial communications termination resistor 6
3. Controller Configuration 7
3.1 Overview 7
3.2 Entering the Parameters 7
3.3 General 7
3.3.1.1 Entering commission ratio mode 8
3.3.1.2 Exiting from commission mode 8
3.4 Option parameter list 8
4. MODBUS RTU Data Sets 10
4.1 Overview 10
4.2 MODBUS system reset and timeout 11
4.3 Coils (0XXX(X)) – WRITE TO registers (MODBUS Function Code 5) 11
4.4 Input Registers (3XXX(X)) – READ FROM (MODBUS function code 4) 12
4.5 Holding Registers (4XXX(X)) – WRITE TO (MODBUS function code 6) 15
5. Modbus TCPIP Data Sets 16
5.1 Overview 16
5.2 Coils (READ / WRITE) registers (Modbus Function Codes 1 & 5) 17
5.3 Input (READ ONLY) registers (Modbus function code 4) 19
5.4 Holding (READ FROM / WRITE TO) registers (Modbus function codes 3 & 6) 30
5.5 Read Discrete Inputs (Function Code 2) 43
6. BACNET/IP Interface 45
6.1 Overview 45
6.2 Implementation Details 45
6.3 Description of Objects 47
6.4 BACnet Protocol Conformance Statement 51
7. Specification. 52
7.1 MODbus RTU 52
7.2 MODbus TCPIP 52
8. Appendix - Communications 53
8.1 E110 Flame Monitor. 53
8.2 YB110 BurnerLogix. 59

4

Introduction
1.1 Compatibility and Conventions
MODBUS RTU communication with NX6100/PPC6000 series controllers is compatible with NX6100 or
PPC6000 at firmware revision 1.2 or greater. Engineer's Key EK55 indicates the firmware version. See Sec-
tion 4 and 6.6 of the relevant NX6100 or PPC6000 bulletin for more information. The NX6100/PPC6000
require the use of either the NXDBMB (MODBUS only) or the NXDBVSD (MODBUS and Variable Speed
Drive) daughter boards. These boards are inserted into the NX6100/PPC6000 through the back side. The
firmware revision of these boards must be 1.103 or above. Consult the factory to verify the revision level.
Modbus TCP communication with NX6100/PPC6000 series controls requires the use of an Ethernet enabled
display module. The NXTSD104 and NX6330 displays provides the required functionality.
If Modbus TCP only is required, then there is no requirement for a daughterboard in the controller unless it is
required for some other function (for example fan speed control).
All touch-screens of firmware version 2.100 and higher will provide Modbus TCP. Version 2.0xx screens can
be upgraded (firmware update) to provide modbus TCP. Version 1.xxx screens cannot be upgraded to provide
modbus TCP.
NX6110 and NX6220 Displays lack Ethernet hardware so do not support Modbus TCP and will require
replacement (or use of Modbus RTU with control daughterboard).
It is important to note that the functionality provided is 'modbus TCP', not 'modbus RTU over TCP'
which is different.
This guide covers several different products; hence the parameters to be entered and connector terminal refer-
ences may be different depending on the product used. Where such information is given, it will be given for
both types of controllers in the following format of the following example:
…. option parameter 12.06000 / 13.06100 must be set to ….
where the required parameter may be 12.0 on a PPC6000, and 13.0 on an NX6100 controller.
1.2 Overview
NX6100/PPC6000 series controllers may be connected to a MODBUS communications system to enable data
collection and limited control functions. The controllers are connected to the MODBUS via the Isolated
RS485 Communications terminals on the controller, not the daughterboard. The MODBUS function requires
a daughter board to be fitted to the controller.
The protocol supported is MODBUS RTU and the data configuration supported is 8-bits, no parity, 1-stop bit.
This is the simplest and most common data configuration because the MODBUS protocol includes 'crc' to
ensure data packet integrity.
NX6100/PPC6000 series controllers support 2-wire MODBUS, which in fact is often a 3-wire system where
the 3rd wire is a 0V logic connection. This is the preferred wiring method. The MODBUS cable loops from
one device to the other, a 'daisy chain' configuration as shown below.
.
Figure 1: MODBUS Connections
Commands via MODBUS are only valid when the NX6100/PPC6000 series controller is in Normal/Remote
operating mode as selected from the display. See the relevant NX6100 or PPC6000 bulletin for more information.
Controller A
NX6100 PPC6000
Controller B Controllers
Other
PC1 0V
PC2 MB-
PC3 MB+
PB13 0V
PB12 MB-
PB11 MB+
MB+
MB-
0V

