DAM-4RO-4DI communication protocol
This product is a 4-channel relay output + 4-channel digital input module supporting standard Modbus RTU commands. For detailed command construction and parsing, use the register tables in this document together with the Modbus specification.
Modbus register reference
Device (slave) address
Default slave address is 0x01; configurable range 0x01–0xF7. Supported ranges:
| Address range | Status | Description |
|---|---|---|
| 0x00 | ❌ Disabled | Non-response broadcast: master only; slaves must not use this address and do not reply. |
| 0x01~0xF7 | ✅ Available | Standard slave address; assignable to any device. |
| 0xFE | ❌ Disabled | Response broadcast: master only; slaves must not use this address. |
Note
When using broadcast address 0xFE, connect only one device on the bus; multiple devices responding will collide.
Function codes
This product is primarily coil-oriented; the following function codes are supported.
| FC | Function | Notes |
|---|---|---|
| 01 | Read coils | Read relay state |
| 02 | Read discrete inputs | Read digital input state |
| 03 | Read holding registers | Read device parameters |
| 05 | Write single coil | Single relay write |
| 06 | Write single register | Write device parameters |
| 0F | Write multiple coils | Multiple relays |
| 10 | Write multiple registers | Multiple device parameters |
Register map
| Address (HEX) | Content | Description | Type | Modbus FC |
|---|---|---|---|---|
| 0x0000~0x0003 | CH1–CH4 relay outputs | 0xFF00：relay ON; 0x0000: relay OFF; | R/W | 0x01,0x05,0x0F |
| 0x00FF | All relay outputs | 0xFF00：All relays ON; 0x0000: all OFF; | W | 0x05 |
| 0x1000~0x1003 | CH1–CH4 relay toggle | 0xFF00：toggle; 0x0000: no change; | W | 0x05,0x0F |
| 0x10FF | All relays toggle | 0xFF00：toggle all; 0x0000: no change; | W | 0x05 |
| 0xA000~0xA003 | CH1–CH4 power-on relay output | 0xFF00：relay ON; 0x0000: relay OFF;power-on relay output. | R/W/S | 0x01,0x05,0x0F |
| 1x0000~1x0003 | CH1–CH4 digital inputs | State of digital inputs CH1–CH4 | R | 0x02 |
| 4x2000~4x2003 | CH1–CH4 relay control mode | Seven control modes 0x0000–0x0006 | R/W | 0x03,0x06,0x10 |
| 4x3000~4x3003 | CH1–CH4 pulse ON | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W | 0x06,0x10 |
| 4x4000~4x4003 | CH1–CH4 pulse OFF | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W | 0x06,0x10 |
| 4x5000~4x5003 | CH1–CH4 relay delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms) | W/S | 0x03,0x06,0x10 |
| 4x8000 | SUK | Model number | R/S | 0x03 |
| 4x8001 | Firmware version | Decimal value with implied decimal → version (e.g. 0x0064 = 100 → V1.00) | R/W/S | 0x03,0x06 |
| 4x8002 | Slave address | Stores Modbus address; default 0x0001 | R/W/S | 0x03,0x06 |
| 4x8003 | UART parameters | Upper byte: stop/parity; lower byte: baud rate | R/W/S | 0x03,0x06 |
| 4x8004 | Watchdog | If no valid Modbus within timeout, outputs off / reset | R/W/S | 0x03,0x06 |
| 4x8005 | Auto-report DI | Digital input change auto-upload | R/W/S | 0x03,0x06 |
| 4x9000~4x900F | User string area | String format | R/W/S | 0x03,0x06,0x10 |
Note
Registers marked S retain values across power cycles.
