Technical Information Sheet

Technical Information Sheet TIS#: 300 Date: September 1, 2009 Author: Mark Demick Approved: Chris Coogan SUBJECT How to configure Wonderware s DASMBTCP Server, V1.5, for use with Eurotherm s 3500 Series (3504 and 3508) Multi-Loop Process Controllers Software and Hardware Used; 2000 2500 26/2700 3000 MINI8 Controller Graphic Recorders Paper Recorders EPower T2550 Eurotherm 3504 ¼ DIN Multi-Loop Process Controller V2.81 with Modbus/TCP Communications Option Wonderware InTouch V9.5 or V10, OPCLink V8 and DASMBTCP V1.5 (0246.0186) The 3508 ⅛ DIN Multi-Loop Process Controller is functionally the same as the 3504. The 3504 and 3508 Multi-Loop Process Controllers are referenced hereafter as 3500 controllers. Open Wonderware System Management Console; start/all Programs/Wonderware/System Management Console. If DASMBTCP is installed there is an ArchestrA.DASMBTCP.1 folder in the DAServer Manager hierarchy tree as shown in Figure 1. Figure 1 Archestra Hierarchy EYCON Visual Supervisor Eurotherm Suite LINtools Review itools 741-F Miller Drive, Leesburg, Virginia 20175 T +1 703 443-0000 F +1 703 669-1300 www.eurotherm.com Action Instruments Barber-Colman Continental Industries Eurotherm Chessell Eurotherm Controls Page 1 of 16

The server specific configuration portion of the DASMBTCP Server starts by adding a TCPCIP_PORT object by right clicking on Configuration and selecting Add TCPIP_PORT Object. The default port name is New_TCPIP_PORT_000 that should be changed to something more descriptive. This is shown in Figure 2 where the TCPIP_PORT has been renamed to TCPIP1. Leave the Port number default of 502 as is. Figure 2 Adding TCPIP_PORT Object To complete the configuration endpoint hierarchy, add a ModbusPLC object to the TCPIP_PORT object by right clicking on the TCPIP_PORT Object TCPIP1. There are other Modbus controller objects that can be created at this hierarchical level, however, the ModbusPLC object represents the generic 4, 5 or 6-digit controller to which the Eurotherm recorders and controllers are compatible. For the 3500 controllers, the addressing is 6-digit. Add a ModbusPLC object as shown in Figure 3 for each 3504 controller to be connected on the network that has a unique IP Address. The default name is New_ModbusPLC_000 that should be changed to something more descriptive. TIS#: 300 Page 2 of 16

Figure 3 Adding a ModbusPLC Object For the ModbusPLC object named 3504_10 shown in Figure 4, the defaults are used except for the Network address that has been changed to exactly match that of the connected 3504 controller and Use Concept data structures (Reals) has been unchecked that is explained later. The Modbus protocol, and that supported by the 3500 controllers, is Modbus RTU. Data is represented by an 8-bit byte. Modbus ASCII or 7-bit data is not supported by the 3500 controllers. TIS#: 300 Page 3 of 16

Figure 4 Modbus PLC Object Parameters To add a Device Group, select the Device Groups tab, right click anywhere in the cell areas and select Add as shown in Figure 5. Change the default Name from Topic_0 to a more descriptive name if desired. Figure 5 Modbus PLC Device Group Parameters In the Device Items tab, item names and Modbus addresses are entered. There are available integer and real (32-bit single precision) addresses having defined absolute Modbus addresses rather than register-number addresses for configuration and run-time data in the 3500 controllers. To determine the modbus address for the Device Items tab reference the 3504/3508 Process Controllers Engineering Handbook, HA027988, Issue 8, available from the Eurotherm web sites. Chapter 30 in the 3504/3508 Engineering Handbook, titled Modbus SCADA Table, provides the Modbus Comms address information. TIS#: 300 Page 4 of 16

The SCADA Table provides fixed single register (integer) absolute Modbus addresses for use with third party Modbus masters in SCADA software packages or PLC s. If required controller parameters are not available in the SCADA Table they can be added to an indirection table using their absolute Modbus addresses. Decimal point scaling of the parameters must be configured the Modbus master scaling must match the 3500 controller parameter resolution to ensure the decimal point is in the correct position. Decimal point scaling is shown in the SCADA Table in Chapter 30. Using Loop 1 as an example from the SCADA Table, Loop.1.Main.PV is listed with a Modbus address of 1. This is an absolute Modbus address and not the register-number Modbus address. The DASMBTCP Server Item Reference supports both absolute Modbus address notation item names using an HR suffix after the absolute Modbus address and/or register-number Modbus addressing. To convert from absolute Modbus to register-number Modbus addressing use the following formula: Register-number = 400000 + absolute Modbus address + 1 Using the absolute Modbus address of 1 and entering it into the formula above we derive the register-number Modbus address of 400002 for Loop.1.Main.PV. To add Device Items, select the Device Items tab, right click anywhere in the cell areas and select Add. Enter in a name for the Device Item. Double click in the corresponding Item Reference cell to add the register-number Modbus addresses as shown in Figure 6. The Item Reference values can be in either the register-number Modbus address format as shown in Figure 6, or the absolute Modbus address format as shown in Figure 7. Figure 6 Modbus PLC Device Items Parameters, Register-Number Modbus Addressing; Integers The Item Reference absolute Modbus addresses are straight from the 3504/3508 Engineering handbook with an HR (Holding Register) suffix. As the 3500 controller does not distinguish between Modbus input or holding registers, the IR (Input Register) suffix may also be used. Table 1 below summarizes the Item Reference suffix modifiers for absolute Modbus addressing notation. Figure 7 Modbus PLC Device Items Parameters, Absolute Modbus Addressing; Integers TIS#: 300 Page 5 of 16

