<![CDATA[Smart Home Automation Forum - "KCS" v3 firmware]]> https://www.kincony.com/forum/ Mon, 09 Nov 2026 09:20:45 +0000 MyBB <![CDATA["KCS" v3.27.4 firmware BIN file download]]> https://www.kincony.com/forum/showthread.php?tid=9929 Mon, 02 Nov 2026 14:02:07 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9929
1. Added: Automatic GPIO expander detection, supporting both PCF8575 and XL9555SS.
2. Added: Per-channel current direction reversal settings for the N series.
3. Improved: IR learning capacity and storage, and data saving before restarting via the web interface.
4. Fixed: Issues with ADC current sampling and 4–20 mA conversion.
5. Fixed: Incorrect reporting of zero accumulated energy at startup.
6. Fixed: Clearing energy totals unintentionally resetting calibration coefficients.
7. Fixed: SHT30 read failures after a software restart and stack overflow issues with Modbus sensors.
8. Fixed: Incorrect state class for Home Assistant power sensors.

.zip   KCS_A2V3_V3.27.4.zip (Size: 1.28 MB / Downloads: 45)

.zip   KCS_A6V3_V3.27.4.zip (Size: 1.25 MB / Downloads: 45)

.zip   KCS_A8V3_V3.27.4.zip (Size: 1.3 MB / Downloads: 44)

.zip   KCS_A16V3_V3.27.4.zip (Size: 1.32 MB / Downloads: 55)

.zip   KCS_A32PRO_V3.27.4.zip (Size: 1.29 MB / Downloads: 37)

.zip   KCS_AG8_V3.27.4.zip (Size: 1.24 MB / Downloads: 38)

.zip   KCS_AGV3_V3.27.4.zip (Size: 1.19 MB / Downloads: 43)

.zip   KCS_AIO_HYBRID_V3.27.4.zip (Size: 1.5 MB / Downloads: 35)

.zip   KCS_ALR_V3.27.4.zip (Size: 1.22 MB / Downloads: 38)

.zip   KCS_B2_V3.27.4.zip (Size: 1.31 MB / Downloads: 41)

.zip   KCS_B4_V3.27.4.zip (Size: 1.31 MB / Downloads: 39)

.zip   KCS_B4M_V3.27.4.zip (Size: 1.31 MB / Downloads: 39)

.zip   KCS_B8_V3.27.4.zip (Size: 1.31 MB / Downloads: 38)

.zip   KCS_B8M_V3.27.4.zip (Size: 1.31 MB / Downloads: 39)

.zip   KCS_B16_V3.27.4.zip (Size: 1.31 MB / Downloads: 36)

.zip   KCS_B16M_V3.27.4.zip (Size: 1.31 MB / Downloads: 35)

.zip   KCS_B24_V3.27.4.zip (Size: 1.31 MB / Downloads: 35)

.zip   KCS_B24M_V3.27.4.zip (Size: 1.31 MB / Downloads: 36)

.zip   KCS_B32M_V3.27.4.zip (Size: 1.31 MB / Downloads: 40)

.zip   KCS_CO16_V3.27.4.zip (Size: 1.31 MB / Downloads: 36)

.zip   KCS_DM4_V3.27.4.zip (Size: 1.31 MB / Downloads: 40)

.zip   KCS_DM8_V3.27.4.zip (Size: 1.31 MB / Downloads: 44)

.zip   KCS_DM16_V3.27.4.zip (Size: 1.28 MB / Downloads: 38)

.zip   KCS_DM32_V3.27.4.zip (Size: 1.31 MB / Downloads: 43)

.zip   KCS_F4_V3.27.4.zip (Size: 1.3 MB / Downloads: 44)

.zip   KCS_F8_V3.27.4.zip (Size: 1.3 MB / Downloads: 31)

.zip   KCS_F16_V3.27.4.zip (Size: 1.32 MB / Downloads: 34)

.zip   KCS_F24_V3.27.4.zip (Size: 1.32 MB / Downloads: 34)

.zip   KCS_F32_V3.27.4.zip (Size: 1.32 MB / Downloads: 33)

.zip   KCS_G1_V3.27.4.zip (Size: 1.25 MB / Downloads: 34)

.zip   KCS_KC_TA_V3.27.4.zip (Size: 1.26 MB / Downloads: 40)

.zip   KCS_MT4_V3.27.4.zip (Size: 1.24 MB / Downloads: 34)

.zip   KCS_N10_V3.27.4.zip (Size: 1.15 MB / Downloads: 36)

.zip   KCS_N20_V3.27.4.zip (Size: 1.15 MB / Downloads: 46)

.zip   KCS_N30_V3.27.4.zip (Size: 1.15 MB / Downloads: 39)

.zip   KCS_N60_V3.27.4.zip (Size: 1.17 MB / Downloads: 33)

.zip   KCS_T16M_V3.27.4.zip (Size: 1.26 MB / Downloads: 39)

.zip   KCS_T32M_V3.27.4.zip (Size: 1.28 MB / Downloads: 35)

.zip   KCS_T64M_V3.27.4.zip (Size: 1.28 MB / Downloads: 43)

.zip   KCS_T128M_V3.27.4.zip (Size: 1.28 MB / Downloads: 39)

.zip   KCS_TR_V3.27.4.zip (Size: 1.21 MB / Downloads: 33)

.zip   KCS_Z1_V3.27.4.zip (Size: 1.38 MB / Downloads: 40) ]]>
1. Added: Automatic GPIO expander detection, supporting both PCF8575 and XL9555SS.
2. Added: Per-channel current direction reversal settings for the N series.
3. Improved: IR learning capacity and storage, and data saving before restarting via the web interface.
4. Fixed: Issues with ADC current sampling and 4–20 mA conversion.
5. Fixed: Incorrect reporting of zero accumulated energy at startup.
6. Fixed: Clearing energy totals unintentionally resetting calibration coefficients.
7. Fixed: SHT30 read failures after a software restart and stack overflow issues with Modbus sensors.
8. Fixed: Incorrect state class for Home Assistant power sensors.

.zip   KCS_A2V3_V3.27.4.zip (Size: 1.28 MB / Downloads: 45)

.zip   KCS_A6V3_V3.27.4.zip (Size: 1.25 MB / Downloads: 45)

.zip   KCS_A8V3_V3.27.4.zip (Size: 1.3 MB / Downloads: 44)

.zip   KCS_A16V3_V3.27.4.zip (Size: 1.32 MB / Downloads: 55)

.zip   KCS_A32PRO_V3.27.4.zip (Size: 1.29 MB / Downloads: 37)

.zip   KCS_AG8_V3.27.4.zip (Size: 1.24 MB / Downloads: 38)

.zip   KCS_AGV3_V3.27.4.zip (Size: 1.19 MB / Downloads: 43)

.zip   KCS_AIO_HYBRID_V3.27.4.zip (Size: 1.5 MB / Downloads: 35)

.zip   KCS_ALR_V3.27.4.zip (Size: 1.22 MB / Downloads: 38)

.zip   KCS_B2_V3.27.4.zip (Size: 1.31 MB / Downloads: 41)

.zip   KCS_B4_V3.27.4.zip (Size: 1.31 MB / Downloads: 39)

.zip   KCS_B4M_V3.27.4.zip (Size: 1.31 MB / Downloads: 39)

.zip   KCS_B8_V3.27.4.zip (Size: 1.31 MB / Downloads: 38)

.zip   KCS_B8M_V3.27.4.zip (Size: 1.31 MB / Downloads: 39)

.zip   KCS_B16_V3.27.4.zip (Size: 1.31 MB / Downloads: 36)

.zip   KCS_B16M_V3.27.4.zip (Size: 1.31 MB / Downloads: 35)

.zip   KCS_B24_V3.27.4.zip (Size: 1.31 MB / Downloads: 35)

.zip   KCS_B24M_V3.27.4.zip (Size: 1.31 MB / Downloads: 36)

.zip   KCS_B32M_V3.27.4.zip (Size: 1.31 MB / Downloads: 40)

.zip   KCS_CO16_V3.27.4.zip (Size: 1.31 MB / Downloads: 36)

.zip   KCS_DM4_V3.27.4.zip (Size: 1.31 MB / Downloads: 40)

.zip   KCS_DM8_V3.27.4.zip (Size: 1.31 MB / Downloads: 44)

.zip   KCS_DM16_V3.27.4.zip (Size: 1.28 MB / Downloads: 38)

.zip   KCS_DM32_V3.27.4.zip (Size: 1.31 MB / Downloads: 43)

.zip   KCS_F4_V3.27.4.zip (Size: 1.3 MB / Downloads: 44)

.zip   KCS_F8_V3.27.4.zip (Size: 1.3 MB / Downloads: 31)

.zip   KCS_F16_V3.27.4.zip (Size: 1.32 MB / Downloads: 34)

.zip   KCS_F24_V3.27.4.zip (Size: 1.32 MB / Downloads: 34)

.zip   KCS_F32_V3.27.4.zip (Size: 1.32 MB / Downloads: 33)

.zip   KCS_G1_V3.27.4.zip (Size: 1.25 MB / Downloads: 34)

.zip   KCS_KC_TA_V3.27.4.zip (Size: 1.26 MB / Downloads: 40)

.zip   KCS_MT4_V3.27.4.zip (Size: 1.24 MB / Downloads: 34)

.zip   KCS_N10_V3.27.4.zip (Size: 1.15 MB / Downloads: 36)

.zip   KCS_N20_V3.27.4.zip (Size: 1.15 MB / Downloads: 46)

.zip   KCS_N30_V3.27.4.zip (Size: 1.15 MB / Downloads: 39)

.zip   KCS_N60_V3.27.4.zip (Size: 1.17 MB / Downloads: 33)

.zip   KCS_T16M_V3.27.4.zip (Size: 1.26 MB / Downloads: 39)

.zip   KCS_T32M_V3.27.4.zip (Size: 1.28 MB / Downloads: 35)

.zip   KCS_T64M_V3.27.4.zip (Size: 1.28 MB / Downloads: 43)

.zip   KCS_T128M_V3.27.4.zip (Size: 1.28 MB / Downloads: 39)

.zip   KCS_TR_V3.27.4.zip (Size: 1.21 MB / Downloads: 33)

.zip   KCS_Z1_V3.27.4.zip (Size: 1.38 MB / Downloads: 40) ]]> <![CDATA[IFTTT FEATURE]]> https://www.kincony.com/forum/showthread.php?tid=9903 Mon, 26 Oct 2026 05:59:27 +0800 Saif Kitany]]> https://www.kincony.com/forum/showthread.php?tid=9903 I want to make a condition by kcs v3 like this :

If the relays 2,4,6,……..,32 in H32B are on, then turn on relay2 in A8v3.

I made a custom protocol 3 like this:

Realy-status-255,170,170,170,170

The router is: TCP Client.

In the IFTTT Condition, i put this:

If “custom protol 3”, Then DO2 ON.

But it didn’t work!!

Is there something i need to correct?]]> I want to make a condition by kcs v3 like this :

If the relays 2,4,6,……..,32 in H32B are on, then turn on relay2 in A8v3.

I made a custom protocol 3 like this:

Realy-status-255,170,170,170,170

The router is: TCP Client.

In the IFTTT Condition, i put this:

If “custom protol 3”, Then DO2 ON.

But it didn’t work!!

Is there something i need to correct?]]> <![CDATA[[Bug] A16v3 KCS 3.27.2 - SHT30/SHT31 fails after software reboot]]> https://www.kincony.com/forum/showthread.php?tid=9872 Sat, 17 Oct 2026 02:04:41 +0800 rokrok]]> https://www.kincony.com/forum/showthread.php?tid=9872 Hardware:
  • KC868-A16v3
  • KCS v3.27.2
  • KinCony SHT30 temperature/humidity sensor
  • I2C address 68 decimal (0x44)
Problem:
After a complete 12 V power cycle, the SHT30 works immediately and temperature/humidity values are displayed normally.
However, if I use Reboot from the KCS web interface, the sensor stops working.
The application log then shows:
Code:
i2c.master: I2C transaction unexpected nack detected
i2c.master: s_i2c_synchronous_transaction(872): I2C transaction failed
i2c.master: i2c_master_transmit(1074): I2C transaction failed
sensor: sht31 error, id=0
KCS retries the sensor, but it may remain unavailable.
How to reproduce:
  1. Power off the whole A16v3 (12 V supply).
  2. Power it on again.
  3. SHT30 data appears immediately and works normally.
  4. In the KCS web interface select Reboot.
  5. After the reboot the SHT30 is no longer available and the log reports I2C NACK / sht31 error.
  6. Remove 12 V power completely and power the A16v3 again.
  7. SHT30 works immediately again.
I have tested this with two different SHT30 sensors.
Initially one sensor had an extended cable, so I suspected the I2C cable length. I then tested a second SHT30 with its original unmodified cable, and it failed immediately after the first KCS software reboot in exactly the same way.
Therefore the cable extension is not the cause.
A complete power cycle of the A16v3/sensor consistently restores operation, while a KCS software reboot can cause the sensor to fail.
It looks like the SHT30/I2C bus or sensor is not being correctly reset/reinitialized after an ESP32 software reboot.
Could you please reproduce this with an A16v3 + SHT30 and check the sensor/I2C initialization after software reboot?]]> Hardware:
  • KC868-A16v3
  • KCS v3.27.2
  • KinCony SHT30 temperature/humidity sensor
  • I2C address 68 decimal (0x44)
Problem:
After a complete 12 V power cycle, the SHT30 works immediately and temperature/humidity values are displayed normally.
However, if I use Reboot from the KCS web interface, the sensor stops working.
The application log then shows:
Code:
i2c.master: I2C transaction unexpected nack detected
i2c.master: s_i2c_synchronous_transaction(872): I2C transaction failed
i2c.master: i2c_master_transmit(1074): I2C transaction failed
sensor: sht31 error, id=0
KCS retries the sensor, but it may remain unavailable.
How to reproduce:
  1. Power off the whole A16v3 (12 V supply).
  2. Power it on again.
  3. SHT30 data appears immediately and works normally.
  4. In the KCS web interface select Reboot.
  5. After the reboot the SHT30 is no longer available and the log reports I2C NACK / sht31 error.
  6. Remove 12 V power completely and power the A16v3 again.
  7. SHT30 works immediately again.
I have tested this with two different SHT30 sensors.
Initially one sensor had an extended cable, so I suspected the I2C cable length. I then tested a second SHT30 with its original unmodified cable, and it failed immediately after the first KCS software reboot in exactly the same way.
Therefore the cable extension is not the cause.
A complete power cycle of the A16v3/sensor consistently restores operation, while a KCS software reboot can cause the sensor to fail.
It looks like the SHT30/I2C bus or sensor is not being correctly reset/reinitialized after an ESP32 software reboot.
Could you please reproduce this with an A16v3 + SHT30 and check the sensor/I2C initialization after software reboot?]]> <![CDATA[A32 pro tuya]]> https://www.kincony.com/forum/showthread.php?tid=9842 Tue, 22 Sep 2026 04:27:24 +0800 Saif Kitany]]> https://www.kincony.com/forum/showthread.php?tid=9842

I have A32 pro, I connected to it ethernet cable.

The tuya part i set by wifi. It’s working.

When the wifi fail, so no more controlling by tuya. I see on the display of A32 pro “tuya offline”.

My question is:

Can I keep controlling A32 pro With tuya by ethernet, even if wifi broke?]]>

I have A32 pro, I connected to it ethernet cable.

The tuya part i set by wifi. It’s working.

When the wifi fail, so no more controlling by tuya. I see on the display of A32 pro “tuya offline”.

