ABB

Modbus Protocol Implementation for

M101-M/M102-M
 Modbus Protocol Implementation for M101-M/M102-M

Table of Contents

1 OBJECTIVE ................................................................................................................................... 2

2 RELATED DOCUMENTATION ...................................................................................................... 2

3 OVERVIEW .................................................................................................................................... 2

4 PROTOCOL IMPLEMENTATION................................................................................................... 2

4.1 Data Frame Format and Data Rate ......................................................................................... 2

4.2 Timing ....................................................................................................................................... 3

4.3 Function Description ............................................................................................................... 3

4.4 Error Responses Description ................................................................................................. 7

5 MEMORY MAP............................................................................................................................... 8

5.1 Memory Map of Actual Value (Input Registers)..................................................................... 8

5.2 Memory map of Holding Registers....................................................................................... 10

6 APPENDIX A USER DEFINABLE MEMORY.......................................................................... 21

7 APPENDIX B CRC-16 ............................................................................................................. 23

1
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

Notes:
1 Objective
This manual provides detailed information on technical implementation of Modbus protocol in M101 and
M102. The products with Modbus protocol here are M101-M and M102-M. It is primarily intended for the
PCS application programmer's implementation and to provide help during installation and
commissioning of the System interfacing.
The knowledge of MODBUS protocol is an added advantage to the reader of this manual.

2 Related Documentation
1TNC911112D0203 M101-M/M102-M User Guide
1TNC911105M0202 M101-M/M102-M Parameter Description

3 Overview
Modbus is one of the protocols employed in M101 and M102. The devices with Modbus are named as
M101-M and M102-M respectively and RS485 is the only physical interface type provided. There are
two identical RS485 interfaces arranged on each device to make the redundant design possible. Via
RS485 interfaces all functions are supported, e.g. parameterization, control, supervisions, etc.
Both M101-M and M102-M implement a subset of the Modicon Modbus RTU serial communication
standard. Modbus is a single master/multiple slave type of protocol suitable for a multi drop
configuration as provided by RS485 hardware. Only a Modbus slave, not a Modbus master, can be
assigned to a M101/M102 device. A Modbus master is usually a PC or a PLC.
Both monitoring and control are possible using read and write register commands. Other commands are
supported to provide additional functions.

4 Protocol implementation

4.1 Data Frame Format and Data Rate

Data Frame is described as follows:

Characteristic RTU
Number of bits per character 10 or 11
Start bits 1
Data bits 8
Parity Even or Odd parity, or no parity
Stop bits 1
Error checking CRC (Cyclical Redundancy Check)

Modbus protocol can be implemented at any standard communication speed. M101-M and M102-M
support operation at 1200, 2400, 4800, 9600, 19200 baud.

DATA PACKET FORMAT

A complete request/response sequence consists of the following bytes (transmitted as separate data
frames):
Master Request Transmission:
SLAVE ADDRESS: 1 byte
FUNCTION CODE: 1 byte
DATA: variable number of bytes depending on FUNCTION CODE
CRC: 2 bytes
Slave Response Transmission:
SLAVE ADDRESS: 1 byte

2
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

FUNCTION CODE: 1 byte

Notes:
DATA: variable number of bytes depending on FUNCTION CODE
CRC: 2 bytes
SLAVE ADDRESS: This is the first byte of every transmission. This byte represents the user-assigned
address of the slave device that is to receive the message sent by the master. Each slave device must
be assigned a unique address and only the addressed slave will respond to a transmission that starts
with its address. In a master request transmission the SLAVE ADDRESS represents the address of the
slave to which the request is being sent. In a slave response transmission the SLAVE ADDRESS
represents the address of the slave that is sending the response.
Note: A master transmission with a SLAVE ADDRESS of 0 indicates a broadcast command.
Broadcast commands can be used only in certain situations.
FUNCTION CODE: This is the second byte of every transmission. Modbus defines function codes of 1
to 127. M101-M and M102-M support FUNCTION CODE 03, 04, 05, 06, 08 and 10. In a master request
transmission the FUNCTION CODE tells the slave what action to perform. In a slave response
transmission the FUNCTION CODE tells the master what function was performed as requested. If the
high order bit of the FUNCTION CODE sent from the slave is a 1 (i.e. if the FUNCTION CODE is >127)
then the slave did not perform the function as requested and is sending an error or exception response.
DATA: This will be a variable number of bytes depending on the FUNCTION CODE. This may be Actual
Values, Settings, or addresses sent by the master to the slave or by the slave to the master. See
Section 3.
CRC: This is a two-byte error checking code.
ERROR CHECKING
The RTU version of Modbus includes a two byte CRC-16 (16 bit cyclic redundancy check) with every
transmission. The CRC-16 algorithm is shown in Appendix B.

4.2 Timing
Data packet synchronization is maintained by timing constraints. The receiving device must measure
the time between the reception of characters. If 3.5 character times elapse without a new character or
completion the packet, then the communication link must be reset (i.e. all slaves start listening for a new
transmission from the master). Thus at 9600 baud a delay of greater than 4.01ms
(3.5X1/9600X11X1000) will cause the communication link to be reset.

4.3 Function Description

The following functions are supported in M101 and M102 Modbus Implementation:
• FUNCTION CODE 03 - Read Parameters and Actual Values
• FUNCTION CODE 04 - Read Parameters and Actual Values
• FUNCTION CODE 05 - Execute Operation
• FUNCTION CODE 06 - Store Single parameter
• FUNCTION CODE 08 – Loop back Test
• FUNCTION CODE 10 - Store Multiple parameters

4.3.1 FUNCTION CODE 03H

Standard Modbus implementation: Read Holding Registers
M101-M/M102-M Modbus implementation: Read Parameters and Actual Values
For M101-M/M102-M implementation of Modbus, this command can be used to read any parameters
("holding registers") or actual values ("input registers"). Holding and input registers are 16 bit (two byte)
values transmitted high order byte first. Thus all parameters and actual values are sent in two bytes.
The maximum number of registers that can be read in one transmission is 125. This function code is
identical to function code 04.