5

2. Wiring and Hardware Configuration
2.1 MODBUS cables
FIREYE recommends that RS485 MODBUS cables should be overall 'braid' screened, PVC insulated, 3-
core of 24 AWG (7/0.2mm) wire minimum. This cable may be run adjacent to, and/or in the same conduit
as high voltage wiring. Therefore, the cable voltage rating must exceed the maximum voltage carried by
any other cable connected to the controller or run in the same conduit.
Terminate the screen at each controller using the cable clamps provided. Incorrect connection or appli-
cation of excess voltage may damage or destroy the controllers being connected.
2.2 Screen termination
Screen termination clamps are provided on the main controller for termination of cable screens (tinned cop-
per braid type). It is important to ensure that the screen and associated insulation cover the cable cores as
close as possible to the terminals to which they are connected, and not cut-back to where the cable passes
through the screen termination clamp.
NOTE: The 'clamps' are not intended to provide strain relief for the cables.

6

2.3 RS485 serial communications termination resistor
NOTE: The 'clamps' are not intended to provide strain relief for the cables.
RS485 communication buses require balancing. This is achieved by
selected by JP1 jumpers
If a FIREYE device is at the end of the bus then set both of the JP1 links to the IN position.
the termination resistors on both controllers to the IN position.
applying termination resistors at the extremes of the cable. Ther re two
resistors, one for each of the RS485 + and - wires. NX6100/PPC6000
series daughter boards have termination resistors on-board, which ae
on the daughter board.
All other controllers should have the links set to the OUT position. If only two controllers ar
on the communications bus, set

7

3. Controller configuration.
3.1 Overview
Before configuring the NX6100/PPC6000 series controllers for MODBUS communications, the user must
have a clear operating strategy defined. This strategy should define the operating speed of the bus, the bus
addresses for each device on the bus and the data sets required of each bus device. Only when this informa-
tion is clear should the system option parameters be set and the MODBUS system tested against the operat-
ing strategy.
3.2 Entering the Parameters
The NX6100/PPC6000 series controllers require configuration to match the MODBUS. Device address and
communications speed are configured by setting option parameters in the controller. These parameters must
be set for each and every NX6100/PPC6000 series controller on the MODBUS and are programmed when
the controller is in Commissioning mode.
The controllers may be configured in any order but it is important to keep a record of the values pro-
grammed into each controller.
3.3 General
If any settings in the control are to be changed, it is necessary to enter a commission mode. Three passcodes
are available for this purpose, shown as LV1 (Level 1), LV2 (Level 2), and LV3 (Level 3) in this manual
•Supplier passcode - LV3 - allows entry to all commissioning modes.
•Adjust ratio passcode - LV2 -- allows adjustment of some option parameters and entry to adjust
ratio mode.
•Site passcode - LV1 -- allows adjustment of some option parameters.

8

3.3.1.1 Entering commission ratio mode
To enter commission mode, press the key labeled COM and select the site passcode value using the
UP/DOWN keys. The site passcode has a factory default setting of 154. Enter this value as shown below.
* - NOTE: If the site passcode has been changed, you will have to enter that number.
3.3.1.2 Exiting from commission mode
To exit from any commission mode to run condition, press the key labeled RUN and then ENTER.
•Use the UP/DOWN keys to change the value of the option parameter. When the correct value is
selected then press the ENTER key to store the new value.
•Set or adjust all of the parameters as required by moving between the parameters and adjusting
as detailed above.
3.4 Option parameter list
Note: Option parameters are marked with LV1, LV2, and LV3, which indicate what level passcode is
required. If, when using the supplier passcode (LV3), it is not possible to adjust the value of an option
parameter, then the burner must be turned off to make the adjustment.
Option 00.1 - Site passcode (0 - 999) LV3
This is a three digit passcode that will allow the site engineer or end-user to enter option set mode and adjust
a limited range of option parameters (those not marked with 'LV2' or ' LV3' in this section). This passcode
can be zero, in which case the user only needs to press the COM / ENTER key twice to enter option set
mode with limited access. Factory default is 154.
CAUTION
• Use extreme care when entering option parameters. Incorrect data entry could
• It is possible that additional parameters may be present in the unit depending on
cause a hazardous situation to occur.
the application and/or supplier.

