Servo Communication Protocol
1. Communication Protocol Overview
Depending on the servo model, the communication interface uses either a TTL level method compatible with high-speed communication or an RS485 communication method with strong anti-interference capability. Among them, the SC series, ST series, and CF35-12 servos use the TTL communication method, while the RSBL series servos use the RS485 communication method. Communication uses asynchronous duplex, and the transmit and receive signals are processed asynchronously.
The controller and the servo communicate in a question-and-answer manner. The controller sends a command frame, and the servo returns a response frame.
A single bus control network allows multiple servos, so each servo is assigned a unique ID number within the network. The control commands sent by the controller include ID information, and only the servo matching the ID number can fully receive this command and return response information.
The communication method is serial asynchronous. One frame of data consists of 1 start bit, 8 data bits, and 1 stop bit, with no parity bit, for a total of 10 bits.
When some parameters in the memory table use a two-byte value range, the byte order of the two bytes depends on the servo model. Potentiometer-type servos use big-endian format (high byte first, low byte last), while magnetic encoder-type servos use little-endian format (low byte first, high byte last). The ST series, RSBL series, and CF35-12 servos are magnetic encoder-type servos, while the SC series servos are potentiometer-type servos. Each servo differs slightly in functionality, so for actual control, please refer to the memory table of the specific model.
2. Command Frame
| Header | ID | Data Length | Instruction | Parameter | Check Sum |
|---|---|---|---|---|---|
| 0xFF 0xFF | ID | Length | Instruction | Parameter1 ...Parameter N | Check Sum |
- Header: Receiving two consecutive 0xFF indicates that a data packet has arrived.
- ID: Each servo has an ID number. The ID number range is
0~253, converted to hexadecimal as0x00~0xFD. - Broadcast ID: ID number 254 is the broadcast ID. If the ID number sent by the controller is 254 (0xFE), all servos receive the command. Except for the PING command, no other command returns response information (the broadcast PING command cannot be used when multiple servos are connected on the bus).
- Data Length: Equal to the parameter N to be sent plus 2, that is, "N+2".
- Instruction: The data packet operation function code. See 4 Instruction Types for details.
- Parameter: Control information additionally required by the instruction. A parameter supports a maximum of two bytes to represent one memory value. For byte order, refer to Communication Protocol Overview (the byte order differs for different servo models).
- Check Sum: The check sum Check Sum is calculated as follows: Check Sum = ~ (ID + Length + Instruction + Parameter1 + ... Parameter N). If the calculated sum inside the parentheses exceeds 255, take the lowest byte. "~" means bitwise inversion.
3. Response Frame
| Header | ID | Data Length | Status Code | Parameter | Check Sum |
|---|---|---|---|---|---|
| 0xFF 0xFF | ID | Length | ERROR | Parameter1 ...Parameter N | Check Sum |
The returned response frame contains the servo's current status ERROR. If the servo's current working status is abnormal, it will be reflected through this byte (for the meaning of each status, see the memory table explanation). If ERROR is 0, the servo has no error information.
4. Instruction Types
| Instruction | Function | Value | Parameter Length |
|---|---|---|---|
| PING | Query working status | 0x01 | 0 |
| READ DATA | Query data in the control table | 0x02 | 2 |
| WRITE DATA | Write data to the control table | 0x03 | Not less than 2 |
| REGWRITE DATA | Similar to WRITE DATA, but the control characters do not act immediately after being written until the ACTION instruction arrives | 0x04 | Not less than 4 |
| ACTION | Trigger the action written by REG WRITE | 0x05 | 0 |
| SYNC READ DATA | Used to query multiple servos at the same time | 0x82 | Not less than 3 |
| SYNC WRITE DATA | Used to control multiple servos at the same time | 0x83 | Not less than 2 |
| RESET | Reset the servo status (reset the servo turns) | 0x0A | 0 |
The following examples all use the ST series servos as examples. The parameter addresses of different servo series may differ. Please refer to the Servo Memory Table of the corresponding model.
4.1 Query Status Instruction PING
Function: Read the servo's working status
Length: 0x02
Instruction: 0x01
Parameter: None
The PING instruction uses the broadcast address, and the servo also returns response information.
Example 1: Read the working status of the servo with ID number 1. Command frame: FF FF 01 02 01 FB (send in hexadecimal)
| Header | ID | Length | Instruction | Check Sum |
|---|---|---|---|---|
| 0xFF 0xFF | 0x01 | 0x02 | 0x01 | 0xFB |
Response frame: FF FF 01 02 00 FC (displayed in hexadecimal)
| Header | ID | Length | Status | Check Sum |
|---|---|---|---|---|
| 0xFF 0xFF | 0x01 | 0x02 | 0x00 | 0xFC |
4.2 Read Instruction READ DATA
Function: Read data from the servo memory control table
Length: 0x04
Instruction: 0x02
Parameter 1: The start address of the data read segment
Parameter 2: The length of the data to read
Example 2: Read the current position of the servo with ID 1 (low byte first, high byte last). The memory table address of the position parameter is 0x38, with two consecutive bytes.
