Easy Modbus- Home
- Modbus register maps
- AERCO
- C-More Boiler Controller (Benchmark / KC series)
Boiler / water heater controller · Modbus register map
AERCO C-More Boiler Controller (Benchmark / KC series) Modbus register map
Updated 16 October 2026
The C-More controller on AERCO Benchmark and KC Series units is a Modbus RTU slave on RS-485, normally driven by an AERCO BMS/ACS or a third-party EMS. A master can monitor temperatures, firing rate, flame strength, run hours and status messages, and can control the unit either by writing a network setpoint (Remote Setpoint mode) or a firing rate (Direct Drive mode). Temperatures are transferred as 0-1000 counts that must be converted with AERCO's equations.
This page lists 57 Modbus registers for the AERCO C-More Boiler Controller (Benchmark / KC series) — 34 writable — with the table, 0-based wire address, data type, word order, scale, units and access of each, re-typed from AERCO’s own free documentation (linked below) and checked against it.
- Manufacturer
- AERCO
- Model
- C-More Boiler Controller (Benchmark / KC series)
- Equipment type
- Boiler / water heater controller
- Registers
- 57 (34 writable)
- Transport
- Modbus RTU
- Default unit ID
- Not stated
- Default serial
- 9600 baud
- Documented addressing
- 0-based (the number printed is the address on the wire)
- 32-bit word order
- CDAB low word first (word-swapped)
- Firmware
- C-More software 2.00 or higher
- Also known as
- C-More, Benchmark, KC1000, KC Series, Benchmark boiler, Benchmark water heater
Integration notes: AERCO C-More Boiler Controller (Benchmark / KC series)
Give the C-More a Comm Address (1-127) in its Setup menu, set Boiler Mode to Remote Setpoint or Direct Drive and Remote Signal to Network, then write holding register 0 (setpoint counts) or 1 (fire rate %) at least every 10 seconds. Read input registers 1-16 for status, temperatures, fire rate and run hours.
Minimum registers to map
Addresses are 0-based wire addresses. Enough to monitor and run the unit; map more as the job needs.
| Register | Name | Type | Why | Access |
|---|---|---|---|---|
| HR 0 | Net Remote Set Point | UINT16 | Network setpoint (Remote Setpoint mode) | Read/write |
| HR 1 | Net Direct Drive | UINT16 | Network fire rate (Direct Drive mode) | Read/write |
| HR 12 | Boiler Mode | UINT16 | Boiler mode | Read/write |
| IR 1 | Unit Status | UINT16 | Unit status | Read |
| IR 2 | Outlet Temp | UINT16 | Outlet temperature | Read |
| IR 8 | Fire Rate Out | UINT16 | Fire rate out | Read |
| IR 15 | Flame Strength | UINT16 | Flame strength | Read |
| IR 0 | Default Message Display Code | UINT16 | Status / fault message code | Read |
Enable Modbus control & writes
Setup menu: Comm Address 1-127 (0, the default, disables Modbus). Configuration menu: Boiler Mode = Direct Drive or Remote Setpoint and Remote Signal = Network. Changing settings needs the right password level; register 2 holds the Modbus-port password and writes to protected registers fail with exception 02 until it matches.
Communication loss & watchdog
Fixed 10 s heartbeat: each received Net Direct Drive or Net Remote Setpoint write resets it. If it expires the controller shows MODBUS COMM FAULT and falls back to the Failsafe Mode in holding register 24 (Shutdown or Constant Setpoint).
Byte order & addressing
- Temperatures are 0-1000 counts that need AERCO's conversion equations; they are not tenths of a degree.
- Function code 16 (write multiple registers) is not supported and returns Illegal Function; write one register at a time with function 06.
- A multi-register read (FC03/FC04) that includes any register the current password level cannot access fails as a whole with Illegal Data Address.
- 32-bit counters are low word first.
Network setup
- RS-485 2-wire with shield, RTU only, fixed 9600 baud on the C-More; up to 127 slaves (32 when driven by a BMS/ACS).
- Terminate and bias only the last C-More on the bus: TERM, BIAS1 and BIAS2 DIP switches on the PMC board behind the front panel; that unit must stay powered for bias.
- Address 0 is broadcast; a broadcast Net Direct Drive or Net Remote Setpoint sets all enabled slaves at once.
Watch out for
- Do not write to registers marked Reserved.
- Front-panel, RS-232 and Modbus changes are not interlocked; the last write wins.
- AERCO recommends enabling Set Point Limiting and choosing the Failsafe Mode before handing control to Modbus.