3
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

Notes:
The slave response to this function code is the slave address, function code, a count of the number of
data bytes to follow, the data itself and the CRC. Each data item is sent as a two-byte number with the
high order byte sent first.
For example, to request slave 1 to respond with 1 register starting at address 1021. For this example
the value in this register (1021) is 0023.

MASTER TRANSMISSION BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 03 Read registers
DATA STARTING ADDRESS 2 10 21 Data starting at 1021
NUMBER OF ACTUAL VALUES 2 00 01 1 registers = 2 bytes total
CRC 2 D0 C0 CRC error code

SLAVE RESPONSE BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 03 Read registers
BYTE COUNT 1 02 1 registers = 2 bytes total
DATA 2 00 23 Value in address 0008
CRC 2 F9 9D CRC error code

4.3.2 FUNCTION CODE 04H

Standard Modbus Implementation: Read Input Registers
M101-M/M102-M Modbus implementation : Read Parameters and Actual Values
For the M101 and M102 implementation of Modbus, this command can be used to read any Parameters
("holding registers") or actual values ("input registers"). Holding and input registers are 16 bit (two byte)
values transmitted high order byte first. Thus all parameters and actual values are sent in two bytes.
The maximum number of registers that can be read in one transmission is 125. This function code is
identical to function code 03.
The slave response to this function code is the slave address, function code, a count of the data bytes to
follow, the data itself and the CRC. Each data item is sent as a two bytes number with the high order
byte sent first.
For example, consider a request for slave 1 to respond with 3 registers starting at address 0023. For
this example the register data in these addresses is shown below:

Address(Hex) Data(Hex)
0023 00DB
0024 00DA
0025 00DB

The master/slave packet format is shown below:

MASTER TRANSMISSION BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
Read registers for phase
FUNCTON CODE 1 04
voltages
DATA STARTING ADDRESS 2 00 23 Data starting at 0023
NUMBER OF REGISTERS 2 00 03 3 registers = 6 bytes total
CRC 2 41 C1 CRC error code

SLAVE RESPONSE BYTES EXAMPLE(Hex) DESCRIPTION

4
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

SLAVE ADDRESS 1 01 Message for slave 1

Notes:
Read registers for phase
FUNCTON CODE 1 04
voltage
BYTE COUNT 1 06 3 registers = 6 bytes
DATA 1 (see definition above) 2 00 DB Value in address 0023
DATA 2 (see definition above) 2 00 DA Value in address 0024
DATA 3 (see definition above) 2 00 DB Value in address 0025
CRC 2 65 20 CRC error code

4.3.3 FUNCTION CODE 05H

Standard Modbus Implementation: Force Single Coil
M101-M/M102-M Modbus implementation: Execute Operation
This function code allows the master to request a slave device to perform specific command operations.
The commands supported are listed in F18.
Note: For Group control command, the broadcast address 0 should be used.
For example, to request slave 1 to execute ‘Stop’ for Start1 mode, we have the following master/slave
packet format:

MASTER TRANSMISSION BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 05 Execute operation
MODE CODE 2 00 01 Start1 mode
OPERATION CODE 2 FF 00 Execute stop
CRC 2 7C 3A CRC error code

SLAVE RESPONSE BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 05 Execute operation
MODE CODE 2 00 01 Start1 mode
OPERATION CODE 2 FF 00 Execute stop
CRC 2 7C 3A CRC error code

4.3.4 FUNCTION CODE 06H

Standard Modbus Implementation: Preset Single Register
M101 M102 Modbus implementation: Store Single Parameter
This command allows the master to store a single parameter into the memory. The slave response to
this function code is to echo the entire master transmission.
For example, request slave 1 to store the value 017C in parameter address 1027. After the transmission
in this example is complete, parameter address 1027 will contain the value 017C.
The master/slave packet format is shown below:

MASTER TRANSMISSION BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 06 Store single parameter

5
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

DATA STARTING ADDRESS 2 10 27 parameter address 1027

Notes:
Data stored in parameter
DATA 2 01 7C
address 1027
CRC 2 3D 70 CRC error code

SLAVE RESPONSE BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 06 Store single parameter
DATA STARTING ADDRESS 2 10 27 Parameter address 1027
Data stored in parameter
DATA 2 01 7C
address 1027
CRC 2 3D 70 CRC error code

4.3.5 FUNCTION CODE 08H

Standard Modbus Implementation: Loopback Test
M101 M102 Modbus implementation: Loopback Test
This function is used to test the integrity of the communication link. The slave device will echo the
request.
For example, consider a loopback test for slave 1:

MASTER TRANSMISSION BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 08 Loop back test
DIAG CODE 2 00 00 Must be 00 00
DATA 2 00 00 Must be 00 00
CRC 2 E0 0B CRC error code

SLAVE RESPONSE BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 08 Loop back test
DIAG CODE 2 00 00 Must be 00 00
DATA 2 00 00 Must be 00 00
CRC 2 E0 0B CRC error code

4.3.6 FUNCTION CODE 10H

Standard Modbus Implementation: Preset Multiple Registers
M101-M/M102-M Implementation: Store Multiple Parameters
This function code allows multiple Parameters to be stored into the memory. Modbus "registers" are
16-bit (two byte) values transmitted high order byte first. Thus all Parameters are sent as two bytes. The
maximum number of Parameters that can be stored in one transmission is dependent on the slave
device. Modbus allows up to a maximum of 60 holding registers to be stored. The slave device
response to this function code is to echo the slave address, function code, starting address, the number
of Parameters stored, and the CRC.
For example, consider a request for slave 1 to store the value 0190 to parameter address 1036 and the
value 0005 to parameter address 1037. After the transmission in this example is complete, slave 1 will
have the following information stored:

