Remote Access DFGT - 2 Product / Protocol Specification: Document Information

HCCP
Remote Access DFGT – 2

Product / Protocol Specification
Document Information
Info Content
Author(s) Ronald Daris

Revision 7
Document Status WIP
Date December 12, 2014

Distribution For Customer use
VPM Number DP14010
Keywords firecrest; winchat; sfeerhaard; gateway
This document is based on the Product / Protocol Specification

template, version 2.0 of the ACS Software Development Process.
Copyright © 2014 HCCP. All rights reserved.

This document contains proprietary information of HCCP and is protected by copyright and other international laws.
Reproduction or improper use without specific written authorization of HCCP is strictly forbidden.
Product / Protocol Specification – Remote Access DFGT
Revision History
Rev. Date Author Description
1 October 22, 2012 Ronald Daris Initial draft
2 December 18, 2012 Ronald Daris  Removed function 06 Read Exception status
 Assigned Modbus Register numbers
 Added mac address as 3 registers
3 March 1, 2013 Ronald Daris  Appendixes added

 Added information to Registers 40011, 40102,
40300-40304
 Removed register 40405, this is now part of
register 40304
 Added Future functions
4 November 26, 2013 Ronald Daris  HW type removed from Registers 40201-40210
 Register 41009 added (apply IP settings)
 Added wave settings, registers
 Added OEM settings, registers
 Added status bits
 Added command for wave, light and boost fan
 Added IP discovery
 Added service interface registers like settings
5 June 6, 2014 Ronald Daris  Added explanation of RSSI registers

40205/40206
 Chapter future functions updated
6 July 28, 2014 Ronald Daris  Added temperature control

 Added service/factory write function
 Added Status bits
 Added generic registers
7 December 12, 2014 Ronald Daris  Registers 40200 and 40201: write only
 Register 40300: read only
 Removed Registers 40315, 40316, 40431,
40432, 40510 and 40511
 Register 40500-40509: read only
 Registers 40600 - 40820: read only added
 Added registers 41001, 41002, 41003, 41100-
41139, 41200-41219 and 41300-41329
Honeywell Confidential and Proprietary Revision 7 – WIP Page 2 of 32

Table of Contents
1 Introduction 4
1.1 Purpose 4
1.2 Scope 4
1.3 Terms, Acronyms and Abbreviations 4
1.4 References 5
2 Product info 6
2.1 Modbus over TCP/IP (Ethernet) 6
2.1.1 User Interface 6
2.1.2 Connections 6
2.1.3 Communications 6
2.2 Modbus RS485 7
2.2.1 User Interface 7
2.2.2 Connections 7
2.2.3 Communications 8
3 Modbus Protocol 9
3.1 Addressing 10
3.2 Holding Registers Gateway 11
3.3 Holding Registers DFGT 13
4 Installation instruction 19
4.1 Modbus over TCP/IP 19
4.1.1 IP address discovery 19
4.2 Modbus RS485 19
4.3 Binding procedure 19
4.3.1 Push button binding 20
4.3.2 Modbus binding 20
5 Safety restrictions 21
5.1 Remote control 21
5.2 Remote reset 21
5.3 Communication Timeout 21
5.4 Encryption 21
5.5 Legislation RF frequency 21
6 Future functions 22
Appendix A Adding New RF device via Ethernet Modbus 23
Appendix B Detecting device Capabilities 24
Appendix C User interaction APP is started 25
Appendix D User interaction ignite fireplace 26
Appendix E Normal use fireplace 27
Appendix F Automatic flame height control fireplace 28
Appendix G Assign fireplace to APP 29
Appendix H Temperature control 30
Appendix I Use gateway as factory tool 31