9

Option 00.2 - Serial communications control address (0 - 15) LV1
If the control is to be connected to other equipment via the serial communications interface, it must be given
a unique address using this option parameter. Additionally if more than one control unit is connected on the
CAN bus (for example to share a display), the units must all have unique addresses BEFORE THEY ARE
CONNECTED TO THE SAME CANbus. This passcode is used with Comfire or sequencing and is not
part of the MODBUS RTU setup.
Option 00.7 - MODBUS device address (1 - 99) LV3
Default value is 0= OFF
This option sets the MODBUS device address for the controller and must be unique for each device on the
bus.
Option 00.8 - MODBUS communications speed (0 - 3) LV3
Default value 0
This option sets the MODBUS communications speed in each controller as follows:
Option 00.8
value
Speed,
bits/s
09600
14800
29600
3 19200

10

4. MODBUS RTU Data Sets
4.1 Overview.
The NX6100/PPC6000 series controllers support the following MODBUS register types :
•Coils (1 to 19) - These registers can be written to by a MODBUS master to provide control of
NX6100/PPC6000 series controllers. In addition these registers can be read to interrogate the
last value written.
•Input registers (1 to 1200, 16 bit) - These can be read by a MODBUS master to monitor combus-
tion and other variables, from the NX6100/PPC6000 series controllers.
•Holding registers (1 to 1600, 16 bit) - These can be written to by a MODBUS master to change
modulation control of NX6100/PPC6000 series controllers. As with Coils, these registers can be
read to interrogate the last value written.
For daughterboard firmware levels 1.103 and greater, the MODBUS system can keep a maximum of
100 items (including read and written items) updated. Values will normally all refresh within one
second, but if more than 50 items are being updated, this will extend to two seconds.
Only the last 100 registers requested from the MODBUS master will be remembered by the
NX6100/PPC6000 controller. If more than 100 items are requested, the oldest items will cease to be
active. This means that if more than 100 different items have been accessed since a particular item
was read, this item may return zero the next time it is read, since the MODBUS system is no longer
tracking that item. It will then become active and will hold valid data on the next read. In practice
this is not an issue since there are nowhere near 100 items available from the NX6100/PPC6000
series controllers that will be of interest to plant operators etc. Most values that are available are
'engineers key' values that are provided for fault-finding and diagnostic purposes.
However, Coils and Holding registers are never 'dropped' from the item list in this way. So if the
burner is turned off via MODBUS (for example), then 100 or more different read items are requested
but the 'burner off' register is not updated, the burner will stay off.
The MODBUS 'read' functions listed in section 4.4 below allow multiple items to be read in one
MODBUS request. However the maximum size of MODBUS messages is limited to 128 bytes. The
maximum number of items that can be read in one message is 61, but it is recommended that signifi-
cantly fewer registers are read. Again, this many contiguous registers will not all contain useful data
anyway.
Note: Check daughterboard firmware level if Option 0.7 and 0.8 are correctly set and the
MODBUS message structure has been verified as correct.
All address references in the MODBUS messages use numbers relative to zero. For example, the first
holding register SETPOINT 1 CONTROL VALUE, would be 40001 and be referenced as register
0000. Similarly, coil 0008, BURNER ON/OFF, would be register 0007.