6
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

Address(Hex) Data(Hex)
Notes:
1036 0190
Notes: 1037 0005

The master/slave packet format is shown below:

MASTER TRANSMISSION BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 10 Store parameters
DATA STARTING ADDRESS 2 10 36 Parameter address 1036
NUMBER OF REGISTER 2 00 02 2 parameters = 4 bytes total
BYTE OF COUNT 1 04 4 bytes of data
Data for parameter address
DATA 1 2 01 90
1036
Data for parameter address
DATA 2 2 00 05
1037
CRC 2 7C 83 CRC error code

SLAVE RESPONSE BYTES EXAMPLE(Hex) DESCRIPTION

SLAVE ADDRESS 1 01 Message for slave 1
FUNCTON CODE 1 10 Store parameters
DATA STARTING ADDRESS 2 10 36 register address 1036
NUMBER OF REGISTER 2 00 02 2 parameters
CRC 2 A5 06 CRC error code

4.4 Error Responses Description

When a M101-M or a M102-M device detects an error other than a CRC error, a response will be sent to
the master. The MSBit of the FUNCTION CODE byte will be set to 1 (i.e. the function code sent from the
slave will be equal to the function code sent from the master plus 128). The following byte will be an
exception code indicating the type of error that occurred.
Transmissions received from the master with CRC errors will be ignored.
The slave response to an error (other than CRC error) will be:
SLAVE ADDRESS: 1 byte
FUNCTION CODE: 1 byte (with MSbit set to 1)
EXCEPTION CODE: 1 byte
CRC: 2 bytes
The device implements the following exception response codes.
• 01 - ILLEGAL FUNCTION
The function code transmitted is not one of the functions supported.
• 02 - ILLEGAL DATA ADDRESS
The address referenced in the data field transmitted by the master is not listed in the memory map..
• 03 - ILLEGAL DATA VALUE
The value referenced in the data field transmitted by the master is not within range for the selected data
address.

7
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

Notes: 5 Memory Map

Small differences exist in between M101-M and M102-M in the following memory map. Less registers and data
can be found due to simpler functionality in M101-M. The differences are clearly marked with ‘* ’ in the relevant
content followed by an explanation.

The data stored is grouped into two areas: Parameters and Actual values. Parameters can be read and
written by a master. Actual values can be read only. All parameters and actual values are stored as two
byte values. That is, each register is the address of two byte value.

5.1 Memory Map of Actual Value (Input Registers)

GROUP REGISTER DESCRIPTION REGISTER STEP UNITS & FORMAT

ADDRESS VALUE VALUE SCALE
RANGE
Actual Value (Input Registers) Address 0000-0FFF
PRODUCT ID 0000 Product Device ASCⅡ
Code char1&2
0001 Product Device ASCⅡ
Code char3&4
0002 Product Device ASCⅡ
Code char5&6
0003 Product Device ASCⅡ
Code char7&8
0004 Product Device ASCⅡ
Code char9&10
0005 Product Device ASCⅡ
Code char11&12
0006 Product Device ASCⅡ
Code char13&14
0007 Product Device ASCⅡ
Code char15
0008 Hardware Version ASCⅡ
0009 Software Version ASCⅡ
Code
000A Serial Number ASCⅡ
char1 &2
000B Serial Number ASCⅡ
char3 &4
000C Serial Number ASCⅡ
char5 &6
000D Serial Number ASCⅡ
char7 &8
000E Serial Number ASCⅡ
char9&10
000F Serial Number ASCⅡ
char 11&12
0010 …Reserved…
0011 …Reserved…
0012 …Reserved…
0013 …Reserved…
0014 …Reserved…
0015 …Reserved…
0016 …Reserved…
STATUS 0017 Digital input F9
status
0018 …Reserved…
0019 Motor Status F8
001A Start Trigger F10
source
001B Stop Trigger F5
source
001C …Reserved…

8
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

001D Alarm Flag1 F1

Notes: 001E Alarm Flag2 F2
001F Trip Active Status F3
Flag1
0020 Trip Active Status F4
Flag2
0021 Set_Para_Status F29
0022 …Reserved…
MOTOR DATA 0023*(see Phase L1-N V Unsigned
note1) Voltage *(see Integer
note1)
0024*(see Phase L2-N V Unsigned
note1) Voltage *(see Integer
note1)
0025 *(see Phase L3-N V Unsigned
note1) Voltage *(see Integer
note1)
0026 *(see Phase L1-L2 V Unsigned
note1) Voltage *(see Integer
note1)
0027 *(see Phase L2-L3 V Unsigned
note1) Voltage *(see Integer
note1)
0028 *(see Phase L3-L1 V Unsigned
note1) Voltage *(see Integer
note1)
0029 Phase A Current %FLC Unsigned
Integer
002A Phase B Current %FLC Unsigned
Integer
002B Phase C Current %FLC Unsigned
Integer
002C Ground Fault mA Unsigned
Current Integer
002D Thermal Capacity % Unsigned
Integer
002E O/L time to trip S Unsigned
Integer
002F Pre Trip Phase A %FLC Unsigned
current Integer
0030 Pre Trip Phase B %FLC Unsigned
current Integer
0031 Pre Trip Phase C %FLC Unsigned
current Integer
0032 Pre Trip Ground mA Unsigned
Current Integer
0033 *(see Power Factor ×0.01 Unsigned
note1) *(see note1) Integer
0034 *(see Power *(see Unsigned
note1) note1) Integer

