MODBUS Slave Protocol

Smart LCD MODBUS Salve Product can be accessed by MODBUS Master devices for real-time control and access.

Basic

MODBUS Communication

The MODBUS is a standard protocol (with RTU or ASCII mode) which is used to communicate between a host and one or multiple slave devices. Over the MODBUS the host is able to communicate with up to 254 slaves. It can read or write data areas on these devices.

The SMART LCD Slave Product works as a slave device in RTU mode. Therefore, we only describe the RTU mode within this document.

General MODBUS Frame consists:
- 1byte of Device Address, to indicate which slave device shall response
- 1byte of Function Code, to tell the addressed slave which function is going to do
- Data content for PAGE, Addresses and data values
- 2-Byte CRC for Error Checking

< - - - - - - - - - - - - - - - - - - - - - - - - - ADU - - - - - - - - - - - - - - - - - - - - - - - - - >
Device Address (1byte)	Function Code (1byte)	Data (252bytes(max.))	Error Check (2bytes)
	< - - - - - - - - - - PDU - - - - - - - - - - >

When the host receives the previous frame reply from the slave device, the host needs an interval of 5ms before it can continue to send the next frame command. Since the SMART LCD is a Modbus slave device, a Device Address must be assigned to it. Device address can be assigned in the TOPWAY’s SGTools.

MODBUS Function Codes

MODBUS Function Code	Function Definition	Address Range	Object Type
0x03	Read Multiple Holding Registers	0x0000 ~ 0xFFFF	2 Bytes
0x06	Write Single Holding Register	0x0000 ~ 0xFFFF	2 Bytes
0x10	Write Multiple Holding Registers	0x0000 ~ 0xFFFF	2 Bytes
0x11	Report Slave ID
0x14	Read File Record	1 File with 2048 Records of 128 Byte

MODUBS Address and Mapping with Smart LCD

To access memory locations in the SMART LCD the host has to issue a Read or Write function, which includes a specific address. Each Read or Write function accesses a 2-Byte location within an area of up to 64k words. Since the multiple data areas (N16, N32, N64, etc.) are together larger than 64k Words, the different memory areas are separated into pages. To select a specific page the Modbus Page Map Register must be written with the page number. The Page Map Register is located within the set of Special Function Registers. The Special Function Registers (SFR) are accessible on all pages at the same location. They are placed within the final 4k words of all pages.

In SGTools, MENU --> View --> Show Modbus Holding Register Address can show up the VPs corresponding MODBUS ADDRESS for the display UI.

Relationship between MODBUS PAGE:addresses and the SMART LCD VPs

VP type	SMART LCD VP Address	MODBUS PAGE: Address	note
VP_STR	0x000000, 0x000080 - 0x01DF80	0:0x0000, 0:0x0040 - 0:0xEFC0
VP_N32	0x020000, 0x020004 - 0x02FFDC	1:0x0000, 1:0x0002 - 1:0x7FEE
TIMER COUNTER	0x02FFE0, 0x02FFE4 - 0x02FFFC	1:0x7FF0, 1:0x7FF2 - 1:0x7FFE	Timer 0, Timer 1 - Timer 7
VP_N64	0x030000, 0x030008 - 0x03FFF8	6:0x0000, 6:0x0004 - 6:0x7FFC
VP_N16	0x080000, 0x080002 - 0x08FFFE	4:0x0000 - 4:0x7FFF
VP_BMP	0x040000 - 0x05DFFE	2:0x0000 - 2:0xEFFF
VP_G16	0x060000 - 0x06EFFF	3:0x0000 - 3:0xEFFF
VP_Flash	120kB Flash memory	5:0x0000 - 5:0xEFFF	remain unchanged even after power down
VP_REG	0xFFF000 - 0xFFFFFF	--	VP_Reg can not be accessed directly via MODBUS
SFR	--	n:0xF000 - n:0xFFFF	SFR for Smart LCD MODBUS can be access form any page it also for some of the VP_REG functions

MODBUS Function Codes Details

The SMART LCD supports five MODBUS Functions Codes: 0x03, 0x06, 0x10, 0x11, 0x14

Function Code 0x03 - “Read Multiple Holding Registers”

This function code read up to 250 Bytes from the SMART LCD.

Host sto Smart LCD MODBUS Frame

Byte Seq	Content	No. of Byte	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x03
2	Start Address to be read	2	0x0000 … 0xFFFF	Address location that MODBUS PAGE assigned via SFR
4	Quantity of data	2	0x0001 … 0x007D	no. of 16 Bit data values to be read
6	CRC	2	0x0000 … 0xFFFF	for error checking

SMART LCD reply to host

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x03
2	Byte Count N	1	0x02 … 0xFA	must be an even number, must be double of the requested "Quantity of data" in16 Bit values
3	N Bytes of data	N	0x00 … 0xFF
3 + N	CRC	2	0x0000 … 0xFFFF	for error checking

SMART LCD reply to host (in case of error found)

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Error Code	1	0x83
2	Exception Code	1	0x01 ... 0x04	01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3	CRC	2	0x0000 … 0xFFFF	for error checking

Example Frame (Read a VP_N32 value form Smart LCD (device address = 01))

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F0 01 00 01 2A CA	Set the Smart LCD MODBUS PAGE =1; omit this frame for continue access the same PAGE
2	RX	01 06 F0 01 00 01 2A CA
3	TX	01 03 00 00 00 02 C4 0B	Read multiple data form address 00 00, and get 00 02 16bit values
4	RX	01 03 04 33 44 11 22 39 2B	no. of byte =04; Data value = 0x11223344

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x06 - “Write Single Holding Register”

This function code write 2 Bytes to the SMART LCD.