11

4.2 MODBUS system reset and timeout
It is possible to change operational parameters of the burner / boiler by writing to coils and holding
registers (see following sections). Once one of these registers is written to, it will become 'active' and
start to control the burner using the data written to it.
This register will remain 'active' controlling the burner forever unless there is no MODBUS commu-
nication to this slave for three minutes. So, if there are no MODBUS read requests or write requests
for three minutes, all control functions will be disabled and the FIREYE controller will operate in it's
default or local state.
As soon as communication resumes (even if just one register is read), the system will remember the
active control register setting from before and those values previously written will be asserted once
more.
Note : For daughterboard firmware levels less than 1.103, the timeout mechanism is slightly differ-
ent - each MODBUS item had it's own 3 minute timeout and there isn't a 'global' MODBUS timeout.
This means that all control registers have to be refreshed at least once every 3 minutes. Whilst this is
good practice, it is no longer required for daughterboard firmware 1.103 onwards.
From version 1.103, it is possible to 'reset' the MODBUS system completely by writing a value
of 1 to coil address 999. This will reset all coils and holding registers to the default (inactive) or
local state. This will allow the burner to run from its local values in the event that some registers are
holding it in an undesirable state. Note that there is a one minute timeout before the control 'forgets'
the effects of the coils / holding registers and runs using it's default values.
4.3 Coils (0XXX(X)) - WRITE TO registers (MODBUS Function Code 5)
There are 20 coil registers available in the NX6100/PPC6000 series controllers. Coils are similar to
switches in that they are set on or off. The MODBUS function code 15 (write multiple coils) is not
supported.
The MODbus function code 15 (write multiple coils) is not supported.
Once a coil is written to, this value will be current until either
- the coil register is written to again with a different value, or
- there is no MODBUS activity to or from this slave for three minutes (MODBUS time-out), or
- the power is removed from the controller, or
- the MODBUS system is reset (see 'MODBUS reset').
For daughterboard firmware levels 1.103 and greater, the coil values may also be read using MOD-
BUS function code 1. The value read back will be the last value that was written to that coil register.
This function needs to be used with care because reading from a coil register that is currently inac-
tive (i.e. never has been written to) will activate that coil with a default value of zero. So, if after a
power-up the burner is running and then coil address 7 is read (never having been written to before)
a value of zero will be returned and the burner will turn off. To turn the burner back on again, a value
of 1 must be written to this coil (or the MODBUS system reset / power cycled).
Note: Not all items are valid for all models within the NX6100/PPC6000 series.

12

Table 1:
4.4 Input Registers (3XXX(X)) - READ FROM (MODBUS function code 4)
There are many input registers available. The majority of these read current display or engineering
(test) values from the system, but a subset of the fault log is also available if the control firmware is
1.201 or higher and the daughterboard firmware is 1.103 or higher.
For display and engineering values, these are all 16 bit registers holding signed integer numbers.
When a number has decimal information, it is multiplied up to give an integer number.
For example:
173 ºC Flue Temperature will read as 173
3.2% oxygen will read as 32.
17.4º servo position will read as 174.
-12% trim will read as -12.
5.00 bar setpoint will read as 500.
Whilst the decimal precision is different for different items, it will not change for any particular item
during normal use.
Reg Address Function Details
0 Setpoint Select 0 = Run to setpoint 1
1 = Run to setpoint 2 (use for night setback etc.)
1 Release to Ignite If used, must be 1 to allow the burner to ignite.
2 Low Fire Hold 0= Normal modulation.
1= Low Fire Hold.
3 Lead boiler Select Choose this to be the lead boiler if boiler
sequencing is in operation.
4 Mute / Reset Due to differing approvals requirements, this
function may be disabled.
5 Oxygen Trim Enable 1 = Allow trim to be ON
6 Boiler Sequencing Enable 1 = Enable boiler sequencing (lead-lag). Must be
done for every unit.
7 Burner ON/OFF If the burner is firing / able to fire, it can be held
OFF by writing a zero to this register.
8 – 10 Reserved for future use.
11 Select Profile 1 1 = Force profile 1, 0 = Run with current profile.
12 Select Profile 2 1 = Force profile 2, 0 = Run with current profile.
13 Select Profile 3 1 = Force profile 3, 0 = Run with current profile.
14 Select Profile 4 1 = Force profile 4, 0 = Run with current profile.
15 – 998 Reserved for future use.
999 Reset MODBUS 1 = Reset all coils and holding registers to the
default (inactive) state. This will allow the burner to
run from its local values.

