FenwalNET 8000-ML

Direct Modbus RTU

Output
Technical Guide

P/N 06-237222-001
June 2012

FenwalNET 8000-ML

Direct Modbus RTU Output

1. Overview
This document defines the Modbus RTU protocol that will be supported on the RS232 serial ports of the
FenwalNET 8000-ML control unit. This document describes the registers available for retrieving control unit status.

2. Modbus
2.1

Configuration

The RS232 communication parameters shall be 38400, N, 8 and 1 when a control unit RS232 port is configured for
Modbus RTU. The modbus slave ID shall be assigned in the FenwalNET 8000-ML configuration and can be 1
through 254.
Modbus can be enabled on the control unit using the keypad menu or the PC Configuration software program. See
the appropriate manual for how to set the configuration. It is necessary to select an RS232 port and assign the
Modbus ID. It is possible to enable Modbus on both RS232 ports simultaneously. This may be necessary for a
particular application such as redundant communications or a BACnet application.

2.2

Exception Responses

The following conditions will result in an exception response from the panel to the Modbus Client:
If the modbus client attempts to perform a function other than 3 or 17 the returned response will be
exception code 1 (function code not supported).
If the modbus client attempts to read either 0 or greater than 125 16-bit register values the control panel
will return exception code 3 (bad quantity of registers requested).
If the modbus client attempts to read addresses other than those described herein, the control panel will
return exception code 3.

2.3

Register Space

The following section describes the register address space. Registers are within the Modbus Holding Registers (03).
Extended Modbus is used to support networked systems up to 28 nodes (see section 6.8 below). The bit order is as
defined below for all registers.
B1

B2

B3

B4

B5

B6

B7

B8

B9

B10

B11

B12

B13

B14

B15

B16

The FenwalNET 8000-ML system can be a network of 64 control units each with up to 8 SLC loops each supporting
up to 255 devices and one IIM supporting 127 detectors.
The FenwalNET 8000-ML Modbus RTU supports all points on a 28 node network as shown in the following
sections.
The following sections also describe how to support a full 64 node network with 3 modbus clients connected to 3
control units within the network.

Page 1

FenwalNET 8000-ML

2.4

Direct Modbus RTU Output

Address 0001

Control Unit Status Register:

Bits
<1:6>
<7>
<8>
<9>

Name
Clock Minutes
Reserved
Initialized
Supervisory

<10>

Trouble

<11>

Pre-Alarm

<12>

Alarm

<13>
<14>
<15>

IIM OnLine
Silence
Battery
Replacement
Night Mode

<16>

Description
Value represents the clocks minute count
Value is unpredictable, reserved for future use.
1if the SLC has been initialized, otherwise 0.
1 if the SUPERVISORY LED is illuminated on the front panel
of the display card, otherwise 0.
1 if the TROUBLE LED is illuminated on the front panel of
the display card, otherwise 0. Troubles include Open and
NovRAM troubles.
1 if the PRE-ALARM LED is illuminated on the front panel of
the display card, otherwise 0.
1 if the ALARM LED is illuminated on the front panel of the
display card, otherwise 0.
1 if an IIM is enabled and communicating, otherwise 0.
1 if control unit is silenced, otherwise 0.
1 indicates its time to replace the system batteries..
1 indicates the system is in Night Mode (SLC smoke
detectors set to night thresholds)

The Pre-Alarm and Alarm bits be will set if a loop device on the SLC or connected to the IIM has detected a prealarm or alarm condition, respectively. This occurs when the smoke level is greater than or equal to the preprogrammed threshold of the detector. In the case of a contact monitor, an alarm will occur if the contacts activate
and the pre-programmed device type is an alarm. Additionally, if a contact monitor is programmed for supervisory
or trouble, the proper status bit, supervisory or trouble, will be set.
The Supervisory and Trouble bits could be set by a loop device on the SLC or for other reasons such as problems
with communication, an on board circuit problem, isolations, or ground fault to name a few.
The Initialized bit indicates that all SLCs have been initialized.
Under normal conditions, the system status register should contain 0x0100 hex.
This register is provided to eliminate unnecessary traffic on the Modbus. If for example, the master determines that
the system status register contains 0x0100 hex, there is no need to read the status of each device.

