ABB Zenith MX350 Use and care manual

—
COMMUNICATIONS GUIDE
Zenith MX350
Microprocessor Controller for ZTE series
Automatic Transfer Switches

© 2019 ABB Incorporated. All rights reserved.
ABB MX350 Automatic Transfer Control System Communications Guide for revision
1.2x.
EnerVista, EnerVista Launchpad, EnerVista MX350 Setup, and FlexLogic are registered
trademarks of The General Electric Company.
The contents of this manual are the property of ABB Inc. This documentation is of ABB.
furnished on license and may not be reproduced in whole or in part without the permission
of ABB. The content of this manual is for informational use only and is subject to change
without notice.
Part number: 1601-9072-A3 (April 2010)

TABLE OF CONTENTS
1EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
Table of Contents
Communications interfaces .........................................................................................1
RS485 interface (Modbus RTU) .....................................................................................2
Modbus Protocol...............................................................................................................................................2
Electrical Interface .......................................................................................................................................... 2
Data Frame Format and Data Rate ........................................................................................................ 2
Data Packet Format ....................................................................................................................................... 2
Error Checking................................................................................................................................................... 3
CRC-16 Algorithm ............................................................................................................................................3
Timing.................................................................................................................................................................... 4
MX350 supported functions ....................................................................................................................... 4
Modbus Functions............................................................................................................................................5
Function Code 01H ......................................................................................................................................... 5
Function Code 03H ......................................................................................................................................... 6
Function Code 04H ......................................................................................................................................... 7
Function Code 05H ......................................................................................................................................... 8
Function Code 06H .......................................................................................................................................10
Function Code 08H .......................................................................................................................................10
Function Code 10H .......................................................................................................................................11
Error Responses..............................................................................................................................................11
Performing commands using Function Code 10H ........................................................................ 12
Using the User Definable Memory Map ..............................................................................................13
Modbus memory map.................................................................................................................................14
Format codes .................................................................................................................................................. 44
Ethernet interface........................................................................................................66

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM2
TABLE OF CONTENTS

1EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
MX350 Automatic Transfer Control
System
Communications Guide
Communications Guide
Communications interfaces
The MX350 supports two communications interfaces:
• Modbus RTU via RS485
• Modbus TCP/IP via 10/100Base-T Ethernet
In addition, a USB interface is provided on the front of the interface panel. It is configured
to be used in conjunction with a virtual serial port on a Windows-based PC.
NOTE: Setpoint changes related to communication parameters require a power cycle of the
controller to be activated.
NOTE: For full details, please refer to the MX350 Communications Guide to be found at http://
www.gedigitalenergy.com/app/Resources.aspx?prod=zte&type=3 .

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM2
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
RS485 interface (Modbus RTU)
The RS485 interface is a serial two-wire port intended for use as a Modbus RTU slave. The
RS485 port has the following characteristics.
• Address: 1 to 254, default 254
• Baud rate: 9600 to115200 bps, default 115200
• Parity: None
• Data bits: 8
• Stop bits: 1
• Supported Modbus function codes: 1, 3, 4, 5, 6, 7, 8, 16
Modbus Protocol
The MX350 implements a subset of the Modicon Modbus RTU serial communication
standard. The Modbus protocol is hardware-independent. That is, the physical layer can be
any of a variety of standard hardware configurations. This includes RS232, RS422, RS485,
fibre optics, etc. Modbus is a single master / multiple slave type of protocol suitable for a
multi-drop configuration as provided by RS485 hardware. The MX350Modbus
implementation employs two-wire RS485 hardware. Using RS485, up to 32 MX350s can be
daisy-chained together on a single communication channel.
The MX350 is always a Modbus slave. It can not be programmed as a Modbus master.
Computers or PLCs are commonly programmed as masters.
Both monitoring and control are possible using read and write register commands. Other
commands are supported to provide additional functions.
Electrical Interface The hardware or electrical interface in the MX350 is two-wire RS485. In a two-wire link,
data is transmitted and received over the same two wires. Although RS485 two wire
communication is bi-directional, the data is never transmitted and received at the same
time. This means that the data flow is half duplex.
RS485 lines should be connected in a daisy chain configuration with terminating networks
installed at each end of the link (i.e. at the master end and at the slave farthest from the
master). The terminating network should consist of a 120 W resistor in series with a 1 nF
ceramic capacitor when used with Belden 9841 RS485 wire. Shielded wire should always
be used to minimize noise. The shield should be connected to all of the MX350s as well as
the master, then grounded at one location only. This keeps the ground potential at the
same level for all of the devices on the serial link.
NOTE: Polarity is important in RS485 communications. The '+' (positive) terminals of every device
must be connected together.
Data Frame Format
and Data Rate
One data frame of an asynchronous transmission to or from a MX350 typically consists of
1 start bit, 8 data bits, and 1 stop bit. This produces a 10 bit data frame. This is important
for transmission through modems at high bit rates (11 bit data frames are not supported
by Hayes modems at bit rates of greater than 300 bps).
Modbus protocol can be implemented at any standard communication speed. The
MX350supports operation at 9600, 19200, 38400, 57600, and 115200 baud.
Data Packet Format A complete request/response sequence consists of the following bytes (transmitted as
separate data frames):
Master Request Transmission:
SLAVE ADDRESS: 1 byte