AERCO C-More Boiler Controller (Benchmark / KC series) Modbus registers
Address = 0-based wire address (the documented number is shown under it when it differs) · Order: ABCD = high word first, CDAB = low word first · Scale: engineering value = raw × scale.
| Table | Address | Name | Description | Type | Order | Scale | Units | Access | Values / bits |
|---|---|---|---|---|---|---|---|---|---|
| IR | 0doc 0 (0x0000) | Default Message Display Code | Current display status/fault message (codes 1-64). | UINT16 | Read | 1 = DISABLED; 2 = STANDBY; 3 = DEMAND DELAY; 4 = PURGING; 5 = IGNITION TRIAL; 6 = FLAME PROVEN; 7 = WARMUP; 8 = HIGH WATER TEMP SWITCH OPEN; 9 = LOW WATER LEVEL; 10 = LOW GAS PRESSURE; 11 = HIGH GAS PRESSURE; 12 = INTERLOCK OPEN; 13 = DELAYED INTERLOCK OPEN; 14 = AIRFLOW FAULT DURING PURGE; 15 = SSOV FAULT DURING PURGE; 16 = PRG SWTCH OPEN DURING PURGE; 17 = IGN SWTCH OPEN DURING IGNITION; 18 = AIRFLOW FAULT DURING IGN; 19 = AIRFLOW FAULT DURING RUN; 20 = SSOV FAULT DURING IGN; 21 = SSOV FAULT DURING RUN; 22 = FLAME LOSS DURING IGN; 23 = FLAME LOSS DURING RUN; 24 = HIGH EXHAUST TEMPERATURE; 25 = LOSS OF POWER; 26 = LOSS OF SENSOR; 27 = LOSS OF SIGNAL; 28 = HIGH O2 LEVEL; 29 = LOW O2 LEVEL; 30 = HIGH CO LEVEL; 31 = SSOV RELAY FAILURE; 32 = RESIDUAL FLAME; 33 = HEAT DEMAND FAILURE; 34 = IGN SWTCH CLOSED DURING PURGE; 35 = PRG SWTCH CLOSED DURING IGNITION; 36 = SSOV SWITCH OPEN; 37 = IGNITION BOARD COMM FAULT; 38 = WAIT; 39 = DIRECT DRIVE SIGNAL FAULT; 40 = REMOTE SETPT SIGNAL FAULT; 41 = OUTDOOR TEMP SENSOR FAULT; 42 = OUTLET TEMP SENSOR FAULT; 43 = FFWD TEMP SENSOR FAULT; 44 = HIGH WATER TEMPERATURE; 45 = LINE VOLTAGE OUT OF PHASE; 46 = STEPPER MOTOR FAILURE; 47 = SETPT LIMITING ACTIVE; 48 = MODBUS COMM FAULT; 49 = WAIT IGNITION RETRY; 50 = WAIT FAULT PURGE; 51 = WAIT RETRY PAUSE; 52 = EXHAUST TEMP SENSOR SHORT; 53 = EXHAUST TEMP SENSOR OPEN; 54 = WARNING EXHAUST TEMP HIGH; 55 = EXHAUST TEMP HIGH; 56 = INLET WATER TEMP SENSOR SHORT; 57 = INLET WATER TEMP SENSOR OPEN; 58 = WARNING IN WATER TEMP HIGH; 59 = WARNING IN WATER TEMP LOW; 60 = INLET GAS PRESS SENSOR OPEN; 61 = GAS PLATE DP SENSOR OPEN; 62 = INLET WATER FLOW SENSOR OPEN; 63 = WARNING IN WTR FLOW LOW; 64 = INLET WATER HIGH FLOW | |||
| IR | 1doc 1 (0x0001) | Unit Status | UINT16 | Read | 0 = Disabled; 1 = Standby; 2 = Manual; 3 = Remote; 4 = Auto; 5 = Fault | ||||
| IR | 2doc 2 (0x0002) | Outlet Temp | Outlet temperature as DEGREES_1 counts (0-1000); °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read | |||
| IR | 3doc 3 (0x0003) | Inlet Temp | Inlet temperature, DEGREES_1 counts; °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read | |||
| IR | 4doc 4 (0x0004) | Aux Temp | Aux temperature, DEGREES_1 counts; °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read | |||
| IR | 5doc 5 (0x0005) | Outdoor Temp | Outdoor temperature, DEGREES_2 counts; °F = floor((counts×330+500)/1000)-80. | UINT16 | counts | Read | |||
| IR | 6doc 6 (0x0006) | Exhaust Temp | Printed as DEGREES_2 (exhaust log uses DEGREES_3); °F = floor((counts×330+500)/1000)-80. | UINT16 | counts | Read | |||
| IR | 7doc 7 (0x0007) | FFWD Temp | Feed-forward (header) temperature, DEGREES_1 counts; °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read | |||
| IR | 8doc 8 (0x0008) | Fire Rate Out | Firing rate output (0-100). | UINT16 | % | Read | |||
