MODBUS Slave Protocol

From Smart LCD

Smart LCD MODBUS Salve Product can be accessed by MODBUS Master devices for real-time control and access.

Basic

MODBUS Communication

The MODBUS is a standard protocol (with RTU or ASCII mode) which is used to communicate between a host and one or multiple slave devices. Over the MODBUS the host is able to communicate with up to 254 slaves. It can read or write data areas on these devices.

The SMART LCD Slave Product works as a slave device in RTU mode. Therefore, we only describe the RTU mode within this document. 

General MODBUS Frame consists:
- 1byte of Device Address, to indicate which slave device shall response
- 1byte of Function Code, to tell the addressed slave which function is going to do
- Data content for PAGE, Addresses and data values
- 2-Byte CRC for Error Checking
< - - - - - - - - - - - - - - - - - - - - - - - - - ADU - - - - - - - - - - - - - - - - - - - - - - - - - > 
Device Address (1byte)

Function Code (1byte)

Data (252bytes(max.))

Error Check (2bytes)
< - - - - - - - - - - PDU - - - - - - - - - - >

When the host receives the previous frame reply from the slave device, the host needs an interval of 5ms before it can continue to send the next frame command. Since the SMART LCD is a Modbus slave device, a Device Address must be assigned to it. Device address can be assigned in the TOPWAY’s SGTools.

MODBUS Function Codes

MODBUS Function Code Function Definition Address Range Object Type
0x03 Read Multiple Holding Registers 0x0000 ~ 0xFFFF 2 Bytes
0x06 Write Single Holding Register 0x0000 ~ 0xFFFF 2 Bytes
0x10 Write Multiple Holding Registers 0x0000 ~ 0xFFFF 2 Bytes
0x11 Report Slave ID
0x14 Read File Record 1 File with 2048 Records of 128 Byte

MODUBS Address and Mapping with Smart LCD

To access memory locations in the SMART LCD the host has to issue a Read or Write function, which includes a specific address. Each Read or Write function accesses a 2-Byte location within an area of up to 64k words. Since the multiple data areas (N16, N32, N64, etc.) are together larger than 64k Words, the different memory areas are separated into pages. To select a specific page the Modbus Page Map Register must be written with the page number. The Page Map Register is located within the set of Special Function Registers. The Special Function Registers (SFR) are accessible on all pages at the same location. They are placed within the final 4k words of all pages.

In SGTools, MENU --> View --> Show Modbus Holding Register Address can show up the VPs corresponding MODBUS ADDRESS for the display UI.

Relationship between MODBUS PAGE:addresses and the SMART LCD VPs

VP type SMART LCD VP Address MODBUS PAGE: Address note
VP_STR 0x000000, 0x000080 - 0x01DF80 0:0x0000, 0:0x0040 - 0:0xEFC0
VP_N32 0x020000, 0x020004 - 0x02FFDC 1:0x0000, 1:0x0002 - 1:0x7FEE
TIMER COUNTER 0x02FFE0, 0x02FFE4 - 0x02FFFC 1:0x7FF0, 1:0x7FF2 - 1:0x7FFE Timer 0, Timer 1 - Timer 7
VP_N64 0x030000, 0x030008 - 0x03FFF8 6:0x0000, 6:0x0004 - 6:0x7FFC
VP_N16 0x080000, 0x080002 - 0x08FFFE 4:0x0000 - 4:0x7FFF
VP_BMP 0x040000 - 0x05DFFE 2:0x0000 - 2:0xEFFF
VP_G16 0x060000 - 0x06EFFF 3:0x0000 - 3:0xEFFF
VP_Flash 120kB Flash memory 5:0x0000 - 5:0xEFFF remain unchanged even after power down
VP_REG 0xFFF000 - 0xFFFFFF -- VP_Reg can not be accessed directly via MODBUS
SFR -- n:0xF000 - n:0xFFFF SFR for Smart LCD MODBUS can be access form any page

it also for some of the VP_REG functions

MODBUS Function Codes Details

The SMART LCD supports five MODBUS Functions Codes: 0x03, 0x06, 0x10, 0x11, 0x14

Function Code 0x03 - “Read Multiple Holding Registers”

This function code read up to 250 Bytes from the SMART LCD.

Host sto Smart LCD MODBUS Frame

Byte Seq Content No. of Byte Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x03
2 Start Address to be read 2 0x0000 … 0xFFFF Address location that MODBUS PAGE assigned via SFR
4 Quantity of data 2 0x0001 … 0x007D no. of 16 Bit data values to be read
6 CRC 2 0x0000 … 0xFFFF for error checking

SMART LCD reply to host

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x03
2 Byte Count N 1 0x02 … 0xFA must be an even number, must be double of the requested "Quantity of data" in16 Bit values
3 N Bytes of data N 0x00 … 0xFF
3 + N CRC 2 0x0000 … 0xFFFF for error checking

SMART LCD reply to host (in case of error found)

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Error Code 1 0x83
2 Exception Code 1 0x01 ... 0x04 01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3 CRC 2 0x0000 … 0xFFFF for error checking

Example Frame (Read a VP_N32 value form Smart LCD (device address = 01))

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F0 01 00 01 2A CA Set the Smart LCD MODBUS PAGE =1; omit this frame for continue access the same PAGE
2 RX 01 06 F0 01 00 01 2A CA
3 TX 01 03 00 00 00 02 C4 0B Read multiple data form address 00 00, and get 00 02 16bit values
4 RX 01 03 04 33 44 11 22 39 2B no. of byte =04; Data value = 0x11223344

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x06 - “Write Single Holding Register”

This function code write 2 Bytes to the SMART LCD.