13

Each fault log item is an 8 byte structure stored in 4 consecutive 16 bit registers.
- Register 0 = (256 * fault number) + condition.
- Register 1 = (256 * year) + month
- Register 2 = (256 * day) + hour
- Register 3 = (256 * minute) + subset
Where :
- Condition = 0 for restart / reset, 1 = Cleared fault or limit (Cx), 2 = Fault (Fx) fault, 3 = Limit (Lx).
- Year is 00 to 99
- Month is 1 to 12
- Day is 1 to 31
- Hour = 0 to 23
- Minute is 0 to 59
- Subset is the fault subset information (0 to 255), if applicable.
Table 2:
Reg address Function Details
0 Drive 0 Position As on product display.
1 Drive 1 Position As on product display.
2 Drive 2 Position As on product display.
3 Drive 3 Position As on product display.
4 Drive 4 Position As on product display.
5 Drive 5 Position As on product display.
6 Drive 6 Position As on product display.
7 Drive 7 Position As on product display.
8 Drive 8 Position As on product display.
9 Drive 9 Position As on product display.
10 Spare Do not use
11 Spare Do not use
12 Measured Value As on product display.
13 Efficiency As on product display.
14 Inlet Temp As on product display.
15 O2 Level As on product display.
16 CO2 Level As on product display.
17 Spare
18 Hours Run As on product display.
19 Burner Status As on product display.
20 Trim As on product display.
21 Setpoint As on product display.
22 Flue Temp As on product display.
23 Fault Number As on product display.
24 Spare
25 Spare
26 Spare
27 Profile Number As on product display.
28 Do not use.
29 Do not use.
30 Modulation Rate As on product display.
31 Spare
32 Spare
33 Spare
34 Spare

14

Reg address Function Details
35 Gas Pressure As on product display.
36 Valve Prove Status As on product display.
37 Flame Signal As on product display.
38 2nd Flame Signal UV level if IR is used
39 to 49 Reserved for future use
1000 Engineers Key 0 Device specific data
1001 Engineers Key 1 Device specific data
1002 Engineers Key 2 Device specific data
1003 to 1199 Engineers Key 3 to 199 Device specific data
2000 to 2003 Fault log item 0 Most recently logged fault event
2004 to 2007 Fault log item 1 Next recently logged fault event
2008 to 2011 Fault log item 2 Next recently logged fault event
2012 to 2015 Fault log item 3 Next recently logged fault event
2016 to 2019 Fault log item 4 Next recently logged fault event
2020 to 2023 Fault log item 5 Next recently logged fault event
2024 to 2027 Fault log item 6 Next recently logged fault event
2028 to 2031 Fault log item 7 Next recently logged fault event
2032 to 2035 Fault log item 8 Next recently logged fault event
2036 to 2039 Fault log item 9 Next recently logged fault event
2040 to 2043 Fault log item 10 Next recently logged fault event
2044 to 2047 Fault log item 11 Next recently logged fault event
2048 to 2051 Fault log item 12 Next recently logged fault event
2052 to 2055 Fault log item 13 Next recently logged fault event
2056 to 2059 Fault log item 14 Next recently logged fault event
2060 to 2063 Fault log item 15 Next recently logged fault event
2064 to 2067 Fault log item 16 Next recently logged fault event
2068 to 2071 Fault log item 17 Next recently logged fault event
2072 to 2075 Fault log item 18 Next recently logged fault event
2076 to 2079 Fault log item 19 Next recently logged fault event
2080 to 2083 Fault log item 20 Next recently logged fault event
2084 to 2087 Fault log item 21 Next recently logged fault event
2088 to 2091 Fault log item 22 Next recently logged fault event
2092 to 2095 Fault log item 23 Oldest logged fault event

