CAN Bus Servo Communication Protocol

---

1. Introduction

This document describes the data-area application-layer communication protocol for Fashion Star CAN bus servo. The protocol supports parameter reads and writes, status queries, and motion control between a host controller and a servo. It also defines response packets, continuous writes, buffered commits, the public memory table, byte order, and response-matching rules.

1.1 Scope

This document applies to host-controller development, PC configuration software development, system integration, and communication testing for Fashion Star CAN bus servo.

Protocol Version

This document is based on protocol version 0.2.0.04172025. Different models or firmware versions may add or remove addresses or adjust parameter semantics. Before integration, confirm the target servo model and firmware version.

• Addresses not listed in this document are undefined and must not be accessed.
• Before product integration, confirm the target servo model, firmware version, CAN link-layer configuration, and the units and ranges of all parameters used.

1.2 Protocol Boundaries

This document defines only the contents of the data field in CAN data frames. It does not define the CAN arbitration ID, standard or extended frames, data or remote frames, the initial physical-layer baud rate, termination resistance, the maximum number of nodes, or how CAN FD is used.

Warning

CAN link-layer configuration must follow the applicable datasheet or complete-system interface specification. Do not infer any configuration that has not been explicitly published.

2. General Conventions

2.1 Byte Numbering and Packet Length

• Byte1 in the original protocol corresponds to Data[0] in this document; subsequent bytes follow in sequence.
• DLC indicates the actual number of data bytes used by an application-layer packet. The sender must set the DLC as specified by the command, and the receiver must validate the DLC before parsing the data.
• The maximum packet length in this protocol is 8 bytes.

2.2 Command Identifier

Data[0] is a single-byte ASCII command identifier. For example, the byte value of r is 0x72, while the byte value of R is 0x52. Command identifiers are case-sensitive.

2.3 Servo ID

Data[1] is the single-byte ServoID. The range of IDs allowed for ordinary unicast communication depends on the configuration constraints of the specific product; the reference document does not provide the complete range.

ServoID = 0xFF is explicitly used only to broadcast to buffered servo units in the synchronous-motion scenario during continuous writes. Outside this scenario, do not assume that all firmware versions or commands support 0xFF broadcasts. Commands that produce a response must not be broadcast, because multiple nodes may transmit responses simultaneously.

2.4 Parameter Width and Byte Order

Except for the source-table anomaly specifically described in Section 5.4, each parameter in the memory table is 2 bytes long. Packets place the low byte first and the high byte second:

Value = Value_L | (Value_H << 8)

Adjacent addresses whose names contain (L) and (H) together form 32-bit data. The (L) address stores the low 16 bits, and the (H) address stores the high 16 bits:

Value32 = Word_L | (Word_H << 16)

Little-Endian Byte Order

Multibyte data uses little-endian byte order, with the low-order byte first and the high-order byte second. Unless a specific parameter states otherwise, do not infer its signedness, engineering unit, scale factor, or physical-quantity conversion.

2.5 Validation, Errors, and Timeouts

• The reference document does not define an application-layer checksum or CRC field. The CAN link layer still uses CAN's own error-detection mechanisms.
• The reference document does not define error responses for illegal commands, illegal addresses, writes to read-only addresses, or out-of-range parameters.
• The reference document does not specify response timeouts, retry counts, or duplicate-command handling. The host controller must determine these values based on the target product and bus load.
• A post-write response returns the current value at the corresponding address after the device performs the write. The host controller must compare the requested value with the response value and must not assume that the requested value was accepted unchanged merely because a response was received.

3. Control Commands

The following table summarizes the application-layer control commands for a CAN bus servo. Command identifiers are case-sensitive.

