
Table of Contents
General Information! 4
Object Types and Commands! 5
Object Types! 5
Commands! 5
LT Comm ands ! 7
Register Tables Summary! 9
Command & Data Formats! 14
Read DO Status! 14
Read DI Status! 14
Read Latched DI Status! 15
Read Group Status Map! 16
Read Pattern Activation Map! 17
Read LT Alive Status Map! 18
Read AI Value! 19
Read AO Value! 19
Read Authorization Mode! 20
Read AO Upper Limit! 21
Read AO Lower Limit! 21
Set Group On/Off! 22
Activate Pattern! 22
Set DO On/Off! 22
Single DO Pulse Out! 23
Dual DO Pulse Out! 23
Clear Latched DI! 24
Clear Pattern Activation Map! 25
Set AO Value! 26
Set Authorization Mode! 26
Set AO Upper Limit! 27
Set AO Lower Limit! 27
Examples! 28
Read DO Status! 28
CC1000 Modbus Reference 2.10e! 1/122

Read DI Status! 29
Read Latched DI Status! 29
Read Group Status Map! 30
Read Pattern Activation Map! 31
Read LT Alive Status Map! 32
Read AI Value! 33
Read AO Value! 33
Read Authorization Mode! 34
Read AO Upper Limit! 35
Read AO Lower Limit! 35
Set Group On/Off! 36
Activate Pattern! 36
Set DO On/Off! 37
Single DO Pulse Out! 38
Dual DO Pulse Out! 38
Clear Latched DI! 39
Clear Pattern Activation Map! 40
Set AO Value! 41
Set Authorization Mode! 42
Set AO Upper Limit! 43
Set AO Lower Limit! 43
CRC Computation! 44
Definition! 44
Usage! 44
Terms and Abbreviations! 45
Notes on Using Modscan! 46
Additional Resources! 47
Precomputed Tables! 48
Set Group Off/On! 48
Activate Pattern! 49
Set DO Off/On! 50
Single DO Pulse Out! 55
Dual DO Pulse Out! 58
CC1000 Modbus Reference 2.10e! 2/122

Complete Register Table For R/W Address! 60
Register Addresses 0 to 767! 60
Register Addresses 768 to 1279! 74
Register Addresses 2816 to 3327! 84
Complete Register Table For Control Addresses! 95
Register Addresses 1 to 767! 95
Register Addresses 768 to 1535! 107
CC1000 Modbus Reference 2.10e! 3/122

The CC1000 is a Modbus gateway for the Smart Lighting Control System D-Bus protocol. It can interface with a PC host
using either Ethernet or RS485 and communicates using the Modbus/RTU protocol.
The baud rate is fixed at 9600 bauds. The data format is 8 bits, no parity, 1 stop bit.
All numerical data is in integer form and must be scaled by multiplying/dividing with its associated unit to get the final
data value.
Reading is executed through function code 3. Writing is executed using function code 16. Most control is executed using
function code 5, but some may use function code 16 as well.
Function code 3 can support reading a single register or multiple registers at a time. When reading multiple registers, a
maximum of 125 registers (250 bytes) can be requested per command query. Requesting to read more than 125
registers at a time is considered an invalid command and will engender no response.
Function code 16 can write to a single register or multiple registers at a time. When writing to multiple registers, a
maximum of 4 registers (8 data bytes) can be written to at a time. Requesting to write more than 4 registers at a time is
considered an invalid command and will engender no response.
The CC1000 will not respond to an invalid command, this is to force the host PC doing the reading to time out. The
CC1000 has a typical response latency of 100 milliseconds, but as a safety margin, a latency of 300 milliseconds should
be allowed for, if this time is exceeded, the host PC should issue a time out.
An invalid command may be any one of the following:
1. The function code is not supported.
2. No register at the given register address for a given function code.
3. The data is malformed or out of range.
4. The CRC is incorrect.
The CC1000 can operate in two modes. The first mode is normal Modbus. The second mode is a variation of the
Modbus wherein any valid command will be executed but will not be responded to. The no response behavior for the
second mode is not an error but rather a normal behavior as required for certain types of applications.
CC1000 Modbus Reference 2.10e! 4/122