0035 *(see Energy used (H) kWh Unsigned

note1) *(see note1) Long
0036 *(see Energy used (L) Integer
note1) *(see note1)
0037 *(see Frequency *(see X0.01Hz Unsigned
note1) note1) Integer
0038 *(see Thermistor Ω Unsigned
note1) value *(see note1) Integer
0039 …Reserved…
003A …Reserved…
003B …Reserved…
MAINTENANCE 003C Running Time Hr. Unsigned
&STATISTICS integer

9
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

003D Stopped Time Hr. Unsigned

Notes: integer
003E Number of Starts Unsigned
integer
003F …Reserved…
0040 …Reserved…
0041 Last alarm 0-20 1 - F26
0042 Hr. of alarm 0-23 1 Hr. Unsigned
timetag integer
0043 mm. of alarm 0-59 1 M Unsigned
timetag integer
0044 Se. of alarm 0-59 1 S Unsigned
timetag integer
0045 Ms of alarm 0-10 1 100ms Unsigned
timetag integer
0046 Last trip 0-20 1 - F27
0047 Hr. of trip timetag 0-23 1 Hr. Unsigned
integer
0048 mm. of trip 0-59 1 M Unsigned
timetag integer
0049 Se. of trip 0-59 1 S Unsigned
timetag integer
004A Ms of trip 0-10 1 100ms Unsigned
timetag integer
004B Last operation 1-17 1 - F18
004C Hr. of operation 0-23 1 Hr. Unsigned
timetag integer
004D mm. of operation 0-59 1 M Unsigned
timetag integer
004E Se. of operation 0-59 1 S Unsigned
timetag integer
004F Ms of operation 0-10 1 100ms Unsigned
timetag integer
USER 0050 User Definable
DEFINABLE Data 0
DATA 0051 User Definable
↓ Data 1
0052 User Definable
Data 2
0053 User Definable
Data 3
0054 User Definable
Data 4
0055 User Definable
Data 5
0056 User Definable
Data 6
0057 User Definable
Data 7
0058 User Definable
Data 8
↓ ↓ ↓ ↓ ↓ ↓
009F User Definable
Data 4F

5.2 Memory map of Holding Registers

GROUP REG DESCRIPTION VALUE STEP UNITS FORMAT

ADD. RANGE VALUE &
SCALE

10
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

Starter ID 1000 Starter ID CHAR ASCⅡ

Notes: (Motor control) 1&2
1001 Starter ID CHAR ASCⅡ
3&4
1002 Starter ID CHAR ASCⅡ
5&6
1003 Starter ID CHAR ASCⅡ
7&8
1004 Starter ID CHAR ASCⅡ
9&10
1005 Starter ID CHAR ASCⅡ
11&12
1006 Starter ID CHAR ASCⅡ
13&14
1007 Starter ID CHAR ASCⅡ
15&16
1008 Starter ID CHAR ASCⅡ
17&18
1009 Starter ID CHAR ASCⅡ
19&20
Motor Information 100A Motor ID CHAR 1&2 ASCⅡ
100B Motor ID CHAR 3&4 ASCⅡ
100C Motor ID CHAR 5&6 ASCⅡ
100D Motor ID CHAR 7&8 ASCⅡ
100E Motor ID CHAR ASCⅡ
9&10
100F Motor ID CHAR ASCⅡ
11&12
1010 Motor ID CHAR ASCⅡ
13&14
1011 Motor ID CHAR ASCⅡ
15&16
1012 Motor ID CHAR ASCⅡ
17&18
1013 Motor ID CHAR ASCⅡ
19&20
1014 System Supply 220-690 1 V Unsigned
*(see Voltage integer
note1)
1015 Frequency 45-60 Hz Unsigned
integer
1016 Number of Phases 1/3 Unsigned
integer
1017 Motor Power Rating 1-99 1 0.01 × Unsigned
(see note2) kW integer
10-1000 1 0.1×kW

1018 Motor Nominal 0-20000 1 X 0.01A Unsigned

Current X 0.1A Integer
*(see note4)
1019 Motor Nominal 0-20000 1 X 0.01A Unsigned
*(see Current (N2) X 0.1A Integer
note1&4)
Motor control 101A Starter Type 1-15 1 F12
101B Startup Time (N1) 1-250 1 s Unsigned
Integer
101C Startup Time (N2) 1-250 1 s Unsigned
*(see Integer
note1)
101D Changeover Time 1-250 1 s Unsigned
Integer

11
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

101E Ramp Up Time 1-250 1 s Unsigned

Notes: *(see Integer
note1)
101F Ramp Down Time 1-250 1 s Unsigned
*(see Integer
note1)
1020 Failsafe Mode 0-5 1 F13
1021 External CT Used 0-1 0 F16
1022 Internal CT Primary 1-630 1 X 0.1A Unsigned
integer
1023 External CT1 1-2000 1 A Unsigned
Primary integer
1024 External CT2 1-2000 1 A Unsigned
*(see Primary integer
note1)
1025 Earth Fault Primary 500-5000 100 mA Unsigned
Integer
1026 Feedback_able 0-1 Unsigned
*(see Integer
note1)
1027 Voltage Input (L-N) 110-250 Unsigned
*(see integer
note1)
1028 …Reserved…
o
1029 Ambient 0-70 1 C Unsigned
Temperature integer
102A …Reserved…
TOL Protection 102B Thermal Model 0-1 1 F14
102C T6 3-40 1 s Unsigned
Integer
102D Ia/In 12-80 1 ×0.1 Unsigned
Integer
102E Te 1-250 1 s Unsigned
Integer
102F Cool Coe. 1-10 1 Unsigned
Integer
1030 Thermal Alarm Level 60-100 1 % Unsigned
Integer
1031 Thermal Trip Level 60-100 1 % Unsigned
Integer
1032 Thermal Reset Level 10-60 1 % Unsigned
Integer
1033 TOL Trip Reset 1-4 1 F15
Mode
1034 TOL Bypass 0-1 0 F16
Enable/Disable
Stall Protection 1035 ENABLE/DISABLE 0-1 1 F16
1036 Trip Level 120-800 10 % Unsigned
integer
1037 Trip Delay 0-250 1 X0.1s Unsigned
integer
1038 Trip reset mode 2-4 1 F15
Phase Failure 1039 ENABLE/DISABLE 0-1 1 F16
Protection 103A Alarm Level 10-90 1 % Unsigned
integer
103B Trip Level 5-90 1 % Unsigned
integer
103C Trip Delay 0-60 1 s Unsigned
integer
103D Trip Reset Mode 2-4 1 F15
Unbalance 103E ENABLE/DISABLE 0-3 1 F16
Protection 103F Alarm Level 50-90 1 % Unsigned
integer

