Neuron Driver Address Format

General

This document describes the tag address formats for Neuron to setup with various kind of industrial protocol drivers. Each Neuron driver has its own address format that will be parsed in configuration process for machine or device communication.

Allen-Bradley PLC2 (half duplex)

General Details

Address String

STN!DST!ADDR

STN is the slave station device number

DST is the destination node (CPU)

ADDR is the register address as following:

Note: Because the 1771KG is directly connected to the CPU, the STN and DST should be set to the same number (address of 1771KG module).

Example: 16!16 (slave number 20 octal)

16!16!520 (word 1010 octal in slave number 20 octal)

Set 8 (10 octal) for 1771-KG and set 0 for 1785-KE and 1770-KF2 in KG mode

Allen-Bradley PLC5 (half duplex)

General Details

Address String

STN!DST!ADDR

STN is the slave station device number (KE/KF2 module address)

DST is the destination node (CPU)

ADDR is the register address as following.

Note: the KE or KF2 module inserts its address as the source, and this address will be the used data file number in the PLC5.

Example: 28!16 (KE/KF2 module number 34 octal and destination node=CPU number 20 octal). 28!16!10 means word 10 in file N28 in slave number 20 (octal).

Set 8 (10 octal) for 1771-KG and set 0 for 1785-KE and 1770-KF2 in KG mode

Schneider TSX7 SCM (Modbus RTU)

General Details

Address String

STN!ADDR

STN is the slave station number (CPU) (1 – 247)

ADDR is the register address as following.

Example: 10!W100 means word 100 in slave station 10.

Schneider TSX7 SCM (Modbus TCP)

General Details

Address String

ADDR

ADDR is the register address as following:

Example:W4000 means word address 4000.

Schneider Telemecanique UNI-TE

General Details

Address String

STN!ADDR

STN is the slave station number (Ad0 in CPU) (1 – 31)

ADDR is the register address as following:

Example: 1!W100 means word 100 in slave number 1.

ABB SattControl Comli

General Details

Address String

STN!ADDR

STN is the slave station number (CPU) (1 – 247)

ADDR is the register address as following

Example: 1!R100 means word 100 in slave number 1.

Omron Single HostLink (Point to Point)

General Details

Address String

ADDR

ADDR is the register address as following:

Example: DM100 means word 100 in DM data memory area.

Omron Multiple HostLink (MasterSlave)

General Details

Address String

STN!ADDR

STN is station number/module number (0 – 31)

ADDR is the register address as following:

Example: 10!DM100 means word 100 in data memory in slave 10.

Omron FINS on TCP

General Details

Address String

ADDR[.BIT]

ADDR is the data memory word address starting with “DM”

BIT bit(option)

Example: DM100 means word 100 in data memory.

Siemens S5 3964R/RK512

General Details

Address String

ADDR

ADDR is the address as following

DB is the data block (0 – 999)

DBW( word offset ) is the data word in that data block

Example: DB100 (data block 100)

DB100.DBW20 (DBddd.DBWddddd) means data word 20 in data block 100

Siemens S7 3964R/RK512

General Details

Address String

ADDR

ADDR is the address as following

DB is the data block (0 – 999)

DBW(byte offset) is the data word in that data block

Note: The real DBW should be used (eg. DBW0, DBW2 etc) and the driver will read the byte start from 0 and the byte start from 2. It reads a word from byte 0, byte 2 respectively.

Example: DB100 (data block 100)

DB100.DBW20 (DBddd.DBWddddd) means data word 20 in data block 100

Siemens FETCH/WRITE

General Details

Address String

ADDR

ADDR is the address as following

DB is the data block (0 – 999)

DBW(byte offset) is the data word (start) in that data block.

Note: There is a limitation in the protocol. The DB can only be between 1-255 and the start address of a read or write table cannot go beyond DBW2047, however the end of a table can. But during the test, it was possible to start at address DBW32766.

Note: In the Simatic PLC you just define a TCP/IP connection for either FETCH passive (read only) or WRITE passive (write only), listening on a certain port. Currently there is no FETCH/WRITE passive setting, so two connections with different ports are required, one for read and one for write.

Example: DB200.DBW20 (DBddd.DBWddddd) means data word 20 in data block 200.

Siemens Industrial Ethernet S7 ISOTCP

General Details

Address String

ADDR

ADDR is the address as following

Note: DB is the data block (0 – 999)

DBW(byte offset) is the data word (start) in that data block.

Example: DB200.DBW20 (DBddd.DBWddddd) means data word 20 in data block 200.

S7P_SCRTSAP is the source TSAP for S7 protocol(default 0x0101)

S7P_DSTTSAP is the destination TSAP for S7 protocol(default 0x0101)

TSAP(2Byte): frist byte: 0x01: PG or PC, 0x02: OS, 0x03: Others, such as OPC server, s7 plc second byte: |7-4 bit| 3-0bit| |—|—| |rack number|cpu slot|

Notes

An external equipment can access to S71200/1500 CPU using the S7 “base” protocol, only working as an HMI, i.e. only basic data transfer are allowed.

All other PG operations (control/directory/etc..) must follow the extended protocol.

Particularly to access a DB in S71500 some additional setting plc-side are needed.

1. Only global DBs can be accessed.
2. The optimized block access must be turned off.
3. The access level must be “full” and the “connection mechanism” must allow GET/PUT.

