ControlEdge Builder

Protocol Configuration Reference Guide

RTDOC-X288-en-140A

April 2017

Release 140
Disclaimer
This document contains Honeywell proprietary information. Information contained
herein is to be used solely for the purpose submitted, and no part of this document
or its contents shall be reproduced, published, or disclosed to a third party without
the express permission of Honeywell International Sàrl.
While this information is presented in good faith and believed to be accurate,
Honeywell disclaims the implied warranties of merchantability and fitness for a
purpose and makes no express warranties except as may be stated in its written
agreement with and for its customer.
In no event is Honeywell liable to anyone for any direct, special, or consequential
damages. The information and specifications in this document are subject to
change without notice.

Copyright 2017 - Honeywell International Sàrl

Contents

Contents
Disclaimer 2
Contents 3
About this guide 7
HART Configuration 9
Configuring a HART IP Server 9
Configuring a HART Function Block 10

DNP3 Slave Configuration 13

Configuring a DNP3 Slave 13

Enron Modbus Slave Configuration 22

Configuring an Enron Modbus Slave 22

Modbus Slave Configuration 23

Configuring a Modbus Slave 23

Modbus Master Configuration 24

Modbus TCP Master 24
Configuring a Modbus TCP Master 24
Programming a Modbus TCP Master 24
Modbus Serial Master 27

Configuring a Modbus Serial Master 27

Programming a Modbus Serial Master 30
Description of Modbus Function Block 33
Read Single Coil 33
Read Multiple Coils 35
Read Single Discrete Input 37
Read Multiple Discrete Inputs 39

Honeywell 2017 3
Contents

Read Single Input Register 41

Read Multiple Input Registers 42
Read Single Holding Register 45
Read Multiple Holding Registers 46
Write Single Coil 49
Write Single Holding Register 51
Write Multiple Coils 52
Write Multiple Holding Registers 54

Description of CONFIG_INFO 57
Description of Input and Output Data Type 59
Modbus Protocol Error Codes 60
Endian Mode 61

OPC UA Configuration 63
Introduction 63
Prerequisite skills 63
OPC UA Server 64
System Architecture and Profiles 65
Access Level 66

Security 66
Redundancy 66
Accessing the Server Object 66
Server Diagnostics 67
Accessing ControlEdge PLC data 67
Overview 67
Ctrl Resources 68

Honeywell 2017 4
Contents

Ctrl Programs 69
ControlEdge PLC Diagnostics 70
Program Variable NodeIds 70
Global and Diagnostic Variables 71
Program Variables 71
Data Types 72
Elementary types 72
Structured Types 73

Arrays 75
Arrays of Structured types 75
Object Types 76
Reference types 77
Configure ControlEdge PLC OPC UA Server 78
Configuration 78
Binding Protocol to Ethernet Ports 78
Configuring Parameters for OPC UA Server 78
Key Parameters to establish OPC UA communication 83
Server Endpoint URL 83

Namespace 84
OPC UA Client 85
IEC 61131-3 OPC UA Function Blocks 85
IEC 61131-3 OPC UA function block usage 87
Usage Considerations 88
Prepare Phase for Reads, Writes or Method Calls 92
Establishing Connection with HonUaConnectSecurityNone 92

Honeywell 2017 5
Contents

Accessing the Address Space of target OPC UA Server 94

Obtaining Nodelds with HonUaTranslatePathList 96
Work Phase 98
Reading a single variable 98
Reading a list of variables 100
Writing a single variable 102
Writing a list of variables 103
Calling a Method 104

Cleanup Phase 106

Terminate Connection with HonUaConnectSecurityNone 106
Utilities 107
Monitoring the target OPC UA Server handle 107
Detecting Boolean Resets 108
Converting Variant Values to String 108
Configuring an OPC UA Client 109
Importing OPC UA Library 109
Importing Data Types of HonUaFbHelperTypes 109
Importing an OPC UA POU 110

Configuring an OPC UA Logic 110

Example logic for reading list of variables from OPC UA Server 111

Notices 113

Honeywell 2017 6
About this guide

About this guide

Revision history
Revision Date Description

A April 2017 Initial release of this document

Intended audience
This documentation is intended for the following audience: Users who plan, install,
configure, operate, or maintain the ControlEdge 900 Controller and I\O modules
running the eCLR (IEC 61131-3) execution environment.

Prerequisite skills
Knowledge of SCADA systems and experience of working in a Microsoft Windows
environment are required.

Special terms
The following table describes some commonly used industry-wide and Honeywell-
specific terminology:

Terminology Description

ControlEdge PLC OPC UA OPC UA runs on ControlEdge PLC

DNP3 Distributed Network Protocol V3.0

EFM Electronic Flow Measurement

An extension of standard Modbus supports for 32-bit

Enron Modbus Integer and Floating Point variables, and historical and
flow data.

HART-IP extends the HART protocol to Ethernet con-

nected nodes. This facilities host level systems and asset
management applications to access and integrate meas-
HART-IP
urement and device diagnostics information from HARTen-
abled field devices using the existing plant networking
infrastructure.

A communication protocol supports communication

Modbus between Modbus slave devices and Modbus master
devices via serial port or Ethernet port.

Honeywell 2017 7
About this guide

Terminology Description

OPC Open Platform Communications

OPC UA OPC Unified Architecture

SCADA Supervisory Control and Data Acquisition

Related documents
The following list identifies publications that may contain information relevant to the
information in this document.

Document name Document number

RTDOC-X285-en-
ControlEdge Builder Software Installation User’s Guide
140A

RTDOC-X166-en-
ControlEdge Builder Software Change Notice
1401A

RTDOC-X283-en-
ControlEdge Builder User’s Guide
140A

ControlEdge 900 Platform Hardware Planning and Installation Guide HWDOC-X430-en-C

ControlEdge 2020 Platform Hardware Planning and Installation Guide HWDOC-X284-en-A

ControlEdge Builder Function and Function Block Configuration RTDOC-X286-en-

Reference Guide 140A

RTDOC-XX75-en-
ControlEdge Builder Network and Security Planning Guide
140A

Honeywell 2017 8
HART Configuration

HART Configuration
HART supports two functionalities.
o HART IP client (FDM) communication
o HART Function Block communication
The controller enables the HART IP client to exchange information with HART field
devices connected to the AI/AO channels in the controller via a HART-IP Server.
Multiple HART IP clients can be served by the controller at the same time. When the
HART IP client builds a HART command request and sends it to the TCP/IP port of
the HART-IP server, the HART-IP server responds to the HART IP client with
information from the field device. Since it takes time for the controller to
communicate with the field devices through onboard or remote I/O cards, a delayed
response mechanism is implemented. The TCP /IP port of the HART-IP server is
user-configurable and the default port number is 5094. The end user may change
the port number if firewall configuration is required.
The controller enables HART function blocks to access to the HART field devices
through HART-enabled AI/AO channels. Currently HART command 3 and
command 48 are implemented.

Configuring a HART IP Server

A new project is created and a controller is added to the project in ControlEdge
Builder. See "Creating a project" and "Connecting a controller" in ControlEdge
Builder User's Guide for more details.
To set a controller as the HART IP Server
1. From the Home Page, click Configure Ethernet Ports and select ETH1 or
ETH2.
2. Under Network Setting, select Use the following IP address and enter the
details in the IP Address, Subnet Mask and Gateway fields.
3. Under Protocol Binding, select HART IP to bind HART IP to the Ethernet port.
4. Click Save to save the configuration, and click Back to return to the Home
Page.
5. Click Configure Protocols > HART IP Server, select the target Ethernet port
and configure the port number in the Port. The default value is 5094.
6. From the Home Page, click Configure I/O, and configure the target AI or AO
channel. For more information, see "Configuring I/O modules and channels" in
the ControlEdge Builder User's Guide.

Honeywell 2017 9
HART Configuration

7. Select the Enable checkbox for HART, and click Save.

8. Click Connect from the Home Page to connect a controller. For the user name
and password, see "User Privileges" in ControlEdge Builder User's Guide.
9. Click Download from the Home Page to load the configuration of HART IP to
the controller.

Configuring a HART Function Block

This task only applies to ControlEdge RTU.
After downloading the configuration, you need to program the HART device for the
project in IEC Programming Workspace.
To configure a HART function block

1. From the IEC Programming Workspace, under the Project Tree Window,
right-click Logical POUs and select Insert > Program.
2. Enter the Name for the new POU, and select the desired programming Lan-
guage. For the following steps, FBD language is used as an example.
3. Click OK to insert the new POU in the project tree.
4. Add a Task as follows:
a. Under Physical Hardware, right-click Task and select Insert > Task.
b. Enter the Name and select the task type as CYCLIC, and click OK.
c. In the Task settings dialog, configure the corresponding parameters.
d. Click OK.
5. Right-click the task you have inserted, and select Insert > Program instance.
6. Enter a name in the Program instance field.

Attention:
The program instance must not be named “RTU” or
“GlobalVariable”.

7. Select the program you want to associate from the Program type drop-down
list.
8. Right-click Libraries and select Insert > Firmware Library, select hart.fwl
under the HART folder. Then click Include.

