DAM-4AO-4VO communication protocol
This product is a 4-channel analog current output + 4-channel analog voltage output module supporting standard Modbus RTU. For detailed command construction and parsing, use the register tables in this document together with the Modbus specification.
Modbus register reference
Device (slave) address
Default slave address is 0x01; configurable range 0x01–0xF7. Supported ranges:
| Address range | Status | Description |
|---|---|---|
| 0x00 | ❌ Disabled | Non-response broadcast: master only; slaves must not use this address and do not reply. |
| 0x01~0xF7 | ✅ Available | Standard slave address; assignable to any device. |
| 0xFE | ❌ Disabled | Response broadcast: master only; slaves must not use this address. |
Note
When using broadcast address 0xFE, connect only one device on the bus; multiple devices responding will collide.
Function codes
This module is holding-register oriented; the following function codes are supported.
| FC | Function | Notes |
|---|---|---|
| 03 | Read holding registers | Read analog setpoints / device parameters |
| 06 | Write single register | Write one analog channel or device parameter |
| 10 | Write multiple registers | Write multiple analog channels or parameters |
Register map
| Address (HEX) | Content | Description | Type | Modbus FC |
|---|---|---|---|---|
| 4x0000~4x0003 | VO1–VO4 voltage outputs | Unsigned hex, range 0–10000, unit mV; span 0–10 V | R/W | 0x03,0x06,0x10 |
| 4x0004~4x0007 | AO1–AO4 current outputs | Unsigned hex, range 0–20000, unit µA; span 0–20 mA | R/W | 0x03,0x06,0x10 |
| 4xA000~4xA003 | VO1–VO4 power-on voltage | Power-on / watchdog-reset defaults; retained across power cycles | R/W/S | 0x03,0x06,0x10 |
| 4xA004~4xA007 | AO1–AO4 power-on current | Power-on / watchdog-reset defaults; retained across power cycles | R/W/S | 0x03,0x06,0x10 |
| 4x8000 | SUK | Model number | R/S | 0x03 |
| 4x8001 | Firmware version | Decimal value with implied decimal → version (e.g. 0x0064 = 100 → V1.00) | R/W/S | 0x03,0x06 |
| 4x8002 | Slave address | Stores Modbus address; default 0x0001 | R/W/S | 0x03,0x06 |
| 4x8003 | UART parameters | Upper byte: stop/parity; lower byte: baud rate | R/W/S | 0x03,0x06 |
| 4x8004 | Watchdog | If no valid Modbus within timeout, reset and restore power-on outputs | R/W/S | 0x03,0x06 |
| 4x9000~4x9007 | User string area | String format | R/W/S | 0x03,0x06,0x10 |
Note
Registers marked S retain values across power cycles.
Scaling
- Voltage VO (4x0000–4x0003): register value = output in mV, range 0–10000 → 0–10 V. Example:
5000= 5.000 V,10000= 10.000 V. - Current AO (4x0004–4x0007): register value = output in µA, range 0–20000 → 0–20 mA. Example:
10000= 10.000 mA,20000= 20.000 mA.
Modbus RTU command reference
Write a single analog output
Request: 01 06 00 00 03 E8 89 74
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register |
| 00 00 | Address | Output register (e.g. VO1 = 4x0000) |
| 03 E8 | Value | 16-bit setpoint, high byte first. Unit mV / µA. 0x03E8 = 1000 → 1 V |
| 89 74 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 00 00 03 E8 89 74
Examples (slave 0x01)
VO1 = 10 V (10000 mV) : 01 06 00 00 27 10 93 F6
VO1 = 5 V (5000 mV) : 01 06 00 00 13 88 84 9C
AO1 = 20 mA (20000 µA) : 01 06 00 04 4E 20 FC 73
AO1 = 10 mA (10000 µA) : 01 06 00 04 27 10 D2 37
AO1 = 4 mA (4000 µA) : 01 06 00 04 0F A0 CD 83
Write multiple analog outputs
Request: 01 10 00 00 00 04 08 27 10 27 10 27 10 27 10 32 1C
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers |
| 00 00 | Start address | First output register (e.g. VO1) |
| 00 04 | Quantity | Number of registers |
| 08 | Byte count | Following data bytes |
| 27 10 … | Values | Per-channel 16-bit setpoints (mV for VO / µA for AO) |
| 32 1C | CRC16 | CRC16 over preceding bytes |
Response: 01 10 00 00 00 04 C1 CA
Examples (slave 0x01)
VO1–VO4 all 10 V : 01 10 00 00 00 04 08 27 10 27 10 27 10 27 10 32 1C
AO1–AO4 all 20 mA : 01 10 00 04 00 04 08 4E 20 4E 20 4E 20 4E 20 4F 78
All 8 channels FS : 01 10 00 00 00 08 10 27 10 27 10 27 10 27 10 4E 20 4E 20 4E 20 4E 20 1E 95
Read analog outputs
Request: 01 03 00 00 00 08 44 0C
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers |
| 00 00 | Start address | First output register (VO1 = 4x0000) |
| 00 08 | Quantity | Read 8 channels (VO1–VO4 + AO1–AO4) |
| 44 0C | CRC16 | CRC16 over preceding bytes |
Response: 01 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 59
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers |
| 10 | Byte count | Data bytes returned (8×2) |
| 00 00 … | Setpoints | VO1–VO4 (mV), then AO1–AO4 (µA), each unsigned 16-bit |
| E4 59 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Read all 8 (VO1–AO4) : 01 03 00 00 00 08 44 0C
Read VO1–VO4 : 01 03 00 00 00 04 44 09
Read AO1–AO4 : 01 03 00 04 00 04 05 C8
Set power-on outputs
Request: 01 06 A0 00 27 10 B1 F6
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register |
| A0 00 | Address | Power-on register (e.g. VO1 = 4xA000) |
| 27 10 | Value | Same units as run registers (mV / µA); retained across power cycles |
| B1 F6 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 A0 00 27 10 B1 F6
Note
Changing a power-on setpoint does not change the current live output; it only updates the default value.
