Danfoss · HVAC controller
ECL Comfort 296 / 310 (ECL 210 via RS-485) Modbus register map
Default configuration
- Protocol
- Modbus TCP
- Port
- 502
- Unit ID
- 1
- Addressing
- 1-based
- Byte order
- Big endian
- Word order
- High word first
Register map
| Address | Count | Name | Type | Unit | Scale | Access |
|---|---|---|---|---|---|---|
| 35 | 1 | ECL software version Two bytes: major.minor (257 = 0x0101 = version 1.01). | UInt16 | - | 1 | R |
| 38 | 1 | Modbus network address Valid range 1-247, factory default 1. A change takes effect immediately. | UInt16 | - | 1 | RW |
| 1024 | 1 | Sum alarms 17-32 Bit field of alarms 17-32; bit set = alarm active. | UInt16 | - | 1 | R |
| 1025 | 1 | Sum alarms 1-16 Bit field of alarms 1-16; bit set = alarm active. | UInt16 | - | 1 | R |
| 2061 | 1 | Application type number Application key the controller runs (e.g. 230, 266), which determines the sensor assignment. | UInt16 | - | 1 | R |
| 2062 | 1 | Application type sub number Sub number of the installed application key. The guide reads the application name and version from PNU 2060-2063: 2060 = prefix (an ASCII letter, e.g. 65 = 'A'), 2061 = type number, 2062 = sub number, 2063 = version (major.minor in the two bytes). | UInt16 | - | 1 | R |
| 2099 | 1 | Production week and year High byte = years since 2000, low byte = production week. | UInt16 | - | 1 | R |
| 4201 | 1 | Circuit 1 mode Operating mode of circuit 1: 0 = manual operation, 1 = scheduled operation, 2 = constant comfort temperature, 3 = constant setback temperature, 4 = frost protection/standby, 5 = active cooling (A232 only). The guide places the circuit modes on PNU 4201-4206 (circuit 1-6) and states that manual mode applies to all circuits; it does not list a separate controller-wide mode PNU. | UInt16 | - | 1 | RW |
| 4202 | 1 | Circuit 2 mode Operating mode of circuit 2, same codes as circuit 1; circuit 3 mode is 4203, circuit 4 mode 4204, and so on up to circuit 6 at 4206. | UInt16 | - | 1 | RW |
| 4211 | 1 | Circuit 1 status Operating status of circuit 1: 0 = setback, 2 = pre-comfort, 3 = comfort, 5 = pre-setback, 6 and above = holiday states (see the guide's 'Mode and status' table). The operating status is read as 0 (setback) when the mode code is larger than 3. | UInt16 | - | 1 | R |
| 4212 | 1 | Circuit 2 status Operating status of circuit 2, same codes as circuit 1; circuit 3 status is 4213, circuit 4 status 4214, and so on. | UInt16 | - | 1 | R |
| 10201 | 1 | Raw sensor 1 Uncorrected input value of hardware sensor input 1, before any application scaling. | Int16 | °C | 0.01 | R |
| 10202 | 1 | Raw sensor 2 | Int16 | °C | 0.01 | R |
| 10203 | 1 | Raw sensor 3 | Int16 | °C | 0.01 | R |
| 10204 | 1 | Raw sensor 4 | Int16 | °C | 0.01 | R |
| 10399 | 1 | SCADA timeout Minutes after which the SCADA overwrites below expire and the controller returns to its own values; 1-720. | UInt16 | min | 1 | RW |
| 10400 | 1 | SCADA outdoor temperature Outdoor temperature injected by SCADA; -60 to 60 °C. Must be written periodically, otherwise it expires after the SCADA timeout. | Int16 | °C | 0.01 | RW |
| 10401 | 1 | SCADA heat offset 1 Parallel shift of heating circuit 1, -50 to 50 K; circuits 2-4 use 10402-10404. Must be written periodically. | Int16 | K | 0.1 | RW |
| 10405 | 1 | SCADA boiler control 1 DHW tank charging request: 0 = off, 1 = stop, 2 = start. Circuits 2-4 use 10406-10408. | UInt16 | - | 1 | RW |