Honeywell 2017 10
HART Configuration

9. Under Logical POUs, double-click the code worksheet of the program

that you have inserted.
10. From the Edit Wizard, select hart from the Group list. There are two function
blocks available for HART programming: HART_CMD3 and HART_CMD48.
11. Drag the target function block into the workplace to display the function block.

Tip:
For more information about the function block, right-click it and
select Help on FB/FU to display the embedded help.

12. Double-click the pin-outs of the function block to assign variables. The Vari-
able Properties dialog appears.
13. Select the Name, Data Type and Usage from the list.
o For the parameter GEN_DEV_STATUS, you should select HAR_GEN_

DEV_STATUS from the Data Type list.

o For the parameter DEV_INFO, you should select HART_CMD48_DEV_

INFO from the Data Type list.

14. Assign Initial value and I/O address details.
o For the parameter IOM, enter the target module number in the Initial

Value field. For example, if the target module name is "Expansion I/O
01", enter "01".
o For the parameter CHN, enter the target channel number in the Initial

Value field.
15. Click OK. The workplace will appear as shown below.
Programming Completion

Honeywell 2017 11
HART Configuration

16. Click Make from the toolbar to compile the programs.

17. Click Download from the toolbar to download the compiled programs of HART
to the controller.

Honeywell 2017 12
DNP3 Slave Configuration

DNP3 Slave Configuration

Configuring a DNP3 Slave
To set a controller as a DNP3 Slave
1. From the Home Page, click Configure Ethernet Ports and select ETH1 or
ETH2.
2. Under Network Setting, select Use the following IP address and enter the
details in the IP Address, Subnet Mask and Gateway fields.
3. Under Protocol Binding, select DNP3 to bind DNP3 to the Ethernet port.
4. Click Save to save the configuration, and click Back to return to the Home
Page.
5. Click Configure Protocols > DNP3 Slave, select the target Ethernet port you
want to bind.
6. In the Physical Layer tab, configure the TCP port number.
7. In the Data Link Layer tab, select or enter the Master Address and Controller
Outstation Address.
8. Select Enable Self Address for the controller to respond with its unique indi-
vidual address, if a message is sent with the “Self Address”. If Enable Self
Address is not selected, the controller will ignore the message that is sent to
the “Self Address”.
9. Select Never from the Data Link Confirmation drop-down list and enter the
value in Data Link Retries and Data Link Retry Timeout under Data Link
Settings. Maximum value for data link retries is 255 and maximum value for
retry timeout is 3,600,000ms.

Attention:
l Never is selected by default. It is not recommended to
select MultiFrag or Always options.
l If you select MultiFrag or Always, ensure that the Data
Link Retries and Data Link Retry Timeout are set.

10. In the Application Layer tab, if you select Enable Unsolicited Responses, the
controller sends event data to SCADA without any request from SCADA.
Unsolicited Response is an operation mode in which the outstation

Honeywell 2017 13
DNP3 Slave Configuration

spontaneously transmits a response without a specific request for the data.

Parameter Description

Send Null Unsolicited

The DNP3 driver sends a null unsolicited message upon
Responses on
reconnect once it is selected.
Reconnection

The maximum hold delay is the maximum amount of time

that the controller will wait after an event occurs before
sending an unsolicited response. This setting allows the
Maximum Hold Delay of controller to queue several events before sending an
Class1/Class2/Class3 unsolicited response, improving bandwidth usage at the
expense of delayed communication.

Minimum value: 0 ms and maximum value: 3,600,000ms.

The maximum hold count is the maximum number of

events that may be queued before sending an unsolicited
Maximum Hold Count of
response. This setting allows the controller to send
Class1/Class2/Class3
multiple events in a single message, improving bandwidth
usage at the expense of delayed communication.

Enter the number of times the DNP3 driver attempts to

Unsolicited Response send the unsolicited application fragment upon not
Retries receiving confirmation.

The value can be 0 to 255.

Unsolicited Response Retry Enter the time intervals between retry to send the
Delay unsolicited response.

According to requirement, select Delete the oldest event

Delete the oldest event when queue is full or not. If this option is checked, in case
when queue is full the DNP3 event buffer is full, then any new event
overwrites the oldest event.

Validate Outstation Select this option, the controller only accept data from
Address some specific outstation address.

Enter the interval that DNP slave station sends response

Keepalive Interval to master station to make sure if the connection is
normal.

Honeywell 2017 14
DNP3 Slave Configuration

Parameter Description

Enable DNP3 Time

Enable time synchronization from the DNP3 master.
Synchronization

Select the time that the controller should indicate to

SCADA that the time synchronization is required.

Attention:
DNP3 Time Synchronization If you select DNP3 Time Sync here, you
Period cannot enable Primary Server and
Secondary Server under Miscellaneous
> Configure Date/Time options at the
same time, or else you cannot
download your configuration.

Solicited response Enter the time in milliseconds the DNP3 driver waits for
confirmation timeout confirmation for the sent solicited application fragment.

Enter the time in milliseconds the DNP3 driver waits for

Unsolicited response confirmation for the sent unsolicited application
confirmation timeout fragment.

Maximum value for timeout is 3600000ms.

Select before operation Enter the time in milliseconds the DNP3 driver waits for
timeout SBO.

Select the corresponding class for EFM data to SCADA

communication.

Set the time interval for getting the EFM responses back
to Experion from the controller through the DNP3 virtual
terminal point.
EFM Data Class
There are three options defined by the DNP3 master:

l Class 1

l Class 2

l Class 3

11. Click Mapping tab, and then select the required mapping table from the

Honeywell 2017 15
DNP3 Slave Configuration

Mapping drop-down list.

Tip:
The same mapping table may be selected for use on multiple
ports. For example, this could be used when a SCADA system
communicates through 2 ports in a redundant arrangement.

12. In the Default Variation tab, configure the default variation for each type of
DNP3 point. Default variation defines the data format that is used by the
controller to send data to the DNP3 Master, when the Master does not ask for
a specific data variation.

Parameter Description

Used to report the current value of a binary input point with three
options:

Binary Input l Any variation

l Packed format

l Value with flags

Used to report events related to a binary input point with four options:

l Any variation
Binary Input
l Value without time
Event
l Value with absolute time

l Value with relative time

Used to report the current value of a double-bit binary input point with
three options:
Double-bit l Any variation
Binary Input
l Packed format

l Value with flags

Double-bit Used to report events related to a double-bit binary input point with four
Binary Input options:

Honeywell 2017 16
DNP3 Slave Configuration

Parameter Description

l Any variation

l Value without time

Event
l Value with absolute time

l Value with relative time

Used to control or report the state of one or more binary output points
with three options:
Binary l Any variation
Output
l Packed format

l Status with flags

A Binary Output Event Object is an instance of a report for an

outstation’s corresponding Binary Output Static object.
Binary
Output l Any variation
Event l Status without time

l Status with time

A Binary Output Command Event object reports that a command has

Binary been attempted on an outstation’s corresponding binary output point.
Output l Any variation
Command
Event l Status without time

l Status with time

Used to report the current value of a counter point with five options:

l Any variation

l 32-bit integer with flag

Counter
l 16-bit integer with flag

l 32-bit integer without flag

l 16-bit integer without flag

Frozen Used to report the value of a counter point captured at the instant when

Honeywell 2017 17
DNP3 Slave Configuration

Parameter Description

the count is frozen with seven options:

l Any variation

l 32-bit integer with flag

l 16-bit integer with flag

Counter
l 32-bit integer with flag. time

l 16-bit integer with flag. time

l 32-bit integer without flag

l 16-bit integer without flag

Used to report the value of a counter point after the count has changed
with five options:

l Any variation
Counter l 32-bit integer with flag
Event
l 16-bit integer with flag

l 32-bit integer with flag. time

l 16-bit integer with flag. time

Used to report, as an event, the value of a counter point captured at the

instant when the count is frozen.

l Any variation
Frozen
Counter l 32-bit integer with flag
Event l 16-bit integer with flag

l 32-bit integer with flag. time

l 16-bit integer with flag. time

Used to report the current value of an analog input point with seven
options:
Analog Input
l Any variation

l 32-bit integer with flag

Honeywell 2017 18
DNP3 Slave Configuration

Parameter Description

l 16-bit integer with flag

l 32-bit integer without flag. time

l 16-bit integer without flag. time

l Single-precision float with flag

l Double-precision float with flag

Used to report events related to an analog input point with nine options:

l Any variation

l 32-bit integer with time

l 16-bit integer with time

Analog Input l 32-bit integer without time

Event l 16-bit integer without time

l Single-precision float with time

l Double-precision float with time

l Single-precision float without time

l Double-precision float without time

Used to set and report the deadband value of an analog input point with
four options:

l Any variation
Analog Input
Deadband l 16-bit integer

l 32-bit integer

l Single-precision float

Used to report the status of an analog output point with seven options:
Analog l Any variation
Output
Status l 32-bit integer with flag

l 16-bit integer with flag

Honeywell 2017 19
DNP3 Slave Configuration

Parameter Description

l Single-precision float with flag

l Double-precision float with flag

An Analog Output Event Object is an instance of a report for an

outstation’s corresponding Analog Output Status object. There are nine
options:

l Any variation

l 32-bit integer with time

Analog l 16-bit integer with time

Output l 32-bit integer without time
Event
l 16-bit integer without time

l Single-precision float with time

l Double-precision float with time

l Single-precision float without time

l Double-precision float without time

An Analog Output Command Event object reports that a command has

been attempted on an outstation’s corresponding Analog Output point.
There are nine options:

l Any variation

l 32-bit integer with time

Analog l 16-bit integer with time
Output
Command l 32-bit integer without time
Event l 16-bit integer without time

l Single-precision float with time

l Double-precision float with time

l Single-precision float without time

l Double-precision float without time

Honeywell 2017 20
DNP3 Slave Configuration

13. Select Flash or SD card from the drop-down list besides Save DNP3 Events
to:.

Attention:
o If you want to save DNP3 events to SD card, you must

allocate the space for DNP3 events first. See "Preparing

SD Card" in ControlEdge Builder User's Guide for the
detailed configuration.
o Up to 80000 DNP3 events can be saved to Flash.

o Up to 200000 DNP3 events can be saved to SD card.

