Reading MM440 VFD Data via USS Protocol on 8051 Microcontroller

1. Problem Overview

Reading process variables (motor voltage, current, RPM) out of a Siemens MICROMASTER 440 (MM440) drive into an external 8-bit controller is a routine requirement in retrofit panels, laboratory drives, and educational projects. The MM440 exposes a serial interface on terminals 29 (+) and 30 (−) that speaks the USS (Universal Serial Interface) protocol on RS-485. Any microcontroller with a UART and an RS-485 transceiver (e.g., MAX485, SN75176) can be wired to these two terminals and used as either a master (issuing setpoints and reading back) or a pure monitor (only reading).

This article consolidates the field-proven configuration for a read-only USS link from an 8051-class MCU to an MM440. It covers the parameter set (P0700, P1000, P2010–P2014, P2016), the exact binary telegram layout (STX, LGE, ADR, PZD, BCC), checksum computation, and a complete C-language transmit routine that can be pasted into Keil µVision or SDCC.

2. USS Protocol Fundamentals

USS is a Siemens-defined, half-duplex, master-slave serial protocol sitting on top of RS-485 at selectable baud rates (1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 bit/s). One master addresses one of up to 31 slaves; slaves never transmit without being polled. Each telegram is a single contiguous frame, and the bus must be silent for at least the start delay (parameter P2012, default 0 ms) before a new frame is sent.

3. MM440 Hardware: Terminals 29 and 30

On the MM440 control board, the bottom row of the terminal block carries the RS-485 link:

Use a twisted pair for 29/30 and keep the cable under 100 m at 9600 bps for the MM440's built-in RS-485 transceiver. A 120 Ω termination resistor is recommended at each physical end of the bus, switchable in by setting bit 0 of P2014 if the drive is the last node.

4. Parameter Configuration for Monitor-Only USS

To leave the existing terminal command source intact and only read data over USS, drive control must come from the digital/analog terminals (P0700 = 2) and the setpoint from analog input 1 (P1000 = 3). The USS channel is enabled for monitoring by leaving P2000 enabled and configuring the PZD length.

Critical PZD mapping for the read-back (configured by P2016):

5. USS Telegram Structure

Every USS frame has the following fixed layout. All multi-byte fields are transmitted low byte first on the wire (little-endian).

For 4 PZD words: LGE = (1 ADR + 8 PZD + 1 BCC) = 0x0A. For 2 PZD: LGE = 0x06. The total frame on the wire is therefore 12 bytes (4 PZD) or 8 bytes (2 PZD).

6. Checksum (BCC) Calculation

The block check character is the byte-wise exclusive-OR of every payload byte after LGE and including BCC's own position. Concretely, for the 4-PZD frame:

BCC = ADR ^ PZD1_LO ^ PZD1_HI ^ PZD2_LO ^ PZD2_HI
         ^ PZD3_LO ^ PZD3_HI ^ PZD4_LO ^ PZD4_HI ^ 0xFF

The trailing 0xFF is a constant recommended by Siemens and is included in the XOR. For the canonical 4-PZD request telegram with ADR=0x03, control word 0x0400 (wire order 0x00, 0x04), and three zero PZD words, the checksum evaluates to 0x0F.

7. 8051 Implementation

7.1 UART and Timer Setup (11.0592 MHz crystal)

// 9600 bps, 8E1
SCON  = 0xD0;     // Mode 3, 9-bit, REN enabled
TMOD  = 0x20;     // Timer 1, mode 2 (auto-reload)
TH1   = 0xFD;     // Reload for 9600 bps @ 11.0592 MHz
TR1   = 1;
// TB8 holds the even parity bit, computed per byte
// Set SM2=0 to ignore the 9th bit on receive

7.2 Building the 4-PZD Request Frame

unsigned char uss_request[12];

void build_uss_request(void)
{
    uss_request[0]  = 0x02;            // STX
    uss_request[1]  = 0x0A;            // LGE for 4 PZD
    uss_request[2]  = 0x03;            // ADR = slave 3 (P2011[0])
    // PZD1 control word = 0x0400, low byte first
    uss_request[3]  = 0x00;
    uss_request[4]  = 0x04;
    // PZD2 setpoint = 0 (monitor-only)
    uss_request[5]  = 0x00;
    uss_request[6]  = 0x00;
    // PZD3 = 0
    uss_request[7]  = 0x00;
    uss_request[8]  = 0x00;
    // PZD4 = 0
    uss_request[9]  = 0x00;
    uss_request[10] = 0x00;
    // BCC
    uss_request[11] = compute_bcc(&uss_request[2], 9);
}

unsigned char compute_bcc(unsigned char *p, unsigned char n)
{
    unsigned char bcc = 0xFF;
    unsigned char i;
    for (i = 0; i < n; i++) bcc ^= p[i];
    return bcc;
}