| IR | 9doc 9 (0x0009) | O2 Level | 0-25 %. | UINT16 | % | Read | |||
| IR | 10doc 10 (0x000A) | CO Level | 0-500 ppm. | UINT16 | ppm | Read | |||
| IR | 11doc 11 (0x000B) | Run Cycles | Low word at 11, high word (0-15) at 12; range 0-999,999. | UINT32 | CDAB | Read | |||
| IR | 13doc 13 (0x000D) | Run Hours | Low word at 13, high word (0-15) at 14; range 0-999,999. | UINT32 | CDAB | h | Read | ||
| IR | 15doc 15 (0x000F) | Flame Strength | UINT16 | % | Read | ||||
| IR | 16doc 16 (0x0010) | Active Set point | DEGREES_1 counts; °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read | |||
| IR | 17doc 17 (0x0011) | Fire Rate In | UINT16 | % | Read | ||||
| IR | 18doc 18 (0x0012) | Manual Fire Rate | Only meaningful in Manual mode from the front panel. | UINT16 | % | Read | |||
| IR | 19doc 19 (0x0013) | Comm Address | Modbus address 0-127; 0 (default) disables Modbus on the controller. | UINT16 | Read | ||||
| IR | 20doc 20 (0x0014) | Software Version | UINT16 | Read | |||||
| IR | 23doc 23 (0x0017) | Fault Log Code | Fault code of the selected fault-log entry. | UINT16 | Read | ||||
| IR | 24doc 24 (0x0018) | Fault Log Cycle | Cycle count of the selected fault-log entry (low word first). | UINT32 | CDAB | Read | |||
| IR | 26doc 26 (0x001A) | Fault Log Date | Date of the selected fault-log entry, 1 count per day. | UINT16 | days | Read | |||
| IR | 27doc 27 (0x001B) | Fault Log Time | Minutes since midnight (0-1439). | UINT16 | min | Read | |||
| HR | 0doc 0 (0x0000) | Net Remote Set Point | Remote Setpoint mode only; DEGREES_1 counts; °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read/write | |||
| HR | 1doc 1 (0x0001) | Net Direct Drive | Fire rate from the network; writable only in Direct Drive mode. | UINT16 | % | Read/write | |||
| HR | 2doc 2 (0x0002) | Modbus Password | Security password for the RS-485 Modbus port (default 0). | UINT16 | Read/write | ||||
| HR | 3doc 3 (0x0003) | Password | Security password for the RS-232 front-panel port (default 0). | UINT16 | Read/write | ||||
| HR | 4doc 4 (0x0004) | Internal Set Point | DEGREES_1 counts (default 130 °F); °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read/write | |||
| HR | 6doc 6 (0x0006) | Time | Controller clock, minutes since midnight (0-1439). | UINT16 | min | Read/write | |||
| HR | 7doc 7 (0x0007) | Date | Controller date, days since 1 Jan 2000. | UINT16 | days | Read/write | |||
| HR | 8doc 8 (0x0008) | Unit of Temp | Display unit (default °F). | UINT16 | Read/write | 0 = Degrees Fahrenheit; 1 = Degrees Celsius | |||
| HR | 9doc 9 (0x0009) | Baud Rate | RS-232 front-panel port only (default 9.6k). | UINT16 | Read/write | 0 = 2400; 1 = 4800; 2 = 9600; 3 = 19200 | |||
| HR | 10doc 10 (0x000A) | Unit Type | UINT16 | Read/write | 0 = Boiler; 1 = Water Heater | ||||
| HR | 11doc 11 (0x000B) | Unit Size | UINT16 | Read/write | 0 = 0.5 MBTU; 1 = 1 MBTU; 2 = 1.5 MBTU; 3 = 2 MBTU; 4 = 2.5 MBTU; 5 = 3 MBTU | ||||
| HR | 12doc 12 (0x000C) | Boiler Mode | Control mode (default Constant Setpt). | UINT16 | Read/write | 0 = Constant Setpt; 1 = Remote Setpt; 2 = Direct Drive; 3 = Combo Unit; 4 = Outdoor Reset | |||
| HR | 13doc 13 (0x000D) | Remote Signal | Source of the remote signal; Network = Modbus. | UINT16 | Read/write | 0 = 4-20 mA / 1-5 V; 1 = 0-20 mA / 0-5 V; 2 = PWM Input; 3 = Network | |||