15

4.5 Holding Registers (4XXX(X)) - WRITE TO (MODBUS function code 6)
There are 20 holding (write to) registers available. These are 16 bit registers holding integer values.
Writing an out of range value (for example 1000) will disable the control item and the system will go
back to using its default value (immediately).
The MODBUS function code 16 (write multiple registers) is not supported.
Once a holding register is written to, this value will be current until either
- the holding register is written to again with a different value, or
- the holding register is written to again with an out of range value (>999), or
- there is no MODBUS activity to or from this slave for three minutes (MODBUS times out), or
- the power is removed from the controller, or
- the MODBUS system is reset (see 'MODBUS reset').
For daughterboard firmware levels 1.103 and greater, the holding register values may also be read
using MODBUS function code 3. The value read back will be the last value that was written to that
holding register. This function needs to be used with care because reading from a holding register that
is currently inactive (i.e. has never been written to) will activate that holding with a default value of
zero. So, for example, if after a power-up the burner is running with a default setpoint of 10.0 and then
holding register address 0 is read (never having been written to before) a value of zero will be returned
and the burners setpoint will become ZERO. To get the setpoint back to 10.0, a value of 100 (or >999)
must be written to this register (or the MODBUS system reset / power cycled).
Table 3:
Reg. Address Function Details
0 Setpoint 1 Control Value Strip decimal information – i.e. 999 = 99.9 = 9.99
1 Setpoint 2 Control Value Strip decimal information – i.e. 999 = 99.9 = 9.99
2 Setpoint 1 Low Control Limit Strip decimal information – i.e. 999 = 99.9 = 9.99
3 Setpoint 2 Low Control Limit Strip decimal information – i.e. 999 = 99.9 = 9.99
4 Setpoint 1 High Control Limit Strip decimal information – i.e. 999 = 99.9 = 9.99
5 Setpoint 2 High Control Limit Strip decimal information – i.e. 999 = 99.9 = 9.99
6 Modulation Rate 0 = low fire, 999 = high fire
7 – 15 Reserved for future use.

16

5. Modbus TCPIP Data Sets
5.1 Overview.
Only the register spaces for coils, input registers and holding registers are used by this system.
Modbus defines each of these spaces as having 65536 possible 16 bit registers. These registers
are numbered 1 to 65536 but are accessed in modbus messages by their addresses, which are
always one less - so the addresses range from 0 to 65535. To attempt to avoid confusion, this
document refers to both the number and address of each register.
Sometimes modbus register numbers are preceded by a number such as 0xxxx for coils, 4xxxx
for holding registers and 3xxxx for input registers. This notation is not part of the modbus
standard and is not used in this document as it fails to account for registers greater than 9999.
The modbus register map for modbus TCP is DIFFERENT to the register map used by 6000 series
products with modbus RTU via RS485.
The following Modbus register types are supported :
•Coils (0 or 1) - These registers can be written to by a Modbus TCP master to provide control of
certain ON/OFF functions such as turning the burner off, or selecting the night-setback setpoint.
In addition these registers can be read to interrogate the last value written to them.
•Input registers (32 bit floating point, sent as two consecutive registers, low word first) - These
can be read by a Modbus master to monitor combustion and other variables. Pairs of 16 bit mod-
bus registers are used to give 32 bit floating-point registers. The value 1.205 (IEE754 =
3F9A3D71) would be sent as two holding registers, the first one containing 3D71 and the sec-
ond one containing 3F9A.
Alternatively, the same data is available as 16 bit integers in the holding registers map, if required.
•Holding registers (16 bit integer) - Some of these registers provide access to the same read-only
values as the input registers described above. Others can be written to by a Modbus master to
change modulation control of the boiler. As with Coils, these registers can be read to interrogate
the last value written. Decimal values are transferred 'multiplied up' as required to maintain pre-
cision so, 1.234, 12.34, 123.4 and 1234 are all sent as 1234.
•Read Discrete Inputs (Modbus Function code 2) - NXTSD104 and NX6330 ONLY These regis-
ters provide the status of the digital inputs, relay outputs and a few other status flage. Addition-
ally, these registers can be used to read the status of the line voltage status inputs on the touch
screen itself, if present. Note that the NX6110 and NX6220 displays do not support the use of
these registers because it does not have the input hardware to which they relate.
The system will attempt to provide up-to-date data for all values read. However, values from the
'engineers key' lists can become out of date and if required should be requested frequently (or at least
twice in succession with two or three seconds between) to ensure up-to-date data is returned. The
expected scenario would be that the master would poll values once every 10 seconds or more fre-
quently.
Values from the 'display values' list will always be up-to-date no matter how infrequently they are
read.
Control functions initiated by writing to coils and holding registers are remembered permanently
while modbus TCP communications are active (values being read or written). If there is no modbus
TCP activity for one minute, the control functions will time-out and the system will revert to default
automatic operation. If subsequently modbus TCP communications resume, the control functions
previously set will resume also.
Note : NXTSD104 Displays prior to version 2.205 were subject to a one minute timeout per function
meaning each control function required frequent refresh to remain operative. This behaviour has now
been changed.

