The inverter provides an RS485 communication interface and supports the Modbus-RTU communication protocol. Users can achieve centralized control through computers or PLCs using this communication protocol to set inverter operation commands, modify or read function code parameters, and read the inverter’s operating status and fault information.
This serial communication protocol defines the content and usage format of the information transmitted in serial communication. It includes the master polling (or broadcasting) format, the encoding method of the master, which includes the function code requesting action, transmission data, and error checking. The response from the slave also follows the same structure, including action confirmation, returning data, and error checking. If the slave encounters an error while receiving information or cannot complete the action requested by the master, it will organize a fault message as a response to the master.
8.1.1 Application Modes
The inverter connects to a “single master multiple slave” PC/PLC control network with an RS485 bus as a communication slave.
8.1.2 Bus Structure
Hardware Interface: Comes with communication interface A+ and B- terminal connectors.
Topology:
Single master multiple slave system. Each communication device in the network has a unique slave address, with one device serving as the communication master (PC host, PLC, HMI, etc.). The master initiates communication and performs parameter read or write operations on the slaves, while other devices act as communication slaves, responding to inquiries or communication operations from the master regarding themselves. Only one device can send data at a time, with the rest in a receiving state. The slave address is set within the range of 1 to 247, with 0 reserved for broadcast communication. Each slave address in the network must be unique.
Communication Transmission Mode:
Asynchronous serial, half-duplex transmission. Data in serial asynchronous communication is transmitted in the form of frames, with one frame sent at a time. According to the MODBUS-RTU protocol, when there is no data on the communication data line for a time greater than 3.5 byte transmission time, it indicates the start of a new communication frame.
The Modbus communication transmission method
The built-in communication protocol of the inverter is the Modbus-RTU slave communication protocol, which can respond to the host’s “queries/commands” or perform corresponding actions based on the host’s “queries/commands,” and communicate data responses.
The host can be a personal computer (PC), industrial control equipment, or programmable logic controller (PLC), etc. The host can communicate individually with a specific slave or broadcast messages to all subordinate slaves. For individual access by the host through “queries/commands,” the accessed slave must return a response frame. For broadcast messages sent by the host, slaves do not need to provide responses.
8.1.3 Communication Data Structure
The Modbus protocol defines the format of communication data as shown below. The inverter only supports the reading or writing of Word-type parameters. The corresponding communication read operation command is 0x03, and the write operation command is 0x06. Byte or bit read/write operations are not supported:
Modbus Communication Data Format
In theory, the host computer can read several consecutive function codes at once (up to a maximum of 12), but it should be noted that it cannot skip the last function code in this group. Otherwise, an error response will be given.
Modbus Communication Data Format
If the slave detects a communication frame error or other reasons leading to unsuccessful read/write operations, it will respond with an error frame.
Modbus Communication Data Format
8.1.4 Frame Field Description
Field
Description
START (Frame Header)
Greater than 3.5 character transmission time of idle
ADR (Slave Address)
Communication address range: 1~247; 0 = broadcast address
Internal parameter address of the inverter, represented in hexadecimal; divided into functional and non-functional parameters (such as operating status parameters, operating commands, etc.). See address definition for details. During transmission, the high byte comes first, followed by the low byte
Function Code Address (Low)
Same as above
Function Code Count (High)
Number of function codes read in this frame. If 1, it means reading 1 function code. During transmission, the high byte comes first, followed by the low byte. This protocol can only rewrite one function code at a time, and there is no such field.
Function Code Count (Low)
Same as above
Data (High)
Response data or specially written data. During transmission, the high byte comes first, followed by the low byte.
Data (Low)
Same as above
CRCCHK (High)
Check value: CRC16 checksum value. During transmission, the high byte comes first, followed by the low byte. Refer to the CRC verification section for calculation method.
CRCCHK (Low)
Same as above
END
3.5 character time
8.1.5 CMD Verification Method
The verification method is the CRC (Cyclical Redundancy Check) method, using the RTU frame format. The message includes an error detection field based on the CRC method. The CRC field checks the content of the entire message. The CRC field consists of two bytes containing a 16-bit binary value. It is calculated by the transmitting device and added to the message. The receiving device recalculates the CRC of the received message and compares it with the value in the received CRC field. If the two CRC values are not equal, it indicates a transmission error.