My question is:

Can I keep controlling A32 pro With tuya by ethernet, even if wifi broke?]]> <![CDATA[config modbus sensor in KCS]]> https://www.kincony.com/forum/showthread.php?tid=9839 Sat, 19 Sep 2026 19:52:30 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9839
.jpg   oxygen-sensor-1.jpg (Size: 401.14 KB / Downloads: 132)

.jpg   oxygen-sensor-2.jpg (Size: 188.69 KB / Downloads: 135)
here is oxygen sensor modbus protocol:

.png   oxygen-modbus-sensor.png (Size: 162.95 KB / Downloads: 140)
here is config sensor in KCS "sensor" webpage, chose "modbus" type of sensor.

.png   kcs-oxygen-modbus-sensor.png (Size: 86.49 KB / Downloads: 133)

slave: 22
function code: 03
register: 104
data type: uint16
byte order: abcd big endian
multiplier: 0.1

KCS monitor will show the sensor value:

.png   oxygen-sensor-value.png (Size: 43.16 KB / Downloads: 131) ]]>
.jpg   oxygen-sensor-1.jpg (Size: 401.14 KB / Downloads: 132)

.jpg   oxygen-sensor-2.jpg (Size: 188.69 KB / Downloads: 135)
here is oxygen sensor modbus protocol:

.png   oxygen-modbus-sensor.png (Size: 162.95 KB / Downloads: 140)
here is config sensor in KCS "sensor" webpage, chose "modbus" type of sensor.

.png   kcs-oxygen-modbus-sensor.png (Size: 86.49 KB / Downloads: 133)

slave: 22
function code: 03
register: 104
data type: uint16
byte order: abcd big endian
multiplier: 0.1

KCS monitor will show the sensor value:

.png   oxygen-sensor-value.png (Size: 43.16 KB / Downloads: 131) ]]> <![CDATA["KCS" v3.27.2 firmware BIN file download]]> https://www.kincony.com/forum/showthread.php?tid=9817 Fri, 11 Sep 2026 10:40:33 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9817
1: Fix native Tuya MQTT TLS verification for the Central Europe data center by adding DigiCert Global Root G2 to the embedded CA bundle while retaining Go Daddy G2 and existing TLS verification settings. (if you using tuya license, need update this firmware)

2: Add RAM-backed application logs to the System page with authenticated polling and preserved serial output.

.zip   KCS_B32M_V3.27.2.zip (Size: 1.3 MB / Downloads: 188)

.zip   KCS_A2V3_V3.27.2.zip (Size: 1.27 MB / Downloads: 145)

.zip   KCS_A6V3_V3.27.2.zip (Size: 1.24 MB / Downloads: 137)

.zip   KCS_A8V3_V3.27.2.zip (Size: 1.29 MB / Downloads: 168)

.zip   KCS_A16V3_V3.27.2.zip (Size: 1.31 MB / Downloads: 226)

.zip   KCS_A32PRO_V3.27.2.zip (Size: 1.28 MB / Downloads: 129)

.zip   KCS_AG8_V3.27.2.zip (Size: 1.23 MB / Downloads: 117)

.zip   KCS_AGV3_V3.27.2.zip (Size: 1.18 MB / Downloads: 136)

.zip   KCS_AIO_HYBRID_V3.27.2.zip (Size: 1.49 MB / Downloads: 127)

.zip   KCS_ALR_V3.27.2.zip (Size: 1.21 MB / Downloads: 118)

.zip   KCS_B2_V3.27.2.zip (Size: 1.3 MB / Downloads: 121)

.zip   KCS_B4_V3.27.2.zip (Size: 1.3 MB / Downloads: 118)

.zip   KCS_B4M_V3.27.2.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B8_V3.27.2.zip (Size: 1.3 MB / Downloads: 140)

.zip   KCS_B8M_V3.27.2.zip (Size: 1.3 MB / Downloads: 139)

.zip   KCS_B16_V3.27.2.zip (Size: 1.3 MB / Downloads: 136)

.zip   KCS_B16M_V3.27.2.zip (Size: 1.3 MB / Downloads: 132)

.zip   KCS_B24_V3.27.2.zip (Size: 1.3 MB / Downloads: 107)

.zip   KCS_B24M_V3.27.2.zip (Size: 1.3 MB / Downloads: 129)

.zip   KCS_CO16_V3.27.2.zip (Size: 1.29 MB / Downloads: 122)

.zip   KCS_DM4_V3.27.2.zip (Size: 1.3 MB / Downloads: 107)

.zip   KCS_DM8_V3.27.2.zip (Size: 1.3 MB / Downloads: 123)

.zip   KCS_DM16_V3.27.2.zip (Size: 1.27 MB / Downloads: 121)

.zip   KCS_DM32_V3.27.2.zip (Size: 1.3 MB / Downloads: 114)

.zip   KCS_F4_V3.27.2.zip (Size: 1.29 MB / Downloads: 128)

.zip   KCS_F8_V3.27.2.zip (Size: 1.29 MB / Downloads: 130)

.zip   KCS_F16_V3.27.2.zip (Size: 1.31 MB / Downloads: 138)

.zip   KCS_F24_V3.27.2.zip (Size: 1.31 MB / Downloads: 125)

.zip   KCS_F32_V3.27.2.zip (Size: 1.31 MB / Downloads: 128)

.zip   KCS_G1_V3.27.2.zip (Size: 1.24 MB / Downloads: 125)

.zip   KCS_KC_TA_V3.27.2.zip (Size: 1.25 MB / Downloads: 122)

.zip   KCS_MT4_V3.27.2.zip (Size: 1.23 MB / Downloads: 127)

.zip   KCS_N10_V3.27.2.zip (Size: 1.14 MB / Downloads: 130)

.zip   KCS_N20_V3.27.2.zip (Size: 1.14 MB / Downloads: 113)

.zip   KCS_N30_V3.27.2.zip (Size: 1.14 MB / Downloads: 127)

.zip   KCS_N60_V3.27.2.zip (Size: 1.16 MB / Downloads: 140)

.zip   KCS_T16M_V3.27.2.zip (Size: 1.25 MB / Downloads: 137)

.zip   KCS_T32M_V3.27.2.zip (Size: 1.27 MB / Downloads: 129)

.zip   KCS_T64M_V3.27.2.zip (Size: 1.27 MB / Downloads: 129)

.zip   KCS_T128M_V3.27.2.zip (Size: 1.27 MB / Downloads: 119)

.zip   KCS_TR_V3.27.2.zip (Size: 1.2 MB / Downloads: 111)

.zip   KCS_Z1_V3.27.2.zip (Size: 1.37 MB / Downloads: 124) ]]>
1: Fix native Tuya MQTT TLS verification for the Central Europe data center by adding DigiCert Global Root G2 to the embedded CA bundle while retaining Go Daddy G2 and existing TLS verification settings. (if you using tuya license, need update this firmware)

2: Add RAM-backed application logs to the System page with authenticated polling and preserved serial output.

.zip   KCS_B32M_V3.27.2.zip (Size: 1.3 MB / Downloads: 188)

.zip   KCS_A2V3_V3.27.2.zip (Size: 1.27 MB / Downloads: 145)

.zip   KCS_A6V3_V3.27.2.zip (Size: 1.24 MB / Downloads: 137)

.zip   KCS_A8V3_V3.27.2.zip (Size: 1.29 MB / Downloads: 168)

.zip   KCS_A16V3_V3.27.2.zip (Size: 1.31 MB / Downloads: 226)

.zip   KCS_A32PRO_V3.27.2.zip (Size: 1.28 MB / Downloads: 129)

.zip   KCS_AG8_V3.27.2.zip (Size: 1.23 MB / Downloads: 117)

.zip   KCS_AGV3_V3.27.2.zip (Size: 1.18 MB / Downloads: 136)

.zip   KCS_AIO_HYBRID_V3.27.2.zip (Size: 1.49 MB / Downloads: 127)

.zip   KCS_ALR_V3.27.2.zip (Size: 1.21 MB / Downloads: 118)

.zip   KCS_B2_V3.27.2.zip (Size: 1.3 MB / Downloads: 121)

.zip   KCS_B4_V3.27.2.zip (Size: 1.3 MB / Downloads: 118)

.zip   KCS_B4M_V3.27.2.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B8_V3.27.2.zip (Size: 1.3 MB / Downloads: 140)

.zip   KCS_B8M_V3.27.2.zip (Size: 1.3 MB / Downloads: 139)

.zip   KCS_B16_V3.27.2.zip (Size: 1.3 MB / Downloads: 136)

.zip   KCS_B16M_V3.27.2.zip (Size: 1.3 MB / Downloads: 132)

.zip   KCS_B24_V3.27.2.zip (Size: 1.3 MB / Downloads: 107)

.zip   KCS_B24M_V3.27.2.zip (Size: 1.3 MB / Downloads: 129)

.zip   KCS_CO16_V3.27.2.zip (Size: 1.29 MB / Downloads: 122)

.zip   KCS_DM4_V3.27.2.zip (Size: 1.3 MB / Downloads: 107)

.zip   KCS_DM8_V3.27.2.zip (Size: 1.3 MB / Downloads: 123)

.zip   KCS_DM16_V3.27.2.zip (Size: 1.27 MB / Downloads: 121)

.zip   KCS_DM32_V3.27.2.zip (Size: 1.3 MB / Downloads: 114)

.zip   KCS_F4_V3.27.2.zip (Size: 1.29 MB / Downloads: 128)

.zip   KCS_F8_V3.27.2.zip (Size: 1.29 MB / Downloads: 130)

.zip   KCS_F16_V3.27.2.zip (Size: 1.31 MB / Downloads: 138)

.zip   KCS_F24_V3.27.2.zip (Size: 1.31 MB / Downloads: 125)

.zip   KCS_F32_V3.27.2.zip (Size: 1.31 MB / Downloads: 128)

.zip   KCS_G1_V3.27.2.zip (Size: 1.24 MB / Downloads: 125)

.zip   KCS_KC_TA_V3.27.2.zip (Size: 1.25 MB / Downloads: 122)

.zip   KCS_MT4_V3.27.2.zip (Size: 1.23 MB / Downloads: 127)

.zip   KCS_N10_V3.27.2.zip (Size: 1.14 MB / Downloads: 130)

.zip   KCS_N20_V3.27.2.zip (Size: 1.14 MB / Downloads: 113)

.zip   KCS_N30_V3.27.2.zip (Size: 1.14 MB / Downloads: 127)

.zip   KCS_N60_V3.27.2.zip (Size: 1.16 MB / Downloads: 140)

.zip   KCS_T16M_V3.27.2.zip (Size: 1.25 MB / Downloads: 137)

.zip   KCS_T32M_V3.27.2.zip (Size: 1.27 MB / Downloads: 129)

.zip   KCS_T64M_V3.27.2.zip (Size: 1.27 MB / Downloads: 129)

.zip   KCS_T128M_V3.27.2.zip (Size: 1.27 MB / Downloads: 119)

.zip   KCS_TR_V3.27.2.zip (Size: 1.2 MB / Downloads: 111)

.zip   KCS_Z1_V3.27.2.zip (Size: 1.37 MB / Downloads: 124) ]]> <![CDATA["KCS" v3.27.1 firmware BIN file download]]> https://www.kincony.com/forum/showthread.php?tid=9808 Tue, 08 Sep 2026 11:24:41 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9808
Optimized memory issues to fix BACnet/IP protocol stack startup.

.zip   KCS_A2V3_V3.27.1.zip (Size: 1.26 MB / Downloads: 128)

.zip   KCS_A6V3_V3.27.1.zip (Size: 1.24 MB / Downloads: 139)

.zip   KCS_A8V3_V3.27.1.zip (Size: 1.29 MB / Downloads: 134)

.zip   KCS_A16V3_V3.27.1.zip (Size: 1.31 MB / Downloads: 140)

.zip   KCS_A32PRO_V3.27.1.zip (Size: 1.28 MB / Downloads: 129)

.zip   KCS_AG8_V3.27.1.zip (Size: 1.23 MB / Downloads: 120)

.zip   KCS_AGV3_V3.27.1.zip (Size: 1.17 MB / Downloads: 127)

.zip   KCS_AIO_HYBRID_V3.27.1.zip (Size: 1.48 MB / Downloads: 126)

.zip   KCS_ALR_V3.27.1.zip (Size: 1.21 MB / Downloads: 122)

.zip   KCS_B2_V3.27.1.zip (Size: 1.3 MB / Downloads: 127)

.zip   KCS_B4_V3.27.1.zip (Size: 1.3 MB / Downloads: 124)

.zip   KCS_B4M_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B8_V3.27.1.zip (Size: 1.3 MB / Downloads: 115)

.zip   KCS_B8M_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B16_V3.27.1.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_B16M_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B24_V3.27.1.zip (Size: 1.3 MB / Downloads: 116)

.zip   KCS_B24M_V3.27.1.zip (Size: 1.3 MB / Downloads: 122)

.zip   KCS_B32M_V3.27.1.zip (Size: 1.3 MB / Downloads: 127)

.zip   KCS_CO16_V3.27.1.zip (Size: 1.29 MB / Downloads: 130)

.zip   KCS_DM4_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_DM8_V3.27.1.zip (Size: 1.3 MB / Downloads: 116)

.zip   KCS_DM16_V3.27.1.zip (Size: 1.27 MB / Downloads: 125)

.zip   KCS_DM32_V3.27.1.zip (Size: 1.3 MB / Downloads: 124)

.zip   KCS_F4_V3.27.1.zip (Size: 1.29 MB / Downloads: 128)

.zip   KCS_F8_V3.27.1.zip (Size: 1.29 MB / Downloads: 121)

.zip   KCS_F16_V3.27.1.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_F24_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_F32_V3.27.1.zip (Size: 1.3 MB / Downloads: 138)

.zip   KCS_G1_V3.27.1.zip (Size: 1.23 MB / Downloads: 119)

.zip   KCS_KC_TA_V3.27.1.zip (Size: 1.25 MB / Downloads: 122)

.zip   KCS_MT4_V3.27.1.zip (Size: 1.23 MB / Downloads: 126)

.zip   KCS_N10_V3.27.1.zip (Size: 1.14 MB / Downloads: 113)

.zip   KCS_N20_V3.27.1.zip (Size: 1.14 MB / Downloads: 116)

.zip   KCS_N30_V3.27.1.zip (Size: 1.14 MB / Downloads: 125)

.zip   KCS_N60_V3.27.1.zip (Size: 1.16 MB / Downloads: 113)

.zip   KCS_T16M_V3.27.1.zip (Size: 1.24 MB / Downloads: 114)

.zip   KCS_T32M_V3.27.1.zip (Size: 1.26 MB / Downloads: 119)

.zip   KCS_T64M_V3.27.1.zip (Size: 1.26 MB / Downloads: 120)

.zip   KCS_T128M_V3.27.1.zip (Size: 1.26 MB / Downloads: 114)

.zip   KCS_TR_V3.27.1.zip (Size: 1.2 MB / Downloads: 118)

.zip   KCS_Z1_V3.27.1.zip (Size: 1.37 MB / Downloads: 124) ]]>
Optimized memory issues to fix BACnet/IP protocol stack startup.

