Mbenet
Mbenet
Mbenet
Revision F
Last Revision: June 2005
Trademarks
All terms mentioned in this documentation that are known to be trademarks or
service marks have been appropriately capitalized. Invensys Systems, Inc.
cannot attest to the accuracy of this information. Use of a term in this
documentation should not be regarded as affecting the validity of any
trademark or service mark.
Alarm Logger, ActiveFactory, ArchestrA, Avantis, DBDump, DBLoad, DT
Analyst, FactoryFocus, FactoryOffice, FactorySuite, FactorySuite A2, InBatch,
InControl, IndustrialRAD, IndustrialSQL Server, InTouch, InTrack,
MaintenanceSuite, MuniSuite, QI Analyst, SCADAlarm, SCADASuite,
SuiteLink, SuiteVoyager, WindowMaker, WindowViewer, Wonderware, and
Wonderware Logger are trademarks of Invensys plc, its subsidiaries and
affiliates. All other brands may be trademarks of their respective owners.
Contents 3
Contents
Wonderware Modicon MODBUS Ethernet
I/O Server .............................................................5
Introduction ............................................................................................ 5
Communications Protocols................................................................. 5
Accessing Remote Items via the I/O Server ....................................... 7
Getting Started........................................................................................ 8
Configuring the I/O Server..................................................................... 9
Configuring a Topic Definition ............................................................ 10
Topic Definition................................................................................ 10
MBENET Topic Definition ...............................................................11
Saving the I/O Server’s Configuration File.......................................... 16
Save Configuration ........................................................................... 16
Saving Multiple Configuration Files ................................................ 16
Configuring the I/O Server Settings..................................................... 18
Server Settings .................................................................................. 18
Accessing I/O Server Help ................................................................... 20
Contents ............................................................................................ 20
How to Use Help .............................................................................. 20
About Modicon MODBUS Ethernet ................................................ 20
Item Names .......................................................................................... 21
Special Item/Point Naming Conventions ......................................... 23
Monitoring the Status of Communications with a PLC ....................... 29
Using the Status Item in Excel.......................................................... 29
Monitoring the Status of Communications with InTouch .................... 30
Using DDEStatus and IOStatus in Excel.......................................... 30
Reading Values from the I/O Server into Excel ............................ 30
Writing Values to the I/O Server from Excel ....................................... 31
Troubleshooting I/O Server Communications Problems ..................... 32
Debugging Communications Between InTouch and an I/O Server.. 32
Debugging Communications Between SuiteLink and an I/O Server 35
Debugging Communications Between an I/O Server and a PLC..... 35
Wonderware Modicon
MODBUS Ethernet I/O
Server
Introduction
The Wonderware® Modicon MODBUS Ethernet I/O Server (referred to as the
server through the remainder of this User's Guide) is a Microsoft® Windows®
application program that allows access to data in the Modicon PLCs (also
referred to as devices) over an Ethernet network.
The server requires only a standard 10BaseT Ethernet network card (or an
Ethernet card with fiber optic output) to access the Ethernet network. Each
Ethernet Network Card provides an interface to as many PLCs as the Ethernet
topology allows. The server supports Modicon Quantum (6-Digit) Automation
Series controllers equipped with Quantum Ethernet TCP/IP NOE modules
(P/N 140 NOE 211 00 for 10BaseT twisted pair or P/N 140 NOE 251 00 for
fiber optic).
While the server is primarily intended for use with Wonderware InTouch®, it
may be used by any Microsoft Windows program which is capable of acting as
a DDE, FastDDE, or SuiteLink™ client.
Communications Protocols
Dynamic Data Exchange (DDE) is a communications protocol developed by
Microsoft to allow applications in the Windows environment to send/receive
data and instructions to/from each other. It implements a client-server
relationship between two concurrently running applications. The server
application provides the data and accepts requests from any other application
interested in its data. Requesting applications are called clients. Some
applications such as InTouch and Microsoft Excel can simultaneously be both
a client and a server.
FastDDE provides a means of packing many proprietary Wonderware DDE
messages into a single Microsoft DDE message. This packing improves
efficiency and performance by reducing the total number of DDE transactions
required between a client and a server. Although Wonderware's FastDDE has
extended the usefulness of DDE for our industry, this extension is being
pushed to its performance constraints in distributed environments.
SuiteLink uses a TCP/IP-based protocol and is designed specifically to meet
industrial needs such as data integrity, high-throughput, and easier diagnostics.
This protocol standard is only supported on Microsoft Windows 2000,
Windows 2003, and Windows XP.