Object Types and Commands
Object Types and Commands
Read Pattern Activation
Map
Clear Pattern Activation
Map
• Reads the status of a discrete output
• Reads the real time status of a discrete input
Read Latched DI
[寫入保全 DI]
• Reads the status of the latched discrete input. The latched DI is a flag that is
set when the DI channel to which it refers to goes from LOW to HIGH. The
event is remembered (latched), the flag is not cleared when the DI channel
goes back to LOW. It can only be cleared by explicitly issuing the Clear Latched
DI command.
Read Group Status Map
[讀取群狀態表]
• Reads the bit map representing the on/off status of each group.
Read Pattern Activation Map
[讀取被觸發場景表]
• Reads the bit map representing the activation status of each pattern.
• The bit representing a pattern is sticky, once activated (set to 1), the bit will
always remain in that state since a pattern cannot be turned off. To clear the
bit, the map must be cleared manually using the Clear Pattern Activation
Map command.
Read LT Alive Status Map
[LT 是否存在表]
• Reads the bit map representing the alive status of each LT.
• An LT is alive when it can be communicated to, an LT is not alive when it does
not exist on the bus or when it is not responding to commands from the
CC1000.
• Reads the value of the analog input.
• The value is a percentage from 0 to 100, with no decimal place.
• Reads the value of the analog output.
• The value is a percentage from 0 to 100, with no decimal place.
CC1000 Modbus Reference 2.10e! 5/122

Read Authorization Mode
[讀取強制模式]
• Reads the IR operating mode
• Each DO can have its own mode.
• There are four possible modes for each DO: Local On, Local Off, Forced On,
Forced Off.
• Note that reading has 4 possibilities, but setting only has 3 possibilities.
• There is a corresponding command to set the authorization mode, see the Set
Authorization Mode command for more details.
• This command is available for the LT3384 with firmware version 23 or higher
only.
Read AO Upper Limit
[讀取 AO 高階設定]
• Reads the value of the upper limit for an AO channel.
• See also the Set AO Upper Limit command to set this value.
Read AO Lower Limit
[讀取 AO 低階設定]
• Reads the value of the lower limit for an AO channel.
• See also the Set AO Upper Limit command to set this value.
• Commands all the DO belonging to a given group to turn On or Off at the same
time.
• Commands all the DO belonging to a given pattern to arrange themselves into a
formation consisting of On and Off elements.
• Note that a pattern can only be activated, a pattern cannot be turned Off.
• Commands a single DO to turn either On or Off.
Single DO Pulse Out
[控制單 DO Pulse]
• Commands a single DO to output a pulse. The pulse is low->high->low.
Dual DO Pulse Out
[控制雙 DO Pulse]
• Commands a pair of DO to each output a pulse simultaneously. The pulse is
low->high->low.
Clear Latched DI
[清除保全 DI]
• Clears the latched DI flag.
• The latched DI flag is sticky, it is set when the DI goes high, the flag will remain
set even when the DI goes back low.
Clear Pattern Activation Map
[清除場景]
• Clears the bit map representing the activation status of each pattern.
• The bit representing a pattern is sticky, once activated (set to 1), the bit will
always remain in that state since a pattern cannot be turned off. This command
is needed in order to clear this sticky bit.
• See also the command Read Pattern Activation Map.
• Writes a value to the analog output.
• The value can be any percent from 0 to 100. There is no decimal place.
Set Authorization Mode
[寫入強制模式]
• Sets the IR operating mode.
• Each DO can have its own mode.
• There are three possible modes that can be set for each DO: Local, Forced On,
Forced Off.
• Note that reading has 4 possibilities, but setting only has 3 possibilities.
• There is a corresponding command to read the authorization mode, see the
Read Authorization Mode command for more details.
• This command is available for LT3384 with firmware version 23 or higher only.
Set AO Upper Limit
[寫入 AO 高階設定]
• Sets the value of the upper limit for an AO channel.
• See also the Read AO Upper Limit command to read the value that is set
from this command.
Set AO Lower Limit
[寫入 AO
低階設定]
• Sets the value of the lower limit for an AO channel.
• See also the Read AO Lower Limit command to read the value that is set
from this command.
CC1000 Modbus Reference 2.10e! 6/122

Read DO Status
[讀取 DO 狀態]
Read DI Status
[讀取 DI 狀態]
Read Latched DI
[讀取保全 DI]
Read Authorization Mode
[讀取強制模式]
Read AO Upper Limit
[讀取 AO 高階設定]
Read AO Lower Limit
[讀取 AO 低階設定]
Single DO Pulse Out
[控制單 DO Pulse]
Dual DO Pulse Out
[控制雙 DO Pulse]
Clear Latched DI
[清除保全 DI]
Set Authorization Mode
[寫入強制模式]
Set AO Upper Limit
[寫入 AO 高階設定]
Set AO Lower Limit
[寫入 AO 低階設定]
✔✔✔✔✔✔✔✔✔✔✘✘✘✘✘✘✘✘✔✔✘✘✘✘✘✘✘✘✔✔✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘
✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✔✘✘✘✘✘✘✘✔✘✘✘✘✘✘✘✘✘✔✘✘
✘✘✘✘✘✘✘✘✔✔✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘✘
Notes:
(1) For the LT3384, the function "Read Authorization Mode" only applies to version 23 or higher. Older versions do not support this function.
(2) For the LT3384, the function "Set Authorization Mode" only applies to version 23 or higher. Older versions do not support this function.
CC1000 Modbus Reference 2.10e! 7/122