)UTRSUBDOM(ECAFRETNI584SREDIUGSNOITACINUMMOC
3EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
FUNCTION CODE: 1 byte
DATA: variable number of bytes depending on FUNCTION CODE
CRC: 2 bytes
Slave Response Transmission:
SLAVE ADDRESS: 1 byte
FUNCTION CODE: 1 byte
DATA: variable number of bytes depending on FUNCTION CODE
CRC: 2 bytes
SLAVE ADDRESS: This is the first byte of every transmission. This byte represents the user-
assigned address of the slave device that is to receive the message sent by the master.
Each slave device must be assigned a unique address and only the addressed slave will
respond to a transmission that starts with its address. In a master request transmission the
SLAVE ADDRESS represents the address of the slave to which the request is being sent. In a
slave response transmission the SLAVE ADDRESS represents the address of the slave that is
sending the response.
FUNCTION CODE: This is the second byte of every transmission. Modbus defines function
codes of 1 to 127.
DATA: This will be a variable number of bytes depending on the FUNCTION CODE. This may
be Actual Values, Setpoints, or addresses sent by the master to the slave or by the slave to
the master.
CRC: This is a two byte error checking code.
Error Checking The RTU version of Modbus includes a two byte CRC-16 (16 bit cyclic redundancy check)
with every transmission. The CRC-16 algorithm essentially treats the entire data stream
(data bits only; start, stop and parity ignored) as one continuous binary number. This
number is first shifted left 16 bits and then divided by a characteristic polynomial
(11000000000000101B). The 16 bit remainder of the division is appended to the end of the
transmission, MSByte first. The resulting message including CRC, when divided by the
same polynomial at the receiver will give a zero remainder if no transmission errors have
occurred.
If a MX350 Modbus slave device receives a transmission in which an error is indicated by
the CRC-16 calculation, the slave device will not respond to the transmission. A CRC-16
error indicates than one or more bytes of the transmission were received incorrectly and
thus the entire transmission should be ignored in order to avoid the MX350performing any
incorrect operation.
The CRC-16 calculation is an industry standard method used for error detection. An
algorithm is included here to assist programmers in situations where no standard CRC-16
calculation routines are available.
CRC-16 Algorithm Once the following algorithm is complete, the working register “A” will contain the CRC
value to be transmitted. Note that this algorithm requires the characteristic polynomial to
be reverse bit ordered. The MSBit of the characteristic polynomial is dropped since it does
not affect the value of the remainder. The following symbols are used in the algorithm:
—>: data transfer
A: 16 bit working register
AL: low order byte of A
AH: high order byte of A
CRC: 16 bit CRC-16 value
i, j: loop counters
(+): logical exclusive or operator
Di: i-th data byte (i = 0 to N-1)

