GE Multilin MM300 Motor Management System Communications Guide for revision 1.0x.
MM300 Motor Management System, EnerVista, EnerVista Launchpad, EnerVista MM300
Setup, and FlexLogic are registered trademarks of GE Multilin Inc.
The contents of this manual are the property of GE Multilin Inc. This documentation is
furnished on license and may not be reproduced in whole or in part without the permission
of GE Multilin. The content of this manual is for informational use only and is subject to
change without notice.
Part number: 1601-9025-A1 (July 2007)
TABLE OF CONTENTS
Table of Contents
COMMUNICATIONS GUIDE ............................................................................................................................ i
Data Frame Format and Data Rate........................................................................................................ 2
Data Packet Format .......................................................................................................................................2
Function Code 03H ......................................................................................................................................... 4
Function Code 04H ......................................................................................................................................... 5
Function Code 05H ......................................................................................................................................... 6
Function Code 06H ......................................................................................................................................... 7
Function Code 07H ......................................................................................................................................... 8
Function Code 08H ......................................................................................................................................... 9
Function Code 10H ......................................................................................................................................... 9
Format codes ..................................................................................................................................................34
Performing Commands Using Function Code 10H ....................................................................... 49
Using the User Definable Memory Map..............................................................................................50
The MM300 implements a subset of the Modicon Modbus RTU serial communication
standard. The Modbus protocol is hardware-independent. That is, the physical layer can be
any of a variety of standard hardware configurations. This includes RS232, RS422, RS485,
fibre optics, etc. Modbus is a single master / multiple slave type of protocol suitable for a
multi-drop configuration as provided by RS485 hardware. The MM300 Modbus
implementation employs two-wire RS485 hardware. Using RS485, up to 32 MM300s can be
daisy-chained together on a single communication channel.
The MM300 is always a Modbus slave. It can not be programmed as a Modbus master.
Computers or PLCs are commonly programmed as masters.
Both monitoring and control are possible using read and write register commands. Other
commands are supported to provide additional functions.
Electrical Interface
The hardware or electrical interface in the MM300 is two-wire RS485. In a two-wire link,
data is transmitted and received over the same two wires. Although RS485 two wire
communication is bi-directional, the data is never transmitted and received at the same
time. This means that the data flow is half duplex.
RS485 lines should be connected in a daisy chain configuration with terminating networks
installed at each end of the link (i.e. at the master end and at the slave farthest from the
master). The terminating network should consist of a 120 W resistor in series with a 1 nF
ceramic capacitor when used with Belden 9841 RS485 wire. Shielded wire should always
be used to minimize noise. The shield should be connected to all of the MM300s as well as
the master, then grounded at one location only. This keeps the ground potential at the
same level for all of the devices on the serial link.
NOTE:
Polarity is important in RS485 communications. The '+' (positive) terminals of every device
must be connected together.
E
Data Frame Format and Data Rate
One data frame of an asynchronous transmission to or from a MM300 typically consists of
1 start bit, 8 data bits, and 1 stop bit. This produces a 10 bit data frame. This is important
for transmission through modems at high bit rates (11 bit data frames are not supported
by Hayes modems at bit rates of greater than 300 bps).
Modbus protocol can be implemented at any standard communication speed. The
MM300supports operation at 9600, 19200, 38400, 57600, and 115200 baud.
Data Packet Format
A complete request/response sequence consists of the following bytes (transmitted as
separate data frames):
2MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE
COMMUNICATIONS GUIDERS485 INTERFACE (MODBUS RTU)
Master Request Transmission:
SLAVE ADDRESS: 1 byte
FUNCTION CODE: 1 byte
DATA: variable number of bytes depending on FUNCTION CODE
CRC: 2 bytes
Slave Response Transmission:
SLAVE ADDRESS: 1 byte
FUNCTION CODE: 1 byte
DATA: variable number of bytes depending on FUNCTION CODE
CRC: 2 bytes
SLAVE ADDRESS: This is the first byte of every transmission. This byte represents the userassigned address of the slave device that is to receive the message sent by the master.
Each slave device must be assigned a unique address and only the addressed slave will
respond to a transmission that starts with its address. In a master request transmission the
SLAVE ADDRESS represents the address of the slave to which the request is being sent. In a
slave response transmission the SLAVE ADDRESS represents the address of the slave that
is sending the response.
FUNCTION CODE: This is the second byte of every transmission. Modbus defines function
codes of 1 to 127.
