Skip to content

Communication Protocols

MODBUS RTU Protocol Explanation

MODBUS RTU (Remote Terminal Unit) is an industrial communication protocol, which is a variant of the MODBUS protocol designed for serial communication. This protocol operates in a master-slave mode, where the master device sends a request frame, and the slave device responds.

Data Frame Structure

Each data frame includes a device address, function code, data, and a CRC checksum.

Field Description Length
Device Address Address of the device 1 byte
Function Code Indicates the operation (e.g., read or write) 1 byte
Data Contains register address and length in the request, and register address and data in the response Variable length
CRC Checksum Error-checking data 2 bytes

Device Address

Each device on the bus is uniquely identified by its address. The valid address range for slave devices is 1–247. When the master sends a data packet, only the slave device with the matching address responds.

Function Code

The function code indicates the operation to be performed, such as reading or writing registers.

Code Description
03 Read register data
06 Write register data

Data

The data packet sent by the master contains the register address and data length, and the data packet responded by the slave contains the content register address and data content. The register address in the data bit is listed in the following subsections.

The data packet sent by the master:

Field Field Description
Register Address Data Length Address of the register and length of the data

The data packet responded by the slave:

Field Field Description
Register Address Data Length Address of the register and length of the data

CRC Checksum

The CRC (Cyclic Redundancy Check) is a 16-bit value used to detect errors in communication. The master and slave devices calculate the CRC value from the transmitted data and compare it to the received CRC to ensure data integrity.

The calculation method involves an initial 16-bit register set to all ones (0xFFFF). Data is processed byte by byte through XOR operations and bit shifts. If the last bit of the result is 1, the register is XORed with a preset value (0xA001). This process is repeated for each byte in the frame. The final register value is the CRC checksum, with the low byte sent first during transmission.

CRC code block:

1 /** 
2   * @funcname: u16 crc16(u8 *buffer,u16 length) 
3   * @brief  CRC-16/MODBUS x16 + x15 + x2 + 1
4   * @note   The function takes each bit as the result of the XOR operation
5   * @param  buffer This parameter is used to store parameters,Directed buffer array
6   * @param  length This parameter represents the data length,To calculate the total number of bytes
7   * @return  temp result CRC-16
8   */
9 u16 crc16(u8 *buffer,u16 length)
10 {
11     u16 temp=0xffff,i,k = 0;        //initial value
12     while( k < length)              //To calculate the total number of bytes
13     {
14         temp = temp ^ buffer[k];   //Enter the byte to be checked, the result of the XOR operation
15         i = 0;
16         while(i < 8)               //Number of byte shifts
17         {
18             if((temp & 0x01)==0)   //Check whether the last bit of the result is zero
19             {
20                 temp = temp >> 1; //Move one to the right
21                 i++;                      //counter 
22             }
23             else
24             {
25                 temp = temp >> 1;        //Move one to the right
26                 temp = temp ^ 0xa001;    //The result of the XOR operation
27                 i++;                     //counter 
28             }
29         }
30         k++;                             //Next check byte
31     }
32     return(temp);
33 }

Example of Reading and Writing Registers

Read Register Data Frame

Data frame sent when reading registers:

Device Address Function Code Register Address Data content CRC Checksum CRC Checksum
0~247 03H Register Address 32bit High Byte Low Byte

Data frame responded when reading register:

Device Address Function Code Register Address Data content CRC Checksum CRC Checksum
0~247 03H Register Address 32bit High Byte Low Byte

Write Register Data Frame

Data frame sent when writing registers:

Device Address Function Code Register Address Data content CRC Checksum CRC Checksum
0~247 06H Register Address 32bit High Byte Low Byte

Data frame responded when writing registers:

Device Address Function Code Register Address Data content CRC Checksum CRC Checksum
0~247 06H Register Address 32bit High Byte Low Byte