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM4
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
G: 16 bit characteristic polynomial = 1010000000000001 with MSbit dropped and bit order
reversed
shr(x): shift right (the LSbit of the low order byte of x shifts into a carry flag, a '0' is shifted
into the MSbit of the high order byte of x, all other bits shift right one location
The algorithm is:
1. FFFF hex —> A
2. 0 —> i
3. 0 —> j
4. Di (+) AL —> AL
5. j+1 —> j
6. shr(A)
7. is there a carry? No: go to 8. Yes: G (+) A —> A
8. is j = 8? No: go to 5. Yes: go to 9.
9. i+1 —> i
10. is i = N? No: go to 3. Yes: go to 11.
11. A —> CRC
Timing Data packet synchronization is maintained by timing constraints. The receiving device
must measure the time between the reception of characters. If 3.5 character times elapse
without a new character or completion of the packet, then the communication link must
be reset (i.e. all slaves start listening for a new transmission from the master). Thus at 9600
baud a delay of greater than 3.5 x 1 / 9600 x 10 x = x 3.65 x ms will cause the
communication link to be reset.
MX350 supported
functions
The following functions are supported by the MX350:
• FUNCTION CODE 01 - Read Input Status
• FUNCTION CODE 03 - Read Setpoints and Actual Values
• FUNCTION CODE 04 - Read Setpoints and Actual Values
• FUNCTION CODE 05 - Execute Operation
• FUNCTION CODE 06 - Store Single Setpoint
• FUNCTION CODE 07 - Read Device Status
• FUNCTION CODE 08 - Loopback Test
• FUNCTION CODE 10 - Store Multiple Setpoints

)UTRSUBDOM(ECAFRETNI584SREDIUGSNOITACINUMMOC
5EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
Modbus Functions
Function Code 01H Modbus implementation: Read Input Status
MX350 implementation: Read Net Control Status
This function code is supported for a selective range of commands for MX350 for net
control functionality. This function reads the ON/OFF status for each net control
command. The query message specifies the starting command and number of commands
status to be read. Commands are addressed starting at zero.
The master/slave packets have the following format:
Table 1: MASTER/SLAVE PACKET FORMAT FOR FUNCTION CODE 03H
Each returned data bit is an ON/OFF status. The number of returned data bytes will
change according to the number of points requested.
The following table lists the supported command addresses for this function code:
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 02 read net control status
STARTING ADDRESS 2 00 C4 starting command address
NUMBER OF POINTS 2 00 02number of statusbits
edocrorreCRC1CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave 17
FUNCTION CODE 1 02 read net control status
BYTE COUNT 1 01 number of status bytes
suta
tslortnoctenfosetyb11ATAD
edocrorreCRC1CRC

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM6
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
Function Code 03H Modbus implementation: Read Holding Registers
MX350 implementation: Read Setpoints
For the MX350 implementation of Modbus, this function code can be used to read any
setpoints (“holding registers”). Holding registers are 16 bit (two byte) values transmitted
high order byte first. Thus all MX350Setpoints are sent as two bytes. The maximum
number of registers that can be read in one transmission is 125.
The slave response to this function code is the slave address, function code, a count of the
number of data bytes to follow, the data itself and the CRC. Each data item is sent as a two
byte number with the high order byte sent first.
For example, consider a request for slave 17 to respond with 3 registers starting at address
006B. For this example the register data in these addresses is as follows:
noitpircseDrebmuNdnammoC
retnuoCelbaliavA2SemiTteseR691
ecneliSmralA791
remit-WssapybotlortnoC891
remit-TssapybotlortnoC991
daoloNnotseTlrtCteN002
lortnoCtseTdaoLtsaF102
lortnoCtseTdaoLralugeR202
1
SotrefsnarterlaunaM/otuA302
2S/1SotrefsnartlaunaM/otuA402
1SrofdehSdaoLlrtCteN502
2SotrefsnarTtibihnIlrtCteN602
1SotrefsnarTtibihnIlrtCteN702
rotceleSedoMnoitisnarTlrtCteN802
05RssapyBotdnammoC902
05RssapyBmrifnoC012
05RssapyBlecnaC112
resicrexEgnidnePssapyB212
ssapyBresicrexElecnaC312
tibihnIrefsnarTotuAlrtCteN412
yaleRrefsnarTotuAlrtCteN512
remiTSTAevitcAssapyB
lrtCteN612
lecnaCresicrexElrtCteN712
tratSrotareneGlrtCteN812
potSrotareneGlrtCteN912
2SrofdehSdaoLlrtCteN022
noitceleSecruoSemirPlrtCteN122
lecnaCedoMtseTlrtCteN222
daoLnOtseTlrtCteN322
timmoCrefsnarTlrtCteN422
ataDsserddA
B220B600
0000C600
4600D600