12
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

1040 Trip Level 50-90 1 % Unsigned

Notes: integer
1041 Trip Delay 0-60 1 % Unsigned
integer
1042 Trip Reset Mode 2-4 1 F15
1043 …Reserved…
Underload 1044 ENABLE/DISABLE 0-3 1 F16
Protection 1045 Alarm Level 20-90 1 % Unsigned
integer
1046 Trip Level 5-90 1 % Unsigned
integer
1047 Trip Delay 0-1800 1 s Unsigned
integer
1048 Trip Reset Mode 2-4 1 F15
1049 …Reserved…
Noload Protection 104A ENABLE.DISABLE 0-3 1 F16
104B Alarm Level 5-50 1 % Unsigned
integer
104C Trip Level 5-50 1 % Unsigned
integer
104D Trip Delay 0-1800 1 s Unsigned
integer
104E Trip Reset Mode 2-4 1 F15
104F …Reserved…
Earth Fault 1050 ENABLE/DISABLE 0-3 1 F16
Protection 1051 Alarm Level 1-50 1 ×0.1A Unsigned
integer
1052 Trip Level 1-50 1 ×0.1A Unsigned
integer
1053 Trip Delay 2-600 2 ×0.1s Unsigned
integer
1054 Trip Reset Mode 2-4 1 F15
1055 …Reserve…
PTC Protection 1056 ENABLE/DISABLE 0-3 1 F16
*(see note1) *(see
note1)
1057 Alarm Level 100-10000 100 Ω Unsigned
*(see integer
note1)
1058 Trip Level 100-10000 1 Ω Unsigned
*(see integer
note1)
1059 Trip Delay 1-1800 1 s Unsigned
*(see integer
note1)
105A Reset Level 100-10000 100 Ω Unsigned
*(see integer
note1)
105B Trip Reset Mode 1-4 F15
*(see
note1)
105C …Reserve…
105D …Reserve…
105E …Reserve…
Undervoltage 105F ENABLE/DISABLE 0-3 1 F16
Protection *(see *(see
note1) note1)
1060 Alarm Level 50-100 1 % Unsigned
*(see integer
note1)
1061 Trip Level 50-100 1 % Unsigned
*(see integer
note1)

13
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

1062 Trip Delay 2-50- 1 0.1Xs Unsigned

Notes: *(see integer
note1)
1063 Reset Level 50-100 1 s Unsigned
*(see integer
note1)
1064 Trip Reset Mode F15
*(see
note1)
1065 …Reserve…
1066 …Reserve…
1067 Enable/disable 0-3 1 F16
*(see
note1)
Auto restart *(see 1068 Function mode 0-1 1
note1) *(see
note1)
1069 Max. autoreclose 100-1000 100 ms Unsigned
*(see Time integer
note1)
106A Max. Power Down 0-1200 1 s Unsigned
*(see Time integer
note1)
106B Staggered Start 0-1200 1 s Unsigned
*(see Delay integer
note1)
106C …Reserve…
106D …Reserve…
Predefined inputs 106E Start1 Disable/ 0-1 0 F16
*(see Enable
note1)
106F Start2 Disable/ 0-1 0 F16
*(see Enable
note1)
1070 Stop Disable/Enable 0-1 0 F16
*(see
note1)
1071 Limit1 0-1 0 F16
*(see Disable/Enable
note1)
1072 Limit2 0-1 0 F16
*(see Disable/Enable
note1)
1073 LOC/R 0-1 0 F16
Disable/Enable
1074 …Reserved…
Programmable 1075 Programmable Input 0-1 1 F24
inputs 0 Type
1076 Input 0 Function 1-15 1 F19
1077 Operation Delay 0-3600 1 s Unsigned
after Startup integer
1078 Duration during 0-3600 1 s Unsigned
Running integer
1079 Operation 0-1 1 F21
107A Alarm 0-1 1 F16
107B Programmable Input 0-1 1 F24
1 Type
107C Input 1 Function 1-15 1 F19
107D Operation Delay 0-3600 1 s Unsigned
after Startup integer
107E Duration during 0-3600 1 s Unsigned
Running integer
107F Operation 0-1 1 F21
1080 Alarm 0-1 1 F16

