DAM-8RO-8DI-E development protocol

This product is an 8-channel relay output + 8-channel digital input module supporting standard Modbus RTU commands. For detailed command construction and parsing, use the register tables in this document together with the Modbus specification.

Modbus register reference

Device (slave) address

Default slave address is 0x01; configurable range 0x01–0xF7. Supported ranges:

Address range	Status	Description
0x00	❌ Disabled	Non-response broadcast: master only; slaves must not use this address and do not reply.
0x01~0xF7	✅ Available	Standard slave address; assignable to any device.
0xFE	❌ Disabled	Response broadcast: master only; slaves must not use this address.

Note

When using broadcast address 0xFE, connect only one device on the bus; multiple devices responding will collide.

Function codes

This product is primarily coil-oriented; the following function codes are supported.

FC	Function	Notes
01	Read coils	Read relay state
02	Read discrete inputs	Read digital input state
03	Read holding registers	Read device parameters
05	Write single coil	Single relay write
06	Write single register	Write device parameters
0F	Write multiple coils	Multiple relays

Register map

Address (HEX)	Content	Description	Type	Modbus FC
0x0000~0x0008	CH1–CH8 relay outputs	0xFF00：relay ON; 0x0000: relay OFF;	R/W	0x01,0x05,0x0F
0x00FF	All relay outputs	0xFF00：All relays ON; 0x0000: all OFF;	W	0x05
0x1000~0x1008	CH1–CH8 relay toggle	0xFF00：toggle; 0x0000: no change;	W	0x05,0x0F
0x10FF	All relays toggle	0xFF00：toggle all; 0x0000: no change;	W	0x05
0xA000~0xA00F	CH1–CH8 power-on relay output	0xFF00：relay ON; 0x0000: relay OFF;power-on relay output.	R/W/S	0x01,0x05,0x0F
1x0000~1x0007	CH1–CH8 digital inputs	State of digital inputs CH1–CH8	W	0x02
4x2000~4x2007	CH1–CH8 relay control mode	Seven control modes 0x0000–0x0006	R/W	0x03,0x06,0x10
4x3000~4x3007	CH1–CH8 pulse ON	Delay = value × 100 ms (e.g. 0x0007 → 700 ms)	W	0x06,0x10
4x4000~4x4007	CH1–CH8 pulse OFF	Delay = value × 100 ms (e.g. 0x0007 → 700 ms)	W	0x06,0x10
4x5000~4x500F	CH1–CH8 relay delay	Delay = value × 100 ms (e.g. 0x0007 → 700 ms)	W/S	0x03,0x06,0x10
4x8000	SUK	Model number	R/W/S	0x03
4x8001	Firmware version	Decimal value with implied decimal → version (e.g. 0x0064 = 100 → V1.00)	R/W/S	0x03
4x8002	Slave address	Stores Modbus address; default 0x0001	R/W/S	0x03,0x06
4x8003	UART parameters	Upper byte: parity/stop; lower byte: baud rate	R/W/S	0x03,0x06
4x8004	Watchdog	If no valid Modbus within timeout, outputs off / reset	R/W/S	0x03,0x06
4x8005	Auto-report DI	Digital input change auto-upload	R/W/S	0x03,0x06
4x9000~4x900F	User string area	String format	R/W/S	0x03,0x06,0x10

Note

Registers marked S retain values across power cycles.

Modbus RTU command reference

Control a single relay

Request: 01 05 00 00 FF 00 8C 3A

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
05	FC 0x05	Relay control
00 00	Address	Target relay register address
FF 00	Command	0xFF00：relay ON; 0x0000: relay OFF;
8C 3A	CRC16	CRC16 over preceding bytes

Response: 01 05 00 00 FF 00 8C 3A

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
05	FC 0x05	Relay control
00 00	Address	Target relay register address
FF 00	Command	0xFF00：relay ON; 0x0000: relay OFF;
8C 3A	CRC16	CRC16 over preceding bytes

Examples (slave 0x01):

relay ON : 01 05 00 00 FF 00 8C 3A
relay OFF : 01 05 00 00 00 00 CD CA
relay ON : 01 05 00 01 FF 00 DD FA
relay OFF : 01 05 00 01 00 00 9C 0A
relay ON : 01 05 00 02 FF 00 2D FA
relay OFF : 01 05 00 02 00 00 6C 0A
relay ON : 01 05 00 03 FF 00 7C 3A
relay OFF : 01 05 00 03 00 00 3D CA
relay toggle : 01 05 10 00 FF 00 88 FA
relay toggle : 01 05 10 01 FF 00 D9 3A
relay toggle : 01 05 10 02 FF 00 29 3A
relay toggle : 01 05 10 03 FF 00 78 FA

