Easy Modbus- Home
- Modbus register maps
- Lochinvar
- Crest / Crest with Hellcat boilers (ModBus communication board)
Boiler · Modbus register map
Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board) Modbus register map
Updated 16 October 2026
Lochinvar's Crest condensing boilers expose Modbus RTU through the RS-485 communication board. A BAS writes a configuration word plus enable, rate/setpoint and remote temperature values; read-only data covers outlet/inlet/flue temperatures, firing rate, pump speeds, cascade power, status/blocking/lockout codes and lockout codes for up to eight cascade units. Some discrete inputs exist only on FB/OF1501-6001 or on FCB1000-6000.
This page lists 62 Modbus registers for the Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board) — 9 writable — with the table, 0-based wire address, data type, word order, scale, units and access of each, re-typed from Lochinvar’s own free documentation (linked below) and checked against it.
- Manufacturer
- Lochinvar
- Model
- Crest / Crest with Hellcat boilers (ModBus communication board)
- Equipment type
- Boiler
- Registers
- 62 (9 writable)
- Transport
- Modbus RTU
- Default unit ID
- Not stated
- Documented addressing
- Modicon 3xxxx/4xxxx (drop the prefix, subtract 1)
- Also known as
- Crest, Crest FB751-6001, Crest OF751-6001, Crest FCB1000-6000, Hellcat, MTR-01
Integration notes: Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board)
Set address, baud and parity on the board DIP switches, set the Demand Configuration in MAIN MENU > SETUP > BMS, then write 40001 (configuration) followed by the commands, using the exact values from the manual for the chosen configuration: enable only is 40001 = 0x0001 with 40002 = 0x0001; enable + BMS is 40001 = 0x0005 with 40002 = 0x0010 and the rate/setpoint in 40003. Monitor 30009-30016.
Minimum registers to map
Addresses are 0-based wire addresses. Enough to monitor and run the unit; map more as the job needs.
| Register | Name | Type | Why | Access |
|---|---|---|---|---|
| HR 0 | Configuration | BITMAP16 | Configuration bits | Read/write |
| CO 0 | Boiler Enable | BIT | Boiler enable | Read/write |
| HR 2 | 0-10 Volt Input / Rate Command / Setpoint Command | UINT16 | Rate (%) or setpoint command | Read/write |
| IR 8 | Outlet Temperature | UINT16 | Outlet temperature | Read |
| IR 11 | Firing Rate | UINT16 | Firing rate | Read |
| IR 13 | Boiler Status Code | UINT16 | Status code | Read |
| IR 14 | Boiler Blocking Code | UINT16 | Blocking code | Read |
| IR 15 | Boiler Lockout Code | UINT16 | Lockout code | Read |
Enable Modbus control & writes
Choose the Demand Configuration (enable only, enable + BMS rate/setpoint, or BMS only) in MAIN MENU > SETUP > BMS; set the BMS type to rate or setpoint for 40003. Re-send 40001 before issuing commands.
Communication loss & watchdog
Crest: BAS timeout adjustable 5-120 s in MAIN MENU > SETUP > BAS; BAS-supplied temperatures must be refreshed within it or the boiler reverts to its own sensors. Other commands must be refreshed at least every 4 minutes. Hellcat: timeout fixed at 300 s.
Byte order & addressing
- Modicon addressing: 30009 is input register 8 on the wire.
- Temperatures are degrees C x 10.
- A setpoint command through 40003 is the 0-10 V equivalent percentage, interpolated from the BMS low/high setpoint parameters, not degrees.
- Only read the lockout code when the status code is 40.
Network setup
- DIP switches 1-7: Modbus address (1-127).
- DIP switch 8: OFF = Celsius, ON = Fahrenheit.
- DIP switch 9: OFF = 9600 baud, ON = 19200 baud.
- DIP switch 10: OFF = no parity with 2 stop bits, ON = even parity with 1 stop bit.
- RTU only; terminate both ends of the RS-485 bus.
Watch out for
- Some discrete inputs are footnoted as FB/OF1501-6001 only or FCB1000-6000 only; do not expect them on other sizes.
- Board LED D7: 1.5 s on / 0.5 s off = no Modbus traffic; 0.5 s on / 1.5 s off = no burner-control communication.
Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board) Modbus registers
Address = 0-based wire address (the documented number is shown under it when it differs) · Order: ABCD = high word first, CDAB = low word first · Scale: engineering value = raw × scale.
| Table | Address | Name | Description | Type | Order | Scale | Units | Access | Values / bits |
|---|---|---|---|---|---|---|---|---|---|
| CO | 0doc 00001 | Boiler Enable | Enable command written by the BAS. | BIT | Read/write | 0 = Off; 1 = On | |||
| CO | 4doc 00005 | Tank Thermostat | DHW tank thermostat demand written by the BAS. | BIT | Read/write | 0 = Off; 1 = On | |||
| DI | 0doc 10001 | Manual Reset High Limit | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 1doc 10002 | Flow Switch | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 2doc 10003 | Gas Pressure Switch | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 3doc 10004 | Louver Proving Switch | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 4doc 10005 | Blower Proving Switch 1 | Crest FB/OF 1501-6001 only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 5doc 10006 | Blocked Drain Switch | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 7doc 10008 | Flame 1 | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 8doc 10009 | Enable | Crest FB/OF 1501-6001 only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 9doc 10010 | Tank Thermostat | Crest FB/OF 1501-6001 only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 10doc 10011 | Blocked Flue | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 17doc 10018 | Internal LWCO | Crest FCB1000-6000 only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 18doc 10019 | Gas Pressure Switch 2 | Crest FCB1000-6000 only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 20doc 10021 | Flue Damper Proving Switch | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 22doc 10023 | Flame 2 | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 25doc 10026 | Enable | Crest FCB1000-6000 only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 29doc 10030 | Tank Thermostat | Crest FCB1000-6000 only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 32doc 10033 | Run-time Contacts | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 33doc 10034 | Alarm Contacts | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 34doc 10035 | SH Pump | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 35doc 10036 | HWG Pump | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 36doc 10037 | Louver Relay | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 37doc 10038 | Gas Valve 1 | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 38doc 10039 | System Pump | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 43doc 10044 | Vent Damper Relay | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 45doc 10046 | Gas Valve 2 | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 48doc 10049 | Blower #1 Power | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 49doc 10050 | Blower #2 Power | Older dual-fan models only. | BIT | Read | 0 = Off; 1 = On | |||
| DI | 50doc 10051 | Spark Igniter | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 51doc 10052 | Air Valve Trigger | BIT | Read | 0 = Off; 1 = On | ||||
| DI | 52doc 10053 | Air Valve Proving | BIT | Read | 0 = Off; 1 = On | ||||
| IR | 0doc 30001 | Discrete Inputs 1-16 | Packed copy of discrete inputs 1-16. | UINT16 | Read | ||||
| IR | 1doc 30002 | Discrete Inputs 17-32 | Packed copy of discrete inputs 17-32. | UINT16 | Read | ||||
| IR | 2doc 30003 | Discrete Inputs 33-48 | Packed copy of discrete inputs 33-48. | UINT16 | Read | ||||
| IR | 4doc 30005 | System Pump Speed In | UINT16 | % | Read | ||||
| IR | 5doc 30006 | Cascade Total Power | Total cascade capacity (100-800 %). | UINT16 | % | Read | |||
| IR | 6doc 30007 | Cascade Current Power | Current cascade output (0-800 %). | UINT16 | % | Read | |||