.zip   KCS_A2V3_V3.27.1.zip (Size: 1.26 MB / Downloads: 128)

.zip   KCS_A6V3_V3.27.1.zip (Size: 1.24 MB / Downloads: 139)

.zip   KCS_A8V3_V3.27.1.zip (Size: 1.29 MB / Downloads: 134)

.zip   KCS_A16V3_V3.27.1.zip (Size: 1.31 MB / Downloads: 140)

.zip   KCS_A32PRO_V3.27.1.zip (Size: 1.28 MB / Downloads: 129)

.zip   KCS_AG8_V3.27.1.zip (Size: 1.23 MB / Downloads: 120)

.zip   KCS_AGV3_V3.27.1.zip (Size: 1.17 MB / Downloads: 127)

.zip   KCS_AIO_HYBRID_V3.27.1.zip (Size: 1.48 MB / Downloads: 126)

.zip   KCS_ALR_V3.27.1.zip (Size: 1.21 MB / Downloads: 122)

.zip   KCS_B2_V3.27.1.zip (Size: 1.3 MB / Downloads: 127)

.zip   KCS_B4_V3.27.1.zip (Size: 1.3 MB / Downloads: 124)

.zip   KCS_B4M_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B8_V3.27.1.zip (Size: 1.3 MB / Downloads: 115)

.zip   KCS_B8M_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B16_V3.27.1.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_B16M_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_B24_V3.27.1.zip (Size: 1.3 MB / Downloads: 116)

.zip   KCS_B24M_V3.27.1.zip (Size: 1.3 MB / Downloads: 122)

.zip   KCS_B32M_V3.27.1.zip (Size: 1.3 MB / Downloads: 127)

.zip   KCS_CO16_V3.27.1.zip (Size: 1.29 MB / Downloads: 130)

.zip   KCS_DM4_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_DM8_V3.27.1.zip (Size: 1.3 MB / Downloads: 116)

.zip   KCS_DM16_V3.27.1.zip (Size: 1.27 MB / Downloads: 125)

.zip   KCS_DM32_V3.27.1.zip (Size: 1.3 MB / Downloads: 124)

.zip   KCS_F4_V3.27.1.zip (Size: 1.29 MB / Downloads: 128)

.zip   KCS_F8_V3.27.1.zip (Size: 1.29 MB / Downloads: 121)

.zip   KCS_F16_V3.27.1.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_F24_V3.27.1.zip (Size: 1.3 MB / Downloads: 119)

.zip   KCS_F32_V3.27.1.zip (Size: 1.3 MB / Downloads: 138)

.zip   KCS_G1_V3.27.1.zip (Size: 1.23 MB / Downloads: 119)

.zip   KCS_KC_TA_V3.27.1.zip (Size: 1.25 MB / Downloads: 122)

.zip   KCS_MT4_V3.27.1.zip (Size: 1.23 MB / Downloads: 126)

.zip   KCS_N10_V3.27.1.zip (Size: 1.14 MB / Downloads: 113)

.zip   KCS_N20_V3.27.1.zip (Size: 1.14 MB / Downloads: 116)

.zip   KCS_N30_V3.27.1.zip (Size: 1.14 MB / Downloads: 125)

.zip   KCS_N60_V3.27.1.zip (Size: 1.16 MB / Downloads: 113)

.zip   KCS_T16M_V3.27.1.zip (Size: 1.24 MB / Downloads: 114)

.zip   KCS_T32M_V3.27.1.zip (Size: 1.26 MB / Downloads: 119)

.zip   KCS_T64M_V3.27.1.zip (Size: 1.26 MB / Downloads: 120)

.zip   KCS_T128M_V3.27.1.zip (Size: 1.26 MB / Downloads: 114)

.zip   KCS_TR_V3.27.1.zip (Size: 1.2 MB / Downloads: 118)

.zip   KCS_Z1_V3.27.1.zip (Size: 1.37 MB / Downloads: 124) ]]> <![CDATA["KCS" v3.27 firmware BIN file download]]> https://www.kincony.com/forum/showthread.php?tid=9806 Mon, 07 Sep 2026 10:51:59 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9806
1: support CO16 controller
2: added BACnet, DMX512, KNX protocols
3: added enable/disable Tuya module option
4: added "Modbus Slave Debugger" tool in webpage

.zip   KCS_B32M_V3.27.0.zip (Size: 1.3 MB / Downloads: 121)

.zip   KCS_A2V3_V3.27.0.zip (Size: 1.26 MB / Downloads: 113)

.zip   KCS_A6V3_V3.27.0.zip (Size: 1.24 MB / Downloads: 122)

.zip   KCS_A8V3_V3.27.0.zip (Size: 1.29 MB / Downloads: 110)

.zip   KCS_A16V3_V3.27.0.zip (Size: 1.31 MB / Downloads: 123)

.zip   KCS_A32PRO_V3.27.0.zip (Size: 1.28 MB / Downloads: 109)

.zip   KCS_AG8_V3.27.0.zip (Size: 1.23 MB / Downloads: 108)

.zip   KCS_AGV3_V3.27.0.zip (Size: 1.17 MB / Downloads: 117)

.zip   KCS_AIO_HYBRID_V3.27.0.zip (Size: 1.48 MB / Downloads: 121)

.zip   KCS_ALR_V3.27.0.zip (Size: 1.21 MB / Downloads: 115)

.zip   KCS_B2_V3.27.0.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_B4_V3.27.0.zip (Size: 1.3 MB / Downloads: 123)

.zip   KCS_B4M_V3.27.0.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_B8_V3.27.0.zip (Size: 1.3 MB / Downloads: 114)

.zip   KCS_B8M_V3.27.0.zip (Size: 1.3 MB / Downloads: 127)

.zip   KCS_B16_V3.27.0.zip (Size: 1.3 MB / Downloads: 110)

.zip   KCS_B16M_V3.27.0.zip (Size: 1.3 MB / Downloads: 114)

.zip   KCS_B24_V3.27.0.zip (Size: 1.3 MB / Downloads: 118)

.zip   KCS_B24M_V3.27.0.zip (Size: 1.3 MB / Downloads: 118)

.zip   KCS_CO16_V3.27.0.zip (Size: 1.29 MB / Downloads: 118)

.zip   KCS_DM4_V3.27.0.zip (Size: 1.3 MB / Downloads: 124)

.zip   KCS_DM8_V3.27.0.zip (Size: 1.3 MB / Downloads: 112)

.zip   KCS_DM16_V3.27.0.zip (Size: 1.27 MB / Downloads: 125)

.zip   KCS_DM32_V3.27.0.zip (Size: 1.3 MB / Downloads: 110)

.zip   KCS_F4_V3.27.0.zip (Size: 1.29 MB / Downloads: 115)

.zip   KCS_F8_V3.27.0.zip (Size: 1.29 MB / Downloads: 113)

.zip   KCS_F16_V3.27.0.zip (Size: 1.3 MB / Downloads: 122)

.zip   KCS_F24_V3.27.0.zip (Size: 1.3 MB / Downloads: 128)

.zip   KCS_F32_V3.27.0.zip (Size: 1.3 MB / Downloads: 109)

.zip   KCS_G1_V3.27.0.zip (Size: 1.23 MB / Downloads: 119)

.zip   KCS_KC_TA_V3.27.0.zip (Size: 1.25 MB / Downloads: 117)

.zip   KCS_MT4_V3.27.0.zip (Size: 1.23 MB / Downloads: 121)

.zip   KCS_N10_V3.27.0.zip (Size: 1.14 MB / Downloads: 116)

.zip   KCS_N20_V3.27.0.zip (Size: 1.14 MB / Downloads: 123)

.zip   KCS_N30_V3.27.0.zip (Size: 1.14 MB / Downloads: 122)

.zip   KCS_N60_V3.27.0.zip (Size: 1.16 MB / Downloads: 113)

.zip   KCS_T16M_V3.27.0.zip (Size: 1.24 MB / Downloads: 115)

.zip   KCS_T32M_V3.27.0.zip (Size: 1.26 MB / Downloads: 118)

.zip   KCS_T64M_V3.27.0.zip (Size: 1.26 MB / Downloads: 119)

.zip   KCS_T128M_V3.27.0.zip (Size: 1.26 MB / Downloads: 115)

.zip   KCS_TR_V3.27.0.zip (Size: 1.2 MB / Downloads: 119)

.zip   KCS_Z1_V3.27.0.zip (Size: 1.37 MB / Downloads: 109) ]]>
1: support CO16 controller
2: added BACnet, DMX512, KNX protocols
3: added enable/disable Tuya module option
4: added "Modbus Slave Debugger" tool in webpage

.zip   KCS_B32M_V3.27.0.zip (Size: 1.3 MB / Downloads: 121)

.zip   KCS_A2V3_V3.27.0.zip (Size: 1.26 MB / Downloads: 113)

.zip   KCS_A6V3_V3.27.0.zip (Size: 1.24 MB / Downloads: 122)

.zip   KCS_A8V3_V3.27.0.zip (Size: 1.29 MB / Downloads: 110)

.zip   KCS_A16V3_V3.27.0.zip (Size: 1.31 MB / Downloads: 123)

.zip   KCS_A32PRO_V3.27.0.zip (Size: 1.28 MB / Downloads: 109)

.zip   KCS_AG8_V3.27.0.zip (Size: 1.23 MB / Downloads: 108)

.zip   KCS_AGV3_V3.27.0.zip (Size: 1.17 MB / Downloads: 117)

.zip   KCS_AIO_HYBRID_V3.27.0.zip (Size: 1.48 MB / Downloads: 121)

.zip   KCS_ALR_V3.27.0.zip (Size: 1.21 MB / Downloads: 115)

.zip   KCS_B2_V3.27.0.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_B4_V3.27.0.zip (Size: 1.3 MB / Downloads: 123)

.zip   KCS_B4M_V3.27.0.zip (Size: 1.3 MB / Downloads: 126)

.zip   KCS_B8_V3.27.0.zip (Size: 1.3 MB / Downloads: 114)

.zip   KCS_B8M_V3.27.0.zip (Size: 1.3 MB / Downloads: 127)

.zip   KCS_B16_V3.27.0.zip (Size: 1.3 MB / Downloads: 110)

.zip   KCS_B16M_V3.27.0.zip (Size: 1.3 MB / Downloads: 114)

.zip   KCS_B24_V3.27.0.zip (Size: 1.3 MB / Downloads: 118)

.zip   KCS_B24M_V3.27.0.zip (Size: 1.3 MB / Downloads: 118)

.zip   KCS_CO16_V3.27.0.zip (Size: 1.29 MB / Downloads: 118)

.zip   KCS_DM4_V3.27.0.zip (Size: 1.3 MB / Downloads: 124)

.zip   KCS_DM8_V3.27.0.zip (Size: 1.3 MB / Downloads: 112)

.zip   KCS_DM16_V3.27.0.zip (Size: 1.27 MB / Downloads: 125)

.zip   KCS_DM32_V3.27.0.zip (Size: 1.3 MB / Downloads: 110)

.zip   KCS_F4_V3.27.0.zip (Size: 1.29 MB / Downloads: 115)

.zip   KCS_F8_V3.27.0.zip (Size: 1.29 MB / Downloads: 113)

.zip   KCS_F16_V3.27.0.zip (Size: 1.3 MB / Downloads: 122)

.zip   KCS_F24_V3.27.0.zip (Size: 1.3 MB / Downloads: 128)

.zip   KCS_F32_V3.27.0.zip (Size: 1.3 MB / Downloads: 109)

.zip   KCS_G1_V3.27.0.zip (Size: 1.23 MB / Downloads: 119)

.zip   KCS_KC_TA_V3.27.0.zip (Size: 1.25 MB / Downloads: 117)

.zip   KCS_MT4_V3.27.0.zip (Size: 1.23 MB / Downloads: 121)

.zip   KCS_N10_V3.27.0.zip (Size: 1.14 MB / Downloads: 116)

.zip   KCS_N20_V3.27.0.zip (Size: 1.14 MB / Downloads: 123)

.zip   KCS_N30_V3.27.0.zip (Size: 1.14 MB / Downloads: 122)

.zip   KCS_N60_V3.27.0.zip (Size: 1.16 MB / Downloads: 113)

.zip   KCS_T16M_V3.27.0.zip (Size: 1.24 MB / Downloads: 115)

.zip   KCS_T32M_V3.27.0.zip (Size: 1.26 MB / Downloads: 118)

.zip   KCS_T64M_V3.27.0.zip (Size: 1.26 MB / Downloads: 119)

.zip   KCS_T128M_V3.27.0.zip (Size: 1.26 MB / Downloads: 115)

.zip   KCS_TR_V3.27.0.zip (Size: 1.2 MB / Downloads: 119)