Host send to Smart LCD MODBUS frame

Byte Seq	Content	No. of Byte	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7	0x00 is a broadcast message to all devices
1	Function Code	1	0x06
2	Address to be writen	2	0x0000 … 0xFFFF	Address location that MODBUS PAGE assigned via SFR
4	Data value	2	0x0001 … 0x007D	16 Bit data values to be written
6	CRC	2	0x0000 … 0xFFFF	for error checking

SMART LCD reply to host

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x06
2	Address wrote	2	0x0000 … 0xFFFF	must be an even number, must be double of the requested "Quantity of data" in16 Bit values
4	Data value	2	0x0000 … 0xFFFF	16 Bit data value wrote
6	CRC	2	0x0000 … 0xFFFF	for error checking

SMART LCD reply to host (in case of error found)

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Error Code	1	0x86
2	Exception Code	1	0x01 ... 0x04	01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3	CRC	2	0x0000 … 0xFFFF	for error checking

Example Frame (Write a VP_N16 value to Smart LCD (device address = 01))

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F0 01 00 04 EA C9	Set the Smart LCD MODBUS PAGE =4; omit this frame for continue access the same PAGE
2	RX	01 06 F0 01 00 04 EA C9
3	TX	01 06 00 00 12 34 84 BD	Write a data 12 34 to address 00 00
4	RX	01 06 00 00 12 34 84 BD

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x10 - “Write Multiple Holding Registers”

This function code write up to 246 Bytes to the SMART LCD.

Host send to Smart LCD MODBUS frame

Byte Seq	Content	No. of Byte	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7	0x00 is a broadcast message to all devices
1	Function Code	1	0x10
2	Start Address to be write	2	0x0000 … 0xFFFF	Address location that MODBUS PAGE assigned via SFR
4	Quantity of data (Q)	2	0x0001 … 0x007B	no. of 16 Bit data values to be written
6	Byte Count	1	0x02 … 0xF6	must be an even number and exactly the double of Q
7	Data to be written	2 x Q	0x0000 ... 0xFFFF
7 + Q	CRC	2	0x0000 ... 0xFFFF	for error checking

SMART LCD reply to host

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x10
2	Start Address wrote	2	0x0000 … 0xFFFF	Address location that MODBUS PAGE assigned via SFR
4	Quantity of data worte	2	0x0001 … 0x007B	no. of 16 Bit data values wrote
6	CRC	2	0x0000 … 0xFFFF	for error checking

SMART LCD reply to host (in case of error found)

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Error Code	1	0x90
2	Exception Code	1	0x01 ... 0x04	01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3	CRC	2	0x0000 … 0xFFFF	for error checking

Example Frame (Write two VP_N16 value to Smart LCD (device address = 01))

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F0 01 00 04 EA C9	Set the Smart LCD MODBUS PAGE =4; omit this frame for continue access the same PAGE
2	RX	01 06 F0 01 00 04 EA C9
3	TX	01 10 00 00 00 02 04 56 78 12 34 06 68	Write two 16bit data 12 34 and 56 78 to address 00 00
4	RX	01 10 00 00 00 02 41 C8

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x11 - "Report Slave ID"

This function code allows the host to check some slave device information like device name and revision. Additional there is one byte indicating the current operational status of the slave device, called the Run Indicator Status. The SMART LCD will always set this byte to 0xFF (Powered On)

Host send to Smart LCD MODBUS frame

Byte Seq	Content	No. of Byte	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x11
2	CRC	2	0x0000 ... 0xFFFF	for error checking

SMART LCD reply to host

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x11
2	Byte Count	1	0x01 ... 0xF9	byte count of all the following data except CRC
3	Slave ID	n	0x00 ... 0xFF	in ASCII (e.g. SMART LCD V1.03)
3 + n	Run Indicator Status	1	0xFF	0xFF for Powered On
3 + n + 1	CRC	2	0x0000 … 0xFFFF	for error checking

SMART LCD reply to host (in case of error found)

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Error Code	1	0x91
2	Exception Code	1	0x01, 0x04	01=Illegal Functrion; 04=SlaveDeviceFailure
3	CRC	2	0x0000 … 0xFFFF	for error checking

Example Frame (Ask for Slave ID of Smart LCD (device id = 01))

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 11 C0 2C
2	RX	01 11 11 48 4D 54 30 37 30 43 4E 2D 43 20 56 31 2E 30 33 FF 29 30	Slave ID is “SMART LCD V1.03”

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x14 - "Read File Record"

This function code allows the host to read up to 128 Byte of a special file (USR.BIN) at once. The file USR.BIN may be placed together with the TML project data into the file system of the SMART LCD and it may contain any additional data used by the host. The file size of USR.BIN may be up to 256k Byte. It is organized into 2048 records. Each record consists of 128 Bytes.