Item Name Description 2 IR Input Register, Refers to the same data Modbus calls "input register." Valid range is 0 (zero) IR through 65535 IR. 108 HR Holding Register; Refers to the same data Modbus calls "holding register." Valid range is 0 (zero) HR through 65535 HR. 1024 PV Process Variable; Refers to holding register type, but treated as floating points and assumes two (2) registers per floating-point number. Valid range is 0 (zero) PV through 65535 PV Table 1 Absolute Notation Item Name Suffix Modifiers The above figures were examples of reading integer values from the 3500 controller. To read real values, the Eurotherm itools configuration software must be used to ascertain the absolute Modbus addresses. There are two (2) methods to ascertain the absolute Modbus addresses for real values from itools. 1) In the itools Parameter Explorer pane, right click on the parameter of interest and select Parameter Properties from the context sensitive menu. Figure 8 shows the Parameter Information dialog box and the canonical or integer value address, and the actual or real value address given in decimal and hex. Close and repeat for each parameter of interest. Figure 8 itools Parameter Explorer Parameter Information TIS#: 300 Page 6 of 16

2) Use the itools OPC Server (EuroMBus) Export Address Space feature. To do this, open the controllers clone file or connect to the 3500 controller and scan to add the 3500 controller. Open EuroMBus using the itools menu Options/Advanced/Show Server. Find the controller in the EuroMBus port (COM, Ethernet or Simulation), right click on the instrument and select Export Address Space as shown in Figure 9. This action will open the Export Address Space dialog box shown in Figure 10. Figure 9 itools OPC Server Export Address Space Context Menu Select the default pre-defined option of Generic CSV IDM Format, click on the Browse button to open the Save As dialog box and enter a path and filename. This creates a CSV (Comma Separated Values) file that contains the absolute Modbus addresses for real (32-bit single precision) values. Alternatively, select the pre-defined option of User Defined to customize which options are included in the exported address space and whether the delimiter is a tab or a comma. The pre-defined option Generic CSV IDM Format is satisfactory for this exercise. TIS#: 300 Page 7 of 16

Figure 10 Export Address Space Dialog Box A sample of rows showing the Loop1.Main parameters is shown in Table 2. The comms address shown in the 3 rd column is the hex value prefixed with the register type of 3. Using Loop.1.Main.PV the value from Table 2 is 0x000358C7. To convert this to an absolute Modbus address, drop the leading 3 and convert the remaining digits 58C7, to decimal. This would be 22727. Table 2 Export Address Space CSV File Real values consist of two (2) consecutive register values and the word order, if not correct, can cause the value to read or written incorrectly. From Figure 4, note that the Use Concept data structure (Reals) has been unchecked. This changes the word order so that it is interpreted correctly. Again, either absolute or register-number Modbus addressing is supported for real values. Figure 11 shows register-number Modbus addressing. Note the suffix F to indicate that this is a real value telling the TIS#: 300 Page 8 of 16

DASMBTCP driver to read two (2) words. The formula for converting real absolute Modbus addresses to realregister Modbus addresses is the same as converting integer Modbus addresses. The Loop.1.Main.PV process value real absolute Modbus address is 22727. Using the same formula as for integers results in the registernumber Modbus address of 422728. Using absolute Modbus addressing requires either the HRF or IRF suffix that is a concatenation of Holding or Input Register with Float data type as shown in Figure 12. Note Active Output Power has been added in Figure 12. Figure 11 Modbus PLC Device Items Parameters, Register-Number Addressing, Reals Figure 12 Modbus PLC Device Items Parameters, Absolute Addressing, Reals The Device Items tab may contain any combination of integer, real, register-number or absolute Modbus addresses. The same parameter may be referenced as an integer and a real in any addressing mode in the Device Items tab. Note in Figure 13, the suffix S for the parameters using integer register-number Modbus addresses. This modifier indicates the register contents are treated as a 16-bit signed integer. Any integer expected to have a negative value requires this suffix. TIS#: 300 Page 9 of 16