| IR | 8doc 30009 | Outlet Temperature | Raw is degrees C x 10 (manual example: 683 = 68.3 C). | UINT16 | × 0.1 | °C | Read | ||
| IR | 9doc 30010 | Inlet Temperature | INT16 | × 0.1 | °C | Read | |||
| IR | 10doc 30011 | Flue Temperature | INT16 | × 0.1 | °C | Read | |||
| IR | 11doc 30012 | Firing Rate | UINT16 | % | Read | ||||
| IR | 12doc 30013 | Boiler Pump Speed Out | UINT16 | % | Read | ||||
| IR | 13doc 30014 | Boiler Status Code | What the boiler is doing; 40 = lockout. | UINT16 | Read | 2 = Heat demand blocked: high absolute outlet temperature; 3 = Heat demand blocked: high absolute flue temperature; 4 = Heat demand blocked: high absolute delta T; 7 = Heat demand blocked: changed personality plug; 8 = Heat demand blocked: low 24 VAC; 9 = Outdoor shutdown; 10 = Blocked: boiler switched off at display; 11 = No heat demand requested; 12 = Blocked: line frequency; 16 = Service function; 19 = DHW function storage tank; 21 = SH heat demand from room thermostat; 22 = SH heat demand from BMS; 23 = SH heat demand from cascade; 30 = Heat demand from freeze protection; 32 = DHW pump delay; 33 = SH pump delay; 34 = No heat function (after pump delay); 40 = Lockout | |||
| IR | 14doc 30015 | Boiler Blocking Code | Reason heat demand is blocked. | UINT16 | Read | 0 = No blocking; 5 = Low 24 VAC supply; 6 = MRHL open; 7 = High outdoor temperature; 8 = Boiler switched off (display); 10 = High delta T; 11 = High outlet water temperature; 12 = Anti-cycling time; 13 = Changed ID plug; 14 = Line frequency; 15 = High flue temperature | |||
| IR | 15doc 30016 | Boiler Lockout Code | Lockout reason; only valid while status code is 40. See manual for the code list. | UINT16 | Read | ||||
| IR | 25doc 30026 | Discrete Inputs 49-64 | Packed copy of discrete inputs 49-64. | UINT16 | Read | ||||
| IR | 26doc 30027 | Lock-out Error Leader | Lockout code of the cascade leader. | UINT16 | Read | ||||
| IR | 27doc 30028 | Lock-out Error Member 1 | UINT16 | Read | |||||
| IR | 28doc 30029 | Lock-out Error Member 2 | UINT16 | Read | |||||
| IR | 29doc 30030 | Lock-out Error Member 3 | UINT16 | Read | |||||
| IR | 30doc 30031 | Lock-out Error Member 4 | UINT16 | Read | |||||
| IR | 31doc 30032 | Lock-out Error Member 5 | UINT16 | Read | |||||
| IR | 32doc 30033 | Lock-out Error Member 6 | UINT16 | Read | |||||
| IR | 33doc 30034 | Lock-out Error Member 7 | UINT16 | Read | |||||
| HR | 0doc 40001 | Configuration | Selects which values the BAS supplies instead of the boiler's own inputs. | BITMAP16 | Read/write | bit 0 = Boiler Enable from BAS; bit 1 = Tank Thermostat from BAS; bit 2 = Rate Command / 0-10V Input / Setpoint Command from BAS; bit 3 = Tank Setpoint from BAS; bit 4 = System Supply Temperature from BAS; bit 5 = Outdoor Temperature from BAS; bit 6 = Tank Temperature from BAS; bit 7 = System Return Temperature from BAS | |||
| HR | 1doc 40002 | Coils | Command word written by the BAS; the manual's example values disagree, see notes. | UINT16 | Read/write | ||||
| HR | 2doc 40003 | 0-10 Volt Input / Rate Command / Setpoint Command | Modulation % or setpoint, per the BMS Type setting (0-100). | UINT16 | % | Read/write | |||
| HR | 4doc 40005 | Tank Temperature | Tank temperature supplied by the BAS. | INT16 | × 0.1 | °C | Read/write | ||
| HR | 5doc 40006 | Outdoor Temperature | Outdoor temperature supplied by the BAS (-40 to 60 C). | INT16 | × 0.1 | °C | Read/write | ||
| HR | 6doc 40007 | System Supply Temperature | System supply temperature supplied by the BAS. | INT16 | × 0.1 | °C | Read/write | ||
| HR | 7doc 40008 | System Return Temperature | System return temperature supplied by the BAS. | INT16 | × 0.1 | °C | Read/write |
Notes on this map
- Temperatures: the manual's conversion section says the appliance passes temperatures in degrees C multiplied by 10 (worked examples: outdoor 26.7 C sent as 267; outlet 683 read as 68.3 C). Scale 0.1 is applied to every temperature register.
