Modbus_RTU_PWM_Output_4CH Development Protocol
Function Code Introduction
| Function Code | Description |
|---|---|
| 03 | Read Holding Registers |
| 06 | Write Single Holding Register |
| 10 | Write Multiple Holding Registers |
Modbus Data Types
The Modbus protocol defines 4 types of data areas, usually represented by 0x, 1x, 3x, and 4x for different address types.
| Address Type | Address Range | Basic Storage Unit | Read/Write Attribute | Function Code |
|---|---|---|---|---|
| Coils | 0x0000-0xFFFF | 1 bit | Read/Write | 01H, 05H, 0FH |
| Discrete Inputs | 1x0000-1xFFFF | 1 bit | Read-only | 02H |
| Input Registers | 3x0000-3xFFFF | 16 bit / Register | Read-only | 04H |
| Holding Registers | 4x0000-4xFFFF | 16 bit / Register | Read/Write | 03H, 06H, 10H |
The above is the standard Modbus data type classification. A device does not necessarily implement all 4 data areas at the same time, nor does it necessarily support all the function codes listed in the table.
In Modbus, the basic width of each register is 16 bit. Actual data can occupy one or more consecutive registers:
- 16-bit data: occupies 1 register
- 32 bit data: occupies 2 consecutive registers
For example, 32-bit big-endian data 0x12345678:
| Register | Data |
|---|---|
| Register N | 0x1234 |
| Register N + 1 | 0x5678 |
That is, the byte order is 12 34 56 78.
The specific data length, data type, and byte order / word order of multi-register data should be based on the register description of the corresponding device.
Register Address Description
| Address (HEX) | Content Stored | Register Value | Access | Modbus Function Code |
|---|---|---|---|---|
| 4x0000 4x0001 | Channel 1 Frequency High 16 bits Channel 1 Frequency Low 16 bits | Unsigned 32-bit value, unit 0.01 Hz, range: 100 - 20000000 (1 Hz - 200 kHz) | R/W | 0x03, 0x06, 0x10 |
| 4x0002 | Channel 1 Duty Cycle | Unsigned 16-bit value, unit 0.01%, range 0 - 10000 (0 - 100%) | R/W | 0x03, 0x06, 0x10 |
| 4x0003 4x0004 | Channel 2 Frequency High 16 bits Channel 2 Frequency Low 16 bits | Unsigned 32-bit value, unit 0.01 Hz, range: 100 - 20000000 (1 Hz - 200 kHz) | R/W | 0x03, 0x06, 0x10 |
| 4x0005 | Channel 2 Duty Cycle | Unsigned 16-bit value, unit 0.01%, range 0 - 10000 (0 - 100%) | R/W | 0x03, 0x06, 0x10 |
| 4x0006 4x0007 | Channel 3 Frequency High 16 bits Channel 3 Frequency Low 16 bits | Unsigned 32-bit value, unit 0.01 Hz, range: 100 - 20000000 (1 Hz - 200 kHz) | R/W | 0x03, 0x06, 0x10 |
| 4x0008 | Channel 3 Duty Cycle | Unsigned 16-bit value, unit 0.01%, range 0 - 10000 (0 - 100%) | R/W | 0x03, 0x06, 0x10 |
| 4x0009 4x000A | Channel 4 Frequency High 16 bits Channel 4 Frequency Low 16 bits | Unsigned 32-bit value, unit 0.01 Hz, range: 100 - 20000000 (1 Hz - 200 kHz) | R/W | 0x03, 0x06, 0x10 |
| 4x000B | Channel 4 Duty Cycle | Unsigned 16-bit value, unit 0.01%, range 0 - 10000 (0 - 100%) | R/W | 0x03, 0x06, 0x10 |
| 4x2000 | Serial Port Parameters | High byte: parity mode: 0x00-0x02 Low byte: baud rate mode: 0x00-0x07 | Read/Write | 0x03, 0x06 |
| 4x4000 | Device Address | Stores Modbus address directly Device address: 0x0001 - 0x00FF | Read/Write | 0x03,0x06 |
| 4x8000 | Software Version | Convert to decimal, then shift decimal point left by two digits; e.g., 0x0064 = 100 = V1.00 | R | 0x03 |
The frequency register is a 32-bit unsigned value, composed of two consecutive 16-bit Modbus registers. Since a single Modbus register is only 16 bits and can represent only 0 to 65535, the full frequency range cannot be covered. Therefore, the frequency value must be split into a high 16-bit and a low 16-bit part for writing.
The frequency register uses big-endian format:
- The lower‑address register stores the high 16 bits.
- The higher‑address register stores the low 16 bits.
Take Channel 1 as an example:
- Register
0x0000: Channel 1 Frequency High 16 bits - Register
0x0001: Channel 1 Frequency Low 16 bits
The frequency unit is 0.01 Hz, so the actual value to write is calculated as:
Register write value = Target frequency in Hz × 100
For example, to set Channel 1 frequency to 100 Hz:
100 Hz × 100 = 10000
10000 (decimal) = 0x00002710
If the frequency write value does not exceed 65535, the high 16 bits are usually 0x0000, and only the low 16 bits need to hold the main value.