During the CRC calculation, the initial value is set to 0xFFFF, and then each consecutive 8-bit byte in the message is processed with the current value in the register. Only the 8-bit data in each character is valid for CRC, while the start bit, stop bit, and parity bit are invalid.
In the CRC generation process, each 8-bit character is individually XORed with the register content, and the result is shifted towards the least significant bit (LSB) direction, with the most significant bit (MSB) filled with 0. The LSB is extracted for checking. If the LSB is 1, the register is XORed with a preset value, and if the LSB is 0, no operation is performed. This process is repeated 8 times. After the last bit (8th bit) is completed, the next 8-bit byte is XORed individually with the current value in the register. The final value in the register is the CRC value after all bytes in the message have been processed. When adding CRC to the message, the low byte is added first, followed by the high byte. The CRC function is as follows:
For reading and writing function code parameters (some function codes cannot be changed and are only used by the manufacturer or for monitoring):
The parameter address is represented by the function code group number and label:
High byte: PO~PF (P group) AO-AF (A group) 70~7F (U group)
Low byte: 00~FF
For example, if you want to access the range of function code P3-12, the access address for the function code is represented as F30CH.
Note:
PF group: Parameters cannot be read or changed.
U group: Parameters can only be read and cannot be changed.
Some parameters cannot be changed when the inverter is in operation; some parameters cannot be changed regardless of the state of the inverter; when changing function code parameters, pay attention to the range, unit, and related instructions of the parameters.
Function Code Group Number
Communication Access Address
Communication Modify RAM Function Code Address
P0~PE Group
0xF000~0xFEFF
0x0000~0x0EFF
A0~AC Group
0xA000~0xACFF
0x4000~0x4CFF
U0 Group
0x7000~0x70FF
Read-only, cannot be written
Note:
Due to frequent EEPROM storage, it will reduce the service life of EEPROM. Therefore, for some function codes, no storage is required in communication mode, and only changing the value in RAM is sufficient.
If it is a P group parameter, to implement this function, simply change the high byte F of the function code address to 0. If it is an A group parameter, to implement this function, simply change the high byte A of the function code address to 4.
Writing to RAM corresponding function code addresses:
High byte: 00~0F (P group) 40~4F (A group)
Low byte: 00~FF
For example, the function code P3-12 is not stored in EEPROM, the address is represented as 030CH;
Function code A0-05 is not stored in EEPROM, the address is represented as 4005H.
Note:
This address representation can only be used for writing to RAM, not for reading actions. When reading, it is an invalid address. For all parameters, you can also use command code 07H to implement this function.
8.1.7 Shutdown/Running Parameters Section:
Parameter Address
Parameter Description
Parameter Address
Parameter Description
1000H
Communication setting value (Decimal) -10000-10000
1010H
PID setting
1001H
Operating frequency
1011H
PID feedback
1002H
Bus voltage
1012H
PLC step
1003H
Output voltage
1013H
Input pulse frequency, unit 0.01kHz
1004H
Output current
1014H
Feedback speed, unit 0.1Hz
1005H
Output power
1015H
Remaining running time
1006H
Output torque
1016H
All calibration voltage
1007H
Operating speed
1017H
AI2 calibration voltage
1008H
DI input flag
1018H
AI3 calibration voltage
1009H
DO output flag
1019H
Line speed
100AH
All voltage
101AH
Current power-on time
100BH
AI2 voltage
101BH
Current running time
100CH
AI3 voltage
101CH
Input pulse frequency, unit 1Hz
100DH
Count value input
101DH
Communication setting value
100EH
Length value input
101EH
Actual feedback speed
100FH
Load speed
101FH
Main frequency X display
1020H
Auxiliary frequency Y display
Note:
The communication setting value is a percentage of the relative value, where 10000 corresponds to 100.00%, and -10000 corresponds to -100.00%.