)UTRSUBDOM(ECAFRETNI584SREDIUGSNOITACINUMMOC
7EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
The master/slave packets have the following format:
Table 2: MASTER/SLAVE PACKET FORMAT FOR FUNCTION CODE 03H
Function Code 04H Modbus Implementation: Read Input Registers
MX350 Implementation: Read Actual Values
For the MX350 implementation of Modbus, this function code can be used to read any
actual values (“input registers”). Input registers are 16 bit (two byte) values transmitted high
order byte first. Thus all MX350Actual Values are sent as two bytes. The maximum number
of registers that can be read in one transmission is 125.
The slave response to this function code is the slave address, function code, a count of the
data bytes to follow, the data itself and the CRC. Each data item is sent as a two byte
number with the high order byte sent first.
For example, request slave 17 to respond with 1 register starting at address 0008. For this
example the value in this register (0008) is 0000.
Table 3: MASTER/SLAVE PACKET FORMAT FOR FUNCTION CODE 04H
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 03 read registers
DATA STARTING ADDRESS 2 00 6Bdata starting at 006B
NUMBER OFSETPOINTS 2 00 033 registers = 6 bytes total
edocrorreCRC78672CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave 17
FUNCTION CODE 1 03 read registers
BYTE COUNT 1 06 3 registers = 6 bytes
DATA 1 (see definition above) 2 02 2B value in address 006B
DATA 2 (see definition above) 2 00 00 value in address 006C
DATA 3 (see definition above) 2 00 64 value in address 006D
edocrorreCRC38452CRC
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 04 read registers
DATA STARTING ADDRESS 2 00 08data starting at 0008
NUMBER OF ACTUAL VALUES 2 00 011 register = 2 bytes
edocrorreCRC892B2CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave
17
FUNCTION CODE 1 04 read registers
BYTE COUNT 1 02 1 register = 2 bytes
DATA (see definition above) 2 00 00 value in address
0008
edocrorreCRC3F872CRC

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM8
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
Function Code 05H Modbus Implementation: Force Single Coil
MX350 Implementation: Execute Operation
This function code allows the master to request a MX350 to perform specific command
operations.
For example, to request slave 17 to execute operation code 1 (reset), we have the following
master/slave packet format:
Table 4: MASTER/SLAVE PACKET FORMAT FOR FUNCTION CODE 05H
The following commands that can be performed by the MX350 using function code 05, can
also be initiated using function code 10H.
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 05 execute operation
OPERATION CODE 2 00 01 operation code 1
CODE VALUE 2 FF 00 perform function
edocrorreCRCA6FD2CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave
17
FUNCTION CODE 1 05 execute operation
OPERATION CODE 2 00 01operation code 1
CODE VALUE 2 FF 00 perform function
edocrorreCRCA6FD2CRC

