Skip to content

Appendix C: Modbus Communication

Data exchange between a PC and the UBZ-302M is done in MODBUS RTU packets. The data packet format is described in Table 2.1.

Table 2.1 - Data packet format

FieldDescription
STARTsilence interval – over 4 ms at 9 600, or over 2 ms at 19 200 baud
ADRUBZ-302M communication address (8 bits)
FUNCTIONCommand code (8 bits)
DATA 0 … DATA (n-1)Data contents: N×8 data bits (n<=24)
CRC CHK lowCRC checksum (16 bits)
CRC CHK high
ENDsilence interval – over 4 ms at 9 600 baud, or over 2 ms at 19 200 baud
ParameterSettingDescription
Address (Add)1-247Device network address
Baud Rate (bdS)9600/19200Communication speed
Data Format8N28 data bits, no parity, 2 stop bits

MODBUS Interface Command Codes (FUNCTION and DATA)

Section titled “MODBUS Interface Command Codes (FUNCTION and DATA)”

The format of data character depends on command codes.

Function CodeDescription
0x03Read Holding Registers
0x04Read Input Registers
0x06Write Single Register
0x08Diagnostics

Example: reading 2 words continuously starting from the address 100 (0x0064) in the UBZ-302M with communication address 0x01.

Command MessageResponse Message
ADR0x01ADR0x01
FUNCTION0x03FUNCTION0x03
Data start address0x00, 0x64Data amount, bytes0x04
Data amount, words0x00, 0x02Data contents at address0x17, 0x70
CRC CHK low0x85Data contents at address0x00, 0x00
CRC CHK high0xD4CRC CHK low0xFE
CRC CHK high0x5C

Data can only be written using the addresses of programmable parameters (see Table 1.5), except the parameters listed in Table 2.3.

Table 2.3 - Parameters that cannot be written via MODBUS

Set and Read ParametersCode ParametersAddress
Total device uptime, daystbU207
Motor uptime, daystCO208
User access codeLOC209
Engineer access codePA5210
Reset to factory parametersPPP211
Device versionrEL217

The parameter is written regardless of any engineer protection set (writing via the communication line has a higher priority).

When a new value is written into a MMSP-protected cell, the parameter is automatically excluded from the MMSP mode.

The parameters being written must be a multiple of the interval specified in Table 1.5.

Example: writing the entry 1000 (0x03E8) into the register at the address 160 (0x00A0), in the UBZ-302M with the communication address 0x01.

Command MessageResponse Message
ADR0x01ADR0x01
FUNCTION0x06FUNCTION0x06
Data start address0x00, 0xA0Data start address0x00, 0xA0
Data0x03, 0xE8Data0x03, 0xE8
CRC CHK low0x89CRC CHK low0x89
CRC CHK high0x56CRC CHK high0x56

The 0x08 function provides for a number of tests used to check the communication between the PC and the UBZ-302M, and to check the UBZ-302M operational state. The function uses the sub-function field to elaborate the action (test).

The data sent in the data field of the query must be returned in the data field of the response.

Example: sub function 0x00 request and response in UBZ-302M with communication address 0x01.

Command messageResponse message
ADDRESS ID0x01ADR0x01
FUNCTION0x08CMD0x08
Subfunction0x00, 0x00Subfunction0x00, 0x00
Data0xA0, 0x3CData0xA0, 0x3C
CRC CHK low0x98CRC CHK low0x98
CRC CHK high0x1ACRC CHK high0x1A
Sub-function 0x01 – restart communication options
Section titled “Sub-function 0x01 – restart communication options”

While performing the command only the change of communication speed is carried out in UBZ-302M. For total change of communication parameters it is necessary to initiate the command “UBZ RESTART” (“RESTART”) (see Command Register).

Example: sub function 0x01 request (response is not returned) for UBZ-302M with communication address 0x01.

Command message
ADDRESS ID0x01
FUNCTION0x08
Subfunction0x00, 0x01
Data0x00, 0x00
CRC CHK low0xB1
CRC CHK high0xCB

The checksum (CRC16) is a cyclical checking code based on the 0xA001 polynomial. The transmitter creates a checksum for all bytes of the transmitted message. The receiver creates the checksum for all bytes of the received message and compares it to the checksum received from the transmitted. If the created and received checksums are not the same, an error message is generated.

The checksum field occupies two bytes. In a message, the checksum is transmitted least significant byte first.

