DAM-8DI-8DO communication protocol
This product is an 8-channel digital input + 8-channel digital output module supporting standard Modbus RTU commands. For detailed command construction and parsing, use the register tables in this document together with the Modbus specification.
Modbus register reference
Device (slave) address
Default slave address is 0x01; configurable range 0x01–0xF7. Supported ranges:
| Address range | Status | Description |
|---|---|---|
| 0x00 | ❌ Disabled | Non-response broadcast: master only; slaves must not use this address and do not reply. |
| 0x01~0xF7 | ✅ Available | Standard slave address; assignable to any device. |
| 0xFE | ❌ Disabled | Response broadcast: master only; slaves must not use this address. |
Note
When using broadcast address 0xFE, connect only one device on the bus; multiple devices responding will collide.
Function codes
This module is coil-oriented; the following function codes are supported.
| FC | Function | Notes |
|---|---|---|
| 01 | Read coils | Read digital output state |
| 02 | Read discrete inputs | Read digital input state |
| 03 | Read holding registers | Read device parameters |
| 05 | Write single coil | Write single digital output |
| 06 | Write single register | Write device parameters |
| 0F | Write multiple coils | Write multiple digital outputs |
| 10 | Write multiple registers | Write multiple device parameters |
Register map
| Address (HEX) | Content | Description | Type | Modbus FC |
|---|---|---|---|---|
| 0x0000~0x0007 | CH1–CH8 digital outputs | 0xFF00：output ON; 0x0000: output OFF; | R/W | 0x01,0x05,0x0F |
| 0x00FF | All digital outputs | 0xFF00：All outputs ON; 0x0000: all OFF; | W | 0x05 |
| 0x1000~0x1007 | CH1–CH8 digital output toggle | 0xFF00：toggle; 0x0000: no change; | W | 0x05,0x0F |
| 0x10FF | All digital outputs toggle | 0xFF00：toggle all outputs; 0x0000: no change; | W | 0x05 |
| 0xA000~0xA007 | CH1–CH8 power-on digital output | 0xFF00：output ON; 0x0000: output OFF;power-on output state. | R/W/S | 0x01,0x05,0x0F |
| 1x0000~1x0007 | CH1–CH8 digital inputs | State of digital inputs CH1–CH8 | R | 0x02 |
| 4x2000~4x2007 | CH1–CH8 digital output mode | Seven control modes 0x0000–0x0006 | R/W | 0x03,0x06,0x10 |
| 4x3000~4x3007 | CH1–CH8 digital output pulse ON | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W | 0x06,0x10 |
| 4x4000~4x4007 | CH1–CH8 digital output pulse OFF | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W | 0x06,0x10 |
| 4x5000~4x5007 | CH1–CH8 digital output delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W/S | 0x03,0x06,0x10 |
| 4x8000 | SUK | Model number | R/S | 0x03 |
| 4x8001 | Firmware version | Decimal value with implied decimal → version (e.g. 0x0064 = 100 → V1.00) | R/W/S | 0x03,0x06 |
| 4x8002 | Slave address | Stores Modbus address; default 0x0001 | R/W/S | 0x03,0x06 |
| 4x8003 | UART parameters | Upper byte: stop/parity; lower byte: baud rate | R/W/S | 0x03,0x06 |
| 4x8004 | Watchdog | If no valid Modbus within timeout, outputs off / reset | R/W/S | 0x03,0x06 |
| 4x8005 | Auto-report DI | Digital input change auto-upload | R/W/S | 0x03,0x06 |
| 4x9000~4x900F | User string area | String format | R/W/S | 0x03,0x06,0x10 |
Note
Registers marked S retain values across power cycles.