.zip   KCS_Z1_V3.27.0.zip (Size: 1.37 MB / Downloads: 109) ]]> <![CDATA[KCS VERSUS ESPHOME]]> https://www.kincony.com/forum/showthread.php?tid=9757 Thu, 20 Aug 2026 23:21:58 +0800 EDVALDO DE MARINGA]]> https://www.kincony.com/forum/showthread.php?tid=9757 My plan is to use Home Assistant to control everything. Today, the KinCony A32 Pro physically controls the lights ON/OFF. Now I need to install the firmware, and the big question is: ESPHome or KCS?
I asked ChatGPT, Gemini, and Copilot, and they gave contradictory answers.
What ChatGPT said
ChatGPT initially recommended KCS + Home Assistant, arguing that KCS can integrate the A32 Pro through MQTT and MQTT Auto Discovery, and that I would not need ESPHome.
It cited KinCony’s forum, including a discussion where the administrator said that KCS and ESPHome cannot run simultaneously and recommended KCS v3 for users who do not know how to configure ESPHome.
It also cited the KinCony forum thread “A32 pro lost control”, where a user had flashed ESPHome and lost KCS. The administrator explained that KCS and ESPHome cannot coexist, and suggested enabling MQTT Auto Discovery in KCS to integrate the A32 Pro with Home Assistant.
Based on this, ChatGPT concluded:
  • I do not need ESPHome.
  • I can install KCS and integrate it with Home Assistant.
  • KCS + MQTT Auto Discovery is the simpler solution for my case.
What Copilot said
Copilot strongly disagreed and said Gemini was right and ChatGPT was wrong.
Its main argument is that KCS does not expose all 32 digital inputs of the A32 Pro to Home Assistant.
According to Copilot, KCS exposes:
  • Relays through MQTT
  • Basic sensors
  • Some internal states
But it does not expose DI1–DI32.
This is critical for my application because I want to use physical inputs/dry contacts to trigger automations such as:
Quote:Press a button → turn on one, two, or three lights.
Copilot says that without the digital inputs being available in Home Assistant, this type of automation cannot work as intended.
It also claims that KinCony has stated on its forum that if you want all inputs and outputs in Home Assistant, you should use ESPHome.
Copilot's other arguments are:
  1. KCS + MQTT Auto Discovery does not automatically expose the 32 digital inputs.
  2. Saying that KCS is simpler may be true for some smaller KinCony controllers, but not necessarily for the A32 Pro.
  3. The A32 Pro uses multiple I/O expanders, and ESPHome provides a more complete mapping of its inputs and outputs to Home Assistant.
My questions
I do not want a generic comparison between ESPHome and KCS. I want the answer specifically for the KinCony KC868-A32 Pro + Home Assistant, considering that my primary objective is to control lighting and use the physical digital inputs for automations.
1. Who is technically correct: Gemini/Copilot or ChatGPT?
More specifically: Does KCS v3 with MQTT Auto Discovery expose all 32 digital inputs of the A32 Pro to Home Assistant, or do I need ESPHome for that?
2. If I need ESPHome on the KinCony A32 Pro:
Where is the latest official A32 Pro ESPHome YAML/configuration for Home Assistant?
Is this KinCony forum thread the correct/latest source?
https://www.kincony.com/forum/showthread.php?tid=5520
3. If KCS should be installed instead:
Is this the latest KCS version/configuration for the A32 Pro, including MQTT Auto Discovery?
https://www.kincony.com/forum/showthread...3#pid25773
I want to resolve the contradiction before flashing the controller, because KCS and ESPHome cannot coexist, so choosing the wrong firmware means having to reflash the device.
Please base the answer on the current KinCony A32 Pro documentation/forum information, not on assumptions about other KinCony models.
Summary: I need to decide between KCS + MQTT Auto Discovery and ESPHome for an A32 Pro whose relays control my lights and whose digital inputs will be used by Home Assistant for physical-button/dry-contact automations. The key question is whether KCS exposes the 32 digital inputs to Home Assistant.]]> My plan is to use Home Assistant to control everything. Today, the KinCony A32 Pro physically controls the lights ON/OFF. Now I need to install the firmware, and the big question is: ESPHome or KCS?
I asked ChatGPT, Gemini, and Copilot, and they gave contradictory answers.
What ChatGPT said
ChatGPT initially recommended KCS + Home Assistant, arguing that KCS can integrate the A32 Pro through MQTT and MQTT Auto Discovery, and that I would not need ESPHome.
It cited KinCony’s forum, including a discussion where the administrator said that KCS and ESPHome cannot run simultaneously and recommended KCS v3 for users who do not know how to configure ESPHome.
It also cited the KinCony forum thread “A32 pro lost control”, where a user had flashed ESPHome and lost KCS. The administrator explained that KCS and ESPHome cannot coexist, and suggested enabling MQTT Auto Discovery in KCS to integrate the A32 Pro with Home Assistant.
Based on this, ChatGPT concluded:
  • I do not need ESPHome.
  • I can install KCS and integrate it with Home Assistant.
  • KCS + MQTT Auto Discovery is the simpler solution for my case.
What Copilot said
Copilot strongly disagreed and said Gemini was right and ChatGPT was wrong.
Its main argument is that KCS does not expose all 32 digital inputs of the A32 Pro to Home Assistant.
According to Copilot, KCS exposes:
  • Relays through MQTT
  • Basic sensors
  • Some internal states
But it does not expose DI1–DI32.
This is critical for my application because I want to use physical inputs/dry contacts to trigger automations such as:
Quote:Press a button → turn on one, two, or three lights.
Copilot says that without the digital inputs being available in Home Assistant, this type of automation cannot work as intended.
It also claims that KinCony has stated on its forum that if you want all inputs and outputs in Home Assistant, you should use ESPHome.
Copilot's other arguments are:
  1. KCS + MQTT Auto Discovery does not automatically expose the 32 digital inputs.
  2. Saying that KCS is simpler may be true for some smaller KinCony controllers, but not necessarily for the A32 Pro.
  3. The A32 Pro uses multiple I/O expanders, and ESPHome provides a more complete mapping of its inputs and outputs to Home Assistant.
My questions
I do not want a generic comparison between ESPHome and KCS. I want the answer specifically for the KinCony KC868-A32 Pro + Home Assistant, considering that my primary objective is to control lighting and use the physical digital inputs for automations.
1. Who is technically correct: Gemini/Copilot or ChatGPT?
More specifically: Does KCS v3 with MQTT Auto Discovery expose all 32 digital inputs of the A32 Pro to Home Assistant, or do I need ESPHome for that?
2. If I need ESPHome on the KinCony A32 Pro:
Where is the latest official A32 Pro ESPHome YAML/configuration for Home Assistant?
Is this KinCony forum thread the correct/latest source?
https://www.kincony.com/forum/showthread.php?tid=5520
3. If KCS should be installed instead:
Is this the latest KCS version/configuration for the A32 Pro, including MQTT Auto Discovery?
https://www.kincony.com/forum/showthread...3#pid25773
I want to resolve the contradiction before flashing the controller, because KCS and ESPHome cannot coexist, so choosing the wrong firmware means having to reflash the device.
Please base the answer on the current KinCony A32 Pro documentation/forum information, not on assumptions about other KinCony models.
Summary: I need to decide between KCS + MQTT Auto Discovery and ESPHome for an A32 Pro whose relays control my lights and whose digital inputs will be used by Home Assistant for physical-button/dry-contact automations. The key question is whether KCS exposes the 32 digital inputs to Home Assistant.]]> <![CDATA["KCS" v3.26.1 firmware BIN file download]]> https://www.kincony.com/forum/showthread.php?tid=9643 Sun, 19 Jul 2026 09:14:31 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9643
1: add support new model: MT4
2: add auto feedback DAC and ADC value by TCP string command.
3: fixed bug temperature sensor trigger SMS or phone call.
4: support use negative temperature value.
5: add "Duration" for IF condition using IFTTT.
6: if repalce new DS18B20 sensor, add auto detect function. Not need to re config sensor manually.
7: full unicode support for 4G module and Longer SMS Message content. You can use local language for SMS.Even emojis in SMS.

.zip   KCS_A2V3_V3.26.1.zip (Size: 1.19 MB / Downloads: 270)

.zip   KCS_A6V3_V3.26.1.zip (Size: 1.17 MB / Downloads: 206)

.zip   KCS_A8V3_V3.26.1.zip (Size: 1.22 MB / Downloads: 255)

.zip   KCS_A16V3_V3.26.1.zip (Size: 1.24 MB / Downloads: 263)

.zip   KCS_A32PRO_V3.26.1.zip (Size: 1.2 MB / Downloads: 225)

.zip   KCS_AG8_V3.26.1.zip (Size: 1.18 MB / Downloads: 185)

.zip   KCS_AGV3_V3.26.1.zip (Size: 1.13 MB / Downloads: 203)

.zip   KCS_AIO_HYBRID_V3.26.1.zip (Size: 1.41 MB / Downloads: 203)

.zip   KCS_ALR_V3.26.1.zip (Size: 1.17 MB / Downloads: 196)

.zip   KCS_B4_V3.26.1.zip (Size: 1.23 MB / Downloads: 206)

.zip   KCS_B4M_V3.26.1.zip (Size: 1.23 MB / Downloads: 194)

.zip   KCS_B8_V3.26.1.zip (Size: 1.23 MB / Downloads: 199)

.zip   KCS_B8M_V3.26.1.zip (Size: 1.23 MB / Downloads: 176)

.zip   KCS_B16_V3.26.1.zip (Size: 1.23 MB / Downloads: 206)

.zip   KCS_B16M_V3.26.1.zip (Size: 1.23 MB / Downloads: 220)

.zip   KCS_B24_V3.26.1.zip (Size: 1.23 MB / Downloads: 203)

.zip   KCS_B24M_V3.26.1.zip (Size: 1.23 MB / Downloads: 214)

.zip   KCS_B32M_V3.26.1.zip (Size: 1.23 MB / Downloads: 186)

.zip   KCS_DM4_V3.26.1.zip (Size: 1.23 MB / Downloads: 194)

.zip   KCS_DM8_V3.26.1.zip (Size: 1.23 MB / Downloads: 193)

.zip   KCS_DM16_V3.26.1.zip (Size: 1.2 MB / Downloads: 205)

.zip   KCS_DM32_V3.26.1.zip (Size: 1.23 MB / Downloads: 225)

.zip   KCS_F4_V3.26.1.zip (Size: 1.22 MB / Downloads: 192)

.zip   KCS_F8_V3.26.1.zip (Size: 1.22 MB / Downloads: 195)

.zip   KCS_F16_V3.26.1.zip (Size: 1.23 MB / Downloads: 212)

.zip   KCS_F24_V3.26.1.zip (Size: 1.23 MB / Downloads: 193)

.zip   KCS_F32_V3.26.1.zip (Size: 1.23 MB / Downloads: 214)

.zip   KCS_G1_V3.26.1.zip (Size: 1.19 MB / Downloads: 210)

.zip   KCS_KC_TA_V3.26.1.zip (Size: 1.18 MB / Downloads: 199)

.zip   KCS_MT4_V3.26.1.zip (Size: 1.18 MB / Downloads: 222)

.zip   KCS_N10_V3.26.1.zip (Size: 1.09 MB / Downloads: 228)

.zip   KCS_N20_V3.26.1.zip (Size: 1.09 MB / Downloads: 188)

.zip   KCS_N30_V3.26.1.zip (Size: 1.09 MB / Downloads: 189)

.zip   KCS_N60_V3.26.1.zip (Size: 1.11 MB / Downloads: 197)

.zip   KCS_T16M_V3.26.1.zip (Size: 1.17 MB / Downloads: 204)

.zip   KCS_T32M_V3.26.1.zip (Size: 1.2 MB / Downloads: 193)

.zip   KCS_T64M_V3.26.1.zip (Size: 1.2 MB / Downloads: 204)

.zip   KCS_T128M_V3.26.1.zip (Size: 1.2 MB / Downloads: 190)

.zip   KCS_TR_V3.26.1.zip (Size: 1.15 MB / Downloads: 198)

.zip   KCS_Z1_V3.26.1.zip (Size: 1.32 MB / Downloads: 177) ]]>
1: add support new model: MT4
2: add auto feedback DAC and ADC value by TCP string command.
3: fixed bug temperature sensor trigger SMS or phone call.
4: support use negative temperature value.
5: add "Duration" for IF condition using IFTTT.
6: if repalce new DS18B20 sensor, add auto detect function. Not need to re config sensor manually.
7: full unicode support for 4G module and Longer SMS Message content. You can use local language for SMS.Even emojis in SMS.

.zip   KCS_A2V3_V3.26.1.zip (Size: 1.19 MB / Downloads: 270)

.zip   KCS_A6V3_V3.26.1.zip (Size: 1.17 MB / Downloads: 206)

.zip   KCS_A8V3_V3.26.1.zip (Size: 1.22 MB / Downloads: 255)

.zip   KCS_A16V3_V3.26.1.zip (Size: 1.24 MB / Downloads: 263)

.zip   KCS_A32PRO_V3.26.1.zip (Size: 1.2 MB / Downloads: 225)

.zip   KCS_AG8_V3.26.1.zip (Size: 1.18 MB / Downloads: 185)

.zip   KCS_AGV3_V3.26.1.zip (Size: 1.13 MB / Downloads: 203)

.zip   KCS_AIO_HYBRID_V3.26.1.zip (Size: 1.41 MB / Downloads: 203)

.zip   KCS_ALR_V3.26.1.zip (Size: 1.17 MB / Downloads: 196)

.zip   KCS_B4_V3.26.1.zip (Size: 1.23 MB / Downloads: 206)

.zip   KCS_B4M_V3.26.1.zip (Size: 1.23 MB / Downloads: 194)

.zip   KCS_B8_V3.26.1.zip (Size: 1.23 MB / Downloads: 199)

.zip   KCS_B8M_V3.26.1.zip (Size: 1.23 MB / Downloads: 176)

.zip   KCS_B16_V3.26.1.zip (Size: 1.23 MB / Downloads: 206)

.zip   KCS_B16M_V3.26.1.zip (Size: 1.23 MB / Downloads: 220)

.zip   KCS_B24_V3.26.1.zip (Size: 1.23 MB / Downloads: 203)

.zip   KCS_B24M_V3.26.1.zip (Size: 1.23 MB / Downloads: 214)

.zip   KCS_B32M_V3.26.1.zip (Size: 1.23 MB / Downloads: 186)

.zip   KCS_DM4_V3.26.1.zip (Size: 1.23 MB / Downloads: 194)

.zip   KCS_DM8_V3.26.1.zip (Size: 1.23 MB / Downloads: 193)

.zip   KCS_DM16_V3.26.1.zip (Size: 1.2 MB / Downloads: 205)

.zip   KCS_DM32_V3.26.1.zip (Size: 1.23 MB / Downloads: 225)

.zip   KCS_F4_V3.26.1.zip (Size: 1.22 MB / Downloads: 192)

.zip   KCS_F8_V3.26.1.zip (Size: 1.22 MB / Downloads: 195)

.zip   KCS_F16_V3.26.1.zip (Size: 1.23 MB / Downloads: 212)

.zip   KCS_F24_V3.26.1.zip (Size: 1.23 MB / Downloads: 193)

.zip   KCS_F32_V3.26.1.zip (Size: 1.23 MB / Downloads: 214)

.zip   KCS_G1_V3.26.1.zip (Size: 1.19 MB / Downloads: 210)

.zip   KCS_KC_TA_V3.26.1.zip (Size: 1.18 MB / Downloads: 199)

.zip   KCS_MT4_V3.26.1.zip (Size: 1.18 MB / Downloads: 222)

.zip   KCS_N10_V3.26.1.zip (Size: 1.09 MB / Downloads: 228)

.zip   KCS_N20_V3.26.1.zip (Size: 1.09 MB / Downloads: 188)

.zip   KCS_N30_V3.26.1.zip (Size: 1.09 MB / Downloads: 189)

.zip   KCS_N60_V3.26.1.zip (Size: 1.11 MB / Downloads: 197)

.zip   KCS_T16M_V3.26.1.zip (Size: 1.17 MB / Downloads: 204)

.zip   KCS_T32M_V3.26.1.zip (Size: 1.2 MB / Downloads: 193)

.zip   KCS_T64M_V3.26.1.zip (Size: 1.2 MB / Downloads: 204)

.zip   KCS_T128M_V3.26.1.zip (Size: 1.2 MB / Downloads: 190)

.zip   KCS_TR_V3.26.1.zip (Size: 1.15 MB / Downloads: 198)

.zip   KCS_Z1_V3.26.1.zip (Size: 1.32 MB / Downloads: 177) ]]> <![CDATA["KCS" v3.25.4 firmware BIN file download]]> https://www.kincony.com/forum/showthread.php?tid=9527 Mon, 22 Jun 2026 13:11:41 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9527
1. IFTTT timer accuracy adjusted to second-level precision
2. IFTTT added time range options for IFTTT
3. Fixed HomeKit DAC shutdown function
4. N-series electricity meter Home assistant MQTT reporting energy accuracy changed to 3 decimal places
5. Disable/Enable ESP32 wifi option

.zip   KCS_A2V3_V3.25.4.zip (Size: 1.19 MB / Downloads: 293)

.zip   KCS_A6V3_V3.25.4.zip (Size: 1.16 MB / Downloads: 290)

.zip   KCS_A8V3_V3.25.4.zip (Size: 1.21 MB / Downloads: 268)

.zip   KCS_A16V3_V3.25.4.zip (Size: 1.23 MB / Downloads: 325)

.zip   KCS_A32PRO_V3.25.4.zip (Size: 1.2 MB / Downloads: 284)

.zip   KCS_AG8_V3.25.4.zip (Size: 1.17 MB / Downloads: 275)

.zip   KCS_AGV3_V3.25.4.zip (Size: 1.13 MB / Downloads: 245)

.zip   KCS_AIO_HYBRID_V3.25.4.zip (Size: 1.4 MB / Downloads: 298)

.zip   KCS_ALR_V3.25.4.zip (Size: 1.16 MB / Downloads: 270)

.zip   KCS_B4_V3.25.4.zip (Size: 1.22 MB / Downloads: 281)

.zip   KCS_B4M_V3.25.4.zip (Size: 1.22 MB / Downloads: 276)

.zip   KCS_B8_V3.25.4.zip (Size: 1.22 MB / Downloads: 259)

.zip   KCS_B8M_V3.25.4.zip (Size: 1.22 MB / Downloads: 237)

.zip   KCS_B16_V3.25.4.zip (Size: 1.22 MB / Downloads: 273)

.zip   KCS_B16M_V3.25.4.zip (Size: 1.22 MB / Downloads: 241)

.zip   KCS_B24_V3.25.4.zip (Size: 1.22 MB / Downloads: 281)

.zip   KCS_B24M_V3.25.4.zip (Size: 1.22 MB / Downloads: 268)

.zip   KCS_B32M_V3.25.4.zip (Size: 1.22 MB / Downloads: 255)

.zip   KCS_DM4_V3.25.4.zip (Size: 1.22 MB / Downloads: 262)

.zip   KCS_DM8_V3.25.4.zip (Size: 1.22 MB / Downloads: 257)

.zip   KCS_DM16_V3.25.4.zip (Size: 1.19 MB / Downloads: 276)

.zip   KCS_DM32_V3.25.4.zip (Size: 1.22 MB / Downloads: 269)

.zip   KCS_F4_V3.25.4.zip (Size: 1.21 MB / Downloads: 240)