Command frame: FF FF 01 04 02 38 02 BE (send in hexadecimal)
| Header | ID | Length | Instruction | Parameter | Check Sum |
|---|---|---|---|---|---|
| 0xFF 0xFF | 0x01 | 0x04 | 0x02 | 0x38 0x02 (current position address, read data length) | 0xBE |
Response frame: FF FF 01 04 00 18 05 DD (displayed in hexadecimal)
| Header | ID | Length | Status | Parameter | Check Sum |
|---|---|---|---|---|---|
| 0xFF 0xFF | 0x01 | 0x04 | 0x00 | 0x18 0x05 | 0xDD |
The two bytes of data read out are respectively (little-endian structure): low byte L 0x18, high byte H 0x05. The two bytes combine into the 16-bit data 0x0518, which in decimal represents the current position 1304.
If it is an SC series servo, the two bytes of data read out are in big-endian structure, with the high byte first and the low byte last.
4.3 Write Instruction WRITE DATA
Function: Write data to the servo memory control table
Length: N+2 (N is the parameter length)
Instruction: 0x03
Parameter 1: The start address of the data write segment
Parameter 2: The 1st data to write
Parameter 3: The 2nd data to write
...
Parameter N: The nth data to write, N=n+1
Example 3: Use the broadcast ID (0xFE) to set the ID of any numbered servo to 1. In the memory table, the address for storing the ID number is 5. Command frame: FF FF FE 04 03 05 01 F4 (send in hexadecimal)
| Header | ID | Length | Instruction | Parameter | Check Sum |
|---|---|---|---|---|---|
| 0xFF 0xFF | 0xFE | 0x04 | 0x03 | 0x05 0x01 (ID address, new ID value) | 0xF4 |
Because the command is sent using the broadcast ID, no data will be returned. In addition, the memory table EPROM has a protection lock switch. Before modifying the ID, you need to turn it off (set to 0). Otherwise, the example ID number will not be saved after power-off. For detailed operations, please refer to the memory table or operation manual of the specific servo model.
Example 4: Control the ID1 servo to rotate to position 2048 at a speed of 1000 steps/second. The start address of the target position in the memory table is 0x2A, so write six consecutive bytes of data starting at address 0x2A.
Position data 0x0800 (2048)
Reserved data 0x0000 (0)
Speed data 0x03E8 (1000)
Command frame: FF FF 01 09 03 2A 00 08 00 00 E8 03 D5 (send in hexadecimal)
| Header | ID | Length | Instruction | Parameter | Check Sum |
|---|---|---|---|---|---|
| 0xFF 0xFF | 0x01 | 0x09 | 0x03 | 0x2A (start address) 0x00 0x08 (position) 0x00 0x00 (reserved) 0xE8 0x03 (speed) | 0xD5 |
Response frame: FF FF 01 02 00 FC (displayed in hexadecimal)
| Header | ID | Length | Status | Check Sum |
|---|---|---|---|---|
| 0xFF 0xFF | 0x01 | 0x02 | 0x00 | 0xFC |
The returned working status is 0, indicating that the servo correctly received the instruction without error and has begun execution. The ID of the sent command packet uses a non-broadcast ID (0x01), so after the command is received, the servo will return a status packet.
4.4 Asynchronous Write Instruction REG WRITE
The REG WRITE instruction is similar to WRITE DATA, except that the execution time is different. When a REG WRITE command frame is received, the received data is stored in the buffer for later use, and the asynchronous write flag register is set to 1. When the ACTION instruction is received, the stored instruction is finally executed.
Length: N+2 (N is the parameter length)
Instruction: 0x04
Parameter 1: The start address of the area to write data to
Parameter 2: The 1st data to write
Parameter 3: The 2nd data to write
Parameter N: The nth data to write, N=n+1
Example 5: Control the ID1 to ID10 servos to rotate to position 2048 at a speed of 1000 per second.
| ID | Asynchronous Write Command Frame | Response Frame |
|---|---|---|
| ID 1 | FF FF 01 09 04 2A 00 08 00 00 E8 03 D4 | FF FF 01 02 00 FC |
| ID 2 | FF FF 02 09 04 2A 00 08 00 00 E8 03 D3 | FF FF 02 02 00 FB |
| ID 3 | FF FF 03 09 04 2A 00 08 00 00 E8 03 D2 | FF FF 03 02 00 FA |
| ID 4 | FF FF 04 09 04 2A 00 08 00 00 E8 03 D1 | FF FF 04 02 00 F9 |
| ID 5 | FF FF 05 09 04 2A 00 08 00 00 E8 03 D0 | FF FF 05 02 00 F8 |
| ID 6 | FF FF 06 09 04 2A 00 08 00 00 E8 03 CF | FF FF 06 02 00 F7 |
| ID 7 | FF FF 07 09 04 2A 00 08 00 00 E8 03 CE | FF FF 07 02 00 F6 |
| ID 8 | FF FF 08 09 04 2A 00 08 00 00 E8 03 CD | FF FF 08 02 00 F5 |
| ID 9 | FF FF 09 09 04 2A 00 08 00 00 E8 03 CC | FF FF 09 02 00 F4 |
| ID10 | FF FF 0A 09 04 2A 00 08 00 00 E8 03 CB | FF FF 0A 02 00 F3 |
4.5 Execute Asynchronous Write Instruction ACTION
Function: Trigger the REG WRITE instruction
Length: 0x02
Instruction: 0x05
Parameter: None
- The ACTION instruction is very useful when controlling multiple servos at the same time.