14. Click Save.

15. Click Connect from the Home Page to connect a controller. For the user name
and password, see "User Privileges" in ControlEdge Builder User's Guide.
16. Click Download from the Home Page to load the configuration of the DNP3
Slave to the controller.

Honeywell 2017 21
Enron Modbus Slave Configuration

Enron Modbus Slave Configuration

Configuring an Enron Modbus Slave
To set a controller as an Enron Modbus Slave
1. From the Home Page, click Configure Ethernet Ports and select ETH1 or
ETH2.
2. Under Network Setting, select Use the following IP address and enter the
details in the IP Address, Subnet Mask and Gateway fields.
3. Under Protocol Binding, select Enron Modbus Slave to bind it to the Ethernet
port.
4. Click Save to save the configuration, and click Back to return to the Home
Page.
5. Click Configure Protocols > Enron Modbus Slave, select the target Ethernet
port you want to bind.
6. Select Slave ID.For Ethernet ports, the port number must be configured.

Tip:
The port configured for Enron Modbus Slave cannot be the
same port as that configured for Modbus Slave.

7. Click Save.
8. Click Connect from the Home Page to connect a controller. For the user name
and password, see "User Privileges" in ControlEdge Builder User's Guide.
9. Click Download from the Home Page to load the configuration of the Modbus
Slave to the controller.

Honeywell 2017 22
Modbus Slave Configuration

Modbus Slave Configuration

Configuring a Modbus Slave
To set a controller as a Modbus Slave
1. From the Home Page, click Configure Ethernet Ports and select ETH1 or
ETH2.
2. Under Network Setting, select Use the following IP address and enter the
details in the IP Address, Subnet Mask and Gateway fields.
3. Under Protocol Binding, select Modbus TCP Slave to bind it to the Ethernet
port.
4. Click Save to save the configuration, and click Back to return to the Home
Page.
5. Click Configure Protocols > Modbus Slave, select the target Ethernet port you
want to bind.
6. Select Slave ID.For Ethernet ports, the port number must be configured.
7. Select the required mapping table from the Mapping drop-down list.

Tip:
The same mapping table may be selected for use on multiple
ports. For example, this could be used when a SCADA system
communicates through 2 ports in for redundancy.

8. Click Save.
9. Click Connect from the Home Page to connect a controller. For the user name
and password, see "User Privileges" in ControlEdge Builder User's Guide.
10. Click Download from the Home Page to load the configuration of the Modbus
Slave to the controller.

Honeywell 2017 23
Modbus Master Configuration

Modbus Master Configuration

Modbus TCP Master
Configuring a Modbus TCP Master
Modbus TCP Master is used for communication between the controller and third-
party Modbus slave devices over Ethernet.
A new project should be created and a controller should be added to the project
opened in ControlEdge Builder. See "Creating a project" and "Connecting a
controller" in ControlEdge Builder User's Guide for more details.
To set a controller as a Modbus TCP Master
1. From the Home Page, click Configure Ethernet Ports and select ETH1 or
ETH2.
2. Under Network Setting, select Use the following IP address and enter the
details in the IP Address, Subnet Mask and Gateway fields.
3. Under Protocol Binding, select Modbus TCP Master to bind Modbus TCP
Master to the Ethernet port.
4. Click Save to save the configuration, or click Back to return to the Home Page.
5. Click Connect from the Home Page to connect a controller. For the user name
and password, see "User Privileges" in the ControlEdge Builder User's Guide.
6. Click Download from the Home Page to load the configuration of Modbus
TCP Master to the controller.
Programming a Modbus TCP Master
After downloading the configuration, you need to program Modbus TCP Master for
the project in IEC Programming Workspace.

To program a Modbus TCP Master

1. Right-click Logical POUs and select Insert > Program. Then enter the name,
and click OK. For the following steps, FBD language is used as an example.
2. Add a Taskas follows:
a. Under Physical Hardware, right-click Task and select Insert > Task.
b. In the pop-up window, enter the name. Select the task type as CYCLIC,
and click OK.
c. In the pop-up window of Task settings, configure the corresponding para-
meters.
d. Click OK.

Honeywell 2017 24
Modbus Master Configuration

3. Right-click the task you have inserted, and selectInsert > Program instance.
4. Enter a name in the Program instancefield.

Attention:
The program instance must not be named “RTU” or
“GlobalVariable”.

5. Select the program you want to associate from the Program type drop-down
list.
6. Right-click Libraries and select Insert > Firmware Library, select
MODBUS.FWL. Then click Include.
7. Right-click Data Types and select Insert > Datatypes. In the pop-up window,
enter the Name and click OK.
8. Double-click the data type you have inserted and define an array in worksheet
shown as below, then click Save button from the toolbar. Click Make.
Modbus Data Array

9. Under Logical POUs, double-click the code worksheet of the program

that you have inserted.
10. Drag the target function or function block of modbus from the Edit Wizard pane
into the code worksheet, the function or function block is displayed. There are
twelve function blocks available for Modbus master programming. For more
details, see Description of Modbus Function Block on page 33. For the fol-
lowing steps, the function block MB_RD_MHR is used as an example.
11. Double-click the pin-outs of the function or function block to assign variables.
In the pop-up Variable Properties window, select the Name, Data Type and
Usage from the drop-down list, and assign Initial value and I/O address. Then

Honeywell 2017 25
Modbus Master Configuration

click OK.

Tip:
To assign initial values to CONFIG_INFO:
CONFIG_INFO, a predefined data structure for Modbus
configuration information, is the crucial input for Modbus
master function blocks and contains key Modbus
communication parameters such as IP address of slave, slave
ID, port number of the controller to be used, etc. This data
structure is read-only and cannot be viewed and edited in
ControlEdge Builder. See Description of CONFIG_INFO on
page 57 for more details. Slave1 is the variable name
assigned by the user of CONFIG_INFO.
CONFIG_INFO for Modbus TCP Master

12. Assign the data returned by the function block to variables to monitor.
Output Data

Honeywell 2017 26
Modbus Master Configuration

Tip:
DATA1 is the variable name assigned by the user of OUTPUT
pin of MB_RD_MHR and it is an array.

After the basic programming steps as described, the workplace will appear as
shown below.
Programming Completion

13. Click Make from the toolbar to compile the programs.

14. Click Download from the toolbar to download the compiled programs of Mod-
bus TCP Master to the controller.

Modbus Serial Master

Configuring a Modbus Serial Master
Modbus Serial Master is used for communication between the controller and third-
party Modbus slave devices over Ethernet.
A new project is created and a controller is added to the project opened in RTU
Builder. See "Creating a project" and "Connecting a controller" in ControlEdge
Builder User's Guide for more details.
To set the controller as a Modbus Serial Master

Honeywell 2017 27
Modbus Master Configuration

1. From the Home Page, click Configure Serial Ports and select the target serial
port to configure.
2. Under General,Port Name and Port Type are displayed automatically. Select
appropriate values for Baud Rate, Parity, Data Bits, Stop Bits, Flow Control
and Force Online if applicable. See the following tables for parameter descrip-
tions.
Serial Port Parameters
Parameter Description

300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200
Baud Rate
RS232 does not support 57600 and 115200.

Parity None, ODD, EVEN

Data Bits 7, 8

Stop Bits 1, 2

For RS232-1 and RS232-2, there are two more options to configure: Flow
Control and Force Online. See the following table for the parameter
descriptions.
RS232 Serial Port Parameters
Parameter Description

Only for RS232-1 and RS232-2

Flow Control l None

l RTS-CTS

Only for RS232-1 and RS232-2.

Force Online is used to save energy when there is no device connected

to the controller RS232 ports by disabling it.

Select the desired option from the Force Online drop-down list:
Force Online
l Disable

It is selected by default and the controller is on power saving

mode. RS232 transmitter will detect the connection of external
device. If external device is connected to the controller, the local
transmitter will be enabled for communication. If there is no

Honeywell 2017 28
Modbus Master Configuration

RS232 Serial Port Parameters(continued...)

Parameter Description

external device connected, the local transmitter will remain

disabled to save energy.

l Enable

RS232 transmitter will not detect external device and if you

force enable, more energy is consumed.