Read DO Status
[讀取 DO 狀態]
Read DI Status
[讀取 DI 狀態]
Read Latched DI
[讀取保全 DI]
Read Authorization Mode
[讀取強制模式]
Read AO Upper Limit
[讀取 AO 高階設定]
Read AO Lower Limit
[讀取 AO 低階設定]
Single DO Pulse Out
[控制單 DO Pulse]
Dual DO Pulse Out
[控制雙 DO Pulse]
Clear Latched DI
[清除保全 DI]
Set Authorization Mode
[寫入強制模式]
Set AO Upper Limit
[寫入 AO 高階設定]
Set AO Lower Limit
[寫入 AO 低階設定]
✔✔✔✔✔✘✔✔✔✔✘✘✘✘✔✘✘✘✘✘✘✘✘✘✔✘✘✘✘✘✘✘✔✔✘✔✘✘✘✔✘✘✔✔✔✔✔✔✘✔✘✘✘✘✔✘✘✘✘✘✘✘✘✘✔✘✘✘✘✘✘✘✘✘✔✘✘✘✘
✔✔✔✔✔✔✔✔✔✔✘✔✘✘✘✘✘✘✘✘✘✔✘✘✘✘✘✘✘
✘✘✘✘✘✘✘✘✘✘✘✘✔✔✔✔✔✔✘✔✘✘✘✘✔✘✘✘✘
CC1000 Modbus Reference 2.10e! 8/122

Dual DO Pulse Out
[控制雙 DO Pulse]
Dual DO Pulse Out
[控制雙 DO Pulse]
Dual DO Pulse Out
[控制雙 DO Pulse]
Dual DO Pulse Out
[控制雙 DO Pulse]
Dual DO Pulse Out
[控制雙 DO Pulse]
Dual DO Pulse Out
[控制雙 DO Pulse]
Clear Latched DI
[清除保全 DI]
Clear Pattern
Activation Map
Clear Pattern
Activation Map
[清除場景]
Set Authorization
Mode
[寫入強制控制模式]
CC1000 Modbus Reference 2.10e! 12/122

Read DO Status
Command Format
✦
N = 1 to 32
Query
LT to Register Address Conversion
❖
Reg = (LT-1) div 2
Read DI Status
Command Format
✦
N = 1 to 64
Query
LT to Register Address Conversion
❖
Reg = LT+31
CC1000 Modbus Reference 2.10e! 14/122

Read Latched DI Status
Command Format
✦
N = 1 to 64
Query
LT to Register Address Conversion
❖
Reg = LT+95
CC1000 Modbus Reference 2.10e! 15/122

Read Group Status Map
Command Format
✦
N = 1 to 4
Query
16151413121110987654321323130292827262524232221201918
484746454443424140393837363534
---6362616059585756555453525150
Group to Register Address Conversion
Each register has the status of 16 groups
Each register has the status of 16 groups
This last register has the status of 15 groups only
CC1000 Modbus Reference 2.10e! 16/122

Read Pattern Activation Map
Command Format
✦
N = 1 to 4
Query
0 = Not activated, 1 = Activated
0 = Not activated, 1 = Activated
0 = Not activated, 1 = Activated
0 = Not activated, 1 = Activated
0 = Not activated, 1 = Activated
16151413121110987654321323130292827262524232221201918
484746454443424140393837363534
646362616059585756555453525150
Patterns to Register Address Conversion
✴
Note that there are 64 patterns but only 63 groups.
CC1000 Modbus Reference 2.10e! 17/122

Read LT Alive Status Map
Command Format
✦
N = 1 to 4
Query
0 = Not alive or not present, 1 = Alive
0 = Not alive or not present, 1 = Alive
0 = Not alive or not present, 1 = Alive
0 = Not alive or not present, 1 = Alive
0 = Not alive or not present, 1 = Alive
16151413121110987654321323130292827262524232221201918
484746454443424140393837363534
646362616059585756555453525150
LT to Register Address Conversion
✴
Note that there are 64 patterns but only 63 groups.
CC1000 Modbus Reference 2.10e! 18/122

Read AI Value
Command Format
✦
N = 1 to 125
Query
Data Format
✦
AI Value = Data-L x 1%
LT to Register Address Conversion
❖
Reg = (LT+63) x 4 + (AI-1)
Read AO Value
Command Format
✦
N = 1 to 125
Query
Data Format
✦
AO Value = Data-L x 1%
LT to Register Address Conversion
❖
Reg = (LT+127) x 4 + (AO-1)
CC1000 Modbus Reference 2.10e! 19/122