Host send to Smart LCD MODBUS frame

Byte Seq	Content	No. of Byte	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x14
2	Byte Count	1	0x07	byte count of all the following data except CRC
3	Reference Type	1	0x06
4	File Number	2	0x0001
6	Record Number	2	0x0000 ... 0x07FF	Record Number of a one of the 2048 possible records within USR.BIN
8	Record Length	2	0x0001 ... 0x003F	Record Length in 16 Bit words to be read from the record
10	CRC	2	0x0000 ... 0xFFFF	for error checking

SMART LCD reply to host

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Function Code	1	0x14
2	Reply Byte Count	1	0x04 ... 0x82	Response Byte Count of all following data except the CRC
3	Record Byte Count	1	0x03 ... 0x81	Record Byte Count of all following data except the CRC
4	Reference Type	1	0x06
5	Data	2 x n	0x00 ... 0xFF	read from record with N 16 Bit words ranging from 1 to 64.
5 + (2xN)	CRC	2	0x0000 … 0xFFFF	for error checking

SMART LCD reply to host (in case of error found)

Byte Seq	Content	Byte Count	Valid Range	note
0	MODBUS Device Address	1	0x01 … 0xF7
1	Error Code	1	0x94
2	Exception Code	1	0x01 ... 0x04	01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3	CRC	2	0x0000 … 0xFFFF	for error checking

Example Frame (Read File Record (device id = 01))

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 14 07 06 00 01 00 00 00 01 05 24	read record file 00 01, record 00 00 and one 16bit value
2	RX	01 14 04 03 06 02 01 D9 F1	two bytes read back are 0x01, 0x02.

TX=host to Smart LCD; RX=Smart LCD reply to host

Since the Modbus protocol organizes data in 16 Bit words the file size of USR.BIN should be even. In case the file size is uneven the SMART LCD would pad the last data word with an additional 0x00.

MODBUS Error Codes Details

In case the SMART LCD receives a command with invalid data, invalid data count or an unsupported function code it will return an error code to the host (Returning the same function code with an additional Bit7 set). Additional it will transfer one of four possible exemption codes to indicate to the host what kind of error occurred

Code	Exemption Name	Descriptions
0x01	ILLEGAL FUNCTION	The function code is not supported by the SMART LCD
0x02	ILLEGAL DATA ADDRESS	The data address by the SMART LCD falls into a undefined area.
0x03	ILLEGAL DATA VALUE	A data value received by the SMART LCD is not valid. It does not fit to the specific range requirements for the particular address.
0x04	SLAVE DEVICE FAILURE	An unrecoverable error occurred while the SMART LCD was attempting to perform the requested action.

Color and Data Value Configuration

To access data the host should do following steps using the Modbus protocol:

1. Use “Write Single Holding Register” with function code (0x06) to address 0xF001 and the data value of the desired memory page (0x01 … 0x05)
2. Write to or read from the desired address within the selected page with: “Read Multiple Holding Registers” with function code (0x03) “Write Single Holding Register” with function code (0x06) "Write Multiple Holding Registers” with function code (0x10)

Each Modbus address holds 16 Bit of data. Therefore, it might be necessary to read multiple address locations:

• STR, up to 64 consecutive accesses might be necessary to read an entire string, One single access will manipulate two characters.
• N16, just one access is necessary to access one N16 variable. Multiple N16 variables might be accessed with a single Modbus command.
• N32, two accesses are necessary to access one N32 variable. Multiple N32 variables might be accessed with a single Modbus command.
• N64, four accesses are necessary to access one N64 variable. Multiple N64 variables might be accessed with a single Modbus command.
• Bitmap, one access can manipulate 16 pixels of a bitmap variable. Multiple pixels might be accessed with a single Modbus command.
• Graph, one access can manipulate one data point of a graph. Multiple data points might be accessed with a single Modbus command.

“Read Multiple Holding Registers” with function code (0x03) allows accessing of up to 125 consecutive address locations at once, with each location holding two Bytes of data.

“Write Multiple Holding Registers” with function code (0x10) allows accessing of up to 123 consecutive address locations at once, with each location holding two Bytes of data.

Access to the Special Function Registers, which are mapped to all pages, should not exceed the required Byte count assigned to each SFR. In such a case the SMART LCD would reply the host with an error message.

Note: Since the Modbus protocol uses a “Big-Endian” representation of data, the first Byte of each 16 Bit word represents the upper 8 Bit of the data word. In contrary the memory organization of the SMART LCD is “Little-Endian” requiring the host to swap upper and lower Byte of each transaction.

16 bit color value

R4	R3	R2	R1	R0	G5	G4	G3	G2	G1	G0	B4	B3	B2	B1	B0
High byte (MSB)								Low byte (LSB)
D7	D6	D5	D4	D3	D2	D1	D0	D7	D6	D5	D4	D3	D2	D1	D0

64bit number value

D63...D56	D55...D48	D47...D40	D39...D32	D31...D24	D23...D16	D15...D8	D7...D0
Byte7 (MSB)							Byte0 (LSB)
D7...D0	D7...D0	D7...D0	D7...D0	D7...D0	D7...D0	D7...D0	D7...D0

32bit number value

D31...D24	D23...D16	D15...D8	D7...D0
Byte3 (MSB)			Byte0 (LSB)
D7...D0	D7...D0	D7...D0	D7...D0

16bit number value

D15...D8	D7...D0
High Byte (MSB)	Low Byte (LSB)
D7...D0	D7...D0

String value

D7...D0	D7...D0
Strings are stored Byte by Byte starting from the lower address. The terminator (0x00) is placed at the highest address. The start address of a string is always even and aligned to a 128 Byte boundary.