Therefore, the register values should be:
Register 0x0000 = 0x0000
Register 0x0001 = 0x2710
If the value to be set exceeds 65535, for example, to set Channel 1 frequency to 700 Hz:
700 Hz × 100 = 70000
70000 (decimal) = 0x00011170
When the frequency write value exceeds 65535, the excess part is written to the high 16-bit register, and the low 16-bit register holds the remainder.
Therefore, the register values should be:
Register 0x0000 = 0x0001
Register 0x0001 = 0x1170
It is recommended to use function code 0x10 to write both the high and low 16-bit registers in a single transaction.
Using function code 0x06 to write each frequency register separately is not recommended, because when only one of the two 16-bit registers is written, the device may temporarily combine an unexpected 32-bit frequency value, resulting in an unknown output frequency.
Command Operation Introduction
PWM Output Command Overview
Set Channel Output Command
Send Code: 01 10 00 00 00 03 06 00 01 86 A0 13 88 FF 7C
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | Channel start register |
| 00 03 | Number of Registers | Number of registers to set |
| 06 | Byte Count | Number of output bytes |
| 00 01 86 A0 13 88 | Register Data Frequency High 16-bit Frequency Low 16-bit Duty Cycle | Frequency is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100 - 20000000, i.e., 1 Hz - 200 kHz Duty Cycle is unsigned 16-bit hexadecimal, unit 0.01%, range 0 - 10000, i.e., 0 - 100% |
| FF 7C | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 10 00 00 00 03 80 08
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | 0x0000 - 0x0007 correspond to output channels 1 - 4 |
| 00 03 | Number of Registers | Number of registers set, cannot exceed maximum channel count |
| 80 08 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set channel 1 output 200 Hz 10% duty cycle : 01 10 00 00 00 03 06 00 00 4E 20 03 E8 F0 DC
Set channels 1 - 4 output 1 kHz 50% duty cycle : 01 10 00 00 00 0C 18 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 6E E5
Set Channel Frequency Command
Send Code: 01 10 00 00 00 02 04 00 01 86 A0 C0 77
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | Channel start register, 00 00 indicates channel 1 start register |
| 00 02 | Number of Registers | Number of registers to set; value is unsigned 32-bit, each register 16-bit |
| 04 | Byte Count | Number of output bytes |
| 00 01 86 A0 | Register Data Frequency High 16 bits Frequency Low 16 bits | Frequency: unsigned 32-bit, unit 0.01 Hz, range 100 - 20000000 (1 Hz - 200 kHz) |
| C0 77 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 10 00 00 00 02 41 C8
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | 0x0000, 0x0003, 0x0006, 0x0009 correspond to the start addresses of output channels 1-4 |
| 00 02 | Number of Registers | Number of registers set, cannot exceed maximum channel count |
| 41 C8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set channel 2 output 200 Hz : 01 10 00 00 00 02 04 00 00 4E 20 C7 D7
Set Channel Duty Cycle Command
Send Code: 01 06 00 02 07 D0 2B A6
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Write Single Holding Register |
| 00 02 | Register Address | Channel 1 duty cycle register |
| 07 D0 | Register Data | Duty cycle is unsigned 16-bit, unit: 0.01%, range: 0-10000, i.e., 0-100% |
| 2B A6 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 06 00 02 07 D0 2B A6
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Write Single Holding Register |
| 00 02 | Register address | Channel duty cycle register |
| 07 D0 | Register Data | Duty cycle is unsigned 16-bit, unit: 0.01%, range: 0-10000, i.e., 0-100% |
| 2B A6 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set channel 1 duty cycle 20% : 01 06 00 02 07 D0 2B A6
Set channel 2 duty cycle 50% : 01 06 00 05 13 88 94 9D
Set channel 4 duty cycle 20% : 01 06 00 0B 23 28 E1 26
Read Channel Output Command
Send Code: 01 03 00 00 00 0C 45 CF
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 03 | Command 03 | Read holding registers |
| 00 00 | Register Start Address | 0x0000, 0x0003, 0x0006, 0x0009 correspond to the start addresses of output channels 1-4 |
| 00 0C | Number of Registers | Number of registers to read, cannot exceed maximum channel count |
| 45 CF | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 03 18 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 90 CE
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 03 | Command 03 | Read holding registers |
| 18 | Byte Count | Total bytes of returned status information |
| 00 01 86 A0 13 88 …… | Output Values | Frequency and duty cycle of channels 1-4 in sequence Frequency is unsigned 32-bit, unit: 0.01 Hz, range: 100-20000000, i.e., 1 Hz-200 kHz Duty cycle is unsigned 16-bit, unit: 0.01%, range: 0-10000, i.e., 0-100% |
| 90 CE | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Read channel 1 data : 01 03 00 00 00 03 05 CB
Read channel 1 duty cycle : 01 03 00 02 00 01 25 CA
Read channel 3 data : 01 03 00 06 00 03 E5 CA
Modbus RTU Communication Commands
Set Baud Rate Command
Send Code: 00 06 20 00 00 05 43 D8