DATA: This will be a variable number of bytes depending on the FUNCTION CODE. This may
be Actual Values, Setpoints, or addresses sent by the master to the slave or by the slave to
the master.
CRC: This is a two byte error checking code.
Error Checking
CRC-16 Algorithm
The RTU version of Modbus includes a two byte CRC-16 (16 bit cyclic redundancy check)
with every transmission. The CRC-16 algorithm essentially treats the entire data stream
(data bits only; start, stop and parity ignored) as one continuous binary number. This
number is first shifted left 16 bits and then divided by a characteristic polynomial
(11000000000000101B). The 16 bit remainder of the division is appended to the end of the
transmission, MSByte first. The resulting message including CRC, when divided by the
same polynomial at the receiver will give a zero remainder if no transmission errors have
occurred.
If a MM300 Modbus slave device receives a transmission in which an error is indicated by
the CRC-16 calculation, the slave device will not respond to the transmission. A CRC-16
error indicates than one or more bytes of the transmission were received incorrectly and
thus the entire transmission should be ignored in order to avoid the MM300 performing
any incorrect operation.
The CRC-16 calculation is an industry standard method used for error detection. An
algorithm is included here to assist programmers in situations where no standard CRC-16
calculation routines are available.
Once the following algorithm is complete, the working register “A” will contain the CRC
value to be transmitted. Note that this algorithm requires the characteristic polynomial to
be reverse bit ordered. The MSBit of the characteristic polynomial is dropped since it does
not affect the value of the remainder. The following symbols are used in the algorithm:
—>: data transfer
A: 16 bit working register
MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE3
RS485 INTERFACE (MODBUS RTU)COMMUNICATIONS GUIDE
AL: low order byte of A
AH: high order byte of A
CRC: 16 bit CRC-16 value
i, j: loop counters
(+): logical exclusive or operator
Di: i-th data byte (i = 0 to N-1)
G: 16 bit characteristic polynomial = 1010000000000001 with MSbit dropped and bit order
reversed
shr(x): shift right (the LSbit of the low order byte of x shifts into a carry flag, a '0' is shifted
into the MSbit of the high order byte of x, all other bits shift right one location
The algorithm is:
1. FFFF hex —> A
2. 0 —> i
3. 0 —> j
4. Di (+) AL —> AL
5. j+1 —> j
6. shr(A)
7. is there a carry? No: go to 8. Yes: G (+) A —> A
8. is j = 8? No: go to 5. Yes: go to 9.
9. i+1 —> i
10. is i = N? No: go to 3. Yes: go to 11.
11. A —> CRC
Timing
Data packet synchronization is maintained by timing constraints. The receiving device
must measure the time between the reception of characters. If 3.5 character times elapse
without a new character or completion of the packet, then the communication link must
be reset (i.e. all slaves start listening for a new transmission from the master). Thus at 9600
baud a delay of greater than 3.5 x 1 / 9600 x 10 x = x 3.65 x ms will cause the
communication link to be reset.
MM300 supported functions
The following functions are supported by the MM300:
•FUNCTION CODE 03 - Read Setpoints and Actual Values
•FUNCTION CODE 04 - Read Setpoints and Actual Values
•FUNCTION CODE 05 - Execute Operation
•FUNCTION CODE 06 - Store Single Setpoint
•FUNCTION CODE 07 - Read Device Status
•FUNCTION CODE 08 - Loopback Test
•FUNCTION CODE 10 - Store Multiple Setpoints
Modbus Functions
Function Code 03H
Modbus implementation: Read Holding Registers
4MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE
COMMUNICATIONS GUIDERS485 INTERFACE (MODBUS RTU)
MM300 implementation: Read Setpoints
For the MM300 implementation of Modbus, this function code can be used to read any
setpoints (“holding registers”). Holding registers are 16 bit (two byte) values transmitted
high order byte first . Thus all MM300 Setpoints are sent as two bytes. The maximum
number of registers that can be read in one transmission is 125.
The slave response to this function code is the slave address, function code, a count of the
number of data bytes to follow, the data itself and the CRC. Each data item is sent as a two
byte number with the high order byte sent first.