| HR | 14doc 14 (0x000E) | Bldg Ref Temp | Outdoor-reset reference, DEGREES_1 counts; °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read/write | |||
| HR | 15doc 15 (0x000F) | Reset Ratio | Outdoor-reset ratio 0.1-9.9 (counts = ratio x 10; default 1.2). | UINT16 | × 0.1 | Read/write | |||
| HR | 16doc 16 (0x0010) | Outdoor Sensor Enable | UINT16 | Read/write | 0 = False; 1 = True | ||||
| HR | 17doc 17 (0x0011) | System Start Temp | DEGREES_2 counts (default 60 °F); °F = floor((counts×330+500)/1000)-80. | UINT16 | counts | Read/write | |||
| HR | 18doc 18 (0x0012) | Set Point Lo Limit | DEGREES_1 counts (default 60 °F); °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read/write | |||
| HR | 19doc 19 (0x0013) | Set Point Hi Limit | DEGREES_1 counts (default 200 °F); °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read/write | |||
| HR | 20doc 20 (0x0014) | Temp Hi Limit | Outlet limit, DEGREES_1 counts (default 210 °F); °F = floor((counts×230+500)/1000)+20. | UINT16 | counts | Read/write | |||
| HR | 21doc 21 (0x0015) | Max Fire Rate | 40-100 % (default 100). | UINT16 | % | Read/write | |||
| HR | 22doc 22 (0x0016) | Pump Delay Timer | 0-30 min. | UINT16 | min | Read/write | |||
| HR | 23doc 23 (0x0017) | Aux Start On Delay | 0-120 s. | UINT16 | s | Read/write | |||
| HR | 24doc 24 (0x0018) | Failsafe Mode | Action on loss of the remote/Modbus signal. | UINT16 | Read/write | 0 = Shutdown; 1 = Constant Setpoint | |||
| HR | 25doc 25 (0x0019) | Low Fire Timer | 2-60 s (default 2). | UINT16 | s | Read/write | |||
| HR | 26doc 26 (0x001A) | Prop Band | Proportional band, ABS_DEG_1 counts (a temperature difference); see notes for conversion. | INT16 | counts | Read/write | |||
| HR | 27doc 27 (0x001B) | Integral Gain | 0.00-2.00. | UINT16 | × 0.01 | Read/write | |||
| HR | 28doc 28 (0x001C) | Derivative Time | 0.00-2.00 min. | UINT16 | × 0.01 | min | Read/write | ||
| HR | 29doc 29 (0x001D) | Min Load Adjust | Water heater only; ABS_DEG_1 counts (temperature difference); see notes for conversion. | INT16 | counts | Read/write | |||
| HR | 30doc 30 (0x001E) | Max Load Adjust | Water heater only; ABS_DEG_1 counts (temperature difference); see notes for conversion. | INT16 | counts | Read/write | |||
| HR | 31doc 31 (0x001F) | Outlet Feedback | Water heater only (default On). | UINT16 | Read/write | 0 = Off; 1 = On | |||
| HR | 60doc 60 (0x003C) | Set Point Limiting | UINT16 | Read/write | 0 = Disabled; 1 = Enabled | ||||
| HR | 61doc 61 (0x003D) | Set Point Limit Band | ABS_DEG_1 counts (temperature difference); see notes for conversion. | INT16 | counts | Read/write | |||
| HR | 67doc 67 (0x0043) | Sensor Log Interval | UINT16 | Read/write | 0 = Off; 1 = 1 min; 2 = 5 min; 3 = 15 min; 4 = 30 min; 5 = 1 h; 6 = 6 h; 7 = 12 h; 8 = 24 h |
Notes on this map
- Temperature registers are raw counts (0-1000), not degrees, and are listed with scale 1 and units 'counts'. AERCO Table A-3 converts them with integer (floor) brackets: DEGREES_1 °F = floor((counts x 230 + 500) / 1000) + 20; DEGREES_2 °F = floor((counts x 330 + 500) / 1000) - 80; DEGREES_3 °F = floor((counts x 520 + 500) / 1000) + 40 (Celsius versions: x128 - 7, x183 - 62, x289 - 4). Because the result is rounded to whole degrees the conversion is a step function, not an exact scale/offset, so it is not encoded as one. Table A-4 gives the reverse (degrees to counts) for writes, e.g. DEGREES_1 counts = floor(((°F - 20) x 1000 + 115) / 230).