.zip   KCS_F8_V3.25.4.zip (Size: 1.21 MB / Downloads: 258)

.zip   KCS_F16_V3.25.4.zip (Size: 1.22 MB / Downloads: 249)

.zip   KCS_F24_V3.25.4.zip (Size: 1.22 MB / Downloads: 268)

.zip   KCS_F32_V3.25.4.zip (Size: 1.22 MB / Downloads: 251)

.zip   KCS_G1_V3.25.4.zip (Size: 1.18 MB / Downloads: 292)

.zip   KCS_KC_TA_V3.25.4.zip (Size: 1.17 MB / Downloads: 262)

.zip   KCS_N10_V3.25.4.zip (Size: 1.08 MB / Downloads: 279)

.zip   KCS_N20_V3.25.4.zip (Size: 1.08 MB / Downloads: 269)

.zip   KCS_N30_V3.25.4.zip (Size: 1.08 MB / Downloads: 243)

.zip   KCS_N60_V3.25.4.zip (Size: 1.1 MB / Downloads: 258)

.zip   KCS_T16M_V3.25.4.zip (Size: 1.17 MB / Downloads: 261)

.zip   KCS_T32M_V3.25.4.zip (Size: 1.19 MB / Downloads: 246)

.zip   KCS_T64M_V3.25.4.zip (Size: 1.19 MB / Downloads: 240)

.zip   KCS_T128M_V3.25.4.zip (Size: 1.19 MB / Downloads: 251)

.zip   KCS_TR_V3.25.4.zip (Size: 1.14 MB / Downloads: 280)

.zip   KCS_Z1_V3.25.4.zip (Size: 1.32 MB / Downloads: 270) ]]>
1. IFTTT timer accuracy adjusted to second-level precision
2. IFTTT added time range options for IFTTT
3. Fixed HomeKit DAC shutdown function
4. N-series electricity meter Home assistant MQTT reporting energy accuracy changed to 3 decimal places
5. Disable/Enable ESP32 wifi option

.zip   KCS_A2V3_V3.25.4.zip (Size: 1.19 MB / Downloads: 293)

.zip   KCS_A6V3_V3.25.4.zip (Size: 1.16 MB / Downloads: 290)

.zip   KCS_A8V3_V3.25.4.zip (Size: 1.21 MB / Downloads: 268)

.zip   KCS_A16V3_V3.25.4.zip (Size: 1.23 MB / Downloads: 325)

.zip   KCS_A32PRO_V3.25.4.zip (Size: 1.2 MB / Downloads: 284)

.zip   KCS_AG8_V3.25.4.zip (Size: 1.17 MB / Downloads: 275)

.zip   KCS_AGV3_V3.25.4.zip (Size: 1.13 MB / Downloads: 245)

.zip   KCS_AIO_HYBRID_V3.25.4.zip (Size: 1.4 MB / Downloads: 298)

.zip   KCS_ALR_V3.25.4.zip (Size: 1.16 MB / Downloads: 270)

.zip   KCS_B4_V3.25.4.zip (Size: 1.22 MB / Downloads: 281)

.zip   KCS_B4M_V3.25.4.zip (Size: 1.22 MB / Downloads: 276)

.zip   KCS_B8_V3.25.4.zip (Size: 1.22 MB / Downloads: 259)

.zip   KCS_B8M_V3.25.4.zip (Size: 1.22 MB / Downloads: 237)

.zip   KCS_B16_V3.25.4.zip (Size: 1.22 MB / Downloads: 273)

.zip   KCS_B16M_V3.25.4.zip (Size: 1.22 MB / Downloads: 241)

.zip   KCS_B24_V3.25.4.zip (Size: 1.22 MB / Downloads: 281)

.zip   KCS_B24M_V3.25.4.zip (Size: 1.22 MB / Downloads: 268)

.zip   KCS_B32M_V3.25.4.zip (Size: 1.22 MB / Downloads: 255)

.zip   KCS_DM4_V3.25.4.zip (Size: 1.22 MB / Downloads: 262)

.zip   KCS_DM8_V3.25.4.zip (Size: 1.22 MB / Downloads: 257)

.zip   KCS_DM16_V3.25.4.zip (Size: 1.19 MB / Downloads: 276)

.zip   KCS_DM32_V3.25.4.zip (Size: 1.22 MB / Downloads: 269)

.zip   KCS_F4_V3.25.4.zip (Size: 1.21 MB / Downloads: 240)

.zip   KCS_F8_V3.25.4.zip (Size: 1.21 MB / Downloads: 258)

.zip   KCS_F16_V3.25.4.zip (Size: 1.22 MB / Downloads: 249)

.zip   KCS_F24_V3.25.4.zip (Size: 1.22 MB / Downloads: 268)

.zip   KCS_F32_V3.25.4.zip (Size: 1.22 MB / Downloads: 251)

.zip   KCS_G1_V3.25.4.zip (Size: 1.18 MB / Downloads: 292)

.zip   KCS_KC_TA_V3.25.4.zip (Size: 1.17 MB / Downloads: 262)

.zip   KCS_N10_V3.25.4.zip (Size: 1.08 MB / Downloads: 279)

.zip   KCS_N20_V3.25.4.zip (Size: 1.08 MB / Downloads: 269)

.zip   KCS_N30_V3.25.4.zip (Size: 1.08 MB / Downloads: 243)

.zip   KCS_N60_V3.25.4.zip (Size: 1.1 MB / Downloads: 258)

.zip   KCS_T16M_V3.25.4.zip (Size: 1.17 MB / Downloads: 261)

.zip   KCS_T32M_V3.25.4.zip (Size: 1.19 MB / Downloads: 246)

.zip   KCS_T64M_V3.25.4.zip (Size: 1.19 MB / Downloads: 240)

.zip   KCS_T128M_V3.25.4.zip (Size: 1.19 MB / Downloads: 251)

.zip   KCS_TR_V3.25.4.zip (Size: 1.14 MB / Downloads: 280)

.zip   KCS_Z1_V3.25.4.zip (Size: 1.32 MB / Downloads: 270) ]]> <![CDATA["KCS" v3 Nx energy meter RS485 TCP/IP Modbus protocol document]]> https://www.kincony.com/forum/showthread.php?tid=9443 Sun, 07 Jun 2026 09:39:23 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9443
.txt   n10_energy_modbus_protocol_20260324.txt (Size: 11.98 KB / Downloads: 195)

.txt   n20_energy_modbus_protocol_20260324.txt (Size: 13.6 KB / Downloads: 188)

.txt   n30_energy_modbus_protocol_20260324.txt (Size: 15.9 KB / Downloads: 177)

.txt   n60_energy_modbus_protocol_20260324.txt (Size: 12.18 KB / Downloads: 169) ]]>
.txt   n10_energy_modbus_protocol_20260324.txt (Size: 11.98 KB / Downloads: 195)

.txt   n20_energy_modbus_protocol_20260324.txt (Size: 13.6 KB / Downloads: 188)

.txt   n30_energy_modbus_protocol_20260324.txt (Size: 15.9 KB / Downloads: 177)

.txt   n60_energy_modbus_protocol_20260324.txt (Size: 12.18 KB / Downloads: 169) ]]> <![CDATA["KCS" v3 TCP/IP Standard Modbus protocol document]]> https://www.kincony.com/forum/showthread.php?tid=9442 Sun, 07 Jun 2026 09:36:16 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9442
Code:
KCSv3 Modbus TCP Protocol Specification
=======================================

1. Overview
-----------

This document specifies the standard Modbus TCP protocol exposed by the
KCSv3 firmware TCP server.

This mode uses the standard Modbus TCP ADU with an MBAP header. It does not use
the RTU CRC field.

2. Communication Parameters
---------------------------

- Protocol: Standard Modbus TCP
- TCP port: configured by tcp_server_port
- Unit ID: configured by tcp_server_protocol_modbus_local_addr
- Register addressing: 0-based Modbus protocol address
- Frame format: [MBAP Header][PDU]
- Protocol ID in MBAP: 0x0000
- CRC: not used

MBAP header format:

+--------+----------------+----------------------------------------------+
| Bytes  | Field          | Description                                  |
+--------+----------------+----------------------------------------------+
| 0..1   | Transaction ID | Echoed in the response                       |
| 2..3   | Protocol ID    | Must be 0x0000                               |
| 4..5   | Length         | Unit ID byte + PDU length                    |
| 6      | Unit ID        | Must match tcp_server_protocol_modbus_local_addr |
+--------+----------------+----------------------------------------------+

The firmware validates the MBAP Protocol ID, Length, and Unit ID before
processing the PDU. Responses are sent only to the requesting TCP client.

3. Supported Function Codes
---------------------------

+---------------+---------------------------+-------------------------------+
| Function Code | Name                      | Usage                         |
+---------------+---------------------------+-------------------------------+
| 0x01          | Read Coils                | Read DO output state          |
| 0x02          | Read Discrete Inputs      | Read DI input state           |
| 0x03          | Read Holding Registers    | Read DAC/IR/RF/energy data    |
| 0x04          | Read Input Registers      | Read ADC/temperature/humidity |
| 0x05          | Write Single Coil         | Set one DO or trigger toggle  |
| 0x06          | Write Single Register     | Set DAC or trigger IR/RF      |
| 0x0F          | Write Multiple Coils      | Set multiple DO channels      |
| 0x10          | Write Multiple Registers  | Set multiple DAC channels     |
+---------------+---------------------------+-------------------------------+

4. Addressing Notes
-------------------

All addresses in this document are 0-based Modbus protocol addresses.

Examples:

- Holding register address 100 is sent as 0x0064 in the Modbus PDU.
- In pymodbus, use read_holding_registers(100, count=2, slave=<unit_id>).
- Some Modbus tools display holding register 100 as 40101 or similar. Use the
  tool's 0-based/1-based setting carefully.

5. Coils (Function Codes 0x01, 0x05, 0x0F)
-------------------------------------------

5.1 DO Output State and Control
-------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DO_NUM-1          | DO output channels   | 0x01 read, 0x05/0x0F write  |
+------------------------+----------------------+-----------------------------+

Write value for function code 0x05:

- 0xFF00: turn ON
- 0x0000: turn OFF

Function code 0x0F supports only the normal DO output range starting at address
0.

5.2 DO Toggle Control
---------------------

+-----------------------------+----------------------+--------------------------+
| Address Range               | Description          | Access                   |
+-----------------------------+----------------------+--------------------------+
| 0x0100 .. 0x0100+DO_NUM-1   | Toggle DO channels   | 0x05 write only          |
+-----------------------------+----------------------+--------------------------+

Write 0xFF00 to address 0x0100 + channel_index to toggle that output channel.
Writing 0x0000 is accepted but does not toggle the output.

6. Discrete Inputs (Function Code 0x02)
---------------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DI_NUM-1          | DI input channels    | 0x02 read                   |
+------------------------+----------------------+-----------------------------+

DI inputs are active-low in the firmware mapping:

- Hardware low / active input returns 1
- Hardware high / inactive input returns 0

7. Holding Registers (Function Codes 0x03, 0x06, 0x10)
------------------------------------------------------

7.1 DAC Output Registers
------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DAC_NUM-1         | DAC output channels  | 0x03 read, 0x06/0x10 write  |
+------------------------+----------------------+-----------------------------+

DAC write value range: 0 .. 255.

Function code 0x10 supports only this DAC register range.

7.2 IR/RF Control Registers
---------------------------

+----------+-------------+----------------------+-----------------------------+
| Address  | Name        | Description          | Access                      |
+----------+-------------+----------------------+-----------------------------+
| 0x0040   | IR_SEND     | Send learned IR slot | 0x03 read, 0x06 write       |
| 0x0041   | IR_LEARN    | Learn IR slot/port   | 0x03 read, 0x06 write       |
| 0x0042   | IR_DELETE   | Delete IR slot       | 0x03 read, 0x06 write       |
| 0x0050   | RF_SEND     | Send learned RF slot | 0x03 read, 0x06 write       |
+----------+-------------+----------------------+-----------------------------+

IR_SEND:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

IR_LEARN:

- High byte: IR memory slot index
- Low byte: IR send port number, starting from 1

IR_DELETE:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

RF_SEND:

- Value: RF memory slot index
- The selected RF slot must exist and be learned

These registers exist only on board variants with the corresponding IR/RF
feature enabled. Otherwise accesses return an illegal data address exception.

7.3 Energy Measurement Registers
--------------------------------

Energy data is exposed as read-only Holding Registers and is read with function
code 0x03.

Each energy chip uses 68 holding registers. The base address is:

  base = 100 + chip_index * 100

where chip_index starts from 0.

+--------------+----------------+----------------+--------------------------+
| Offset Range | Parameter      | Format         | Resolution / Notes       |
+--------------+----------------+----------------+--------------------------+
| 0 .. 19      | RMS_1..RMS_10  | uint32 CDAB    | Current in A * 1000      |
| 20 .. 39     | WATT_1..WATT_10| int32 CDAB     | Power in W * 10          |
| 40 .. 59     | Energy_1..10   | float32 CDAB   | Energy in kWh            |
| 60 .. 61     | Energy_Sum     | float32 CDAB   | Total energy in kWh      |
| 62           | RMS_V          | uint16         | Voltage in V * 100       |
| 63           | Period         | uint16         | Frequency in Hz * 100    |
| 64 .. 65     | TPS1           | float32 CDAB   | Temperature in deg C     |
| 66 .. 67     | PF             | float32 CDAB   | Power factor             |
+--------------+----------------+----------------+--------------------------+

Per-channel offsets:

+----------------+----------------+----------------+--------------------------+
| Channel        | Current Offset | Power Offset   | Energy Offset            |
+----------------+----------------+----------------+--------------------------+
| 1              | 0              | 20             | 40                       |
| 2              | 2              | 22             | 42                       |
| 3              | 4              | 24             | 44                       |
| 4              | 6              | 26             | 46                       |
| 5              | 8              | 28             | 48                       |
| 6              | 10             | 30             | 50                       |
| 7              | 12             | 32             | 52                       |
| 8              | 14             | 34             | 54                       |
| 9              | 16             | 36             | 56                       |
| 10             | 18             | 38             | 58                       |
+----------------+----------------+----------------+--------------------------+

For 32-bit integer and float values, read two consecutive registers. The lower
16-bit word is returned first, followed by the upper 16-bit word.

Examples:

- Chip 1 current channel 1: read holding registers 100 and 101
- Chip 2 power channel 1: read holding registers 220 and 221
- Chip 1 voltage: read holding register 162
- Chip 1 frequency: read holding register 163

8. Input Registers (Function Code 0x04)
---------------------------------------

+-------------------------------+----------------------+--------------------------+
| Address Range                 | Description          | Format                   |
+-------------------------------+----------------------+--------------------------+
| 0 .. ADC_NUM-1                | ADC input channels   | uint16 raw ADC value     |
| 0x0100 .. 0x0100+SENSOR_NUM-1 | Temperature sensors  | int16, deg C * 10        |
| 0x0120 .. 0x0120+SENSOR_NUM-1 | Humidity sensors     | int16, %RH * 10          |
+-------------------------------+----------------------+--------------------------+

If a temperature or humidity sensor is invalid or not present, the returned
value is 0x7FFF.