)UTRSUBDOM(ECAFRETNI584SREDIUGSNOITACINUMMOC
9EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
noitpircseDedoCnoitarepO
teseR1
tpmorPataDtluaFtsaLraelC69
sreteMhravMdnahWMteseR79
sretnuoCpirTraelC99
sdroceRtnevEraelC001
remiTecnanetniaMraelC201
erutpaCmrofevaWreggirT021
2stniopteSyrotcaFdaoleR161
1stniopteSyrotcaFdaoleR261
ylnossecatnioptesoterotseR361
tseT053XM181
tseTtsaF-tseT053XM281
daoLrefX-tseT053XM381
refXoN-tseT053XM481
resicrexEssapyB-tseT053XM581
ssapyBresicrexElecnaC-tseT053XM681
ssapyBlecnaC-tseT053XM881
ssapyB-egasseM053XM981
seY-egasseM053XM091
oN-egasseM053XM191
epacsE-egasseM053XM291
lecnaC-egasseM053XM391
ecneliS-egasseM053XM491
teseR-egasseM053XM591
The following commands can only be performed using function code 05H
retnuoCelbaliavA2Semi
TteseR691
ecneliSmralA791
remit-WssapybotlortnoC891
remit-TssapybotlortnoC991
daoloNnotseTlrtCteN002
lortnoCtseTdaoLtsaF102
lortnoCtseTdaoLralugeR202
1SotrefsnarterlaunaM/otuA302
2S/1SotrefsnartlaunaM/otuA402
1SrofdehSdaoLlrtCteN502
2SotrefsnarTtibihnIlrtCteN602
1SotrefsnarTtibihnIlrtCteN702
rotceleSedoMnoitisnarTlrtCteN802
05RssapyBotdnammoC902
05RssapyB
mrifnoC012
05RssapyBlecnaC112
daoLnotseTlrtCteN322
timmoCrefsnarTlrtCteN422

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM01
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
Function Code 06H Modbus Implementation:Preset Single Register
MX350 Implementation: Store Single Setpoint
This command allows the master to store a single setpoint into the memory of a MX350
The slave response to this function code is to echo the entire master transmission.
For example, request slave 17 to store the value 2 in setpoint address 04 5C. After the
transmission in this example is complete, setpoints address 04 5C will contain the value
01F4. The master/slave packet format is shown below:
Table 5: MASTER/SLAVE PACKET FORMAT FOR FUNCTION CODE 06H
Function Code 08H Modbus Implementation: Loopback
Test MX350 Implementation: Loopback Test
This function is used to test the integrity of the communication link. The MX350 will echo
the request.
For example, consider a loopback test from slave 17:
Table 6: MASTER/SLAVE PACKET FORMAT FOR FUNCTION CODE 08H
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 06 store single setpoint
DATA STARTING ADDRESS 2 04 5Csetpoint address 04
5C
tnioptesrofatad20002ATAD
address 04 5C
edocrorreCRC9BBC2CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave
17
FUNCTION CODE 1 06 store single setpoint
DATA STARTING ADDRESS 2 04 5Csetpoint address 04
5C
niderotsatad20002ATAD
setpoint address 04
5C
edocrorreCRC9BBC2CRC
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 08 loopback test
DIAG CODE 2 00 00must be 00 00
0000ebtsum00002ATAD
edocrorreCRCB00E2CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave
17
FUNCTION CODE 1 08 loopback test
DIAG CODE 2 00 00must be 00 00
0000ebtsum00002ATAD
edocrorreCRCB00E2CRC