For dimensional data of frequency, this percentage is relative to the maximum frequency (P0-10); for torque dimensional data, this percentage is P2-10, A2-48, A3-48, A4-48 (torque limit digital setting, corresponding to the first, second, third, and fourth motors respectively).
Control Commands Input to the Inverter: (Write Only)
Parameter Lock Password Verification: (Returns 888H if the password check passes)
Password Address
Password Input
1F00H
*****
8.1.8 Output Control Commands
Command Address
Command Content
Output Control Command Description
2001H
Bit0: DO1 Output Control Bit1: DO2 Output Control Bit2: RELAY1 Output Control Bit3: RELAY2 Output Control Bit4: FMR Output Control Bit5: VDO1 Bit6: VDO2
Digital Output Terminal Control: (Write Only)
2002H
0~7FFF represents 0%~100%
Analog Output AO1 Control: (Write Only)
2003H
0~7FFF represents 0%~100%
Analog Output AO2 Control: (Write Only)
2004H
0~7FFF represents 0%~100%
Pulse (PULSE) Output Control: (Write Only)
8.1.9 Inverter Fault Descriptions
Fault Address
Fault Information
8000H
0000: No Fault 0001: Reserved 0002: Overcurrent during acceleration 0003: Overcurrent during deceleration 0004: Overcurrent during constant speed 0005: Overvoltage during acceleration 0006: Overvoltage during deceleration 0007: Overvoltage during constant speed 0008: Buffer resistor overload fault 0009: Undervoltage fault 000A: Inverter overload 000B: Motor overload 000C: Input phase loss 000D: Output phase loss 000E: Module overheating 000F: External fault 0010: Communication abnormality 0011: Contactor abnormality 0012: Current detection fault 0013: Motor tuning fault 0014: Encoder/PG card fault 0015: Parameter read/write abnormality 0016: Inverter hardware fault 0017: Motor-to-ground short circuit fault 0018: Reserved 0019: Reserved 001A: Running time reached 001B: User-defined fault 1 001C: User-defined fault 2 001D: Power-on time reached 001E: Unload 001F: PID feedback loss during operation 0028: Quick current limiting timeout fault 0029: Motor switch fault during operation 002A: Excessive speed deviation 002B: Motor overspeed 002D: Motor over temperature 005A: Encoder line number setting error 005B: Encoder not connected 005C: Initial position error 005E: Speed
8.1.10 PD Group Communication Parameter Description
0: No Parity, Data Format <8,N,2> 1: Even Parity, Data Format <8,E,1> 2: Odd Parity, Data Format <8,0,1>
0
Pd-02
Device Address
1~247, 0 for Broadcast Address
1
Pd-03
Response Delay
0~20ms
2ms
ℹ️
Response Delay: The time interval from the end of data reception by the inverter until sending data to the host. If the response delay is less than the system processing time, it is based on the system processing time. If the response delay is longer than the system processing time, the system must wait until the response delay time elapses before sending data to the host.
Parameter Code
Name
Range
Factory Default
Pd-04
Communication Timeout
0.0s (Invalid) to 60.0s
2ms
ℹ️
Note:
When the parameter code is set to 0.0s, the communication timeout parameter is invalid.
When the parameter code is set to a valid value, if the interval between consecutive communications exceeds the communication timeout time, the system will report a communication fault error (Err16). Typically, this parameter is set to an invalid value. Setting this parameter in continuous communication systems can monitor communication status.
Parameter Code
Name
Range
Factory Default
Pd-05
Modbus Protocol
0: Non-Standard Modbus Protocol 1: Standard Modbus Protocol
0
ℹ️
Note:
Pd-05=1: Selects the standard Modbus protocol.
Pd-05=0: When reading commands, the number of bytes returned by the slave is one more than the standard Modbus protocol. Refer to the Communication Data Structure section of this protocol for details.
Parameter Code
Name
Range
Factory Default
Pd-06
Communication Current Resolution
0: 0.01A 1: 0.1A
0
ℹ️
Note: Determines the output unit of the current value when communicating to read output current.