9. Board-Dependent Limits
-------------------------

The following symbols depend on the compiled board model:

- DO_NUM: number of digital outputs
- DI_NUM: number of digital inputs
- DAC_NUM: number of DAC outputs
- ADC_NUM: number of ADC inputs
- SENSOR_NUM: maximum temperature/humidity sensor slots
- ENERGY_NUM: number of energy measurement chips

N-series energy chip bases:

+-------+------------+--------------------------------------+
| Board | ENERGY_NUM | Energy Holding Register Bases        |
+-------+------------+--------------------------------------+
| N10   | 1          | 100                                  |
| N20   | 2          | 100, 200                             |
| N30   | 3          | 100, 200, 300                        |
| N60   | 6          | 100, 200, 300, 400, 500, 600         |
+-------+------------+--------------------------------------+

10. Exception Codes
-------------------

+----------------+----------------------------+-------------------------------+
| Exception Code | Name                       | Meaning                       |
+----------------+----------------------------+-------------------------------+
| 0x01           | Illegal Function           | Unsupported function code     |
| 0x02           | Illegal Data Address       | Unsupported address/range     |
| 0x03           | Illegal Data Value         | Invalid value or quantity     |
| 0x04           | Slave Device Failure       | Runtime failure or overflow   |
+----------------+----------------------------+-------------------------------+

11. Request Size Limits
-----------------------

- Read coils/discrete inputs: quantity 1 .. 2000
- Read holding/input registers: quantity 1 .. 125
- Write multiple coils: quantity 1 .. 1968
- Write multiple registers: quantity 1 .. 123
download protocol:

.txt   Modbus_TCP_Protocol.txt (Size: 11.59 KB / Downloads: 245) ]]>
Code:
KCSv3 Modbus TCP Protocol Specification
=======================================

1. Overview
-----------

This document specifies the standard Modbus TCP protocol exposed by the
KCSv3 firmware TCP server.

This mode uses the standard Modbus TCP ADU with an MBAP header. It does not use
the RTU CRC field.

2. Communication Parameters
---------------------------

- Protocol: Standard Modbus TCP
- TCP port: configured by tcp_server_port
- Unit ID: configured by tcp_server_protocol_modbus_local_addr
- Register addressing: 0-based Modbus protocol address
- Frame format: [MBAP Header][PDU]
- Protocol ID in MBAP: 0x0000
- CRC: not used

MBAP header format:

+--------+----------------+----------------------------------------------+
| Bytes  | Field          | Description                                  |
+--------+----------------+----------------------------------------------+
| 0..1   | Transaction ID | Echoed in the response                       |
| 2..3   | Protocol ID    | Must be 0x0000                               |
| 4..5   | Length         | Unit ID byte + PDU length                    |
| 6      | Unit ID        | Must match tcp_server_protocol_modbus_local_addr |
+--------+----------------+----------------------------------------------+

The firmware validates the MBAP Protocol ID, Length, and Unit ID before
processing the PDU. Responses are sent only to the requesting TCP client.

3. Supported Function Codes
---------------------------

+---------------+---------------------------+-------------------------------+
| Function Code | Name                      | Usage                         |
+---------------+---------------------------+-------------------------------+
| 0x01          | Read Coils                | Read DO output state          |
| 0x02          | Read Discrete Inputs      | Read DI input state           |
| 0x03          | Read Holding Registers    | Read DAC/IR/RF/energy data    |
| 0x04          | Read Input Registers      | Read ADC/temperature/humidity |
| 0x05          | Write Single Coil         | Set one DO or trigger toggle  |
| 0x06          | Write Single Register     | Set DAC or trigger IR/RF      |
| 0x0F          | Write Multiple Coils      | Set multiple DO channels      |
| 0x10          | Write Multiple Registers  | Set multiple DAC channels     |
+---------------+---------------------------+-------------------------------+

4. Addressing Notes
-------------------

All addresses in this document are 0-based Modbus protocol addresses.

Examples:

- Holding register address 100 is sent as 0x0064 in the Modbus PDU.
- In pymodbus, use read_holding_registers(100, count=2, slave=<unit_id>).
- Some Modbus tools display holding register 100 as 40101 or similar. Use the
  tool's 0-based/1-based setting carefully.

5. Coils (Function Codes 0x01, 0x05, 0x0F)
-------------------------------------------

5.1 DO Output State and Control
-------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DO_NUM-1          | DO output channels   | 0x01 read, 0x05/0x0F write  |
+------------------------+----------------------+-----------------------------+

Write value for function code 0x05:

- 0xFF00: turn ON
- 0x0000: turn OFF

Function code 0x0F supports only the normal DO output range starting at address
0.

5.2 DO Toggle Control
---------------------

+-----------------------------+----------------------+--------------------------+
| Address Range               | Description          | Access                   |
+-----------------------------+----------------------+--------------------------+
| 0x0100 .. 0x0100+DO_NUM-1   | Toggle DO channels   | 0x05 write only          |
+-----------------------------+----------------------+--------------------------+

Write 0xFF00 to address 0x0100 + channel_index to toggle that output channel.
Writing 0x0000 is accepted but does not toggle the output.

6. Discrete Inputs (Function Code 0x02)
---------------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DI_NUM-1          | DI input channels    | 0x02 read                   |
+------------------------+----------------------+-----------------------------+

DI inputs are active-low in the firmware mapping:

- Hardware low / active input returns 1
- Hardware high / inactive input returns 0

7. Holding Registers (Function Codes 0x03, 0x06, 0x10)
------------------------------------------------------

7.1 DAC Output Registers
------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DAC_NUM-1         | DAC output channels  | 0x03 read, 0x06/0x10 write  |
+------------------------+----------------------+-----------------------------+

DAC write value range: 0 .. 255.

Function code 0x10 supports only this DAC register range.

7.2 IR/RF Control Registers
---------------------------

+----------+-------------+----------------------+-----------------------------+
| Address  | Name        | Description          | Access                      |
+----------+-------------+----------------------+-----------------------------+
| 0x0040   | IR_SEND     | Send learned IR slot | 0x03 read, 0x06 write       |
| 0x0041   | IR_LEARN    | Learn IR slot/port   | 0x03 read, 0x06 write       |
| 0x0042   | IR_DELETE   | Delete IR slot       | 0x03 read, 0x06 write       |
| 0x0050   | RF_SEND     | Send learned RF slot | 0x03 read, 0x06 write       |
+----------+-------------+----------------------+-----------------------------+

IR_SEND:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

IR_LEARN:

- High byte: IR memory slot index
- Low byte: IR send port number, starting from 1

IR_DELETE:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

RF_SEND:

- Value: RF memory slot index
- The selected RF slot must exist and be learned

These registers exist only on board variants with the corresponding IR/RF
feature enabled. Otherwise accesses return an illegal data address exception.

7.3 Energy Measurement Registers
--------------------------------

Energy data is exposed as read-only Holding Registers and is read with function
code 0x03.

Each energy chip uses 68 holding registers. The base address is:

  base = 100 + chip_index * 100

where chip_index starts from 0.

+--------------+----------------+----------------+--------------------------+
| Offset Range | Parameter      | Format         | Resolution / Notes       |
+--------------+----------------+----------------+--------------------------+
| 0 .. 19      | RMS_1..RMS_10  | uint32 CDAB    | Current in A * 1000      |
| 20 .. 39     | WATT_1..WATT_10| int32 CDAB     | Power in W * 10          |
| 40 .. 59     | Energy_1..10   | float32 CDAB   | Energy in kWh            |
| 60 .. 61     | Energy_Sum     | float32 CDAB   | Total energy in kWh      |
| 62           | RMS_V          | uint16         | Voltage in V * 100       |
| 63           | Period         | uint16         | Frequency in Hz * 100    |
| 64 .. 65     | TPS1           | float32 CDAB   | Temperature in deg C     |
| 66 .. 67     | PF             | float32 CDAB   | Power factor             |
+--------------+----------------+----------------+--------------------------+

Per-channel offsets:

+----------------+----------------+----------------+--------------------------+
| Channel        | Current Offset | Power Offset   | Energy Offset            |
+----------------+----------------+----------------+--------------------------+
| 1              | 0              | 20             | 40                       |
| 2              | 2              | 22             | 42                       |
| 3              | 4              | 24             | 44                       |
| 4              | 6              | 26             | 46                       |
| 5              | 8              | 28             | 48                       |
| 6              | 10             | 30             | 50                       |
| 7              | 12             | 32             | 52                       |
| 8              | 14             | 34             | 54                       |
| 9              | 16             | 36             | 56                       |
| 10             | 18             | 38             | 58                       |
+----------------+----------------+----------------+--------------------------+

For 32-bit integer and float values, read two consecutive registers. The lower
16-bit word is returned first, followed by the upper 16-bit word.

Examples:

- Chip 1 current channel 1: read holding registers 100 and 101
- Chip 2 power channel 1: read holding registers 220 and 221
- Chip 1 voltage: read holding register 162
- Chip 1 frequency: read holding register 163

8. Input Registers (Function Code 0x04)
---------------------------------------

+-------------------------------+----------------------+--------------------------+
| Address Range                 | Description          | Format                   |
+-------------------------------+----------------------+--------------------------+
| 0 .. ADC_NUM-1                | ADC input channels   | uint16 raw ADC value     |
| 0x0100 .. 0x0100+SENSOR_NUM-1 | Temperature sensors  | int16, deg C * 10        |
| 0x0120 .. 0x0120+SENSOR_NUM-1 | Humidity sensors     | int16, %RH * 10          |
+-------------------------------+----------------------+--------------------------+

If a temperature or humidity sensor is invalid or not present, the returned
value is 0x7FFF.

9. Board-Dependent Limits
-------------------------

The following symbols depend on the compiled board model:

- DO_NUM: number of digital outputs
- DI_NUM: number of digital inputs
- DAC_NUM: number of DAC outputs
- ADC_NUM: number of ADC inputs
- SENSOR_NUM: maximum temperature/humidity sensor slots
- ENERGY_NUM: number of energy measurement chips

N-series energy chip bases:

+-------+------------+--------------------------------------+
| Board | ENERGY_NUM | Energy Holding Register Bases        |
+-------+------------+--------------------------------------+
| N10   | 1          | 100                                  |
| N20   | 2          | 100, 200                             |
| N30   | 3          | 100, 200, 300                        |
| N60   | 6          | 100, 200, 300, 400, 500, 600         |
+-------+------------+--------------------------------------+

10. Exception Codes
-------------------

+----------------+----------------------------+-------------------------------+
| Exception Code | Name                       | Meaning                       |
+----------------+----------------------------+-------------------------------+
| 0x01           | Illegal Function           | Unsupported function code     |
| 0x02           | Illegal Data Address       | Unsupported address/range     |
| 0x03           | Illegal Data Value         | Invalid value or quantity     |
| 0x04           | Slave Device Failure       | Runtime failure or overflow   |
+----------------+----------------------------+-------------------------------+

11. Request Size Limits
-----------------------

- Read coils/discrete inputs: quantity 1 .. 2000
- Read holding/input registers: quantity 1 .. 125
- Write multiple coils: quantity 1 .. 1968
- Write multiple registers: quantity 1 .. 123
download protocol:

.txt   Modbus_TCP_Protocol.txt (Size: 11.59 KB / Downloads: 245) ]]> <![CDATA["KCS" v3 Modbus RTU over TCP/IP protocol document]]> https://www.kincony.com/forum/showthread.php?tid=9441 Sun, 07 Jun 2026 09:33:35 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9441
Code:
KCSv3 Modbus RTU over TCP Protocol Specification
================================================

1. Overview
-----------

This document specifies the Modbus RTU over TCP protocol exposed by the
KCSv3 firmware TCP server when the TCP protocol mode is configured for Modbus RTU
frames.

This mode transports a complete Modbus RTU ADU over a TCP socket. It does not use
the standard Modbus TCP MBAP header.

2. Communication Parameters
---------------------------

- Protocol: Modbus RTU ADU transported over TCP
- TCP port: configured by tcp_server_port
- Slave address: configured by tcp_server_protocol_modbus_local_addr
- Register addressing: 0-based Modbus protocol address
- Frame format: [Slave Address][PDU][CRC Lo][CRC Hi]
- CRC: Modbus CRC16, low byte first
- MBAP header: not used

Clients should send one complete RTU ADU frame per TCP request. The firmware
validates the RTU slave address and CRC before processing the PDU.

3. Supported Function Codes
---------------------------

+---------------+---------------------------+-------------------------------+
| Function Code | Name                      | Usage                         |
+---------------+---------------------------+-------------------------------+
| 0x01          | Read Coils                | Read DO output state          |
| 0x02          | Read Discrete Inputs      | Read DI input state           |
| 0x03          | Read Holding Registers    | Read DAC/IR/RF/energy data    |
| 0x04          | Read Input Registers      | Read ADC/temperature/humidity |
| 0x05          | Write Single Coil         | Set one DO or trigger toggle  |
| 0x06          | Write Single Register     | Set DAC or trigger IR/RF      |
| 0x0F          | Write Multiple Coils      | Set multiple DO channels      |
| 0x10          | Write Multiple Registers  | Set multiple DAC channels     |
+---------------+---------------------------+-------------------------------+

4. Addressing Notes
-------------------

All addresses in this document are 0-based Modbus protocol addresses.

Examples:

- Holding register address 100 is sent as 0x0064 in the Modbus PDU.
- Some Modbus tools display holding register 100 as 40101 or similar. Use the
  tool's 0-based/1-based setting carefully.

5. Coils (Function Codes 0x01, 0x05, 0x0F)
-------------------------------------------

5.1 DO Output State and Control
-------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DO_NUM-1          | DO output channels   | 0x01 read, 0x05/0x0F write  |
+------------------------+----------------------+-----------------------------+

Write value for function code 0x05:

- 0xFF00: turn ON
- 0x0000: turn OFF

Function code 0x0F supports only the normal DO output range starting at address
0.

5.2 DO Toggle Control
---------------------

+-----------------------------+----------------------+--------------------------+
| Address Range               | Description          | Access                   |
+-----------------------------+----------------------+--------------------------+
| 0x0100 .. 0x0100+DO_NUM-1   | Toggle DO channels   | 0x05 write only          |
+-----------------------------+----------------------+--------------------------+

Write 0xFF00 to address 0x0100 + channel_index to toggle that output channel.
Writing 0x0000 is accepted but does not toggle the output.

6. Discrete Inputs (Function Code 0x02)
---------------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DI_NUM-1          | DI input channels    | 0x02 read                   |
+------------------------+----------------------+-----------------------------+

DI inputs are active-low in the firmware mapping:

- Hardware low / active input returns 1
- Hardware high / inactive input returns 0

7. Holding Registers (Function Codes 0x03, 0x06, 0x10)
------------------------------------------------------

7.1 DAC Output Registers
------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DAC_NUM-1         | DAC output channels  | 0x03 read, 0x06/0x10 write  |
+------------------------+----------------------+-----------------------------+

DAC write value range: 0 .. 255.

Function code 0x10 supports only this DAC register range.

7.2 IR/RF Control Registers
---------------------------

+----------+-------------+----------------------+-----------------------------+
| Address  | Name        | Description          | Access                      |
+----------+-------------+----------------------+-----------------------------+
| 0x0040   | IR_SEND     | Send learned IR slot | 0x03 read, 0x06 write       |
| 0x0041   | IR_LEARN    | Learn IR slot/port   | 0x03 read, 0x06 write       |
| 0x0042   | IR_DELETE   | Delete IR slot       | 0x03 read, 0x06 write       |
| 0x0050   | RF_SEND     | Send learned RF slot | 0x03 read, 0x06 write       |
+----------+-------------+----------------------+-----------------------------+

IR_SEND:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

IR_LEARN:

- High byte: IR memory slot index
- Low byte: IR send port number, starting from 1

IR_DELETE:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

RF_SEND:

- Value: RF memory slot index
- The selected RF slot must exist and be learned

These registers exist only on board variants with the corresponding IR/RF
feature enabled. Otherwise accesses return an illegal data address exception.

7.3 Energy Measurement Registers
--------------------------------

Energy data is exposed as read-only Holding Registers and is read with function
code 0x03.

Each energy chip uses 68 holding registers. The base address is:

  base = 100 + chip_index * 100

where chip_index starts from 0.

