Modbus data transfer
Modbus is a client/server data communications protocol. The EA HMI-Series acts as slave/server only. It is designed to visualize data from a server, normally a PLC and takes user inputs. The server polls the data and interprets them.
The EA HMI-Series supports TCP/IP over Ethernet and WiFi as well as through EIA/TIA-485-A. Only binary form RTU and TCP is supported.
Message Frame (RTU)
RTU |
Address |
PDU |
RTU |
||
Start |
Slave Address |
Function Code |
Data |
CRC Check |
End |
>3.5 Char |
8 Bit (Set in HMIDesigner, see here for details) |
1 Byte |
0 up to 252 Bytes |
2 Bytes, CRC low, CRC high |
>3.5 Char |
Message Frame (TCP)
MBAP Header |
Address |
PDU |
|||||
Transaction ID |
Protocol ID |
Length |
Unit ID (→Slave Address) |
Function Code |
Data |
||
2 Bytes |
2 Bytes |
2 Bytes |
1 Byte |
1 Byte |
up to 65535 Bytes |
||
Function Codes / Modbus data model
The supported function codes can be divided in two major groups, public and user-defined.
Register type |
Function Code |
Table name |
Size per entry |
Coils |
1 (0x01) |
Read single or multiple coils |
1 Bit |
5 (0x05) |
Write single coil |
1 Bit |
|
15 (0x0F) |
Write multiple coil |
1 Bit |
|
Discrete inputs |
2 (0x02) |
Read single or multiple discrete inputs |
1 Bit |
Input registers |
4 (0x04) |
Read single or multiple input registers |
16 Bit |
Holding registers |
3 (0x03) |
Read single or multiple holding registers |
16 Bit |
6 (0x06) |
Write single holding register |
16 Bit |
|
16 (0x10) |
Write multiple holding registers |
16 Bit |
|
User-defined |
65 (0x41) |
Read multiple bytes of custom data |
--- |
66 (0x42) |
Write multiple bytes of custom data |
--- |
Transfer data to EA HMI-Series
To send custom data like HMI commands, new HMIDesigner projects or to update internal firmwares of the modules you have to use commands to transfer user-defined data through modbus.
1. Commands / sending data to display
This user-defined modbus command transfers data to the display. Several graphics commands can be packaged into a single protocol package. If the amount of data is larger than the maximum packet size, the data can be split into several packets. The module reassembles the individual data packets.
Module receives |
Slave Address 0xXX |
Function code 0x42 |
Data |
crc (16 Bit) 0xXX 0xXX |
||
Length (Data) |
Type/Command |
Payload data |
||||
0xXX |
0x00 |
0xXX... |
||||
Module sends |
Slave Address 0xXX |
Function code 0x42 |
Length 0xXX |
crc (16 Bit) 0xXX 0xXX |
||
Example: #XCB20 changes the brightness to 20%. The command need to be terminated with [LF] which is 0x0A. This example send to slave address 5.
So the modbus packet starts with address followed by the function code and length (count of data). At the end there's a CRC16 (Modbus) necessary, calculated with all bytes. Here's a link to an Online-CRC-Calculator.
Hex: 05 42 08 00 23 58 43 42 32 30 0A A8 53
2. Request / read data from display
This user-defined modbus command receives data from the display. Several commands place information in the send buffer. Please see here to find description about the answers/feedback of the module. If the amount of data is larger than the maximum packet size, the data can be split into several packets. The data needs to be requested several times then.
Module receives |
Slave Address 0xXX |
Function code 0x41 |
crc (16 Bit) 0xXX 0xXX |
||
Module sends |
Slave Address 0xXX |
Function code 0x41 |
Length (Data) 0xXX |
Payload data 0xXX ... (see Answer / Feedback) |
crc (16 Bit) 0xXX 0xXX |
3. Turn on / off automatic answers / feedback for data reading
In modbus mode the module deactivates all answers / feedback. No output is done as default. If extern master wants to read data from display, it has to activate the answers / feedbacks from the module. If master finishes reading it has to deactivate all answers to avoid buffer overrun.
Remark: While automatic answers are turned on, public modbus functions like reading and writing all types off registers is deactivated.
Module receives |
Slave Address 0xXX |
Function code 0x42 |
Data |
crc (16 Bit) 0xXX 0xXX |
||
Length (Data) |
Type |
Answers |
||||
0x02 |
0x01 |
0x00: turned off, normal operation 0x01: turned on, public modbus functions deactivated |
||||
Module sends |
Slave Address 0xXX |
Function code 0x42 |
Length 0xXX |
crc (16 Bit) 0xXX 0xXX |
||