DAM-16DO communication protocol
This product is a 16-channel Darlington digital output module supporting standard Modbus RTU commands. For detailed command construction and parsing, use the register tables in this document together with the Modbus specification.
Modbus register reference
Device (slave) address
Default slave address is 0x01; configurable range 0x01–0xF7. Supported ranges:
| Address range | Status | Description |
|---|---|---|
| 0x00 | ❌ Disabled | Non-response broadcast: master only; slaves must not use this address and do not reply. |
| 0x01~0xF7 | ✅ Available | Standard slave address; assignable to any device. |
| 0xFE | ❌ Disabled | Response broadcast: master only; slaves must not use this address. |
Note
When using broadcast address 0xFE, connect only one device on the bus; multiple devices responding will collide.
Function codes
This module is coil-oriented; the following function codes are supported.
| FC | Function | Notes |
|---|---|---|
| 01 | Read coils | Read digital output state |
| 03 | Read holding registers | Read device parameters |
| 05 | Write single coil | Write single digital output |
| 06 | Write single register | Write device parameters |
| 0F | Write multiple coils | Multiple digital outputs |
| 10 | Write multiple registers | Multiple device parameters |
Register map
| Address (HEX) | Content | Description | Type | Modbus FC |
|---|---|---|---|---|
| 0x0000~0x000F | CH1–CH16 digital outputs | 0xFF00：output ON; 0x0000: output OFF; | R/W | 0x01,0x05,0x0F |
| 0x00FF | All digital outputs | 0xFF00：All outputs ON; 0x0000: all OFF; | W | 0x05 |
| 0x1000~0x100F | CH1–CH16 digital output toggle | 0xFF00：toggle; 0x0000: no change; | W | 0x05,0x0F |
| 0x10FF | All digital outputs toggle | 0xFF00：toggle all; 0x0000: no change; | W | 0x05 |
| 0xA000~0xA00F | CH1–CH16 power-on digital output | 0xFF00：output ON; 0x0000: output OFF; power-on output state. | R/W/S | 0x01,0x05,0x0F |
| 4x2000~4x200F | CH1–CH16 digital output mode | Two modes: 0x0000 command, 0x0001 cycle | R/W | 0x03,0x06,0x10 |
| 4x3000~4x300F | CH1–CH16 digital output pulse ON | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W | 0x06,0x10 |
| 4x4000~4x400F | CH1–CH16 digital output pulse OFF | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W | 0x06,0x10 |
| 4x5000~4x500F | CH1–CH16 digital output delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W/S | 0x03,0x06,0x10 |
| 4x8000 | SUK | Model number | R/S | 0x03 |
| 4x8001 | Firmware version | Decimal value with implied decimal → version (e.g. 0x0064 = 100 → V1.00) | R/W/S | 0x03,0x06 |
| 4x8002 | Slave address | Stores Modbus address; default 0x0001 | R/W/S | 0x03,0x06 |
| 4x8003 | UART parameters | Upper byte: stop/parity; lower byte: baud rate | R/W/S | 0x03,0x06 |
| 4x8004 | Watchdog | If no valid Modbus within timeout, outputs off / reset | R/W/S | 0x03,0x06 |
| 4x9000~4x900F | User string area | String format | R/W/S | 0x03,0x06,0x10 |
Note
Registers marked S retain values across power cycles.
Modbus RTU command reference
Control a single digital output
Request: 01 05 00 00 FF 00 8C 3A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Output control |
| 00 00 | Address | Target output register address |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| 8C 3A | CRC16 | CRC16 over preceding bytes |
Response: 01 05 00 00 FF 00 8C 3A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Output control |
| 00 00 | Address | Target output register address |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| 8C 3A | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01):
1 output ON : 01 05 00 00 FF 00 8C 3A
1 output OFF : 01 05 00 00 00 00 CD CA
2 output ON : 01 05 00 01 FF 00 DD FA
2 output OFF : 01 05 00 01 00 00 9C 0A
3 output ON : 01 05 00 02 FF 00 2D FA
3 output OFF : 01 05 00 02 00 00 6C 0A
4 output ON : 01 05 00 03 FF 00 7C 3A
4 output OFF : 01 05 00 03 00 00 3D CA
1 output toggle : 01 05 10 00 FF 00 88 FA
2 output toggle : 01 05 10 01 FF 00 D9 3A
3 output toggle : 01 05 10 02 FF 00 29 3A
4 output toggle : 01 05 10 03 FF 00 78 FA
Control all digital outputs
Request: 01 05 00 FF FF 00 BC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Output control |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| BC 0A | CRC16 | CRC16 over preceding bytes |
Response: 01 05 00 FF FF 00 BC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Output control |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| BC 0A | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01):
All outputs ON : 01 05 00 FF FF 00 BC 0A
All outputs OFF : 01 05 00 FF 00 00 FD FA
All digital outputs toggle : 01 05 10 FF FF 00 B8 CA
Read digital output states
Request: 01 01 00 00 00 10 3D C6
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 01 | FC 0x01 | Read coils (FC 01) |
