# Neuron Driver Address Format

# General

This document describes the tag address formats for Neuron to setup with various kind of industrial protocol drivers. Each Neuron driver has its own address format that will be parsed in configuration process for machine or device communication.

# Allen-Bradley PLC2 (half duplex)

# General Details

SettingsParameters
Runtime moduleneuron_o_df1hp2
Driver namedf1hp2
ProtocolDF1 half-duplex
Physical interfaceRS485
Default settings9600/8/N/1

# Address String

STN!DST!ADDR

STN is the slave station device number

DST is the destination node (CPU)

ADDR is the register address as following:

TypeFormatRangeDescription
WordDDDDD0 ~ 65535Work Area (word)

Note: Because the 1771KG is directly connected to the CPU, the STN and DST should be set to the same number (address of 1771KG module).

Example: 16!16 (slave number 20 octal)

16!16!520 (word 1010 octal in slave number 20 octal)

Set 8 (10 octal) for 1771-KG and set 0 for 1785-KE and 1770-KF2 in KG mode

# Allen-Bradley PLC5 (half duplex)

# General Details

SettingsParameters
Runtime moduleneuron_o_df1ph5
Driver namedf1ph5
ProtocolDF1 half-duplex
Physical interfaceRS485
Default settings9600/8/N/1

# Address String

STN!DST!ADDR

STN is the slave station device number (KE/KF2 module address)

DST is the destination node (CPU)

ADDR is the register address as following.

TypeFormatRangeDescription
WordDDDDD0 ~ 65535Work Area (word)

Note: the KE or KF2 module inserts its address as the source, and this address will be the used data file number in the PLC5.

Example: 28!16 (KE/KF2 module number 34 octal and destination node=CPU number 20 octal). 28!16!10 means word 10 in file N28 in slave number 20 (octal).

Set 8 (10 octal) for 1771-KG and set 0 for 1785-KE and 1770-KF2 in KG mode

# Schneider TSX7 SCM (Modbus RTU)

# General Details

SettingsParameters
Runtime moduleneuron_o_tsxmbr
Driver nametsxmbr
ProtocolModbus RTU
Physical interfaceRS232
Default settings9600/8/N/1

# Address String

STN!ADDR

STN is the slave station number (CPU) (1 – 247)

ADDR is the register address as following.

TypeFormatRangeDescription
WordWDDDDD0 ~ 32767Register (word)

Example: 10!W100 means word 100 in slave station 10.

# Schneider TSX7 SCM (Modbus TCP)

# General Details

SettingsParameters
Runtime moduleneuron_o_tsxmbt
Driver nametsxmbt
ProtocolModbus TCP
Physical interfaceEthernet
Default settings502

# Address String

ADDR

ADDR is the register address as following:

TypeFormatRangeDescription
WordWDDDDD0 ~ 32767Register

Example:W4000 means word address 4000.

# Schneider Telemecanique UNI-TE

# General Details

SettingsParameters
Runtime moduleneuron_o_unite
Driver nameunite
ProtocolTSX SCM 2161 (Uni-Telway), directly on the built-in UNI-TE port on a V4 (or later) CPU
Physical interfaceRS232
Default settings9600/8/N/1

# Address String

STN!ADDR

STN is the slave station number (Ad0 in CPU) (1 – 31)

ADDR is the register address as following:

TypeFormatRangeDescription
WordWDDDDD0 ~ 32767Register (word)

Example: 1!W100 means word 100 in slave number 1.

# ABB SattControl Comli

# General Details

SettingsParameters
Runtime moduleneuron_o_comli
Driver namecomli
ProtocolCOMLI
Physical interfaceRS232
Default settings9600/8/N/1

# Address String

STN!ADDR

STN is the slave station number (CPU) (1 – 247)

ADDR is the register address as following

TypeFormatRangeDescription
WordRDDDD0 ~ 3071Register (word)

Example: 1!R100 means word 100 in slave number 1.

# General Details

SettingsParameters
Runtime moduleneuron_o_omrhls
Driver nameomrhls
ProtocolHost-Link sysmac c-series
Physical interfaceRS232
Default settings9600/8/N/1

# Address String

ADDR

ADDR is the register address as following:

TypeFormatRangeDescription
WordARDDDD0 ~ 4095Auxiliary Relay
WordIRDDDD0 ~ 4095I/O and Internal Relay
WordHRDDDD0 ~ 4095Hold Relay
WordLRDDDD0 ~ 4095Link Relay
WordTCDDDD0 ~ 255Timer
WordDMDDDD0 ~ 9999Data Register

Example: DM100 means word 100 in DM data memory area.

