Specifications

MODBUS COMMUNICATION MANUAL
3-3
3.2.6 Broadcast Commands
Address 0 is reserved for Broadcast Messages sent by the Modbus Master. At the current time,
only two holding register variables can be written by broadcast to the C-More Controller Slaves.
These variables are Net Remote Setpoint and Net Direct Drive (addresses 0x0000, 0x0001).
No password is required to write either of these variables. Broadcast write commands to all
other holding registers will be ignored. Therefore, write commands to all other holding registers
must be individually transmitted to a valid Network Slave address. Valid Slave device
addresses must be within the range of 1 to 127.
3.2.7 Physical Slave Address Zero
Normally, each Modbus Network Slave Controller will be assigned its own unique Comm.
Address (Input Register Address 0x0013). Valid entries are from 1 to 127. However, if the
default address of 0 is assigned, the C-More Slave, will not respond or process any Modbus
Network messages. This effectively disables the Slave’s Modbus communication link.
3.3 BMS STANDARD APPLICATION OPERATIONS
For an AERCO BMS Controller, the first eight Boilers are reserved for Legacy Boilers. These
Legacy Boilers are wired to the J2 connector terminals and are controlled utilizing Pulse Width
Modulation (PWM) signals, just as with earlier BMS Models, prior to implementation of Modbus.
Therefore, Boiler No. 9 will be the first Modbus Network Boiler, Boiler No. 10 will be the second
and so on. Up to 32 Network Boilers can be connected on a Modbus Network, in addition to the
8 Legacy Boilers. The BMS will operate the Network Boilers and the Legacy Boilers as one
complete System.
3.3.1 Password Protection for BMS Input and Holding Register Access
Access to BMS register addresses are protected by a password in virtually the same manner as
the C-More Controllers. For the BMS, a communications security code holding register
“Password Lo” and “Password Hi” (addresses 0x007E, 0x007F) must be written with the proper
password for writing data in the BMS through the RS232 communications port. If an attempt is
made to write data to a single holding register using an incorrect password, write access is
denied. If this occurs, an Illegal Data Address Exception Code (02) is generated and the data is
not changed. Reading data is allowed, even if the password is incorrect. If a Modbus message
is received to read multiple Input or Holding Registers and one or more of the addresses is not
accessible, an Illegal Data Address Exception Code will be sent to the EMS Master and no data
is affected.
Only the network control variable “Net Header Set Temp” (address 0x0004) can be written
without a password and only
if the BMS is programmed for Remote Setpoint Control by an EMS
Master.
3.3.2 Remote Setpoint Control of BMS Slave By EMS Master
All Modbus communication between a BMS Slave and an EMS Master is accomplished via the
RS232 port on the BMS. If the EMS Master also contains a RS232 port, it can be directly
connected to the BMS. However, if the EMS Master contains a RS485 port, a RS232-to-RS485
Converter is required.