14
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

1081 Programmable Input 0-1 1 F24

Notes: 2 Type
1082 Input 2 Function 1-15 1 F19
1083 Operation Delay 0-3600 1 s Unsigned
after Startup integer
1084 Duration during 0-3600 1 s Unsigned
Running integer
1085 Operation 0-1 1 F21
1086 Alarm 0-1 1 F16
Programmable 1087 Programmable 0-10 1 F28
outputs output 1 function
1088 Start/stop delay 0-125 1 s F1
1089 Programmable 1-10 1 F
output 2 function
*(see note1)
108A Start/Stop Delay 0-125 1 s F1
*(see note1)
108B …Reserve…
108C …Reserve…
Control authority 108D Control Mode 1-8 F17
108E …Reserve…
COMMS 108F Modbus Baud Rate 1-5 1 F20
1090 Parity Check 0-2 1 F22
1091 Redundancy 0/1 1 F16
disable/enable
1092 Communication 5-25 1 s Unsigned
Failure Delay integer
1093 Device Address 1-127 1 Unsigned
integer
Maintainence 1094 Running Time Alarm 1-65534 1 Hr. Unsigned
level integer
1095 …Reserved…
1096 Start Number Alarm 1-65534 Unsigned
level integer
1097 …Reserved…
1098 …Reserved…
1099 …Reserved…
Motor Grouping 109A Enable/Disable 0-1 1 F16
109B Group Number 1-9 1 Unsigned
integer
109C Group ID. Char1&2 ASCⅡ
109D Group ID. Char3&4 ASCⅡ
109E Group ID. Char5&6 ASCⅡ
109F Group ID. Char7&8 ASCⅡ
10A0 Group ID. Char9&10 ASCⅡ
10A1 Group ID. ASCⅡ
Char11&12
10A2 Group ID. ASCⅡ
Char13&14
10A3 Group ID. ASCⅡ
Char15&16
10A4 Group Start 0/1 1 F25
Direction
10A5 Group Start Delay 0-300 1 s Unsigned
integer
10A6 Group Stop Delay 0-300 1 s Unsigned
integer
10A7 …Reserved…
10A8 …Reserved…
Start limitation 10A9 Enable/Disable 0-1 1 F16
10AA Time interval 1-600 1 min Unsigned
integer

15
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

10AB Number of start 2-10 1 Unsigned

Notes: integer
10AC Trip reset mode 1-4 1 F15
10AD …Reserved…
TIMER 10AE HOUR (H) 0-23 Unsigned
SYNCHRONIZE. MIN (L) 0-59 integer
10AF S (H) 0-59 Unsigned
MS (L) 0-999 integer
…Reserved…
USER DEF. 1100 Register 0000-114F 1 Unsigned
MEM. MAP DATA address-User integer
Definable Data 0000
1101 Register 0000-114F 1 Unsigned
address-User integer
Definable Data 0001
1102 Register 0000-114F 1 Unsigned
address-User integer
Definable Data 0040
1103 Register 0000-114F 1 Unsigned
address-User integer
Definable Data 0002
↓ ↓ ↓ ↓ ↓ ↓
114F Register 0000-114F 1 Unsigned
address-User integer
Definable Data 004F

Data format
FORMAT CODE DESCRIPTION BITMASK
F1 Alarm Status Flag1 FFFF
Thermal Capacity 0001
Overload 0002
Phase Failure 0004
Phase unbalance 0008
Underload 0010
Noload 0020
Earth Fault 0040
PTC *(see note1) 0080 *(see note1)
Undervoltage *(see note1) 0100 *(see note1)
Autoreclose *(see note1) 0200 *(see note1)
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
F2 Alarm Status Flag2 FFFF
Contactor Feedback 0001
--- ---
Welded Contactor 0004
--- ---
Drive Failed to Start *(see note1) 0010
Drive Failed to Stop *(see note1) 0020
Start limitation 0040
Serial Communication 0080
Running time 0100
Start number 0200
Programmable input 0 0400
Programmable input 1 0800
Programmable input 2 1000
--- ---
--- ---

16
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

--- ---
Notes: F3 Trip Status Flag1 FFFF
TOL 0001
Stalled rotor 0002
Phase Failure 0004
Phase unbalance 0008
Underload 0010
Noload 0020
Earth fault 0040
PTC *(see note1) 0080 *(see note1)
Undervoltage *(see note1) 0100 *(see note1)
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
F4 Trip Status Flag2 FFFF
Contactor Feedback 0001
--- ---
Programmable Input0 0004
Programmable Input1 0008
Programmable Input2 0010
Serial Communication failure 0020
Start limitation 0040
Feeder Trip 0080
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
F5 Stop Trigger Source FFFF
RCU stop 0001
Stop I/O input *(see note1) 0002 *(see note1)
MDStop 0004
PCS(fieldbus control) Stop 0008
Programmable input0 stop 0010
Programmable input1 stop 0020
Programmable input2 stop 0040
Limit1 input stop *(see note1) 0080 *(see note1)
Limit2 input stop *(see note1) 0100 *(see note1)
Emergency stop 0200
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
F7

F8 Motor Status FFFF

Running CW 0001

17
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

Running CCW 0002

Notes: Alarm 0004
Trip 0008

F9 Digital Input Status FFFF

Contactor A 0001
Contactor B 0002
Contactor C *(see note1) 0004 *(see note1)
--- ---
Stop I/O *(see note1) 0010 *(see note1)
Start1 I/O *(see note1) 0020 *(see note1)
Start2 I/O *(see note1) 0040 *(see note1)
Limit switch1 *(see note1) 0080 *(see note1)
Limit Switch2 *(see note1) 0100 *(see note1)
Main switch Status *(see note1) 0200 *(see note1)
Local/remote 0400
Programmable input0 0800
Programmable Input1 1000
Programmable Input2 2000
F10 Start trigger Source FFFF
RCU Start 0001
Start I/O input *(see note1) 0002 *(see note1)
MD Start 0004
PCS (Fieldbus Control)Start 0008
Programable input0 start 0010
Programable input1 start 0020
Programable input2 start 0040

--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
--- ---
F11 Motor Type FFFF
0= Single Phase 0000
1=Three Phase 0001

F12 Starter Type FFFF

1= NR_DOL 0001
2= NR_DOL/RCU 0002
3= REV_DOL 0003
4= REV_DOL/RCU 0004
5= Actuator *(see note1) 0005
6= NR_S/D *(see note1) 0006
7= ---Reserved--- 0007
8= NR_2N *(see note1) 0008
9= ---Reserved--- 0009
10= ---Reserved--- 000A
11= ---Reserved--- 000B
12= Autotransformer *(see note1) 000C
13=NR-Softstarter *(see note1) 000D
14=REV-Softstarter *(see note1) 000E
15=Feeder*(see note1) 000F
F13 Failsafe Mode FFFF