# General Details

SettingsParameters
Runtime moduleneuron_o_omrhls
Driver nameomrhls
ProtocolHost-Link sysmac c-series
Physical interfaceRS232
Default settings9600/8/N/1

# Address String

STN!ADDR

STN is station number/module number (0 – 31)

ADDR is the register address as following:

TypeFormatRangeDescription
WordARDDDD0 ~ 4095Auxiliary Relay
WordIRDDDD0 ~ 4095I/O and Internal Relay
WordHRDDDD0 ~ 4095Hold Relay
WordLRDDDD0 ~ 4095Link Relay
WordTCDDDD0 ~ 255Timer
WordDMDDDD0 ~ 9999Data Register

Example: 10!DM100 means word 100 in data memory in slave 10.

# Siemens S5 3964R/RK512

# General Details

SettingsParameters
Runtime moduleneuron_o_s539rk
Driver names539rk
Protocol3964R/RK512
Physical interfaceRS232
Default settings9600/8/N/1

# Address String

ADDR

ADDR is the address as following

DB is the data block (0 – 999)

DBW(_ word offset _) is the data word in that data block

TypeFormatRangeDescription
WordIDDDD0 ~ 4095Input
WordQDDDD0 ~ 4095Output
WordMDDDD0 ~ 4095Marker Memory
WordDB0~999.DBWDDDDD
DDDDD
0 ~ 65535
0 ~ 65535
Data Memory
WordTDDD0 ~ 255Timer
WordCDDD0 ~ 255Counter

Example: DB100 (data block 100)

DB100.DBW20 (DBddd.DBWddddd) means data word 20 in data block 100

# Siemens S7 3964R/RK512

# General Details

SettingsParameters
Runtime moduleneuron_o_s739rk
Driver nameS739rk
Protocol3964R/RK512
Physical interfaceRS232
Default settings9600/8/N/1

# Address String

ADDR

ADDR is the address as following

DB is the data block (0 – 999)

DBW(_ byte offset _) is the data word in that data block

TypeFormatRangeDescription
ByteIWDDDD0 ~ 4095Input
ByteQWDDDD0 ~ 4095Output
ByteMWDDDD0 ~ 4095Marker Memory
ByteDB0~999.DBWDDDDD
DDDDD
0 ~ 65535
0 ~ 65535
Data Memory (must be in even byte no.)
ByteTDDD0 ~ 255Timer
ByteCDDD0 ~ 255Counter

Note: The real DBW should be used (eg. DBW0, DBW2 etc) and the driver will read the byte start from 0 and the byte start from 2. It reads a word from byte 0, byte 2 respectively.

Example: DB100 (data block 100)

DB100.DBW20 (DBddd.DBWddddd) means data word 20 in data block 100

# Siemens FETCH/WRITE

# General Details

SettingsParameters
Runtime moduleneuron_o_siefw
Driver namesiefw
ProtocolSiemens Fetch/Write Protocol
Physical interfaceEthernet
Default port no.2200

# Address String

ADDR

ADDR is the address as following

DB is the data block (0 – 999)

DBW(_ byte offset _) is the data word (start) in that data block.

TypeFormatRangeDescription
ByteIWDDDD0 ~ 4095Input
ByteQWDDDD0 ~ 4095Output
ByteMWDDDD0 ~ 4095Marker Memory
ByteDB0~999.DBWDDDDD
DDDDD
0 ~ 65535
0 ~ 65535
Data Memory (must be in even byte no)
ByteTDDD0 ~ 255Timer
ByteCDDD0 ~ 255Counter

Note: There is a limitation in the protocol. The DB can only be between 1-255 and the start address of a read or write table cannot go beyond DBW2047, however the end of a table can. But during the test, it was possible to start at address DBW32766.

Note: In the Simatic PLC you just define a TCP/IP connection for either FETCH passive (read only) or WRITE passive (write only), listening on a certain port. Currently there is no FETCH/WRITE passive setting, so two connections with different ports are required, one for read and one for write.

Example: DB200.DBW20 (DBddd.DBWddddd) means data word 20 in data block 200.

# Siemens Industrial Ethernet S7 ISOTCP

# General Details

SettingsParameters
Runtime moduleneuron_o_s7pro
Driver names7pro
ProtocolS7 ISO TCP (S7 protocol)
Physical interfaceEthernet
Default port no.102

# Address String

ADDR

ADDR is the address as following

Note: DB is the data block (0 – 999)

DBW(_ byte offset _) is the data word (start) in that data block.