Tip:
The following table describes four scenarios that will happen
for Force Online option between the controller and the device
it communicates.
Force online scenarios between the controller and devices
Controller Third-party
Force Online Device Force Communication
Option Online Option

Enabled Enabled Normal

Normal, with energy saving on the

Disabled Enabled
controller

Normal, with energy saving on

Enabled Disabled
Device

It is forbidden. Both devices would

consider there is no device
Disabled Disabled
connected to it and hence there is
no communication between them.

3. Under Protocol Binding, select Modbus RTU Master or Modbus ASCII

Master to bind Modbus Serial Master to the serial port. See the following table
for parameter descriptions.

Honeywell 2017 29
Modbus Master Configuration

Parameter descriptions of Modbus RTU Master and Modbus ASCII Master

Protocol Description

The controller acts as the Modbus Master and used for

Modbus RTU
communication between The controller and third-party Modbus
Master
Slave devices, for example I/O modules.

The controller acts as the Modbus Master and used for

Modbus ASCII
communication between The controller and third-party Modbus
Master
Slave devices, for example: I/O modules.

4. Click Save to save the configuration, or click Back to return to the Home Page.
5. Click Connect from the Home Page to connect a controller. For the user name
and password, see "User Privileges" in ControlEdge Builder User's Guide.
6. Click Download from the Home Page to load the configuration of Modbus
Serial Master to the controller.
Programming a Modbus Serial Master
After downloading the configuration, you must program Modbus Serial Master for
the project in IEC Programming Workspace.
To program a Modbus Serial Master
1. Right-click Logical POUs and select Insert > Program. Then enter the name,
and click OK. For the following steps, FBD language is used as an example.
2. Add a Task as follows:
a. Under Physical Hardware, right-click Task and select Insert > Task.
b. In the pop-up window, enter the name. Select the task type as CYCLIC,
and click OK.
c. In the pop-up window of Task settings, configure the corresponding para-
meters.
d. Click OK.
3. Right-click the task you have inserted, and select Insert > Program instance.

Honeywell 2017 30
Modbus Master Configuration

4. Enter a name in the Program instance field.

Attention:
The program instance must not be named “RTU” or
“GlobalVariable”.

5. Select the program you want to associate from the Program type drop-down
list.
6. Right-click Libraries and select Insert > Firmware Library, select
MODBUS.FWL. Then click Include.
7. Right-click Data Types and select Insert > Datatypes. In the pop-up window,
enter the Name and click OK.
8. Double-click the data type you have inserted and define an array in worksheet
shown as below, then click Save from the toolbar. Click Make.
Modbus Data Array

9. Under Logical POUs, double-click the code worksheet of the program

that you have inserted. The workspace appears.
10. Drag the target function or function block of modbus from the Edit Wizard pane
into the workspace, the function or function block is displayed. There are
twelve function blocks available for Modbus master programming. For more
details, see Description of Modbus Function Block on page 33. For the fol-
lowing steps, the function block MB_RD_MHR is taken as an example.
11. Double-click the pin-outs of the function or function block to assign variables.
In the pop-up Variable Properties window, select the Name, Data Type and
Usage from the drop-down list, and assign Initial value and I/O address. Then
click OK.

Honeywell 2017 31
Modbus Master Configuration

Tip:
To assign initial values to CONFIG_INFO:
CONFIG_INFO, a predefined data structure for Modbus
configuration information, is the crucial input for Modbus
master function blocks and contains key Modbus
communication parameters such as IP address of slave, slave
ID, port number of the controller to be used, etc. This data
structure is read-only and cannot be viewed and edited in RTU
Builder. See Description of CONFIG_INFO on page 57 for
more details. Slave1 is the variable name assigned by the user
of CONFIG_INFO.

CONFIG_INFO for Modbus Serial Master

12. Assign the data returned by the function block to variables to monitor.
Output Data

Honeywell 2017 32
Modbus Master Configuration

Tip:
DATA1 is the variable name assigned by the user of OUTPUT
pin of MB_RD_MHR and it is an array.

After the basic programming steps as described, the workplace will appear as
shown below.
Programming Completion

13. Click Make from the toolbar to compile the programs.

14. Click Download from the toolbar to download the compiled programs of Mod-
bus Serial Master to the controller.

Description of Modbus Function Block

With these function blocks, you can read and write single coil, multiple coils, single
discrete input, multiple discrete inputs, single input register, multiple input registers,
single holding register, etc., as per Modbus protocol.
Read Single Coil
MB_RD_C

Honeywell 2017 33
Modbus Master Configuration

Description

It is used to read a single coil.

Input
MB_RD_C Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description
data type
of CONFIG_INFO on page 57.

The first Modbus register address to read. Function code

START_ADDR UINT
is not included in the address.

If SEND_FLAG is true and RDY_FLAG is true, function

blocks will send the request. RDY_FLAG is TRUE means
SEND_FLAG BOOL last communication is finished. Before the last
communication is finished, even if the SEND_FLAG is true,
the request won’t be sent.

Output
MB_RD_C Output Parameter
Parameter Data type Description

True: last communication is finished. FB is

RDY_FLAG BOOL ready for the next communication.

False: command request is being sent or

Honeywell 2017 34
Modbus Master Configuration

MB_RD_C Output Parameter(continued...)

Parameter Data type Description

received.

OUTPUT BOOL Output: 1: true, 0: OFF

Indicates that the response is received

DONE BOOL
from slave device.

Will be set to TRUE if there is either a

ERR_FLG BOOL
general error or a protocol error.

Error numbers defined by Modbus

PROTOCOL_ERR USINT protocol. See Modbus Protocol Error
Codes on page 60 for details.

General error code:

0: Communication succeeded.

1: The input parameter is invalid.

GEN_ERR USINT 2: Response timeout

3: Controller internal time out (IPC

timeout).

4: Invalid request

Read Multiple Coils

MB_RD_MC

Honeywell 2017 35
Modbus Master Configuration

Description
It is used to read multiple coils.
Input
MB_RD_MC Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description of
data type
CONFIG_INFO on page 57.

The first Modbus register address to read. Function code is

START_ADDR UINT
not included in the address.

LENGTH UINT The number of registers to read.

If SEND_FLAG is true and RDY_FLAG is true, function blocks

will send the request. RDY_FLAG is TRUE means the last
SEND_FLAG BOOL communication finished. Before the last communication is
finished, even if SEND_FLAG is true, the request won’t be
sent.

Output
MB_RD_MC Output Parameter
Data
Parameter Description
type

True: last communication is finished. FB is ready for the next

RDY_FLAG BOOL communication.

False: command request is being sent or received.

User defined data type: array of bool. The size of the array should be
equal to the number of the registers to read. Define a data type as
Array of shown below:
OUTPUT
BOOL TYPE
Variable Name: array[1..LENGTH] of BOOL;
END_TYPE

DONE BOOL Indicates that the response is received from a slave device.

Honeywell 2017 36
Modbus Master Configuration

MB_RD_MC Output Parameter(continued...)

Data
Parameter Description
type

Will be set to TRUE if there is either a general error or a protocol

ERR_FLG BOOL
error.

PROTOCOL_ Error numbers defined by Modbus protocol. See Modbus Protocol

USINT
ERR Error Codes on page 60 for details.

General error code:

0: Communication succeeded.

1: The input parameter is invalid.

GEN_ERR USINT
2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Read Single Discrete Input

MB_RD_DI

Description
It is used to read single discrete input.
Input

Honeywell 2017 37
Modbus Master Configuration

MB_RD_DI Input Parameter

Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus

User defined
CONFIG_INFO related information is included. For more details, see
data type
Description of CONFIG_INFO on page 57.

The first Modbus register address to read. Function

START_ADDR UINT
code is not included in the address.

If SEND_FLAG is true and RDY_FLAG is true,

function blocks will send the request. RDY_FLAG is
SEND_FLAG BOOL TRUE means last communication is finished. Before
last communication is finished, even if SEND_FLAG
is true the request won’t be sent.

Output
MB_RD_DI Output Parameter
Parameter Data type Description

True: last communication is finished. FB is ready for

RDY_FLAG BOOL the next communication.

False: command request is being sent or received.

User defined data type: array of BOOL. The size of

OUTPUT Array of BOOL the array should be equal to the number of the
registers to read.

OUTPUT BOOL Output: 1: true, 0: OFF

Indicates that the response is received from a slave

DONE BOOL
device.

Will be set to TRUE if there is either a general error

ERR_FLG BOOL
or a protocol error.

Error numbers defined by Modbus protocol. See

PROTOCOL_ERR USINT Modbus Protocol Error Codes on page 60 for
details.

General error code:

GEN_ERR USINT
0: Communication succeeded.

Honeywell 2017 38
Modbus Master Configuration

MB_RD_DI Output Parameter(continued...)

Parameter Data type Description

1: The input parameter is invalid.

2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Read Multiple Discrete Inputs

MB_RD_MDI

Description
It is used to read multiple discrete inputs.

Input
MB_RD_MDI Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description
data type
of CONFIG_INFO on page 57.

The first Modbus register address to read. Function code

START_ADDR UINT
is not included in the address.

Honeywell 2017 39
Modbus Master Configuration

MB_RD_MDI Input Parameter(continued...)

