Modbus Register Definitions
This guide explains how to control a DFRobot N20 motor module using Modbus-RTU protocol, including changing the device address and restoring factory defaults. It covers hardware setup, wiring, and command sending. The key registers and function codes are detailed, with examples for driving the motor and modifying settings.
Register Definitions
| Register Type | Register Address | Name | R/W | Data Range (16‑bit) | Default Value | Description |
|---|---|---|---|---|---|---|
| Input Register | 0x0000 | VID | R | 0x3343 | 0x3343 | VID (Manufacturer ID for DFRobot) |
| Input Register | 0x0001 | PID | R | 0x0000~0xFFFF | 0x04FD | Product ID |
| Input Register | 0x0002 | Device Address | R | 0x0001~0x0020 | 0x0001 | Reserved |
| Input Register | 0x0003 | Module Baud Rate | R | 0x0000~0xFFFF | 0x0003 | Reserved |
| Input Register | 0x0004 | Parity Bit(H) ‑ Stop Bit(L) | R | 0x0000~0xFFFF | 0x0001 | Reserved |
| Input Register | 0x0005 | VERSION | R | 0x0000~0xFFFF | 0x1000 | Firmware Version: 0x1000 stands for V1.0.0.0 |
| Input Register | 0x0006 | Motor Status | R | 0x0000~0xFFFF | 0x0000 | Current motor status: 0=Stop, 100=Forward rotation, 200=Reverse rotation |
| Holding Register | 0x0000 | VID | R/W | 0x0000~0xFFFF | 0xFFFF | Reserved |
| Holding Register | 0x0001 | PID | R/W | 0x0000~0xFFFF | 0xFFFF | Reserved |
| Holding Register | 0x0002 | Device Address | R/W | 0x0001~0x0020 | 0x0001 | Module slave address (1~247) |
| Holding Register | 0x0003 | Module Baud Rate | R/W | 0x0000~0x00FF | 0x0003 | Module baud rate:0x0001‑24000x0002‑48000x0003‑96000x0004‑144000x0005‑192000x0006‑384000x0007‑576000x0008‑115200Other values‑115200 |
| Holding Register | 0x0004 | Parity Bit(H) ‑ Stop Bit(L) | R/W | 0x0000~0xFFFF | 0x0001 | Module parity bit (High byte) ‑ Stop bit (Low byte)Parity(H):0x00‑None0x01‑Even0x02‑OddOther‑NoneStop Bit(L):0x00‑0.5 Byte0x01‑1 Byte0x02‑1.5 Byte0x03‑2 ByteOther‑1 Byte |
| Holding Register | 0x0005 | VERSION | R/W | 0x0000~0xFFFF | 0xFFFF | Reserved |
| Holding Register | 0x0006 | Motor Status | R/W | 0x0000~0xFFFF | 0x0000 | Reserved |
| Holding Register | 0x0007 | Motor Speed | R/W | 0x0000~0xFFFF | 0x0000 | 16‑bit signed motor speed, range ‑255~255.0=Stop, >0=Forward rotation, <0=Reverse rotation |
| Holding Register | 0x0008 | RESET | R/W | 0x0000~0x0001 | 0x0001 | Restore factory defaults |
Common Function Codes for Modbus-RTU:
| Function Code | Name | Function |
|---|---|---|
| 0x03 | Read Multiple Registers | Read integer, character, status word, floating-point (read N words) --- Read holding registers, byte operation |
| 0x04 | Read Input Registers | Read integer, status word, floating-point (read N words) --- Read input registers, byte operation |
| 0x06 | Write Single Holding Register | Write integer, character, status word, floating-point (write one word) --- Write holding register, byte operation |
| 0x10 | Write Multiple Holding Registers | Write multiple holding registers --- Load specific binary values into a series of consecutive holding registers |
Input and holding registers can be read and written using the above commands.