TypeFormatRangeDescription
ByteIWDDDD0 ~ 4095Input
ByteQWDDDD0 ~ 4095Output
ByteMWDDDD0 ~ 4095Marker Memory
ByteDB0~999DBWDDDDD
DDDDD
0 ~ 65535
0 ~ 65535
Data Memory (must be in even byte no.)
ByteTDDD0 ~ 255Timer
ByteCDDD0 ~ 255Counter

Example: DB200.DBW20 (DBddd.DBWddddd) means data word 20 in data block 200.

S7P_SCRTSAP is the source TSAP for S7 protocol

S7P_DSTTSAP is the destination TSAP for S7 protocol

# Mitsubishi FX0S/FX0N/FX1S/FX1N/FX2

# General Details

SettingsParameters
Runtime moduleneuron_o_fxnpro
Driver namefxnpro
ProtocolRS command
Physical interfaceRS232
Default settings9600/7/E/1

# Address String

ADDR

ADDR is the register address

TypeFormatRangeDescription
BitXOOO0 ~ 377Input Relay
BitYOOO0 ~ 377Output Relay
BitMDDDD0 ~ 7999Auxiliary Relay
BitTDDD0 ~ 255Timer Relay
BitCDDD0 ~ 255Counter Relay
BitSMDDDD8000 ~ 9999Special Aux. Relays
BitSDDDD0 ~ 4095States
WordTNDDD0 ~ 255Timer Memory
WordCNDDD0 ~ 199Counter Memory
WordDDDDD0 ~ 7999Data Register
DWordCN2DDD200 ~ 255Counter Memory
WordSDDDDD8000 ~ 9999Special Data Register

Example: D100 means word 100 in D data memory area.

# Mitsubishi FX2N/FX3U/FX3G Series

# General Details

SettingsParameters
Runtime moduleneuron_o_fx3u3g
Driver namefx3u3g
ProtocolRS command
Physical interfaceRS232
Default settings9600/7/E/1

# Address String

ADDR

ADDR is the register address as following:

TypeFormatRangeDescription
BitXOOO0 ~ 764Input Relay
BitYOOO0 ~ 764Output Relay
BitMDDDD0 ~ 7999Auxiliary Relay
BitTDDD0 ~ 511Timer Relay
BitCDDD0 ~ 255Counter Relay
BitSMDDDD8000 ~ 9999Special Aux. Relays
BitSDDDD0 ~ 4095States
WordTNDDD0 ~ 511Timer Memory
WordCNDDD0 ~ 199Counter Memory
WordDDDDD0 ~ 7999Data Register
DWordCN2DDD200 ~ 255Counter Memory
WordSDDDDD8000 ~ 9999Special Data Register
WordRDDDD0 ~ 32767Extended Register

Example: D100 means word 100 in D data memory area.

# Mitsubishi Melsec E71 for Q Series

# General Details

SettingsParameters
Runtime moduleneuron_o_mele71
Driver namemele71
ProtocolMELSEC E71
Physical interfaceEthernet
Default port no.2000

# Address String

ADDR

ADDR is the register address as following:

TypeFormatRangeDescription
BitXHHHH0 ~ 1fffInput Relay
BitYHHHH0 ~ 1fffOutput Relay
BitMDDDDD0 ~ 61439Internal Relay
BitLDDDDD0 ~ 32767Latch Relay
BitFDDDDD0 ~ 32767Annunciator
BitVDDDDD0 ~ 32767Edge Relay
BitBHHHH0 ~ efffLink Relay
BitTCDDDD0 ~ 2047Timer Coil
BitSSDDDDD0 ~ 25471Retentive Timer Contact
BitSCDDDDD0 ~ 25471Retentive Timer Coil
BitCSDDDDD0 ~ 25471Counter Contact
BitCCDDDDD0 ~ 25471Counter Coil
BitSBHHH0 ~ 7ffSpecial Link Relay
BitDXHHHH0 ~ 1fffDirect Input
BitDYHHHH0 ~ 1fffDirect Output
BitTSDDDD0 ~ 2047Timer Contact
WordWHHHH0 ~ 2fffLink Register
WordTNDDDD0 ~ 2047Timer Current Value
WordSNDDDD0 ~ 2047Retentive Timer Current
WordCNDDDD0 ~ 1023Counter Value
WordSWHHH0 ~ 7ffSpecial Link Register
WordZDD0 ~ 19Index Register
WordZRHHHHH0 ~ fe7a5File Register
WordDDDDDDDD0 ~ 4212735Data Register
WordSDDDDD0 ~ 2047

Example: D100 means word 100 in D data memory area.