+--------------+----------------+----------------+--------------------------+
| Offset Range | Parameter      | Format         | Resolution / Notes       |
+--------------+----------------+----------------+--------------------------+
| 0 .. 19      | RMS_1..RMS_10  | uint32 CDAB    | Current in A * 1000      |
| 20 .. 39     | WATT_1..WATT_10| int32 CDAB     | Power in W * 10          |
| 40 .. 59     | Energy_1..10   | float32 CDAB   | Energy in kWh            |
| 60 .. 61     | Energy_Sum     | float32 CDAB   | Total energy in kWh      |
| 62           | RMS_V          | uint16         | Voltage in V * 100       |
| 63           | Period         | uint16         | Frequency in Hz * 100    |
| 64 .. 65     | TPS1           | float32 CDAB   | Temperature in deg C     |
| 66 .. 67     | PF             | float32 CDAB   | Power factor             |
+--------------+----------------+----------------+--------------------------+

Per-channel offsets:

+----------------+----------------+----------------+--------------------------+
| Channel        | Current Offset | Power Offset   | Energy Offset            |
+----------------+----------------+----------------+--------------------------+
| 1              | 0              | 20             | 40                       |
| 2              | 2              | 22             | 42                       |
| 3              | 4              | 24             | 44                       |
| 4              | 6              | 26             | 46                       |
| 5              | 8              | 28             | 48                       |
| 6              | 10             | 30             | 50                       |
| 7              | 12             | 32             | 52                       |
| 8              | 14             | 34             | 54                       |
| 9              | 16             | 36             | 56                       |
| 10             | 18             | 38             | 58                       |
+----------------+----------------+----------------+--------------------------+

For 32-bit integer and float values, read two consecutive registers. The lower
16-bit word is returned first, followed by the upper 16-bit word.

Examples:

- Chip 1 current channel 1: read holding registers 100 and 101
- Chip 2 power channel 1: read holding registers 220 and 221
- Chip 1 voltage: read holding register 162
- Chip 1 frequency: read holding register 163

8. Input Registers (Function Code 0x04)
---------------------------------------

+-------------------------------+----------------------+--------------------------+
| Address Range                 | Description          | Format                   |
+-------------------------------+----------------------+--------------------------+
| 0 .. ADC_NUM-1                | ADC input channels   | uint16 raw ADC value     |
| 0x0100 .. 0x0100+SENSOR_NUM-1 | Temperature sensors  | int16, deg C * 10        |
| 0x0120 .. 0x0120+SENSOR_NUM-1 | Humidity sensors     | int16, %RH * 10          |
+-------------------------------+----------------------+--------------------------+

If a temperature or humidity sensor is invalid or not present, the returned
value is 0x7FFF.

9. Board-Dependent Limits
-------------------------

The following symbols depend on the compiled board model:

- DO_NUM: number of digital outputs
- DI_NUM: number of digital inputs
- DAC_NUM: number of DAC outputs
- ADC_NUM: number of ADC inputs
- SENSOR_NUM: maximum temperature/humidity sensor slots
- ENERGY_NUM: number of energy measurement chips

N-series energy chip bases:

+-------+------------+--------------------------------------+
| Board | ENERGY_NUM | Energy Holding Register Bases        |
+-------+------------+--------------------------------------+
| N10   | 1          | 100                                  |
| N20   | 2          | 100, 200                             |
| N30   | 3          | 100, 200, 300                        |
| N60   | 6          | 100, 200, 300, 400, 500, 600         |
+-------+------------+--------------------------------------+

10. Exception Codes
-------------------

+----------------+----------------------------+-------------------------------+
| Exception Code | Name                       | Meaning                       |
+----------------+----------------------------+-------------------------------+
| 0x01           | Illegal Function           | Unsupported function code     |
| 0x02           | Illegal Data Address       | Unsupported address/range     |
| 0x03           | Illegal Data Value         | Invalid value or quantity     |
| 0x04           | Slave Device Failure       | Runtime failure or overflow   |
+----------------+----------------------------+-------------------------------+

11. Request Size Limits
-----------------------

- Read coils/discrete inputs: quantity 1 .. 2000
- Read holding/input registers: quantity 1 .. 125
- Write multiple coils: quantity 1 .. 1968
- Write multiple registers: quantity 1 .. 123
download protocol:

.txt   Modbus_RTU_over_TCP_Protocol.txt (Size: 11.05 KB / Downloads: 220) ]]>
Code:
KCSv3 Modbus RTU over TCP Protocol Specification
================================================

1. Overview
-----------

This document specifies the Modbus RTU over TCP protocol exposed by the
KCSv3 firmware TCP server when the TCP protocol mode is configured for Modbus RTU
frames.

This mode transports a complete Modbus RTU ADU over a TCP socket. It does not use
the standard Modbus TCP MBAP header.

2. Communication Parameters
---------------------------

- Protocol: Modbus RTU ADU transported over TCP
- TCP port: configured by tcp_server_port
- Slave address: configured by tcp_server_protocol_modbus_local_addr
- Register addressing: 0-based Modbus protocol address
- Frame format: [Slave Address][PDU][CRC Lo][CRC Hi]
- CRC: Modbus CRC16, low byte first
- MBAP header: not used

Clients should send one complete RTU ADU frame per TCP request. The firmware
validates the RTU slave address and CRC before processing the PDU.

3. Supported Function Codes
---------------------------

+---------------+---------------------------+-------------------------------+
| Function Code | Name                      | Usage                         |
+---------------+---------------------------+-------------------------------+
| 0x01          | Read Coils                | Read DO output state          |
| 0x02          | Read Discrete Inputs      | Read DI input state           |
| 0x03          | Read Holding Registers    | Read DAC/IR/RF/energy data    |
| 0x04          | Read Input Registers      | Read ADC/temperature/humidity |
| 0x05          | Write Single Coil         | Set one DO or trigger toggle  |
| 0x06          | Write Single Register     | Set DAC or trigger IR/RF      |
| 0x0F          | Write Multiple Coils      | Set multiple DO channels      |
| 0x10          | Write Multiple Registers  | Set multiple DAC channels     |
+---------------+---------------------------+-------------------------------+

4. Addressing Notes
-------------------

All addresses in this document are 0-based Modbus protocol addresses.

Examples:

- Holding register address 100 is sent as 0x0064 in the Modbus PDU.
- Some Modbus tools display holding register 100 as 40101 or similar. Use the
  tool's 0-based/1-based setting carefully.

5. Coils (Function Codes 0x01, 0x05, 0x0F)
-------------------------------------------

5.1 DO Output State and Control
-------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DO_NUM-1          | DO output channels   | 0x01 read, 0x05/0x0F write  |
+------------------------+----------------------+-----------------------------+

Write value for function code 0x05:

- 0xFF00: turn ON
- 0x0000: turn OFF

Function code 0x0F supports only the normal DO output range starting at address
0.

5.2 DO Toggle Control
---------------------

+-----------------------------+----------------------+--------------------------+
| Address Range               | Description          | Access                   |
+-----------------------------+----------------------+--------------------------+
| 0x0100 .. 0x0100+DO_NUM-1   | Toggle DO channels   | 0x05 write only          |
+-----------------------------+----------------------+--------------------------+

Write 0xFF00 to address 0x0100 + channel_index to toggle that output channel.
Writing 0x0000 is accepted but does not toggle the output.

6. Discrete Inputs (Function Code 0x02)
---------------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DI_NUM-1          | DI input channels    | 0x02 read                   |
+------------------------+----------------------+-----------------------------+

DI inputs are active-low in the firmware mapping:

- Hardware low / active input returns 1
- Hardware high / inactive input returns 0

7. Holding Registers (Function Codes 0x03, 0x06, 0x10)
------------------------------------------------------

7.1 DAC Output Registers
------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DAC_NUM-1         | DAC output channels  | 0x03 read, 0x06/0x10 write  |
+------------------------+----------------------+-----------------------------+

DAC write value range: 0 .. 255.

Function code 0x10 supports only this DAC register range.

7.2 IR/RF Control Registers
---------------------------

+----------+-------------+----------------------+-----------------------------+
| Address  | Name        | Description          | Access                      |
+----------+-------------+----------------------+-----------------------------+
| 0x0040   | IR_SEND     | Send learned IR slot | 0x03 read, 0x06 write       |
| 0x0041   | IR_LEARN    | Learn IR slot/port   | 0x03 read, 0x06 write       |
| 0x0042   | IR_DELETE   | Delete IR slot       | 0x03 read, 0x06 write       |
| 0x0050   | RF_SEND     | Send learned RF slot | 0x03 read, 0x06 write       |
+----------+-------------+----------------------+-----------------------------+

IR_SEND:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

IR_LEARN:

- High byte: IR memory slot index
- Low byte: IR send port number, starting from 1

IR_DELETE:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

RF_SEND:

- Value: RF memory slot index
- The selected RF slot must exist and be learned

These registers exist only on board variants with the corresponding IR/RF
feature enabled. Otherwise accesses return an illegal data address exception.

7.3 Energy Measurement Registers
--------------------------------

Energy data is exposed as read-only Holding Registers and is read with function
code 0x03.

Each energy chip uses 68 holding registers. The base address is:

  base = 100 + chip_index * 100

where chip_index starts from 0.

+--------------+----------------+----------------+--------------------------+
| Offset Range | Parameter      | Format         | Resolution / Notes       |
+--------------+----------------+----------------+--------------------------+
| 0 .. 19      | RMS_1..RMS_10  | uint32 CDAB    | Current in A * 1000      |
| 20 .. 39     | WATT_1..WATT_10| int32 CDAB     | Power in W * 10          |
| 40 .. 59     | Energy_1..10   | float32 CDAB   | Energy in kWh            |
| 60 .. 61     | Energy_Sum     | float32 CDAB   | Total energy in kWh      |
| 62           | RMS_V          | uint16         | Voltage in V * 100       |
| 63           | Period         | uint16         | Frequency in Hz * 100    |
| 64 .. 65     | TPS1           | float32 CDAB   | Temperature in deg C     |
| 66 .. 67     | PF             | float32 CDAB   | Power factor             |
+--------------+----------------+----------------+--------------------------+

Per-channel offsets:

+----------------+----------------+----------------+--------------------------+
| Channel        | Current Offset | Power Offset   | Energy Offset            |
+----------------+----------------+----------------+--------------------------+
| 1              | 0              | 20             | 40                       |
| 2              | 2              | 22             | 42                       |
| 3              | 4              | 24             | 44                       |
| 4              | 6              | 26             | 46                       |
| 5              | 8              | 28             | 48                       |
| 6              | 10             | 30             | 50                       |
| 7              | 12             | 32             | 52                       |
| 8              | 14             | 34             | 54                       |
| 9              | 16             | 36             | 56                       |
| 10             | 18             | 38             | 58                       |
+----------------+----------------+----------------+--------------------------+

For 32-bit integer and float values, read two consecutive registers. The lower
16-bit word is returned first, followed by the upper 16-bit word.

Examples:

- Chip 1 current channel 1: read holding registers 100 and 101
- Chip 2 power channel 1: read holding registers 220 and 221
- Chip 1 voltage: read holding register 162
- Chip 1 frequency: read holding register 163

8. Input Registers (Function Code 0x04)
---------------------------------------

+-------------------------------+----------------------+--------------------------+
| Address Range                 | Description          | Format                   |
+-------------------------------+----------------------+--------------------------+
| 0 .. ADC_NUM-1                | ADC input channels   | uint16 raw ADC value     |
| 0x0100 .. 0x0100+SENSOR_NUM-1 | Temperature sensors  | int16, deg C * 10        |
| 0x0120 .. 0x0120+SENSOR_NUM-1 | Humidity sensors     | int16, %RH * 10          |
+-------------------------------+----------------------+--------------------------+

If a temperature or humidity sensor is invalid or not present, the returned
value is 0x7FFF.

9. Board-Dependent Limits
-------------------------

The following symbols depend on the compiled board model:

- DO_NUM: number of digital outputs
- DI_NUM: number of digital inputs
- DAC_NUM: number of DAC outputs
- ADC_NUM: number of ADC inputs
- SENSOR_NUM: maximum temperature/humidity sensor slots
- ENERGY_NUM: number of energy measurement chips

N-series energy chip bases:

+-------+------------+--------------------------------------+
| Board | ENERGY_NUM | Energy Holding Register Bases        |
+-------+------------+--------------------------------------+
| N10   | 1          | 100                                  |
| N20   | 2          | 100, 200                             |
| N30   | 3          | 100, 200, 300                        |
| N60   | 6          | 100, 200, 300, 400, 500, 600         |
+-------+------------+--------------------------------------+

10. Exception Codes
-------------------

+----------------+----------------------------+-------------------------------+
| Exception Code | Name                       | Meaning                       |
+----------------+----------------------------+-------------------------------+
| 0x01           | Illegal Function           | Unsupported function code     |
| 0x02           | Illegal Data Address       | Unsupported address/range     |
| 0x03           | Illegal Data Value         | Invalid value or quantity     |
| 0x04           | Slave Device Failure       | Runtime failure or overflow   |
+----------------+----------------------------+-------------------------------+

11. Request Size Limits
-----------------------

- Read coils/discrete inputs: quantity 1 .. 2000
- Read holding/input registers: quantity 1 .. 125
- Write multiple coils: quantity 1 .. 1968
- Write multiple registers: quantity 1 .. 123
download protocol:

.txt   Modbus_RTU_over_TCP_Protocol.txt (Size: 11.05 KB / Downloads: 220) ]]> <![CDATA["KCS" v3 RS485 Standard Modbus protocol document]]> https://www.kincony.com/forum/showthread.php?tid=9439 Sun, 07 Jun 2026 09:28:35 +0800 admin]]> https://www.kincony.com/forum/showthread.php?tid=9439
Code:
KCSv3 Modbus RTU Protocol Specification
=======================================

1. Overview
-----------

This document specifies the Modbus RTU protocol exposed by the KCSv3
firmware on the RS485 interface.

2. Communication Parameters
---------------------------

- Protocol: Modbus RTU
- Physical interface: RS485
- Slave address: configured by rs485_local_addr
- Register addressing: 0-based Modbus protocol address
- Frame format: [Slave Address][PDU][CRC Lo][CRC Hi]
- CRC: Modbus CRC16, low byte first

Serial port parameters are configured by the firmware RS485 settings.

3. Supported Function Codes
---------------------------

+---------------+---------------------------+-------------------------------+
| Function Code | Name                      | Usage                         |
+---------------+---------------------------+-------------------------------+
| 0x01          | Read Coils                | Read DO output state          |
| 0x02          | Read Discrete Inputs      | Read DI input state           |
| 0x03          | Read Holding Registers    | Read DAC/IR/RF/energy data    |
| 0x04          | Read Input Registers      | Read ADC/temperature/humidity |
| 0x05          | Write Single Coil         | Set one DO or trigger toggle  |
| 0x06          | Write Single Register     | Set DAC or trigger IR/RF      |
| 0x0F          | Write Multiple Coils      | Set multiple DO channels      |
| 0x10          | Write Multiple Registers  | Set multiple DAC channels     |
+---------------+---------------------------+-------------------------------+

4. Addressing Notes
-------------------

All addresses in this document are 0-based Modbus protocol addresses.

Examples:

- Holding register address 100 is sent as 0x0064 in the Modbus PDU.
- Some Modbus tools display holding register 100 as 40101 or similar. Use the
  tool's 0-based/1-based setting carefully.

5. Coils (Function Codes 0x01, 0x05, 0x0F)
-------------------------------------------

5.1 DO Output State and Control
-------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DO_NUM-1          | DO output channels   | 0x01 read, 0x05/0x0F write  |
+------------------------+----------------------+-----------------------------+

Write value for function code 0x05:

- 0xFF00: turn ON
- 0x0000: turn OFF

Function code 0x0F supports only the normal DO output range starting at address
0.