The following algorithm is used to create the checksum:

  1. load CRC register (16 bit) with ones (0xFFFF);
  2. XOR gate with the first 8 bits of the message byte and the contents of the CRC register;
  3. shift result one bit to the right;
  4. if the shifted bit = 1, XOR gate with the register contents with value of 0xA001;
  5. if the shifted bit = 0, repeat step 3;
  6. repeat steps 3, 4, 5, until 8 shifts are carried out;
  7. XOR gate with the next 8 bits of the message byte and the contents of the CRC register;
  8. repeat steps 3-7 until all bytes of the message are processed;
  9. the final contents of the register will contain the checksum.

An example of CRC generating code in C. The function receives two arguments:

  • unsigned char* data – indicator to message buffer;
  • unsigned char length – number of bytes in the buffer.

The function returns the CRC value as (unsigned int).

unsigned int crc_chk(unsigned char* data, unsigned char length)
{
int j;
unsigned int reg_crc = 0xFFFF;
while(length--)
{
reg_crc ^= *data++;
for(j = 0; j < 8; j++)
{
if(reg_crc & 0x01)
reg_crc = (reg_crc >> 1) ^ 0xA001; // LSB(b0)=1
else
reg_crc = reg_crc >> 1;
}
}
return reg_crc;
}

In case of an error during frame reception (parity error, frame error, checksum error), UBZ-302M returns no response.

In case of an error in format or value of transmitted data (unsupported function code, etc.), UBZ-302M accepts the query frame and creates a response containing the error indication code. The error indication is the 1 in the higher bit of the function field. A separate field is reserved for the error code in the response.

Example: function 0x30 error response (illegal function) from UBZ-302M with communication address 0x01.

Command messageResponse message
ADDRESS ID0x01ADR0x01
FUNCTION0x30FUNCTION ERROR0xB0
DATAError code0x01
CRC CHK lowCRC CHK low0x94
CRC CHK highCRC CHK high0x00

Table 2.6 - Error codes

Error codeNameDescription
0x01ILLEGAL FUNCTIONThe UBZ-302M cannot process the accepted function code
0x02ILLEGAL DATA ADDRESSThe data address in the query is not accessible by this slave device
0x03ILLEGAL DATA VALUEThe value in the query data field is not acceptable for the UBZ-302M
0x04SLAVE DEVICE FAILUREAn unrecoverable error occurred when UBZ-302M tried to carry out the requested action
0x05ACKNOWLEDGEThe UBZ-302M accepted the query, but processing it requires a long time. This response prevents the master device from generating a timeout error
0x06SLAVE DEVICE BUSYThe UBZ-302M is busy processing the command. The master device should resent the message later, when the slave device is free
0x07NEGATIVE ACKNOWLEDGEThe UBZ-302M cannot carry out the program function contained in the query

Measured Parameters (Input Registers, Table 1.4)

Section titled “Measured Parameters (Input Registers, Table 1.4)”
ParameterMnemonicAddressRangeUnitsAccuracy
Phase 1 currentiF11000.5-6300.1A2%
Phase 2 currentiF21010.5-6300.1A2%
Phase 3 currentiF31020.5-6300.1A2%
Zero sequence currentiF01030.3-5.00.1A2%
Phase 1 average currentiS1104-0.1A-
Phase 2 average currentiS2105-0.1A-
Phase 3 average currentiS3106-0.1A-
Phase 1 max averagein1107-0.1A2%/10%
Phase 2 max averagein2108-0.1A2%/10%
Phase 3 max averagein3109-0.1A2%/10%
Starting currentiPU110-0.1A2%/10%
Start timetPU1110.1-600s-
OvercurrentiPE112-0.1A2%/10%
Negative sequence currentioP1130.2-2000.1A5%
ParameterMnemonicAddressRangeUnitsAccuracy
Phase 1 voltageUF1114100-300V3V
Phase 2 voltageUF2115100-300V3V
Phase 3 voltageUF3116100-300V3V
Line voltage U12UL1117100-475V5V
Line voltage U23UL2118100-475V5V
Line voltage U31UL3119100-475V5V
Positive sequence voltageUPP120100-300V3V
Negative sequence voltageUP1213-300V3V
Zero sequence voltageUnP1223-100V3V
ParameterMnemonicAddressRangeUnitsAccuracy
Temperature sensor 1td1123-40 to 100°C1°C
Temperature sensor 2td2124-40 to 220°C1°C
4-20mA inputin11250-250.01mA2%
0-10V inputinU1260-100.1V2%

Temperature sensor status codes:

  • 5000: Sensor not connected.
  • 1000±10: Sensor short-circuited.
  • 2000±10: Sensor fault.
ParameterMnemonicAddressRangeUnitsAccuracy
Operation timeStr1270-999days-
FrequencyFFF12845-650.1Hz1%
Time to thermal triptOP1290-600s1s
ARC countdowntAP1300-900s1s
Thermal wait timettP1310-900s1s
Insulation resistancerid1320-19.90.1MΩ10%
Motor thermal balance-133-1340-1000000.001%-
ParameterMnemonicAddressRangeUnitsAccuracy
Total powerPot135-1360-500010W5%
Active powerPoA137-1380-500010W5%
Reactive powerPoJ139-1400-500010VAr5%
Phase A cos φ × 1000-141-1420-1000-5%
Phase B cos φ × 1000-143-1440-1000-5%
Phase C cos φ × 1000-145-1460-1000-5%
ParameterMnemonicAddressMinMaxDefaultDescription
CT typetPt1500100=Internal, 1=External CT
CT rated currenttnt15120800100External CT primary current (A)
Motor rated currentind15206300Nominal motor current (A)
Average measurement timetS11531060060Time for average current (s)
ParameterMnemonicAddressMinMaxDefaultDescription
Protection typei⁼P1540500=Independent, 1=SIT, 2=VIT, 3=EIT, 4=UIT, 5=RI
Tripping ratioi⁼51550.89.04.0Multiplier × rated current
Tripping delayi⁼t1560.360010.0Time delay (s)
Permissioni⁼r1570220=Off, 1=On no ARC, 2=On with ARC
Priority vs thermali⁼n1580110=Independent, 1=After thermal
ParameterMnemonicAddressMinMaxDefaultDescription
Tripping thresholdi_51590.35.00.5Ground fault current (A)
Tripping delayi_t1600.32.01.0Time delay (s)
Permissioni_r1610220=Off, 1=On no ARC, 2=On with ARC
ParameterMnemonicAddressMinMaxDefaultDescription
Tripping thresholdio516252010% of rated current
Tripping delayiot1630.310.05.0Time delay (s)
Permissionior1640220=Off, 1=On no ARC, 2=On with ARC
K2i/K2u ratioiO5165242Threshold ratio
Analysis enableiOr1660110=Off, 1=On
ParameterMnemonicAddressMinMaxDefaultDescription
Permissiondtr1670220=Off, 1=On no ARC, 2=On with ARC
Double overload timedtt1681012060Trip time at 2× current (s)
Cooling time ratiodtP1691.04.01.0Stopped motor cooling factor
ParameterMnemonicAddressMinMaxDefaultDescription
Tripping thresholdi₌5170119020% of rated current
Tripping delayi₌t17111005Time delay (s)
Permissioni₌r1720220=Off, 1=On no ARC, 2=On with ARC
ParameterMnemonicAddressMinMaxDefaultDescription
Tripping ratioPP51731.57.05.0Multiplier × rated current
Start time delayPPt174160010Motor start time (s)
Blocking delayPbt1750.33001.0Rotor blocking delay (s)
PermissionPPr1760210=Off, 1=On no ARC, 2=On with ARC
ParameterMnemonicAddressMinMaxDefaultDescription
Minimum voltageU₌5177270415320Undervoltage threshold (V)
Min voltage delayU₌t17853010Time delay (s)
Min voltage permissionU₌r1790220=Off, 1=On no ARC, 2=On with ARC
Maximum voltageU⁼5180330475415Overvoltage threshold (V)
Max voltage delayU⁼t1811102Time delay (s)
Max voltage permissionU⁼r1820220=Off, 1=On no ARC, 2=On with ARC
Voltage imbalanceUⁿ51831512035Negative sequence threshold (V)
Imbalance delayUⁿt1841305Time delay (s)
Imbalance permissionUⁿr1850220=Off, 1=On no ARC, 2=On with ARC
Phase sequence permissionUЧr1860210=Off, 1=On no ARC, 2=On with ARC
ParameterMnemonicAddressMinMaxDefaultDescription
ARC time (undercurrent)Atn1870900600Delay after undercurrent (s)
ARC timeAtt18809005Standard ARC delay (s)
ARC permissionArr1890110=Forbidden, 1=Allowed
Start after power-onAPd1900210=Manual, 1=After ARC, 2=2s delay
Panel controlACd1910300=Off, 1=Start, 2=Stop, 3=Both
ParameterMnemonicAddressMinMaxDefaultDescription
Sensor 1 typeC1r1920200=Off, 1=Integrated, 2=PTC
Sensor 1 trip tempC1S193010080De-energize temperature (°C)
Sensor 1 correctionC1c194-990Temperature offset (°C)
Sensor 2 typeC2r1950300=Off, 1=Pt100, 2=Ni100, 3=Ni120
Sensor 2 trip tempC2S1960220180De-energize temperature (°C)
Sensor 2 warning tempC2A1970220170Warning temperature (°C)
Sensor 2 correctionC2c198-990Temperature offset (°C)
ARC after temp tripCPA1991221=No ARC, 2=ARC allowed
Sensor failure reactionCCr2000100=Warning, 1=Stop motor
ParameterMnemonicAddressMinMaxDefaultDescription
Insulation protectionrid2010205See description below

