UART Bus Protocol¶

This protocol applies to servos with a TTL-level half-duplex single-wire interface, a two-wire full-duplex interface, or a differential RS-485 interface. All variants use the same packets.

Communication is query-response: the controller sends an Instruction Packet, the servo answers with a Status Packet. Many servos can share one bus, so each servo has a unique ID. Only the servo whose ID matches the packet executes it and replies.

Setting	Value
Frame	1 start bit, 8 data bits, no parity, 1 stop bit
Default baud rate	1 Mbps (see Baud Rate)
Byte order	Little-endian for 2-byte values (low byte first)
Inter-byte timeout	100 ms — a longer gap discards the partial packet

Check the control table of your model

Functions differ slightly between models. Read the control table of your servo before writing to it.

Instruction Packet¶

Header 1	Header 2	Packet ID	Length	Instruction	Param 1	…	Param N	Checksum
`0xFF`	`0xFF`	ID	LEN	INST	P1	…	PN	CKSM

Header: 0xFF 0xFF marks the start of a packet.
Packet ID: 0x00–0xFD (0–253) addresses one servo. 0xFE (254) is the broadcast ID: every servo on the bus executes the packet, and none of them replies.
Length: Number of parameters + 2.
Instruction: One of the values in the instruction table.
Parameters: Instruction-specific data.
Checksum: ~(ID + Length + Instruction + Param 1 + … + Param N), keeping only the low byte. ~ is the bitwise NOT.

Checksum example¶

ID 0x01, Length 0x05, Instruction 0x03, parameters 0x0C 0xFE 0x05:

  0x01 + 0x05 + 0x03 + 0x0C + 0xFE + 0x05 = 0x118
  low byte                                 = 0x18
  ~0x18                                    = 0xE7

Full packet: FF FF 01 05 03 0C FE 05 E7

PythonC

def checksum(body: bytes) -> int:
    """body = ID, Length, Instruction/Error and parameters (no header)."""
    return ~sum(body) & 0xFF

def packet(servo_id: int, instruction: int, params: bytes = b"") -> bytes:
    body = bytes([servo_id, len(params) + 2, instruction]) + params
    return b"\xFF\xFF" + body + bytes([checksum(body)])

uint8_t checksum(const uint8_t *body, size_t n)
{
    /* body = ID, Length, Instruction/Error and parameters (no header) */
    uint16_t sum = 0;
    for (size_t i = 0; i < n; i++)
        sum += body[i];
    return (uint8_t)~sum;
}

Status Packet¶

Header 1	Header 2	Packet ID	Length	Error	Param 1	…	Param N	Checksum
`0xFF`	`0xFF`	ID	LEN	ERR	P1	…	PN	CKSM

The checksum is computed the same way, with the Error byte in place of the Instruction: ~(ID + Length + Error + Param 1 + … + Param N).

Error byte¶

Bit	Error	Set when
7	Encoder	The position encoder is not available
6	Instruction	An undefined instruction was sent, or Action was sent without a prior Reg Write
5	Overcurrent	Current stayed above the overcurrent threshold for longer than the detection time
4	Checksum	The checksum of the Instruction Packet is wrong
3	Range	A value is outside its permitted range
2	Overheating	Internal temperature exceeds Temperature Limit
1	Angle limit	Goal Position is outside the CW / CCW angle limits
0	Input voltage	Supply voltage is outside the voltage limits

Bits combine with OR. For example, the status packet FF FF 01 02 24 D8 from servo 1 carries error 0x24 = 0010 0100: bit 5 and bit 2, so overcurrent and overheating.

Note

The error bits relate to the actuator and may vary slightly by model.

Instructions¶

Value	Instruction	Description
`0x01`	Ping	Check that a servo with this ID is present
`0x02`	Read	Read data from the control table
`0x03`	Write	Write data to the control table, executed immediately
`0x04`	Reg Write	Store a write and hold it until Action
`0x05`	Action	Execute all stored Reg Writes
`0x06`	Factory Reset	Restore the control table to factory defaults
`0x08`	Reboot	Restart the servo
`0x83`	Sync Write	Write the same address on several servos in one packet

Abbreviations in the examples: H header, LEN length, INST instruction, ERR error, P parameter, CKSM checksum.

Ping (0x01)¶

Checks whether a servo exists. Ping always returns a Status Packet, regardless of Status Return Level.

LEN	INST	Params
`0x02`	`0x01`	none

Example — ping servo 1:

	H1	H2	ID	LEN	INST / ERR	CKSM
Instruction	`FF`	`FF`	`01`	`02`	`01`	`FB`
Status	`FF`	`FF`	`01`	`02`	`00`	`FC`

Read (0x02)¶

Reads data from the control table.