| 11175 | 1 | Circuit 1 heat curve slope Weather-compensation slope (heat curve); read-only per the guide, writable in some applications | Int16 | - | 0.1 | R |
| 11180 | 1 | Circuit 1 comfort room setpoint | Int16 | °C | 0.1 | RW |
| 11181 | 1 | Circuit 1 saving room setpoint | Int16 | °C | 0.1 | RW |
| 11190 | 1 | Comfort DHW setpoint | Int16 | °C | 0.1 | RW |
| 11191 | 1 | Saving DHW setpoint | Int16 | °C | 0.1 | RW |
| 11201 | 1 | Circuit 1, sensor S1 Measured value of the sensor the application assigns to S1 of circuit 1 (typically the flow temperature). Which physical sensor that is depends on the application key. | Int16 | °C | 0.01 | R |
| 11202 | 1 | Circuit 1, sensor S2 | Int16 | °C | 0.01 | R |
| 11203 | 1 | Circuit 1, sensor S3 | Int16 | °C | 0.01 | R |
| 11204 | 1 | Circuit 1, sensor S4 | Int16 | °C | 0.01 | R |
| 11205 | 1 | Circuit 1, sensor S5 | Int16 | °C | 0.01 | R |
| 11206 | 1 | Circuit 1, sensor S6 | Int16 | °C | 0.01 | R |
| 11207 | 1 | Circuit 1, sensor S7 | Int16 | °C | 0.01 | R |
| 11208 | 1 | Circuit 1, sensor S8 | Int16 | °C | 0.01 | R |
| 11209 | 1 | Circuit 1, sensor S9 | Int16 | °C | 0.01 | R |
| 11210 | 1 | Circuit 1, sensor S10 | Int16 | °C | 0.01 | R |
| 11251 | 1 | Circuit 1, S1 sensor reference Desired value / setpoint used for sensor S1 of circuit 1. | Int16 | °C | 0.01 | R |
| 11252 | 1 | Circuit 1, S2 sensor reference | Int16 | °C | 0.01 | R |
| 11253 | 1 | Circuit 1, S3 sensor reference | Int16 | °C | 0.01 | R |
| 11254 | 1 | Circuit 1, S4 sensor reference | Int16 | °C | 0.01 | R |
Notes
Source: Danfoss Climate Solutions, "ECL Comfort 210/296/310, communication description" (operating guide AQ074886472234, English, 2026.05 edition). The ECL Comfort 296 and 310 are Modbus servers on TCP port 502 with default address 1 (range 1-247, settable in PNU 38); only public function codes 03 (read holding), 04 (read input) and 06 (write single) are supported, and the guide's own examples read both a setpoint and a sensor with function code 03, so the complete map is listed as holding registers, the ADU is limited to 240 bytes and a request may span at most 123 parameters. The register address is the PNU minus one (the guide's example: PNU 11180 is at address 11179), so the PNU numbers from the parameter list are used one_based here. Every value is a signed or unsigned 16-bit integer; the guide's Scale column is applied above (100 = 0.01, 10 = 0.1). The controller model is defined by the application key installed (PNU 2060-2063 report prefix, type number, sub number and version), and the application decides which sensor S1-S10 is what, which PNUs exist and whether a heat curve is present, so the sensor rows are intentionally described by their application-level names. PNU ranges: circuit modes 4201-4206 and circuit statuses 4211-4216 (circuit 1 = 4201/4211, as the guide's 'Mode and status' section states); the guide lists no controller-wide mode or status PNU, so none is included. Circuit 1 parameters are 11xxx, circuit 2 (DHW) 12xxx, and 1000 is added per further circuit. The circuit 1 heat curve slope (PNU 11175) uses the guide's scale 10 (= 1.0) and is listed as read-only, because the guide marks it read-only while some applications allow writing it. Reading non-existing parameters returns a Modbus exception instead of a value.