- Removed: System/Cascade Setpoint (30004), Outlet Setpoint (30008) and Tank Setpoint (40004). The memory map gives these a 0.5 C resolution while the conversion section says all temperature data is degrees C x 10, and the worked examples only cover other registers (outdoor temperature and outlet temperature). Because the scaling of these three is not settled by the document, they are left out.
- Signed types: registers whose published minimum is negative (inlet, flue, tank, outdoor, supply/return temperatures) are listed as INT16; the manual itself only says '16-bit word'.
- Dip switch 8 on the communication board selects degrees C (OFF) or F (ON) for the display/data; units here assume C (switch OFF), matching the manual's tables and conversion examples.
- Holding register 40002 'Coils' has no bit list: for the Crest, the enable-only table writes 0x0001 to enable the unit, the enable + BMS table writes 0x0010 for the same purpose, and the DHW table writes 0x0010 for the tank thermostat. Prefer the Boiler Enable coil (00001) and confirm on site.
- Input registers 30001-30003 are packed copies of the discrete inputs; the bit-to-input order is not stated, so they are listed as UINT16. Use the discrete inputs instead.
- Left out: FCB1000-6000 combustion registers 30019-30025 and 30036-30038 (air/gas damper angle, fan speed target, O2 status, trim factor, barometer, flame, O2 reading) because the manual gives no units or scaling for them.
- The full Crest lockout-code list (input register 30016) is long; see pp. 43 onward in the manual.
- The Regent water heater map in the same manual uses different input-register numbers and is not included.
Check it against the live device. A register map tells you what the controller can expose; the unit in front of you may differ by firmware or options. Read a few registers and compare them with the unit’s own display; for a 32-bit value the float and byte-order decoder shows all four word orders at once, so a wrong word order or scale is obvious. New to this? Read what a register map is and why addresses are off by one.
Questions about the Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board)
What Modbus registers does the Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board) have?
This map lists 62 registers: 2 coils, 30 discrete inputs, 23 input registers, 7 holding registers. 9 of them can be written. Registers vary with firmware, options and configuration, so confirm against the device.
Are the Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board) Modbus addresses 0-based or 1-based?
The manufacturer's document numbers registers Modicon 3xxxx/4xxxx (drop the prefix, subtract 1). Every address on this page is the 0-based wire address you put in the request; the documented number is shown under it where it differs. Addresses are printed Modicon-style (00001, 10001, 30001, 40001). Subtract the table base and 1 for the wire address; the manual's exception-code text confirms PDU addresses start at 0.
What are the minimum Modbus registers to integrate the Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board)?
Start with HR 0 Configuration (Configuration bits); CO 0 Boiler Enable (Boiler enable); HR 2 0-10 Volt Input / Rate Command / Setpoint Command (Rate (%) or setpoint command); IR 8 Outlet Temperature (Outlet temperature); IR 11 Firing Rate (Firing rate); IR 13 Boiler Status Code (Status code); IR 14 Boiler Blocking Code (Blocking code); IR 15 Boiler Lockout Code (Lockout code).
How do I enable Modbus control of the Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board)?
Choose the Demand Configuration (enable only, enable + BMS rate/setpoint, or BMS only) in MAIN MENU > SETUP > BMS; set the BMS type to rate or setpoint for 40003. Re-send 40001 before issuing commands.
What happens when the Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board) loses Modbus communication?
Crest: BAS timeout adjustable 5-120 s in MAIN MENU > SETUP > BAS; BAS-supplied temperatures must be refreshed within it or the boiler reverts to its own sensors. Other commands must be refreshed at least every 4 minutes. Hellcat: timeout fixed at 300 s.
Where is the official Lochinvar Crest / Crest with Hellcat boilers (ModBus communication board) Modbus documentation?
The source is ModBus and BACnet Communication Instructions for Crest FB/OF751-6001, FCB1000-6000 and Regent IWH500-1000 (100161012_2000020084 Rev X), published free by Lochinvar at https://assets.lochinvar.com/damroot/Original/10017/MODB_100161012_2000020084_REV%20X_(71343).pdf.
More Lochinvar Modbus register maps
Source: ModBus and BACnet Communication Instructions for Crest FB/OF751-6001, FCB1000-6000 and Regent IWH500-1000 · 100161012_2000020084 Rev X. Register numbers, types, scaling and units are reproduced as published; descriptions are our own.