Control all relays

Request: 01 05 00 FF FF 00 BC 0A

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
05	FC 0x05	Relay control
00 FF	Address	Fixed 0x00FF
FF 00	Command	0xFF00：relay ON; 0x0000: relay OFF;
BC 0A	CRC16	CRC16 over preceding bytes

Response: 01 05 00 FF FF 00 BC 0A

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
05	FC 0x05	Relay control
00 FF	Address	Fixed 0x00FF
FF 00	Command	0xFF00：relay ON; 0x0000: relay OFF;
BC 0A	CRC16	CRC16 over preceding bytes

Examples (slave 0x01):

All relays ON : 01 05 00 FF FF 00 BC 0A
All relays OFF : 01 05 00 FF 00 00 FD FA
All relays toggle : 01 05 10 FF FF 00 B8 CA

Read relay states

Request: 01 01 00 00 00 08 3D CC

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
01	FC 0x01	Read coils (FC 01)
00 00	Start address	First coil register address
00 08	Coil count	Number of coils; must not exceed max address
3D CC	CRC16	CRC16 over preceding bytes

Response: 01 01 01 00 51 88

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
01	FC 0x01	Read coils (FC 01)
01	Byte count	Total data bytes returned.
00	Returned states	Packed coil bits: Bit0 = first coil, Bit1 = next, …; unused high bits are zero.
51 88	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

TX: 01 01 00 00 00 08 3D CC     //Read first 8 relays
RX: 01 01 01 00 51 88           // First 8 relays all OFF
TX: 01 01 00 01 00 03 2D CB     // Query relays 2–4
RX: 01 01 01 05 91 8B           //2、4 relay ON，3 relay OFF
TX: 01 01 00 03 00 05 0C 09     // Query relays 4–8
RX: 01 01 01 0F 11 8C           //4-7 relay ON，8 relay OFF

Write multiple relay states

Request: 01 0F 00 00 00 08 01 FF BE D5

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
0F	FC 0x0F	Write multiple coils (FC 0x0F)
00 00	Start address	First coil register address
00 08	Coil count	Coil count; must not exceed maximum
01	Byte count	Data byte count
FF	Coil data	Bit0: first coil, Bit1: next, …; unused high bits zero
BE D5	CRC16	CRC16 over preceding bytes

Response: 01 0F 00 00 00 08 54 0D

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
0F	FC 0x0F	Write multiple coils (FC 0x0F)
00 00	Start address	First coil register address
00 08	Coil count	Coil count; must not exceed maximum
54 0D	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

All relays ON : 01 0F 00 00 00 08 01 FF BE D5
All relays OFF : 01 0F 00 00 00 08 01 00 FE 95
CH1–2 ON; CH3–7 OFF : 01 0F 00 00 00 08 01 03 BE 94

Single-relay pulse ON/OFF

Request: 01 06 30 00 00 07 C7 08

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
30 00	Pulse addr	Pulse register address for target relay
00 07	Interval	Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF.
C7 08	CRC16	CRC16 over preceding bytes

Response: 01 06 30 00 00 07 C7 08

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
30 00	Pulse addr	Pulse register address for target relay
00 07	Interval	Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF.
C7 08	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

CH1 pulse ON : 01 06 30 00 00 07 C7 08  //700MS = 7*100MS = 700MS
CH2 pulse ON : 01 06 30 01 00 08 D6 CC  //800MS
CH1 pulse OFF : 01 06 40 00 00 05 5C 09  //500MS
CH2 pulse OFF : 01 06 40 01 00 06 4D C8  //600MS

Multiple-relay pulse ON/OFF

Request: 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
10	FC 0x10	Write multiple holding registers (FC 10)
30 00	Pulse addr	First relay pulse register address
00 04	Coil count	Coil count; must not exceed maximum
08	Byte count	Following data byte count
00 0A …… 00 0A	Timeout / interval	Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF.
65 8E	CRC16	CRC16 over preceding bytes

Response: 01 10 30 00 00 04 CE CA

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
10	FC 0x10	Write multiple holding registers (FC 10)
30 00	Pulse addr	First relay pulse register address
00 04	Coil count	Coil count; must not exceed maximum
CE CA	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