Example of Driving Motor Forward
Objective
Write to the holding registers of the N20 motor module via Modbus RTU protocol to control the motor to rotate forward at the specified speed.
Hardware Preparation
Wiring Diagram
Connection Description:
| Motor Pin: + | Connect to | Main Controller Pin: 5V |
|---|---|---|
| Motor Pin: - | Connect to | Main Controller Pin: GND |
| Motor Pin: R | Connect to | Main Controller Pin: TX |
| Motor Pin: T | Connect to | Main Controller Pin: RX |
General Operation Steps
Hardware Connection: Connect the N20 motor module to the host (PC) via the RainbowLink USB protocol converter. The factory default RTU slave address is 0x0001.
Parameter Configuration: Set parameters in the serial debug tool (must match the factory default configuration of the motor module):
- Baud rate: 9600 (default)
- Data bits: 8
- Stop bits: 1
- Parity: None
Send Command: Enter the hexadecimal command below in the "Send Area" of the debug tool, check the "Send as Hex" option, then send.
Send Command & Parsing
Note: The register controlling motor speed is holding register 0x0007, a 16-bit signed integer. Positive values indicate forward rotation and negative values indicate reverse rotation, with a value range of -255 ~ 255. This example sets speed = 100 for motor forward rotation.
| Field Name | Hex Value | Description |
|---|---|---|
| Device Address | 01 | MODBUS device address, default 0x0001 |
| Function Code | 06 | Write Single Holding Register (fixed command) |
| Register Starting Address | 00 07 | Motor speed holding register address (0x0007) |
| Write Data | 00 64 | Set speed to 100, 16-bit signed positive number for forward rotation |
| CRC Check | 39 E0 | CRC16 check value of the command |
Full Send Command: 01 06 00 07 00 64 39 E0
Response Data & Parsing
After receiving a valid write command, the motor module echoes the identical message frame as the response:
| Field Name | Hex Value | Description |
|---|---|---|
| Device Address | 01 | Consistent with the device address in the send command |
| Function Code | 06 | Confirms execution of "Write Single Holding Register" operation |
| Register Starting Address | 00 07 | Address of the written register |
| Written Data | 00 64 | Actual written speed value |
| CRC Check | 39 E0 | CRC16 check value of the response frame |
Full Response Data: 01 06 00 07 00 64 39 E0
Notes
-
To stop the motor, write
00 00to holding register 0x0007. Full command:01 06 00 07 00 00 38 0B. -
If you have modified the module’s device address, baud rate, parity or stop bits, the serial debug tool parameters and the device address inside the command must be modified accordingly.
Example of Modifying Device Address and Restoring Factory Defaults
Objective
Write to holding registers via the Modbus RTU protocol to change the device address of the N20 motor module from the default 0x01 to 0x02. After modifying the address, power-cycle the module for the new address to take effect. Then send the factory reset command to restore the module to factory default parameters (the device address will revert to 0x01).
Hardware Preparation
Wiring Diagram
Connection Description:
| Motor Pin: + | Connect to | Main Controller Pin: 5V |
|---|---|---|
| Motor Pin: - | Connect to | Main Controller Pin: GND |
| Motor Pin: R | Connect to | Main Controller Pin: TX |
| Motor Pin: T | Connect to | Main Controller Pin: RX |
General Operation Steps
Hardware Connection: Connect the N20 motor module to the host (PC) via the RainbowLink USB protocol converter. The factory default RTU slave address is 0x0001.
Parameter Configuration: Set parameters in the serial debug tool (must match the factory default configuration of the motor module):
- Baud rate: 9600 (default)
- Data bits: 8
- Stop bits: 1
- Parity: None
Send Command: Enter the hexadecimal command below in the "Send Area" of the debug tool, check the "Send as Hex" option, then send.
Part 1: Modify Device Address (0x01 → 0x02)
Important Note: Writing to the address register only saves the configuration. You must power-cycle the module for the new device address to take effect. The old address 0x01 is still used for communication before reboot.