18
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

0=NOP 0000
Notes: 1=Start (CW) 0001
2=Start (CCW) 0002
3=Trip 0003
4=Reserved… ---
5=Reserved… ---
F14 Thermal Model FFFF
0=Standard 0000
1=EEx e -0001

F15 Trip Reset Mode FFFF

1=Auto 0001
2=Local 0002
3=Remote 0003
4=Remote & local 0004
F16 Enable/Disable FFFF
0=Disable 0000
1=Enable 0001
2=…Reserved… 0002
3=Alarm only 0003
F17 Control Mode FFFF
RCU 0001
MD (Operator panel) 0002
DCS Hardwiring 0004
PCS Fieldbus 0008
F18 Command FFFF
1=Start1Coil 0001
2=Start2 Coil 0002
3=Stop 0003
4=---Reserved--- 0004
5=---Reserved--- 0005
6=Clear Maintenance Timers 0006
7=Clear Maintenance Counters 0007
8=Clear Energy Data 0008
9---Reserved--- 0009
10=Active TOL bypass 000A
11=Programmable relay output 1 close 000B
12= Programmable relay output 1 open 000C
13= Programmable relay output 2 close 000D
*(see note1)
14= Programmable relay output 2 open 000E
*(see note1)
15= Trip Reset 000F
256=Group 1 Stop 0100
257=Group 1 Start 0101
512=Group 2 Stop 0200
513=Group 2 Start 0201
768=Group 3 Stop 0300
769 Group 3 Start 0301
1024=Group 4 Stop 0400
1025 Group 4 Start 0401
1280=Group 5 Stop 0500
1281 Group 5 Start 0501
1536=Group 6 Stop 0600
1537=Group 6 Start 0601
1792=Group 7 Stop 0700
1793=Group 7 Start 0701
2048=Group 8 Stop 0800
2049=Group 8 Start 0801
2304=Group 9 Stop 0900
2305=Group 9 Start 0901
F19 Programmable input function FFFF

19
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

1=Start1 0001
Notes: 2=Start2 0002
3=Stop 0003
4---Reserved--- 0004
5---Reserved--- 0005
6=Process interlock 1 0006
7=Process interlock 2 0007
8=Test Position 0008
9=Emergency Stop 0009
10=PLC control 000A
11=Trip reset 000B
12=Serial control disable 000C
13=Torque switch 000D
15=NOP 000F
F20 MODBUS Baud Rate FFFF
1=1200 0001
2=2400 0002
3=4800 0003
4=9600 0004
5=19200 0005
F21 Programmable input operation FFFF
0=Stop 0000
1=Latched trip 0001

F22 Parity check FFFF

0=None 0000
1=Odd 0001
2=Even 0002
F24 Programmable input type FFFF
0=NC 0000
1=NO 0001

F25 Group Start Direction FFFF

0=CW 0000
1=CCW 0001

F26 The last alarm FFFF

0= No alarm 0000
1=Thermal Capacity 0001
2=Overload 0002
3=Phase Failure 0003
4=Phase unbalance 0004
5=Underload 0005
6=Noload 0006
7=Earth Fault 0007
8=PTC *(see note1) 0008
9=Undervoltage *(see note1) 0009
10=Autoreclose *(see note1) 000A
11=---reserved--- 000B
12=Contactor Feedback 000C
13=---reserved--- 000D
14=Welded Contactor 000E
15=---reserved--- 000F
16=Drive Failed to Start 0010
17=Drive Failed to Stop 0011
18=Start limitation 0012
19=Serial Communication 0013
20=Running time 0014
21=Start number 0015
22=Programmable input 0 0016
23=Programmable input 1 0017
24=Programmable input 2 0018

20
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

F27 The last fault trip FFFF

Notes: 0=No trip 0000
1=TOL 0001
2=Stalled rotor 0002
3=Phase Failure 0003
4=Phase unbalance 0004
5=Underload 0005
6=Noload 0006
7=Earth fault 0007
8=PTC *(see note1) 0008
9=Undervoltage *(see note1) 0009
10=---reserved--- 000A
11=---reserved--- 000B
12=Contactor Feedback 000C
13=---reserved--- 000D
14=Programmable input 0 000E
15=Programmable Input 1 000F
16=Programmable Input 2 0010
17=Serial Communication 0011
18=Start limitation 0012
F28 Programmable output function FFFF
0=Energize on start delay 0000
1=De-energize on stop delay 0001
2=Serial control 0002
3=interlock0 0003
4=interlock1 0004
5=interlock2 0005
6=Trips 0006
7=Ground fault trip 0007
8=Overload 0008
9=Watchdog output 0009
10=Communication failure 000A
11=Local_Remote Switch 000B
11 = RCU Mode *(see note3)
F29 Set Parameters Status FFFF
1=Setting Parameters 0001
2= Parameter Setting Done 0002
3=Parameter Setting Failure 0003
4=Parameters Not Set 0004

6 Appendix A User Definable Memory

For convenience default User Map values have been added. However, the User
Definable Memory Map is still fully customizable. The defaults are separated into
three sections. Regular polling data items, data that is read when a trip, stop or
alarm occurs, and data that can be monitored as time permits.