Read Authorization Mode
Command Format
✦
N = 1 to 125
Query
LT to Register Address Conversion
❖
Reg = (LT+95) x 8 + (DO-1)
CC1000 Modbus Reference 2.10e! 20/122

Read AO Upper Limit
Command Format
✦
N = 1 to 125
Query
Data Format
✦
AO Upper Limit = Data-L x 1%
LT to Register Address Conversion
❖
Reg = (LT+703) x 4 + (AO-1)
Read AO Lower Limit
Command Format
✦
N = 1 to 125
Query
Data Format
✦
AO Lower Limit = Data-L x 1%
LT to Register Address Conversion
❖
Reg = (LT+767) x 4 + (AO-1)
CC1000 Modbus Reference 2.10e! 21/122

Set Group On/Off
Data Format
Command Format
Query and Reply
Group to Register Address Conversion
❖
Reg = Group
Activate Pattern
Data Format
✦
Patterns can only be activated, the activation code is 255, there is no off for a pattern.
Command Format
Query and Reply
Pattern to Register Address Conversion
❖
Reg = Pattern + 63
Set DO On/Off
Data Format
Command Format
Query and Reply
LT to Register Address Conversion
❖
Reg = (LT + 31) x 8 + (DO - 1)
CC1000 Modbus Reference 2.10e! 22/122

Single DO Pulse Out
Command Format
Query and Reply
LT to Register Address Conversion
❖
Reg = (LT + 95) x 8 + (DO - 1)
Dual DO Pulse Out
Command Format
Query and Reply
LT to Register Address Conversion
❖
Reg = (LT + 319) x 4 + (DO - 1) div 2
CC1000 Modbus Reference 2.10e! 23/122

Clear Latched DI
Data Format
✦
N = 1 to 4
✦
The data written is a mask and each DI can be cleared independently.
0 = Clear, 1 = Don’t Clear
0 = Clear, 1 = Don’t Clear
0 = Clear, 1 = Don’t Clear
0 = Clear, 1 = Don’t Clear
0 = Clear, 1 = Don’t Clear
0 = Clear, 1 = Don’t Clear
LT to Register Address Conversion
❖
Reg = LT + 95
CC1000 Modbus Reference 2.10e! 24/122

Clear Pattern Activation Map
Data Format
✦
There are 64 patterns, which are grouped into 4 registers of 16 patterns each.
✦
Each pattern is represented by a bit. Each pattern can be cleared independently.
✦
N = 1 to 4
323130292827262524232221201918
48474645444342414039383736353433646362616059585756555453525150
0 = clear, 1 = don’t clear
0 = clear, 1 = don’t clear
0 = clear, 1 = don’t clear
0 = clear, 1 = don’t clear
0 = clear, 1 = don’t clear
0 = clear, 1 = don’t clear
Patterns to Register Address Conversion
CC1000 Modbus Reference 2.10e! 25/122

Set AO Value
Data Format
✦
N = 1 to 4
✦
Allowed AO Values: 0 to 100%
✦
Data-L = AO Value / 1%
Command Format
Query
LT to Register Address Conversion
❖
Reg = (LT + 127) x 4 + (AO - 1)
Set Authorization Mode
Data Format
✦
N = 1 to 4
LT to Register Address Conversion
❖
Reg = (LT + 95) x 8 + (DO - 1)
CC1000 Modbus Reference 2.10e! 26/122

Set AO Upper Limit
Data Format
✦
N = 1 to 4
✦
Allowed AO Upper Limit Values: 0 to 100%
✦
Data-L = AO Upper Limit / 1%
Command Format
Query
LT to Register Address Conversion
❖
Reg = (LT + 703) x 4 + (AO - 1)
Set AO Lower Limit
Data Format
✦
N = 1 to 4
✦
Allowed AO Lower Limit Values: 0 to 100%
✦
Data-L = AO Lower Limit / 1%
Command Format
Query
LT to Register Address Conversion
❖
Reg = (LT + 767) x 4 + (AO - 1)
CC1000 Modbus Reference 2.10e! 27/122

Read DO Status
✦
CC1000 Address 1
✦
LT address 15 and 16
➡
Register Address = (15 - 1) div 2 = 7
➡
RH = 7 div 256 = 0
➡
RL = 7 mod 256 = 7
Query
CC1000 Modbus Reference 2.10e! 28/122