Host send to Smart LCD MODBUS frame

Byte Seq Content No. of Byte Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7 0x00 is a broadcast message to all devices
1 Function Code 1 0x06
2 Address to be writen 2 0x0000 … 0xFFFF Address location that MODBUS PAGE assigned via SFR
4 Data value 2 0x0001 … 0x007D 16 Bit data values to be written
6 CRC 2 0x0000 … 0xFFFF for error checking

SMART LCD reply to host

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x06
2 Address wrote 2 0x0000 … 0xFFFF must be an even number, must be double of the requested "Quantity of data" in16 Bit values
4 Data value 2 0x0000 … 0xFFFF 16 Bit data value wrote
6 CRC 2 0x0000 … 0xFFFF for error checking

SMART LCD reply to host (in case of error found)

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Error Code 1 0x86
2 Exception Code 1 0x01 ... 0x04 01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3 CRC 2 0x0000 … 0xFFFF for error checking

Example Frame (Write a VP_N16 value to Smart LCD (device address = 01))

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F0 01 00 04 EA C9 Set the Smart LCD MODBUS PAGE =4; omit this frame for continue access the same PAGE
2 RX 01 06 F0 01 00 04 EA C9
3 TX 01 06 00 00 12 34 84 BD Write a data 12 34 to address 00 00
4 RX 01 06 00 00 12 34 84 BD

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x10 - “Write Multiple Holding Registers”

This function code write up to 246 Bytes to the SMART LCD.

Host send to Smart LCD MODBUS frame

Byte Seq Content No. of Byte Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7 0x00 is a broadcast message to all devices
1 Function Code 1 0x10
2 Start Address to be write 2 0x0000 … 0xFFFF Address location that MODBUS PAGE assigned via SFR
4 Quantity of data (Q) 2 0x0001 … 0x007B no. of 16 Bit data values to be written
6 Byte Count 1 0x02 … 0xF6 must be an even number and exactly the double of Q
7 Data to be written 2 x Q 0x0000 ... 0xFFFF
7 + Q CRC 2 0x0000 ... 0xFFFF for error checking

SMART LCD reply to host

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x10
2 Start Address wrote 2 0x0000 … 0xFFFF Address location that MODBUS PAGE assigned via SFR
4 Quantity of data worte 2 0x0001 … 0x007B no. of 16 Bit data values wrote
6 CRC 2 0x0000 … 0xFFFF for error checking

SMART LCD reply to host (in case of error found)

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Error Code 1 0x90
2 Exception Code 1 0x01 ... 0x04 01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3 CRC 2 0x0000 … 0xFFFF for error checking

Example Frame (Write two VP_N16 value to Smart LCD (device address = 01))

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F0 01 00 04 EA C9 Set the Smart LCD MODBUS PAGE =4; omit this frame for continue access the same PAGE
2 RX 01 06 F0 01 00 04 EA C9
3 TX 01 10 00 00 00 02 04 56 78 12 34 06 68 Write two 16bit data 12 34 and 56 78 to address 00 00
4 RX 01 10 00 00 00 02 41 C8

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x11 - "Report Slave ID"

This function code allows the host to check some slave device information like device name and revision. Additional there is one byte indicating the current operational status of the slave device, called the Run Indicator Status. The SMART LCD will always set this byte to 0xFF (Powered On)

Host send to Smart LCD MODBUS frame

Byte Seq Content No. of Byte Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x11
2 CRC 2 0x0000 ... 0xFFFF for error checking

SMART LCD reply to host

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x11
2 Byte Count 1 0x01 ... 0xF9 byte count of all the following data except CRC
3 Slave ID n 0x00 ... 0xFF in ASCII (e.g. SMART LCD V1.03)
3 + n Run Indicator Status 1 0xFF 0xFF for Powered On
3 + n + 1 CRC 2 0x0000 … 0xFFFF for error checking

SMART LCD reply to host (in case of error found)

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Error Code 1 0x91
2 Exception Code 1 0x01, 0x04 01=Illegal Functrion; 04=SlaveDeviceFailure
3 CRC 2 0x0000 … 0xFFFF for error checking

Example Frame (Ask for Slave ID of Smart LCD (device id = 01))

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 11 C0 2C
2 RX 01 11 11 48 4D 54 30 37 30 43 4E 2D 43 20 56 31 2E 30 33 FF 29 30 Slave ID is “SMART LCD V1.03”

TX=host to Smart LCD; RX=Smart LCD reply to host

Function Code 0x14 - "Read File Record"

This function code allows the host to read up to 128 Byte of a special file (USR.BIN) at once. The file USR.BIN may be placed together with the TML project data into the file system of the SMART LCD and it may contain any additional data used by the host. The file size of USR.BIN may be up to 256k Byte. It is organized into 2048 records. Each record consists of 128 Bytes.