Send Command & Parsing
| Field Name | Hex Value | Description |
|---|---|---|
| Device Address | 01 | MODBUS device address, default 0x0001 before modification |
| Function Code | 06 | Write Single Holding Register (fixed command) |
| Register Starting Address | 00 02 | Device address holding register address (0x0002) |
| Write Data | 00 02 | Set the new module device address to 0x0002 |
| CRC Check | A9 CB | CRC16 check value of the command |
Full Send Command: 01 06 00 02 00 02 A9 CB
Response Data & Parsing
After receiving a valid write command, the motor module echoes the identical message frame as the response:
| Field Name | Hex Value | Description |
|---|---|---|
| Device Address | 01 | Consistent with the old device address in the send command |
| Function Code | 06 | Confirms execution of "Write Single Holding Register" operation |
| Register Starting Address | 00 02 | Address of the written register |
| Written Data | 00 02 | New device address value to be written |
| CRC Check | A9 CB | CRC16 check value of the response frame |
Full Response Data: 01 06 00 02 00 02 A9 CB
Interpretation of Address Modification Result
Receiving the response frame means the new address configuration has been saved inside the module, but the new address is not active yet.
-
Power off the module and re-power it to reboot.
-
After reboot, the new address 0x02 takes effect. The first byte of all subsequent communication commands must be changed to 02 to communicate with the module.
Address verification command after reboot (new address 0x02, read input register 0x0002):
02 04 00 02 00 01 90 39The module follows the standard Modbus-RTU big-endian mode; no byte swap is required. Actual returned frame:02 04 02 00 02 7C F1. The data bytes00 02represent the read device address 0x0002, confirming the address modification is completed.
Part 2: Restore Factory Defaults (Current address 0x02, revert to 0x01 after reset)
Register Definition: Holding register 0x0008 RESET. Write 0x0001 to trigger factory reset. A power cycle is also required for factory reset to load and apply default settings.
Send Command & Parsing
| Field Name | Hex Value | Description |
|---|---|---|
| Device Address | 02 | Current MODBUS device address of the module, 0x0002 after reboot |
| Function Code | 06 | Write Single Holding Register (fixed command) |
| Register Starting Address | 00 08 | Factory reset register address (0x0008) |
| Write Data | 00 01 | Trigger factory reset |
| CRC Check | C9 FB | CRC16 check value of the command |
Full Send Command: 02 06 00 08 00 01 C9 FB
Response Data & Parsing
After the motor module receives and successfully executes the factory reset command, it returns the original sent frame:
| Field Name | Hex Value | Description |
|---|---|---|
| Device Address | 02 | Device address before reset execution |
| Function Code | 06 | Confirms execution of "Write Single Holding Register" operation |
| Register Starting Address | 00 08 | Address of the written register |
| Written Data | 00 01 | Reset trigger value |
| CRC Check | C9 FB | CRC16 check value of the response frame |
Full Response Data: 02 06 00 08 00 01 C9 FB
Interpretation of Factory Reset Result
Once the module returns the response frame, the factory reset configuration is saved. Power-cycle the module to load factory parameters. After reboot, all parameters restore to factory defaults: device address reverts to 0x0001, baud rate 9600, default parity and stop bit settings, and motor speed cleared to stop.
Verification command after reboot (address reverts to 0x01):
01 04 00 02 00 01 90 0A. Parse returned data bytes in standard big-endian order. Reading 0x0001 confirms factory reset takes effect.
Notes
-
After successful writing for device address modification, the module must be power-cycled for the new address to take effect. Factory reset also requires a power cycle after writing, the address will switch back to 0x01, and the first byte of the message must be modified accordingly.
-
Valid device address range: 1–247. Do not write 0, otherwise module communication will be abnormal.
-
Factory reset clears user configurations: communication baud rate, parity, stop bits and running speed all revert to factory defaults, which will be loaded after power cycle.
Was this article helpful?