Getting Started
Wonderware supplies a version of the server for Microsoft Windows 2000,
Windows 2003, and Windows XP. No special Kernel Device Driver is needed.
It uses the standard TCP/IP protocol stack that comes with Windows 2000,
Windows 2003, or Windows XP operating system.
If you have your Ethernet adapter card configured for accessing the Ethernet
network, it will work without modification for communicating with the
Modicon Quantum (6-Digit) Series PLCs.
1. Configure the Modicon MODBUS Ethernet module to have a unique valid
IP Address on the network to which it is connected.
• You may need to see your Network Administrator to obtain valid IP
Addresses.
2. Configure TCP/IP on your computer with a unique IP Address.
3. Make sure that the computer and the PLC or Bridge are either on the same
subnet or are connected by routers and/or bridges.
4. To make sure that your computer can communicate with the PLC or
Bridge, try pinging the IP Address of the Modicon MODBUS Ethernet
module that you are trying to access.
3. To access the options used for the various configurations, open the
Configure menu:
Note If any of the options appear dimmed, these options are not available
with this software version.
Topic Definition
Note Once topics have been defined, their names will be listed in the Topics
section of this dialog box.
• Click this Done button to close the dialog box and accept any new
definitions, modifications, or deletions made.
• To modify or view an existing topic definition, select its name in the list
and click on the Modify button.
• The MBENET Topic Definition dialog box (described below) will
appear displaying the selected topic definition.
• To delete an existing topic definition, select its name in the list and click
on this Delete button.
• A message box will appear prompting you to confirm the deletion.
1. Enter a unique name (up to 32-characters long) for the PLC in this box.
For example:
Node209
Note When communicating with InTouch, this exact name is used as the
topic name in the Access Name definition.
2. Enter the unique IP Address that was configured in the Quantum (6-
Digit) PLC.
• If your computer has access to a Domain Name Server or a HOST
file, then enter the name of the Quantum (6-Digit) host PLC.
• The HOST file is an ASCII text file that maps user-friendly host
names to IP Addresses.
An example of a HOST file entry would be:
10.32.200.209 Wonder0 wonder0
• In this case, enter Wonder0 or wonder0 in the Edit box for the IP
Address.
• If the computer is located on a remote network, then a fully qualified
domain name may be required in the HOST file.
For example:
10.32.200.209 mbe2.wonderware.com
3. In this case, enter mbe2.wonderware.com in the Edit box.
• It is recommended to enter the IP Address, if available.
• This is faster because the server does not have to resolve the name to
an IP Address.
• The number of new topics per PLC (IP Address) is limited to 16
topics per PLC.
4. Enter the Dest_Index if you are using the MODBUS Plus to Ethernet
bridge.
• Enter the Unit_ID if you are using the MODBUS to Ethernet bridge.
• This value may contain any integer from 0 to 255.
5. From the drop-down list box, select the Slave Device Type.
• The Block I/O Sizes will automatically change when a new slave type
is selected
8. Select the option for the style the server uses to store ASCII strings into
the PLC registers.
Note For more information on the String Variable Styles, see the "Item
Names" section in this User's Guide.
10. Enter the maximum number of consecutive coils to be read at one time in
this box.
• In this example, the valid Coil Read values can be between 8 to 1600
and must be an even multiple by 8.
11. Enter in the Coil Write box the maximum number of consecutive coils
that can be written to at one time.
• In this example, the valid Coil Write values can be between 8 to 800
and must be an even multiple by 8.
12. Enter the maximum number of consecutive registers to be read at one time
in this box.
• In this example, the valid Register Read values can be between 1 to
100.
13. Enter the maximum number of consecutive registers that can be written to
at one time in this box.
• In this example, the valid Register Write can be between 1 to 100.
15. Enter the amount of time (in seconds) that the PLCs for this topic will be
given to reply to commands from the server.
16. Click Cancel to close the dialog box without saving changes.
17. Click OK to accept the topic definition and return to the Topic Definition
dialog box.
Save Configuration
This text box displays the drive\directory into which the server will save the
current configuration file.
• To save the configuration file to a different directory, enter the path for
that directory in this box.
This option is selected and disabled on initial entry to the Save Configuration
dialog box.
• This check box becomes selectable if the Configuration File Directory is
changed.
• Once enabled, selecting this option will record a new Configuration File
path in the WIN.INI file.
• This option allows the server to find its configuration file automatically
each time it is started.