Special Function Registers (SFR)

The SMART LCD provides a set of SFR, which allow the host to:

• Select a Memory Page to be able to access different kinds of VPs
• Issue graphical drawing commands (Draw Pixels, Lines, Rectangles)
• Show text or specific icons on the GUI
• Read or change current page shown on the GUI  
• Set the Type
• Control Buzzer, Backlight and Screensaver
• Read and Set the Real Time Clock (RTC)
• Select a GUI project (if multiple GUI projects are present)
• Restart a GUI project
• Unlock the File System for access via USB
• Format the File System
• Change the RS485 communication Baud Rate
• Start a System Self-Test or the Touch Panel Calibration Routine

SFR List

SFR Type	SFR Address	R/W	Size (bytes)	SFR Name	Default Value
Command SFR (*1)	n:0xF000	R/W	2	Command	0x0000 (*2)
MODBUS PAGE SFR	n:0xF001	R/W	2	Modbus VP Page	0x0004
Project Control SFRs	n:0xF00A	R/W	2	Project ID	0x0000
	n:0xF200	W	128	USB Password Buffer	0x0000
	n:0xF300	R	2	TP_X_Position	0x0000
	n:0xF301	R	2	TP_Y_Position	0x0000
Peripheral Control SFRs	n:0xF400	R/W	2	Display Page ID	Project Value
	n:0xF401	R	2	Modbus Slave Address	Project Value
	n:0xF402	R/W	2	Baud rate	Project Value
	n:0xF403	R/W	2	Backlight Level	Project Value
	n:0xF404	R/W	2	Screen Saver Backlight Level	Project Value
	n:0xF405	R/W	2	Screen Saver Time	Project Value
	n:0xF406	R/W	2	Buzzer Key Click Time	Project Value
	n:0xF407	R/W	2	cursor type	Project Value
	n:0xF408	R/W	6	RTC_NOW in format (YY-MM-DD HH:mm:ss)	0x000101000000 (2000-01-01 00:00:00)
	n:0xF40B	R/W	2	Buzzer Sound Time	click time
	n:0xF40C	R/W	2	Enable Self-Test	0x0000
	n:0xF40D	R/W	2	Enable Format	0x0000
	n:0xF40E	R/W	2	Enable Touch Panel Calibration	0x0000
Timer Control SFRs	n:0xF410	R/W	2	Timer_ctrl 0	0x0000
	n:0xF411	R/W	2	Timer_ctrl 1	0x0000
	n:0xF412	R/W	2	Timer_ctrl 2	0x0000
	n:0xF413	R/W	2	Timer_ctrl 3	0x0000
	n:0xF414	R/W	2	Timer_ctrl 4	0x0000
	n:0xF415	R/W	2	Timer_ctrl 5	0x0000
	n:0xF416	R/W	2	Timer_ctrl 6	0x0000
	n:0xF417	R/W	2	Timer_ctrl 7	0x0000
System Control SFRs	n:0xF420	R/W	2	Screen Saver Time1	Project Value
	n:0xF421	R/W	2	Screen Saver Page ID	Project Value
	n:0xF422	R/W	2	Codepage	Project Value
	n:0xF423	R/W	2	Country code	Project Value
	n:0xF424	R/W	2	PinYin EN/CN Switch	0:CN 1: EN
	n:0xF425	R	2	PIP State	(1: PIP MODE)
	n:0xF426	R	2	Touch Panel State	(1: Press Down; 0: Release)
	n:0xF427	R	2	Touch Key ID	0xFFFF
	n:0xF428	R	2	Backlight Level	Project Value

note:

*1. SFR for Smart LCD MODBUS can be access form any page

*2. The Host may issue a command to Command SFR (address 0xF000). The SMART LCD will interpret the command and execute it.

*3. When 0x0000 read from the Command SFR (address 0xF000) it means that the previous command was executed and the SMART LCD is ready for a next command.

SFR Details

Command SFR (n:0xF000)

When written Command SFR with a command code, it may trigger a special command using the values stored in one or multiple other SFRs. See the SFR Commands section for details and examples.

VP Page SFR (n:0xF001)

When written VP Page SFR, it will select the specific page for any subsequent memory access within the Modbus address range of n:0x0000 … n:0xEFFF.

SFR	SFR Address	Descriptions
Modbus VP Page	n:0xF001	read/write SFR Power on value 0x0004 value=0x0000:Access VP_STR data area value=0x0001:Access VP_N32 and TIMER COUNTER data areas value=0x0002:Access VP_BMP data area value=0x0003:Access VP_G16 data area value=0x0004:Access VP_N16 data area value=0x0005:Access VP_Flash data area value=0x0006:Access VP_N64 data area

Example Frame (device id = 01, read from the SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F0 01 00 01 E6 CA	read the Modbus VP Page
2	RX	01 03 02 00 04 B9 87	Report to host that Modbus VP Page=4

Example Frame (device id = 01, write to the SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F0 01 00 01 2A CA	set the Modbus VP Page to 1
2	RX	01 06 F0 01 00 01 2A CA

Touch Panel XY Position & State SFRs (n:0xF300, n:0xF301, n:0xF426)

The SMART LCD allows the host to read its current touch panel pen position. For this purpose, the host may poll via Modbus the 4 Byte TP_XY_Position Register, which is located in the Special Function Register Area.

