MODBUS Slave Protocol
Smart LCD MODBUS Salve Product can be accessed by MODBUS Master devices for real-time control and access.
Basic
MODBUS Communication
The MODBUS is a standard protocol (with RTU or ASCII mode) which is used to communicate between a host and one or multiple slave devices. Over the MODBUS the host is able to communicate with up to 254 slaves. It can read or write data areas on these devices.
The SMART LCD Slave Product works as a slave device in RTU mode. Therefore, we only describe the RTU mode within this document.
General MODBUS Frame consists: - 1byte of Device Address, to indicate which slave device shall response - 1byte of Function Code, to tell the addressed slave which function is going to do - Data content for PAGE, Addresses and data values - 2-Byte CRC for Error Checking
| < - - - - - - - - - - - - - - - - - - - - - - - - - ADU - - - - - - - - - - - - - - - - - - - - - - - - - > | |||
|---|---|---|---|
Device Address (1byte) |
Function Code (1byte) |
Data (252bytes(max.)) |
Error Check (2bytes) |
| < - - - - - - - - - - PDU - - - - - - - - - - > | |||
When the host receives the previous frame reply from the slave device, the host needs an interval of 5ms before it can continue to send the next frame command. Since the SMART LCD is a Modbus slave device, a Device Address must be assigned to it. Device address can be assigned in the TOPWAY’s SGTools.
MODBUS Function Codes
| MODBUS Function Code | Function Definition | Address Range | Object Type |
| 0x03 | Read Multiple Holding Registers | 0x0000 ~ 0xFFFF | 2 Bytes |
| 0x06 | Write Single Holding Register | 0x0000 ~ 0xFFFF | 2 Bytes |
| 0x10 | Write Multiple Holding Registers | 0x0000 ~ 0xFFFF | 2 Bytes |
| 0x11 | Report Slave ID | ||
| 0x14 | Read File Record | 1 File with 2048 Records of 128 Byte | |
MODUBS Address Mapping
To access memory locations in the SMART LCD the host has to issue a Read or Write function, which includes a specific address. Each Read or Write function accesses a 2-Byte location within an area of up to 64k words. Since the multiple data areas (N16, N32, N64, etc.) are together larger than 64k Words, the different memory areas are separated into pages. To select a specific page the Modbus Page Map Register must be written with the page number. The Page Map Register is located within the set of Special Function Registers. The Special Function Registers (SFR) are accessible on all pages at the same location. They are placed within the final 4k words of all pages.
In SGTools, MENU --> View --> Show Modbus Holding Register Address can show up the VPs corresponding MODBUS ADDRESS for the display UI.
Relationship between MODBUS PAGE:addresses and the SMART LCD VPs
| VP type | SMART LCD VP Address | MODBUS PAGE: Address | note |
| VP_STR | 0x000000, 0x000080 - 0x01DF80 | 0:0x0000, 0:0x0040 - 0:0xEFC0 | |
| VP_N32 | 0x020000, 0x020004 - 0x02FFDC | 1:0x0000, 1:0x0002 - 1:0x7FEE | |
| TIMER COUNTER | 0x02FFE0, 0x02FFE4 - 0x02FFFC | 1:0x7FF0, 1:0x7FF2 - 1:0x7FFE | Timer 0, Timer 1 - Timer 7 |
| VP_N64 | 0x030000, 0x030008 - 0x03FFF8 | 6:0x0000, 6:0x0004 - 6:0x7FFC | |
| VP_N16 | 0x080000, 0x080002 - 0x08FFFE | 4:0x0000 - 4:0x7FFF | |
| VP_BMP | 0x040000 - 0x05DFFE | 2:0x0000 - 2:0xEFFF | |
| VP_G16 | 0x060000 - 0x06EFFF | 3:0x0000 - 3:0xEFFF | |
| VP_Flash | 120kB Flash memory | 5:0x0000 - 5:0xEFFF | remain unchanged even after power down |
| VP_REG | 0xFFF000 - 0xFFFFFF | -- | VP_Reg can not be accessed directly via MODBUS |
| SFR | -- | n:0xF000 - n:0xFFFF | SFR for Smart LCD MODBUS PAGE and some of the VP_REG functions |
MODBUS Function Codes Details
The SMART LCD supports five MODBUS Functions Codes: 0x03, 0x06, 0x10, 0x11, 0x14
Function Code 0x03 - “Read Multiple Holding Registers”
This function code read up to 250 Bytes from the SMART LCD.