Parameter Data type Description

LENGTH UINT The number of registers to read.

If SEND_FLAG is true and RDY_FLAG is true, function

blocks will send the request. RDY_FLAG is TRUE means
SEND_FLAG BOOL the last communication is finished. Before the last
communication is finished, even if SEND_FLAG is true, the
request won’t be sent.

Output
MB_RD_MDI Output Parameter
Data
Parameter Description
type

True: last communication is finished. FB is ready for the next

RDY_FLAG BOOL communication.

False: command request is being sent or received.

User defined data type: array of bool. The size of the array should be
equal to the number of the registers to read. Define a data type as
Array of shown here:
OUTPUT
BOOL TYPE
Variable Name: array[1..LENGTH] of BOOL;
END_TYPE

DONE BOOL Indicates that the response is received from a slave device.

Will be set to TRUE if there is either a general error or a protocol

ERR_FLG BOOL
error.

PROTOCOL_ Error numbers defined by Modbus protocol. See Modbus Protocol

USINT
ERR Error Codes on page 60 for details.

General error code:

0: Communication succeeded.

GEN_ERR USINT 1: The input parameter is invalid.

2: Response timeout

3: Controller internal time out (IPC timeout).

Honeywell 2017 40
Modbus Master Configuration

MB_RD_MDI Output Parameter(continued...)

Data
Parameter Description
type

4: Invalid request

Read Single Input Register

MB_RD_IR

Description
It is used to read single input register.
Input
MB_RD_IR Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description of
data type
CONFIG_INFO on page 57.

The Modbus register address to read. Function code is not

START_ADDR UINT
included in the address.

If SEND_FLAG is true and RDY_FLAG is true, function blocks

would send the request. RDY_FLAG is TRUE means the last
SEND_FLAG BOOL
communication is finished. Before last communication is
finished, even if SEND_FLAG is true, the request won’t be

Honeywell 2017 41
Modbus Master Configuration

MB_RD_IR Input Parameter(continued...)

Parameter Data type Description

sent.

Output
MB_RD_IR Output Parameter
Parameter Data type Description

True: last communication is finished. FB is ready for the next

RDY_FLAG BOOL communication.

False: command request is being sent or received.

OUTPUT BOOL 16bit Data read from the START_ADDR

DONE BOOL Indicates that the response is received from slave device.

Will be set to TRUE if there is either a general error or a

ERR_FLG BOOL
protocol error.

PROTOCOL_ Error numbers defined by Modbus protocol. See Modbus

USINT
ERR Protocol Error Codes on page 60 for details.

General error code:

0: Communication succeeded.

1: The input parameter is invalid.

GEN_ERR USINT
2: Response timeout

3: Controller internal time out(IPC timeout).

4: Invalid request

Read Multiple Input Registers

MB_RD_MIR

Honeywell 2017 42
Modbus Master Configuration

Description
It is used to read multiple input registers.
Input
MB_RD_MIR Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description of
data type
CONFIG_INFO on page 57.

The first Modbus register address to read. Function code is

START_ADDR UINT
not included in the address.

LENGTH UINT The number of registers to read.

If SEND_FLAG is true and RDY_FLAG is true, function

blocks would send the request. RDY_FLAG is TRUE means
SEND_FLAG BOOL the last communication is finished. Before the last
communication is finished, even if the SEND_FLAG is true,
the request won’t be sent.

Output

Honeywell 2017 43
Modbus Master Configuration

MB_RD_MIR Output Parameter

Paramete Data
Description
r type

True: last communication is finished. FB is ready for the next

RDY_
BOOL communication.
FLAG
False: command request is being sent or received.

INT,
User defined data type. The size of the array should be equal to the
UINT,
number of the registers to read. The end user should define a data type
DINT,
as shown here:
UDIN
T, TYPE
OUTPUT
LINT, array[1..LENGTH] of
REAL INT/UINT/DINT/UDINT/LINT/REAL/LREAL;
or END_TYPE
LREA
The end user can read the data of a specific register by using the suffix.
L;

Endian mode is required for reading/writing 32bit and 64 bit variables. As

Modbus always use big Endian to transceive data, there is no need to set
the Endian mode for 16-bit data.

1: little Endian mode for 32 bit data

2: byte-swapped little Endian mode for 32 bit data

3: big Endian mode for 32 bit data

ENDIAN_ USIN
MODE T 4: byte-swapped big Endian mode for 32 bit data

5: little Endian mode for 64 bit data

6: byte-swapped little Endian mode for 64 bit data

7: big Endian mode for 64 bit data

8: byte-swapped big Endian mode for 64 bit data

Please see Endian Mode on page 61 for details.

DONE BOOL Indicates that the response is received from slave device.

ERR_FLG BOOL Will be set to TRUE if there is either a general error or a protocol error.

PROTOCO USIN Error numbers defined by Modbus protocol. See Modbus Protocol Error
L_ERR T Codes on page 60 for details.

Honeywell 2017 44
Modbus Master Configuration

MB_RD_MIR Output Parameter(continued...)

Paramete Data
Description
r type

General error code:

0: Communication succeeded.

USIN 1: The input parameter is invalid.

GEN_ERR
T 2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Read Single Holding Register

MB_RD_HR

Description
It is used to read a single holding register.
Input
MB_RD_HR Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description
data type
of CONFIG_INFO on page 57.

Honeywell 2017 45
Modbus Master Configuration

MB_RD_HR Input Parameter(continued...)

Parameter Data type Description

The Modbus register address to read. Function code is not

START_ADDR UINT
included in the address.

If SEND_FLAG is true and RDY_FLAG is true, function

blocks would send the request. RDY_FLAG is TRUE means
SEND_FLAG BOOL the last communication is finished. Before the last
communication is finished, even if the SEND_FLAG is true
the request won’t be sent.

Output

MB_RD_HR Output Parameter

Parameter Data type Description

True: last communication is finished. FB is ready for the

RDY_FLAG BOOL next communication.

False: command request is being sent or received.

OUTPUT BOOL 16 bit data read from the START_ADDR

DONE BOOL Indicates that the response is received from slave device.

Will be set true if there is either a general error or a

ERR_FLG BOOL
protocol error.

PROTOCOL_ Error numbers defined by Modbus protocol. See Modbus

USINT
ERR Protocol Error Codes on page 60 for details.

General error code:

0: Communication succeeded.

1: The input parameter is invalid.

GEN_ERR USINT
2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Read Multiple Holding Registers

MB_RD_MHR

Honeywell 2017 46
Modbus Master Configuration

Description
It is used to read multiple holding registers.
Input
MB_RD_MHR Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description
data type
of CONFIG_INFO on page 57.

The first Modbus register address to read. Function code

START_ADDR UINT
is not included in the address.

LENGTH UINT The number of registers to read.

If SEND_FLAG is true and RDY_FLAG is true, function

blocks would send the request. RDY_FLAG is TRUE
SEND_FLAG BOOL means the last communication is finished. Before the last
communication is finished, even if the SEND_FLAG is
true, the request won’t be sent.

Output

Honeywell 2017 47
Modbus Master Configuration

MB_RD_MHR Output Parameter

Dat
Parame
a Description
ter
type

True: last communication is finished. FB is ready for the next

RDY_ BOO communication.
FLAG L
False: command request is being sent or received.

Arra
y of
INT,
UIN User defined data type. The size of the array should be equal to the number
T, of the registers to read. The end user should define a data type as shown
DIN here:
T,
TYPE
OUTPUT UDI
Variable Name: array[1..LENGTH] of
NT,
INT/UINT/DINT/UDINT/LINT/REAL/LREAL;
LIN
END_TYPE
T,
REA The end user can read the data of a specific register by using the suffix.
L or
LRE
AL;

Endian mode is required for reading/writing 32bit and 64 bit variables. As

Modbus always use big Endian to transceive data, there is no need to set
the Endian mode for 16-bit data.

1: little Endian mode for 32 bit data

2: byte-swapped little Endian mode for 32 bit data

ENDIA 3: big Endian mode for 32 bit data

USI
N_ 4: byte-swapped big Endian mode for 32 bit data
NT
MODE
5: little Endian mode for 64 bit data

6: byte-swapped little Endian mode for 64 bit data

7: big Endian mode for 64 bit data

8: byte-swapped big Endian mode for 64 bit data

Please see Endian Mode on page 61 for details.

Honeywell 2017 48
Modbus Master Configuration

MB_RD_MHR Output Parameter(continued...)

Dat
Parame
a Description
ter
type

BOO
DONE Indicates that the response is received from slave device.
L

ERR_ BOO
Will be set to TRUE if there is either a general error or a protocol error.
FLG L

PROTO
USI Error numbers defined by Modbus protocol. See Modbus Protocol Error
COL_
NT Codes on page 60 for details.
ERR

General error code:

0: Communication succeeded.

GEN_ USI 1: The input parameter is invalid.

ERR NT 2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Write Single Coil

MB_WR_C

Description
It is used to write a single coil.
Input

Honeywell 2017 49
Modbus Master Configuration

MB_WR_C Input Parameter

Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus

User defined
CONFIG_INFO related information is included. For more details, see
data type
Description of CONFIG_INFO on page 57.