List of Register Addresses

Register Address Parameter Name Read/Write Data Range Description
00 00 Version Information R/W 0/1 Returns version info on power-up (0: No return, 1: Return, default: Return)
00 01 Baud Rate R/W 1~5 Baud rates: 1=19200, 2=57600, 3=115200, 4=2250000, 5=4500000bps (default: 19200)
00 02 Device Address R/W 0~247 Device address
00 03 Motor Temperature R -40°C~75°C Read motor temperature
00 04 Brake R/W 0/1 Brake/Release brake (only for models with brakes)
00 10 Servo State R/W 0/1 Servo state (0: Off, 1: On).
00 13 Encoder Position 1 R ±67108864 Read cumulative position of encoder 1, cleared when powered off.
00 14 Motor Speed R ±3000 rpm Read current motor speed (in rpm).
00 15 Encoder Position 2 R 0~32767 Read single-turn absolute position of output shaft encoder 2.
00 19 Drive Current R 0~5000 Read drive current (in milliamps).
00 1A Operating State R 0/1 Read motor operating state.
00 1B Fault Code R/W 0~3 Fault code (0: Normal, 1: Under-voltage, 2: Over-temperature, 3: Overload).
00 1E Upper Limit of Motor Current R/W 10~3500 Set upper limit of motor current (in mA).
00 20 Position Control Proportional Coefficient (Kp1) R/W 1~32000 Higher value indicates stronger stiffness.
00 21 Position Control Integral Coefficient (Ki1) R/W 1~32000 Used to eliminate steady-state error.
00 22 Position Control Derivative Coefficient (Kd1) R/W 1~32000 Damping to prevent oscillation.
00 27 Acceleration Time R/W 100~1000 ms Set motor acceleration time (in milliseconds).
00 28 Deceleration Time R/W 100~1000 ms Set motor deceleration time (in milliseconds).
00 2D Save Parameters W 1 Save configuration parameters.
00 2E Target Speed R/W 1~3000 rpm Set motor running speed (in rpm).
00 2F Speed Mode R/W ±3000 rpm Speed mode (in rpm).
00 30 Current Mode R/W ±2000 mA Modify PWM parameters in current mode.
00 31 Set Home Position W 1 Set the current position as the home position.
00 32 Return to Home Position W 1 Return the output shaft to the home position.
00 33 Stop Motor Operation W 1 Stop motor operation.
00 81 Position Mode W ±134217728 Run to target position (without acceleration or deceleration, no return information).
00 82 Position Mode W ±134217728 Run to target position (with target speed setting).

Note 1

If the communication baud rate or device address is modified, the parameters need to be saved and the device needs to be powered off and restarted for the changes to take effect.

Note 2

It is recommended that the target position and current position difference be less than 1000 when sending a new target position. If the difference is too large, the lack of acceleration/deceleration may cause motor vibrations.

Note 3

Encoder 1 resolution varies as follows:

  • 15 bits for models without brakes
  • 18 bits for brake-equipped joint modules of models 08 and 11
  • 19 bits for brake-equipped joint modules of models 14 and 17

Application Examples

Read Motor Position

The master send:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 03 00 13 00 00 00 02 C5 B6

The slave response:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 03 00 13 00 01 86 A0 C5 B6

Read Servo Status

The master send:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 03 00 10 00 00 00 02 C5 F2

The slave response:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 03 00 10 00 00 00 00 04 73

Write Servo Status

The master send:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 10 00 00 00 01 C4 E7

The slave response:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 10 00 00 00 01 C4 E7

Write Target Speed: 1000 rpm

The master send:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 2E 00 00 03 E8 7F 0F

The slave response:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 2E 00 00 03 E8 7F 0F

Write Target Position: 20000

The master send:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 82 00 00 4E 20 A1 AB

The slave response:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 82 00 00 4E 20 A1 AB

Write Target Position: -20000

The master send:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 82 FF FF B1 DF 35 AA

The slave response:

Device Address Function Code Register Address Data content 32bit CRC Checksum
01 06 00 82 FF FF B1 DF 35 AA