Communication-Protocols
MODBUS RTU Protocol Explanation
MODBUS RTU (Remote Terminal Unit) is an industrial communication protocol, which is a variant of the MODBUS protocol designed for serial communication. This protocol operates in a master-slave mode, where the master device sends a request frame, and the slave device responds.
Data Frame Structure
Each data frame includes a device address, function code, data, and a CRC checksum.
| Field | Description | Length |
|---|---|---|
| Device Address | Address of the device | 1 byte |
| Function Code | Indicates the operation (e.g., read or write) | 1 byte |
| Data | Contains register address and length in the request, and register address and data in the response | Variable length |
| CRC Checksum | Error-checking data | 2 bytes |
Device Address
Each device on the bus is uniquely identified by its address. The valid address range for slave devices is 1–247. When the master sends a data packet, only the slave device with the matching address responds.
Function Code
The function code indicates the operation to be performed, such as reading or writing registers.
| Code | Description |
|---|---|
| 03 | Read register data |
| 06 | Write register data |
Data
The data packet sent by the master contains the register address and data length, and the data packet responded by the slave contains the content register address and data content. The register address in the data bit is listed in the following subsections.
The data packet sent by the master:
| Field | Field | Description |
|---|---|---|
| Register Address | Data Length | Address of the register and length of the data |
The data packet responded by the slave:
| Field | Field | Description |
|---|---|---|
| Register Address | Data Length | Address of the register and length of the data |
CRC Checksum
The CRC (Cyclic Redundancy Check) is a 16-bit value used to detect errors in communication. The master and slave devices calculate the CRC value from the transmitted data and compare it to the received CRC to ensure data integrity.
The calculation method involves an initial 16-bit register set to all ones (0xFFFF). Data is processed byte by byte through XOR operations and bit shifts. If the last bit of the result is 1, the register is XORed with a preset value (0xA001). This process is repeated for each byte in the frame. The final register value is the CRC checksum, with the low byte sent first during transmission.
CRC code block:
1 /**
2 * @funcname: u16 crc16(u8 *buffer,u16 length)
3 * @brief CRC-16/MODBUS x16 + x15 + x2 + 1
4 * @note The function takes each bit as the result of the XOR operation
5 * @param buffer This parameter is used to store parameters,Directed buffer array
6 * @param length This parameter represents the data length,To calculate the total number of bytes
7 * @return temp result CRC-16
8 */
9 u16 crc16(u8 *buffer,u16 length)
10 {
11 u16 temp=0xffff,i,k = 0; //initial value
12 while( k < length) //To calculate the total number of bytes
13 {
14 temp = temp ^ buffer[k]; //Enter the byte to be checked, the result of the XOR operation
15 i = 0;
16 while(i < 8) //Number of byte shifts
17 {
18 if((temp & 0x01)==0) //Check whether the last bit of the result is zero
19 {
20 temp = temp >> 1; //Move one to the right
21 i++; //counter
22 }
23 else
24 {
25 temp = temp >> 1; //Move one to the right
26 temp = temp ^ 0xa001; //The result of the XOR operation
27 i++; //counter
28 }
29 }
30 k++; //Next check byte
31 }
32 return(temp);
33 }
Example of Reading and Writing Registers
Read Register Data Frame
Data frame sent when reading registers:
| Device Address | Function Code | Register Address | Data content | CRC Checksum | CRC Checksum |
|---|---|---|---|---|---|
| 0~247 | 03H | Register Address | 32bit | High Byte | Low Byte |
Data frame responded when reading register:
| Device Address | Function Code | Register Address | Data content | CRC Checksum | CRC Checksum |
|---|---|---|---|---|---|
| 0~247 | 03H | Register Address | 32bit | High Byte | Low Byte |
Write Register Data Frame
Data frame sent when writing registers:
| Device Address | Function Code | Register Address | Data content | CRC Checksum | CRC Checksum |
|---|---|---|---|---|---|
| 0~247 | 06H | Register Address | 32bit | High Byte | Low Byte |
Data frame responded when writing registers:
| Device Address | Function Code | Register Address | Data content | CRC Checksum | CRC Checksum |
|---|---|---|---|---|---|
| 0~247 | 06H | Register Address | 32bit | High Byte | Low Byte |
List of Register Addresses
| Register Address | Parameter Name | Read/Write | Data Range | Description |