Read DI Status
✦
CC1000 Address 1
✦
LT address 26
➡
Register Address = 26 + 31 = 57
➡
RH = 57 div 256 = 0
➡
RL = 57 mod 256 = 57
Query
OffOnOnOnOn16151413121110987654321
Read Latched DI Status
✦
CC1000 Address 1
✦
LT address 34
➡
Register Address = 34 + 95 = 129
➡
RH = 129 div 256 = 0
➡
RL = 129 mod 256 = 129
Query
OffOnOff16151413121110987654321
CC1000 Modbus Reference 2.10e! 29/122

Read Group Status Map
✦
CC1000 Address 1
✦
Read Groups 1 to 63
➡
Starting Register Address = 160
➡
RH = 160 div 256 = 0
➡
RL = 160 mod 256 = 160
Query
Off16151413121110987654321
Off32313029282726252423222120191817
Off48474645444342414039383736353433
---6362616059585756555453525150
CC1000 Modbus Reference 2.10e! 30/122

Read Pattern Activation Map
✦
CC1000 Address 1
✦
Read Patterns 1 to 64
➡
Starting Register Address = 164
➡
RH = 164 div 256 = 0
➡
RL = 164 mod 256 = 164
Query
---16151413121110987654321
---32313029282726252423222120191817
---48474645444342414039383736353433
---64636261605958575655545352515049
CC1000 Modbus Reference 2.10e! 31/122

Read LT Alive Status Map
✦
CC1000 Address 1
✦
Read Alive Status for LT 1 to 64
➡
Starting Register Address = 168
➡
RH = 168 div 256 = 0
➡
RL = 168 mod 256 = 168
Query
---16151413121110987654321
---32313029282726252423222120191817
---48474645444342414039383736353433
---64636261605958575655545352515049
CC1000 Modbus Reference 2.10e! 32/122

Read AI Value
✦
CC1000 Address 1
✦
LT address 36, AI 3
➡
Register Address = (36 + 63) x 4 + (3 - 1) = 398
➡
RH = 152 div 256 = 1
➡
RL = 152 mod 256 = 142
Query
✦
DL = 76
➡
AI Value = 76 x 1% = 76%
Read AO Value
✦
CC1000 Address 1
✦
LT address 55, AI 4
➡
Register Address = (55 + 127) x 4 + (4 - 1) = 731
➡
RH = 731 div 256 = 2
➡
RL = 731 mod 256 = 219
Query
✦
DL = 46
➡
AO Value = 46 * 1% = 46%
CC1000 Modbus Reference 2.10e! 33/122

Read Authorization Mode
Example 1 - Read Authorization Mode for One DO
✦
CC1000 Address 1
✦
LT address 2, read mode for DO 8
➡
Register Address = (2 + 95) x 8 + (8 - 1) = 783
➡
RH = 783 div 256 = 3
➡
RL = 783 mod 256 = 15
Query
✦
DL = 3
➡
DO 8 Mode = Forced Off
Example 2 - Read Authorization Mode for Four DOs
✴
Note that a maximum of 4 authorization modes can be read at a time.
✦
CC1000 Address 1
✦
LT address 64, read modes for DO 5 to 8
➡
Register Address = (64 + 95) x 8 + (5 - 1) = 1276
➡
RH = 1276 div 256 = 4
➡
RL = 1276 mod 256 = 252
Query
✦
D1 = 1
➡
DO 5 Mode = Local Off
✦
D2 = 2
➡
DO 6 Mode = Local On
✦
D3 = 3
➡
DO 7 Mode = Forced Off
✦
D4 = 4
➡
DO 8 Mode = Forced On
CC1000 Modbus Reference 2.10e! 34/122

Read AO Upper Limit
✦
CC1000 Address 1
✦
LT address 51, AO 3
➡
Register Address = (51 + 703) x 4 + (3 - 1) = 3018
➡
RH = 3018 div 256 = 11
➡
RL = 3018 mod 256 = 202
Query
✦
DL = 80
➡
AO Upper Limit = 80 x 1% = 80%
Read AO Lower Limit
✦
CC1000 Address 1
✦
LT address 19, AO 1
➡
Register Address = (19 + 767) x 4 + (1 - 1) = 3144
➡
RH = 3144 div 256 = 12
➡
RL = 3144 mod 256 = 72
Query
✦
DL = 25
➡
AO Lower Limit = 25 x 1% = 25%
CC1000 Modbus Reference 2.10e! 35/122