- When controlling multiple servos, using the ACTION instruction allows the first and last servos to execute their respective actions at the same time, with no delay in between.
- When sending the ACTION instruction to multiple servos, the broadcast ID (0xFE) is used. Therefore, no data frame will be returned when sending this instruction.
Example 6: After sending the asynchronous write instructions to control the ID1 to ID10 servos to rotate to position 2048 at a speed of 1000 per second, the asynchronous write instruction needs to be executed.
Command frame: FF FF FE 02 05 FA
Response frame: None
4.6 Synchronous Write Instruction SYNC WRITE
Function: Used to control multiple servos at the same time.
ID: 0xFE
Length: (L+1)*n+4 (L: the data length sent to each servo, n: the number of servos)
Instruction: 0x83
Parameter 1: The start address of the data to write
Parameter 2: The length of the data to write (L)
Parameter 3: The ID number of the 1st servo
Parameter 4: The 1st data written to the 1st servo
Parameter 5: The 2nd data written to the 1st servo
...
Parameter L+3: The Lth data written to the 1st servo
Parameter L+4: The ID number of the 2nd servo
Parameter L+5: The 1st data written to the 2nd servo
Parameter L+6: The 2nd data written to the 2nd servo
...
Parameter 2L+4: The Lth data written to the 2nd servo
...
Unlike the REG WRITE+ACTION instruction, its real-time performance is higher. One SYNC WRITE instruction can modify the control table contents of multiple servos at once, while the REG WRITE+ACTION instruction does it step by step. Nevertheless, when using the SYNC WRITE instruction, the length of the data written and the start address for storing the data must be the same.
Example 7: Write position 0x0800, reserved 0x0000, and speed 0x03E8 to the start address 0x2A of a total of 4 servos, ID1-ID4 (low byte first, high byte last). Command frame: FF FF FE 20 83 2A 06 01 00 08 00 00 E8 03 02 00 08 00 00 E8 03 03 00 08 00 00 E8 03 04 00 08 00 00 E8 03 58 (send in hexadecimal)
Header: FF FF
ID: FE
Valid data length: 20
Instruction: 83
Parameter:
2A 06 (start address, data length)
01 00 08 00 00 E8 03 (ID1 servo instruction)
02 00 08 00 00 E8 03 (ID2 servo instruction)
03 00 08 00 00 E8 03 (ID3 servo instruction)
04 00 08 00 00 E8 03 (ID4 servo instruction)
Check Sum: 58
4.7 Synchronous Read Instruction SYNC READ
Function: Used to query multiple servos at the same time.
ID: 0xFE
Length: n+4 (n is the number of servos)
Instruction: 0x82
Parameter 1: The start address of the data to read
Parameter 2: The length of the data to read
Parameter 3: The ID number of the 1st servo
Parameter 4: The ID number of the 2nd servo
...
Parameter N: The ID number of the nth servo, N=n+2
One SYNC READ instruction can query the control table contents of multiple servos at once. The synchronous read instruction specifies the IDs of the servos to query. The servo response packets are returned in the order of the IDs in the command packet. When using the SYNC READ instruction, the data length and the data start address of all queries must be the same (this instruction is available for some serial bus servos).
SC series servos do not support synchronous read
Example 8: Query the current position, current speed, current load, current voltage, and current temperature of a total of 2 servos, ID1-ID2 (start address 0x38, a total of 8 bytes of data, low byte first, high byte last).
Command frame: FF FF FE 06 82 38 08 01 02 36
| Header | ID | Length | Instruction | Parameter | Check Sum |
|---|---|---|---|---|---|
| 0xFF 0xFF | 0xFE | 0x06 | 0x82 | 0x38 0x08 0x01 0x02 (data start address, data length, ID01, ID02) | 0x36 |
Response frame format for each servo (ID is 01 or 02):
FF FF ID 0A ERROR POSITION_L POSITION_H SPEED_L SPEED_H LOAD_L LOAD_H VOLTAGE TEMPERATURE CHECKSUM
4.8 Status Reset Instruction RESET
Function: Reset the servo status (reset the servo turns)
Length: 0x02
Instruction: 0x0A
Parameter: None
Example 9: Reset the servo with ID number 01.
Command frame: FF FF 01 02 0A F2 (send in hexadecimal)
Response frame: FF FF 01 02 00 FC (displayed in hexadecimal)