Interfacing with the Zoncn NZ100 VFD over Modbus


I recently purchased a new Zoncn NZ100 Variable Frequency Drive to drive a three phase motor used on a CNC. My intention is to integrate it into the controller that controls the CNC over Modbus, which the VFD supports using RS-485.

However, to communicate with it, one must know the registers of the VFD. This isn’t outlined, or even mentioned, in its manual.

Luckily, there are other VFDs which have documented their protocols better, for instance the SKI-780, Salicru CV-50, GS20 and NZ100’s big brother Z2000. The NZ100 implements the Modbus interface as a bit of a mix. Not quite like the Z2000, which surprised me. I thought I had it when I found its manual. However, when I commanded it to start by setting register 0x2000 to 1 as documented on p.176 in the Z2000 manual, nothing happened. The VFD didn’t do anything if I set 0x1000 to a percentage of the desired maximum speed and starting it from the VFD’s control panel, either.

I started looking at the available Modbus documentation for similar VFDs. I tried writing to registers suggested by the documentation of those. All these documents gave me enough hints to be able to figure out how the NZ100 is controlled. Here’s my findings:

The desired output frequency is set in units of 1/10 Hz (instead of 1/100 Hz as is customary) in register 0x2001. An output frequency of 50.0Hz is thus written as 500. The VFD will limit the output frequency according to the values set in parameter P105 (max frequency) and P106 (min frequency).

On the topic of the documented parameters Pxxx: Parameter P105 is available at register address 0xF105. The register P212 is located at 0xF20C. The entire set of parameters outlined in the manual is located according to this pattern. To write a new value without persisting it to the unit’s EEPROM i.e. writing it to RAM, change the F into a 0. Note that reads are invalid at this address. It may be desirable to write to RAM instead of EEPROM, as the write cycles on the EEPROM is limited.

In practice, register 0x2000 and 0x2001 are used to control the frequency and operation of the drive, according to the following table:

Register addressPurposeUnit
0x2000Operation mode

Bit 0-1
00: no function
01: Stop
10: Run
11: Jog+Run

Bit 2-3 Reserved

Bit 4-5
00: no function
01: FWD
10: REV
11: no function

In practice:
0x0001 STOP
0x0022 Run Reverse
0x0012 Run Forward

This register is “edge triggered” meaning that in order to stop the drive, you must send a value setting the Stop bit. It’s not enough to clear the Run bit.
N/A
0x2001Desired output frequency0.1 Hz

Example conversations

Modbus RTU frame format is quite straight-forward. It’s a multi-drop bus, so there’s one client device that initiates communication and one or more servers that each carry a unique address and responds to the requests. In this example, the VFD acts as a Modbus Server on address 1.

The first byte of each frame is the destination address. The second byte is a function code. These VFDs only implements the Modbus function code 3: read holding register and function code 6: write holding register. As a proprietary addition, a temporary write i.e. write to RAM can be performed by issuing a write request using function code 7.

Read P215 Rated Motor Frequency

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
F2 0FStarting addressPhysical: 0xF20F (61967)
Logical: 0xF210 (61968)
00 01Quantity0x0001 (1)
86 B1CRC0x86B1 (34481)
To VFD: 0103f20f000186b1
Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
02Byte count0x02 (2)
01 F4Register value0x01F4 (500)
B8 53CRC0xB853 (47187)
From VFD: 01030201f4b853

Read P212 Rated RPM @ Rated Motor Frequency

Together with P215, P212 helps us figure out what RPM a specific frequency results in. By dividing P212 with P215 (in Hz), we get the number of RPMs for each Hz. My spindle outputs 3000 RPM @ 50.0Hz, which translates to 60RPM/Hz. At the spindle’s maximum frequency, 400Hz, it rotates at 60*400 = 24000 RPM.