Modbus RTU command reference
Control a single digital output
Request: 01 05 00 00 FF 00 8C 3A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Digital output control |
| 00 00 | Address | Target output register address |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| 8C 3A | CRC16 | CRC16 over preceding bytes |
Response: 01 05 00 00 FF 00 8C 3A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Digital output control |
| 00 00 | Address | Target output register address |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| 8C 3A | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01):
CH1 output ON : 01 05 00 00 FF 00 8C 3A
CH1 output OFF : 01 05 00 00 00 00 CD CA
CH2 output ON : 01 05 00 01 FF 00 DD FA
CH2 output OFF : 01 05 00 01 00 00 9C 0A
CH3 output ON : 01 05 00 02 FF 00 2D FA
CH3 output OFF : 01 05 00 02 00 00 6C 0A
CH4 output ON : 01 05 00 03 FF 00 7C 3A
CH4 output OFF : 01 05 00 03 00 00 3D CA
CH1 output toggle : 01 05 10 00 FF 00 88 FA
CH2 output toggle : 01 05 10 01 FF 00 D9 3A
CH3 output toggle : 01 05 10 02 FF 00 29 3A
CH4 output toggle : 01 05 10 03 FF 00 78 FA
Control all digital outputs
Request: 01 05 00 FF FF 00 BC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Digital output control |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| BC 0A | CRC16 | CRC16 over preceding bytes |
Response: 01 05 00 FF FF 00 BC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Digital output control |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00：output ON; 0x0000: output OFF; |
| BC 0A | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01):
All outputs ON : 01 05 00 FF FF 00 BC 0A
All outputs OFF : 01 05 00 FF 00 00 FD FA
All digital outputs toggle : 01 05 10 FF FF 00 B8 CA
Read digital output states
Request: 01 01 00 00 00 08 3D CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 01 | FC 0x01 | Read coils (FC 01) |
| 00 00 | Start address | First output register address |
| 00 08 | Quantity | Number of outputs; must not exceed max address |
| 3D CC | CRC16 | CRC16 over preceding bytes |
Response: 01 01 01 00 51 88
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 01 | FC 0x01 | Read coils (FC 01) |
| 01 | Byte count | Total data bytes returned. |
| 00 | Returned states | Packed output bits: Bit0 = first output, Bit1 = next, …; unused high bits are zero. |
| 51 88 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX: 01 01 00 00 00 08 3D CC //Read first 8 outputs
RX: 01 01 01 00 51 88 // First 8 outputs all OFF
TX: 01 01 00 01 00 03 2D CB // Query outputs 2–4
RX: 01 01 01 05 91 8B // CH2, CH4 ON; CH3 OFF
TX: 01 01 00 03 00 05 0C 09 // Query outputs 4–8
RX: 01 01 01 0F 11 8C // CH4–7 ON; CH8 OFF
Write multiple digital outputs
Request: 01 0F 00 00 00 08 01 FF BE D5
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 0F | FC 0x0F | Write multiple coils (FC 0x0F) |
| 00 00 | Start address | First output register address |
| 00 08 | Quantity | Output count; must not exceed maximum |
| 01 | Byte count | Data byte count |
| FF | Output data | Bit0: first output, Bit1: next, …; unused high bits zero |
| BE D5 | CRC16 | CRC16 over preceding bytes |
Response: 01 0F 00 00 00 08 54 0D
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 0F | FC 0x0F | Write multiple coils (FC 0x0F) |
| 00 00 | Start address | First output register address |
| 00 08 | Quantity | Output count; must not exceed maximum |
| 54 0D | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
All outputs ON : 01 0F 00 00 00 08 01 FF BE D5
All outputs OFF : 01 0F 00 00 00 08 01 00 FE 95
CH1–2 ON; CH3–8 OFF : 01 0F 00 00 00 08 01 03 BE 94
Single digital output pulse ON/OFF
Request: 01 06 30 00 00 07 C7 08
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 30 00 | Pulse addr | Pulse register address for target output |
| 00 07 | Interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| C7 08 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 30 00 00 07 C7 08
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 30 00 | Pulse addr | Pulse register address for target output |
| 00 07 | Interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| C7 08 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
CH1 pulse ON : 01 06 30 00 00 07 C7 08 //700MS = 7*100MS = 700MS
CH2 pulse ON : 01 06 30 01 00 08 D6 CC //800MS
CH1 pulse OFF : 01 06 40 00 00 05 5C 09 //500MS
CH2 pulse OFF : 01 06 40 01 00 06 4D C8 //600MS
Multiple digital output pulse ON/OFF
Request: 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 30 00 | Pulse addr | First output pulse register address |
| 00 04 | Quantity | Output count; must not exceed maximum |
| 08 | Byte count | Following data byte count |
| 00 0A …… 00 0A | Timeout / interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| 65 8E | CRC16 | CRC16 over preceding bytes |
Response: 01 10 30 00 00 04 CE CA
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 30 00 | Pulse addr | First output pulse register address |