Note When the server initially starts up, it attempts to locate its default
configuration file by first checking the WIN.INI file for a previously specified
path. If a path is not present in the WIN.INI file, the server will assume that
the current working directory is to be used.
• Click Defaults to reset the settings to their default values without saving
changes.
• Click OK to save the configuration file to the specified directory.
• This allows you to have multiple configuration files that can be accessed
by using a special switch (/d:).
For example:
1. To start the server using a configuration file located in a different
directory, click the Start button on the Taskbar.
2. Select Run and enter the following in the Open combo box:
MBENET /d:c:\directoryname
• When the Server Settings option is selected, the Server Settings dialog
box will appear.
Server Settings
1. Enter the frequency (in milliseconds) that the server is to check for data to
process.
• This should be approximately two to four times faster than the fastest
rate desired to update data from the equipment.
Note The default protocol timer tick value will vary between servers.
2. To create a new default configuration file, enter in this box the complete
path for the directory in which the file is to be saved.
• This new path will automatically be written to the WIN.INI file and
the server will use this path to load its configuration file the next time
it is started.
3. Enable this option for the server to start as a Windows 2000, Windows
2003, or Windows XP operating system service.
• Windows 2000, Windows 2003, or Windows XP offers the capability
of running applications even when a user is not logged on to the
system. This is valuable when systems must operate in an unattended
mode.
• Enabling this option and rebooting the system will cause the server to
run as a Windows 2000, Windows 2003, or Windows XP service.
4. Disabling this option and restarting the system will cause the server to run
as a Windows application program once again.
Note You must restart the server for the changes to take effect.
Contents
This option is used to display the table of contents for the Help file.
Item Names
The server supports item/point names that are consistent with the point naming
convention used by Modicon PLCs. The server allows you to select a Slave
Type when you configure the topic definition for the PLC.
The following PLC Address Ranges are supported:
File# Range
1 600001-610000
2 610001-620000
3 620001-630000
4 630001-640000
5 640001-650000
6 650001-660000
7 660001-670000
8 670001-680000
9 680001-690000
10 690001-69xxxx
The supported Item Names for Daniel FC, Elliott FC, Omni FC, and
Micromotion slave-device types are consistent with the Item Names used by
Modicon PLCs. However, the Item Name and Read/Write Access may vary
depending upon the application being used. For more information, see your
User's Guide for the device being used.
The following Flow Computer Address Ranges are supported:
Signed Registers
The server normally allows register values in the range of 0 to 65535.
• Registers may be treated as 16-bit signed quantities having values between
-32,768 and 32,767.
• To specify that a register is to be treated as a signed quantity, append a
space and the letter S to the item name.
For example:
To indicate that the first Holding Register is signed, enter "400001 S" for the
item name.
Long Integers
Pairs of registers can be treated as 32-bit signed integers.
• This is done by appending a space and the letter L to the item name.
For example: 400001 L
Floating Point
Pairs of registers can be treated as IEEE 32-bit floating point numbers.
• This is done by appending a space and the letter F to the item name.
For example: 400001 F
Bits In Registers
Individual bits in registers can be read as discrete tags by using the notation
rrrr:b.
• Where rrrr specifies a valid input register or holding register and b
specifies a bit position between 1 and 16 (1 specifies the most significant
bit of the register).
Examples:
400001:1 - Most significant bit of first holding register
300008:16 - Least significant bit of an input register
Note Bits in registers are read-only. The Ethernet protocol has no commands
to write individual register bits.
Explicit Conversions
Registers are normally treated as integers.
• This can be altered for specific registers by adding a blank space (using
the spacebar) and one of the following to the point name:
L - Long
F - Float
I - Integer
M - Message (ASCII Strings)
Modulo-10000 Points
Two or three consecutive registers may be interpreted as a single numeric
quantity.
ASCII Strings
Multiple consecutive registers (1-100) can be treated as a string of ASCII
characters.
• The first character of the string is in the high-order 8 bits of the lowest
numbered register.
• Three options are provided for the representation of variable length
strings:
A. The string may be padded with ASCII spaces (hex 20).
B. The string may be terminated with a zero byte.
C. The length may be stored in the first byte.
Strings of ASCII characters can be stored in consecutive registers in a PLC.
• The number of registers that are allocated to the storage of an individual
string must be fixed.
• However, the string contained in those registers can have a variable length
up to twice the number of registers allocated.
• Strings are stored in the PLC registers from the lowest numbered register
to the highest and within each register, first the most significant byte, then
the least significant byte.
• The server supports three methods of storing strings of ASCII characters
in registers: Full Length, C Style, and Pascal Style.