Page 2

FenwalNET 8000-ML

2.5

Direct Modbus RTU Output

Addresses 0002 - 0008

Reserved:
This space has been reserved for future enhancements. Presently, all addresses in this space will return zeros.

2.6

Address 0009 - 2233 (SLC Devices (8 loops * 256) and IIM HSSD Devices
(127) and C Variables (50))

Loop Device and HSSD Register:

Bits
<1:8>
<9>
<10>
<11>

Name
Reserved
Supervisory
Trouble
Pre-Alarm

<12>
<13>

Alarm
Registered

<14:16>

Type

Description
Value is unpredictable, reserved for future use.
1 if the state of the device is supervisory, otherwise 0.
1 if the state of the device is trouble, otherwise 0.
1 if the state of the device is pre-alarm,
otherwise 0.
1 if the state of the device is alarm, otherwise 0.
1 if the device has been registered with the SLC or IIM,
otherwise 0.
Indicates the device type in hexadecimal:
1: Ion detector
2: Photo detector
3: Thermal detector
4: Addressable contact input device
5: Addressable relay output device/Addressable Signal
Module/Remote Release Module
6: Addressable Alarmline Module
7: HSSD (AIM or HSSD via IIM)

The control unit will return the above formatted registers in response to a read of any device address on the SLC or
HSSD connected via the IIM. This includes reads to a valid device address in which no device is physically
attached to the SLC or IIM. If the Registered bit is equal to 0, the device is either unregistered or does not exist. If a
device exists, but is unregistered, the Alarm, Pre-Alarm, and Trouble status should be ignored.
C Variable Register:

Bits
<1:11>
<12>
<13:16>

Name
Reserved
State
Reserved

Description
Value is unpredictable, reserved for future use.
1 if the state of the variable is true, otherwise 0.
Value is unpredictable, reserved for future use.

The control unit will return the above format in response to a read of a C Variable register. Please see the
Configuration Software manual for a discussion of how the C Variables are used.

Page 3

FenwalNET 8000-ML

Direct Modbus RTU Output

The following table shows how the Modbus Address space is mapped to the control unit SLC and HSSD devices
and C Variables.

Modbus Address

Device Address

0009

0 - not a registerable
device
1
255
Loop 2 - 0
255
Loop 3 - 0
255
Loop 4 - 0
255
Loop 5 - 0
255
Loop 6 - 0
255
Loop 7 - 0
255
Loop 8 - 0
255
1 - HSSD #001
127 HSSD #127
C Variable 1
C Variable 50

0010
0264
0265
0520
0521
0776
0777
1032
1033
1288
1289
1544
1545
1800
1801
2056
2057
2183
2184
2233

2.7

Address 2234 - 2261

(Network reporting)

Network Node System Register:

Bits
<1:8>
<9>
<10>
<11>
<12>
<13:16>

Name
Reserved
Supervisory
Trouble
Pre-Alarm
Alarm
Reserved

Description
Value is unpredictable, reserved for future use.
1 if a supervisory event is active on the node, otherwise 0.
1 if a trouble event is active on the node, otherwise 0.
1 if a pre-alarm event is active on the node, otherwise 0.
1 if an alarm event is active on the node, otherwise 0.
Value is unpredictable, reserved for future use.

Page 4

FenwalNET 8000-ML

Direct Modbus RTU Output

The control unit will return the above format in response to a read of any network node register. The network node
register is different from the local System Status Register in that it will only contain status information if there is a
current event on the node in question and the node is currently active on the network. If a node is operating properly
on the network, the modbus register data shall be 0x0000. However if a node is not configured on the network, the
register will also be 0x0000. If a node is configured on a network but not communicating, the trouble bit will be set.
The control unit should be connected to a control unit that is programmed to see all events that occur on all other
panels. The local control panel (connected to the modbus client) will not be aware of statuses on nodes in a different
group unless the connected control unit is programmed to Log All Events.
Due to memory limitations and modbus address limitations, a single control unit shall only support status registers
for a maximum of 28 nodes.
Depending on the node address of the control unit connected to the modbus client, a range of node registers is
available as shown in the table below.
The following table shows how the Modbus Address space is mapped to the network node system registers.