The Modbus register address to read. Function code is

START_ADDR UINT
not included in the address.

If SEND_FLAG is true and RDY_FLAG is true, function

blocks would send the request. RDY_FLAG is TRUE
SEND_FLAG BOOL means the last communication is finished. Before the
last communication is finished, even if the SEND_FLAG
is true, the request won’t be sent.

1: ON
INPUT BOOL
0: OFF

Output
MB_WR_C Output Parameter
Parameter Data type Description

True: last communication is finished. FB is ready for the

RDY_FLAG BOOL next communication.

False: command request is being sent or received.

Indicates that the response is received from slave

DONE BOOL
device.

Will be set to TRUE if there is either a general error or a

ERR_FLG BOOL
protocol error.

Error numbers defined by Modbus protocol. See

PROTOCOL_ERR USINT
Modbus Protocol Error Codes on page 60 for details.

General error code:

0: Communication succeeded.
GEN_ERR USINT
1: The input parameter is invalid.

2: Response timeout

Honeywell 2017 50
Modbus Master Configuration

MB_WR_C Output Parameter(continued...)

Parameter Data type Description

3: Controller internal time out (IPC timeout).

4: Invalid request

Write Single Holding Register

MB_WR_HR

Description
It is used to write single holding register.
Input
MB_WR_HR Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

User defined
CONFIG_INFO information is included. For more details, see Description
data type
of CONFIG_INFO on page 57.

The Modbus register address to read. Function code is not

START_ADDR UINT
included in the address.

If SEND_FLAG is true and RDY_FLAG is true, function

blocks would send the request. RDY_FLAG is TRUE means
SEND_FLAG BOOL the last communication is finished. Before the last
communication is finished, even if the SEND_FLAG is true,
the request won’t be sent.

Honeywell 2017 51
Modbus Master Configuration

MB_WR_HR Input Parameter(continued...)

Parameter Data type Description

INPUT UINT 16 bit input data of START_ADDR register

Output
MB_WR_HR Output Parameter
Parameter Data type Description

True: last communication is finished. FB is ready for the

RDY_FLAG BOOL next communication.

False: command request is being sent or received.

DONE BOOL Indicates that the response is received from slave device.

Will be set to TRUE if there is either a general error or a

ERR_FLG BOOL
protocol error.

PROTOCOL_ Error numbers defined by Modbus protocol. See Modbus

USINT
ERR Protocol Error Codes on page 60 for details.

General error code:

0: Communication succeeded.

1: The input parameter is invalid.

GEN_ERR USINT
2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Write Multiple Coils

MB_WR_MC

Honeywell 2017 52
Modbus Master Configuration

Description

It is used to write multiple coils.

Input
MB_WR_MC Input Parameter
Parameter Data type Description

ENABLE BOOL Enable: If TRUE, the FB is enabled and workable.

This is a structure provided by Honeywell. Modbus related

CONFIG_ User defined
information is included. For more details, see Description of
INFO data type
CONFIG_INFO on page 57.

START_ The first Modbus register address to read. Function code is not
UINT
ADDR included in the address.

LENGTH UINT The number of registers to write.

If SEND_FLAG is TRUE and RDY_FLAG is true, function blocks

would send the request. RDY_FLAG is TRUE means the last
SEND_
BOOL communication is finished. Before the last communication is
FLAG
finished, even if the SEND_FLAG is true, the request won’t be
sent.

User defined data type: array of bool. The size of the array
should be equal to the number of the registers to read. The end
INPUT Array of BOOL user should define a data type as shown here:

TYPE
Variable Name: array[1..LENGTH] of BOOL;

Honeywell 2017 53
Modbus Master Configuration

MB_WR_MC Input Parameter(continued...)

Parameter Data type Description

END_TYPE

Use the suffix to set the status of a specific register.

Output
MB_WR_MC Output Parameter
Parameter Data type Description

True: last communication is finished. FB is ready for the

RDY_FLAG BOOL next communication.

False: command request is being sent or received.

DONE BOOL Indicates that the response is received from slave device.

Will be set to TRUE if there is either a general error or a

ERR_FLG BOOL
protocol error.

PROTOCOL_ Error numbers defined by Modbus protocol. See Modbus

USINT
ERR Protocol Error Codes on page 60 for details.

General error code:

0: Communication succeeded.

1: The input parameter is invalid.

GEN_ERR USINT
2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Write Multiple Holding Registers

MB_WR_MHR

Honeywell 2017 54
Modbus Master Configuration

Description
It is used to write multiple holding registers.
Input
MB_WR_MHR Input Parameter
Param Data
Description
eter type

ENABL BOO
Enable: If TRUE, the FB is enabled and workable.
E L

User
defin
CONFI This is a structure provided by Honeywell. Modbus related information is
ed
G_INFO included. For more details, see Description of CONFIG_INFO on page 57.
data
type

START_ The first Modbus register address to read. Function code is not included in
UINT
ADDR the address.

LENGT
UINT The number of registers to write.
H

If SEND_FLAG is true and RDY_FLAG is true, function blocks would send the
SEND_ BOO request. RDY_FLAG is TRUE means the last communication is finished.
FLAG L Before the last communication is finished, even if the SEND_FLAG is true,
the request won’t be sent.

Honeywell 2017 55
Modbus Master Configuration

MB_WR_MHR Input Parameter(continued...)

Param Data
Description
eter type

Array
of
User defined data type. The size of the array depends on the number of the
INT,
registers to write:
UIN
T, Size of (array) * size of (element of array) / size of (UINT) = LENGTH.
DIN
The end user should define a data type as shown here:
T,
INPUT
UDI TYPE
NT, Variable Name: array[1..LENGTH] of
LINT, INT/UINT/DINT/UDINT/LINT/REAL/LREAL;
REA END_TYPE
L, or
Use the suffix to read the data of a specific register.
LRE
AL

Output
MB_WR_MHR Output Parameter
Parameter Data type Description

True: last communication is finished. FB is ready for the next

RDY_FLAG BOOL communication.

False: command request is being sent or received.

Endian mode is required for reading/writing 32bit and 64 bit

variables. As Modbus always use big Endian to transceive
data, there is no need to set the Endian mode for 16-bit
data.

1: little Endian mode for 32 bit data

ENDIAN_
USINT 2: byte-swapped little Endian mode for 32 bit data
MODE
3: big Endian mode for 32 bit data

4: byte-swapped big Endian mode for 32 bit data

5: little Endian mode for 64 bit data

6: byte-swapped little Endian mode for 64 bit data

Honeywell 2017 56
Modbus Master Configuration

MB_WR_MHR Output Parameter(continued...)

Parameter Data type Description

7: big Endian mode for 64 bit data

8: byte-swapped big Endian mode for 64 bit data

Please see Endian Mode on page 61 for details.

DONE BOOL Indicates that the response is received from slave device.

Will be set to TRUE if there is either a general error or a

ERR_FLG BOOL
protocol error.

PROTOCOL_ Error numbers defined by Modbus protocol. See Modbus

USINT
ERR Protocol Error Codes on page 60 for details.

General error code:

0: Communication succeeded.

1: The input parameter is invalid.

GEN_ERR USINT
2: Response timeout

3: Controller internal time out (IPC timeout).

4: Invalid request

Description of CONFIG_INFO
The CONFIG_INFO pin defined in the function blocks is to input all the
configuration information for the Modbus master.
There are two types of communication between Modbus master and Modbus slave:
serial communication using RS232 or RS485, and Ethernet communication.
Accordingly two types of data structures are defined for CONFIG_INFO.
n For serial communication, the data structure is defined as:
TYPE
MB_CONFIG_INFO_COM:
STRUCT
MB_SLAVE_ID: USINT;
PORT_NUM: USINT;
RETRIES: USINT;
TIMEOUT: UDINT;

Honeywell 2017 57
Modbus Master Configuration

END_STRUCT;
END_TYPE

n For Ethernet communication, the data structure is defined as:

TYPE
MB_CONFIG_INFO_ETH:
STRUCT
MB_SLAVE_ID: USINT;
PORT_NUM: USINT;
RETRIES: USINT;
TIMEOUT: UDINT;
TCP_PORT_NUM: UINT;
IP_ADDR: STRING;
END_STRUCT;
END_TYPE

Attention:
You are not permitted to make any change to the data structure as
the configuration would be parsed incorrectly.

See the following table for the parameter descriptions.

CONFIG_INFO Parameter
Parameter Data type Description

MB_SLAVE_ID USINT Modbus slave ID: valid arrange: 1~247.

n The physical interface of serial port:

a. RS232 port 1

b. RS232 port 2

c. RS485 port 1
PORT_NUM USINT
d. RS485 port 2

e. reserved

f. reserved

n The physical interface of Ethernet port:

Honeywell 2017 58
Modbus Master Configuration

CONFIG_INFO Parameter(continued...)
Parameter Data type Description

a. Ethernet port 1

b. Ethernet port 2

c. reserved

d. reserved

RETRIES USINT Retry times before it is failed.

Timeout unit: millisecond.

TIMEOUT UDINT The minimal timeout is 500ms. If the end-user gives a

number less than 500, the FB would send the default
timeout value instead.