Modbus RTU command reference
Control a single relay
Request: 01 05 00 00 FF 00 8C 3A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Relay control |
| 00 00 | Address | Target relay register address |
| FF 00 | Command | 0xFF00：relay ON; 0x0000: relay OFF; |
| 8C 3A | CRC16 | CRC16 over preceding bytes |
Response: 01 05 00 00 FF 00 8C 3A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Relay control |
| 00 00 | Address | Target relay register address |
| FF 00 | Command | 0xFF00：relay ON; 0x0000: relay OFF; |
| 8C 3A | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01):
1 relay ON : 01 05 00 00 FF 00 8C 3A
1 relay OFF : 01 05 00 00 00 00 CD CA
2 relay ON : 01 05 00 01 FF 00 DD FA
2 relay OFF : 01 05 00 01 00 00 9C 0A
3 relay ON : 01 05 00 02 FF 00 2D FA
3 relay OFF : 01 05 00 02 00 00 6C 0A
4 relay ON : 01 05 00 03 FF 00 7C 3A
4 relay OFF : 01 05 00 03 00 00 3D CA
1 relay toggle : 01 05 10 00 FF 00 88 FA
2 relay toggle : 01 05 10 01 FF 00 D9 3A
3 relay toggle : 01 05 10 02 FF 00 29 3A
4 relay toggle : 01 05 10 03 FF 00 78 FA
Control all relays
Request: 01 05 00 FF FF 00 BC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Relay control |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00：relay ON; 0x0000: relay OFF; |
| BC 0A | CRC16 | CRC16 over preceding bytes |
Response: 01 05 00 FF FF 00 BC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 05 | FC 0x05 | Relay control |
| 00 FF | Address | Fixed 0x00FF |
| FF 00 | Command | 0xFF00：relay ON; 0x0000: relay OFF; |
| BC 0A | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01):
All relays ON : 01 05 00 FF FF 00 BC 0A
All relays OFF : 01 05 00 FF 00 00 FD FA
All relays toggle : 01 05 10 FF FF 00 B8 CA
Read relay states
Request: 01 01 00 00 00 04 3D C9
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 01 | FC 0x01 | Read coils (FC 01) |
| 00 00 | Start address | First coil register address |
| 00 04 | Coil count | Number of coils; must not exceed max address |
| 3D C9 | CRC16 | CRC16 over preceding bytes |
Response: 01 01 01 00 51 88
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 01 | FC 0x01 | Read coils (FC 01) |
| 01 | Byte count | Total data bytes returned. |
| 00 | Returned states | Packed coil bits: Bit0 = first coil, Bit1 = next, …; unused high bits are zero. |
| 51 88 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX: 01 01 00 00 00 04 3D C9 //Read 4 relays
RX: 01 01 01 00 51 88 // All 4 relays OFF
TX: 01 01 00 01 00 03 2D CB // Query relays 2–4
RX: 01 01 01 05 91 8B // CH2 and CH4 ON, CH3 OFF
TX: 01 01 00 02 00 02 1C 0B // Query relays 3–4
RX: 01 01 01 03 11 89 // Relays 3–4 all ON
Write multiple relay states
Request: 01 0F 00 00 00 04 01 0F 7E 92
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 0F | FC 0x0F | Write multiple coils (FC 0x0F) |
| 00 00 | Start address | First coil register address |
| 00 04 | Coil count | Coil count; must not exceed maximum |
| 01 | Byte count | Data byte count |
| 0F | Coil data | Bit0: first coil, Bit1: next, …; unused high bits zero |
| 7E 92 | CRC16 | CRC16 over preceding bytes |
Response: 01 0F 00 00 00 04 54 08
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 0F | FC 0x0F | Write multiple coils (FC 0x0F) |
| 00 00 | Start address | First coil register address |
| 00 04 | Coil count | Coil count; must not exceed maximum |
| 54 08 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
All relays ON : 01 0F 00 00 00 04 01 0F 7E 92
All relays OFF : 01 0F 00 00 00 04 01 00 3E 96
CH1–2 ON; CH3–4 OFF : 01 0F 00 00 00 04 01 03 7E 97
Single-relay pulse ON/OFF
Request: 01 06 30 00 00 07 C7 08
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 30 00 | Pulse addr | Pulse register address for target relay |
| 00 07 | Interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| C7 08 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 30 00 00 07 C7 08
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 30 00 | Pulse addr | Pulse register address for target relay |
| 00 07 | Interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| C7 08 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
CH1 pulse ON : 01 06 30 00 00 07 C7 08 //700MS = 7*100MS = 700MS
CH2 pulse ON : 01 06 30 01 00 08 D6 CC //800MS
CH1 pulse OFF : 01 06 40 00 00 05 5C 09 //500MS
CH2 pulse OFF : 01 06 40 01 00 06 4D C8 //600MS
Multiple-relay pulse ON/OFF
Request: 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 30 00 | Pulse addr | First relay pulse register address |
| 00 04 | Coil count | Coil count; must not exceed maximum |
| 08 | Byte count | Following data byte count |
| 00 0A …… 00 0A | Timeout / interval | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF. |
| 65 8E | CRC16 | CRC16 over preceding bytes |
Response: 01 10 30 00 00 04 CE CA
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 30 00 | Pulse addr | First relay pulse register address |