CMD	Hex	Direction	Function	DLC	Response
r	0x72	Host -> servo	Read one parameter	3	v, DLC = 5
R	0x52	Host -> servo	Read two parameters	4	V, DLC = 8
w	0x77	Host -> servo	Write one parameter	5	No response
W	0x57	Host -> servo	Write two parameters	8	No response
x	0x78	Host -> servo	Write one parameter and respond	5	v, DLC = 5
X	0x58	Host -> servo	Write two parameters and respond	8	V, DLC = 8
Q	0x51	Host -> servo	Begin continuous writes	2	No response
q	0x71	Host -> servo	End continuous writes and commit	2	No response
v	0x76	servo -> Host	Single-parameter response	5	Triggered by r or x
V	0x56	servo -> Host	Dual-parameter response	8	Triggered by R or X

4. Packet Structure

4.1 Read One Parameter

• Request command: r (0x72)
• Response command: v (0x76)

4.1.1 Request Packet

Byte	Field	Description
Data[0]	CMD	Fixed at r (0x72)
Data[1]	ServoID	Target servo ID
Data[2]	Addr	Parameter address

4.1.2 Response Packet

Byte	Field	Description
Data[0]	CMD	Fixed at v (0x76)
Data[1]	ServoID	Responding servo ID
Data[2]	Addr	Parameter address; must match the request
Data[3]	Value_L	Parameter low byte
Data[4]	Value_H	Parameter high byte

4.2 Read Two Parameters

• Request command: R (0x52)
• Response command: V (0x56)

4.2.1 Request Packet

Byte	Field	Description
Data[0]	CMD	Fixed at R (0x52)
Data[1]	ServoID	Target servo ID
Data[2]	Addr_A	Parameter A address
Data[3]	Addr_B	Parameter B address

4.2.2 Response Packet

Byte	Field	Description
Data[0]	CMD	Fixed at V (0x56)
Data[1]	ServoID	Responding servo ID
Data[2]	Addr_A	Parameter A address; must match the request
Data[3]	Value_A_L	Parameter A low byte
Data[4]	Value_A_H	Parameter A high byte
Data[5]	Addr_B	Parameter B address; must match the request
Data[6]	Value_B_L	Parameter B low byte
Data[7]	Value_B_H	Parameter B high byte

4.3 Write One Parameter

• Write command without response: w (0x77)
• Write command with response: x (0x78)

4.3.1 Command Packet

Byte	Field	Description
Data[0]	CMD	w (0x77) or x (0x78)
Data[1]	ServoID	Target servo ID
Data[2]	Addr	Parameter address
Data[3]	Value_L	Parameter low byte
Data[4]	Value_H	Parameter high byte

Response Rules

w does not produce a response after a write. After a write, x uses a 5-byte v packet to return the current value at the corresponding address. The host controller must compare the requested value with the response value and must not assume that the requested value was accepted unchanged merely because a response was received.

4.4 Write Two Parameters

• Write command without response: W (0x57)
• Write command with response: X (0x58)

4.4.1 Command Packet

Byte	Field	Description
Data[0]	CMD	W (0x57) or X (0x58)
Data[1]	ServoID	Target servo ID
Data[2]	Addr_A	Parameter A address
Data[3]	Value_A_L	Parameter A low byte
Data[4]	Value_A_H	Parameter A high byte
Data[5]	Addr_B	Parameter B address
Data[6]	Value_B_L	Parameter B low byte
Data[7]	Value_B_H	Parameter B high byte

Response Rules

W does not produce a response after a write. After a write, X uses an 8-byte V packet to return the current values at the two corresponding addresses. The host controller must verify both addresses, their order, and the actual response values.

4.5 Continuous Writes

4.5.1 Begin Continuous Writes

Byte	Field	Description
Data[0]	CMD	Fixed at Q (0x51)
Data[1]	ServoID	Target servo ID

4.5.2 End and Commit

Byte	Field	Description
Data[0]	CMD	Fixed at q (0x71)
Data[1]	ServoID	Target servo ID

4.5.3 Continuous-Write Rules

1. After the servo receives Q, subsequent parameter writes first enter the buffer.
2. The buffer accepts up to eight w or W packets. After receiving the eighth packet, the device automatically performs one write operation.
3. During continuous writes, x and X are handled as w and W, respectively, and no response is sent.
4. Receiving r or R during continuous writes does not change the continuous-write behavior.
5. After receiving q, the device stops accepting continuous-write parameters and writes all buffered parameters in a single operation.
6. The reference document does not state whether the device automatically exits the buffered state after writing the eighth packet. The host controller must not rely on undefined behavior and must explicitly send q to complete the process.