SFR	SFR Address	Descriptions
TP position X	n:0xF300	Read-Only SFR Power on value 0x0000 pen down X range will be 0x0000 (left) … 0x031F (right) pen up, keep the previous pen down value
TP position Y	n:0xF301	Read-Only SFR Power on value 0x0000 pen down Y range will be 0x0000 (up) … 0x01DF (down) pen up, keep the previous pen down value
TP State	n:0xF426	Read Only SFR On pen up Status will be 0x0000 (default) On pen down State will be 0x0001

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F3 00 00 02 F7 4F	Read TP position SFR (X&Y)
2	RX	01 03 04 01 7E 01 54 9B B8	Report back to host X=017E; Y=0154

Display Page ID SFR (n:0xF400)

The SMART LCD allows the host to read the Display Page now showing on screen.

SFR	SFR Address	Descriptions
Display Page	n:0xF4000	Read Only SFR Can be assign value by using display_page (0x0070) command

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 00 00 01 B6 3A	Read Display Page ID
2	RX	01 03 02 00 01 79 84	Report to host that the Display Page ID = 0x0001

MODBUS Slave Address SFR (n:0xF401)

The SMART LCD allows the host to read the MODBUS Device Address. (It may use as a handshake)

SFR	SFR Address	Descriptions
MODBUS Slave Address	n:0xF401	Read Only SFR value ranges 1 to 247

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 01 00 01 E7 FA	Read MODBUS Device Address
2	RX	01 03 02 00 01 79 84	Report to host that MODBUS Device Address = 01

Backlight Level SFR (n:0xF403)

The SMART LCD allows the host to read the Backlight Level.

SFR	SFR Address	Descriptions
Backlight Level	n:0xF403	Read Only SFR Can be assign value by using backlight_ctrl (0x005F) command

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 03 00 01 46 3A	Read Backlight Level
2	RX	01 03 02 00 20 B9 9C	Report to host that the Backlight Level = 0x0002

Screen Saver Backlight Level SFR (n:0xF404)

The SMART LCD allows the host to read the Screen Saver Backlight Level.

SFR	SFR Address	Descriptions
Screen Saver Backlight Level	n:0xF404	Read Only SFR Can be assign value by using screen_saver_on (0x00A0) command

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 04 00 01 F7 FB	Read Screen Saver Backlight Level
2	RX	01 03 02 00 05 78 47	Report to host that the Screen Saver Backlight level = 0x0005

Screen Saver Time SFR (n:0xF405)

The SMART LCD allows the host to read the Screen Saver Time.

SFR	SFR Address	Descriptions
Screen Saver Time	n:0xF405	Read Only SFR Can be assign value by using screen_saver_on (0x00A0) command

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 05 00 01 A6 3B	Read Screen Saver Time
2	RX	01 03 02 00 05 78 47	Report to host that the Screen Saver Time = 0x0005

Buzzer Key Click Time SFR (n:0xF406)

The SMART LCD allows the host to read the Buzzer Key Click Time.

SFR	SFR Address	Descriptions
Buzzer Key Click Time	n:0xF406	Read Only SFR Can be assign value by using buzzer_ctrl (0x0079) command

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 06 00 01 56 3B	Read Buzzer Key Click
2	RX	01 03 02 00 12 38 49	Report to host that the Buzzer Key Click Time = 0x0012

Buzzer Sound Time SFR (n:0xF40B)

The SMART LCD allows the host to read the Buzzer Sound Time.

SFR	SFR Address	Descriptions
Buzzer Sound Time	n:0xF40B	Read Only SFR Can be assign value by using buzzer_beep (0x0080) command

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 0B 00 01 C7 F8	Read Buzzer Sound Time
2	RX	01 03 02 00 12 38 49	Report to host that the Buzzer Sound Time = 0x0012

Timers Control SFR (n:0xF410 ... n:0xF417)

The SMART LCD provide eight 32-Bit timers, which can be used by GUI and host. The timers located within the VP_N32 area. Each Timer has got a Timer Count Register and a corresponding SFR, Timer Control Register for starting, stopping and setting the counting direction of the timers.

