MODBUS Memory and Data Location Terminology / Register vs. Address ................................................................. 2
Supported MODBUS Message Function Codes ........................................................................................................... 2
Read Command Example .............................................................................................................................................. 3
Special Notes When Using the 4X Addresses .............................................................................................................. 3
Real Time Status ............................................................................................................................................................ 7
Fault Record Retrieval .................................................................................................................................................... 8
LED Indication .............................................................................................................................................................. 10
Identity Object Class Services ......................................................................................................................................11
This guide is addressed to systems integrators who will be developing software for a master device to
communicate with the Model MP8000 product. The software developer is expected to have reasonable working
knowledge (example: understanding what uint16_t Base 10.xx means) for writing programs. This document also
describes the EtherNet/IP features supported by the MP8000. The MP8000 supports Explicit I/O messaging as
defined by the ODVA EtherNet/IP Specification.
NOTE: Littelfuse has developed a PC based program called MP8000 Software. It is available for free and should
work for most applications.
The master device would typically be a Programmable Logic Controller (PLC) or a Personal Computer (PC) that will
communicate with one or more slave devices. A PLC normally would have the command protocols built into it, so
the programmer would not have to develop them. If programming a Personal Computer, these would have to be
developed or find a library online that supports MODBUS TCP or Ethernet/IP.
If programming a PC, it may be worth noting that it is the responsibility of the master controller to initiate
communication. In other words, the master controller must be programmed to periodically poll the slave
devices and initiate a request for data or to issue a command to the Model MP8000 to stop or reset the Model
MP8000’s control relay. When the Model MP8000 responds with the requested data or confirmation of the stop
command, it is the responsibility of the master controller to determine if the information arrived correctly with
no communication errors. If there are communication errors or if there is a time-out waiting for a response, it is
the responsibility of the master controller to reissue the command to the slave device. If the response arrives
correctly, the master controller is then required to further process the data to put it in a form suitable for viewing
by an operator.
Connecting to the MP8000
The RJ45 jack on the side of the MP8000 is the interface for MODBUS TCP and Ethernet/IP. The user can access
the MP8000 via a network or via a direct connection. Accessing the MP8000 via a network can be done by simply
connecting a standard Ethernet cable between the network (switch/router) and the MP8000 RJ45 jack. Another
way to connect via a network that has Wi-Fi is to use a low cost router (example: VONETS VAR11N-300 or similar).
To connect directly from a laptop to the MP8000, connect a standard Ethernet cable between the laptop and
the MP8000 RJ45 jack. You will need to configure according to the instructions in the MP8000 Point to Point
Configuration Document.
MODBUS Memory and Data Location Terminology / Register vs. Address
The MODBUS standard defines a memory location in terms of registers and addresses. The “register”
numbering system starts Xxxxxx1 and goes up to X65536, where the leading X is a reference number that
designates a register type. The “address” numbering system starts at 0 rather than 1 and does not contain
a prefix. The prefix indicates which read and write functions should be used to get or set the corresponding
location. The Modicon MODBUS Protocol Reference Guide refers to these XX references, such as 4X reference
for holding registers.
Older standards and products tend to use a 5-digit numbering system for registers. (Ex: 40,001 for the first
holding register) However, other documentation is written using a 6-digit numbering system; MODBUS supports
registers up to 65536. (Ex: 400,001 for the first holding register).
The “address” numbering system is defined in the standard to describe the message that is actually sent to
the physical communications bus. By starting the addresses at 0 rather than 1 and by truncating the register
type prefix or reference, the number of usable memory or data locations is maximized. This document will use
the terms “address” and “location” interchangeably to refer to the actual address placed on the bus to get the
intended piece of data.
Supported MODBUS Message Function Codes
The following four function codes are supported. The 03 Read and 04 Read functions can be used on any
register. Broadcast is not supported.
1. FUNCTION CODE 03 Read Holding Registers: Block read
2. FUNCTION CODE 04 Read Input Registers: Block read
3. FUNCTION CODE 06 Preset Single Register: Write one value
4. FUNCTION CODE 16 (0x10) Preset Multiple Registers: Block write
Registers are 16 bits. Many MP8000 parameters are stored as 32 bit integers. Therefore, two Register reads or
writes are required when accessing these parameters.
A typical request for a Model MP8000 would be to ask for the 3 voltages (32 bits each) starting at address
0x0226, which are the Voltage between L1-L2, L2-L3, and L3-L1. In the example below, the values will be
returned as 481, 476, and 483 volts for these variables.
Assume that the Model MP8000 has been programmed with a device address of A02. The MODBUS command
message from the master device to a slave device would look like:
Byte Contents Example (in Hex)
1 Address of Slave Device 02
2 Command to Slave Device 03
3 High Byte of Address 02 .(Address of L1-L2)
4 Low Byte of Address 26
5 High Byte of Number of Registers 00 .(Read 6 registers)
6 Low Byte of Number of Registers 06
The above sequence would be a request to read 6 registers (12 bytes) starting at address 0x0226. The normal
response from the slave device to the master device would look something like:
Byte Contents Example (in Hex)
1 Address of Slave Device 02
2 Echo of Command to Slave Device 03
3 Number of Bytes sent back 10
4 High Byte of Word at 0017 00 (L1-L2 = 481)
5 Low Byte of Word at 0017 00
4 High Byte of Word at 0018 01
5 Low Byte of Word at 0018 E1
6 High Byte of Word at 0019 00 (L2-L3 = 476)
7 Low Byte of Word at 0019 00
6 High Byte of Word at 001A 01
7 Low Byte of Word at 001A DC
8 High Byte of Word at 001B 00 (L3-L1 = 483)
9 Low Byte of Word at 001B 00
8 High Byte of Word at 001C 01
9 Low Byte of Word at 001C E3
The voltage values listed would be values that might be expected from a 480 volt system.