Register

2234
2235
2236
2237
2238
2239
2240
2241
.
.
.
2260
2261

Node Number
Client connected to
node 1 through 28
1
2
3
4
5
6
7
8
.
.
.
27
28

Page 5

Node Number
Client connected to
node 29 through 56
29
30
31
32
33
34
35
36
.
.
.
55
56

Node Number
Client connected to
node 57 through 64
57
58
59
60
61
62
63
64

FenwalNET 8000-ML

2.8

Direct Modbus RTU Output

Address 2262 - 64561

(Network Node Device reporting detail)

Network Loop Device and HSSD Register:

Bits
<1:8>
<9>
<10>
<11>

Name
Reserved
Supervisory
Trouble
Pre-Alarm

<12>
<13>
<14:16>

Alarm
Reserved
Type

Description
Value is unpredictable, reserved for future use.
1 if the state of the device is supervisory, otherwise 0.
1 if the state of the device is trouble, otherwise 0.
1 if the state of the device is pre-alarm,
otherwise 0.
1 if the state of the device is alarm, otherwise 0.
Value is unpredictable, reserved for future use.
Indicates the device type in hexadecimal:
1: Ion detector
2: Photo detector
3: Thermal detector
4: Addressable contact input device
5: Addressable relay output device/Addressable Signal
Module/ Remote Release Module
6: Addressable Alarmline Module
7: HSSD (AIM or HSSD via IIM)

The control unit will return the above format in response to a read of a network device register. The network device
registers are similar to the standalone node device registers. The main difference with network node device registers
is that the registered status is not known.
Network C Variable Register:

Bits
<1:11>
<12>
<13:16>

Name
Reserved
State
Reserved

Description
Value is unpredictable, reserved for future use.
1 if the state of the variable is true, otherwise 0.
Value is unpredictable, reserved for future use.

The control unit will return the above format in response to a read of a network C Variable register.

2.8.1

Network Register Mapping

The following tables show how the Modbus Address space is mapped to the dynamic network node SLC, HSSD
device and variable statuses.
The control unit shall support modbus data for a maximum of 28 nodes. The following table shows a breakdown of
modbus registers for any node with a node address less than or equal to 28. 'local' indicates the panel connected to
the modbus client.

Page 6

FenwalNET 8000-ML

Direct Modbus RTU Output

Modbus Address

Node

Device Address

0009
2056
2057
2183
2184
2233
2234
2235
2236
2237
.
.
2261
2262

local
local
local
local
local
local
1
2
3
.
.
.
28
1

4309

4310
4436
4437
4486
4487

1
1
1
1
2

6533

6534
6661
6662
6711
6712
.
.
62337

2
2
2
2
.
.
.
28

SLC device L1:000

SLC device L8:255
HSSD 001
HSSD 127
C Variable 1
C Variable 50
Node 1 Status
Node 2 Status
Node 3 Status
.
.
.
Node 28Status
Node 1 SLC device
L1:000
Node 1 SLC device
L8:255
Node 1 HSSD 001
Node 1 HSSD 127
Node 1 C Variable 1
Node 1 C Variable 50
Node 2 SLC device
L1:000
Node 2 SLC device
L8:255
Node 2 HSSD 001
Node 2 HSSD 127
Node 2 C Variable 1
Node 2 C Variable 50

64384

28

64385
64511
64512
64561

28
28
28
28

Node 28 SLC device

L1:000
Node 28 SLC device
L8:255
Node 28 HSSD 001
Node 28 HSSD 127
Node 28 C Variable 1
Node 28 C Variable 50

The following table shows a breakdown of modbus registers for any node with a node address greater than 28 but
less than or equal to 56.