USER MAP REG DESCRIPTION REGISTER STEP UNITS & FORMAT

DEFAULT ADDR. VALUE VALUE SCALE
ADDRESS (HEX) RANGE
0050 0019 Motor Status F8
0051 0029 Phase A Current %FLC Unsigned
Integer
0052 0017 Digital Input status F9
0053 001D Alarm Flag1 F1
0054 001E Alarm Flag2 F2
0055 001F Trip Active Status F3
Flag1

21
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

0056 0020 Trip Active Status F4

Notes: Flag2
0057 001A Start trigger source F10
0058 001B Stop trigger source F5
0059 002E O/L Time to trip s Unsigned
Integer
005A 002D Thermal capacity % Unsigned
Integer
005B 002F Pre Trip Phase A %FLC Unsigned
current Integer
005C 0030 Pre Trip Phase B %FLC Unsigned
current Integer
005D 0031 Pre Trip Phase C %FLC Unsigned
current Integer
005E 0032 Pre Trip Ground mA Unsigned
Current Integer
005F 0033 Power factor *(see ×0.01 Unsigned
note1) integer
0060 0034 Power *(see note1) 0.1×kW Unsigned
Integer
0061 0035 Energy Used(H) kWhr Unsigned
*(see note1) long
0062 0036 Energy Used(L) integer
*(see note1)
0063 0023 Phase A V Unsigned
Voltage*(see Integer
note1)
0064 0024 Phase B V Unsigned
Voltage*(see Integer
note1)
0065 0025 Phase C V Unsigned
Voltage*(see Integer
note1)
0066 003C Running time Hr. Unsigned
Integer
0067 003D Stopped time Hr. Unsigned
Integer
0068 003E Number of Starts Unsigned
long
integer
…
009F

The M101-M and the M102-M contains a User Definable area in the memory map. This area allows
re-mapping of the addresses of any Actual Values or Parameters registers. The User Definable area
has two sections:
1. A Register Index area (memory map addresses 1100H-114FH) that contains 80 Actual Values or
Parameters registers addresses.
2. A Register area (memory map addresses 0050H-009FH) that contains the data at the addresses
in the Register Index.
Register data that is separated in the rest of the memory map may be re-mapped to adjacent register
addresses in the User Definable Registers area. This is accomplished by writing to register addresses in
the User Definable Register Index area. This allows for improved throughput of data and can eliminate
the need for multiple read command sequences. The User Definable Register Index is stored as a
Parameter and therefore it is “remembered” even when the power is removed.
For example, if Motor Status (register address 0019H) and the values of phase L1 current (register
address 0029H) are required to be read from the slave device, their addresses may be re-mapped as
follows:
1. Write 0019H to address 1101H (User Definable Register Index 0000) using function code 06H
or 10H.

22
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

2. Write 0029H to address 1100H (User Definable Register Index 0001) using function code 06H
Notes: or 10H.
It is now possible to read these two data registers with one read, at addresses 0050H, 0051H. Address
0500H will contain Motor status and address 0051H will contain Phase L1 Current.
The MCUsetup software can also be used to write these data to the User Definable Resister Index.
Note! Important!
(1) The functions and registers marked with ‘ * (see note1)’ are only provided on M102-M
and for reservation on M101-M;
(2) For parameter ‘Power’, the range of setting is 0.01—1000KW; M102 deal with the values
in two steps as illustrated, a) the values <1KW, the MSB of the integer data is set ‘1’ and
the real value is ‘value read out’ times 0.01KW. e.g. the data 8001( HEX) means that the
value (1000 0000 0000 0001) is less than 1KW and the real value is 0.01KW (1X0.01KW);
b) If 1KW < the value < 1000KW ( 1KW included), the MSB of the integer data is ‘0’ and
the real value equals to ‘value read out’ times 0.1KW. e.g. the data 00A0(HEX) means
16KW (160X0.1KW);
(3) The ‘Local Remote Switch’ function is provided only on M102-M; On M101-M that is
‘11=RCU Mode’;
(4) Motor current setting is related to Internal CT setting( register 1022). If Internal CT
setting (range 0.1-63A) <1A, the scale of the current is x0.01A; If Internal CT setting >1A
( 1A included), the scale is 0.1A. For example, if CT value read is ‘2’ (that is 0.2A) and
the motor current value is ‘8’ then the current real value shall be 0.08A, ie 8x0.01A;
Samely, if CT setting value is 10 (1A), the motor current value read ‘8’ then the real
value shall be 0.8A, ie 8x0.1A.

7 Appendix B CRC-16
The CRC-16 algorithm essentially treats the entire data stream (data bits only; start, stop and parity
ignored) as one continuous binary number. This number is first shifted left 16 bits and then divided by a
characteristic polynomial (11000000000000101B). The 16bit remainder of the division is appended to
the end of the transmission, MSByte first. The resulting message including CRC, when divided by the
same polynomial at the receiver will give a zero remainder if no transmission errors have occurred.
If a Modbus slave device receives a transmission in which an error is indicated by the CRC-16
calculation, the slave device will not respond to the transmission. A CRC-16 error indicates that one or
more bytes of the transmission were received incorrectly and thus the entire transmission should be
ignored in order to avoid the device performing any incorrect operation.
a) CRC-16 ALGORITHM
Flowchart of the algorithm:

23
ABB
1TNC911505M0203 Edition June 2004
 Modbus Protocol Implementation for M101-M/M102-M

FFFFH -> A
Notes:

0 -> i

0 -> j

Di XOR AL -> AL

j = j + 1

shr(A)

CY?

G XOR A -> A

j = 8 ?

i = i + 1

i = N?

A -> CRC

Symbols are used in the algorithm:

• ->: data transfer
• A: 16bit working register
• AL: low order byte of A
• AH: high order byte of A
• CRC: 16bit CRC-16 value
• I, j: loop counters
• XOR: logical “exclusive or” operate
• Di: I-the data byte (I=0 to N-1)
• G: 16bit characteristic polynomial = 1010000000000001 with MSB bit dropped and bit
order reversed.
• Shr(x): shift right (the LSB bit of the low order byte of x shifts into a carry flag, a ‘0’ is
shifted into the MSB bit of the high order byte of x, all other bits shift right one location.
• CY?: is there a carry?

24
ABB
1TNC911505M0203 Edition June 2004