Host send to Smart LCD MODBUS frame

Byte Seq Content No. of Byte Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x14
2 Byte Count 1 0x07 byte count of all the following data except CRC
3 Reference Type 1 0x06
4 File Number 2 0x0001
6 Record Number 2 0x0000 ... 0x07FF Record Number of a one of the 2048 possible records within USR.BIN
8 Record Length 2 0x0001 ... 0x003F Record Length in 16 Bit words to be read from the record
10 CRC 2 0x0000 ... 0xFFFF for error checking

SMART LCD reply to host

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Function Code 1 0x14
2 Reply Byte Count 1 0x04 ... 0x82 Response Byte Count of all following data except the CRC
3 Record Byte Count 1 0x03 ... 0x81 Record Byte Count of all following data except the CRC
4 Reference Type 1 0x06
5 Data 2 x n 0x00 ... 0xFF read from record with N 16 Bit words ranging from 1 to 64.
5 + (2xN) CRC 2 0x0000 … 0xFFFF for error checking

SMART LCD reply to host (in case of error found)

Byte Seq Content Byte Count Valid Range note
0 MODBUS Device Address 1 0x01 … 0xF7
1 Error Code 1 0x94
2 Exception Code 1 0x01 ... 0x04 01=Illegal Functrion; 02=IllegalDataAddress; 03=IllegalDataValue; 04=SlaveDeviceFailure
3 CRC 2 0x0000 … 0xFFFF for error checking

Example Frame (Read File Record (device id = 01))

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 14 07 06 00 01 00 00 00 01 05 24 read record file 00 01, record 00 00 and one 16bit value
2 RX 01 14 04 03 06 02 01 D9 F1 two bytes read back are 0x01, 0x02.

TX=host to Smart LCD; RX=Smart LCD reply to host

Since the Modbus protocol organizes data in 16 Bit words the file size of USR.BIN should be even. In case the file size is uneven the SMART LCD would pad the last data word with an additional 0x00.

MODBUS Error Codes Details

In case the SMART LCD receives a command with invalid data, invalid data count or an unsupported function code it will return an error code to the host (Returning the same function code with an additional Bit7 set). Additional it will transfer one of four possible exemption codes to indicate to the host what kind of error occurred

Code Exemption Name Descriptions
0x01 ILLEGAL FUNCTION The function code is not supported by the SMART LCD
0x02 ILLEGAL DATA ADDRESS The data address by the SMART LCD falls into a undefined area.
0x03 ILLEGAL DATA VALUE A data value received by the SMART LCD is not valid. It does not fit to the specific range requirements for the particular address.
0x04 SLAVE DEVICE FAILURE An unrecoverable error occurred while the SMART LCD was attempting to perform the requested action.

Color and Data Value Configuration

To access data the host should do following steps using the Modbus protocol:

  1. Use “Write Single Holding Register” with function code (0x06) to address 0xF001 and the data value of the desired memory page (0x01 … 0x05)
  2. Write to or read from the desired address within the selected page with: “Read Multiple Holding Registers” with function code (0x03) “Write Single Holding Register” with function code (0x06) "Write Multiple Holding Registers” with function code (0x10)

Each Modbus address holds 16 Bit of data. Therefore, it might be necessary to read multiple address locations:

  • STR, up to 64 consecutive accesses might be necessary to read an entire string, One single access will manipulate two characters.
  • N16, just one access is necessary to access one N16 variable. Multiple N16 variables might be accessed with a single Modbus command.
  • N32, two accesses are necessary to access one N32 variable. Multiple N32 variables might be accessed with a single Modbus command.
  • N64, four accesses are necessary to access one N64 variable. Multiple N64 variables might be accessed with a single Modbus command.
  • Bitmap, one access can manipulate 16 pixels of a bitmap variable. Multiple pixels might be accessed with a single Modbus command.
  • Graph, one access can manipulate one data point of a graph. Multiple data points might be accessed with a single Modbus command.

“Read Multiple Holding Registers” with function code (0x03) allows accessing of up to 125 consecutive address locations at once, with each location holding two Bytes of data.

“Write Multiple Holding Registers” with function code (0x10) allows accessing of up to 123 consecutive address locations at once, with each location holding two Bytes of data.

Access to the Special Function Registers, which are mapped to all pages, should not exceed the required Byte count assigned to each SFR. In such a case the SMART LCD would reply the host with an error message.

Note: Since the Modbus protocol uses a “Big-Endian” representation of data, the first Byte of each 16 Bit word represents the upper 8 Bit of the data word. In contrary the memory organization of the SMART LCD is “Little-Endian” requiring the host to swap upper and lower Byte of each transaction.

16 bit color value
R4 R3 R2 R1 R0 G5 G4 G3 G2 G1 G0 B4 B3 B2 B1 B0
High byte (MSB) Low byte (LSB)
D7 D6 D5 D4 D3 D2 D1 D0 D7 D6 D5 D4 D3 D2 D1 D0
64bit number value
D63...D56 D55...D48 D47...D40 D39...D32 D31...D24 D23...D16 D15...D8 D7...D0
Byte7 (MSB) Byte0 (LSB)
D7...D0 D7...D0 D7...D0 D7...D0 D7...D0 D7...D0 D7...D0 D7...D0
32bit number value
D31...D24 D23...D16 D15...D8 D7...D0
Byte3 (MSB) Byte0 (LSB)
D7...D0 D7...D0 D7...D0 D7...D0
16bit number value
D15...D8 D7...D0
High Byte (MSB) Low Byte (LSB)
D7...D0 D7...D0
String value
D7...D0 D7...D0
Strings are stored Byte by Byte starting from the lower address.

The terminator (0x00) is placed at the highest address. The start address of a string is always even and aligned to a 128 Byte boundary.