# Modbus RTU

# General Details

SettingsParameters
Runtime moduleneuron_o_mbsrtu
Driver namembsrtu
ProtocolModbus RTU
Physical interfaceRS485
Default settings9600/8/N/1

# Address String

STN!ADDR

STN is slave number or device ID (0-247)

ADDR is the register address as following:

TypeFormatRangeDescription
Bit01/05/15DDDDDD000001 ~ 065536Discrete Output Coils
Bit02DDDDDD100001 ~ 165536Discrete Input Contacts
Word04DDDDDD300001 ~ 365536Analog Input Registers
Word03/06/16DDDDDD400001 ~ 465536Analog Output Holding Registers

# Modbus TCP

# General Details

SettingsParameters
Runtime moduleneuron_o_mbstcp
Driver namembstcp
ProtocolModbus TCP
Physical interfaceEthernet
Default port no.502

# Address String

STN!ADDR

STN is slave number or device ID (0-247)

ADDR is the register address as following:

TypeFormatRangeDescription
Bit01/05/15DDDDDD000001 ~ 065536Discrete Output Coils
Bit02DDDDDD100001 ~ 165536Discrete Input Contacts
Word04DDDDDD300001 ~ 365536Analog Input Registers
Word03/06/16DDDDDD400001 ~ 465536Analog Output Holding Registers

Example:2!404001 means word address 4000 with in slave number 2.

# Modbus RTU over TCP

# General Details

SettingsParameters
Runtime moduleneuron_o_mbsrot
Driver namembsrot
ProtocolModbus RTU over TCP
Physical interfaceEthernet
Default port no.502

# Address String

STN!ADDR

STN is slave number or device ID (0-247)

ADDR is the register address as following:

TypeFormatRangeDescription
Bit01/05/15DDDDDD000001 ~ 065536Discrete Output Coils
Bit02DDDDDD100001 ~ 165536Discrete Input Contacts
Word04DDDDDD300001 ~ 365536Analog Input Registers
Word03/06/16DDDDDD400001 ~ 465536Analog Output Holding Registers

Example:2!404001 means word address 4000 with in slave number 2.

# IEC 61850

# General Details

SettingsParameters
Runtime moduleneuron_o_i61850
Driver namei61850
ProtocolIEC 61850
Physical interfaceEthernet
Default settings102

# Address String

FC!ADDR

FC is functional constraints value as following:

FnFormatDescription
0IEC61850_FC_STStatus information
1IEC61850_FC_MXMeasurands - analog values
2IEC61850_FC_SPSetpoint
3IEC61850_FC_SVSubstitution
4IEC61850_FC_CFConfiguration
5IEC61850_FC_DCDescription
6IEC61850_FC_SGSetting group
7IEC61850_FC_SESetting group editable
8IEC61850_FC_SRService response / Service tracking
9IEC61850_FC_OROperate received
10IEC61850_FC_BLBlocking
11IEC61850_FC_EXExtended definition
12IEC61850_FC_COControl
13IEC61850_FC_USUnicast SV
14IEC61850_FC_MSMulticast SV
15IEC61850_FC_RPUnbuffered report
16IEC61850_FC_BRBuffered report
17IEC61850_FC_LGLog control blocks

ADDR is the object reference address string

The IEC61850 data hierarchical model are usually as following:

Physical Device (IED)

Logical Device (LD)

Logical Node (LN)

Object Data (DO)

Object Attribute (DA)

Example:1!testmodelSENSORS/TTMP1.TmpSv.instMag.f

means the functional constraint of this tag is 1 (IEC61850_FC_MX –analog measurands). The object reference address string are (IED) – testmodel, (LD) – SENSORS, (LN) – TTMP1, (DO) – TmpSv, (DA) – instMag.f for floating value.

# OPC UA

# General Details

SettingsParameters
Runtime moduleneuron_o_opcua
Driver nameopcua
ProtocolOPC UA
Physical interfaceEthernet
Default port no.4840

# Address String

IX!NODEID

IX is the namespace index. (1-32767)

NODEID is the node ID. (any string exclude '!')

Example: 2!Device1.Module1.Tag1 represents namespace index is 2 and node ID is Device1.Module1.Tag1

Please refer to OPC UA standard for the explanation of namespace index and node id.