7.3 Transmit and Receive Half-Duplex Sequence

void uss_poll(void)
{
    unsigned char i, c;
    // Drive DE/RE high to transmit
    RS485_DIR = 1;
    for (i = 0; i < 12; i++) tx_byte(uss_request[i]);
    while (!TI_flag);              // wait last byte shifted out
    RS485_DIR = 0;                 // switch to receive
    // 12 byte response expected for 4-PZD echo
    for (i = 0; i < 12; i++) {
        rx_byte(&c, 50);           // 50 ms timeout per byte
        uss_response[i] = c;
    }
    if (uss_response[11] != compute_bcc(&uss_response[2], 9)) {
        // checksum mismatch – discard
        return;
    }
    // Extract engineering values
    //   frequency = (PZD2) * 0.01 Hz  (PZD2 = uss_response[5] | (uss_response[6]<<8))
    //   current   = (PZD3) * 0.01 A   (scaled by P2002)
    //   torque    = (PZD4) * 0.01 Nm  (scaled by P2003)
    display_freq = ((unsigned int)uss_response[5])
                 | ((unsigned int)uss_response[6] << 8);
    display_current = ((unsigned int)uss_response[7])
                    | ((unsigned int)uss_response[8] << 8);
    lcd_update();
}

8. Realterm Validation Procedure

Before porting to the 8051, validate the telegram from a PC. This catches wiring, baud rate, and parameter issues in minutes.

1. Open Realterm. Set Port to the COM port of the USB-to-RS485 adapter. Set Baud to 9600, Parity to Even, Data to 8, Stop to 1.
2. Click Send. Switch the hex tab and enter the 12-byte frame: 02 0A 03 00 04 00 00 00 00 00 00 0F.
3. Within ~5–10 ms, the MM440 will echo an identical-length frame containing the ZSW1 status word and three actual-value PZD words.
4. If nothing returns, swap 29/30 (the bus is polarity-sensitive), confirm the green COM LED on the MM440 blinks, and check that P2010[0] reads 6 on the drive keypad.

9. Common Failure Modes and Fixes

10. Reading Voltage, Current, and RPM in Practice

The 4-PZD response carries:

• ZSW1 – status word, bits 0/1/2/3/4/5/6/10 indicate ready, run, fault, no OFF2, no OFF3, inhibit, fault present, controller inhibit.
• Actual frequency in 0.01 Hz steps (P2016 default = 0 → r0024). Convert to RPM with: RPM = freq_Hz × 60 / motor_pole_pairs.
• Actual current in 0.01 A steps (P2016 default = 1 → r0027, scaled by P2002). Already in amps once the 0.01 multiplier is applied.

Output voltage is not in the default 4-PZD mapping. To get DC-link or output voltage, add a fifth actual value by using the PKW area: P2013[0] = 4 (3 PKW words, the standard "parameter channel"). Then issue parameter read requests using the PKW protocol. For monitor-only simplicity, the more common path is to enable P2016[3] = 5 to map r0025 (output voltage) to PZD4, and to leave the torque on the bus via a 5th PZD (P2012 = 5, P2013 = 0).

11. Engineering Scaling Reference

For an MM440 set to 400 V / 50 Hz / 5 A with P2000 = 50, P2001 = 400, P2002 = 5, P2003 = 12:

• Frequency PZD 0x4000 = 50 Hz
• Voltage PZD 0x4000 = 400 V
• Current PZD 0x4000 = 5 A
• Torque PZD 0x4000 = 12 Nm

12. Verification Checklist

1. Realterm echoes a 12-byte frame containing the ZSW1 bit pattern 0x0631 or 0x0231 (depending on run state) when a 0x0400 control word is sent.
2. 8051 firmware latches the same PZD values into RAM within 20 ms of each poll.
3. LCD displays frequency in Hz that matches the BOP/AOP readout to within ±0.1 Hz.
4. No fault F0070 (COM link) is logged in r0947 after 30 minutes of operation.
5. Removing the 120 Ω termination introduces a slow climb in read errors, confirming the bus is wired correctly when the error count is zero.

13. FAQ