1 Introduction
1.1 Purpose
This System Specification describes the capabilities and characteristics of the product identified including design
constraints, and other factors as necessary.
1.2 Scope
This system Specification applies to decorative fire systems with Honeywell controls. The system consists of
 A fireplace with a burner controller and RF receiver (DFGT)
 A remote user interface
 And optional an RF interface to enable customer home automation
rd
The Ethernet and Modbus devices open the communication for 3 party applications (red square) to control the
fireplace.
Either an Ethernet or Modbus device can be connected together with a remote control to the fireplace.
1.3 Terms, Acronyms and Abbreviations

Below are the terms, acronyms, and abbreviations used within this document.
Term, Acronym, Abbreviation Definition

Term, Acronym, Abbreviation Definition
APP Android/iOs/Windows application to control the fireplace
DFGT Decorative Fireplace controller for Gas applications
DFRC Decorative Fireplace Remote control
RC Remote Control
RF Wireless protocol
Pilot Flame The small flame in the fireplace to ignite the main burner
DBI Direct Burner Ignition (ignition without pilot flame)
1.4 References
Abbreviation Reference Element Description
Modbus Modbus_Messaging_Implementation_Guide_V1_0b.pdf Modbus TCP/IP implementation
Modbus_Application_Protocol_V1_1b.pdf Modbus Application Protocol
Modbus_over_serial_line_V1_02-1.pdf Modbus RS485 implementation

2 Product info
2.1 Modbus over TCP/IP (Ethernet)
2.1.1 User Interface

The device has a (hidden) button and 5 LED’s. 2 LED’s are located at the RJ45 connector and 3 LED’s are on the
top of the product.
Front LED indications:
 Power/Error indication
 RF communication
 Modbus connection active
RJ45 Led indications:
 Ethernet connection
 IP address assigned
A short press on the button will initiate a binding with a fireplace.

A long press (10 seconds) on the button will clear all settings
2.1.2 Connections
Connections:
 RJ45 (female) connector Ethernet (10/100Mbit)
 Micro USB B connector to power the device
 USB A connector (no function at this moment)
2.1.3 Communications
The Ethernet device is working according a Modbus TCP/IP Server device (acting as a slave).

The Modbus server listens on TCP port 502 (fixed). Multiple concurrent connections are not supported.
To allow multiple devices to connect to the device the client (APP) should close the connection ASAP. The device
will close the connection automatically when there is no communication for at least 3 minutes.
2.2 Modbus RS485

Future product, ask your supplier for availability.
2.2.1 User Interface

The device has a button and 2 LED’s.
The exact function of the LED’s is not determined at this moment.
Some possible LED indications:
 Power/Error indication
 RF communication
 RS485 Communication
The button will be used to reset all setting back to factory defaults and to initiate/accept binding with an RF device.
2.2.2 Connections
Terminal Function
1 RS485 A
2 GND (shielding)
3 RS485 B
4 Power supply (9V DC / 24V AC)

Terminal Function
5 GND
2.2.3 Communications
The Modbus RS485 device is working as a slave. The initial slave address is 207.
The default communication rate is 19200 8-E-1 (8 data bits, EVEN parity and 1 stop bit).
It’s possible to change the baud rate via a special Modbus function (see next chapter).

3 Modbus Protocol
The device will support Modbus functions:
 03 Read Holding Registers
 06 Write Single Registers
 16 Write Multiple Registers
 11 Get com event counter
 43 Read device Identification (sub code 14) (content TBD according Honeywell standard)
Functions 01, 02, 04, 05, 06, 15, 17, 20, 21, 22, and 24 are not supported. Usage of these functions will result in an
Exception code 01 (ILLEGAL FUNCTION)
Holding registers can be read only. Writing to a read only holding registers will be ignored (no exception raised)
Note: Input reading registers are not used.
Reading or writing to a Holding register that doesn’t exist result in exception code 02 (ILLEGAL DATA ADDRESS).
Note: This is also the case when multiple registers are accessed in a function and one or more registers don’t exist
and some registers might exist.
When a register is read that doesn’t have actual data yet, for instance after power-up. The exception code 05
(ACKNOWLEDGE) will be returned. The master should retry after some while.
Standard real numbers are communicated as IEEE-754 32 bits floating point.
32 bits values are composed by 2 consecutive 16 bits holding registers.
A Modbus master can read/write a single word of a 32 bits register in two separate packets. The 32 bits value is
cached in the gateway to maintain data integrity. The lowest register has to be read/write before highest register.
The byte/word sequence of a 32 bits registers is according TBD…
When there is a communication error with an RF device all functions on the (virtual slave) will return the exception
0B (GATEWAY TARGET DEVICE FAILED TO RESPOND)