1 relays pulse ON 1 s    : 01 10 30 00 00 04 08 00 0A 00 0A 00 0A 00 0A 65 8E   //700MS = 7*100MS = 700MS
2/CH3 pulse ON 800 ms : 01 10 30 01 00 02 04 00 08 00 08 E6 66               //800MS
5 relays pulse OFF 500 ms : 01 10 40 04 00 04 08 00 05 00 05 00 05 00 05 F0 77   //500MS
1/CH3 pulse ON 600 ms : 01 10 40 00 00 03 06 00 07 00 07 00 07 F6 82         //700MS

Read digital input states

Request: 01 02 00 00 00 08 79 CC

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
02	FC 0x02	Read discrete inputs (FC 02)
00 00	Start address	First discrete input address
00 08	Coil count	Input count; must not exceed max channels
79 CC	CRC16	CRC16 over preceding bytes

Response: 01 01 01 00 51 88

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
01	FC 0x01	Read coils (FC 01)
01	Byte count	Total data bytes returned.
00	Returned states	Packed coil bits: Bit0 = first coil, Bit1 = next, …; unused high bits are zero.
51 88	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

TX: 01 02 00 00 00 08 79 CC
RX: 01 01 01 00 51 88           //No inputs active
TX: 01 02 00 00 00 08 79 CC
RX: 01 02 01 01 60 48           //CH1 active, others idle
TX: 01 02 00 00 00 08 79 CC
RX: 01 02 01 41 61 B8           //CH1 and CH7 active

Read relay control modes

Request: 01 03 20 00 00 08 4F CC

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
03	FC 0x03	Read holding registers (FC 03)
20 00	Mode block start address	First mode register address
00 08	Coil count	Number of mode registers
4F CC	CRC16	CRC16 over preceding bytes

Response: 01 03 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E4 59

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
03	FC 0x03	Read holding registers (FC 03)
10	Byte count	Total data bytes returned.
00 00 …… 00 00	Relay mode	Supported relay control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Relay tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles relay; 0x0004: Toggle on edge — Each input edge toggles relay; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay;
51 88	CRC16	CRC16 over preceding bytes

Note

In cycle, ON-delay, and OFF-delay modes, adjust timing via the delay registers.

Examples (slave 0x01)

Read CH1–8 modes: 01 03 20 00 00 08 4F CC
Read CH1 mode: 01 03 20 00 00 01 8F CA
Read CH2 mode: 01 03 20 01 00 01 DE 0A
Read CH3–5 modes: 01 03 20 02 00 03 AF CB

Set single relay control mode

Request: 01 06 20 00 00 02 03 CB

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write holding register (FC 06)
20 00	Mode register address	Target mode register address
00 02	Mode	Supported relay control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Relay tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles relay; 0x0004: Toggle on edge — Each input edge toggles relay; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay;
03 CB	CRC16	CRC16 over preceding bytes

Note

Cycle, ON-delay, and OFF-delay timing is adjusted via delay registers.

Response: 01 06 20 00 00 02 03 CB

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write holding register (FC 06)
20 00	Mode register address	Target mode register address
00 02	Mode	Relay control mode value
03 CB	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

Set CH1 follow mode: 01 06 20 00 00 02 03 CB
Set CH2 toggle mode: 01 06 20 01 00 03 93 CB

Set multiple relay control modes

Request: 01 10 20 00 00 08 10 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 D3 35

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
10	FC 0x10	Write multiple holding registers (FC 10)
20 00	Mode block start address	First mode register address
00 08	Coil count	Coil count; must not exceed maximum
10	Byte count	Following data byte count
00 02 …… 00 02	Mode	Supported relay control modes: 0x0000: Command mode — Direct command control; 0x0001: Cycle mode — State toggles on a timer; 0x0002: Follow-input mode — Relay tracks matching input; 0x0003: Toggle on pulse — Each input pulse toggles relay; 0x0004: Toggle on edge — Each input edge toggles relay; 0x0005: ON-delay mode — Input pulse: ON then OFF after delay; 0x0006: OFF-delay mode — Input pulse: OFF then ON after delay;
D3 35	CRC16	CRC16 over preceding bytes

Note

Cycle, ON-delay, and OFF-delay timing is adjusted via delay registers.

Response: 01 10 20 00 00 08 CA 0F

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
10	FC 0x10	Write multiple holding registers (FC 10)
20 00	Mode block start address	First mode register address
00 08	Coil count	Coil count; must not exceed maximum
CA 0F	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

Set CH1–8 follow mode: 01 10 20 00 00 08 10 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 D3 35
Set CH3–5 toggle mode: 01 10 20 02 00 03 06 00 03 00 03 00 03 18 8B

Set single relay delay time

Request: 01 06 50 00 00 0A 18 CD

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write holding register (FC 06)
50 00	Mode register address	Delay register address
00 0A	Delay	Delay = value × 100 ms (e.g. 0x0007 → 700 ms). Max 0x7FFF.
03 CB	CRC16	CRC16 over preceding bytes

Note

Delay registers apply only in cycle, ON-delay, and OFF-delay modes.