Examples (slave 0x01)
VO1 power-on 10 V : 01 06 A0 00 27 10 B1 F6
AO1 power-on 20 mA : 01 06 A0 04 4E 20 DE 73
Read firmware version
Request: 01 03 80 01 00 01 FC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 80 01 | Firmware register | Fixed 4x8001 |
| 00 01 | Word count | Fixed 0x0001 |
| FC 0A | CRC16 | CRC16 over preceding bytes |
Response: 01 03 02 00 64 B9 AF
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 64 | Version | Decimal ÷100 → version string (0x0064 = 100 → V1.00) |
| B9 AF | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX:01 03 80 01 00 01 FC 0A
RX:01 03 02 01 2C B8 09 //0x012C = 300 =V3.00
Read slave address
Request: FE 03 80 02 00 01 18 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | Word count | Fixed 0x0001 |
| 18 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 03 02 00 01 6D 90
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 01 | Slave addr | Current 0x0001–0x00F7 |
| 6D 90 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast read, connect only one device to avoid bus collisions.
Examples (slave 0x01)
TX : FE 03 80 02 00 01 18 05
RX : FE 03 02 00 02 2D 91 //address：0x02
Set slave address
Request: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast write, connect only one device or all devices will receive the same address.
Examples (slave 0x01)
Set address 0x01 ：FE 06 80 02 00 01 D4 05
Set address 0x02 ：FE 06 80 02 00 02 94 04
Set address 0x03 ：FE 06 80 02 00 03 55 C4
Set UART parameters
Request: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | Bits 0–7: baud rate 0 : 4800 1 : 9600 2 : 19200 3 : 38400 4 : 57600 5 : 115200 6 : 128000 7 : 256000 Bits 8–12: parity 0 : None, 1: Even parity, 2: Odd parity Bits 13–16: stop bits 0 : 1 stop bit, 1: 1.5 stop bits, 2: 2 stop bits |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | UART value |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
9600 baud, none, 1 stop ：01 06 80 03 00 01 91 CA
9600 baud, even, 2 stop ：01 06 80 03 00 D1 90 56
115200 baud, none, 1 stop ：01 06 80 03 00 05 90 09
Set watchdog
Request: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | 0 disables watchdog. Non-zero enables: each valid Modbus frame feeds the dog; if the interval expires without a valid frame, firmware resets and outputs return to power-on saved values. Timeout = value × 100 ms (e.g. 0x000A → 1 s). |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | Watchdog timeout value |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Watchdog 10 s ：01 06 80 04 00 64 E0 20
Disable watchdog ：01 06 80 04 00 00 E1 CB
Exception codes
On protocol or device errors, the slave returns an exception response:
Response: 01 85 03 02 91
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 85 | Exception FC | Exception FC = request FC + 0x80 |
| 03 | Ex. code | Exception code |
| 02 91 | CRC16 | CRC16 over preceding bytes |
Exception codes (single byte) indicate error type. Common Modbus exceptions:
| Code | Name | Description |
|---|---|---|
| 0x01 | Illegal function | Requested function not supported. |
| 0x02 | Illegal data address | Requested data address invalid. |
| 0x03 | Illegal data value | Data value or operation not allowed. |
| 0x04 | Server device failure | Server device failure. |
| 0x05 | Acknowledge | Request accepted and being processed. |
| 0x06 | Device busy | Device busy; cannot execute now. |