17

5.2 Coils (READ / WRITE) registers (Modbus Function Codes 1 & 5)
Sometimes these registers are referred to as registers 0xxxx registers although this notation is not
part of the modbus standard and is not used here.
There are 16 coil registers available for a single burner system. Coils are similar to switches in that
they are set on or off. The modbus function code 15 (write multiple coils) is NOT supported however
the coil values may also be read using modbus function code 1. The value read back will be the last
value that was written to that coil register. These registers must be used with care since they can pre-
vent the boiler from operating or meeting the site load.
If used, these registers must be written to at least as often as once a minute. After one minute, the
function will timeout and the control will revert to it's default mode of operation.
When an NXTSD104 touch screen is being used in a 'twin firing' configuration, these items
relate to the left-hand-side (LHS) burner. The list of functions for the right-hand-side (RHS)
burner can be found by adding 10000 to the register address. The NX6110 display does not
currently support twin firing configurations.
When the display is being used with a water-level control / expansion unit, modbus functions
relating to that unit can be accessed by adding 20000 to the register address. However, no coil
functions are currently supported by these units.
Note : Not all items are valid for all models within the Fireye 6000 series.

18

Table 4:
Register Register Function Details
number address
1 0 Setpoint 0 = Run to setpoint 1.
Select 1 = Run to setpoint 2 (use for night setback etc.).
This register MUST NOT be written to if the built-in boiler
2 1 Release to If used, must be 1 to allow the burner to ignite.
3 2 Low Fire 0= Normal modulation.
4 3 Lead boiler Choose this to be the lead boiler if boiler sequencing is in operation.
5 4 Mute / Due to differing approvals requirements, this function may be disabled.
Reset
This register will mute the alarms and reset the fault, allowing the
burner to restart. To do this, the register must be set to 1 for typically
5 seconds. Once the fault has been reset, or after 5 seconds, the
register should be cleared.
DO NOT ACTIVATE THIS REGISTER WHEN THERE ARE NO
ALARMS TO MUTE. If this is repeatedly done, an F36 fault will
6 5 Oxygen 1 = Allow trim to be
7 6 Boiler 1 = Enable boiler sequencing (lead-lag). Must be done for every unit.
Sequencing
8 7 Burner If the burner is firing / able to fire, it can be held OFF by writing a zero to
9 8 Fault Mute When set to 1, this register will mute fault alarms. Unlike register
Only number 5 (address 4), this register will not cause the burner to restart
if the fault has cleared, no matter how long it is left on for.
As with the other register, it should be set to 0 after use.
Compatibility
note :
This function requires controls with firmware versions 1.221 or
10 - 11 9 – 10
Reserv
12 11 Select 1 = Force profile 1, 0 = Run with current profile. Integrated controls
13 12 Select 1 = Force profile 2, 0 = Run with current profile. Integrated controls
14 13 Select 1 = Force profile 3, 0 = Run with current profile. Integrated controls
15 14 Select 1 = Force profile 4, 0 = Run with current profile. Integrated controls
16 15 Reserved
onwards onwards for future use

19

5.3 Input (READ ONLY) registers (Modbus function code 4)
Sometimes these registers are referred to as registers 3xxxx registers although this notation is not
part of the modbus standard and is not used here.
There are many input registers available, these read current display or engineering (test) values from
the system.
These values are sent as 32 bit IEE754 floating point values, sent as two consecutive registers - low
word first.
This example illustrates reading the burner control firmware version via EK56 (EK stands for engi-
neers key). From the table opposite, EK56 starts at register 314 (address 313). A modbus poll for
two registers 314 & 315 (addresses 313 & 314) yields :
Address 313 = 0x3D71
Address 314 = 0x3F9A.
The value 1.205 (IEE754 = 3F9A3D71) has been sent as two holding registers, the first one contain-
ing 3D71 and the second one containing 3F9A.
Alternatively, the same data is available as 16 bit integers in the holding registers map, if the modbus
master is easier configured to use standard modbus integer registers.
When the touch screen is being used in a 'twin firing' configuration, these items relate to the
left-hand-side (LHS) burner. The list of functions for the right-hand-side (RHS) burner can be
found by adding 10000 to the register number / address.
When the display is being used with a water-level control / expansion unit, modbus functions
relating to that unit can be accessed by adding 20000 to the register address. In this case, see
Table 6 on page 24 below
Table 5: .
Burner Controls
Register Register Function Details
Number address
1 0 Drive 0 Position As on product display.
3 2 Drive 1 Position As on product display.
5 4 Drive 2 Position As on product display.
7 6 Drive 3 Position As on product display.
9 8 Drive 4 Position As on product display.
11 10 Drive 5 Position As on product display.
13 12 Drive 6 Position As on product display.
15 14 Drive 7 Position As on product display.
17 16 Drive 8 Position As on product display.
19 18 Drive 9 Position As on product display.
21 20 Spare Do not use
23 22 Spare Do not use
25 24 Measured Value As on product display.
27 26 Efficiency As on product display.
29 28 Inlet Temp As on product display.
31 30 O2 Level As on product display.
33 32 CO2 Level As on product display.
35 34 Spare
37 36 Hours Run As on product display.
39 38 Burner Status As on product display.
41 40 Trim As on product display.
43 42 Setpoint As on product display.
45 44 Flue Temp As on product display.
47 46 Fault Number As on product display.
49 48 Spare
51 50 Spare
53 52 Spare