Response: 01 06 30 00 00 02 03 CB

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write holding register (FC 06)
20 00	Mode register address	Target mode register address
00 02	Mode	Relay control mode value
03 CB	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

Set CH1 follow mode: 01 06 20 00 00 02 03 CB
Set CH2 toggle mode: 01 06 20 01 00 03 93 CB

Read firmware version

Request: 01 03 80 01 00 01 FC 0A

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
03	FC 0x03	Read firmware / device info (FC 03)
80 01	Firmware register	Fixed 4x8001
00 01	Word count	Fixed 0x0001
FC 0A	CRC16	CRC16 over preceding bytes

Response: 01 03 02 00 64 B9 AF

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
03	FC 0x03	Read firmware / device info (FC 03)
02	Byte count	Returned byte count
00 64	Version	Decimal ÷100 → version string (0x0064 = 100 → V1.00)
B9 AF	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

TX:01 03 80 01 00 01 FC 0A
RX:01 03 02 01 2C B8 09       //0x012C = 300 =V3.00

Read slave address

Request: FE 03 80 02 00 01 18 05

Field	Meaning	Notes
FE	Slave address	0xFE: responding broadcast; applies to all slaves
03	FC 0x03	Read holding registers (FC 03)
80 02	Address register	Fixed 4x8002
00 01	New address	Slave address to set, range 0x0001–0x00F7
D4 05	CRC16	CRC16 over preceding bytes

Response: FE 03 02 00 01 6D 90

Field	Meaning	Notes
FE	Slave address	0xFE: responding broadcast; applies to all slaves
03	FC 0x03	Read holding registers (FC 03)
02	Byte count	Returned byte count
00 01	Slave addr	Current 0x0001–0x00F7
6D 90	CRC16	CRC16 over preceding bytes

Note

With 0xFE broadcast read, connect only one device to avoid bus collisions.

Examples (slave 0x01)

Set address 0x01 ：FE 06 80 02 00 01 D4 05
Set address 0x02 ：FE 06 80 02 00 02 94 04
Set address 0x03 ：FE 06 80 02 00 03 55 C4

Set slave address

Request: FE 06 80 02 00 01 D4 05

Field	Meaning	Notes
FE	Slave address	0xFE: responding broadcast; applies to all slaves
06	FC 0x06	Write single holding register (FC 06)
80 02	Address register	Fixed 4x8002
00 01	New address	Slave address to set, range 0x0001–0x00F7
D4 05	CRC16	CRC16 over preceding bytes

Response: FE 06 80 02 00 01 D4 05

Field	Meaning	Notes
FE	Slave address	0xFE: responding broadcast; applies to all slaves
06	FC 0x06	Write single holding register (FC 06)
80 02	Address register	Fixed 4x8002
00 01	New address	Slave address to set, range 0x0001–0x00F7
D4 05	CRC16	CRC16 over preceding bytes

Note

With 0xFE broadcast write, connect only one device or all devices will receive the same address.

Examples (slave 0x01)

Set address 0x01 ：FE 06 80 02 00 01 D4 05
Set address 0x02 ：FE 06 80 02 00 02 94 04
Set address 0x03 ：FE 06 80 02 00 03 55 C4

Set UART parameters

Request: 01 06 80 03 00 05 90 09

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
80 03	UART register	Fixed 4x8003
00 05	UART	Bits 0–7: baud rate 0 : 4800 1 : 9600 2 : 19200 3 : 38400 4 : 57600 5 : 115200 6 : 128000 7 : 256000 Bits 8–12: parity (label follows Chinese doc) 0 : None, 1: Even parity, 2: Odd parity Bits 13–16: stop bits 0 : 1 stop bit, 1: 1.5 stop bits, 2: 2 stop bits
90 09	CRC16	CRC16 over preceding bytes

Response: 01 06 80 03 00 05 90 09

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
80 03	UART register	Fixed 4x8003
00 05	UART	UART value
90 09	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

9600 baud, none, 1 stop   ：01 06 80 03 00 01 91 CA
9600 baud, even, 2 stop   ：01 06 20 00 00 91 43 CA
115200 baud, none, 1 stop ：01 06 80 03 00 05 90 09