Host to Smart LCD MODBUS Frame
| Byte Seq | Content | No. of Byte | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Function Code | 1 | 0x03 | |
| 2 | Start Address to be read | 2 | 0x0000 … 0xFFFF | Address location that MODBUS PAGE assigned via SFR |
| 4 | Quantity of data | 2 | 0x0001 … 0x007D | no. of 16 Bit data values to be read |
| 6 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
SMART LCD reply to host
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Function Code | 1 | 0x03 | |
| 4 | Byte Count N | 1 | 0x02 … 0xFA | must be an even number, must be double of the requested "Quantity of data" in16 Bit values |
| 6 | N Bytes of data | N | 0x00 … 0xFF | |
| 6 + N | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
SMART LCD reply to host (in case of error found)
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Error Code | 1 | 0x83 | |
| 2 | Exception Code | 1 | 0x01 ... 0x04 | 01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure |
| 3 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
Example Frame (Read a VP_N32 value form Smart LCD (device address = 01))
| Seq | dir | MODBUS Communication Frame | Descriptions |
| 1 | TX | 01 06 F0 01 00 01 2A CA | Set the Smart LCD MODBUS PAGE =1; omit this frame for continue access the same PAGE |
| 2 | RX | 01 06 F0 01 00 01 2A CA | |
| 3 | TX | 01 03 00 00 00 02 C4 0B | Read multiple data form address 00 00, and get 00 02 16bit values |
| 4 | RX | 01 03 04 33 44 11 22 39 2B | no. of byte =04; Data value = 0x11223344 |
Function Code 0x06 - “Write Single Holding Register”
This function code write 2 Bytes to the SMART LCD.
Host send to Smart LCD MODBUS frame
| Byte Seq | Content | No. of Byte | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | 0x00 is a broadcast message to all devices |
| 1 | Function Code | 1 | 0x06 | |
| 2 | Address to be writen | 2 | 0x0000 … 0xFFFF | Address location that MODBUS PAGE assigned via SFR |
| 4 | Data value | 2 | 0x0001 … 0x007D | 16 Bit data values to be written |
| 6 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
SMART LCD reply to host
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Function Code | 1 | 0x06 | |
| 2 | Address wrote | 1 | 0x02 … 0xFA | must be an even number, must be double of the requested "Quantity of data" in16 Bit values |
| 4 | Data value | 2 | 0x0001 … 0x007D | 16 Bit data value wrote |
| 6 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
SMART LCD reply to host (in case of error found)
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Error Code | 1 | 0x86 | |
| 2 | Exception Code | 1 | 0x01 ... 0x04 | 01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure |
| 3 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
Example Frame (Write a VP_N16 value to Smart LCD (device address = 01))
| Seq | dir | MODBUS Communication Frame | Descriptions |
| 1 | TX | 01 06 F0 01 00 04 EA C9 | Set the Smart LCD MODBUS PAGE =4; omit this frame for continue access the same PAGE |
| 2 | RX | 01 06 F0 01 00 04 EA C9 | |
| 3 | TX | 01 06 00 00 12 34 84 BD | Write a data 12 34 to address 00 00 |
| 4 | RX | 01 06 00 00 12 34 84 BD |
TX=host to Smart LCD; RX=Smart LCD reply to host
Function Code 0x10 - “Write Multiple Holding Registers”
This function code write up to 246 Bytes to the SMART LCD.
Host send to Smart LCD MODBUS frame
| Byte Seq | Content | No. of Byte | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | 0x00 is a broadcast message to all devices |
| 1 | Function Code | 1 | 0x10 | |
| 2 | Start Address to be write | 2 | 0x0000 … 0xFFFF | Address location that MODBUS PAGE assigned via SFR |
| 4 | Quantity of data (Q) | 2 | 0x0001 … 0x007B | no. of 16 Bit data values to be written |
| 6 | Byte Count | 1 | 0x02 … 0xF6 | must be an even number and exactly the double of Q |
| 7 | Data to be written | 2 x Q | 0x0000 ... 0xFFFF | |
| 7 + Q | CRC | 2 | 0x0000 ... 0xFFFF | for error checking |
SMART LCD reply to host
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Function Code | 1 | 0x10 | |
| 2 | Start Address wrote | 2 | 0x0000 … 0xFFFF | Address location that MODBUS PAGE assigned via SFR |
| 4 | Quantity of data worte | 2 | 0x0001 … 0x007B | no. of 16 Bit data values wrote |
| 6 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
SMART LCD reply to host (in case of error found)
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Error Code | 1 | 0x90 | |
| 2 | Exception Code | 1 | 0x01 ... 0x04 | 01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure |
| 3 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
Example Frame (Write two VP_N16 value to Smart LCD (device address = 01))
| Seq | dir | MODBUS Communication Frame | Descriptions |
| 1 | TX | 01 06 F0 01 00 04 EA C9 | Set the Smart LCD MODBUS PAGE =4; omit this frame for continue access the same PAGE |
| 2 | RX | 01 06 F0 01 00 04 EA C9 | |
