Secondary Development Protocol
Function Code Introduction
| Function Code | Description |
|---|---|
| 03 | Read Holding Registers |
| 06 | Write Single Holding Register |
| 10 | Write Multiple Holding Registers |
Register Address Description
| Address (HEX) | Address Storage Content | Register Value | Access | Modbus Function Code |
|---|---|---|---|---|
| 4x0000 4x0001 | Channel 1 Frequency High 16-bit Channel 1 Frequency Low 16-bit | Value is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100~20000000, i.e., 1 Hz~200 kHz | Read/Write | 0x03,0x06,0x10 |
| 4x0002 | Channel 1 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% | Read/Write | 0x03,0x06,0x10 |
| 4x0003 4x0004 | Channel 2 Frequency High 16-bit Channel 2 Frequency Low 16-bit | Value is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100~20000000, i.e., 1 Hz~200 kHz | Read/Write | 0x03,0x06,0x10 |
| 4x0005 | Channel 2 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% | Read/Write | 0x03,0x06,0x10 |
| 4x0006 4x0007 | Channel 3 Frequency High 16-bit Channel 3 Frequency Low 16-bit | Value is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100~20000000, i.e., 1 Hz~200 kHz | Read/Write | 0x03,0x06,0x10 |
| 4x0008 | Channel 3 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% | Read/Write | 0x03,0x06,0x10 |
| 4x0009 4x000A | Channel 4 Frequency High 16-bit Channel 4 Frequency Low 16-bit | Value is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100~20000000, i.e., 1 Hz~200 kHz | Read/Write | 0x03,0x06,0x10 |
| 4x000B | Channel 4 Duty Cycle | Value is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% | Read/Write | 0x03,0x06,0x10 |
| 4x2000 | Serial Port Parameters | High byte: parity mode: 0x00~0x02 Low byte: baud rate mode: 0x00~0x07 | Read/Write | 0x03,0x06 |
| 4x4000 | Device Address | Stores Modbus address directly Device address: 0x0001-0x00FF | Read/Write | 0x03,0x06 |
| 4x8000 | Software Version | Convert to decimal, then shift decimal point two places left for version 0x0064 = 100 = V1.00 | Read | 0x03 |
- Note: It is recommended to use function code 10 to set frequency with multiple registers simultaneously. Using function code 06 to operate a single register may output an unknown frequency.
Operation Command Description
Set Channel Output Command
Transmission Code: 01 10 00 00 00 03 06 00 01 86 A0 13 88 FF 7C
| Field | Description | Note |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | Channel start register |
| 00 03 | Number of Registers | Number of registers to set |
| 06 | Byte Count | Number of output bytes |
| 00 01 86 A0 13 88 | Register Data Frequency High 16-bit Frequency Low 16-bit Duty Cycle | Frequency is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100~20000000, i.e., 1 Hz~200 kHz Duty Cycle is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% |
| FF 7C | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 10 00 00 00 03 80 08
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | 0x0000 - 0x0007 correspond to output channels 1~8 |
| 00 03 | Number of Registers | Number of registers set, cannot exceed maximum channel count |
| 80 08 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device address 1
Set channel 2 output 200 Hz 10% duty cycle : 01 10 00 00 00 03 06 00 00 4E 20 03 E8 F0 DC
Set channels 1\~4 output 1 kHz 50% duty cycle : 01 10 00 00 00 0C 18 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 6E E5
Set Channel Frequency Command
Transmission Code: 01 10 00 00 00 02 04 00 01 86 A0 C0 77
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | Channel start register, 00 00 indicates channel 1 start register |
| 00 02 | Number of Registers | Number of registers to set, value is unsigned 32-bit hexadecimal, each register is 16-bit |
| 04 | Byte Count | Number of output bytes |
| 00 01 86 A0 | Register Data Frequency High 16-bit Frequency Low 16-bit | Frequency is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100~20000000, i.e., 1 Hz~200 kHz |
| C0 77 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 10 00 00 00 02 41 C8
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 10 | Write Multiple Registers Command | |
| 00 00 | Register Start Address | 0x0000 - 0x0007 correspond to output channels 1~8 |
| 00 02 | Number of Registers | Number of registers set, cannot exceed maximum channel count |
| 41 C8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set channel 2 output 200 Hz : 01 10 00 00 00 02 04 00 00 4E 20 C7 D7
Set Channel Duty Cycle Command
Transmission Code: 01 06 00 02 07 D0 2B A6
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Write Single Holding Register |
| 00 02 | Register Address | Channel 1 duty cycle register |
| 07 D0 | Register Data | Duty cycle is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% |
| 2B A6 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 06 00 02 07 D0 2B A6
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Write Single Holding Register |
| 00 02 | Register address | Channel duty cycle register |
| 07 D0 | Register Data | Duty cycle is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% |
| 2B A6 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set channel 1 duty cycle 20% : 01 06 00 02 07 D0 2B A6
Set channel 2 duty cycle 50% : 01 06 00 05 13 88 94 9D
Set channel 4 duty cycle 20% : 01 06 00 0B 23 28 E1 26
Read Channel Output Command
Transmission Code: 01 03 00 00 00 0C 45 CF
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read Holding Registers |
| 00 00 | Register Start Address | 0x0000 - 0x0007 correspond to input channels 1~8 |