5.2 DO Toggle Control
---------------------

+-----------------------------+----------------------+--------------------------+
| Address Range               | Description          | Access                   |
+-----------------------------+----------------------+--------------------------+
| 0x0100 .. 0x0100+DO_NUM-1   | Toggle DO channels   | 0x05 write only          |
+-----------------------------+----------------------+--------------------------+

Write 0xFF00 to address 0x0100 + channel_index to toggle that output channel.
Writing 0x0000 is accepted but does not toggle the output.

6. Discrete Inputs (Function Code 0x02)
---------------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DI_NUM-1          | DI input channels    | 0x02 read                   |
+------------------------+----------------------+-----------------------------+

DI inputs are active-low in the firmware mapping:

- Hardware low / active input returns 1
- Hardware high / inactive input returns 0

7. Holding Registers (Function Codes 0x03, 0x06, 0x10)
------------------------------------------------------

7.1 DAC Output Registers
------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DAC_NUM-1         | DAC output channels  | 0x03 read, 0x06/0x10 write  |
+------------------------+----------------------+-----------------------------+

DAC write value range: 0 .. 255.

Function code 0x10 supports only this DAC register range.

7.2 IR/RF Control Registers
---------------------------

+----------+-------------+----------------------+-----------------------------+
| Address  | Name        | Description          | Access                      |
+----------+-------------+----------------------+-----------------------------+
| 0x0040   | IR_SEND     | Send learned IR slot | 0x03 read, 0x06 write       |
| 0x0041   | IR_LEARN    | Learn IR slot/port   | 0x03 read, 0x06 write       |
| 0x0042   | IR_DELETE   | Delete IR slot       | 0x03 read, 0x06 write       |
| 0x0050   | RF_SEND     | Send learned RF slot | 0x03 read, 0x06 write       |
+----------+-------------+----------------------+-----------------------------+

IR_SEND:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

IR_LEARN:

- High byte: IR memory slot index
- Low byte: IR send port number, starting from 1

IR_DELETE:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

RF_SEND:

- Value: RF memory slot index
- The selected RF slot must exist and be learned

These registers exist only on board variants with the corresponding IR/RF
feature enabled. Otherwise accesses return an illegal data address exception.

7.3 Energy Measurement Registers
--------------------------------

Energy data is exposed as read-only Holding Registers and is read with function
code 0x03.

Each energy chip uses 68 holding registers. The base address is:

  base = 100 + chip_index * 100

where chip_index starts from 0.

+--------------+----------------+----------------+--------------------------+
| Offset Range | Parameter      | Format         | Resolution / Notes       |
+--------------+----------------+----------------+--------------------------+
| 0 .. 19      | RMS_1..RMS_10  | uint32 CDAB    | Current in A * 1000      |
| 20 .. 39     | WATT_1..WATT_10| int32 CDAB     | Power in W * 10          |
| 40 .. 59     | Energy_1..10   | float32 CDAB   | Energy in kWh            |
| 60 .. 61     | Energy_Sum     | float32 CDAB   | Total energy in kWh      |
| 62           | RMS_V          | uint16         | Voltage in V * 100       |
| 63           | Period         | uint16         | Frequency in Hz * 100    |
| 64 .. 65     | TPS1           | float32 CDAB   | Temperature in deg C     |
| 66 .. 67     | PF             | float32 CDAB   | Power factor             |
+--------------+----------------+----------------+--------------------------+

Per-channel offsets:

+----------------+----------------+----------------+--------------------------+
| Channel        | Current Offset | Power Offset   | Energy Offset            |
+----------------+----------------+----------------+--------------------------+
| 1              | 0              | 20             | 40                       |
| 2              | 2              | 22             | 42                       |
| 3              | 4              | 24             | 44                       |
| 4              | 6              | 26             | 46                       |
| 5              | 8              | 28             | 48                       |
| 6              | 10             | 30             | 50                       |
| 7              | 12             | 32             | 52                       |
| 8              | 14             | 34             | 54                       |
| 9              | 16             | 36             | 56                       |
| 10             | 18             | 38             | 58                       |
+----------------+----------------+----------------+--------------------------+

For 32-bit integer and float values, read two consecutive registers. The lower
16-bit word is returned first, followed by the upper 16-bit word.

Examples:

- Chip 1 current channel 1: read holding registers 100 and 101
- Chip 2 power channel 1: read holding registers 220 and 221
- Chip 1 voltage: read holding register 162
- Chip 1 frequency: read holding register 163

8. Input Registers (Function Code 0x04)
---------------------------------------

+-------------------------------+----------------------+--------------------------+
| Address Range                 | Description          | Format                   |
+-------------------------------+----------------------+--------------------------+
| 0 .. ADC_NUM-1                | ADC input channels   | uint16 raw ADC value     |
| 0x0100 .. 0x0100+SENSOR_NUM-1 | Temperature sensors  | int16, deg C * 10        |
| 0x0120 .. 0x0120+SENSOR_NUM-1 | Humidity sensors     | int16, %RH * 10          |
+-------------------------------+----------------------+--------------------------+

If a temperature or humidity sensor is invalid or not present, the returned
value is 0x7FFF.

9. Board-Dependent Limits
-------------------------

The following symbols depend on the compiled board model:

- DO_NUM: number of digital outputs
- DI_NUM: number of digital inputs
- DAC_NUM: number of DAC outputs
- ADC_NUM: number of ADC inputs
- SENSOR_NUM: maximum temperature/humidity sensor slots
- ENERGY_NUM: number of energy measurement chips

N-series energy chip bases:

+-------+------------+--------------------------------------+
| Board | ENERGY_NUM | Energy Holding Register Bases        |
+-------+------------+--------------------------------------+
| N10   | 1          | 100                                  |
| N20   | 2          | 100, 200                             |
| N30   | 3          | 100, 200, 300                        |
| N60   | 6          | 100, 200, 300, 400, 500, 600         |
+-------+------------+--------------------------------------+

10. Exception Codes
-------------------

+----------------+----------------------------+-------------------------------+
| Exception Code | Name                       | Meaning                       |
+----------------+----------------------------+-------------------------------+
| 0x01           | Illegal Function           | Unsupported function code     |
| 0x02           | Illegal Data Address       | Unsupported address/range     |
| 0x03           | Illegal Data Value         | Invalid value or quantity     |
| 0x04           | Slave Device Failure       | Runtime failure or overflow   |
+----------------+----------------------------+-------------------------------+

11. Request Size Limits
-----------------------

- Read coils/discrete inputs: quantity 1 .. 2000
- Read holding/input registers: quantity 1 .. 125
- Write multiple coils: quantity 1 .. 1968
- Write multiple registers: quantity 1 .. 123
download protocol:

.txt   Modbus_RTU_Protocol.txt (Size: 10.7 KB / Downloads: 257) ]]>
Code:
KCSv3 Modbus RTU Protocol Specification
=======================================

1. Overview
-----------

This document specifies the Modbus RTU protocol exposed by the KCSv3
firmware on the RS485 interface.

2. Communication Parameters
---------------------------

- Protocol: Modbus RTU
- Physical interface: RS485
- Slave address: configured by rs485_local_addr
- Register addressing: 0-based Modbus protocol address
- Frame format: [Slave Address][PDU][CRC Lo][CRC Hi]
- CRC: Modbus CRC16, low byte first

Serial port parameters are configured by the firmware RS485 settings.

3. Supported Function Codes
---------------------------

+---------------+---------------------------+-------------------------------+
| Function Code | Name                      | Usage                         |
+---------------+---------------------------+-------------------------------+
| 0x01          | Read Coils                | Read DO output state          |
| 0x02          | Read Discrete Inputs      | Read DI input state           |
| 0x03          | Read Holding Registers    | Read DAC/IR/RF/energy data    |
| 0x04          | Read Input Registers      | Read ADC/temperature/humidity |
| 0x05          | Write Single Coil         | Set one DO or trigger toggle  |
| 0x06          | Write Single Register     | Set DAC or trigger IR/RF      |
| 0x0F          | Write Multiple Coils      | Set multiple DO channels      |
| 0x10          | Write Multiple Registers  | Set multiple DAC channels     |
+---------------+---------------------------+-------------------------------+

4. Addressing Notes
-------------------

All addresses in this document are 0-based Modbus protocol addresses.

Examples:

- Holding register address 100 is sent as 0x0064 in the Modbus PDU.
- Some Modbus tools display holding register 100 as 40101 or similar. Use the
  tool's 0-based/1-based setting carefully.

5. Coils (Function Codes 0x01, 0x05, 0x0F)
-------------------------------------------

5.1 DO Output State and Control
-------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DO_NUM-1          | DO output channels   | 0x01 read, 0x05/0x0F write  |
+------------------------+----------------------+-----------------------------+

Write value for function code 0x05:

- 0xFF00: turn ON
- 0x0000: turn OFF

Function code 0x0F supports only the normal DO output range starting at address
0.

5.2 DO Toggle Control
---------------------

+-----------------------------+----------------------+--------------------------+
| Address Range               | Description          | Access                   |
+-----------------------------+----------------------+--------------------------+
| 0x0100 .. 0x0100+DO_NUM-1   | Toggle DO channels   | 0x05 write only          |
+-----------------------------+----------------------+--------------------------+

Write 0xFF00 to address 0x0100 + channel_index to toggle that output channel.
Writing 0x0000 is accepted but does not toggle the output.

6. Discrete Inputs (Function Code 0x02)
---------------------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DI_NUM-1          | DI input channels    | 0x02 read                   |
+------------------------+----------------------+-----------------------------+

DI inputs are active-low in the firmware mapping:

- Hardware low / active input returns 1
- Hardware high / inactive input returns 0

7. Holding Registers (Function Codes 0x03, 0x06, 0x10)
------------------------------------------------------

7.1 DAC Output Registers
------------------------

+------------------------+----------------------+-----------------------------+
| Address Range          | Description          | Access                      |
+------------------------+----------------------+-----------------------------+
| 0 .. DAC_NUM-1         | DAC output channels  | 0x03 read, 0x06/0x10 write  |
+------------------------+----------------------+-----------------------------+

DAC write value range: 0 .. 255.

Function code 0x10 supports only this DAC register range.

7.2 IR/RF Control Registers
---------------------------

+----------+-------------+----------------------+-----------------------------+
| Address  | Name        | Description          | Access                      |
+----------+-------------+----------------------+-----------------------------+
| 0x0040   | IR_SEND     | Send learned IR slot | 0x03 read, 0x06 write       |
| 0x0041   | IR_LEARN    | Learn IR slot/port   | 0x03 read, 0x06 write       |
| 0x0042   | IR_DELETE   | Delete IR slot       | 0x03 read, 0x06 write       |
| 0x0050   | RF_SEND     | Send learned RF slot | 0x03 read, 0x06 write       |
+----------+-------------+----------------------+-----------------------------+

IR_SEND:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

IR_LEARN:

- High byte: IR memory slot index
- Low byte: IR send port number, starting from 1

IR_DELETE:

- Value: IR memory slot index
- Valid range: 0 .. IR_MEM_NUM-1

RF_SEND:

- Value: RF memory slot index
- The selected RF slot must exist and be learned

These registers exist only on board variants with the corresponding IR/RF
feature enabled. Otherwise accesses return an illegal data address exception.

7.3 Energy Measurement Registers
--------------------------------

Energy data is exposed as read-only Holding Registers and is read with function
code 0x03.

Each energy chip uses 68 holding registers. The base address is:

  base = 100 + chip_index * 100

where chip_index starts from 0.

+--------------+----------------+----------------+--------------------------+
| Offset Range | Parameter      | Format         | Resolution / Notes       |
+--------------+----------------+----------------+--------------------------+
| 0 .. 19      | RMS_1..RMS_10  | uint32 CDAB    | Current in A * 1000      |
| 20 .. 39     | WATT_1..WATT_10| int32 CDAB     | Power in W * 10          |
| 40 .. 59     | Energy_1..10   | float32 CDAB   | Energy in kWh            |
| 60 .. 61     | Energy_Sum     | float32 CDAB   | Total energy in kWh      |
| 62           | RMS_V          | uint16         | Voltage in V * 100       |
| 63           | Period         | uint16         | Frequency in Hz * 100    |
| 64 .. 65     | TPS1           | float32 CDAB   | Temperature in deg C     |
| 66 .. 67     | PF             | float32 CDAB   | Power factor             |
+--------------+----------------+----------------+--------------------------+

Per-channel offsets:

+----------------+----------------+----------------+--------------------------+
| Channel        | Current Offset | Power Offset   | Energy Offset            |
+----------------+----------------+----------------+--------------------------+
| 1              | 0              | 20             | 40                       |
| 2              | 2              | 22             | 42                       |
| 3              | 4              | 24             | 44                       |
| 4              | 6              | 26             | 46                       |
| 5              | 8              | 28             | 48                       |
| 6              | 10             | 30             | 50                       |
| 7              | 12             | 32             | 52                       |
| 8              | 14             | 34             | 54                       |
| 9              | 16             | 36             | 56                       |
| 10             | 18             | 38             | 58                       |
+----------------+----------------+----------------+--------------------------+

For 32-bit integer and float values, read two consecutive registers. The lower
16-bit word is returned first, followed by the upper 16-bit word.

Examples:

- Chip 1 current channel 1: read holding registers 100 and 101
- Chip 2 power channel 1: read holding registers 220 and 221
- Chip 1 voltage: read holding register 162
- Chip 1 frequency: read holding register 163

8. Input Registers (Function Code 0x04)
---------------------------------------

+-------------------------------+----------------------+--------------------------+
| Address Range                 | Description          | Format                   |
+-------------------------------+----------------------+--------------------------+
| 0 .. ADC_NUM-1                | ADC input channels   | uint16 raw ADC value     |
| 0x0100 .. 0x0100+SENSOR_NUM-1 | Temperature sensors  | int16, deg C * 10        |
| 0x0120 .. 0x0120+SENSOR_NUM-1 | Humidity sensors     | int16, %RH * 10          |
+-------------------------------+----------------------+--------------------------+

If a temperature or humidity sensor is invalid or not present, the returned
value is 0x7FFF.

9. Board-Dependent Limits
-------------------------

The following symbols depend on the compiled board model:

- DO_NUM: number of digital outputs
- DI_NUM: number of digital inputs
- DAC_NUM: number of DAC outputs
- ADC_NUM: number of ADC inputs
- SENSOR_NUM: maximum temperature/humidity sensor slots
- ENERGY_NUM: number of energy measurement chips

N-series energy chip bases:

+-------+------------+--------------------------------------+
| Board | ENERGY_NUM | Energy Holding Register Bases        |
+-------+------------+--------------------------------------+
| N10   | 1          | 100                                  |
| N20   | 2          | 100, 200                             |
| N30   | 3          | 100, 200, 300                        |
| N60   | 6          | 100, 200, 300, 400, 500, 600         |
+-------+------------+--------------------------------------+

10. Exception Codes
-------------------

+----------------+----------------------------+-------------------------------+
| Exception Code | Name                       | Meaning                       |
+----------------+----------------------------+-------------------------------+
| 0x01           | Illegal Function           | Unsupported function code     |
| 0x02           | Illegal Data Address       | Unsupported address/range     |
| 0x03           | Illegal Data Value         | Invalid value or quantity     |
| 0x04           | Slave Device Failure       | Runtime failure or overflow   |
+----------------+----------------------------+-------------------------------+

11. Request Size Limits
-----------------------

- Read coils/discrete inputs: quantity 1 .. 2000
- Read holding/input registers: quantity 1 .. 125
- Write multiple coils: quantity 1 .. 1968
- Write multiple registers: quantity 1 .. 123
download protocol:

.txt   Modbus_RTU_Protocol.txt (Size: 10.7 KB / Downloads: 257) ]]>