Mitsubishi FX0S/FX0N/FX1S/FX1N/FX2

General Details

Address String

ADDR

ADDR is the register address

Example: D100 means word 100 in D data memory area.

Mitsubishi FX2N/FX3U/FX3G Series

General Details

Address String

ADDR

ADDR is the register address as following:

Example: D100 means word 100 in D data memory area.

Mitsubishi Melsec E71 for Q Series

General Details

Caution

Multiple connection requests cannot be handled by a single port in Q series PLCs. When connecting to a PLC using the E71 protocol, be sure to assign a separate port for each neuron instance in the parameter settings of the PLC and specify the protocol as TCP and MC.

Address String

ADDR

ADDR is the register address as following:

Example: D100 means word 100 in D data memory area.

Modbus RTU

General Details

Address String

STN!ADDR[.BIT][#ENDIAN]

STN is slave number or device ID (0-247)

ADDR is the register address as following:

BIT Bit no.(0-15)

ENDIAN Endianness of the value

Modbus TCP

General Details

Address String

STN!ADDR[.BIT][#ENDIAN]

STN is slave number or device ID (0-247)

ADDR is the register address as following:

BIT Bit no.(0-15)

ENDIAN Endianness of the value

Example:2!404001 means word address 4000 with in slave number 2.

Modbus RTU over TCP

General Details

Address String

STN!ADDR[.BIT][#ENDIAN]

STN is slave number or device ID (0-247)

ADDR is the register address as following:

BIT Bit no.(0-15)

ENDIAN Endianness of the value

Example:2!404001 means word address 4000 with in slave number 2.

IEC 61850

General Details

Address String

FC!ADDR

FC is functional constraints value as following:

ADDR is the object reference address string

The IEC61850 data hierarchical model are usually as following:

Physical Device (IED)

Logical Device (LD)

Logical Node (LN)

Object Data (DO)

Object Attribute (DA)

Example:1!testmodelSENSORS/TTMP1.TmpSv.instMag.f

means the functional constraint of this tag is 1 (IEC61850_FC_MX –analog measurands). The object reference address string are (IED) – testmodel, (LD) – SENSORS, (LN) – TTMP1, (DO) – TmpSv, (DA) – instMag.f for floating value.

OPC UA

General Details

Certificate Setting

OPCUA can login to OPC-UA server by user self-signed certificate, certificate and key must meet the following conditions.

• CERTIFICATE and KEYFILE must be set at the same time
• Certificate must be generated by X.509v3 standard
• The SAN field of the Certficate must contain URI:urn:xxx.xxx.xxx, with the “xxx” part being a custom part
• Certificate file and key file must be encoded with DER format

The certificate file can be imported into the target server in advance and set as trust, or it can be set by neuron and submitted automatically and then set as trust by the server.

Certificate generation steps(Windows/Linux/Mac):

$openssl req -config localhost.cnf -new -nodes -x509 -sha256 -newkey rsa:2048 -keyout localhost.key -days 365 -subj "/C=DE/O=neuron/CN=NeuronClient@localhost" -out localhost.crt
$openssl x509 -in localhost.crt -outform der -out client_cert.der
$openssl rsa -inform PEM -in localhost.key -outform DER -out client_key.der
$rm localhost.crt
$rm localhost.key

The *.cnf file specified by -config can be modified using the template file for openssl to be modified to include the following configuration section:

[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[ alt_names ]
URI.1 = urn:xxx.xxx.xxx
DNS.1 = localhost
#DNS.2 = localhost
IP.1 = 127.0.0.1
#IP.2 = 0.0.0.0

-days can set the value as desired.

Certificate conversion

You can convert PEM certificate and private key to DER format by following steps and commands

1. Save all the contents including “——-BEGIN CERTIFICATE——-“ and “——-END CERTIFICATE——-“ as 1.crt;
2. Save all the contents including “——-BEGIN PRIVATE KEY——-“ and “——-END PRIVATE KEY——-“ as 1.key;
3. Execute the following command:

   $ openssl x509 -in 1.crt -outform der -out cert.der   
   $ openssl rsa -inform PEM -in 1.key -outform DER -out key.der

Address String

IX!NODEID

IX is the namespace index. (1-32767)

NODEID is the node ID. (any string exclude '!')

Example: 2!Device1.Module1.Tag1 represents namespace index is 2 and node ID is Device1.Module1.Tag1

Neuron version 1.4 already supports fixed-length string read and write, you need to add the string length identifier - #length to the node ID, if you want to set Device1.Module1.Tag1 to a string type with length 20, the full access address is 2!Device1 .Module1.Tag1#20

Please refer to OPC UA standard for the explanation of namespace index and node id.

IEC 60870-5-104

General Details

Parameters

Address String

CA!IOA

CA Station Address

IOA Starting Information Object Address

Example: 1!2 represents Station Address is 1 and IOA is 2

DL/T645-2007

General Details

The calibration method of general electricity meter is even calibration.

Address String

STN1!STN2!ADDR

STN1 is the first three bytes of the communication address of the meter.

STN2 is the last three bytes of the communication address of the meter

ADDR is the corresponding data identification:

Example：210220!003011!33343435 represents the voltage value of the device with communication address 210220003011