Special Function Registers (SFR)

The SMART LCD provides a set of SFR, which allow the host to:

  • Select a Memory Page to be able to access different kinds of VPs
  • Issue graphical drawing commands (Draw Pixels, Lines, Rectangles)
  • Show text or specific icons on the GUI
  • Read or change current page shown on the GUI  
  • Set the Type
  • Control Buzzer, Backlight and Screensaver
  • Read and Set the Real Time Clock (RTC)
  • Select a GUI project (if multiple GUI projects are present)
  • Restart a GUI project
  • Unlock the File System for access via USB
  • Format the File System
  • Change the RS485 communication Baud Rate
  • Start a System Self-Test or the Touch Panel Calibration Routine

SFR List

SFR Type SFR Address R/W Size (bytes) SFR Name Default Value
Command SFR (*1) n:0xF000 R/W 2 Command 0x0000 (*2)
MODBUS PAGE SFR n:0xF001 R/W 2 Modbus VP Page 0x0004
Project Control SFRs n:0xF00A R/W 2 Project ID 0x0000
n:0xF200 W 128 USB Password Buffer 0x0000
n:0xF300 R 2 TP_X_Position 0x0000
n:0xF301 R 2 TP_Y_Position 0x0000
Peripheral Control SFRs n:0xF400 R/W 2 Display Page ID Project Value
n:0xF401 R 2 Modbus Slave Address Project Value
n:0xF402 R/W 2 Baud rate Project Value
n:0xF403 R/W 2 Backlight Level Project Value
n:0xF404 R/W 2 Screen Saver Backlight Level Project Value
n:0xF405 R/W 2 Screen Saver Time Project Value
n:0xF406 R/W 2 Buzzer Key Click Time Project Value
n:0xF407 R/W 2 cursor type Project Value
n:0xF408 R/W 6 RTC_NOW in format (YY-MM-DD HH:mm:ss) 0x000101000000 (2000-01-01 00:00:00)
n:0xF40B R/W 2 Buzzer Sound Time Project Value of Buzzer Key Click Time
n:0xF40C R/W 2 Enable Self-Test 0x0000
n:0xF40D R/W 2 Enable Format 0x0000
n:0xF40E R/W 2 Enable Touch Panel Calibration 0x0000
Timer Control SFRs n:0xF410 R/W 2 Timer_ctrl 0 0x0000
n:0xF411 R/W 2 Timer_ctrl 1 0x0000
n:0xF412 R/W 2 Timer_ctrl 2 0x0000
n:0xF413 R/W 2 Timer_ctrl 3 0x0000
n:0xF414 R/W 2 Timer_ctrl 4 0x0000
n:0xF415 R/W 2 Timer_ctrl 5 0x0000
n:0xF416 R/W 2 Timer_ctrl 6 0x0000
n:0xF417 R/W 2 Timer_ctrl 7 0x0000
System Control SFRs n:0xF420 R/W 2 Screen Saver Time1 Project Value
n:0xF421 R/W 2 Screen Saver Page ID Project Value
n:0xF422 R/W 2 Codepage Project Value
n:0xF423 R/W 2 Country code Project Value
n:0xF424 R/W 2 PinYin EN/CN Switch 0:CN 1: EN
n:0xF425 R 2 PIP State (1: PIP MODE)
n:0xF426 R 2 Touch Panel State (1: Press Down; 0: Release)
n:0xF427 R 2 Touch Key ID 0xFFFF
n:0xF428 R 2 Backlight Level Project Value

note:

*1. SFR for Smart LCD MODBUS can be access form any page

*2. The Host may issue a command to Command SFR (address 0xF000). The SMART LCD will interpret the command and execute it.

*3. When 0x0000 read from the Command SFR (address 0xF000) it means that the previous command was executed and the SMART LCD is ready for a next command.

SFR Details

Command SFR (n:0xF000)

When written Command SFR with a command code, it may trigger a special command using the values stored in one or multiple other SFRs. See the SFR Commands section for details and examples.

VP Page SFR (n:0xF001)

When written VP Page SFR, it will select the specific page for any subsequent memory access within the Modbus address range of n:0x0000 … n:0xEFFF.

SFR SFR Address Descriptions
Modbus VP Page n:0xF001
  • read/write SFR
  • Power on value 0x0004
  • value=0x0000:Access VP_STR data area
  • value=0x0001:Access VP_N32 and TIMER COUNTER data areas
  • value=0x0002:Access VP_BMP data area
  • value=0x0003:Access VP_G16 data area
  • value=0x0004:Access VP_N16 data area
  • value=0x0005:Access VP_Flash data area
  • value=0x0006:Access VP_N64 data area

Example Frame (device id = 01, read from the SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F0 01 00 01 E6 CA read the Modbus VP Page
2 RX 01 03 02 00 04 B9 87 Report to host that Modbus VP Page=4

Example Frame (device id = 01, write to the SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F0 01 00 01 2A CA set the Modbus VP Page to 1
2 RX 01 06 F0 01 00 01 2A CA

Project ID SFR (n:0xF00A)

The SMART LCD allows the host to read the Project ID.

SFR SFR Address Descriptions
Project ID n:0xF00A
  • Read Only SFR
  • Can be assign value by using project_sel (0x00E1) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F0 0A 00 01 97 08 Read Project ID SFR
2 RX 01 03 02 00 01 79 84 Report to host that the Project ID = 0001

Touch Panel XY Position & State SFRs (n:0xF300, n:0xF301, n:0xF426)

The SMART LCD allows the host to read its current touch panel pen position. For this purpose, the host may poll via Modbus the 4 Byte TP_XY_Position Register, which is located in the Special Function Register Area.