3.1 Addressing
Typical address overview
The gateway will respond on multiple slave addresses (RS485) or Unit Identifiers (TCP/IP).
 The address to communicate to the gateway itself
 Each RF device that is bound to the gateway has its own address
The initial slave address (RS485) of the gateway itself is 207 and can be altered by the master.
The Unit Identifier (Ethernet) of the gateway itself is 1 and cannot be altered.
When a DFGT is bound to the device via the push button the gateway will automatically assign an (new) address
to the node, starting from 2. When binding is initiated via Modbus the Modbus Master is in control of the address
assignment.
Note: When a installer replaces the DFGT without removing the old device or without performing a factory reset the
new DFGT gets a new address assigned and the old DFGT will have a communication failure. The APP must use
the new assigned address for correct operation.

3.2 Holding Registers Gateway
Reg Read Function / Name

No. Write
40000 R- Gateway info HW type (2)
40001 R- Gateway info SW version
40002- R- 32 bits RF Serial number

40003
40004- R- MAC address of the device (48 bits)

40006
40010 RW RF protocol:
0 Standard Honeywell RF protocol
1 Legacy decorative fireplace protocol
note: is used to communicate with current DFGT modules


No. Write
40011 RW Baud rate of the RS485 communication (default 6 - 19200 only RS485)
Value Baud rate Value Baud rate
0 300 5 9600
1 600 6 19200 (default)
2 1200 7 38400
3 2400 8 57600
4 4800 9 115200
40012 RW Slave address of this device (default 207 only RS485)
40100 RW Push button binding

0 Disabled (not possible to initiate binding via button
1 Enabled (default)
40101 -W Initiate binding with DFGT.

The value written will become the slave address / Unit Identifier of the RF node when
the binding is completed successfully.
Note: If another RF node is already assigned to this address the old node is removed
before the binding procedure is started.
40102 R- Actual Binding status

0 N/A (default)
1 Binding procedure initiated (waiting on response of RF node)
2 Binding completed successfully
100 Binding failed, no answer
101 Binding failed, incompatible device
102 Binding failed, node list is full
103 Binding failed ModBus address or UID is invalid (Range 2 to 255)
40110 -W Remove bounded RF node

The value written is de slave address / Unit Identifier of the RF node that will be
removed from the bound RF node list.
40200 Number of bound RF nodes
R- List of RF nodes and their used slave addresses / Unit Identifier

40201 LSB Assigned slave address / UID
40202.. LSB Assigned slave address / UID
40210 LSB Assigned slave address / UID
41000 RW IP address assignment

0 AUTO, try to use DHCP otherwise use fixed IP address
1 DHCP assigned IP and DNS address
2 Fixed IP and DNS address


No. Write
41001- RW 32 bits IP address of this device

41002 Default 192.168.0.207 when DHCP is not used
41003- RW 32 bits IP mask of TCP/IP settings

41005- RW 32 bits IP address of the default gateway (router)

41007- RW 32 bits IP address of the DNS server

41009 -W Writing the value 54321 will store and activate new IP settings
41100 RW Magic number Factory Tool

Ask Honeywell for number so device can be used during production setup.
42000- RW 1000 values can be used by APP to store product specific information. The device itself
42999 doesn’t use this data. For instance a time schedule can be stored.
note: values should not be written more than 100k times
3.3 Holding Registers DFGT
Reg. Read Function / Name

No. Write
40000 R- RF Node info HW type (1)
40001 R- RF Node info SW version
40002- R 32 bits RF Node Serial number

40003
40100 R- RF node info Last seen

Number of seconds ago the last message was received from this
device.
Note: When the burner is OFF there is no communication
40101 R- RF Communication status

0 No Error
1 Error
Note: A communication error only occurs when the burner is ON or an
action needs to be carried out and no response is received.