Set Group On/Off
Example 1 - Set Group to On
✦
CC1000 Address 1
✦
Set Group 27 To On
➡
Register Address = 27
➡
RH = 27 div 256 = 0
➡
RL = 27 mod 256 = 27
➡
Group On
➡
DH = 255
Query and Reply
Example 2 - Set Group to Off
✦
CC1000 Address 1
✦
Set Group 63 To Off
➡
Register Address = 63
➡
RH = 63 div 256 = 0
➡
RL = 63 mod 256 = 63
➡
Group Off
➡
DH = 0
Query and Reply
Activate Pattern
✦
CC1000 Address 1
✦
Activate Pattern 7
➡
Register Address = 7 + 63 = 70
➡
RH = 70 div 256 = 0
➡
RL = 70 mod 256 = 70
➡
Activate Pattern
➡
DH = 255
Query and Reply
CC1000 Modbus Reference 2.10e! 36/122

Set DO On/Off
Example 1 - Set DO to On
✦
CC1000 Address 1
✦
LT address 27, DO 6 to ON
➡
Register Address = (27 + 31) x 8 + (6 - 1) = 469
➡
RH = 469 div 256 = 1
➡
RL = 469 mod 256 = 213
➡
DO On = 255
Query and Reply
Example 2 - Set DO to Off
✦
CC1000 Address 1
✦
LT address 56, DO 3 to ON
➡
Register Address = (56 + 31) x 8 + (3 - 1) = 698
➡
RH = 698 div 256 = 2
➡
RL = 698 mod 256 = 186
➡
DO Off = 0
Query and Reply
CC1000 Modbus Reference 2.10e! 37/122

Single DO Pulse Out
✦
CC1000 Address 1
✦
Send out pulse from LT 15, DO 6
➡
Register Address = (15 + 95) x 8 + (6 - 1) = 885
➡
RH = 885 div 256 = 3
➡
RL = 885 mod 256 = 117
➡
Pulse Out
➡
DH = 255
Query and Reply
Dual DO Pulse Out
✦
CC1000 Address 1
✦
Send out a pulse from both DO 7 and 8 simultaneously on LT 64
➡
Register Address = (64 + 319) x 4 + (7 - 1) div 2 = 1535
➡
RH = 1535 div 256 = 5
➡
RL = 1535 mod 256 = 255
➡
Pulse Out
➡
DH = 255
Query and Reply
CC1000 Modbus Reference 2.10e! 38/122

Clear Latched DI
Example 1 - Clear Some Latched DIs For One LT
✦
CC1000 Address 1
✦
LT address 57
➡
Register Address = 57 + 95 = 152
➡
RH = 152 div 256 = 0
➡
RL = 152 mod 256 = 152
✦
Data mask for the Latched DIs to be cleared:
16151413121110987654321---
Example 2 - Clear All Latched DIs For 4 LTs
✴
Note that 4 is the maximum number of Latched DIs that can be cleared at a time.
✦
CC1000 Address 1
✦
LT 21 to 2 4
➡
Starting Register Address = 21 + 95 = 116
➡
RH = 116 div 256 = 0
➡
RL = 116 mod 256 = 116
➡
Number of Registers = 4
➡
Byte Count = 8
✦
Clearing a latched DI sets its bit to zero, so clearing all DIs would set the entire data mask to zero.
➡
D1, D2, D3, D4, D5, D6, D7, D8 = 0
Query
CC1000 Modbus Reference 2.10e! 39/122

Clear Pattern Activation Map
✦
CC1000 Address 1
✦
Patterns 1 to 64
➡
Register Address = 164
➡
RH = 164 div 256 = 0
➡
RL = 164 mod 256 = 164
✦
Clear Activation Status for all Patterns
➡
D1, D2, D3, D4, D5, D6, D7, D8 = 0
Query
CC1000 Modbus Reference 2.10e! 40/122

Set AO Value
✦
CC1000 Address 1
✦
LT address 19, AO 1
➡
Register Address = (19 + 127) x 4 + (1 - 1) = 584
➡
RH = 584 div 256 = 2
➡
RL = 584 mod 256 = 72
✦
AO Value = 50%
➡
DL = 50% / 1% = 50
✴
Note that the allowed values for AO is from 0 to 100%.
Query
CC1000 Modbus Reference 2.10e! 41/122

Set Authorization Mode
✦
CC1000 Address 1
✦
LT address 1, DO 1
➡
Register Address = (1 + 95) x 8 + (1 - 1) = 768
➡
RH = 768 div 256 = 3
➡
RL = 768 mod 256 = 0
✦
Set Authorization Mode to Forced On
➡
DL = 4
Query
CC1000 Modbus Reference 2.10e! 42/122