SFR SFR Address Descriptions
TP position X n:0xF300
  • Read-Only SFR
  • Power on value 0x0000
  • pen down X range will be 0x0000 (left) … 0x031F (right)
  • pen up, keep the previous pen down value
TP position Y n:0xF301
  • Read-Only SFR
  • Power on value 0x0000
  • pen down Y range will be 0x0000 (up) … 0x01DF (down)
  • pen up, keep the previous pen down value
TP State n:0xF426
  • Read Only SFR
  • On pen up Status will be 0x0000 (default)
  • On pen down State will be 0x0001

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F3 00 00 02 F7 4F Read TP position SFR (X&Y)
2 RX 01 03 04 01 7E 01 54 9B B8 Report back to host X=017E; Y=0154

Display Page ID SFR (n:0xF400)

The SMART LCD allows the host to read the Display Page now showing on screen.

SFR SFR Address Descriptions
Display Page n:0xF4000
  • Read Only SFR
  • Can be assign value by using display_page (0x0070) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 00 00 01 B6 3A Read Display Page ID
2 RX 01 03 02 00 01 79 84 Report to host that the Display Page ID = 0x0001

MODBUS Slave Address SFR (n:0xF401)

The SMART LCD allows the host to read the MODBUS Device Address. (It may use as a handshake)

SFR SFR Address Descriptions
MODBUS Slave Address n:0xF401
  • Read Only SFR
  • value ranges 1 to 247

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 01 00 01 E7 FA Read MODBUS Device Address
2 RX 01 03 02 00 01 79 84 Report to host that MODBUS Device Address = 01

Backlight Level SFR (n:0xF403)

The SMART LCD allows the host to read the Backlight Level.

SFR SFR Address Descriptions
Backlight Level n:0xF403
  • Read Only SFR
  • Can be assign value by using backlight_ctrl (0x005F) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 03 00 01 46 3A Read Backlight Level
2 RX 01 03 02 00 20 B9 9C Report to host that the Backlight Level = 0x0002

Screen Saver Backlight Level SFR (n:0xF404)

The SMART LCD allows the host to read the Screen Saver Backlight Level.

SFR SFR Address Descriptions
Screen Saver Backlight Level n:0xF404
  • Read Only SFR
  • Can be assign value by using screen_saver_on (0x00A0) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 04 00 01 F7 FB Read Screen Saver Backlight Level
2 RX 01 03 02 00 05 78 47 Report to host that the Screen Saver Backlight level = 0x0005

Screen Saver Time SFR (n:0xF405)

The SMART LCD allows the host to read the Screen Saver Time.

SFR SFR Address Descriptions
Screen Saver Time n:0xF405
  • Read Only SFR
  • Can be assign value by using screen_saver_on (0x00A0) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 05 00 01 A6 3B Read Screen Saver Time
2 RX 01 03 02 00 05 78 47 Report to host that the Screen Saver Time = 0x0005

Buzzer Key Click Time SFR (n:0xF406)

The SMART LCD allows the host to read the Buzzer Key Click Time.

SFR SFR Address Descriptions
Buzzer Key Click Time n:0xF406
  • Read Only SFR
  • Can be assign value by using buzzer_ctrl (0x0079) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 06 00 01 56 3B Read Buzzer Key Click
2 RX 01 03 02 00 12 38 49 Report to host that the Buzzer Key Click Time = 0x0012

RTC_NOW SFR (n:0xF408)

The SMART LCD allows the host to read the RTC_NOW in format (YY-MM-DD HH:mm:ss).

SFR SFR Address Descriptions
RTC_NOW n:0xF408
  • Read Only SFR
  • Can be assign value by using RTC_set (0x009C) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 08 00 03 B6 39 Read RTC_NOW SFR
2 RX 01 03 06 10 03 0A 08 08 22 62 26 Report to host that the RTC_NOW = 2016-03-10 08:08:34

Buzzer Sound Time SFR (n:0xF40B)

The SMART LCD allows the host to read the Buzzer Sound Time.

SFR SFR Address Descriptions
Buzzer Sound Time n:0xF40B
  • Read Only SFR
  • Can be assign value by using buzzer_beep (0x0080) command

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 0B 00 01 C7 F8 Read Buzzer Sound Time
2 RX 01 03 02 00 12 38 49 Report to host that the Buzzer Sound Time = 0x0012

Timers Control SFR (n:0xF410 ... n:0xF417)

The SMART LCD provide eight 32-Bit timers, which can be used by GUI and host. The timers located within the VP_N32 area. Each Timer has got a Timer Count Register and a corresponding SFR, Timer Control Register for starting, stopping and setting the counting direction of the timers.