Insulation Protection Settings:

  • 0: Protection off
  • 5: No start if <500kΩ, ARC allowed
  • 10: No start if <1MΩ, ARC allowed
  • 15: No start if <500kΩ, no ARC
  • 20: No start if <1MΩ, no ARC
ParameterMnemonicAddressMinMaxDefaultDescription
MMSP mode5in2020110=On, 1=Off
Display before start5iP2030210=Voltage, 1=Insulation, 2=ARC
Parameter display mode5iC2040110=Continuous, 1=15s timeout
Functional relay moderr52050200=Signal, 1=Timer, 2=Star-delta
Timer delayrrt206030030Functional relay delay (s)
ParameterMnemonicAddressMinMaxDefaultDescription
Device uptimetbU20709990Total operation time (days)
Motor uptimetCO20809990Motor run time (days)
ParameterMnemonicAddressMinMaxDefaultDescription
User passwordLOC2090900=Unlocked, 1-9=Password
Engineer passwordPA52100999123000=Unlocked, else=Password
Factory resetPPP211010Set 1 to reset
ParameterMnemonicAddressMinMaxDefaultDescription
Device addressrSA21212471MODBUS address
Baud raterSS2130100=9600, 1=19200
Link loss reactionrSP214030See description below
Timeout detectionrSO21501200Link timeout (s), 0=Off
Interface selectionrPP2160200=Off, 1=USB, 2=RS-485
Device versionrEL217--22Read-only

Link Loss Reaction (rSP):

  • 0: Continue operation, no warning
  • 1: Warning, continue operation
  • 2: Warning, stop motor, ARC after restore
  • 3: Warning, stop motor, no ARC
ParameterMnemonicAddressMinMaxDefaultDescription
Switching timeFtt2180.12.00.4Time between star and delta (s)
ParameterMnemonicAddressMinMaxDefaultDescription
Trip delayibt2190.3100.5Phase loss delay (s)
Permissionibr2200210=Off, 1=On no ARC, 2=On with ARC
ParameterMnemonicAddressMinMaxDefaultDescription
Remote controldUd2210200=Off, 1=On+auto start, 2=On+manual start
ParameterMnemonicAddressMinMaxDefaultDescription
Upper thresholdAit222020.010.0High threshold (mA)
Lower thresholdAib223020.01.0Low threshold (mA)
Control algorithmAiA2240200=Off, 1=Stop on high, 2=Start on high
Fault loggingAiE2250100=No log, 1=Log faults
ParameterMnemonicAddressMinMaxDefaultDescription
Upper thresholdAUt226010.05.0High threshold (V)
Lower thresholdAUb227010.01.0Low threshold (V)
Control algorithmAUA2280200=Off, 1=Stop on high, 2=Start on high
Fault loggingAUE2290100=No log, 1=Log faults
ParameterMnemonicAddressMinMaxDefaultDescription
External MS controlCCi2300110=Off, 1=On

Remote control of the UBZ-302M is determined by the value of dUd.

At dUd=0, remote control of the motor is forbidden.

At dUd=1, the UBZ-302M operation after energizing is the same as with remote control off (regular operation), but writing into the R_COMMAND command register is allowed.

At dUd=2, the UBZ-302M will energize the motor only after a respective command is received via the USB/RS-485 interface.

The value of R_COMMAND is taken into consideration by the UBZ-302M operation algorithm at dUd=1 and dUd=2. If dUd=0, and the user sets dUd=1 or dUd=2, “0” will be written to R_COMMAND.

At dUd=1, “1” will be written into the command register after power on (regular operation). At dUd=2, “0” will be written into the command register after power on (the motor is switched off until the energize command is given).

After emergency de-energizing of the motor by simultaneous pressing of UP and DOWN (at ACd=2 or ACd=3), the command register will be reset to 0.