LEN	INST	P1	P2
`0x04`	`0x02`	Start address	Number of bytes

Example — read Present Temperature (address 43, 0x2B, 1 byte) from servo 1. The servo answers 0x20 = 32 °C:

	H1	H2	ID	LEN	INST / ERR	P1	P2	CKSM
Instruction	`FF`	`FF`	`01`	`04`	`02`	`2B`	`01`	`CC`
Status	`FF`	`FF`	`01`	`03`	`00`	`20`		`DB`

Write (0x03)¶

Writes data to the control table. Takes effect as soon as the packet is received.

LEN	INST	P1	P2 … P(N+1)
N + 3	`0x03`	Start address	Data bytes 1 … N

Example — set an unknown servo's ID to 1 by broadcasting a write to ID (address 3). Connect only that one servo to the bus first:

	H1	H2	ID	LEN	INST	P1	P2	CKSM
Instruction	`FF`	`FF`	`FE`	`04`	`03`	`03`	`01`	`F6`

Warning

No Status Packet is returned when the broadcast ID 0xFE is used.

Example — move servo 1 to centre: write 512 (0x0200, little-endian 00 02) to Goal Position (address 30, 0x1E):

	H1	H2	ID	LEN	INST / ERR	P1	P2	P3	CKSM
Instruction	`FF`	`FF`	`01`	`05`	`03`	`1E`	`00`	`02`	`D6`
Status	`FF`	`FF`	`01`	`02`	`00`				`FC`

Reg Write (0x04)¶

Like Write, but the data is held until an Action arrives. Use it to make several servos start moving at the same instant.

On Reg Write the packet is stored and Registered is set to 1.
On Action the stored packet runs and Registered returns to 0.

LEN	INST	P1	P2 … P(N+1)
N + 3	`0x04`	Start address	Data bytes 1 … N

Example — servo 1: register 500 (0x01F4) for Goal Position (address 30) and wait for Action:

	H1	H2	ID	LEN	INST / ERR	P1	P2	P3	CKSM
Instruction	`FF`	`FF`	`01`	`05`	`04`	`1E`	`F4`	`01`	`E2`
Status	`FF`	`FF`	`01`	`02`	`00`				`FC`

Action (0x05)¶

Executes the packets registered with Reg Write. Sending one write per servo leaves a small delay between the first and last servo starting; Reg Write followed by a single broadcast Action removes it.

LEN	INST	Params
`0x02`	`0x05`	none

Example — all servos have a registered write; trigger them together:

	H1	H2	ID	LEN	INST	CKSM
Instruction	`FF`	`FF`	`FE`	`02`	`05`	`FA`

No Status Packet is returned because the broadcast ID is used.

Factory Reset (0x06)¶

Restores the control table to factory defaults.

Danger

Factory Reset overwrites every value you stored in non-volatile memory, including the ID and baud rate. The broadcast ID 0xFE cannot be used with this instruction.

LEN	INST	Params
`0x02`	`0x06`	none

Example — factory reset servo 0:

	H1	H2	ID	LEN	INST / ERR	CKSM
Instruction	`FF`	`FF`	`00`	`02`	`06`	`F7`
Status	`FF`	`FF`	`00`	`02`	`00`	`FD`

Reboot (0x08)¶

Restarts the servo.

Example — reboot servo 1:

	H1	H2	ID	LEN	INST / ERR	CKSM
Instruction	`FF`	`FF`	`01`	`02`	`08`	`F4`
Status	`FF`	`FF`	`01`	`02`	`00`	`FC`

Sync Write (0x83)¶

Writes the same address and length on several servos with one packet, which cuts bus time when many servos share a channel. The packet must use the broadcast ID, so no Status Packet is returned.

Field	Value
Instruction	`0x83`
Length	(L + 1) × N + 4 (L = data length per servo, N = number of servos)
Param 1	Start address
Param 2	Data length L
Param 3	1st servo ID
Param 4 … L+3	1st servo data bytes 1 … L
Param L+4	2nd servo ID
Param L+5 … 2L+4	2nd servo data bytes 1 … L
…	…

Example — write Goal Position (30) and Moving Speed (32), 4 bytes, to two servos:

Servo 0: Goal Position 0x0010, Moving Speed 0x0150
Servo 1: Goal Position 0x0220, Moving Speed 0x0360

FF FF FE 0E 83 1E 04  00 10 00 50 01  01 20 02 60 03  67
         │  │  │  │   └── servo 0 ──┘  └── servo 1 ──┘  └ checksum
         │  │  │  └ L = 4 bytes per servo
         │  │  └ start address 30
         │  └ Sync Write
         └ (4 + 1) × 2 + 4 = 14

需要样品、定制或批量报价？联系我们，通常一个工作日内回复。