Synchronous Motion

Write the motion parameters at addresses 0x50-0x58 while the device is in the buffered state, and then write 0x0001 to address 0x59. This trigger can use a specified ServoID or ServoID = 0xFF to broadcast to buffered servo units. Do not wait for a device response after a broadcast trigger.

5. Memory Table

5.1 Table Notes

• The unit of “Length” is bytes.
• “-” means that the reference document does not specify a value; it does not mean that the value is 0.
• “Not published” means that the access attribute has not been made public.
• Parameters without a specified unit, scale, or range may only be accessed as raw values and must not be converted into engineering quantities without supporting documentation.

5.2 Device Information and Real-Time Status

Address	Parameter	Length	Readable	Writable	Default	Range/Enumeration	Unit	Description
0x01	servo Model	2	Yes	Not published	-	-	-	-
0x02	Firmware Version	2	Yes	Not published	-	-	-	-
0x03	servo Serial Number (L)	2	Yes	Not published	-	-	-	Serial number low 16 bits
0x04	servo Serial Number (H)	2	Yes	Not published	-	-	-	Serial number high 16 bits
0x10	servo Voltage	2	Yes	No	-	-	Not specified	-
0x11	servo Current	2	Yes	No	-	-	Not specified	-
0x12	servo Power	2	Yes	No	-	-	Not specified	-
0x13	servo Temperature	2	Yes	No	-	-	Not specified	-
0x14	servo Status	2	Yes	No	-	-	-	-
0x15	Current Angle in Multi-Turn Mode (L)	2	Yes	No	-	-	Not specified	Current angle low 16 bits
0x16	Current Angle in Multi-Turn Mode (H)	2	Yes	No	-	-	Not specified	Current angle high 16 bits
0x17	Turn Count	2	Yes	No	-	-	turns	-
0x18	Current Angle (Single-Turn Mode)	2	Yes	No	-	-	Not specified	-

5.3 Motion Control

Address	Parameter	Length	Readable	Writable	Default	Range/Enumeration	Unit	Description
0x28	Damping Mode Power	2	Yes	Yes	-	-	mW	Enters damping mode after writing
0x50	Time to Target Angle (L)	2	Yes	Yes	-	-	ms	Time low 16 bits
0x51	Time to Target Angle (H)	2	Yes	Yes	-	-	ms	Time high 16 bits
0x52	Angle Mode Selection	2	Yes	Yes	-	0: Default; 1: Based on acceleration/deceleration; 2: Based on speed	-	-
0x53	Specified Angle (L)	2	Yes	Yes	-	-	0.1°	Specified angle low 16 bits
0x54	Specified Angle (H)	2	Yes	Yes	-	-	0.1°	Specified angle high 16 bits
0x55	Angle Mode Operating Power	2	Yes	Yes	-	-	mW	-
0x56	Acceleration-Phase Time at Startup	2	Yes	Yes	-	-	ms	-
0x57	Deceleration-Phase Time Near Target	2	Yes	Yes	-	-	ms	-
0x58	Maximum Speed to Target Angle	2	Yes	Yes	-	-	0.1°/s	-
0x59	Execute Angle Motion	2	Yes	Yes	-	0: Default, no action; 1: Execute	-	Executes the motion parameters already written to 0x50-0x58

5.4 Control and Reset

Address	Parameter	Length	Readable	Writable	Default	Range/Enumeration	Unit	Description
0x78	User Data Reset	2	No	Yes	0	0-65535	-	Resets the user data area to factory defaults
0x79	Clear Current Turn Count	2	No	Yes	-	0: Default; 1: Clear turn count	-	-
0x7A	Origin Setting	2	No	Yes	-	0: Set the current servo angle to 0°; nonzero value: restore factory settings	-	-
0x7B	Stop Control Mode	2	No	Yes	-	0x10: Release torque after stopping (unlocked); 0x11: Maintain holding torque after stopping; 0x12: Enter damping state after stopping	-

Note

In the source table for 0x78, the maximum value is listed as 0 and the minimum value as 65535. This document corrects the valid unsigned 16-bit raw-value range to 0-65535.