)UTRSUBDOM(ECAFRETNI584SREDIUGSNOITACINUMMOC
11EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
Function Code 10H Modbus Implementation: Preset Multiple Registers
MX350 Implementation: Store Multiple Setpoints
This function code allows multiple Setpoints to be stored into the MX350 memory. Modbus
“registers” are 16-bit (two byte) values transmitted high order byte first. Thus all
MX350setpoints are sent as two bytes. The maximum number of Setpoints that can be
stored in one transmission is dependent on the slave device. Modbus allows up to a
maximum of 60 holding registers to be stored. The MX350response to this function code is
to echo the slave address, function code, starting address, the number of Setpoints stored,
and the CRC.
For example, consider a request for slave 17 to store the value 00 02 to setpoint address 04
5C and the value 01 F4 to setpoint address 04 5D. After the transmission in this example is
complete, MX350 slave 17 will have the following setpoints information stored:
The master/slave packets have the following format:
Table 7: MASTER/SLAVE PACKET FORMAT FOR FUNCTION CODE 10H
Error Responses When a MX350 detects an error other than a CRC error, a response will be sent to the
master. The MSBit of the FUNCTION CODE byte will be set to 1 (i.e. the function code sent
from the slave will be equal to the function code sent from the master plus 128). The
following byte will be an exception code indicating the type of error that occurred.
Transmissions received from the master with CRC errors will be ignored by the MX350.
The slave response to an error (other than CRC error) will be:
SLAVE ADDRESS: 1 byte
FUNCTION CODE: 1 byte (with MSbit set to 1)
EXCEPTION CODE: 1 byte
ataDsserddA
2000C540
4F10D540
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 10 store setpoints
DATA STARTING ADDRESS 2 04 5Csetpoint address 04
5C
NUMBER OF SETPOINTS 2 00 022 setpoints= 4 bytes
total
BYTE COUNT 1 04 4 bytes of data
tnioptesrofatad200021ATAD
address 04 5C
tnioptesrofatad4F1022ATAD
address 04 5D
edocrorreCRC11132CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave
17
FUNCTION CODE 1 10 store setpoints
DATA STARTING ADDRESS 2 04 5Csetpoint address 04
5C
NUMBER OF SETPOINTS 2 00 022 setpoints
edocrorreCRCA7282CRC

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM21
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
CRC: 2 bytes
The MX350 implements the following exception response codes:
01 - ILLEGAL FUNCTION
The function code transmitted is not one of the functions
supported by the MX350.
02 - ILLEGAL DATA ADDRESS
The address referenced in the data field transmitted by the
master is not an allowable address for the MX350.
03 - ILLEGAL DATA VALUE
The value referenced in the data field transmitted by the
master is not within range for the selected data address.
Performing commands using Function Code 10H
All commands other than net control commands can be performed using function code 16
as well as function code 5. When using FUNCTION CODE 16, the Command Function
register must be written with a value of 5. The Command Operation register must be
written with a valid command operation number. The Command Data registers must be
written with valid data; this is dependent upon the command operation.
For example, consider a request for slave 17 to perform command operation 1 (RESET): The
master/slave packets have the following format:
Table 8: MASTER/SLAVE PACKET FORMAT FOR PERFORMING COMMANDS
MASTER TRANSMISSION BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message for slave 17
FUNCTION CODE 1 10 store multiple
setpoints
DATA STARTING ADDRESS 2 00 80setpoint address 00
80
NUMBER OF SETPOINTS 2 00 022 setpoints= 4 bytes
total
BYTE COUNT 1 04 4 bytes of data
00sserddarofatad500021ATAD 80
00sserddarofatad100022ATAD
81
edocrorreCRCECE72CRC
SLAVE RESPONSE BYTES EXAMPLE DESCRIPTION
SLAVE ADDRESS 1 11 message from slave
17
FUNCTION CODE 1 10 store multiple
setpoints
DATA STARTING ADDRESS 2 00 80setpoint address 00
80
NUMBER OF SETPOINTS 2 00 022 setpoints
edocrorreCRC0B242CRC

)UTRSUBDOM(ECAFRETNI584SREDIUGSNOITACINUMMOC
31EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
Using the User
Definable Memory
Map
The MX350 contains a User Definable area in the memory map. This area allows re-
mapping of the addresses of any Actual Values or Setpoints registers. The User Definable
area has two sections:
1. A Register Index area (memory map addresses 020BH-0287H) that contains 125
Actual Values or Setpoints register addresses.
2. A Register area (memory map addresses 020BH-0287H) that contains the data at the
addresses in the Register Index.
Register data that is separated in the rest of the memory map may be re-mapped to
adjacent register addresses in the User Definable Registers area. This is accomplished by
writing to register addresses in the User Definable Register Index area. This allows for
improved throughput of data and can eliminate the need for multiple read command
sequences. The User Definable Register Index is stored as a setpoint and therefore it is
“remembered” even when the power is removed.
For example, if the values of ATS STATUS (register address 013FH; modbus address 30320)
and EXERCISER STATUS (register address 0838H; modbus address 32105) are required to be
read from a MX350, their addresses may be re-mapped as follows:
1. Write 30320 to address 020BH (40524) (User Definable Register Index 0000) using
function code 06 or 16.
2. Write 32105 to address 020CH (40525) (User Definable Register Index 0001) using
function code 06 or 16.
The MX350PC software can be used to write these locations to the User Definable Register
Index using the Setpoints > Modbus Memory Map > User Map screen.
It is now possible to read these two data registers with one read, at addresses 020BH,
020CH. Address 020BH will contain ATS STATUS. Address 020CH will contain EXERCISER
STATUS.