20

55 54 Profile Number As on product display.
57 56 Do not use.
59 58 Do not use.
61 60 Modulation Rate As on product display.
63 62 Spare
65 64 Spare
67 66 Spare
69 68 Spare
71 70 Gas Pressure As on product display.
73 72 Valve Prove Status As on product display.
75 74 Flame Signal As on product display.
77 76 2nd Flame Signal UV level if IR is used
79 – 198 78 - 197 Reserved for future use
199 198 Touchscreen firmware version The firmware version of the
touchscreen providing modbus TCP.
Reserved for future use
201 200 Engineers Key 0 See product manual ‘EK’ list
203 202 Engineers Key 1 See product manual ‘EK’ list
205 204 Engineers Key 2 See product manual ‘EK’ list
207 206 Engineers Key 3 See product manual ‘EK’ list
209 208 Engineers Key 4 See product manual ‘EK’ list
211 210 Engineers Key 5 See product manual ‘EK’ list
213 212 Engineers Key 6 See product manual ‘EK’ list
215 214 Engineers Key 7 See product manual ‘EK’ list
217 216 Engineers Key 8 See product manual ‘EK’ list
219 218 Engineers Key 9 See product manual ‘EK’ list
221 220 Engineers Key 10 See product manual ‘EK’ list
223 222 Engineers Key 11 See product manual ‘EK’ list
225 224 Engineers Key 12 See product manual ‘EK’ list
227 226 Engineers Key 13 See product manual ‘EK’ list
229 228 Engineers Key 14 See product manual ‘EK’ list
231 230 Engineers Key 15 See product manual ‘EK’ list
233 232 Engineers Key 16 See product manual ‘EK’ list
235 234 Engineers Key 17 See product manual ‘EK’ list
237 236 Engineers Key 18 See product manual ‘EK’ list
239 238 Engineers Key 19 See product manual ‘EK’ list
241 240 Engineers Key 20 See product manual ‘EK’ list
243 242 Engineers Key 21 See product manual ‘EK’ list
245 244 Engineers Key 22 See product manual ‘EK’ list
247 246 Engineers Key 23 See product manual ‘EK’ list
249 248 Engineers Key 24 See product manual ‘EK’ list
251 250 Engineers Key 25 See product manual ‘EK’ list
253 252 Engineers Key 26 See product manual ‘EK’ list
255 254 Engineers Key 27 See product manual ‘EK’ list
257 256 Engineers Key 28 See product manual ‘EK’ list
259 258 Engineers Key 29 See product manual ‘EK’ list
261 260 Engineers Key 30 See product manual ‘EK’ list
263 262 Engineers Key 31 See product manual ‘EK’ list
265 264 Engineers Key 32 See product manual ‘EK’ list
267 266 Engineers Key 33 See product manual ‘EK’ list
269 268 Engineers Key 34 See product manual ‘EK’ list
271 270 Engineers Key 35 See product manual ‘EK’ list
273 272 Engineers Key 36 See product manual ‘EK’ list
275 274 Engineers Key 37 See product manual ‘EK’ list
277 276 Engineers Key 38 See product manual ‘EK’ list
Burner Controls
Register Register Function Details
Number address