All Timers are counting in 1s steps.

n Timer n Control SFR Address Descriptions Timer n MODBUS Address Note
0 n:0xF410
  • read/write SFR
  • value=0x0000 : Timer stop
  • value=0x0001 : Timer counting down to 0x00000000
  • value=0x0003 : Timer counting up to 0x7FFFFFFF
 1:0x7FF0 Timer are located in MODBUS PAGE=1

it could be access via UI in VP_N32 area

1 n:0xF411 1:0x7FF2
2 n:0xF412 1:0x7FF4
3 n:0xF413 1:0x7FF6
4 n:0xF414 1:0x7FF8
5 n:0xF415 1:0x7FFA
6 n:0xF416 1:0x7FFC
7 n:0xF417 1:0x7FFE

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 10 00 03 FA 3E Set the Timer 0 Control SFR of Timer 0 as count up mode
2 RX 01 06 F4 10 00 03 FA 3E
3 TX 01 06 F0 01 00 01 2A CA Select MODBUS PAGE1
4 RX 01 06 F0 01 00 01 2A CA
5 TX 01 03 7F F0 00 02 DD EC Read the Timer 0
6 RX 01 03 04 00 63 00 00 0A 2D Report the Timer register value back to the host

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 10 00 01 B7 FF Read Timer1 Control SFR
2 RX 01 03 02 00 03 F8 45 Report to host that the Timer1 Control = 0003

Screen Saver Time1 SFR (n:0xF420)

The SMART LCD allows the host to modify the screen saver delay time. The register value can be changed under delay 2 in project settings

SFR SFR Address Descriptions
Screen Saver Time1 n:0xF420
  • read/write SFR
  • values range 0x0001... 0xFFFF
  • SFR value high byte corresponding to system register 0xFFFF25
  • SFR value low byte corresponding to system register 0xFFFF26

Example Frame (device id = 01, write to the SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 20 00 05 7A 33 Set the Screen Saver Time to 0005 seconds
2 RX 01 06 F4 20 00 05 7A 33

Screen Saver Page Jump ID SFR (n:0xF421)

The SMART LCD allows the host to change the page ID of the screen saver in run time which normally assigned in the page jump option in project settings.

SFR SFR Address Descriptions
Screen Saver Page JUMP ID n:0xF421
  • read/write SFR
  • values range 0x0000 ... 0x03E7
  • SFR's high byte corresponding to system register 0xFFFF23
  • SFR's low byte corresponding to system register 0xFFFF24

Example Frame (device id = 01, write to the SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 21 00 01 2A 30 change the screen saver page jump ID to 0001
2 RX 01 06 F4 21 00 01 2A 30

Code page SFR (n:0xF422)

The SMART LCD allows the host to modify the project code page. It alters the code page preset in project settings.

SFR SFR Address Descriptions
Code Page SFR n:0xF422
  • read/write SFR
  • values range 0x0001... 0x0016
  • SFR corresponds to the system registers 0xFFFF30

Example Frame (device id = 01, write to the SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 22 00 01 DA 30 change the Code page to 0001 (437(OEM United States))
2 RX 01 06 F4 22 00 01 DA 30

Country Code SFR (n:0xF423)

The SMART LCD allows the host to modify the country code. It alters the country code preset in project settings

SFR SFR Address Descriptions
Country Code SFR n:0xF423
  • read/write SFR
  • values range 0x0001... 0x000B
  • SFR corresponding to system register 0xFFFF31

Example Frame (device id = 01, write to the SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 23 00 01 8B F0 change the Country Code to 0001 (USA)
2 RX 01 06 F4 23 00 01 8B F0

PinYin SFR (n:0xF424)

The SMART LCD allows host to modify the PIP PinYin keyboard input method

SFR SFR Address Descriptions
PinYin SFR n:0xF424
  • read/write SFR
  • SFR=0: PinYin keyboard using Chinese input method
  • SFR=1: PinYin keyboard use English input method

Example Frame (device id = 01, write to the SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 24 00 00 FB F1 set the PinYin Keyboard as Chines input method
2 RX 01 06 F4 24 00 00 FB F1

PIP Status SFR (n:0xF425)

The SMART LCD allows the host to read the PIP keyboard status.

SFR SFR Address Descriptions
PIP Status SFR n:0xF425
  • Read-Only SFR
  • SFR=0: normal
  • SFR=1; while the PIP keyboard is called

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 25 00 01 A7 F1 read the PIP status
2 RX 01 03 02 00 01 79 84 Report to host that the PIP keyboard is called

Touch Key ID SFR (n:0xF427)

The SMART LCD allows the host to read the Touch Key ID number when the touch key is pressed

SFR SFR Address Descriptions
Touch Key ID SFR n:0xF427
  • Read-Only SFR
  • Power on default value is 65535
  • give the last touched Touch Key ID

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 27 00 01 06 31 read the Touch Key ID
2 RX 01 03 02 00 0A 38 43 Report to host that last touched Touch Key ID=000A

Backlight Level SFR (n:0xF428)

The SMART LCD allows the host to read the current backlight brightness

SFR SFR Address Descriptions
Backlight Level SFR n:0xF428
  • Read-Only SFR
  • valual ranges 0 to 63
  • SFR corresponding to system register 0xFFFF29

Example Frame (device id = 01, read form SFR)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 03 F4 28 00 01 36 32 read the Backlight Level
2 RX 01 03 02 00 3F F8 54 Report to host that backlight level 003F

SFR Commands

Command List

Command Code Command Name Descriptions
0x0070 disp_page Display a pre-stored TML file (page)
0x005F backlight_ctrl Set backlight brightness level
0x00A0 screen_saver_on Set Screen Saver parameters
0x00A1 screen_saver_off Disable Screen Saver
0x0079 buzzer_ctrl Set Buzzer Key Click Parameters
0x0080 buzzer_beep Sound Buzzer once
0x009C RTC_set Set the RTC
0x00E0 set_baudrate Set RS485 Baud Rate
0x00E1 sel_project Set active project folder
0x00E2 u_drv_format Format File System
0x00E3 u_drv_unlock Unlock File System for USB Access with pre-stored password
0x0088 self_test Starts Self-Test
0x0000 NOP No Operation / No Command to execute

SFR Command Details

disp_page (0x0070)

This command allows the host to dictate the GUI to show a particular page.