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
F2 0CStarting addressPhysical: 0xF20C (61964)
Logical: 0xF20D (61965)
00 01Quantity0x0001 (1)
76 B1CRC0x76B1 (30385)
To VFD: 0103f20c000176b1
Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
02Byte count0x02 (2)
0B B8Register value0x0BB8 (3000)
BF 06CRC0xBF06 (48902)
From VFD: 0103020bb8bf06

Read P105 Maximum Frequency

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
F1 05Starting addressPhysical: 0xF105 (61701)
Logical: 0xF106 (61702)
00 01Quantity0x0001 (1)
A6 F7CRC0xA6F7 (42743)
To VFD: 0103f1050001a6f7
Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
02Byte count0x02 (2)
0F A0Register value0x0FA0 (4000)
BD CCCRC0xBDCC (48588)
From VFD: 0103020fa0bdcc

Read P106 Minimum Frequency

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
F1 06Starting addressPhysical: 0xF106 (61702)
Logical: 0xF107 (61703)
00 01Quantity0x0001 (1)
56 F7CRC0x56F7 (22263)
To VFD: 0103f106000156f7

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
02Byte count0x02 (2)
03 E8Register value0x03E8 (1000)
B8 FACRC0xB8FA (47354)
From VFD: 01030203e8b8fa

Read 0x3000 (status)

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
30 00Starting addressPhysical: 0x3000 (12288)
Logical: 0x3001 (12289)
00 01Quantity0x0001 (1)
8B 0ACRC0x8B0A (35594)
To VFD: 0103300000018b0a

Unconfirmed, but following the Z2000’s description of the status register: 1 – Running (Forward), 2 – Running (Reverse), 3 – Stopped

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
02Byte count0x02 (2)
00 03Register value0x0003 (3)
F8 45CRC0xF845 (63557)
From VFD: 0103020003f845

Read 0x2000 – Desired Output Frequency

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
20 01Starting addressPhysical: 0x2001 (8193)
Logical: 0x2002 (8194)
00 01Quantity0x0001 (1)
DE 0ACRC0xDE0A (56842)
To VFD: 010320010001de0a

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
03Function code0x03 (3) – Read Holding Registers
02Byte count0x02 (2)
0F A0Register value0x0FA0 (4000)
BD CCCRC0xBDCC (48588)
From VFD: 0103020fa0bdcc

Write 0x2000 Operating Mode

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
06Function code0x06 (6) – Write Single Register
20 00Register addressPhysical: 0x2000 (8192)
Logical: 0x2001 (8193)
00 01Register value0x0001 (1)
43 CACRC0x43CA (17354)
To VFD: 01062000000143ca
Part of Data PackageDescriptionValue
01Slave address0x01 (1)
06Function code0x06 (6) – Write Single Register
20 00Register addressPhysical: 0x2000 (8192)
Logical: 0x2001 (8193)
00 01Register value0x0001 (1)
43 CACRC0x43CA (17354)
From VFD: 01062000000143ca

Write 0x2001 Desired Output Frequency

This message tells the VFD that the desired output frequency is 150Hz. At 60RPM/Hz, that is 9000 RPM.

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
06Function code0x06 (6) – Write Single Register
20 01Register addressPhysical: 0x2001 (8193)
Logical: 0x2002 (8194)
05 DCRegister value0x05DC (1500)
D1 03CRC0xD103 (53507)
To VFD: 0106200105dcd103

The VFD confirms by echoing the write request.

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
06Function code0x06 (6) – Write Single Register
20 01Register addressPhysical: 0x2001 (8193)
Logical: 0x2002 (8194)
05 DCRegister value0x05DC (1500)
D1 03CRC0xD103 (53507)
From VFD: 0106200105dcd103

Write 0x2000 Operating Mode

This is the write that starts the spindle. As outlined above, the written value 0x0012 tells the VFD it should Run Clockwise.

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
06Function code0x06 (6) – Write Single Register
20 00Register addressPhysical: 0x2000 (8192)
Logical: 0x2001 (8193)
00 12Register value0x0012 (18)
02 07CRC0x0207 (519)
To VFD: 0106200000120207

The VFD confirms by echoing the write request.

Part of Data PackageDescriptionValue
01Slave address0x01 (1)
06Function code0x06 (6) – Write Single Register
20 00Register addressPhysical: 0x2000 (8192)
Logical: 0x2001 (8193)
00 12Register value0x0012 (18)
02 07CRC0x0207 (519)
From VFD: 0106200000120207


Leave a Reply

Your email address will not be published. Required fields are marked *