All Timers are counting in 1s steps.

n	Timer n Control SFR Address	Descriptions	Timer n MODBUS Address	Note
0	n:0xF410	read/write SFR value=0x0000 : Timer stop value=0x0001 : Timer counting down to 0x00000000 value=0x0003 : Timer counting up to 0x7FFFFFFF	1:0x7FF0	Timer are located in MODBUS PAGE=1 it could be access via UI in VP_N32 area
1	n:0xF411		1:0x7FF2
2	n:0xF412		1:0x7FF4
3	n:0xF413		1:0x7FF6
4	n:0xF414		1:0x7FF8
5	n:0xF415		1:0x7FFA
6	n:0xF416		1:0x7FFC
7	n:0xF417		1:0x7FFE

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 10 00 03 FA 3E	Set the Timer 0 Control SFR of Timer 0 as count up mode
2	RX	01 06 F4 10 00 03 FA 3E
3	TX	01 06 F0 01 00 01 2A CA	Select MODBUS PAGE1
4	RX	01 06 F0 01 00 01 2A CA
5	TX	01 03 7F F0 00 02 DD EC	Read the Timer 0
6	RX	01 03 04 00 63 00 00 0A 2D	Report the Timer register value back to the host

Screen Saver Time1 SFR (n:0xF420)

The SMART LCD allows the host to modify the screen saver delay time. The register value can be changed under delay 2 in project settings

SFR	SFR Address	Descriptions
Screen Saver Time1	n:0xF420	read/write SFR values range 0x0001... 0xFFFF SFR value high byte corresponding to system register 0xFFFF25 SFR value low byte corresponding to system register 0xFFFF26

Example Frame (device id = 01, write to the SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 20 00 05 7A 33	Set the Screen Saver Time to 0005 seconds
2	RX	01 06 F4 20 00 05 7A 33

Screen Saver Page Jump ID SFR (n:0xF421)

The SMART LCD allows the host to change the page ID of the screen saver in run time which normally assigned in the page jump option in project settings.

SFR	SFR Address	Descriptions
Screen Saver Page JUMP ID	n:0xF421	read/write SFR values range 0x0000 ... 0x03E7 SFR's high byte corresponding to system register 0xFFFF23 SFR's low byte corresponding to system register 0xFFFF24

Example Frame (device id = 01, write to the SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 21 00 01 2A 30	change the screen saver page jump ID to 0001
2	RX	01 06 F4 21 00 01 2A 30

Code page SFR (n:0xF422)

The SMART LCD allows the host to modify the project code page. It alters the code page preset in project settings.

SFR	SFR Address	Descriptions
Code Page SFR	n:0xF422	read/write SFR values range 0x0001... 0x0016 SFR corresponds to the system registers 0xFFFF30

Example Frame (device id = 01, write to the SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 22 00 01 DA 30	change the Code page to 0001 (437(OEM United States))
2	RX	01 06 F4 22 00 01 DA 30

Country Code SFR (n:0xF423)

The SMART LCD allows the host to modify the country code. It alters the country code preset in project settings

SFR	SFR Address	Descriptions
Country Code SFR	n:0xF423	read/write SFR values range 0x0001... 0x000B SFR corresponding to system register 0xFFFF31

Example Frame (device id = 01, write to the SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 23 00 01 8B F0	change the Country Code to 0001 (USA)
2	RX	01 06 F4 23 00 01 8B F0

PinYin SFR (n:0xF424)

The SMART LCD allows host to modify the PIP PinYin keyboard input method

SFR	SFR Address	Descriptions
PinYin SFR	n:0xF424	read/write SFR SFR=0: PinYin keyboard using Chinese input method SFR=1: PinYin keyboard use English input method

Example Frame (device id = 01, write to the SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 24 00 00 FB F1	set the PinYin Keyboard as Chines input method
2	RX	01 06 F4 24 00 00 FB F1

PIP Status SFR (n:0xF425)

The SMART LCD allows the host to read the PIP keyboard status.

SFR	SFR Address	Descriptions
PIP Status SFR	n:0xF425	Read-Only SFR SFR=0: normal SFR=1; while the PIP keyboard is called

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 25 00 01 A7 F1	read the PIP status
2	RX	01 03 02 00 01 79 84	Report to host that the PIP keyboard is called

Touch Key ID SFR (n:0xF427)

The SMART LCD allows the host to read the Touch Key ID number when the touch key is pressed

SFR	SFR Address	Descriptions
Touch Key ID SFR	n:0xF427	Read-Only SFR Power on default value is 65535 give the last touched Touch Key ID

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 27 00 01 06 31	read the Touch Key ID
2	RX	01 03 02 00 0A 38 43	Report to host that last touched Touch Key ID=000A

Backlight Level SFR (n:0xF428)

The SMART LCD allows the host to read the current backlight brightness

SFR	SFR Address	Descriptions
Backlight Level SFR	n:0xF428	Read-Only SFR valual ranges 0 to 63 SFR corresponding to system register 0xFFFF29

Example Frame (device id = 01, read form SFR)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 03 F4 28 00 01 36 32	read the Backlight Level
2	RX	01 03 02 00 3F F8 54	Report to host that backlight level 003F

SFR Commands

Command List

Command Code	Command Name	Descriptions
0x0070	disp_page	Display a pre-stored TML file (page)
0x005F	backlight_ctrl	Set backlight brightness level
0x00A0	screen_saver_on	Set Screen Saver parameters
0x00A1	screen_saver_off	Disable Screen Saver
0x0079	buzzer_ctrl	Set Buzzer Key Click Parameters
0x0080	buzzer_beep	Sound Buzzer once
0x009C	RTC_set	Set the RTC
0x00E0	set_baudrate	Set RS485 Baud Rate
0x00E1	sel_project	Set active project folder
0x00E2	u_drv_format	Format File System
0x00E3	u_drv_unlock	Unlock File System for USB Access with pre-stored password
0x0088	self_test	Starts Self-Test
0x0000	NOP	No Operation / No Command to execute

SFR Command Details

disp_page (0x0070)

This command allows the host to dictate the GUI to show a particular page.