No. Write
40200 -W Fireplace action

0 no action
1 Turn fireplace OFF (appliance specific)
2 Turn pilot OFF
3 Turn main burner OFF (appliance specific)
4 Turn Second burner OFF
5 Turn Light OFF
6 Turn Boost Fan OFF
7 Turn wave OFF
8 Turn Temperature Control OFF
100 Turn Pilot ON
101 Turn Main Burner ON
102 Turn Second Burner ON
103 Turn Light ON
104 Turn Boost Fan ON
105 Turn wave ON
106 Turn Temperature Control ON
1000 Reset fireplace
40201 -W The requested flame height. (0-100%)

Note 1: The main burner must be switched ON with the previous
command before this value is used. For correct ignition this value is
ignored for xx seconds after ignition.
Note 2: This value is ignored when temperature control is active.
Note 3: Due to legislation on the used RF frequency it’s not
allowed to write this value more than once every 10 seconds. This
limitation can be overruled for a few seconds when there is user
interaction at that moment.
40202 RW Communication time-out in minutes (default 60 min)

The fireplace is turned OFF when there is no communication with the
Modbus Master (RS485) or TCP/IP Client for at least this time.


No. Write
40203 R- Fireplace Status (bit flags)

xxxxxxxxxxxxxxx1 Fault
xxxxxxxxxxxxxx1x Pilot flam ON
xxxxxxxxxxxxx1xx Main Burner ON
xxxxxxxxxxxx1xxx Second Burner ON
xxxxxxxxxxx1xxxx Low battery DFRC
xxxxxxxxxx1xxxxx 230V phase fault
xxxxxxxxx1xxxxxx Reset fireplace can be initiated by customer
xxxxxxxx1xxxxxxx Boost Fan ON
xxxxxxx1xxxxxxxx Light ON
xxxxxx1xxxxxxxxx Wave active
xxxxx1xxxxxxxxxx Flame height cannot be changed by user at this
moment
xxxx1xxxxxxxxxxx A Remote Control is bound to the appliance
xxx1xxxxxxxxxxxx A Gateway is bound to the appliance (always 1)
xYYxxxxxxxxxxxxx YY Temp Control state:
00 = Temp Control not possible
01 = Temp Control Possible (not Active)
10 = Temp Control Active
11 = Temp control error (like RF fault DFRC)
1xxxxxxxxxxxxxxx 1 = Ignition is not allowed at this moment
40204 R- When an fault is active this number gives more detail on the exact
failure
40205 R- RSSI level of the messages received by the gateway

This value should be multiplied by -0.5 before shown to the user. A
value of -90 after multiplication is a very bad signal a value
between -30 to -55 is excellent.
40206 R- RSSI level of the messages received by the DFGT

This value should be multiplied by -0.5 before shown to the user
40207 R- Rounded (0.5°C) actual Room Temperature [°C]

Value must be divided by 10 to get a correct value.
Example: Value 205 equals 20.5°C
40250 RW Temperature Control Setpoint [°C] (steps of 0.5°C)

Read value must be divided by 10 to get a correct value.
Write value must be multiplied by 10.
Example: Value 190 equals 19°C


No. Write
40300- R- 10 OEM bytes

40304 Bytes are programmed during production inside the DFGT and can be
used to identify or release specific functions for the customer
It’s advisable to transfer info like:
 Open / Closed fireplace
 DBI or Pilot ignition
 Second burner present
 Model/Brand number to check if APP is allowed to be used or to
know what logo to show
But also other things like production year/week can be programmed.
Register MSB LSB
40300 OEM byte 1 OEM byte 0
OEM byte 9: A Honeywell assigned number that can be programmed
during production inside the DFGT by the fireplace manufacturer.
This number can be used by the APP to check if the appliance is not
from the competitor. Ask your Honeywell sales representative for an
unique number or number range.
40305- RW 20 OEM bytes (10 registers).
40314 Can be used by the App to store device specific information. For
instance to store location information like text “Living room”
40400- RW Factory settings DFGT. Only Individual write is possible but is only
40419 intended for service people. Do not make this data writeable for end
users. Some data might be protected by the DFGT and individual write
is not possible.
40420 RW Wave interval time [s]