Set AO Upper Limit
✦
CC1000 Address 1
✦
LT address 1, AO 1
➡
Register Address = (1 + 703) x 4 + (1 - 1) = 2816
➡
RH = 2816 div 256 = 11
➡
RL = 2816 mod 256 = 0
✦
Set AO Upper Limit to 85%
➡
DL = 85% / 1% = 85
Query
Set AO Lower Limit
✦
CC1000 Address 1
✦
LT address 64, AO 4
➡
Register Address = (64 + 767) x 4 + (4 - 1) = 3327
➡
RH = 3327 div 256 = 12
➡
RL = 3327 mod 256 = 255
✦
Set AO Upper Limit to 10%
➡
DL = 10% / 1% = 10
Query
CC1000 Modbus Reference 2.10e! 43/122

The CC1000 conforms to the Modbus/RTU protocol and thus uses CRC16 for its error checking. The computed CRC is
appended to the end of the message with the LSB first and then the MSB. Below is the pseudo code for computing the
CRC as used by the standard Modbus/RTU. The pseudo code is written in the Ruby language and can be directly used
as such.
Definition
def get_crc (*byte_array)
!sum = 0xFFFF
!byte_array.each do |byte|
! sum ^= byte
! 8.times do
! ! carry = (1 == sum & 1)
! ! sum = 0x7FFF & (sum >> 1)
! ! sum ^= 0xA001 if carry
! end
end
return [sum & 0xFF, sum >> 8]
end
Usage
>> crc = get_crc(1,3,0,141,0,5)
=> [21, 226] <---- [CRC low byte, CRC high byte]
CC1000 Modbus Reference 2.10e! 44/122

div
Operator that gives the quotient after an integer division. Example: 773 div 256 = 3
mod
Operator that gives the remainder after an integer division. Example: 773 mod 256 = 5
Reg-H
Short for Register Address High byte.
Reg-L
Short for Register Address Low byte.
CRC
Short for Cyclic Redundancy Code.
CRC-H
Short for CRC High byte.
CRC-L
Short for CRC Low byte.
-H
Suffix to indicate the high byte of a word-sized data.
-L
Suffix to indicate the lower byte of a word-sized data.
DO
Short for Discrete Output (also known as Digital Output).
DI
Short for Discrete Input (also known as Digital Input).
AO
Short for Analog Output.
AI
Short for Analog Input.
CC1000 Modbus Reference 2.10e! 45/122

Notes on Using Modscan
This is not a manual of Modscan, but only a short note describing its manual commands capability.
Most users are familiar with Modscanʼs ability to read and continuously poll a designated device using Modbus
commands 1 to 4. But in addition, Modscan also has the ability to issue other commands as well.
For the CC1000, function code 5 and 16 needs to be issued as well. To issue them, first make sure that the connection
has already been established and running then go to the menu and run the dialog box “User Defined Command String”
from [Setup->Extended->User Msg] as shown in the screen captures below:
Notes on Using Modscan
CC1000 Modbus Reference 2.10e! 46/122

Although every effort has been taken to ensure that this document is free from errors, some may still remain. If found
please send an email to: info@daeinstrument.com, in the subject line write “Errata” and please indicate the name of this
document “CC1000 Modbus Reference”, revision number, page number and indicate the error with its correction.
We have made sure that this document is as clear and useful to you as possible, but any suggestions on improving this
document to serve you even better would be welcome. Send comments and suggestions to: info@daeinstrument.com, in
the subject line, write “Comments” and please indicate the name of this document “CC1000 Modbus Reference”.
Questions are also welcome.
This document only covers the Modbus protocol registers as used by the CC1000 gateway, for hardware interfacing and
other information please refer to the other documentation for the CC1000.
CC1000 Modbus Reference 2.10e! 47/122

These precomputed tables are for control commands function code 5 only. The CC1000 device address is assumed to
be set to 1. The CRC is the last two bytes of the command query and is included in the command query.
Set Group Off/On
CC1000 Modbus Reference 2.10e! 48/122

Dual DO Pulse Out
Command Query
Dual DO Pulse Out
Command Query
Dual DO Pulse Out
Command Query
Dual DO Pulse Out
Command Query
341,5,5,101,255,0,156,233
561,5,5,102,255,0,108,233
561,5,5,106,255,0,172,234
781,5,5,111,255,0,188,235
121,5,5,116,255,0,204,236
341,5,5,113,255,0,220,237
561,5,5,126,255,0,236,238
781,5,5,123,255,0,252,239
121,5,5,132,255,0,204,223
341,5,5,129,255,0,220,222
561,5,5,142,255,0,236,221
781,5,5,139,255,0,252,220
121,5,5,144,255,0,140,219
341,5,5,149,255,0,156,218
561,5,5,150,255,0,108,218
561,5,5,154,255,0,172,217
781,5,5,147,255,0,124,219
781,5,5,159,255,0,188,216
121,5,5,160,255,0,140,212
341,5,5,165,255,0,156,213
561,5,5,166,255,0,108,213
561,5,5,170,255,0,172,214
781,5,5,163,255,0,124,212
781,5,5,175,255,0,188,215
121,5,5,180,255,0,204,208
341,5,5,177,255,0,220,209
561,5,5,190,255,0,236,210
CC1000 Modbus Reference 2.10e! 58/122