| 00 04 | Coil count | Coil count; must not exceed maximum |
| CE CA | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
CH1–4 pulse ON 1 s : 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E //1S = 10*100MS = 1000MS
2/CH3 pulse ON 800 ms : 01 10 30 01 00 02 04 00 08 00 08 E6 66 //800MS
CH3–4 pulse OFF 500 ms : 01 10 40 02 00 02 04 00 05 00 05 93 B7 //500MS
1/CH3 pulse OFF 700 ms : 01 10 40 00 00 03 06 00 07 00 07 00 07 F6 82 //700MS
Read digital input states
Request: 01 02 00 00 00 04 79 C9
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 02 | FC 0x02 | Read discrete inputs (FC 02) |
| 00 00 | Start address | First discrete input address |
| 00 04 | Input count | Input count; must not exceed max channels |
| 79 C9 | CRC16 | CRC16 over preceding bytes |
Response: 01 02 01 00 A1 88
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 02 | FC 0x02 | Read discrete inputs (FC 02) |
| 01 | Byte count | Total data bytes returned. |
| 00 | Returned states | Packed input bits: Bit0 = first input, Bit1 = next, …; unused high bits are zero. |
| A1 88 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX: 01 02 00 00 00 04 79 C9
RX: 01 02 01 00 A1 88 //No inputs active
TX: 01 02 00 00 00 04 79 C9
RX: 01 02 01 01 60 48 //CH1 active, others idle
TX: 01 02 00 00 00 04 79 C9
RX: 01 02 01 09 61 8E //CH1 and CH4 active
Read relay control modes
Request: 01 03 20 00 00 04 4F C9
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 20 00 | Mode block start address | First mode register address |
| 00 04 | Register count | Number of mode registers |
| 4F C9 | CRC16 | CRC16 over preceding bytes |
Response: 01 03 08 00 00 00 00 00 00 00 00 00 00 2F 0E
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 08 | Byte count | Total data bytes returned. |
| 00 00 …… 00 00 | Relay mode | Supported relay control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Relay tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles relay; 0x0004: Toggle on edge — Each input edge toggles relay; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay; |
| 2F 0E | CRC16 | CRC16 over preceding bytes |
Note
In cycle, ON-delay, and OFF-delay modes, adjust timing via the delay registers.
Examples (slave 0x01)
Read CH1–4 modes: 01 03 20 00 00 04 4F C9
Read CH1 mode: 01 03 20 00 00 01 8F CA
Read CH2 mode: 01 03 20 01 00 01 DE 0A
Read CH3–4 modes: 01 03 20 02 00 02 6E 0B
Set single relay control mode
Request: 01 06 20 00 00 02 03 CB
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 20 00 | Mode register address | Target mode register address |
| 00 02 | Mode | Supported relay control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Relay tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles relay; 0x0004: Toggle on edge — Each input edge toggles relay; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay; |
| 03 CB | CRC16 | CRC16 over preceding bytes |
Note
Cycle, ON-delay, and OFF-delay timing is adjusted via delay registers.
Response: 01 06 20 00 00 02 03 CB
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 20 00 | Mode register address | Target mode register address |
| 00 02 | Mode | Relay control mode value |
| 03 CB | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1 follow mode: 01 06 20 00 00 02 03 CB
Set CH2 toggle mode: 01 06 20 01 00 03 93 CB
Set multiple relay control modes
Request: 01 10 20 00 00 04 08 00 02 00 02 00 02 00 02 B3 1B
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 20 00 | Mode block start address | First mode register address |
| 00 04 | Register count | Register count; must not exceed maximum |
| 08 | Byte count | Following data byte count |
| 00 02 …… 00 02 | Mode | Supported relay control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Relay tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles relay; 0x0004: Toggle on edge — Each input edge toggles relay; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay; |
| B3 1B | CRC16 | CRC16 over preceding bytes |
Note
Cycle, ON-delay, and OFF-delay timing is adjusted via delay registers.
Response: 01 10 20 00 00 04 CA 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 10 | FC 0x10 | Write multiple holding registers (FC 10) |
| 20 00 | Mode block start address | First mode register address |
| 00 04 | Register count | Register count; must not exceed maximum |
| CA 0A | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1–4 follow mode: 01 10 20 00 00 04 08 00 02 00 02 00 02 00 02 B3 1B
Set CH3–4 toggle mode: 01 10 20 02 00 02 04 00 03 00 03 5B B6
Set single relay delay time
Request: 01 06 50 00 00 0A 18 CD
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 50 00 | Mode delay address | Delay register address |
| 00 0A | Delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Cycle-mode switching interval; max 0x7FFF. |
| 18 CD | CRC16 | CRC16 over preceding bytes |
Note
Delay registers apply only in cycle, ON-delay, and OFF-delay modes.
