I tracked the hard fault. It happens when I call any fls_tpm.h function (TPM_StartTimer(), TPM_UpdateChnlEdgeLevelSelect()...)
You can send the message
85 1 30 40 50 60 70 80 90 100 68
85 -> Header
1 -> Command
30, 40, 50, 60, 70, 80, 90, 100 -> Servo Data
68 -> Xor for byte 0 to byte 9
thanks for your help