Page 7

FenwalNET 8000-ML

Direct Modbus RTU Output

Modbus Address

Node

Device Address

0009
2056
2057
2183
2184
2233
2234
2235
2236
2237
.
.
2261
2262

local
local
local
local
local
local
29
30
31
.
.
.
56
29

4309

29

4310
4436
4437
4486
4487

29
29
29
29
30

6533

30

6534
6661
6662
6711
6712
.
.
62337

30
30
30
30
.
.
.
56

SLC device L1:000

SLC device L8:255
HSSD 001
HSSD 127
C Variable 1
C Variable 50
Node 29 Status
Node 30 Status
Node 31 Status
.
.
.
Node 56Status
Node 29 SLC device
L1:000
Node 29 SLC device
L8:255
Node 29 HSSD 001
Node 29 HSSD 127
Node 29 C Variable 1
Node 29 C Variable 50
Node 30 SLC device
L1:000
Node 30 SLC device
L8:255
Node 30 HSSD 001
Node 30 HSSD 127
Node 30 C Variable 1
Node 30 C Variable 50

64384

56

64385
64511
64512
64561

56
56
56
56

Node 56 SLC device

L1:000
Node 56 SLC device
L8:255
Node 56 HSSD 001
Node 56 HSSD 127
Node 56 C Variable 1
Node 56 C Variable 50

The following table shows a breakdown of modbus registers for any node with a node address greater than 56.

Page 8

FenwalNET 8000-ML

Direct Modbus RTU Output

Modbus Address

Node

Device Address

0009
2056
2057
2183
2184
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
.
.
2262

local
local
local
local
local
local
57
58
59
60
61
62
63
64
.
.
.
57

4309

57

4310
4436
4437
4486
4487

57
57
57
57
58

6533

58

6534
6661
6662
6711
6712
.
.
17837

58
58
58
58
.
.
.
64

SLC device L1:000

SLC device L8:255
HSSD 001
HSSD 127
C Variable 1
C Variable 50
Node 57 Status
Node 58 Status
Node 59 Status
Node 60 Status
Node 61 Status
Node 62 Status
Node 62 Status
Node 64 Status
n/a
n/a
n/a
Node 57 SLC device
L1:000
Node 57 SLC device
L8:255
Node 57 HSSD 001
Node 57 HSSD 127
Node 57 C Variable 1
Node 57 C Variable 50
Node 58 SLC device
L1:000
Node 58 SLC device
L8:255
Node 58 HSSD 001
Node 58 HSSD 127
Node 58 C Variable 1
Node 58 C Variable 50

19884

64

19885
20011
20012
20061
20062
.
.

64
64
64
64
.
.
.
Page 9

Node 64 SLC device

L1:000
Node 64 SLC device
L8:255
Node 64 HSSD 001
Node 64 HSSD 127
Node 64 C Variable 1
Node 64 C Variable 50
n/a
n/a
n/a

FenwalNET 8000-ML

Direct Modbus RTU Output

Network Example:
Suppose the modbus client is connected to node 1 on a network of 3 control units with node numbers 1, 5
and 10.
The modbus client would poll the system register 40002. If a status change is detected, the client could do
the following:

2.9

read registers 0010 through 2233 for the local node statuses
read register 2238 to check for a status change on node 5
if status exists on node 5, start reading registers 11162 through 13386 to look
for new statuses
read register 2243 to check for status change on node 10.
if status exists on node 10, start reading registers 22287 through 24511 to look
for new statuses

Modbus Slave Address

The modbus protocol supports a request of the control units Modbus Slave Address' - function 17.

Page 10

This literature is provided for informational purposes only. KIDDE-FENWAL,

INC. assumes no responsibility for the products suitability for a particular
application. The product must be properly applied to work correctly. If you
need more information on this product, or if you have a particular problem or
question, contact KIDDE-FENWAL, INC., Ashland, MA 01721. Telephone:
(508) 881-2000.
P/N 06-237222-001

Rev AA

2012 Kidde-Fenwal Inc.

All rights reserved.