Description of Input and Output Data Type

Modbus supports reading and writing multiple consecutive registers. In these cases,
the input or output is defined as an array.
n For reading and writing coils and discrete inputs, array of BOOL is defined.
Set or retrieve the data value by using the suffix. For example: there are 10
coils to read, the output array COIL_OUT can be defined as array [1...10] of
BOOL, reading the status of the fifth register could be COIL_OUT [5].
n For reading and writing input registers and holding registers, multiple array
types can be defined: INT, UINT, DINT, UDINT, REAL, LREAL or LINT.
Set or retrieve the data value by using the suffix. For example: there are 3
LREAL variables , or in other words, 12 holding registers to read, the output
array LREAL_OUT can be defined as array[1..3] of LREAL, reading the value
of the second register could be LREAL_OUT[2]. In this case, the Endian mode
is involved.

Tip:

Honeywell 2017 59
Modbus Master Configuration

Reading or writing a single DINT/UDINT/LINT/REAL/LREAL type

data: You need not define an “array[1..1] of xxx ”; you can simply
assign a DINT, UDINT, LINT, REAL or LREAL type variable to the
INPUT/OUTPUT pin of the function block.

Modbus Protocol Error Codes

Refer to the following table for Modbus Protocol Error Codes:
Modbus Protocol Error Codes
Error Code Item Description

0 success N/A

Signals that the TCP/IP connection is closed by the

69 Connection broken
remote peer or broken.

129 checksum error N/A

Signals that a received frame does not correspond

either by structure or content to the specification or
130 invalid frame error
does not match a previously sent query frame. A poor
data link typically causes this error.

Signals that a received reply does not correspond to

131 Invalid reply error
the specification

Signals that a fieldbus data transfer timed out. This

can occur if the slave device does not reply in time or
does not reply at all. A wrong unit address will also
132 reply timeout error
cause this error. On some occasions, this exception is
also produced if the characters received don't
constitute a complete frame.

Signals that a fieldbus data send timed out. This can

133 send timeout error
only occur if the handshake lines are not properly set.

Signals that an illegal Function exception response

was received. This exception response is sent by a
illegal function
161 slave device instead of a normal response message if a
response
master sent a Modbus function not supported by the
slave device.

Honeywell 2017 60
Modbus Master Configuration

Modbus Protocol Error Codes(continued...)

Error Code Item Description

Signals that an illegal Data Address exception

response was received. This exception response is sent
illegal address
162 by a slave device instead of a normal response
response
message if a master queried an invalid or non-existing
data address.

Signals that an illegal Value exception response was

received. This exception response is sent by a slave
163 illegal value response device instead of a normal response message if a
master sent a data value that is not an allowed value
for the slave device.

Signals that a Slave Device Failure exception response

(code 04) was received. This exception response is
sent by a slave device instead of a normal response
164 failure response message if an unrecoverable error occurred while
processing the requested action. This response is also
sent if the request would generate a response whose
size exceeds the allowable data size.

Endian Mode
Modbus protocol supports 16bit data only. If there are 32bit or 64bit variables, 2 or 4
consecutive registers should be used to read the data value. In these cases, the
Endian mode may be involved due to the different Endian modes in Modbus slave
devices.
See the following table for the concept of Endian modes used in Modbus function
blocks:
Modbus Function Block Endian Mode
Endian mode Description

Lower registers contain lower bits and higher registers contain

higher bits. The order is on a register basis. Inside each register, the
Little endian
more significant byte is always at the first place as defined by the
Modbus protocol.

Lower registers contain higher bits and higher registers contain

Big endian lower bits. The order is on a register basis. Inside each register, the
more significant byte is always at the first place as defined by the

Honeywell 2017 61
Modbus Master Configuration

Modbus Function Block Endian Mode(continued...)

Endian mode Description

Modbus protocol.

Byte-swapped The two bytes inside each register would be swapped.

See the following table for the valid Endian modes:

Modbus Function Block Valid Endian Mode
Valid Endian mode Description

1 little Endian mode for 32 bit data

2 byte-swapped little Endian mode for 32 bit data

3 big Endian mode for 32 bit data

4 byte-swapped big Endian mode for 32 bit data

5 little Endian mode for 64 bit data

6 byte-swapped little Endian mode for 64 bit data

7 big Endian mode for 64 bit data

8 byte-swapped big Endian mode for 64 bit data

Honeywell 2017 62
OPC UA Configuration

OPC UA Configuration
Introduction
OPC is the interoperability standard for the secure and reliable exchange of data in
the industrial automation space and in other industries. It is a platform independent
and ensures the seamless flow of information among devices from multiple vendors.
OPC UA released in 2006 is a platform independent service-oriented architecture
that integrates all the functionality of the individual OPC Classic specifications into
one extensible framework.
ControlEdge PLC supports OPC UA server and client which are built-in protocols in
the controller, and it provides an IIoT-ready open platform that enables users to
better leverage data across their assets. Benefits include:

n Smooth integration with a broad range of instruments, equipment and software

from multiple vendors
n Flexible and scalable design due to interoperable multi-level and multi-
platform open communication
n Direct access to cloud-based applications for visualization and analytics
Prerequisite skills
This guidance uses terminology and concepts defined in OPC UA, PLCOpen and
IEC 61131-3 specifications. It is assumed that you have familiarity with these
Industry Standards. The following table lists relevant OPC UA or PLCOpen
terminology and concepts introduced in this guide.

Reference Description

Defines the basic address model concepts

OPC Unified Architecture
including nodes, attributes, references,
[UA-3] Specification Part 3: Address
variables, data types and methods. Standard
Space Model, Release 1.03
node classes are defined in this specification.

Abstract descriptions of OPC UA Services

which are organized into Service Sets.
OPC Unified Architecture
Familiarization with the “Overview” content for
[UA-4] Specification Part 4: Services,
the following Service Sets is recommended:
Release 1.03
SecureChannel, Session, Monitored Item, and
Subscription.

Honeywell 2017 63
OPC UA Configuration

Reference Description

Building on the concepts introduced in Part 3,

this specification defines the UA Information
OPC Unified Architecture model which is the base for all OPC UA
Specification Part 5: Information Models including PLCOpen. It
[UA-5]
Information Model, Release defines entry points into the address space,
1.03 Server Object, built-in object or data types,
standard objects and their variables and
standard references.

Defines meaningful collections of features for

OPC Unified Architecture compliance purposes. Familiarity with the
[UA-7] Specification Part 7: Profiles, terminology introduced in this specification
Release 1.03 including profile, facet, and compliance unit is
recommended.

Defines an OPC UA Information Model

OPC Unified Architecture for
associated with Devices. This information
[DI] Devices Companion
model provides a base for other OPC UA
Specification
companion specifications including PLC Open.

Defines an OPC UA Information Model to

represent the IEC 61131-3 architectural
models. This specification is considered a
PLCopen and OPC
companion specification to the set of OPC UA
Foundation: OPC UA
[PLC] specifications. To understand the overall
Information Model for IEC
structure of the IEC 61131-3 Information
61131-3, Release 1.00
model as it relates to DI and base OPC UA, see
the figure labeled as “OPC UA IEC 61131-3
ObjectTypes Overview”.

Help content that is accessible from

ControlEdge Builder. IEC 61131 compliant
[IEC] IEC 61131 Basics
PLC elements are described in detail including
those for data types.

OPC UA Server
ControlEdge PLC OPC UA Server enables the native OPC UA client access to
information on ControlEdge PLC.

Honeywell 2017 64
OPC UA Configuration

System Architecture and Profiles

The figure below conceptually shows the deployment of the ControlEdge PLC OPC
UA Server as an embedded OPC UA server. The same is true for the OPC UA
Client and Modbus Master that are also shown in the figure below as examples of
data sources. These examples are in addition to the local or remote I/O capabilities
of the ControlEdge PLC, all of which can be exposed by the ControlEdge PLC OPC
UA server when the data sources are configured within the eCLR.
Although not shown below, it is possible to establish a peer to peer connection from
the embedded OPC UA Client to the embedded OPC UA Server on a different
ControlEdge PLC.

The ControlEdge PLC OPC Server is based on the Embedded UA Server profile
defined in [OPC-7]. Refer to [PLC] for additional companion specification profile
information.

Honeywell 2017 65
OPC UA Configuration

Access Level
Currently, the ControlEdge PLC OPC UA server allows both read and write access
of all exposed variables.
Security
Currently, the ControlEdge OPC UA Server is implemented with the lowest security
level.
Redundancy
The ControlEdge OPC UA Server does not support UA redundancy as defined in
[UA-4]. Furthermore, the ControlEdge OPC UA Server does not maintain any state
data. Therefore, if an unexpected disconnection between the client and server
occurs, it is the responsibility of the clients to re-establish connections (i.e.
sessions). Even though none of OPC UA redundancy profiles are supported, the
Control Edge OPC UA Server does participate in redundancy related usage
scenarios supported in the ControlEdge PLC.
Accessing the Server Object
The ControlEdge PLC OPC UA Server supports the standardized entry points into
its address space.
n OPC UA clients can browse to the Server object by traversing the hierarchy
starting at Root.
n Alternatively, OPC UA clients can use the Server object’s well-known node id
to directly access its objects, properties and variables.
Use the diagram legend to understand the objects, variables and properties that the
ControlEdge PLC OPC UA Server supports.