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM41
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
Modbus memory map
Modbus Hex Description Min Max Step Units Format Default Size in
Words
ACTUAL VALUES
PRODUCT INFORMATION
30001 0000 Product Device Code ------------ F22 N/A 1
30002 0001 Hardware Revision------------ F15 N/A 1
30003 0002 Firmware Version ------------ F3 N/A 1
30004 0003 Display Software Version------------ F3 N/A 1
30005 0004 Modification Number------------ F1 N/A 1
30006 0005 Boot Version ------------ F3 N/A 1
30007 0006 Boot Modification #------------ F1 N/A 1
30008 0007 Serial Number------------ F22 N/A 6
30014 000D Order Code ------------ F22 N/A 16
30030 001D MAC Address ------------ F22 N/A 6
30036 0023 Reserved ------------------ 1
30037 0024 Build Date ------------ F22 N/A 6
30043 002A Build Time------------ F22 N/A 4
30047 002E Original Calibration Date ------------ F18 N/A 2
30049 0030 Last Calibration Date ------------F18N/A 2
30051 0032 Communications Build Date ------------ F22 N/A 6
30057 0038 Communications Build Time------------ F22 N/A 4
30061 003C Communications Revision ------------ F3 N/A 1
30062 003D Platform Version ------------ F3 N/A 1
30063 003E Reserved ------------------ 1
to to Reserved ------------------ 1
30185 00B8 Reserved ------------------ 1
LAST FAULT DATA
30186 00B9 Reserved ------------------ 1
30187 00BA Reserved ------------------ 2
30189 00BC Reserved ------------------ 2
30191 00BE Reserved ------------------ 1
30192 00BF Reserved ------------------ 2
30194 00C1 Reserved ------------------ 2
30196 00C3 Reserved ------------------ 2
30198 00C5 Reserved ------------------ 1
to to Reserved ------------------ 1
30201 00C8 Reserved ------------------ 1
30202 00C9 Reserved ------------------ 1
30203 00CA Reserved ------------------ 2
30205 00CC Reserved ------------------ 1
30206 00CD Reserved ------------------ 1
30207 00CE Reserved ------------------ 1
30208 00CF Reserved ------------------ 1
30209 00D0 Reserved ------------------ 1