For example, consider a request for slave 17 to respond with 3 registers starting at address
006B. For this example the register data in these addresses is as follows:
AddressData
006B022B
006C0000
006D0064
The master/slave packets have the following format:
Table 1: Master/slave packet format for function code 03H
MASTER TRANSMISSIONBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message for slave
FUNCTION CODE103read registers
DATA STARTING ADDRESS200 6Bdata starting at
NUMBER OF SETPOINTS200 033 registers = 6
CRC276 87CRC error code
17
006B
bytes total
Function Code 04H
SLAVE RESPONSEBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message from
slave 17
FUNCTION CODE103read registers
BYTE COUNT1063 registers = 6
bytes
DATA 1 (see definition above) 202 2Bvalue in address
006B
DATA 2 (see definition above) 200 00value in address
006C
DATA 3 (see definition above) 200 64value in address
006D
CRC254 83CRC error code
Modbus Implementation: Read Input Registers
MM300 implementation: Read Actual Values
For the MM300 implementation of Modbus, this function code can be used to read any
actual values (“input registers”). Input registers are 16 bit (two byte) values transmitted high
order byte first . Thus all MM300 Actual Values are sent as two bytes. The maximum
number of registers that can be read in one transmission is 125.
MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE5
RS485 INTERFACE (MODBUS RTU)COMMUNICATIONS GUIDE
The slave response to this function code is the slave address, function code, a count of the
data bytes to follow, the data itself and the CRC. Each data item is sent as a two byte
number with the high order byte sent first .
For example, request slave 17 to respond with 1 register starting at address 0008. For this
example the value in this register (0008) is 0000.
Table 2: Master/slave packet format for function code 04H
MASTER TRANSMISSIONBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message for slave
FUNCTION CODE104read registers
DATA STARTING ADDRESS200 08data starting at
NUMBER OF ACTUAL VALUES 200 011 register = 2 bytes
CRC2B2 98CRC error code
SLAVE RESPONSEBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message from
FUNCTION CODE104read registers
BYTE COUNT1021 register = 2 bytes
DATA (see definition above)200 00value in address
CRC278 F3CRC error code
17
0008
slave 17
0008
Function Code 05H
Modbus Implementation: Force Single Coil
MM300 Implementation: Execute Operation
This function code allows the master to request a MM300 to perform specific command
operations.
For example, to request slave 17 to execute operation code 1 (reset), we have the following
master/slave packet format:
Table 3: Master/slave packet format for function code 05H
MASTER TRANSMISSIONBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message for slave
17
FUNCTION CODE105execute operation
OPERATION CODE200 01operation code 1
CODE VALUE2FF 00perform function
CRC2DF 6ACRC error code
SLAVE RESPONSEBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message from
slave 17
FUNCTION CODE105execute operation
OPERATION CODE200 01operation code 1
CODE VALUE2FF 00perform function
CRC2DF 6ACRC error code
6MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE
COMMUNICATIONS GUIDERS485 INTERFACE (MODBUS RTU)
The commands that can be performed by the MM300 using function code 05 can also be
initiated by using function code 10.
Operation CodeDescription
1Reset
2Lockout Reset
3Stop
4Start A
5Start B
96Clear Last Trip Data Prompt
97Reset MWh and Mvarh Meters
99Clear Counters
100Clear Event Records
102Clear Maintenance Timer
112Clear RTD Maximums
113Reset Motor Information
114Auto Mode
115Manual Mode
116Manual Inhibit
117Manual Restore
Function Code 06H
Modbus Implementation: Preset Single Register
MM300 Implementation: Store Single Setpoint
This command allows the master to store a single setpoint into the memory of a MM300
The slave response to this function code is to echo the entire master transmission.
For example, request slave 17 to store the value 2 in setpoint address 04 5C. After the
transmission in this example is complete, setpoints address 04 5C will contain the value
01F4. The master/slave packet format is shown below:
Table 4: Master/slave packet format for function code 06H
MASTER TRANSMISSIONBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message for slave
17
FUNCTION CODE106store single
setpoint
DATA STARTING ADDRESS204 5Csetpoint address
04 5C
DATA200 02data for setpoint
address 04 5C
CRC2CB B9CRC error code
MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE7
RS485 INTERFACE (MODBUS RTU)COMMUNICATIONS GUIDE
SLAVE RESPONSEBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message from
FUNCTION CODE106store single
DATA STARTING ADDRESS204 5Csetpoint address
DATA200 02data stored in
CRC2CB B9CRC error code
slave 17
setpoint
04 5C
setpoint address
04 5C
Function Code 07H
Modbus Implementation: Read Exception Status
MM300 Implementation: Read Device Status
This is a function used to quickly read the status of a selected device. A short message
length allows for rapid reading of status. The status byte returned will have individual bits
set to 1 or 0 depending on the status of the slave device. For this example, consider the
following MM300 general status byte:
The master/slave packets have the following format:
Table 5: Function code 7 bitmask
BitFunction
0Alarm
1Trip
2Internal fault
3Auto
4Contactor A
5Contactor B
6Contact output 3
7Drive available (communications control)
Table 6: Master/slave packet format for function code 07H
MASTER TRANSMISSIONBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message for slave
FUNCTION CODE107read device status
CRC24C 22CRC error code
SLAVE RESPONSEBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message from
FUNCTION CODE107read device status
DEVICE STATUS (see
definition above)
CRC222 28CRC error code
12Cstatus = 00101100
17
slave 17
(in binary)
8MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE
COMMUNICATIONS GUIDERS485 INTERFACE (MODBUS RTU)
Function Code 08H
Modbus Implementation: Loopback
Test MM300 Implementation: Loopback Test
This function is used to test the integrity of the communication link. The MM300 will echo
the request.