Total period of wave pattern is 20 times this interval time.
Note: from valve position 1 to 15 can takes up to 5 seconds. So a small
interval time and a large difference might not be visible for the end
user.
40421- RW Wave pattern, values that can be used 1 – 15

40430 20 values together make the pattern of the wave.(layout as OEM
bytes)
Note: This settings are only stored once a day in none volatile memory,
therefor the setting might be lost after a (rare) power interruption
40500- R Factory settings DFRC

40509
40600 R Size of Fault history buffer


No. Write
40601- R Fault history array. Register 40601 contains the most recent occurred
40620 error
Each entry contains one fault. See service manual of product for the
possible fault numbers
40700 R Size of Fault counters array
40701- R Fault counters array.

40720 Register 40701 counts the number of time fault 0 has occurred
Register 40702 counts the number of time fault 1 has occurred etc.
See service manual of product for the possible fault numbers
40800 R Size of Operation counters and actual data number array
40801- R Operation counters and actual data array

40820 See service manual of product for the meaning of the counters and
actual data
41001 R Write Result Factory Settings DFGT

0 = Fault
1 = Busy
2 = Completed (OK)
41002 R Write Result Factory Settings DFRC

0 = Fault
1 = Busy
2 = Completed (OK)
41003 R Write Result Factory Settings OEM

0 = Fault
1 = Busy
2 = Completed (OK)
41100- -W Factory settings DFGT.

41139 The value range of each registers is 0-255
Note: Individual write is not possible, all registers should we written in
one message.
41200- -W Factory settings DFRC.

one message.


No. Write
41300- -W Factory settings OEM.

one message.

4 Installation instruction
4.1 Modbus over TCP/IP
When the power and Ethernet connection are made the device gets it IP address from the DHCP server. Default if
no DHCP server is available it will use a fixed IP address. Both Ethernet LEDs will be ON when the DHCP server
has assigned the IP address, otherwise only one LED will be ON.
The APP needs the IP address of the device to be able to control it. Either the APP scans for the device(s) or the
user must enter the IP address. The Unit Identifier of the device is 1.
4.1.1 IP address discovery
To detect the IP-address of the device automatically the device is supporting mDNS, part of the Apple Bonjour
mechanism.
The mDNS query response contains:
 Service Record:
HWBRDG-DF._modbus._tcp.local. 3600 IN SRV 0 0 502 HWBRDG-DF.local.
<Instance Name> = HWBRDG-DF (this name is specific for the fireplace gateway)
<Service Type> = ._modbus._tcp
<Domain> = local.
<TTL> = 3600
<port> = 502
<target> = HWBRDG-DF.local.
 Pointer Record:
_modbus._tcp.local. 3600 PTR HWBRDG-DF._modbus._tcp.local.
A mDNS query response message is broadcasted after the Ethernet link is made and repeated every hour.
It is also send as a mDNS response on a query for the service type _modbus._tcp.local
According to the mDNS protocol all message are send to multicast address 224.0.0.251 UDP port 5353
Note:
The device does not support the Automatic Private IP Allocation that’s using IP address range 169.254.0.0 –
169.254.255.255.
Because not all routers supports the mDNS protocol broadcast correctly this mDNS packet is also send every 10
seconds to UDP port 35353 to IP-address 255.255.255.255
4.2 Modbus RS485

After initial power-up the slave address of the device is 207. If needed the slave address can be changed to any
other address.
4.3 Binding procedure

Before the Ethernet or Modbus device can be used the gateway must be bound to the DFGT.
To bind the product the DFGT must be set in to binding mode by pressing the button on the DFGT or via a power
cycle of the DFGT. Within 5 minutes this Ethernet or Modbus device must initiate binding.
Note: The DFGT only supports one binding to a control device, so either a RC or a gateway can be used to control
the fireplace.