Figure 13 Device Items Table Additional Item Reference suffix data type modifiers are shown in Table 3. Addresses shown are in register-number Modbus format. Item Ref Description 400002 When no spaces and no letters follow the register number, the register contents are treated as a 16-bit unsigned quantity. 400108 S When a space and the letter "S" follow the register number, the register contents are treated as a 16-bit signed quantity. 401024 I When a space and the letter "I" follow the register number, the register contents are treated as a 32-bit signed quantity. This takes up two consecutive registers. 403424 L When a space and the letter "L" follow the register number, the register contents are treated as a 32-bit signed quantity. 400236 F When a space and the letter "F" follow the register number, the register contents are treated as a floating-point quantity. This takes up two consecutive registers. 404784 U When a space and the letter "U" follow the register number, the register contents are treated as a 32-bit unsigned quantity. Table 3 Item Reference Data Type Suffix Modifiers After entering Device Items, Item References, click the blue and white floppy disk icon in the upper right-hand corner of the System Management Console to save any changes. The DASMBTCP Server is an OPC Server. This means that any OPC Client can connect to the DASMBTCP Server. In Figure 14, the Eurotherm itools OPC Scope Client has been used to demonstrate an OPC Client connecting to the DASMBTCP Server. A 3504 configured as a cascade controller is online using the parameter set shown in Figure 12. TIS#: 300 Page 10 of 16

Figure 14 itools OPC Scope To use the DASMBTCP Server with Wonderware InTouch HMI, the Wonderware OPCLink Client needs to be configured to interface between InTouch using the SuiteLink Protocol and the DASMBTCP Server using the OPC (Object Linking and Embedding for Process Control) protocol. This is because InTouch is not an OPC Client. Open OPCLink, create a New Configuration, if required, and configure one or more Topic Definitions. As shown in Figure 15, create a Topic Name that is descriptive of the instrument node. This exact name is used in the InTouch Access Name definition. The OPC Server Name is chosen from the drop-down and the OPC Path is configured by clicking the Browse button. TIS#: 300 Page 11 of 16

Figure 15 OPCLink OPC Topic Definition Dialog Box Clicking the Browse button brings up the OPC Browser window as shown in Figure 16. Note the TCPIP_Port and Modbus_PLC Objects defined in the DASMBTCP Server are shown in the Browse OPC items pane. These objects are returned by the DASMBTCP server. The OPC Path is the first part of a full OPC item-name string common to all items that will be used in this topic. In a hierarchical address space it usually is the item name without the leaf section. OPCLink will combine the OPC Path and the InTouch I/O Item name to construct the fully qualified OPC name that is passed to DASMBTCP the OPC Server. In the 3500 controller example here, the first part is the TCPIP_PORT object name followed by the ModbusPLC object. This first part limits the topic to a single controller while the remainder of the OPC Path name is entered during the definition of the Item name in WindowMaker. Note the. at the end of the OPC Path is used as a delimiter to the remainder of the fully qualified path. TIS#: 300 Page 12 of 16

Figure 16 OPCLink OPC Browser Dialog Box A tag in WindowMaker is created as shown in Figure 17. An Access Name shown in Figure 18 has been created to point to the topic (N3504_10) created in OPCLink. The tag Item name is the remainder of the fully qualified OPC path name. The r prefix indicates a real data type. Thus to concatenate the OPC Path from the topic in OPC Link and the Item name below you would have the fully qualified name TCPIP1.3504_10.Loop1PV. Figure 17 Tagname Dictionary Tag Definition TIS#: 300 Page 13 of 16

Figure 18 Access Name Definition The Tagname represents a received integer value having an implicit 10ths decimal point. The tenths will be displayed as the Min and Max EU both have been divided by 10. There is no Unit_ID or Modbus node address configuration available in the DASMBTCP server. This means that the 3500 controller Unit Ident Enable parameter in the Comms list must be set to Loose. This means that the Unit_ID received is ignored thus causing a response regardless of the received Unit_ID. Figure 19 below shows the Eurotherm itools instrument ActiveX control to the left of tags showing the PV, target setpoint and active output power using both integer and real addresses from the 3504. The Device Items used are those from Figure 13. TIS#: 300 Page 14 of 16

Figure 19 Online WindowViewer Window The System Management Console includes diagnostic capability. Figure 20 below shows the default group since none were created in this example, with six (6) Device Items and their status. Each of the Names is preceded by a green square indicating good quality. TIS#: 300 Page 15 of 16

Figure 20 SMC Diagnostics On the Wonderware support web site Tech Note 424, Working with DAServers, contains more detailed information than the online help does in the System Management Console. The examples within this document apply to more than just the 3500 controllers. They apply to any Eurotherm Modbus/TCP slave instrument; e.g. Eurotherm 2704, Chessell 6100 Series Graphic Recorders, EPower, EYCON Visual Supervisor, T2550 and more. TIS#: 300 Page 16 of 16