)UTRSUBDOM(ECAFRETNI584SREDIUGSNOITACINUMMOC
51EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM
30210 00D1 Reserved ------------------ 1
30211 00D2 Reserved ------------------ 1
30212 00D3 Reserved ------------------ 2
30214 00D5 Reserved ------------------ 2
30216 00D7 Reserved ------------------ 1
30217 00D8 Reserved ------------------ 1
30218 00D9 Reserved ------------------ 1
to to Reserved ------------------ 1
30222 00DD Reserved ------------------ 1
REAL-TIME CLOCK
30223 00DE Weekday------------FC171N/A 1
30224 00DF Date Read Only ------------F18N/A 2
30226 00E1 Time Read Only------------ F19 N/A 2
30228 00E3 Daylight SavingsActive ------------FC126N/A 1
30229 00E4 Reserved ------------------ 1
30230 00E5 Total Number of Trips ------------ F1 N/A 1
30231 00E6 Reserved ------------------ 1
to to Reserved ------------------ 1
30282 0119 Reserved ------------------ 1
CONTACT/VIRTUAL INPUTS/OUTPUTS STATUS
30283 011A Contact Input 64-33 (Bit Field)------------FC168N/A 2
30285 011C Contact Input 32-1 (Bit Field)------------FC167N/A 2
30287 011E Reserved ------------------ 1
30288 011F Virtual Input 32-1 (Bit Field)------------FC167N/A 2
30290 0121 Virtual Output 32-1 (Bit Field)------------FC167N/A 2
30292 0123 Reserved ------------------ 2
to to Reserved ------------------ 1
30297 0128 Reserved ------------------ 1
30298 0129 Contact Output 32-1 (Bit Field)------------FC167N/A 2
30300 012B Reserved ------------------ 1
30301 012C Reserved ------------------ 1
SECURITY
30302 012D Current Security Access Level ------------ F1 N/A 1
30303 012E Reserved ------------------ 1
to to Reserved ------------------ 1
30317 013C Reserved ------------------ 1
STATUS - ATS
30318 013D Source Status ------------FC158---
30319 013E Source 2 Status ------------FC158---
30320 013F ATS Status------------FC315---
30321 0140 Reserved ------------------ 1
30322 0141 Reserved ------------------ 1
NET CONTROL STATUS
30323 0142 Net Control ------------ FC321---
30325 0144 Reserved ------------------ 1
CURRENT METERING
Modbus Hex Description Min Max Step Units Format Default Size in
Words

EDIUGSNOITACINUMMOC–METSYSLORTNOCREFSNARTCITAMOTUA053XM61
EDIUGSNOITACINUMMOC)UTRSUBDOM(ECAFRETNI584SR
2A/N01FA---------nI541062303
2A/N01FA---------aI741082303
2A/N01FA---------bI941003303
2A/N01FA---------cIB41023303
2A/N01FA---------gvaID41043303
30336 014E Reserved ---------------N/A 1
30337 0150 Current Unbalance --------- %Ub F1 N/A 1
2A/N01FA---------nI151083303
VOLTAGE METERING
30340 0153 Va1 Angle--------- ° F1 N/A 1
30341 0154 Vb1 Angle --------- ° F1 N/A 1
30342 0155 Vc1 Angle --------- ° F1 N/A 1
30343 0156 Reserved ------------------ 1
30344 0157 Reserved ------------------ 1
30345 0158 Reserved ------------------ 1
30346 0159 Va2 Angle--------- ° F1 N/A 1
30347 015A Vb2 Angle --------- ° F1 N/A 1
30348 015B Vc2 Angle --------- ° F1 N/A 1
30349 015C Reserved ------------------ 1
to to Reserved ------------------ 1
30357 0164 Reserved 1
1A/N1FV---------baV561085303
1A/N1FV---------cbV661095303
1A/N1FV---------acV761006303
30361 0168 Average Line Voltage--------- V F1 N/A 1
1A/N1FV--
-------naV961026303
1A/N1FV---------nbVA61036303
1A/N1FV---------ncVB61046303
30365 016C Reserved ------------------ 1
1A/N3FzH---------qerFD61066303
1A/N1FV---------2SbaVE61076303
1A/N1FV---------2ScbVF61086303
1A/N1FV---------2SacV071096303
30370 0171 Average Line Voltage S2--------- V F1 N/A 1
1A/N1FV---------2SnaV271017303
1A/N1FV---------2SnbV371027303
1A/N1FV---------2SncV471037303
30374 0175 Average Phase Voltage S2 --------- V F1 N/A 1
1A/N3Fz
H---------2SqerF671057303
30376 0177 Reserved ------------------ 1
30377 0178 Reserved ------------------ 1
30378 0179 Reserved ------------------ 1
30379 017A Voltage Unbalance S2--------- %Ub F1 N/A 1
30380 017B Reserved ------------------ 1
to to Reserved ------------------ 1
30383 017E Reserved ------------------ 1
Modbus Hex Description Min Max Step Units Format Default Size in
Words