Seq SFR SFR Address Values Descriptions
1 Page ID SFR n:0xF400 0x0000 … 0x03E7
  • Read Access to register 0xF400 will allow give the currently displaying Page ID
  • Write Access to register 0xF400 will preset a new page ID going to display.
  • at this moment reading from 0xF400 will still displaying page ID.
  • It will be updated until command 0x0070 was successfully executed.
2 Command SFR n:0xF000 0x0070 disp_page Command code

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 00 00 01 7A 3A set the Page ID SFR
2 RX 01 06 F4 00 00 01 7A 3A
3 TX` 01 06 F0 00 00 70 BB 2E     execute disp_page command
4 RX 01 06 F0 00 00 70 BB 2E

backlight_ctrl (0x005F)

This command allows the host to dim the LCD backlight of the SMART LCD in a range from 0 … 63 levels.

Seq SFR SFR Address Valid Data Values Descriptions
1 Backlight Level SFR n:0xF403 0x0000 … 0x003F Select Backlight Level (0 … 63)
2 Command SFR n:0xF000 0x005F backlight_ctrl Command code

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 03 00 20 4A 22 set the backlight level
2 RX 01 06 F4 03 00 20 4A 22
3 TX` 01 06 F0 00 00 5F FA F2  execute backlight_ctrl command
4 RX 01 06 F0 00 00 5F FA F2

screen_saver_on (0x00A0)

This command allows the host to enable the Screensaver of the SMART LCD.

Seq SFR SFR Address Valid Data Values Descriptions
1 Screen Saver Backlight Level SFR n:0xF404 0x0000 … 0x003F Set the Level
2 Screen Saver Time SFR n:0xF405 0x0001 … 0xFFFF Set the Time (in seconds)
3 Command SFR n:0xF000 0x00A0 screen_saver_on Command code

Note:

1. This command will only enable the Screensaver and not immediately switch to the Screen Saver mode. The Screensaver Mode will only be entered after the Screen Saver Timer is expired and no touch panel events were noticed.

2. Select Screen Saver Backlight Level must be less than Backlight Level.

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 04 00 05 3A 38 set the Screen Saver Backlight Level
2 RX 01 06 F4 04 00 05 3A 38
3 TX` 01 06 F4 05 00 05 6B F8 Set the Screen Saver Time
4 RX 01 06 F4 05 00 05 6B F8
5 TX 01 06 F0 00 00 A0 BA B2 execute screen_saver_on Command code
6 RX 01 06 F0 00 00 A0 BA B2

screen_saver_off (0x00A1)

This command allows the host to disable the Screensaver of the SMART LCD.

Seq SFR SFR Address Valid Data Values Descriptions
1 Command SFR n:0xF000 0x00A1 screen_saver_off Command code

Note: In case the SMART LCD is operating in the Screen Saver Mode while the command is issued, it will be immediately leaving this mode, restore normal backlight and keep the Screen Saver disabled.

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F0 00 00 A1 7B 72 execute screen_saver_off Command code
2 RX 01 06 F0 00 00 A1 7B 72

buzzer_ctrl (0x0079)

This command allows the host to adjust the general timing of the SMART LCD’s buzzer used for key clicks.

Seq SFR SFR Address Valid Data Values Descriptions
1 Buzzer Key Click Time SFR n:0xF406 0x0000 … 0x003F value unit is 10ms

0x0000 would disable the key click

2 Command SFR n:0xF000 0x0079 buzzer_ctrl Command code

Note: This command will not start any sounding of the buzzer. It just sets the parameters used for the SMART LCD key click.

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 06 00 12 DB F6 set the Time
2 RX 01 06 F4 06 00 12 DB F6
3 TX 01 06 F0 00 00 79 7B 28 execute buzzer_ctrl Command code
4 RX 01 06 F0 00 00 79 7B 28

buzzer_beep (0x0080)

This command allows the host to sound the buzzer of the SMART LCD once for a desired period of time.

Seq SFR Modbus Address Valid Data Values Descriptions
1 Buzzer Sound Time SFR n:0xF40B 0x0000 … 0xFFFF set the time, value unit is 10ms
2 Command SFR n:0xF000 0x0080 buzzer_beep Command code

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 0B 00 12 4A 35 set the Time
2 RX 01 06 F4 0B 00 12 4A 35
3 TX 01 06 F0 00 00 80 BB 6A execute buzzer_beep Command code
4 RX 01 06 F0 00 00 80 BB 6A

RTC_set (0x009C)

This command allows the host to write the Real Time Clock of the SMART LCD.

Seq SFR Modbus Address Valid Data Values Descriptions
1 RTC_NOW SFR n:0xF408 0xYYMMDDHHmmss Preset New Date and Time using one 3 Word / 6 Byte

YY=00…99; MM=01…12; DD=01…31;

HH=00…23; mm=00…59; ss=00…59;

3word (6 byte); Only decimal Digits!

2 Command SFR n:0xF000 0x009C RTC_set Command code

Note: To set date and time use one single Modbus command with function code 0x10 and 6 Bytes of data.

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 10 F4 08 00 03 06 10 03 0A 08 08 08 B3 D5 set the RTC 2016-03-10 08:08:08
2 RX 01 10 F4 08 00 03 33 FA
3 TX 01 06 F0 00 00 9C BA A3 execute RTC_set Command code
4 RX 01 06 F0 00 00 9C BA A3

baudrate_set (0x00E0)

This command allows the host to modify the baud rate of the RS485 port.