| 00 04 | Quantity | Output count; must not exceed maximum |
| CE CA | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
CH1–4 pulse ON 1 s : 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E //1S = 10*100MS = 1000MS
2/CH3 pulse ON 800 ms : 01 10 30 01 00 02 04 00 08 00 08 E6 66 //800MS
CH5–8 pulse OFF 500 ms : 01 10 40 04 00 04 08 00 05 00 05 00 05 00 05 F0 77 //500MS
1/CH3 pulse OFF 700 ms : 01 10 40 00 00 03 06 00 07 00 07 00 07 F6 82 //700MS
Read digital input states
Request: 01 02 00 00 00 08 79 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 02 | FC 0x02 | Read discrete inputs (FC 02) |
| 00 00 | Start address | First discrete input address |
| 00 08 | Input count | Input count; must not exceed max channels |
| 79 CC | CRC16 | CRC16 over preceding bytes |
Response: 01 02 01 00 A1 88
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 02 | FC 0x02 | Read discrete inputs (FC 02) |
| 01 | Byte count | Total data bytes returned. |
| 00 | Returned states | Packed input bits: Bit0 = first input, Bit1 = next, …; unused high bits are zero. |
| A1 88 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX: 01 02 00 00 00 08 79 CC
RX: 01 02 01 00 A1 88 //No inputs active
TX: 01 02 00 00 00 08 79 CC
RX: 01 02 01 01 60 48 //CH1 active, others idle
TX: 01 02 00 00 00 08 79 CC
RX: 01 02 01 41 61 B8 //CH1 and CH7 active
Read digital output control modes
Request: 01 03 20 00 00 08 4F CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 20 00 | Mode block start address | First mode register address |
| 00 08 | Quantity | Number of mode registers |
| 4F CC | CRC16 | CRC16 over preceding bytes |
Response: 01 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 59
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 10 | Byte count | Total data bytes returned. |
| 00 00 …… 00 00 | Output mode | Supported digital output control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Output tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles output; 0x0004: Toggle on edge — Each input edge toggles output; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay; |
| E4 59 | CRC16 | CRC16 over preceding bytes |
Note
In cycle, ON-delay, and OFF-delay modes, adjust timing via the delay registers.
Examples (slave 0x01)
Read CH1–8 modes: 01 03 20 00 00 08 4F CC
Read CH1 mode: 01 03 20 00 00 01 8F CA
Read CH2 mode: 01 03 20 01 00 01 DE 0A
Read CH3–5 modes: 01 03 20 02 00 03 AF CB
Set single digital output control mode
Request: 01 06 20 00 00 02 03 CB
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 20 00 | Mode register address | Target mode register address |
| 00 02 | Mode | Supported digital output control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Output tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles output; 0x0004: Toggle on edge — Each input edge toggles output; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay; |
| 03 CB | CRC16 | CRC16 over preceding bytes |
Note
Cycle, ON-delay, and OFF-delay timing is adjusted via delay registers.
Response: 01 06 20 00 00 02 03 CB
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 20 00 | Mode register address | Target mode register address |
| 00 02 | Mode | Digital output control mode value |
| 03 CB | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1 follow mode: 01 06 20 00 00 02 03 CB
Set CH2 toggle mode: 01 06 20 01 00 03 93 CB
Set multiple digital output control modes
Request: 01 10 20 00 00 08 10 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 D3 35
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 20 00 | Mode block start address | First mode register address |
| 00 08 | Quantity | Quantity; must not exceed maximum |
| 10 | Byte count | Following data byte count |
| 00 02 …… 00 02 | Mode | Supported digital output control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Output tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles output; 0x0004: Toggle on edge — Each input edge toggles output; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay; |
| D3 35 | CRC16 | CRC16 over preceding bytes |
Note
Cycle, ON-delay, and OFF-delay timing is adjusted via delay registers.
Response: 01 10 20 00 00 08 CA 0F
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 20 00 | Mode block start address | First mode register address |
| 00 08 | Quantity | Quantity; must not exceed maximum |
| CA 0F | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1–8 follow mode: 01 10 20 00 00 08 10 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 D3 35
Set CH3–5 toggle mode: 01 10 20 02 00 03 06 00 03 00 03 00 03 18 8B
Set single digital output delay time
Request: 01 06 50 00 00 0A 18 CD
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 50 00 | Mode delay address | Delay register address |
| 00 0A | Delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Cycle-mode switching interval; max 0x7FFF. |
| 18 CD | CRC16 | CRC16 over preceding bytes |
Note
Delay registers apply only in cycle, ON-delay, and OFF-delay modes.