Set watchdog

Request: 01 06 80 04 00 0A 61 CC

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
80 04	Watchdog register	Fixed 4x8004
00 0A	Timeout / interval	0 disables watchdog. Non-zero enables: each valid Modbus frame feeds the dog; if the interval expires without a valid frame, firmware resets and relays return to power-on defaults. Timeout = value × 100 ms (e.g. 0x000A → 1 s).
61 CC	CRC16	CRC16 over preceding bytes

Response: 01 06 80 04 00 0A 61 CC

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
80 04	Watchdog register	Fixed 4x8004
00 0A	Timeout / interval	Watchdog timeout value
61 CC	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

Watchdog 10 s  ：01 06 80 04 00 64 E0 20
Disable watchdog     ：01 06 80 04 00 00 E1 CB

Set DI auto-upload

Request: 01 06 80 05 FF 00 61 CC

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
80 05	Auto-upload register	Fixed 4x8005
FF 00	On/off	Digital inputs can auto-report on change. 0 disables; any non-zero value enables reporting when DI state changes.
61 CC	CRC16	CRC16 over preceding bytes

Response: 01 06 80 05 FF 00 61 CC

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
06	FC 0x06	Write single holding register (FC 06)
80 05	Auto-upload register	Fixed 4x8005
FF 00	On/off	Digital inputs can auto-report on change. 0 disables; any non-zero value enables reporting when DI state changes.
61 CC	CRC16	CRC16 over preceding bytes

Examples (slave 0x01)

Enable auto-upload  ：01 06 80 05 FF 00 61 CC
Disable auto-upload  ：01 06 80 05 00 00 B0 0B

Exception codes

On protocol or device errors, the slave returns an exception response:

Response: 01 85 03 02 91

Field	Meaning	Notes
01	Slave address	0x00: broadcast; 0x01–0xF7: slave address
85	Exception FC	Exception FC = request FC + 0x80
03	Ex. code	Exception code
02 91	CRC16	CRC16 over preceding bytes

Exception codes (single byte) indicate error type. Common Modbus exceptions:

Code	Name	Description
0x01	Illegal function	Requested function not supported.
0x02	Illegal data address	Requested data address invalid.
0x03	Illegal data value	Data value or operation not allowed.
0x04	Server device failure	Server device failure.
0x05	Acknowledge	Request accepted and being processed.
0x06	Device busy	Device busy; cannot execute now.

Modbus TCP framing

Below, turning on relay 1 illustrates how an RTU frame maps to Modbus TCP.

Modbus RTU PDU: 01 05 00 00 FF 00 8C 3A

Field	Meaning	Notes
01	Slave address	Fixed 0x01
05	FC 0x05	Relay control
00 00	Address	Coil 0x0000 (first relay)
FF 00	Command	0xFF00 = relay ON
8C 3A	CRC16	CRC16 over preceding bytes

Modbus TCP ADU: 00 00 00 00 00 06 01 05 00 00 FF 00

Field	Meaning	Notes
00 00	Transaction ID	Typically 0x0000
00 00	Protocol ID	Must be 0 for Modbus
00 06	Length (bytes following)	Byte count of PDU that follows
01	Slave address	Fixed 0x01
05	FC 0x05	Relay control
00 00	Address	Coil 0x0000 (first relay)
FF 00	Command	0xFF00 = relay ON

Compared above: take the RTU PDU (drop CRC), prepend 5×0x00 plus length to form Modbus TCP.

Modbus register reference​

Device (slave) address​

Function codes​

Register map​

Modbus RTU command reference​

Control a single relay​

Control all relays​

Read relay states​

Write multiple relay states​

Single-relay pulse ON/OFF​

Multiple-relay pulse ON/OFF​

Read digital input states​

Read relay control modes​

Set single relay control mode​

Set multiple relay control modes​

Set single relay delay time​

Read firmware version​

Read slave address​

Set slave address​

Set UART parameters​

Set watchdog​

Set DI auto-upload​

Exception codes​

Modbus TCP framing​

Modbus register reference

Device (slave) address

Function codes

Register map

Modbus RTU command reference

Control a single relay

Control all relays

Read relay states

Write multiple relay states

Single-relay pulse ON/OFF

Multiple-relay pulse ON/OFF

Read digital input states

Read relay control modes

Set single relay control mode

Set multiple relay control modes

Set single relay delay time

Read firmware version

Read slave address

Set slave address

Set UART parameters

Set watchdog

Set DI auto-upload

Exception codes

Modbus TCP framing