Seq SFR Modbus Address Valid Data Values Descriptions
1 baud rate SFR n:0xF402 0x0000 … 0x0007 Select new Baud Rate:
  • 0x0000: 1200 baud
  • 0x0001: 2400 baud
  • 0x0002: 4800 baud
  • 0x0003: 9600 baud
  • 0x0004: 19200 baud
  • 0x0005: 38400 baud
  • 0x0006: 57600 baud
  • 0x0007: 115200 baud
2 Command SFR n:0xF000 0x00E0 baudrate_set Command code

Note: After setting the new baud rate the SMART LCD will still acknowledge with the previous baud rate. Any subsequent communication will use the new baud rate.

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 02 00 03 5A 3B select the RS485 baud rate as 9600 baud
2 RX 01 06 F4 02 00 03 5A 3B
3 TX 01 06 F0 00 00 E0 BB 42 execute baudrate_set Command code
4 RX 01 06 F0 00 00 E0 BB 42

project_sel (0x00E1)

This command allows the host to select one of the project to be display.

Seq SFR Modbus Address Valid Data Values Descriptions
1 Project ID SFR n:0xF00A 0x0000 … 0x0009 Select a Project:
  • 0x0000: THMT
  • 0x0001: THMT01
  • …
  • 0x0009: THMT09
2 Command SFR n:0xF000 0x00E1 project_sel Command code

Note:

Make sure the project folder selected exist.

If the selected project is the same as the current project, issuing the Set Active Project Command will cause the restart of the project from it’s start page.

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F0 0A 00 01 5B 08 select the THMT01 to be display
2 RX 01 06 F0 0A 00 01 5B 08
3 TX 01 06 F0 00 00 E1 7A 82 execute project_sel Command code
4 RX 01 06 F0 00 00 E1 7A 82

u_drv_format (0x00E2)

This command allows the host to format the file system of the SMART LCD.

Seq SFR Modbus Address Valid Data Values Descriptions
1 Enable Format SFR n:0xF40D 0xAAAA Only 0xAAAA for Enables Format capability

(format will be carry after the u_drv_format command)

2 Command SFR n:0xF000 0x00E2 u_drv_format Command code

Note: All GUI project data will be lost after formatting the file system. The USB File Access will be enabled again in case it was locked by a password before. After the format the Enable Format SFR will be reset to 0x0000

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 0D AA AA D4 E6 put specific 0xAAAA for Enable Format capability
2 RX 01 06 F4 0D AA AA D4 E6
3 TX 01 06 F0 00 00 E2 3A 83 u_drv_format Command code
4 RX 01 06 F0 00 00 E2 3A 83

u_drv_unlock (0x00E3)

This command allows the host to unlock the USB access of the file system of the SMART LCD.

Seq SFR Modbus Address Valid Data Values Descriptions
1 USB Password Buffer SFR n:0xF200 128byte(max) data depends on the password length and end with 0x00

(add-on 0x00 for 16bit alignment if necessary)

(format will be carry after the u_drv_unlock command)

2 Command SFR n:0xF000 0x00E3 u_drv_format Command code

Notes:

  • The 128 Byte reference password can be set within the project in TOPWAY’s SGTools and is stored within the project files.
  • Formatting the File System will erase the project files including the password and unlock the File System for USB access
  • It is allowed to use multiple Modbus Write Commands to set the password buffer
  • The password buffer is Write Only. Attempting to read it via Modbus will result in a Modbus Error

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 10 F2 00 00 04 08 4F 54 57 50 59 41 00 00 2F 1F password is "TOPWAY", 0x00(as string end), 0x00(for 16bit alignment)
2 RX 01 10 F2 00 00 04 F3 72
3 TX 01 06 F0 00 00 E3 FB 43 u_drv_unlock Command code
4 RX 01 06 F0 00 00 E3 FB 43

touch_calib (0x00E4)

This command allows the host to enable touch panel calibration of the SMART LCD (RTP only .

Seq SFR Modbus Address Valid Data Values Descriptions
1 Enable Touch Panel Calibration SFR n:0xF40E 0xA5A5 put specific 0xA5A5

for enable touch panel calibration

2 Command SFR n:0xF000 0x00E4 touch_calib Command code

Note: Keep pressing the top right comer of touch panel (RTP) during power on, could also trigger the touch_calib function.

Example Frame (device id = 01)

Seq dir MODBUS Communication Frame Descriptions
1 TX 01 06 F4 0E A5 A5 61 12 put specific 0xA5A5 for enable touch panel calibration

(calibration will be carry after the touch_calib command)

2 RX 01 06 F4 0E A5 A5 61 12
3 TX 01 06 F0 00 00 E4 BA 81 touch_calib Command code
4 RX 01 06 F0 00 00 E4 BA 81

self_check (0x0088)

This command allows the host to initiate the self-test mode of the SMART LCD.

Seq SFR Modbus Address Valid Data Values Descriptions
1 enable self-test SFR n:0xF40C 0x5555 put specific 0x5555 for the enable self test

(self check will be carry after the self_check command)

2 Command SFR n:0xF000 0x0088 self_check Command code

Note: After the self-test is executed the Enable Buffer will be reset to 0x0000

Example Frame (device id = 01)

Retrieved from "https://topway.app/sld_doc/en/index.php?title=MODBUS_Slave_Protocol&oldid=867"