For example, consider a loopback test from slave 17:
Table 7: Master/slave packet format for function code 08H
MASTER TRANSMISSIONBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message for slave
FUNCTION CODE108loopback test
DIAG CODE200 00must be 00 00
DATA200 00must be 00 00
CRC2E0 0BCRC error code
SLAVE RESPONSEBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message from
FUNCTION CODE108loopback test
DIAG CODE200 00must be 00 00
DATA200 00must be 00 00
CRC2E0 0BCRC error code
17
slave 17
Function Code 10H
Modbus Implementation: Preset Multiple Registers
MM300 Implementation: Store Multiple Setpoints
This function code allows multiple Setpoints to be stored into the MM300 memory. Modbus
“registers” are 16-bit (two byte) values transmitted high order byte first. Thus all MM300
setpoints are sent as two bytes. The maximum number of Setpoints that can be stored in
one transmission is dependent on the slave device. Modbus allows up to a maximum of 60
holding registers to be stored. The MM300 response to this function code is to echo the
slave address, function code, starting address, the number of Setpoints stored, and the
CRC.
For example, consider a request for slave 17 to store the value 00 02 to setpoint address
04 5C and the value 01 F4 to setpoint address 04 5D. After the transmission in this example
is complete, MM300 slave 17 will have the following setpoints information stored:
AddressData
04 5C00 02
04 5D01 F4
The master/slave packets have the following format:
MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE9
RS485 INTERFACE (MODBUS RTU)COMMUNICATIONS GUIDE
Table 8: Master/slave packet format for function code 10H
MASTER TRANSMISSIONBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message for slave
FUNCTION CODE110store setpoints
DATA STARTING ADDRESS204 5Csetpoint address
NUMBER OF SETPOINTS200 022 setpoints = 4
BYTE COUNT1044 bytes of data
DATA 1200 02data for setpoint
DATA 2201 F4data for setpoint
CRC231 11CRC error code
SLAVE RESPONSEBYTESEXAMPLEDESCRIPTION
SLAVE ADDRESS111message from
FUNCTION CODE110store setpoints
DATA STARTING ADDRESS204 5Csetpoint address
NUMBER OF SETPOINTS200 022 setpoints
CRC282 7ACRC error code
17
04 5C
bytes total
address 04 5C
address 04 5D
slave 17
04 5C
Error Responses
When a MM300 detects an error other than a CRC error, a response will be sent to the
master. The MSBit of the FUNCTION CODE byte will be set to 1 (i.e. the function code sent
from the slave will be equal to the function code sent from the master plus 128). The
following byte will be an exception code indicating the type of error that occurred.
Transmissions received from the master with CRC errors will be ignored by the MM300.
The slave response to an error (other than CRC error) will be:
SLAVE ADDRESS: 1 byte
FUNCTION CODE: 1 byte (with MSbit set to 1)
EXCEPTION CODE: 1 byte
CRC: 2 bytes
The MM300 implements the following exception response codes:
01 - ILLEGAL FUNCTION
The function code transmitted is not one of the functions supported by the MM300.
02 - ILLEGAL DATA ADDRESS
The address referenced in the data field transmitted by the master is not an allowable
address for the MM300.
03 - ILLEGAL DATA VALUE
The value referenced in the data field transmitted by the master is not within range for the
selected data address.
10MM300 MOTOR MANAGEMENT SYSTEM – COMMUNICATIONS GUIDE
COMMUNICATIONS GUIDERS485 INTERFACE (MODBUS RTU)
Modbus memory map
ModbusHexDescriptionMinMaxStepUnitsFormat DefaultSize in