Seq	SFR	SFR Address	Values	Descriptions
1	Page ID SFR	n:0xF400	0x0000 … 0x03E7	Read Access to register 0xF400 will allow give the currently displaying Page ID Write Access to register 0xF400 will preset a new page ID going to display. at this moment reading from 0xF400 will still displaying page ID. It will be updated until command 0x0070 was successfully executed.
2	Command SFR	n:0xF000	0x0070	disp_page Command code

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 00 00 01 7A 3A	set the Page ID SFR
2	RX	01 06 F4 00 00 01 7A 3A
3	TX`	01 06 F0 00 00 70 BB 2E	execute disp_page command
4	RX	01 06 F0 00 00 70 BB 2E

backlight_ctrl (0x005F)

This command allows the host to dim the LCD backlight of the SMART LCD in a range from 0 … 63 levels.

Seq	SFR	SFR Address	Valid Data Values	Descriptions
1	Backlight Level SFR	n:0xF403	0x0000 … 0x003F	Select Backlight Level (0 … 63)
2	Command SFR	n:0xF000	0x005F	backlight_ctrl Command code

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 03 00 20 4A 22	set the backlight level
2	RX	01 06 F4 03 00 20 4A 22
3	TX`	01 06 F0 00 00 5F FA F2	execute backlight_ctrl command
4	RX	01 06 F0 00 00 5F FA F2

screen_saver_on (0x00A0)

This command allows the host to enable the Screensaver of the SMART LCD.

Seq	SFR	SFR Address	Valid Data Values	Descriptions
1	Screen Saver Backlight Level SFR	n:0xF404	0x0000 … 0x003F	Set the Level
2	Screen Saver Time SFR	n:0xF405	0x0001 … 0xFFFF	Set the Time (in seconds)
3	Command SFR	n:0xF000	0x00A0	screen_saver_on Command code

Note:

1. This command will only enable the Screensaver and not immediately switch to the Screen Saver mode. The Screensaver Mode will only be entered after the Screen Saver Timer is expired and no touch panel events were noticed.

2. Select Screen Saver Backlight Level must be less than Backlight Level.

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 04 00 05 3A 38	set the Screen Saver Backlight Level
2	RX	01 06 F4 04 00 05 3A 38
3	TX`	01 06 F4 05 00 05 6B F8	Set the Screen Saver Time
4	RX	01 06 F4 05 00 05 6B F8
5	TX	01 06 F0 00 00 A0 BA B2	execute screen_saver_on Command code
6	RX	01 06 F0 00 00 A0 BA B2

screen_saver_off (0x00A1)

This command allows the host to disable the Screensaver of the SMART LCD.

Seq	SFR	SFR Address	Valid Data Values	Descriptions
1	Command SFR	n:0xF000	0x00A1	screen_saver_off Command code

Note: In case the SMART LCD is operating in the Screen Saver Mode while the command is issued, it will be immediately leaving this mode, restore normal backlight and keep the Screen Saver disabled.

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F0 00 00 A1 7B 72	execute screen_saver_off Command code
2	RX	01 06 F0 00 00 A1 7B 72

buzzer_ctrl (0x0079)

This command allows the host to adjust the general timing of the SMART LCD’s buzzer used for key clicks.

Seq	SFR	SFR Address	Valid Data Values	Descriptions
1	Buzzer Key Click Time SFR	n:0xF406	0x0000 … 0x003F	value unit is 10ms 0x0000 would disable the key click
2	Command SFR	n:0xF000	0x0079	buzzer_ctrl Command code

Note: This command will not start any sounding of the buzzer. It just sets the parameters used for the SMART LCD key click.

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 06 00 12 DB F6	set the Time
2	RX	01 06 F4 06 00 12 DB F6
3	TX	01 06 F0 00 00 79 7B 28	execute buzzer_ctrl Command code
4	RX	01 06 F0 00 00 79 7B 28

buzzer_beep (0x0080)

This command allows the host to sound the buzzer of the SMART LCD once for a desired period of time.

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	Buzzer Sound Time SFR	n:0xF40B	0x0000 … 0xFFFF	set the time, value unit is 10ms
2	Command SFR	n:0xF000	0x0080	buzzer_beep Command code

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 0B 00 12 4A 35	set the Time
2	RX	01 06 F4 0B 00 12 4A 35
3	TX	01 06 F0 00 00 80 BB 6A	execute buzzer_beep Command code
4	RX	01 06 F0 00 00 80 BB 6A

RTC_set (0x009C)

This command allows the host to write the Real Time Clock of the SMART LCD.

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	RTC_NOW SFR	n:0xF408	0xYYMMDDHHmmss	Preset New Date and Time using one 3 Word / 6 Byte YY=00…99; MM=01…12; DD=01…31; HH=00…23; mm=00…59; ss=00…59; 3word (6 byte); Only decimal Digits!
2	Command SFR	n:0xF000	0x009C	RTC_set Command code

Note: To set date and time use one single Modbus command with function code 0x10 and 6 Bytes of data.