|---|---|---|---|---|
| 00 00 | Version Information | R/W | 0/1 | Returns version info on power-up (0: No return, 1: Return, default: Return) |
| 00 01 | Baud Rate | R/W | 1~5 | Baud rates: 1=19200, 2=57600, 3=115200, 4=2250000, 5=4500000bps (default: 19200) |
| 00 02 | Device Address | R/W | 0~247 | Device address |
| 00 03 | Motor Temperature | R | -40°C~75°C | Read motor temperature |
| 00 04 | Brake | R/W | 0/1 | Brake/Release brake (only for models with brakes) |
| 00 10 | Servo State | R/W | 0/1 | Servo state (0: Off, 1: On). |
| 00 13 | Encoder Position 1 | R | ±67108864 | Read cumulative position of encoder 1, cleared when powered off. |
| 00 14 | Motor Speed | R | ±3000 rpm | Read current motor speed (in rpm). |
| 00 15 | Encoder Position 2 | R | 0~32767 | Read single-turn absolute position of output shaft encoder 2. |
| 00 19 | Drive Current | R | 0~5000 | Read drive current (in milliamps). |
| 00 1A | Operating State | R | 0/1 | Read motor operating state. |
| 00 1B | Fault Code | R/W | 0~3 | Fault code (0: Normal, 1: Under-voltage, 2: Over-temperature, 3: Overload). |
| 00 1E | Upper Limit of Motor Current | R/W | 10~3500 | Set upper limit of motor current (in mA). |
| 00 20 | Position Control Proportional Coefficient (Kp1) | R/W | 1~32000 | Higher value indicates stronger stiffness. |
| 00 21 | Position Control Integral Coefficient (Ki1) | R/W | 1~32000 | Used to eliminate steady-state error. |
| 00 22 | Position Control Derivative Coefficient (Kd1) | R/W | 1~32000 | Damping to prevent oscillation. |
| 00 27 | Acceleration Time | R/W | 100~1000 ms | Set motor acceleration time (in milliseconds). |
| 00 28 | Deceleration Time | R/W | 100~1000 ms | Set motor deceleration time (in milliseconds). |
| 00 2D | Save Parameters | W | 1 | Save configuration parameters. |
| 00 2E | Target Speed | R/W | 1~3000 rpm | Set motor running speed (in rpm). |
| 00 2F | Speed Mode | R/W | ±3000 rpm | Speed mode (in rpm). |
| 00 30 | Current Mode | R/W | ±2000 mA | Modify PWM parameters in current mode. |
| 00 31 | Set Home Position | W | 1 | Set the current position as the home position. |
| 00 32 | Return to Home Position | W | 1 | Return the output shaft to the home position. |
| 00 33 | Stop Motor Operation | W | 1 | Stop motor operation. |
| 00 81 | Position Mode | W | ±134217728 | Run to target position (without acceleration or deceleration, no return information). |
| 00 82 | Position Mode | W | ±134217728 | Run to target position (with target speed setting). |
If the communication baud rate or device address is modified, the parameters need to be saved and the device needs to be powered off and restarted for the changes to take effect.
It is recommended that the target position and current position difference be less than 1000 when sending a new target position. If the difference is too large, the lack of acceleration/deceleration may cause motor vibrations.
Encoder 1 resolution varies as follows:
- 15 bits for models without brakes
- 18 bits for brake-equipped joint modules of models 08 and 11
- 19 bits for brake-equipped joint modules of models 14 and 17
Application Examples
Read Motor Position
The master send:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 03 | 00 13 | 00 00 00 02 | C5 B6 |
The slave response:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 03 | 00 13 | 00 01 86 A0 | C5 B6 |
Read Servo Status
The master send:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 03 | 00 10 | 00 00 00 02 | C5 F2 |
The slave response:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 03 | 00 10 | 00 00 00 00 | 04 73 |
Write Servo Status
The master send:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 10 | 00 00 00 01 | C4 E7 |
The slave response:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 10 | 00 00 00 01 | C4 E7 |
Write Target Speed: 1000 rpm
The master send:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 2E | 00 00 03 E8 | 7F 0F |
The slave response:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 2E | 00 00 03 E8 | 7F 0F |
Write Target Position: 20000
The master send:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 82 | 00 00 4E 20 | A1 AB |
The slave response:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 82 | 00 00 4E 20 | A1 AB |
Write Target Position: -20000
The master send:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 82 | FF FF B1 DF | 35 AA |
The slave response:
| Device Address | Function Code | Register Address | Data content 32bit | CRC Checksum |
|---|---|---|---|---|
| 01 | 06 | 00 82 | FF FF B1 DF | 35 AA |