| 00 00 | Start address | First coil register address |
| 00 10 | Coil count | Number of coils; must not exceed max address |
| 3D C6 | CRC16 | CRC16 over preceding bytes |
Response: 01 01 02 00 00 B9 FC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 01 | FC 0x01 | Read coils (FC 01) |
| 02 | Byte count | Total data bytes returned. |
| 00 | Returned states | Packed coil bits: Bit0 = first coil, Bit1 = next, …; unused high bits are zero. |
| B9 FC | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX: 01 01 00 00 00 10 3D C6 //Read first 16 outputs
RX: 01 01 02 00 00 B9 FC // First 16 outputs all OFF
TX: 01 01 00 01 00 03 2D CB // Query outputs 2–4
RX: 01 01 01 05 91 8B //CH2、CH4 ON; CH3 OFF
TX: 01 01 00 03 00 05 0C 09 // Query outputs 4–8
RX: 01 01 01 0F 11 8C //CH4–7 ON; CH8 OFF
Write multiple digital outputs
Request: 01 0F 00 00 00 10 02 FF FF E3 90
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 0F | FC 0x0F | Write multiple coils (FC 0x0F) |
| 00 00 | Start address | First coil register address |
| 00 10 | Coil count | Coil count; must not exceed maximum |
| 02 | Byte count | Data byte count |
| FF FF | Coil data | Bit0: first coil, Bit1: next, …; unused high bits zero |
| E3 90 | CRC16 | CRC16 over preceding bytes |
Response: 01 0F 00 00 00 10 54 07
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 0F | FC 0x0F | Write multiple coils (FC 0x0F) |
| 00 00 | Start address | First coil register address |
| 00 10 | Coil count | Coil count; must not exceed maximum |
| 54 07 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
All outputs ON : 01 0F 00 00 00 10 02 FF FF E3 90
All outputs OFF : 01 0F 00 00 00 10 02 00 00 E2 20
CH1–2 ON; CH3–16 OFF : 01 0F 00 00 00 10 02 03 00 E2 D0
Single digital output pulse ON/OFF
Request: 01 06 30 00 00 07 C7 08
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 30 00 | Pulse addr | Pulse register address for target output |
| 00 07 | Interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| C7 08 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 30 00 00 07 C7 08
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 30 00 | Pulse addr | Pulse register address for target output |
| 00 07 | Interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| C7 08 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
CH1 pulse ON : 01 06 30 00 00 07 C7 08 //700MS = 7*100MS = 700MS
CH2 pulse ON : 01 06 30 01 00 08 D6 CC //800MS
CH1 pulse OFF : 01 06 40 00 00 05 5C 09 //500MS
CH2 pulse OFF : 01 06 40 01 00 06 4D C8 //600MS
Multiple digital output pulse ON/OFF
Request: 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 30 00 | Pulse addr | First output pulse register address |
| 00 04 | Coil count | Coil count; must not exceed maximum |
| 08 | Byte count | Following data byte count |
| 00 0A …… 00 0A | Timeout / interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| 65 8E | CRC16 | CRC16 over preceding bytes |
Response: 01 10 30 00 00 04 CE CA
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 30 00 | Pulse addr | First output pulse register address |
| 00 04 | Coil count | Coil count; must not exceed maximum |
| CE CA | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
CH1–4 pulse ON 1 s : 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E //1S = 10*100MS = 1000MS
2/CH3 pulse ON 800 ms : 01 10 30 01 00 02 04 00 08 00 08 E6 66 //800MS
CH5–8 pulse OFF 500 ms : 01 10 40 04 00 04 08 00 05 00 05 00 05 00 05 F0 77 //500MS
1/CH3 pulse OFF 700 ms : 01 10 40 00 00 03 06 00 07 00 07 00 07 F6 82 //700MS
Read digital output control modes
Request: 01 03 20 00 00 10 4F C6
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 20 00 | Mode block start address | First mode register address |
| 00 10 | Coil count | Number of mode registers |
| 4F C6 | CRC16 | CRC16 over preceding bytes |
Response: 01 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 59
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 20 | Byte count | Total data bytes returned. |
| 00 00 …… 00 00 | Output mode | Supported digital output control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; |
| E4 59 | CRC16 | CRC16 over preceding bytes |
Note
In cycle mode, adjust timing via the delay registers.
Examples (slave 0x01)
Read CH1–16 modes: 01 03 20 00 00 10 4F C6
Read CH1 mode: 01 03 20 00 00 01 8F CA
Read CH2 mode: 01 03 20 01 00 01 DE 0A
Read CH3–5 modes: 01 03 20 02 00 03 AF CB
Set single digital output control mode
Request: 01 06 20 00 00 01 43 CA
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 20 00 | Mode register address | Target mode register address |
| 00 01 | Mode | Supported digital output control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; |
| 43 CA | CRC16 | CRC16 over preceding bytes |
Note
In cycle mode, adjust timing via the delay registers.
