Technical reference
Modbus register map
There is no fixed register table in this product, and that is deliberate. The display has a block of registers, and you decide what lives where: each variable you configure takes a slot in that block. Your PLC reads and writes those slots like any other Modbus registers. This page describes the model, so you can size and plan before ordering.
How addresses work
Three areas are the same physical block of registers, seen from three directions:
| Variable values | Where the display reads the numbers and text it renders |
|---|---|
| Modbus slave window | What your PLC reads/writes — a straight 1:1 map of the same addresses |
| Master polling image | Where values land when the panel polls a PLC as master |
The slave window is an identity mapping: protocol address 0x0000 is register 0, 0x0001 is register 1, and so on. No offset, no translation table to maintain.
Register space per model
| Model | Control card | Register space | Max variables per configuration |
|---|---|---|---|
| K1 | CH579 | 128 registers (0–127) | 32 |
| K2 | ESP32 | 128 registers (0–127) | 128 |
| K3 | ECP5 | 1024 registers (0–1023) | 64 |
Register space and variable count are independent: 64 variables can be spread across any addresses in the 0–1023 range. Confirm the figures for your exact model in the sheet supplied with the unit.
Variable types, and how many registers each takes
| Code | Type | Registers used | Encoding |
|---|---|---|---|
0 | Decimal integer | 1 | Unsigned 16-bit raw value. Displayed as value / 10^dec. |
1 | Long integer | 2 | 32-bit unsigned, low word first. |
2 | Single-precision float | 2 | IEEE-754 float32 bit pattern, low word first. Displayed as float / 10^dec. |
3 | Raw text | N (as configured) | Byte string, high byte first. GB2312; plain ASCII is a subset, so English text passes through unchanged. Trailing zero bytes are discarded. |
4 | Preset string index | 1 | The register holds the index (0-based) of an entry in the preset string list. |
Text never participates in threshold comparisons — the register holds bytes, not a number. Types 0, 1, 2 and 4 do, and for types 0 and 1 the comparison uses the raw register value.
Byte order — three conventions coexist
This is where most integrations go wrong, so it is worth stating explicitly rather than leaving to a datasheet footnote.
| What | Order |
|---|---|
| 16-bit values inside the PDU | Big-endian (high byte first) — standard Modbus |
| 32-bit values (long, float) | Low word first across the two registers |
| Text bytes | High byte first, so the byte order on the wire is the GB2312 byte order |
| RTU frame CRC | Low byte first |
Reading a 32-bit value as big-endian is the single most common mistake: the number comes out roughly 65536 times too large, or nonsense. Write a test value of 1 and read the two registers back before trusting any 32-bit mapping.
Function codes
| Code | Function | Notes |
|---|---|---|
03 | Read holding registers | Standard register access |
04 | Read input registers | Supported; the window is the same block |
06 | Write single register | |
16 | Write multiple registers | Use this for text and for 32-bit values so the pair is written in one transaction |
Exception responses returned:
01illegal function — unsupported code02illegal data address — outside the configured window03illegal data value — malformed request
Assigning addresses
Two modes, and they can be mixed in one configuration.
| Explicit | You set the register number for a variable. It stays where you put it, regardless of ordering. |
|---|---|
| Automatic | Leave the address unset and variables are placed starting at register 0, in the order they appear. Automatic placement skips slots already taken by explicit assignments. |
Automatic placement does not de-duplicate: if the same value appears twice in your content, it gets two separate slots. If two variables need to share one register, assign that address explicitly to both — the display reads one value and shows it twice, which is usually what you actually wanted.
Master mode: the polling table
When the panel polls a PLC itself, each polling entry is one of two directions.
| Direction | Meaning |
|---|---|
| Read (03 / 04) | Remote address range → local registers. The local address is the destination. |
| Write (06 / 16) | Local registers → remote address range. The local address is the source. |
The same local address field means destination on a read entry and source on a write entry. That asymmetry catches people out when editing an existing table. The polling interval is the gap between entries, so a full cycle takes interval × number of entries, not interval.