Modbus command reference

Note

This page covers boxes ordered with Modbus, which is what we stock. A unit from elsewhere may use the vendor protocol — see that page.

Port settings

	Value
Baud rate	9600
Data · stop · parity	8 · 1 · none
Device address	`1`
Function codes	`03` `06` `10`

Danger

🔴 The address is fixed at 1 and users cannot change it.

The manual states: Slave address: 0x01 by default, if you need to modify, please specify in advance (users can not modify)

There is also no register for the address — registers 1 and 2 are documented as unused.

This differs from the RFID readers, which can be readdressed in the field.

Registers

Address	Purpose	Range	Access
`0001`	unused	—	—
`0002`	unused	—	—
`0003`	Sound folder	`0`–`255`	read/write
`0004`	Volume	`0`–`28`	read/write

Warning

The manual’s table ends with ……, so undocumented registers may exist.

Do not probe by writing. Writing an unknown register may overwrite a factory setting. Ask the manufacturer if you need something not listed.

Command order

Send volume first, then the play command — they are separate registers and cannot be written in one frame. Play first and the sound uses the previous volume.

Example frames

Every frame below was generated by code and checked against the manual’s own examples — none were typed by hand.

Writing — function `06`

Action	Frame sent
Volume 28 (max)	`01 06 00 04 00 1C C9 C2`
Volume 15	`01 06 00 04 00 0F 88 0F`
Volume 0 (silent)	`01 06 00 04 00 00 C8 0B`
Play `AW002`	`01 06 00 03 00 02 F8 0B`
Play `AW004`	`01 06 00 03 00 04 78 09`
Play `AW005`	`01 06 00 03 00 05 B9 C9`
Stop	`01 06 00 03 00 00 79 CA`

The box echoes the frame back byte for byte, per the Modbus standard.

Reading — function `03`

Reads folder and volume together.

send    01 03 00 03 00 02 34 0B
reply   01 03 04 00 07 00 09 8B F4
             │  └─┬─┘ └─┬─┘
             │    │     └── volume = 9
             │    └──────── folder = 7, i.e. AW007
             └───────────── data byte count = 4

Danger

🔴 Always check that the third byte is 04.

The read command you send also starts 01 03, exactly like the reply. If the bus echoes and your code only checks the first two bytes, it will accept its own frame and decode:

folder 768 — above the 255 maximum
volume 564 — above the 28 maximum

Both impossible, but without the check they are used silently.

CRC

Standard Modbus CRC16 — polynomial 0xA001, seed 0xFFFF, low byte first.

def crc16(data):
    c = 0xFFFF
    for b in data:
        c ^= b
        for _ in range(8):
            c = (c >> 1) ^ 0xA001 if c & 1 else c >> 1
    return bytes([c & 0xFF, (c >> 8) & 0xFF])   # low byte first

Tip

Swapped CRC bytes are the most common mistake, and the symptom is total silence — indistinguishable from a broken cable.

Compare a frame your code builds against the table above; if the last two bytes are reversed, you have found it.

Check before connecting hardware

Print the frames your code generates and compare them with the table above. Far faster than debugging with hardware attached.

Important

Always read the current values before overwriting them with function 03. It tells you what the box actually holds, and confirms the wiring and protocol are right before you change anything.