Response: 01 06 50 00 00 0A 18 CD
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 50 00 | Mode delay address | Delay register address |
| 00 0A | Delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Cycle-mode switching interval; max 0x7FFF. |
| 18 CD | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1 delay 500ms: 01 06 50 00 00 05 58 C9
Set CH2 delay 1s: 01 06 50 01 00 0A 49 0D
Read firmware version
Request: 01 03 80 01 00 01 FC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 80 01 | Firmware register | Fixed 4x8001 |
| 00 01 | Word count | Fixed 0x0001 |
| FC 0A | CRC16 | CRC16 over preceding bytes |
Response: 01 03 02 00 64 B9 AF
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 64 | Version | Decimal ÷100 → version string (0x0064 = 100 → V1.00) |
| B9 AF | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX:01 03 80 01 00 01 FC 0A
RX:01 03 02 01 2C B8 09 //0x012C = 300 =V3.00
Read slave address
Request: FE 03 80 02 00 01 18 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | Word count | Fixed 0x0001 |
| 18 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 03 02 00 01 6D 90
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 01 | Slave addr | Current 0x0001–0x00F7 |
| 6D 90 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast read, connect only one device to avoid bus collisions.
Examples (slave 0x01)
TX : FE 03 80 02 00 01 18 05
RX : FE 03 02 00 02 2D 91 //address：0x02
Set slave address
Request: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast write, connect only one device or all devices will receive the same address.
Examples (slave 0x01)
Set address 0x01 ：FE 06 80 02 00 01 D4 05
Set address 0x02 ：FE 06 80 02 00 02 94 04
Set address 0x03 ：FE 06 80 02 00 03 55 C4
Set UART parameters
Request: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | Bits 0–7: baud rate 0 : 4800 1 : 9600 2 : 19200 3 : 38400 4 : 57600 5 : 115200 6 : 128000 7 : 256000 Bits 8–12: parity 0 : None, 1: Even parity, 2: Odd parity Bits 13–16: stop bits 0 : 1 stop bit, 1: 1.5 stop bits, 2: 2 stop bits |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | UART value |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
9600 baud, none, 1 stop ：01 06 80 03 00 01 91 CA
9600 baud, even, 2 stop ：01 06 20 00 00 91 43 CA
115200 baud, none, 1 stop ：01 06 80 03 00 05 90 09
Set watchdog
Request: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | 0 disables watchdog. Non-zero enables: each valid Modbus frame feeds the dog; if the interval expires without a valid frame, firmware resets and outputs return to power-on defaults. Timeout = value × 100 ms (e.g. 0x000A → 1 s). |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | Watchdog timeout value |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Watchdog 10 s ：01 06 80 04 00 64 E0 20
Disable watchdog ：01 06 80 04 00 00 E1 CB
Set DI auto-upload
Request: 01 06 80 05 FF 00 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 05 | Auto-upload register | Fixed 4x8005 |
| FF 00 | On/off | Digital inputs can auto-report on change. 0 disables; any non-zero value enables reporting when DI state changes. |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 05 FF 00 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 05 | Auto-upload register | Fixed 4x8005 |
| FF 00 | On/off | Digital inputs can auto-report on change. 0 disables; any non-zero value enables reporting when DI state changes. |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Enable auto-upload ：01 06 80 05 FF 00 61 CC
Disable auto-upload ：01 06 80 05 00 00 B0 0B
Exception codes
On protocol or device errors, the slave returns an exception response:
Response: 01 85 03 02 91
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 85 | Exception FC | Exception FC = request FC + 0x80 |
| 03 | Ex. code | Exception code |
| 02 91 | CRC16 | CRC16 over preceding bytes |
Exception codes (single byte) indicate error type. Common Modbus exceptions:
| Code | Name | Description |
|---|---|---|
| 0x01 | Illegal function | Requested function not supported. |
| 0x02 | Illegal data address | Requested data address invalid. |
| 0x03 | Illegal data value | Data value or operation not allowed. |
| 0x04 | Server device failure | Server device failure. |
| 0x05 | Acknowledge | Request accepted and being processed. |
| 0x06 | Device busy | Device busy; cannot execute now. |