Dual DO Pulse Out
Command Query
Dual DO Pulse Out
Command Query
Dual DO Pulse Out
Command Query
Dual DO Pulse Out
Command Query
781,5,5,187,255,0,252,211
121,5,5,192,255,0,140,202
341,5,5,197,255,0,156,203
561,5,5,198,255,0,108,203
561,5,5,202,255,0,172,200
781,5,5,195,255,0,124,202
781,5,5,207,255,0,188,201
121,5,5,212,255,0,204,206
341,5,5,209,255,0,220,207
561,5,5,222,255,0,236,204
781,5,5,219,255,0,252,205
121,5,5,228,255,0,204,193
341,5,5,225,255,0,220,192
561,5,5,238,255,0,236,195
781,5,5,235,255,0,252,194
121,5,5,240,255,0,140,197
341,5,5,245,255,0,156,196
561,5,5,246,255,0,108,196
561,5,5,250,255,0,172,199
781,5,5,243,255,0,124,197
781,5,5,255,255,0,188,198
CC1000 Modbus Reference 2.10e! 59/122

Complete Register Table For R/W Address
Complete Register Table For R/W Address
Use function code 3 to read, use function code 16 to write.
Register Addresses 0 to 767
3000013000123000233000343000453000563000673000783000893000910300101130011123001213300131430014153001516300161730017183001819300192030020213002122300222330023243002425300252630026273002728300282930029
LT 1: DO 1~8
LT 2: DO 1~8
LT 3: DO 1~8
LT 4: DO 1~8
LT 5: DO 1~8
LT 6: DO 1~8
LT 7: DO 1~8
LT 8: DO 1~8
LT 9: DO 1~8
LT 10: DO 1~8
LT 11: DO 1~8
LT 12: DO 1~8
LT 13: DO 1~8
LT 14: DO 1~8
LT 15: DO 1~8
LT 16: DO 1~8
LT 17: DO 1~8
LT 18: DO 1~8
LT 19: DO 1~8
LT 20: DO 1~8
LT 21: DO 1~8
LT 22: DO 1~8
LT 23: DO 1~8
LT 24: DO 1~8
LT 25: DO 1~8
LT 26: DO 1~8
LT 27: DO 1~8
LT 28: DO 1~8
LT 29: DO 1~8
LT 30: DO 1~8
LT 31: DO 1~8
LT 32: DO 1~8
LT 33: DO 1~8
LT 34: DO 1~8
LT 35: DO 1~8
LT 36: DO 1~8
LT 37: DO 1~8
LT 38: DO 1~8
LT 39: DO 1~8
LT 40: DO 1~8
LT 41: DO 1~8
LT 42: DO 1~8
LT 43: DO 1~8
LT 44: DO 1~8
LT 45: DO 1~8
LT 46: DO 1~8
LT 47: DO 1~8
LT 48: DO 1~8
LT 49: DO 1~8
LT 50: DO 1~8
LT 51: DO 1~8
LT 52: DO 1~8
LT 53: DO 1~8
LT 54: DO 1~8
LT 55: DO 1~8
LT 56: DO 1~8
LT 57: DO 1~8
LT 58: DO 1~8
LT 59: DO 1~8
LT 60: DO 1~8
CC1000 Modbus Reference 2.10e! 60/122

300323330033343003435300353630036373003738300383930039403004041300414230042433004344300444530045463004647300474830048493004950300505130051523005253300535430054553005556300565730057583005859300596030060613006162300626330063643006465300656630066673006768300686930069703007071300717230072733007374300747530075763007677300777830078
LT 61: DO 1~8
LT 62: DO 1~8
LT 63: DO 1~8
LT 64: DO 1~8
CC1000 Modbus Reference 2.10e! 61/122

3007980300808130081823008283300838430084853008586300868730087883008889300899030090913009192300929330093943009495300959630096973009798300989930099
CC1000 Modbus Reference 2.10e! 62/122

Register Addresses 768 to 1279
CC1000 Modbus Reference 2.10e! 74/122

Register Addresses 2816 to 3327
CC1000 Modbus Reference 2.10e! 84/122

Complete Register Table For Control Addresses
Complete Register Table For Control Address
Use function code 5 to issue the control command.
Register Addresses 1 to 767
12345678910111213141516171819202122232425262728293031323334353637383940414243441
CC1000 Modbus Reference 2.10e! 95/122

4546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394951Set Group On/Off
CC1000 Modbus Reference 2.10e! 96/122