Response: 01 06 50 00 00 0A 18 CD
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write holding register (FC 06) |
| 50 00 | Mode delay address | Delay register address |
| 00 0A | Delay | Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Cycle-mode switching interval; max 0x7FFF. |
| 18 CD | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Set CH1 delay 500ms: 01 06 50 00 00 05 58 C9
Set CH2 delay 1s: 01 06 50 01 00 0A 49 0D
Read firmware version
Request: 01 03 80 01 00 01 FC 0A
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 80 01 | Firmware register | Fixed 4x8001 |
| 00 01 | Word count | Fixed 0x0001 |
| FC 0A | CRC16 | CRC16 over preceding bytes |
Response: 01 03 02 00 64 B9 AF
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 03 | FC 0x03 | Read firmware version (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 64 | Version | Decimal ÷100 → version string (0x0064 = 100 → V1.00) |
| B9 AF | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
TX:01 03 80 01 00 01 FC 0A
RX:01 03 02 01 2C B8 09 //0x012C = 300 =V3.00
Read slave address
Request: FE 03 80 02 00 01 18 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | Word count | Fixed 0x0001 |
| 18 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 03 02 00 01 6D 90
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 03 | FC 0x03 | Read holding registers (FC 03) |
| 02 | Byte count | Returned byte count |
| 00 01 | Slave addr | Current 0x0001–0x00F7 |
| 6D 90 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast read, connect only one device to avoid bus collisions.
Examples (slave 0x01)
TX : FE 03 80 02 00 01 18 05
RX : FE 03 02 00 02 2D 91 //address：0x02
Set slave address
Request: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Response: FE 06 80 02 00 01 D4 05
| Field | Meaning | Notes |
|---|---|---|
| FE | Slave address | 0xFE: responding broadcast; applies to all slaves |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 02 | Address register | Fixed 4x8002 |
| 00 01 | New address | Slave address to set, range 0x0001–0x00F7 |
| D4 05 | CRC16 | CRC16 over preceding bytes |
Note
With 0xFE broadcast write, connect only one device or all devices will receive the same address.
Examples (slave 0x01)
Set address 0x01 ：FE 06 80 02 00 01 D4 05
Set address 0x02 ：FE 06 80 02 00 02 94 04
Set address 0x03 ：FE 06 80 02 00 03 55 C4
Set UART parameters
Request: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | Bits 0–7: baud rate 0 : 4800 1 : 9600 2 : 19200 3 : 38400 4 : 57600 5 : 115200 6 : 128000 7 : 256000 Bits 8–12: parity 0 : None, 1: Even parity, 2: Odd parity Bits 13–16: stop bits 0 : 1 stop bit, 1: 1.5 stop bits, 2: 2 stop bits |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 03 00 05 90 09
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 03 | UART register | Fixed 4x8003 |
| 00 05 | UART | UART value |
| 90 09 | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
9600 baud, none, 1 stop ：01 06 80 03 00 01 91 CA
9600 baud, even, 2 stop ：01 06 80 03 00 D1 90 56
115200 baud, none, 1 stop ：01 06 80 03 00 05 90 09
Set watchdog
Request: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | 0 disables watchdog. Non-zero enables: each valid Modbus frame feeds the dog; if the interval expires without a valid frame, firmware resets and relays return to power-on defaults. Timeout = value × 100 ms (e.g. 0x000A → 1 s). |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 04 00 0A 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 04 | Watchdog register | Fixed 4x8004 |
| 00 0A | Timeout / interval | Watchdog timeout value |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Watchdog 10 s ：01 06 80 04 00 64 E0 20
Disable watchdog ：01 06 80 04 00 00 E1 CB
Set DI auto-upload
Request: 01 06 80 05 FF 00 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 05 | Auto-upload register | Fixed 4x8005 |
| FF 00 | On/off | Digital inputs can auto-report on change. 0 disables; any non-zero value enables reporting when DI state changes. |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Response: 01 06 80 05 FF 00 61 CC
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 06 | FC 0x06 | Write single holding register (FC 06) |
| 80 05 | Auto-upload register | Fixed 4x8005 |
| FF 00 | On/off | Digital inputs can auto-report on change. 0 disables; any non-zero value enables reporting when DI state changes. |
| 61 CC | CRC16 | CRC16 over preceding bytes |
Examples (slave 0x01)
Enable auto-upload ：01 06 80 05 FF 00 61 CC
Disable auto-upload ：01 06 80 05 00 00 B0 0B
Exception codes
On protocol or device errors, the slave returns an exception response:
Response: 01 85 03 02 91
| Field | Meaning | Notes |
|---|---|---|
| 01 | Slave address | 0x00: broadcast; 0x01–0xF7: slave address |
| 85 | Exception FC | Exception FC = request FC + 0x80 |
| 03 | Ex. code | Exception code |
| 02 91 | CRC16 | CRC16 over preceding bytes |
Exception codes (single byte) indicate error type. Common Modbus exceptions:
| Code | Name | Description |
|---|---|---|
| 0x01 | Illegal function | Requested function not supported. |
| 0x02 | Illegal data address | Requested data address invalid. |
| 0x03 | Illegal data value | Data value or operation not allowed. |
| 0x04 | Server device failure | Server device failure. |
| 0x05 | Acknowledge | Request accepted and being processed. |
| 0x06 | Device busy | Device busy; cannot execute now. |