Table 2.7 - Command codes

Command register R_COMMAND (Address = 237)Actions
0De-energize motor. If the motor is off, it will not be energized until a remote energize command is given. If the motor is on, it will be de-energized.
1Regular device operation. If the motor was de-energized by a remote command, or by simultaneous pressing of UP and DOWN (at ACd=3), or by a fault with permitted subsequent ARC, then after 1 is written into R_COMMAND, the motor will be energized after the ARC time delay.
2Early motor de-energizing. Writing 2 into R_COMMAND results in the motor energizing before the end of the ARC time delay. After the motor is on, R_COMMAND = 1.
55 (0x37)Command “UBZ ALARMS RESET”
88 (0x58)Command “UBZ RESTART” (“RESTART”)

If the motor is on, writing the 1 to R_COMMAND will de-energize it.

If the motor is off, it will not be energized until a remote energize command (1 or 2) is given.

If the motor was de-energized by a remote command, or by simultaneous pressing of UP and DOWN (at ACd=3), or by a fault with permitted subsequent ARC, then after 1 is written into R_COMMAND, the motor will be energized after the ARC time delay.

Writing 2 into R_COMMAND results in:

  • the motor energizing before the end of the ARC time delay.
  • after the motor is on, R_COMMAND will be set to 1 (regular operation).

The command “UBZ ALARMS RESET” is to be initiated after entering the command code 55 in command register (Table 2.7) by interface USB/RS-485.

While initiating the command:

  • the alarms are being reset no matter whether the ARC is disabled or enabled (except for the current alarms on engine currents availability at the load relay being deactivated CCi and alarm of EEPROM destruction);
  • ahead of time counting of ARC ends and, if there are no new alarms, the engine starts.

The command “UBZ RESTART” is used for initiating the changed communication parameters. The command “UBZ RESTART” is to be initiated after entering the command code 88 in command register (Table 2.7) by interface USB/RS-485. After receiving the command “UBZ RESTART” UBZ-302M does not return the confirmation of received command.

BitDescription
00=No fault, 1=Fault active (fault code in register 241)
10=Load relay open, 1=Load relay closed
20=Functional relay open, 1=Functional relay closed
30=No restart pending, 1=ARC expected
5-4Functional relay mode: 00=signaling relay; 01=time relay; 10=star / delta
60=MMSP off, 1=MMSP on
70=regular operating mode; 1=UBZ-302M in hysteresis area when working with analog inputs
AddressDescription
241Fault register 1 (bits 0-15, according to Table 2.8)
242Fault register 2 (bits 0-10, according to Table 2.8)
DescriptionAddressPurpose
Fault code 1243fault code according to Table 2.8
Parameter value 1244parameter value according to Table 2.8
Fault time 1 (high word)245two upper bytes
Fault time 1 (low word)246two lower bytes
Fault code 2247see register 243
Parameter value 2248see register 244
Fault time 2 (high word)249see register 245
Fault time 2 (low word)250see register 246
Fault code 3251see register 243
Parameter value 3252see register 244
Fault time 3 (high word)253see register 245
Fault time 3 (low word)254see register 246
Fault code 4255see register 243
Parameter value 4256see register 244
Fault time 4 (high word)257see register 245
Fault time 4 (low word)258see register 246
Fault code 5259see register 243
Parameter value 5260see register 244
Fault time 5 (high word)261see register 245
Fault time 5 (low word)262see register 246
CodeBitRegisterMnemonicDescriptionParameter Address
00241Ai⁼Phase overcurrent300
11241AdtThermal overload301
22241Ai_Ground fault302
33241AiOExcess K2i/K2u303
44241AioNegative sequence current304
55241Ai₌Phase undercurrent305
66241APPDelayed start306
77241APbRotor blocking307
88241At1Temperature sensor 1308
99241At2Temperature sensor 2309
1010241AUЧPhase sequence310
1111241ACoExternal MS311
1212241AU₌Undervoltage312
1313241AU⁼Overvoltage313
1414241AUⁿVoltage imbalance314
1515241AriInsulation resistance315
160242AdURemote channel fault-
171242EAdEmergency stop no ARC-
182242EOdEmergency stop with ARC-
193242ES1Sensor 1 short circuit-
204242EO1Sensor 1 breakout-
215242ES2Sensor 2 short circuit-
226242EO2Sensor 2 breakout-
237242EiUPhase loss-
248242EEPEEPROM destruction-
259242AAi0-20mA input fault325
2610242AAU0-10V input fault326

Resetting of the UBZ-302M factory settings via MODBUS interface

Section titled “Resetting of the UBZ-302M factory settings via MODBUS interface”

For initiation of this operation it is necessary to set the parameter PPP=1. At this operation the parameters of serial interface will not be changed (the reset of interface parameters to the factory ones is not made). The time period of reset to the factory settings is up to 5 seconds. After the completion of operation the parameter is PPP=0.