Note: In case multiple fireplaces are in binding mode within range and it’s unclear with device will be successfully
bound.
4.3.1 Push button binding
When the user presses the button on the device it tries to connected with another device that is also in binding
mode at that moment. When the binding is successful the RF node gets automatically a Modbus slave address
Unit Identifier assigned.
The first used slave address / Unit Identifier is 2. This number is incremented for every new binding.
Note: Because each RF node will get a slave address on the RS485 bus it’s not advisable to use the push button
binding method when multiple devices are connected to the RS485 bus.
4.3.2 Modbus binding
Via a Modbus command the binding can be initiated. Together with the command the slave address / Unit Identifier
of the new RF node is send to Modbus slave. This new slave address / Unit Identifier can be used to communicate
with the RF node after the binding is successful completed.
Single Bound RF nodes can be removed from the device via the remove bounded RF device holding register
command.

5 Safety restrictions
5.1 Remote control
For safety reasons (regulations) it’s might be an issue if the fireplace is controlled (ignited) from outside the house.
So it’s advisable to disable the connection to the gateway from a public IP address and only setup a connection
from the same subnet as the where the Modbus device is.
Note: viewing the actual status is no problem from outside.
5.2 Remote reset

For safety reasons (regulations) it’s not allowed to automatically perform a reset operation, it must be manually
triggered.
Within 24h it’s not allowed to reset too often. The “Reset fireplace can be initiated by customer” flag indicates if it’s
allowed to perform a reset. If this flag is not set the reset command is ignored by the DFGT.
5.3 Communication Timeout

Either due to malfunction of a smartphone/tablet, router or the absence of the smartphone the fireplace is
automatically shut down when there is no Modbus communication for at least 60 minutes (setting).
The fireplace DFGT itself also performs a shutdown when there is no RF communication with the Modbus device
for a specific time.
Note: when Wi-Fi is turned off on a phone or tablet a shutdown might occur unintentionally.
5.4 Encryption
The Modbus over TCP/IP communication is not encrypted or protected in any way. So it’s not advisable to
communication via the internet (WAN).
Hence it’s still possible to perform port forwarding on the router to get access from outside.
5.5 Legislation RF frequency

Due to legislation on the used RF frequency (868.3MHz) it’s not allowed to communicate more than 1% in time.
Therefor the App must limit the communication with the fireplace when the user is not actively operating the device.
In general it should not write values more often than once every 10 - 30 seconds.

6 Future functions
A future Ethernet gateway can setup a permanent encrypted connection with a server on the internet. This server
is providing a way of communicating with the gateway behind a router (or firewall) from anywhere on the internet.
This server also gives the possibility to have concurrent connections to multiple user interfaces (phones, tablets) to
a single gateway.
It’s not allowed to send continuously commands or flame height via the APP in this case.
Some new control functions might be added like:
• Time schedule temperature control
• AES encryption

Appendix A Adding New RF device via Ethernet Modbus
When only a # bound

single RF node devices No (Other RF nodes already exist)
is supported [40200] =
UID 2 can be
(re)used
directly Yes (First device) Check assigned
UID’s [40202-
40210] When a existing node
And get first is replaced the node
new UID = 2 available UID must be deleted via
register 40110 or can
be overridden by
using the same UID
Initiate binding
[40101] = new UID
Binding status
[40102] <> 1 ? No
Yes
Binding status No Binding status