| 3 | TX | 01 10 00 00 00 02 04 56 78 12 34 06 68 | Write two 16bit data 12 34 and 56 78 to address 00 00 |
| 4 | RX | 01 10 00 00 00 02 41 C8 |
TX=host to Smart LCD; RX=Smart LCD reply to host
Function Code 0x11 - "Report Slave ID"
This function code allows the host to check some slave device information like device name and revision. Additional there is one byte indicating the current operational status of the slave device, called the Run Indicator Status. The SMART LCD will always set this byte to 0xFF (Powered On)
Host send to Smart LCD MODBUS frame
| Byte Seq | Content | No. of Byte | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Function Code | 1 | 0x11 | |
| 2 | CRC | 2 | 0x0000 ... 0xFFFF | for error checking |
SMART LCD reply to host
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Function Code | 1 | 0x11 | |
| 2 | Byte Count | 1 | 0x01 ... 0xF9 | byte count of all the following data except CRC |
| 3 | Slave ID | n | 0x00 ... 0xFF | in ASCII (e.g. SMART LCD V1.03) |
| 3 + n | Run Indicator Status | 1 | 0xFF | 0xFF for Powered On |
| 3 + n + 1 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
SMART LCD reply to host (in case of error found)
| Byte Seq | Content | Byte Count | Valid Range | note |
| 0 | MODBUS Device Address | 1 | 0x01 … 0xF7 | |
| 1 | Error Code | 1 | 0x91 | |
| 2 | Exception Code | 1 | 0x01, 0x04 | 01=Illegal Functrion; 04=SlaveDeviceFailure |
| 3 | CRC | 2 | 0x0000 … 0xFFFF | for error checking |
Example Frame (Ask for Slave ID of Smart LCD (device id = 01))
| Seq | dir | MODBUS Communication Frame | Descriptions |
| 1 | TX | 01 11 C0 2C | |
| 2 | RX | 01 11 11 48 4D 54 30 37 30 43 4E 2D 43 20 56 31 2E 30 33 FF 29 30 | Slave ID is “SMART LCD V1.03” |
TX=host to Smart LCD; RX=Smart LCD reply to host
Modbus Error Codes Details
In case the SMART LCD receives a command with invalid data, invalid data count or an unsupported function code it will return an error code to the host (Returning the same function code with an additional Bit7 set). Additional it will transfer one of four possible exemption codes to indicate to the host what kind of error occurred
| Code | Exemption Name | Descriptions |
| 0x01 | ILLEGAL FUNCTION | The function code is not supported by the SMART LCD |
| 0x02 | ILLEGAL DATA ADDRESS | The data address by the SMART LCD falls into a undefined area. |
| 0x03 | ILLEGAL DATA VALUE | A data value received by the SMART LCD is not valid. It does not fit to the specific range requirements for the particular address. |
| 0x04 | SLAVE DEVICE FAILURE | An unrecoverable error occurred while the SMART LCD was attempting to perform the requested action. |
Accessing the Smart LCD
To access data the host should do following steps using the Modbus protocol:
- Use “Write Single Holding Register” with function code (0x06) to address 0xF001 and the data value of the desired memory page (0x01 … 0x05)
- Write to or read from the desired address within the selected page with: “Read Multiple Holding Registers” with function code (0x03) “Write Single Holding Register” with function code (0x06) "Write Multiple Holding Registers” with function code (0x10)
Each Modbus address holds 16 Bit of data. Therefore, it might be necessary to read multiple address locations:
- STR, up to 64 consecutive accesses might be necessary to read an entire string, One single access will manipulate two characters.
- N16, just one access is necessary to access one N16 variable. Multiple N16 variables might be accessed with a single Modbus command.
- N32, two accesses are necessary to access one N32 variable. Multiple N32 variables might be accessed with a single Modbus command.
- N64, four accesses are necessary to access one N64 variable. Multiple N64 variables might be accessed with a single Modbus command.
- Bitmap, one access can manipulate 16 pixels of a bitmap variable. Multiple pixels might be accessed with a single Modbus command.
- Graph, one access can manipulate one data point of a graph. Multiple data points might be accessed with a single Modbus command.
“Read Multiple Holding Registers” with function code (0x03) allows accessing of up to 125 consecutive address locations at once, with each location holding two Bytes of data.
“Write Multiple Holding Registers” with function code (0x10) allows accessing of up to 123 consecutive address locations at once, with each location holding two Bytes of data.
Access to the Special Function Registers, which are mapped to all pages, should not exceed the required Byte count assigned to each SFR. In such a case the SMART LCD would reply the host with an error message.
Note: Since the Modbus protocol uses a “Big-Endian” representation of data, the first Byte of each 16 Bit word represents the upper 8 Bit of the data word. In contrary the memory organization of the SMART LCD is “Little-Endian” requiring the host to swap upper and lower Byte of each transaction.