The Address and Number-Of-Words-To-Send words are sent with the high byte first followed by the low byte.
Special Notes When Using the 4X Addresses
Some software packages, such as Human-Machine-Interface (HMI) software packages for PLCs, can only use
registers from 400001 to 465536 in the MODBUS 03 and 06 commands.
If this is the case, add 400001 to the hexadecimal addresses in the tables to select the start of the data to read.
Many of these software packages will automatically subtract the 400001 part of the address before sending the
actual address in the MODBUS command.
MP8000 MODBUS MEMORY MAP
Many MP8000 parameters are stored as 32 bit integers. Therefore, two Register (defined as 16 bits) reads or
writes are required when accessing these parameters. See the tables below for address and bit details. Although
all parameters are stored as integers (excluding the device name), the integers may be “scaled” in various ways.
See Table 3 - Memory Map Data Format Codes for details.
There are two methods of requesting a fault record: By index, and by date. (See Table 6)
To request fault records by Index:
1. Write the fault index to the FRI register (0x300). Note, this index is zero based, so the most recent fault
record will have an index of zero.
a. Also the maximum valid index is 1023
2. Write to the CMD register (0x0076) with command 0x11 (see Table 4)
3. Continuously read the FRI register until it has been updated to 0xFFFF
4. The fault record is ready to read, starting at address 0x0308. (see Table 6)
To request fault records by date:
1. Write zero to the FRI register (0x0300).
2. Write the UNIX (32bit) time stamp to the FRO register (0x0304).
a. The log entry with the next earlier time entry will be retrieved.
3. Write to the CMD register (0x0076) with command 0x11 (see Table 4)
4. Continuously read the FRI register until it has been updated to 0xFFFF
5. The fault record is ready to read, starting at address 0x0308. (see Table 6)
Table 6 - Fault Record Retrieval
FIELD
NAME
FRI0x03007682Fault Request Index (Or base DT)CW
FRO0x03027702Fault Request OffsetFW
FCODE0x03047722Fault Code indicating the source of the faultBR
FDT0x03067742Date Time of FaultKR
V1F0x03087762Measured line 1 Voltage RMSHR
V2F0x030A582Measured line 2 Voltage RMSHR
V3F0x030C7802Measured line 3 Voltage RMSHR
I1F0x030E7822Measured line 1 Current RMSHR
I2F0x03107842Measured line 2 Current RMSHR
I3F0x03127862Measured line 3 Current RMSHR
MRTF0x03147882Time since motor startedHR
TCUF0x03167902Thermal Capacity UsedLR
P1F0x03187922Measured line 1 PowerCR
P2F0x031A7942Measured line 2 PowerCR
P3F0x031C7962Measured line 3 PowerCR
PF1F0x031E7981Measured line 1 Power FactorPR
PF2F0x031F7991Measured line 2 Power FactorPR
PF3F0x03208001Measured line 3 Power Factor
IGFF0x03218012Ground Fault CurrentHR
VUBF0x03238031Measured Voltage UnbalanceGR
CUBF0x03248041Measured Current UnbalanceGR
W_CSPFCurrent Single Phasing Detected0x00000008N/A
W_CTCFContactor Failure Detected0x00000010N/A
W_GFFGround Fault Detected0x00000020N/A
W_HPFHigh Power Detected0x00000040N/A
W_LPFLow Power Detected0x00000080
W_LCVFLow Control Voltage Detected0x00000100N/A
W_PTCFPTC Holdoff0x00000200N/A
W_LINLinear Overcurrent Detected0x00000800N/A
W_STALLMotor Stall Detected0x00001000N/A
LVHLow Voltage Holdoff0x00010000100
HVHHigh Voltage Holdoff0x00020000101
VUBHVoltage Unbalanced Holdoff0x00040000102
PHSQPhase Sequence Holdoff0x00080000103
UNDEFFUndefined Holdoff0x00100000N/A
GFALARMGround Fault Alarm0x0080000016
N/A
MP8000 ETHERNET/IP INTERFACE
MP8000 Network Settings
By default, the MP8000 is configured to request its IP address and network configuration from a DHCP server. It
is also possible to set a static IP address using the MP8000 software or Littelfuse smartphone/tablet app.
RSLOGIX5000 Setup
Add a Generic EtherNet/IP Module as a New Module to the PLC. The Comm Format for the MP8000 is
DATA-SINT. The Input Assembly is instance 50 or 51 with a size of 1, and the Output Assembly is instance 2
with a size of 1.
LED Indication
There are two LED’s on the RJ45 connector on the side of the MP8000. The amber LED indicates the existence
of a network connection. The green LED indicates data transfer.