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 10 F4 08 00 03 06 10 03 0A 08 08 08 B3 D5	set the RTC 2016-03-10 08:08:08
2	RX	01 10 F4 08 00 03 33 FA
3	TX	01 06 F0 00 00 9C BA A3	execute RTC_set Command code
4	RX	01 06 F0 00 00 9C BA A3

baudrate_set (0x00E0)

This command allows the host to modify the baud rate of the RS485 port.

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	baud rate SFR	n:0xF402	0x0000 … 0x0007	Select new Baud Rate: 0x0000: 1200 baud 0x0001: 2400 baud 0x0002: 4800 baud 0x0003: 9600 baud 0x0004: 19200 baud 0x0005: 38400 baud 0x0006: 57600 baud 0x0007: 115200 baud
2	Command SFR	n:0xF000	0x00E0	baudrate_set Command code

Note: After setting the new baud rate the SMART LCD will still acknowledge with the previous baud rate. Any subsequent communication will use the new baud rate.

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 02 00 03 5A 3B	select the RS485 baud rate as 9600 baud
2	RX	01 06 F4 02 00 03 5A 3B
3	TX	01 06 F0 00 00 E0 BB 42	execute baudrate_set Command code
4	RX	01 06 F0 00 00 E0 BB 42

project_sel (0x00E1)

This command allows the host to select one of the project to be display.

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	Project ID SFR	n:0xF00A	0x0000 … 0x0009	Select a Project: 0x0000: THMT 0x0001: THMT01 … 0x0009: THMT09
2	Command SFR	n:0xF000	0x00E1	project_sel Command code

Note:

Make sure the project folder selected exist.

If the selected project is the same as the current project, issuing the Set Active Project Command will cause the restart of the project from it’s start page.

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F0 0A 00 01 5B 08	select the THMT01 to be display
2	RX	01 06 F0 0A 00 01 5B 08
3	TX	01 06 F0 00 00 E1 7A 82	execute project_sel Command code
4	RX	01 06 F0 00 00 E1 7A 82

u_drv_format (0x00E2)

This command allows the host to format the file system of the SMART LCD.

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	Enable Format SFR	n:0xF40D	0xAAAA	Only 0xAAAA for Enables Format capability (format will be carry after the u_drv_format command)
2	Command SFR	n:0xF000	0x00E2	u_drv_format Command code

Note: All GUI project data will be lost after formatting the file system. The USB File Access will be enabled again in case it was locked by a password before. After the format the Enable Format SFR will be reset to 0x0000

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 0D AA AA D4 E6	put specific 0xAAAA for Enable Format capability
2	RX	01 06 F4 0D AA AA D4 E6
3	TX	01 06 F0 00 00 E2 3A 83	u_drv_format Command code
4	RX	01 06 F0 00 00 E2 3A 83

u_drv_unlock (0x00E3)

This command allows the host to unlock the USB access of the file system of the SMART LCD.

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	USB Password Buffer SFR	n:0xF200	128byte(max)	data depends on the password length and end with 0x00 (add-on 0x00 for 16bit alignment if necessary) (format will be carry after the u_drv_unlock command)
2	Command SFR	n:0xF000	0x00E3	u_drv_format Command code

Notes:

• The 128 Byte reference password can be set within the project in TOPWAY’s SGTools and is stored within the project files.
• Formatting the File System will erase the project files including the password and unlock the File System for USB access
• It is allowed to use multiple Modbus Write Commands to set the password buffer
• The password buffer is Write Only. Attempting to read it via Modbus will result in a Modbus Error

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 10 F2 00 00 04 08 4F 54 57 50 59 41 00 00 2F 1F	password is "TOPWAY", 0x00(as string end), 0x00(for 16bit alignment)
2	RX	01 10 F2 00 00 04 F3 72
3	TX	01 06 F0 00 00 E3 FB 43	u_drv_unlock Command code
4	RX	01 06 F0 00 00 E3 FB 43

touch_calib (0x00E4)

This command allows the host to enable touch panel calibration of the SMART LCD (RTP only .

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	Enable Touch Panel Calibration SFR	n:0xF40E	0xA5A5	put specific 0xA5A5 for enable touch panel calibration
2	Command SFR	n:0xF000	0x00E4	touch_calib Command code

Note: Keep pressing the top right comer of touch panel (RTP) during power on, could also trigger the touch_calib function.

Example Frame (device id = 01)

Seq	dir	MODBUS Communication Frame	Descriptions
1	TX	01 06 F4 0E A5 A5 61 12	put specific 0xA5A5 for enable touch panel calibration (calibration will be carry after the touch_calib command)
2	RX	01 06 F4 0E A5 A5 61 12
3	TX	01 06 F0 00 00 E4 BA 81	touch_calib Command code
4	RX	01 06 F0 00 00 E4 BA 81

self_check (0x0088)

This command allows the host to initiate the self-test mode of the SMART LCD.

Seq	SFR	Modbus Address	Valid Data Values	Descriptions
1	enable self-test SFR	n:0xF40C	0x5555	put specific 0x5555 for the enable self test (self check will be carry after the self_check command)
2	Command SFR	n:0xF000	0x0088	self_check Command code

Note: After the self-test is executed the Enable Buffer will be reset to 0x0000

Example Frame (device id = 01)