Response: 01 06 20 00 00 01 43 CA
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 20 00 | Mode register address | Target mode register address |
| 00 01 | Mode | Output control mode value |
| 43 CA | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1 cycle mode: 01 06 20 00 00 01 43 CA
Set CH2 command mode: 01 06 20 01 00 00 D3 CA
Set multiple digital output control modes
Request: 01 10 20 00 00 10 20 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 07 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 20 00 | Mode block start address | First mode register address |
| 00 10 | Coil count | Coil count; must not exceed maximum |
| 20 | Byte count | Following data byte count |
| 00 01 …… 00 01 | Mode | Supported digital output control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; |
| 07 09 | CRC16 | CRC16 over preceding bytes |
Note
In cycle mode, adjust timing via the delay registers.
Response: 01 10 20 00 00 10 CA 05
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 20 00 | Mode block start address | First mode register address |
| 00 10 | Coil count | Coil count; must not exceed maximum |
| CA 05 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1–16 cycle mode: 01 10 20 00 00 10 20 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 07 09
Set CH3–5 command mode: 01 10 20 02 00 03 06 00 00 00 00 00 00 EC 8A
Set single digital output delay time
Request: 01 06 50 00 00 0A 18 CD
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 50 00 | Mode delay address | Delay register address |
| 00 0A | Delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Cycle-mode switching interval; max 0x7FFF. |
| 18 CD | CRC16 | CRC16 over preceding bytes |
Note
Delay registers apply only in cycle mode.
Response: 01 06 50 00 00 0A 18 CD
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 50 00 | Mode delay address | Delay register address |
| 00 0A | Delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Cycle-mode switching interval; max 0x7FFF. |
| 18 CD | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1 delay 500ms: 01 06 50 00 00 05 58 C9
Set CH2 delay 1s: 01 06 50 01 00 0A 49 0D
Read firmware version
Request: 01 03 80 01 00 01 FC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 80 01 | Firmware register | Fixed 4x8001 |
| 00 01 | Word count | Fixed 0x0001 |
| FC 0A | CRC16 | CRC16 over preceding bytes |
Response: 01 03 02 00 64 B9 AF
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 64 | Version | Decimal ÷100 → version string (0x0064 = 100 → V1.00) |
| B9 AF | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX:01 03 80 01 00 01 FC 0A
RX:01 03 02 01 2C B8 09 //0x012C = 300 =V3.00
Read slave address
Request: FE 03 80 02 00 01 18 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | Word count | Fixed 0x0001 |
| 18 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 03 02 00 01 6D 90
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 01 | Slave addr | Current 0x0001–0x00F7 |
| 6D 90 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast read, connect only one device to avoid bus collisions.
Examples (slave 0x01)
TX : FE 03 80 02 00 01 18 05
RX : FE 03 02 00 02 2D 91 //address：0x02
Set slave address
Request: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast write, connect only one device or all devices will receive the same address.
Examples (slave 0x01)
Set address 0x01 ：FE 06 80 02 00 01 D4 05
Set address 0x02 ：FE 06 80 02 00 02 94 04
Set address 0x03 ：FE 06 80 02 00 03 55 C4
Set UART parameters
Request: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | Bits 0–7: baud rate 0 : 4800 1 : 9600 2 : 19200 3 : 38400 4 : 57600 5 : 115200 6 : 128000 7 : 256000 Bits 8–12: parity 0 : None, 1: Even parity, 2: Odd parity Bits 13–16: stop bits 0 : 1 stop bit, 1: 1.5 stop bits, 2: 2 stop bits |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | UART value |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
9600 baud, none, 1 stop ：01 06 80 03 00 01 91 CA
9600 baud, even, 2 stop ：01 06 80 03 00 D1 90 56
115200 baud, none, 1 stop ：01 06 80 03 00 05 90 09
Set watchdog
Request: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | 0 disables watchdog. Non-zero enables: each valid Modbus frame feeds the dog; if the interval expires without a valid frame, firmware resets and outputs return to power-on defaults. Timeout = value × 100 ms (e.g. 0x000A → 1 s). |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | Watchdog timeout value |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Watchdog 10 s ：01 06 80 04 00 64 E0 20
Disable watchdog ：01 06 80 04 00 00 E1 CB
Exception codes
On protocol or device errors, the slave returns an exception response:
Response: 01 85 03 02 91
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 85 | Exception FC | Exception FC = request FC + 0x80 |
| 03 | Ex. code | Exception code |
| 02 91 | CRC16 | CRC16 over preceding bytes |
Exception codes (single byte) indicate error type. Common Modbus exceptions:
| Code | Name | Description |
|---|---|---|
| 0x01 | Illegal function | Requested function not supported. |
| 0x02 | Illegal data address | Requested data address invalid. |
| 0x03 | Illegal data value | Data value or operation not allowed. |
| 0x04 | Server device failure | Server device failure. |
| 0x05 | Acknowledge | Request accepted and being processed. |
| 0x06 | Device busy | Device busy; cannot execute now. |