| 00 0C | Number of Registers | Number of registers to read, cannot exceed maximum channel count |
| 45 CF | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 03 18 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 00 01 86 A0 13 88 90 CE
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read Holding Registers |
| 18 | Byte Count | Total bytes of returned status information |
| 00 01 86 A0 13 88 …… | Output Values | Sequentially frequency and duty cycle for channels 1~4 Frequency is unsigned 32-bit hexadecimal, unit 0.01 Hz, range: 100~20000000, i.e., 1 Hz~200 kHz Duty Cycle is unsigned 16-bit hexadecimal, unit 0.01%, range 0~1000, i.e., 0~100% |
| 90 CE | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Read channel 1 data : 01 03 00 00 00 03 05 CB
Read channel 1 duty cycle : 01 03 00 02 00 01 25 CA
Read channel 3 data : 01 03 00 06 00 03 E5 CA
Set Baud Rate Command
Transmission Code: 00 06 20 00 00 05 43 D8
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 20 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 | Parity Mode | 0x00 for no parity, 0x01 for odd parity, 0x02 for even parity |
| 05 | Baud Rate Value | Baud rate value mapping: 0x00: 4800 0x01: 9600 0x02: 19200 0x03: 38400 0x04: 57600 0x05: 115200 0x06: 128000 0x07: 256000 |
| 43 D8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 00 06 20 00 00 05 43 D8
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 20 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 | Parity Mode | 0x00 for no parity, 0x01 for odd parity, 0x02 for even parity |
| 05 | Baud Rate | Baud rate value mapping: 0x00: 4800 0x01: 9600 0x02: 19200 0x03: 38400 0x04: 57600 0x05: 115200 0x06: 128000 0x07: 256000 |
| 43 D8 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set baud rate 4800 : 00 06 20 00 00 00 83 DB
Set baud rate 9600 : 00 06 20 00 00 01 42 1B
Set baud rate 115200 : 00 06 20 00 00 05 43 D8
Set Device Address Command
Transmission Code: 00 06 40 00 00 01 5C 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 40 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 01 | Device Address | Device address set, 0x0001-0x00FF |
| 5C 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 00 06 40 00 00 01 5C 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 06 | 06 Command | Set baud rate, set device address |
| 40 00 | Command Register | 0x2000 for setting baud rate, 0x4000 for setting device address |
| 00 01 | Device Address | Device address set, 0x0001-0x00FF |
| 5C 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Set device address to 0x01 : 00 06 40 00 00 01 5C 1B
Set device address to 0x02 : 00 06 40 00 00 02 1C 1A
Set device address to 0x03 : 00 06 40 00 00 03 DD DA
Read Device Address Command
Transmission code: 00 03 40 00 00 01 90 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read device address command |
| 40 00 | Command Register | 0x4000 for reading device address, 0x8000 for reading software version |
| 00 01 | Byte Count | Fixed 0x0001 |
| 90 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return code: 01 03 02 00 01 79 84
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read software version, read device address command |
| 02 | Byte Count | Returned byte count |
| 00 01 | Device Address | Device address set, 0x0001-0x00FF |
| 79 84 | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 2
Transmission Code: 00 03 40 00 00 01 90 1B
Return Code : 02 03 02 00 02 7D 85 //Address 0x02
Read Software Version Command
Transmission Code: 00 03 80 00 00 01 AC 1B
| Field | Description | Notes |
|---|---|---|
| 00 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read software version, read device address command |
| 80 00 | Command Register | 0x4000 for reading device address, 0x8000 for reading software version |
| 00 01 | Byte Count | Fixed 0x0001 |
| AC 1B | CRC16 | CRC16 checksum of the first 6 bytes of data |
Return Code: 01 03 02 00 64 B9 AF
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 03 | 03 Command | Read software version, read device address command |
| 02 | Byte Count | Returned byte count |
| 00 64 | Software Version | Convert to decimal, then shift decimal point two places left for version 0x0064 = 100 = V1.00 |
| B9 AF | CRC16 | CRC16 checksum of the first 6 bytes of data |
Example: Device with address 1
Transmission Code: 00 03 80 00 00 01 AC 1B
Return Code: 01 03 02 00 64 B9 AF //0x0064 = 100 =V1.00
Exception Function Code Introduction
If the received command is incorrect or an exception occurs, the device will return an exception response. The exception response format is as follows:
Return Code: 01 85 03 02 91
| Field | Description | Notes |
|---|---|---|
| 01 | Device Address | 0x00 indicates broadcast address; 0x01-0xFF indicate device address |
| 85 | Exception Function Code | Exception function code = Request function code + 0x80 |
| 03 | Byte Count | Exception code |
| 02 91 | CRC16 | CRC16 checksum of the first 6 bytes of data |
The exception code is a single-byte value indicating the type of error. Several common exception codes defined by the Modbus protocol:
| Exception Code | Name | Description |
|---|---|---|
| 0x01 | Illegal Function | The requested function code is not supported |
| 0x02 | Illegal Data Address | The requested data address is incorrect |
| 0x03 | Illegal Data Value | The requested data value or operation cannot be performed |
| 0x04 | Server Failure | Server device failure |
| 0x05 | Acknowledge | Request received and processing |
| 0x06 | Device Busy | Device is busy and cannot execute the requested operation |