- ABS_DEG_1 registers (prop band, min/max load adjust, setpoint limit band) are temperature differences in counts (published range 0-1000): °F = floor((counts x 230 + 500) / 1000) for counts >= 0 and floor((counts x 230 - 500) / 1000) for counts < 0. They are typed INT16 because the manual gives a negative-count formula; within the published range INT16 and UINT16 read the same.
- Exhaust Temp (input 6) is printed as DEGREES_2 while Sensor Log Exhaust Temp (input 32, not listed) is DEGREES_3; check the conversion on site.
- 32-bit counters (run cycles, run hours, fault-log cycle) are stored low word first (low word at the lower address), hence CDAB. The high word only ranges 0-15.
- The Unit Status / message code list is Table A-2 in the manual even though the register table points to Table A-1.
- Left out: reserved registers, the sensor-log and time-log history registers (28-43), the log pointers (68-70) and all BMS/BMS II/ACS registers (a separate controller covered in the same manual).
Check it against the live device. A register map tells you what the controller can expose; the unit in front of you may differ by firmware or options. Read a few registers and compare them with the unit’s own display; for a 32-bit value the float and byte-order decoder shows all four word orders at once, so a wrong word order or scale is obvious. New to this? Read what a register map is and why addresses are off by one.
Questions about the AERCO C-More Boiler Controller (Benchmark / KC series)
What Modbus registers does the AERCO C-More Boiler Controller (Benchmark / KC series) have?
This map lists 57 registers: 23 input registers, 34 holding registers. 34 of them can be written. Registers vary with firmware, options and configuration, so confirm against the device.
Are the AERCO C-More Boiler Controller (Benchmark / KC series) Modbus addresses 0-based or 1-based?
The manufacturer's document numbers registers 0-based (the number printed is the address on the wire). Every address on this page is the 0-based wire address you put in the request; the documented number is shown under it where it differs. The manual lists generic Modbus data addresses in decimal and hex (e.g. Outlet Temp 2 (0x0002)) and states that BAS tools using 30001/40001 notation add 30001/40001 to them. The listed number is the wire address.
What byte order does the AERCO C-More Boiler Controller (Benchmark / KC series) use for 32-bit values?
Multi-register values in this map use CDAB (low word first (word-swapped)). Set your client to this order for every 32/64-bit value in the table.
What are the minimum Modbus registers to integrate the AERCO C-More Boiler Controller (Benchmark / KC series)?
Start with HR 0 Net Remote Set Point (Network setpoint (Remote Setpoint mode)); HR 1 Net Direct Drive (Network fire rate (Direct Drive mode)); HR 12 Boiler Mode (Boiler mode); IR 1 Unit Status (Unit status); IR 2 Outlet Temp (Outlet temperature); IR 8 Fire Rate Out (Fire rate out); IR 15 Flame Strength (Flame strength); IR 0 Default Message Display Code (Status / fault message code).
How do I enable Modbus control of the AERCO C-More Boiler Controller (Benchmark / KC series)?
Setup menu: Comm Address 1-127 (0, the default, disables Modbus). Configuration menu: Boiler Mode = Direct Drive or Remote Setpoint and Remote Signal = Network. Changing settings needs the right password level; register 2 holds the Modbus-port password and writes to protected registers fail with exception 02 until it matches.
What happens when the AERCO C-More Boiler Controller (Benchmark / KC series) loses Modbus communication?
Fixed 10 s heartbeat: each received Net Direct Drive or Net Remote Setpoint write resets it. If it expires the controller shows MODBUS COMM FAULT and falls back to the Failsafe Mode in holding register 24 (Shutdown or Constant Setpoint).
Where is the official AERCO C-More Boiler Controller (Benchmark / KC series) Modbus documentation?
The source is Modbus Communications User Manual - C-More Controller, Boiler Management System (BMS/BMS II), AERCO Control System (ACS) (OMM-0035_D / GF-114), revision 2026-04-07, published free by AERCO at https://www.aerco.com/dfsmedia/0533dbba17714b1ab581ab07a4cbb521/58215-source/639112726810000000/omm-0035-0b-gf-114-modbus-communications-manual-05-18-12-0.pdf.
Source: Modbus Communications User Manual - C-More Controller, Boiler Management System (BMS/BMS II), AERCO Control System (ACS) · OMM-0035_D / GF-114 · rev. 2026-04-07. Register numbers, types, scaling and units are reproduced as published; descriptions are our own.