Full Length
If strings are stored in this manner, the string always uses all of the registers
allocated.
• If the string is shorter than the allocation of registers, it is padded with
ASCII space characters (hex 20) to the full length.
For example:
String item "400001-400010 M" containing the ASCII string "Wonderware":
MSB LSB
400001 57 6F "Wo"
400002 6E 64 "nd"
400003 65 72 "er"
400004 77 61 "wa"
400005 72 65 "re"
400006 20 20 " "
400007 20 20 " "
400008 20 20 " " padded to the end
400009 20 20 " " with ASCII spaces
400010 20 20 " "
C Style
If strings are stored in this manner, the end of the string is marked by a byte of
zero immediately following the last character in the string.
• This option is so named because this is the way strings are stored in the
"C" programming language.
For example:
String item "40001-40010 M" containing the ASCII string "Wonderware":
MSB LSB
400001 57 6F "Wo"
400002 6E 64 "nd"
400003 65 72 "er"
400004 77 61 "wa"
400005 72 65 "re"
400006 0 x end marked by zero
400007 x x the remaining
400008 x x bytes
400009 x x are
400010 x x unused
Pascal Style
If strings are stored in this manner, the length of the string is denoted by a
length byte which occupies the first byte of the string (MSB of the first
register).
• This option is so named because this is the way strings are stored in the
"Pascal" programming language (for most compilers).
For example:
String item "400001-400010 M" containing the ASCII string "Wonderware":
MSB LSB
400001 0A 57 length = 0A (hex) "W"
400002 6F 6E "on"
400003 64 65 "de"
400004 72 77 "rw"
400005 61 72 "ar"
400006 65 x "e"
400007 x x the remaining
400008 x x bytes
400009 x x are
400010 x x unused
Absolute Notation
Absolute item naming conventions are available that are independent of PLC
model numbers.
• The absolute notation allows accessing of the four Ethernet data types,
each with an address from 0 to 65535.
• The data types are indicated by the item name suffix characters as follows:
nnnnn DO (Discrete Output)
Refers to the same data Ethernet calls "coils"
(valid range is 0 DO through 65535 DO).
nnnnn DI (Discrete Input)
Refers to the same data Ethernet calls "contacts"
(valid range is 0 DI through 65535 DI).
nnnnn IR (Input Registers)
Refers to the same data Ethernet calls "input
registers" (valid range is 0 IR through 65535 IR).
nnnnn HR (Holding Registers)
Refers to the same data Ethernet calls "holding
registers" (valid range is 0 HR through 65535
HR).
nnnnn PV (Process Variable)
Refers to holding registers but treats them as
floating points and assumes 2 registers per
floating point number. The valid range is 0 PV
through 32767 PV.
The IR and HR absolute notations can also be combined with the following
conversions: L (long), F (floating point), or S (signed).
For example: :
219 HRS 16-bit signed integer
0 HRL 32-bit signed integer
100 HRF 32-bit floating point
Unsolicited Data
Unsolicited Data has no special point naming conventions. However, due to
the architecture of the Modicon PLCs, only 4xxxxx tags may be specified to be
read with unsolicited messages.
Global Data
The server does not support Global Data.
Where:
MBENET Is the name of the server application.
Node209 Is the exact topic name defined in the server for the
PLC.
400001 Is the actual location in the PLC that contains the data
value. This is the item name.
In this example, each time the value of 400001 changes in the PLC, the server
will automatically send the new value to the cell containing the formula in
Excel.
Note Refer to the Microsoft Excel manual for complete details on entering
Remote Reference formulas for cells.
=POKE(channel,"itemname", Data_Reference)
POKEs the value contained in the Data_Reference to the specified item name
(actual location in the PLC) via the channel number returned by the previously
executed INITIATE function
• Data_Reference is the row/column ID of the cell containing the data
value.
=TERMINATE(channel)
Closes the channel at the end of the macro.
• Some applications have a limited number of channels therefore, they
should be closed when finished.
• Channel is the channel number returned by the previously executed
INITIATE function.
=RETURN()
Marks the end of the macro.
Note Refer to the .XLM sample Excel poke macro provided in the installed
server’s directory. Also refer to the Microsoft Excel manual for complete
details on entering Remote Reference formulas for cells.
Note This is a general troubleshooting guide and for the sake of brevity we
cannot cover every possible source of communications problems.
Note All Wonderware version 7.0 or later servers support both DDE and
SuiteLink. However, the SuiteLink protocol is only supported on the Windows
2000, Windows 2003, or Windows XP operating system.