5.5 Communication and Protection Configuration

Address	Parameter	Length	Readable	Writable	Default	Range/Enumeration	Unit	Description
0x80	Control Response	2	Yes	Yes	-	Not specified	-	-
0x81	servo ID	2	Yes	Yes	-	0-254	-	-
0x82	Baud Rate	2	Yes	Yes	6	See Section 5.6	-	Default: 500 kbps
0x83	Stall Unlock Protection	2	Yes	Yes	-	Not specified	-	-
0x84	Stall Power Limit	2	Yes	Yes	-	Not specified	mW	-
0x85	Undervoltage Protection Voltage	2	Yes	Yes	-	Not specified	mV	-
0x86	Overvoltage Protection Voltage	2	Yes	Yes	-	Not specified	mV	-
0x87	Temperature Protection Threshold	2	Yes	Yes	-	Not specified	-	-
0x88	Power Protection Threshold	2	Yes	Yes	-	Not specified	mW	-
0x89	Current Protection Threshold	2	Yes	Yes	-	Not specified	mA	-
0x8A	Acceleration	2	Yes	Yes	-	Not specified	Not specified	-
0x8B	Power Protection Hysteresis Parameter	2	Yes	Yes	-	Not specified	Not specified	-
0x8C	Power-On Torque Lock Switch	2	Yes	Yes	-	Not specified	-	-
0x8D	Wheel Mode Brake Switch	2	Yes	Yes	-	Not specified	-	-
0x8E	Angle Limit Switch	2	Yes	Yes	-	Not specified	-	-
0x8F	Power-On Soft-Start Switch	2	Yes	Yes	-	Not specified	-	-
0x90	Power-On Soft-Start Time	2	Yes	Yes	-	Not specified	ms	-
0x91	Upper Angle Limit	2	Yes	Yes	-	Not specified	0.1°	-
0x92	Lower Angle Limit	2	Yes	Yes	-	Not specified	0.1°	-
0x93	Center Offset	2	Yes	Yes	-	Not specified	0.1°	-

5.6 Baud Rate Enumeration

Parameter Value	CAN Baud Rate
0	50 kbps
1	100 kbps
2	125 kbps
3	200 kbps
4	250 kbps
5	400 kbps
6	500 kbps (default)
7	750 kbps
8	800 kbps
9	1 Mbps

6. Communication Examples

The following examples show only the application-layer data field and do not include link-layer settings such as the CAN arbitration ID. All bytes are shown in hexadecimal.

6.1 Read the Raw Current Single-Turn Angle

请求：72 01 18
响应：76 01 18 34 12

The raw response value is 0x1234.

6.2 Write and Verify One Parameter

Example: Write the value 0x0520 to address 0x85 on ServoID = 0x01.

Request data:

78 01 85 20 05

If the write succeeds, the device must return:

76 01 85 20 05

6.3 Commit Buffered Motion Parameters

51 01                   # Q：开始连续写入
77 01 52 01 00          # w：角度模式选择 = 1
77 01 59 01 00          # w：执行角度运动 = 1，先进入缓存
71 01                   # q：提交缓存并结束连续写入

7. Host Controller Implementation Requirements

1. Command identifiers must be case-sensitive.
2. Multibyte parameters must be encoded and parsed with the low byte first.
3. When receiving a response, validate at least the DLC, command, ServoID, and address. For a dual-parameter response, also validate both addresses and their order.
4. For responses to x and X, compare the actual response values with the requested values.
5. Do not wait for a response to x or X during continuous writes.
6. For write-only parameters, verify the result according to the specific function outcome or product definition.
7. Do not independently define meanings in a public interface for parameters whose units, scaling, signedness, status bits, or effective timing have not been published.
8. Before changing the servo ID or baud rate, design a communication-recovery and device-identification procedure.