[40102] >= 100 [40102] = 2?
?
Yes Yes
Inform user binding Inform user binding

FAILED completed
Communication to RF node
can now take place via
New UID

Appendix B Detecting device Capabilities

It’s up to the fireplace Registers 40300 – 40304
manufacturer if he want are programmed inside
to use this auto detection the appliance during
mechanism. It’s also production. The meaning
possible to let the of the values is The following data is used as an
consumer select it’s model manufacturer specific example.
number
40304 bit 0: 0 = Closed fire place
1 = Open Fireplace
bit 1: 0 = DBI Application
1 = Pilot Application
bit 2: 0 = Intermitted pilot
1 = Standing pilot
bit 3: 0 = single burner
1= double burner
OEM Number 12 bit 8-15: manufacturer number
[40304] bit 8-
15?
08
Show logo Show logo

1 1 The manufacturer number
can be made unique so
every fireplace
manufacturer has its own
number and a generic app
can be used for different
brands
Register 40304 1
bit 3 ?
Register 40304 1 Register 40304 1

bit 2 ? bit 2 ?
0 0
User can User can User can User can
switch on/off: switch on/off: switch switch
-burner -Pilot flame on/off: on/off:
-burner -Burner -Pilot flame
-Second -Burner
burner -Second
burner

Appendix C User interaction APP is started
Start
APP See also temperature
control
Fault Status 1 Fireplace

[40203] bit 0? fault
Second burner 1 Read register Fireplace is ON

Status [40203] 40201 Both burners are
bit 3? Flame height ON
Main burner 1 Read register Fireplace is ON

Status [40203] 40201 Main burner is
bit 2? Flame height ON
Flame Status 1 Fireplace is ON

[40203] bit 1? Main burner is
OFF
Fireplace is OFF

Appendix D User interaction ignite fireplace

PRE:
Ignite • Fault register 40203
Ask user if he is
fireplace bit 0 should not be
standing in front of the
set.
fireplace
• Fireplace is off
Ignition allowed
[40203] bit 15?
Standing pilot
application.
Wait until it is Turn Pilot On Main burner should
allowed. Write register be turned on also.
This could takes 40200 = 100
minutes !!
Flame status 0
[40203] bit 1?
Turn Main
burner On
Write register
40200 = 101
Optional, but most

Set max flame manufacturers like
height to have the
Write register maximum flame
40201 = 100 height after ignition
Wait for x
seconds • The delay is
appliance specific
and cannot be
overruled.
• When the time is
passed on the
Now the user is able fireplace the new
to alter the flame height will be used.
height
(Register 40201)

Appendix E Normal use fireplace
Change
flame
height
Write register
40201
0-100%
Read status
register 40203
Flame on 0
Burner OFF
[40203] bit 1?
Fault on [40203] 1 Fireplace

bit 0? fault
Delay
Few seconds

Appendix F Automatic flame height control fireplace
Automatic PRE:
Flame Height control • register 40203 bit 2
should be set. (main
burner on)
Flame on 0
[40203] bit 1?
Limit RF communication
to fireplace due to
1 legislation!!
Normally it’s not
allowed to write more
Main burner on 0 then once every 5 - 10
[40203] bit 2? seconds a value
Flame height
0-100% Turn main on
Write register [40200] = 101
40201
Closed fireplace
No
Yes
Wait for at
least ignite
5 seconds
Automatic ignition NOT

allowed on open fireplaces Fireplace
is OFF

Appendix G Assign fireplace to APP
Assign Fireplace
Possible solutions: gateway
• Send Bonjour query
• scan on port 502 on all
local IP-addresses
• Enter IP-address manually
Discover ip-
address of
gateway
Is it needed to pair or can every

device connect to the gateway?
Pair device
How to pair?
• Manually enter mac
address
• Press button on device
• PIN code on device
• Power cycle gateway
• …..
Pair device Pairing not