Note It is highly recommended that you start all the servers required by the
InTouch application before starting WindowViewer. InTouch (versions prior to
7.0) will display the Initiating DDE Conversation message box for each
uninitiated conversation.
For example:
If you start up WindowViewer and cannot successfully establish a
conversation with a server, the following Initiating DDE Conversation
dialog box will appear:
• The information in the second line indicates that you have at least one I/O
type tagname defined in your Tagname Dictionary that is associated with
an Access Name that defines OMRONFO as the Application Name, and
HLPLC as the Topic Name.
• Make note of exactly how the application and topic names are spelled.
Note This example only applies when using a version of InTouch prior to
InTouch 7.0.
If the I/O Server is running, verify that the I/O Server's program
name is correct in all WindowMaker Access Name definitions.
1. Switch to (or start) WindowMaker.
2. Select Access Names from the Special menu.
• The Access Name Definitions dialog box appears listing all Access
Names defined in the WindowMaker.
3. In the Access Names list, select the Access Name referencing the server
and click Modify.
• The Modify Access Name dialog box will appear.
4. Verify the server's program name in the Application Name box is correct.
5. If it is wrong, correct it and then click OK; else click Cancel.
Note The server's exact "executable name" must be typed in the Application
Name box in all Access Name definitions. The ".exe" extension is not used.
Note If you are debugging a remote tagname reference, also verify that the
node name for the remote computer in the Node Name box is correct.
6. Repeat steps 3 through 5 and verify the server program name is correct in
all Access Names that use it.
Note Blank spaces cannot follow the topic name in either the server's Topic
Definition or the Access Name definition.
Note The data in the server’s program window indicates the read and write
messages the server is sending to and receiving from the PLC. These are not
error messages; only status messages are written to the server’s program
window.
Note For more information on the Wonderware Logger, see your online
FactorySuite System Administrator's Guide.
Try communicating to the I/O Server using the DDE protocol. If this
is not possible, proceed to the next troubleshooting section;
otherwise continue with the following steps:
1. Verify Microsoft's TCP/IP stack is installed and configured properly.
Note SuiteLink uses the Microsoft TCP/IP stack for its communications even
if the client application and the server reside on the same node.
2. If you do not have an Ethernet card to bind to the TCP/IP stack, install the
Microsoft Loop Back Adapter.
3. Install the Microsoft TCP/IP stack.
Note For more information on the Wonderware Logger, see your online
FactorySuite System Administrator's Guide.
For example:
Some of the most common errors that may appear in the Wonderware Logger
for serial servers are as follows:
Response Timeout
WCRET = -2
WakeUp = -2
Receive Overrun
Framing Errors
Note If you are using a server that requires a TSR, you will not be able to
verify that the port is functioning properly while the TSR is running. Stop all
TSRs then continue with this procedure. If you confirm that the port functions
properly without the TSR running, change your software interrupt (IRQ) to
another number. For example, change 60 to 62.
Note Also, if you are using an AT-type computer, two devices cannot share
interrupts. Verify that the communicatios port you are using has a unique
interrupt setting.
Note If you do not have two computers and the computer you are using has
another port, start two instances of the HyperTerminal program with each
configured to their own port. Then try communicating between them.
If the PLC or field device has more than one COM port, verify the
connection to the correct port.
The COM port on your computer uses the RS-232 hardware communications
standard and connects the cable from the COM port to an RS-232-compliant
device.
Note To connect to an RS-422 or RS-485 port on the PLC, you need an RS-
232-to-RS-422/485 conversion device.
Note Without Administrator privileges, the server and Server Install program
cannot make the necessary edits to the Windows Registry during installation
or board configuration of the server.
Note Performance of this test depends upon the type of PLC you are using.
Reinstall the I/O Server and verify that you are using the latest
version.
Wonderware is continually improving our servers and using the latest version
will guarantee the best results.
Note New versions of the Wonderware I/O Servers are released regularly on
the Knowledge Base CD. These are available to Comprehensive Support
customers from the Wonderware Web site at:
http://www.wonderware.com/support/mmi.
Note Wonderware server configuration files are typically the exact same
name as the server’s executable name with the .CFG extension. For example,
OMRONFO.CFG. Refer to the Configuration File section of the specific
server User’s Guide for the exact name of the configuration file.
If you feel you have tested all possible situations that may be
causing your failed I/O communications, contact your local
Wonderware distributor for technical support.
Note For more information on obtaining technical support, see your online
FactorySuite System Administrator’s Guide.