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 06 | Command 06 | Set baud rate, device address |
| 20 00 | Command register | 0x2000: set baud rate; 0x4000: set device address; 0x8000: read software version |
| 00 | Parity Mode | 0x00 for no parity, 0x01 for odd parity, 0x02 for even parity |
| 05 | Baud rate value | Corresponding baud rates: 0x00:4800, 0x01:9600, 0x02:19200, 0x03:38400, 0x04:57600, 0x05:115200, 0x06:128000, 0x07:256000 |
| 43 D8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 00 06 20 00 00 05 43 D8
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 06 | Command 06 | Set baud rate, device address |
| 20 00 | Command register | 0x2000: set baud rate; 0x4000: set device address; 0x8000: read software version |
| 00 | Parity Mode | 0x00 for no parity, 0x01 for odd parity, 0x02 for even parity |
| 05 | Baud rate value | Corresponding baud rates: 0x00:4800, 0x01:9600, 0x02:19200, 0x03:38400, 0x04:57600, 0x05:115200, 0x06:128000, 0x07:256000 |
| 43 D8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set baud rate 4800 : 00 06 20 00 00 00 83 DB
Set baud rate 9600 : 00 06 20 00 00 01 42 1B
Set baud rate 19200 : 00 06 20 00 00 02 02 1A
Set baud rate 38400 : 00 06 20 00 00 03 C3 DA
Set the baud rate as 57600: 00 06 20 00 00 04 82 18
Set the baud rate as 115200: 00 06 20 00 00 05 43 D8
Set the baud rate as 128000: 00 06 20 00 00 06 03 D9
Set the baud rate as 256000: 00 06 20 00 00 07 C2 19
Set Device Address Command
Send Code: 00 06 40 00 00 01 5C 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 06 | Command 06 | Set baud rate, device address |
| 40 00 | Command register | 0x2000: set baud rate; 0x4000: set device address; 0x8000: read software version |
| 00 01 | Device address | Device address set, 0x0001-0x00FF |
| 5C 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 00 06 40 00 00 01 5C 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 06 | Command 06 | Set baud rate, device address |
| 40 00 | Command register | 0x2000: set baud rate; 0x4000: set device address; 0x8000: read software version |
| 00 01 | Device address | Device address set, 0x0001-0x00FF |
| 5C 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set the device address to 0x01: 00 06 40 00 00 01 5C 1B
Set the device address to 0x02: 00 06 40 00 00 02 1C 1A
Set the device address to 0x03: 00 06 40 00 00 03 DD DA
Read Device Address Command
Send code: 00 03 40 00 00 01 90 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 03 | 03 Command | Read device address command |
| 40 00 | Command register | 0x2000: set baud rate; 0x4000: set device address; 0x8000: read software version |
| 00 01 | Byte Count | Fixed 0x0001 |
| 90 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Receive code: 00 03 02 00 01 44 44
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 03 | 03 Command | Read software version, read device address command |
| 02 | Byte count | Returned byte count |
| 00 01 | Device address | Device address set, 0x0001-0x00FF |
| 44 44 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 2
Send Code: 00 03 40 00 00 01 90 1B
Receive: 00 03 02 00 02 04 45 //Address: 0x02
Read Software Version Command
Send Code: 00 03 80 00 00 01 AC 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 03 | 03 Command | Read software version, read device address command |
| 80 00 | Command register | 0x2000: set baud rate; 0x4000: set device address; 0x8000: read software version |
| 00 01 | Byte Count | Fixed 0x0001 |
| AC 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 00 03 02 00 C8 84 12
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00: broadcast; 0x01-0xFF: device address |
| 03 | 03 Command | Read software version, read device address command |
| 02 | Byte Count | Returned byte count |
| 00 C8 | Software version | Convert to decimal and shift decimal point left two places: 0x00C8 = 200 = V2.00 |
| 84 12 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Send Code: 00 03 80 00 00 01 AC 1B
Return Code: 00 03 02 00 64 84 6F //0x0064 = 100 =V1.00
Exception Function Code Introduction
If the received command is incorrect or an exception occurs, the device will return an exception response. The exception response format is as follows:
Return Code: 01 85 03 02 91
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 85 | Exception Function Code | Exception function code = Request function code + 0x80 |
| 03 | Byte Count | Exception code |
| 02 91 | CRC16 | CRC16 checksum of the first 6 bytes of data |
The exception code is a single-byte value indicating the type of error. Several common exception codes defined by the Modbus protocol:
| Exception Code | Name | Description |
|---|---|---|
| 0x01 | Illegal Function | The requested function code is not supported |
| 0x02 | Illegal Data Address | The requested data address is incorrect |
| 0x03 | Illegal Data Value | The requested data value or operation cannot be performed |
| 0x04 | Server Failure | Server device failure |
| 0x05 | Acknowledge | Request received and processing |
| 0x06 | Device Busy | Device is busy and cannot execute the requested operation |