Successful successful
Pairing not
successful

Appendix H Temperature control

Start
APP
Temperature control is not
possible when the Remote Control
is not within range or has empty
batteries
Old gateway software will raise
Read setpoint
exception if temperature control is
40250 Low battery warning register
not supported
40203 of remote control should be
shown on App when temp control
is used.
The warning can be ignored when
temp control is not used.
Register 40203
bit 13,14
00 01 10 11
Not possible Possible, not active Active Error
Possible causes:
Possible causes: • Temperature Sensor Error
• No remote control • Remote control out of
bound range
(can be checked with • Empty batteries remote
register 40203) control
• Old software version
DFGT Temperature setpoint can be
(can be checked with changed by user or
automatically by APP
For safety reasons only

activate temperature control
after user intervention and
not automatically
Temperature control and time

schedule is disabled in the Remote When a remote control is switched
Control when a gateway is on previously activated
connected to the system. temperature control is switched
off automatically

Appendix I Use gateway as factory tool

Ask Honeywell for the magic
This procedure should never be number.
Use gateway as factory tool
performed at the end customer.
Once a gateway is configured to be
used as a factory tool it cannot be When multiple factory gateways
used as a normal gateway because are used simultaneously (multiple
the binding is not stored anymore production lines) each gateway
Write magic number needs to be programmed with
Register another magic number
41100-411001
Configure
fireplace
User needs to press

DFGT button
Perform binding Binding inside gateway is not

stored so after a power cycle of
the gateway there is no binding
Write registers
40300 - 40315

Write registers
40400 - 40431
Write registers
40500 - 40510
from here the user can release

DFGT button
Read registers
40316, 40432, 40511
Some Busy ?
Some failed Configuration

? Failed
Configuration
successful

Remote Access DFGT - 2 Product / Protocol Specification: Document Information

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Remote Access DFGT - 2 Product / Protocol Specification: Document Information

Uploaded by

Copyright:

Available Formats

HCCP

Remote Access DFGT – 2

Author(s) Ronald Daris

Document Status WIP

Date December 12, 2014

VPM Number DP14010

Keywords firecrest; winchat; sfeerhaard; gateway

This document is based on the Product / Protocol Specification

Copyright © 2014 HCCP. All rights reserved.

3 March 1, 2013 Ronald Daris  Appendixes added

5 June 6, 2014 Ronald Daris  Added explanation of RSSI registers

6 July 28, 2014 Ronald Daris  Added temperature control

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 2 of 32

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 3 of 32

1.3 Terms, Acronyms and Abbreviations

Term, Acronym, Abbreviation Definition

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 4 of 32

Term, Acronym, Abbreviation Definition

APP Android/iOs/Windows application to control the fireplace

DFGT Decorative Fireplace controller for Gas applications

DFRC Decorative Fireplace Remote control

DBI Direct Burner Ignition (ignition without pilot flame)

Abbreviation Reference Element Description

Modbus Modbus_Messaging_Implementation_Guide_V1_0b.pdf Modbus TCP/IP implementation

Modbus_Application_Protocol_V1_1b.pdf Modbus Application Protocol

Modbus_over_serial_line_V1_02-1.pdf Modbus RS485 implementation

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 5 of 32

2.1.1 User Interface

A short press on the button will initiate a binding with a fireplace.

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 6 of 32

2.2 Modbus RS485

2.2.1 User Interface

4 Power supply (9V DC / 24V AC)

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 7 of 32

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 8 of 32

Standard real numbers are communicated as IEEE-754 32 bits floating point.

32 bits values are composed by 2 consecutive 16 bits holding registers.

The byte/word sequence of a 32 bits registers is according TBD…

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 9 of 32

Typical address overview

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 10 of 32

3.2 Holding Registers Gateway

Reg Read Function / Name

40000 R- Gateway info HW type (2)

40001 R- Gateway info SW version

40002- R- 32 bits RF Serial number

40004- R- MAC address of the device (48 bits)

Copyright © 2014 HCCP. All rights reserved.

Honeywell Confidential and Proprietary Revision 7 – WIP Page 11 of 32

Reg Read Function / Name

40012 RW Slave address of this device (default 207 only RS485)

40100 RW Push button binding

40101 -W Initiate binding with DFGT.

40102 R- Actual Binding status