Honeywell 2017 66
OPC UA Configuration

Server Diagnostics
The Sever Diagnostic object shown above, represents pertinent diagnostic
information related to the ControlEdge PLC OPC UA server itself. All mandatory
sub-components and properties are supported [UA-5].
Accessing ControlEdge PLC data

Overview
DeviceSet is the entry point for OPC UA Clients that want to access data from the
ControlEdge PLC. Shown below is an example address space of the ControlEdge
PLC OPC UA Server. It is based on Object Types definitions found in the base UA
specification ([UA-5]) as well as those definitions found in companion specifications
([DI] and [PLC]). In this address space, there are three example objects:
n eclrRes is an example of a Ctrl Resource
n SimpleUARead is an example of a Ctrl Program Instance.

Honeywell 2017 67
OPC UA Configuration

n DftTask is an example of a Ctrl Task.

An example for address space of the ControlEdge PLC OPC UA Server

Ctrl Resources
All the data on the ControlEdge PLC is accessible by browsing to the Object
instance derived from CtrlResourceType. The Browsename of this Object instance
is the name given to the resource that represents the ControlEdge PLC itself.
Shown below is the output of a 3rd party client connected to the ControlEdge PLC
OPC UA Server. The objects listed below PLC_Demo represents the complete set
of data associated with the ControlEdge PLC including Programs, Tasks, Global
variables and Diagnostics.

Honeywell 2017 68
OPC UA Configuration

Ctrl Programs
In ControlEdge PLC, the instance of a POU assigned to a task is treated as a
program instance. Note that same program instance in is able to be assigned to
different task. They are treated as different program instance.
Shown below is the output of a 3rd party client connected to the ControlEdge PLC
OPC UA Server, all Ctrl Program instances executing in the ControlEdge PLC are
located under Programs. For each Ctrl Program, the program variables and
Function Block instances including their child function blocks and variables also
appear in the address space.

Honeywell 2017 69
OPC UA Configuration

The “With” reference is used to show the association between the program instance
and the task that executes the program.
ControlEdge PLC Diagnostics
Referring to ControlEdge PLC Diagnostics above, OPC UA clients have access to
ControlEdge PLC diagnostic information exposed by the GlobalVars and
Diagnostics folder objects.
Located under the GlobalVars folder are the ControlEdge PLC System Variables
including PLC_SYS_TICK_CNT and PLC_MAX_ERRORS.
Located under the Diagnostics folder are the ControlEdge PLC diagnostics as
viewed from the ControlEdge Configuration Workspace of the ControlEdge Builder.
Program Variable NodeIds
OPC UA Clients can use NodeIds to read, write and monitor variables for data
changes. The NodeIds for accessing IEC 61131-3 program elements are defined
with string identifiers. The string identifiers embed the underlying name that the
ControlEdge PLC OPC UA Server uses to access the ControlEdge PLC variables.
Global and Diagnostic Variables on the next page and Program Variables on the
next page define the string representation of several types of variables.

Honeywell 2017 70
OPC UA Configuration

Global and Diagnostic Variables

For Global and Diagnostic variables, the Identifier element of the NodeId is defined
as: Identifier = @GV. <Varname>
For example, the NodeId of the global variable ‘PLC_SYS_TICK_CNT’ is shown
below.

Element NodeId

NamespaceIndex 5

IdentifierType String

Identifier @GV.PLC_SYS_TICK_CNT

Note that for ControlEdge PLC OPC UA client, function block

“UaNamespaceGetIndex” is able to get the NamespaceIndex when NamespaceUri
of ControlEdge PLC OPC Server is available. See Key Parameters to establish
OPC UA communication on page 83 for more information.
Program Variables
For Program local variables, the Identifier element of the Nodeid is defined as:
Identifier = <Program Instance Name>.<Varname>
For example, the NodeId of the local variable ‘Connect’ defined within the program
instance ‘ReadWrite is shown below.

Element NodeId

NamespaceIndex 5

IdentifierType String

Identifier ReadWrite.Connect

For Function Block instance variables, the Identifier element of the NodeId is define
as:
Identifier = <Program Instance Name>.<FunctionBlockInstance>.<Varname>
The example below shows the NodeId of ‘ConnectHandle’ which is a variable of
the Function Block instance ‘UA_Read_Write_1’ in the program ‘ReadWrite’

Honeywell 2017 71
OPC UA Configuration

Element NodeId

NamespaceIndex 5

IdentifierType String

Identifier ReadWrite.UA_ReadWrite_1.ConnectionHandle

Data Types
Elementary types
The ControlEdge PLC OPC UA server maps all IEC 61131-3 elementary data types
supported on the ControlEdge PLC to an OPC UA built in data type. The table
below shows how the elementary data types defined by IEC 61131 -3 map to OPC
UA Built in data types.

IEC 61131-3 Elementary Data Types OPC UA Built In Data Types

BOOL Boolean

SINT SByte

USINT Byte

INT Int16

UINT UInt16

DINT Int32

UDINT Uint32

BYTE Byte

WORD UInt16

DWORD Uint32

REAL Float

LREAL Double

STRING String

TIME Double

Honeywell 2017 72
OPC UA Configuration

Note that when writing to a variable, the ControlEdge OPC UA Server shall return a
Bad_TypeMismatch error if the data type of the written value is not the same type or
subtype of the variable’s DataType.
Structured Types
The IEC 61131-3 STRUCT declaration represents a structured data type as an
aggregate data type. IEC 61131-3 structured data types defined in the ControlEdge
PLC are mapped by the ControlEdge OPC UA Server to OPC UA structured data
types as defined in [PLC] section 5.2.3.4. Shown below is the definition of
ANALOG_INPUT_TYPE as an IEC 61131-3 structured type defined in the
ControlEdge PLC.
TYPE
ANALOG_INPUT_TYPE
STRUCT
STS : USINT;
PV : REAL;
EUHI : REAL;
EULO : REAL;
EUHIEX : REAL;
EULOEX : REAL;
END_STRUCT;
END_TYPE

To illustrate how the ControlEdge PLC OPC UA Server maps ANALOG_INPUT_

TYPE, we connect a 3rd party sample client to the ControlEdge PLC OPC UA
Server.
Shown below is the partial Browse output for a variable.

Honeywell 2017 73
OPC UA Configuration

Currently, the ControlEdge PLC OPC UA server implements approach "c" as

described in the section entitled “Many Variables and / or structured DataTypes” of
[UA-3]. This means that an OPC UA client can access the whole data structure as
well as its individual elements.
Shown below is the AddressSpace showing the variable, AIVar1 and individual
elements of the variable.

The following steps summarize how the ControlEdge PLC OPC UA Server exposes
IEC 61131-3 Structured Data Types such as ANALOG_INPUT_TYPE to OPC UA
Clients:
1. Creates an OPC UA Structured DataType with the same elements as the IEC
61131-3 STRUCT.
2. Creates an OPC UA Complex Variable with the DataType created in step 1.
3. Creates several simple Variables using simple DataTypes to reflect the
elements in the IEC 61131-3 STRUCT and exposes them as variables of the
Complex Variable created in step 2.

Honeywell 2017 74
OPC UA Configuration

4. Adds the Variable created in step 2 to the AddressSpace to make the data
available to the OPC UA Client.
Additionally, the Datatype, which in our example is ANALOG_INPUT_TYPE, is
added to the DataTypeDictionary. The DataTypeDictionary also contains all the
other structured DataTypes supported by the ControlEdge PLC OPC UA Server.
Arrays
The PLC array data type is mapped to an OPC UA data type derived from the
corresponding elementary data type. The ‘ValueRank’ attribute is used in UA to
provide the information if a value is an array and the ‘ArrayDimensions’ attribute
provides the length of each dimension. Arrays appear as a single node in the UA
address space.

Example of an array data type in ControlEdge PLC:

TYPE
UaLocaleIds : ARRAY [1..5] OF STRING;
END_TYPE

A variable, say ‘LocaleIds’, of this type in a PLC program will be mapped to the
OPC data type String with the ‘ValueRank’ attribute set to 1 and ArrayDimensions
[0] set to 5.

Arrays of Structured types

The ControlEdge PLC structured data arrays are modelled along the lines of
standard OPCUA array types such as SubscriptionDiagnosticsArray defined in [UA-
5]. Unlike an elementary array that appears as a single node in the AddressSpace,

Honeywell 2017 75
OPC UA Configuration

the structured data array will expose each entry of the array as a separate node in
the AddressSpace. This way a UA Client can access the entire array, read an
individual array entry or read individual elements of an array entry.
Shown below is an IEC 61131-3 array of struct ANALOG_INPUT_TYPE defined in
the ControlEdge PLC.
TYPE
AIList : ARRAY [1..5] OF ANALOG_INPUT_TYPE;
END_TYPE
The program DftInst has a variable AIDataValues of type AIList. The AddressSpace
with the variable AIDataValues is shown below:

Object Types
OPC UA Clients can browse for Server specific function block types from the
CtrlTypes\FunctionBlocks Folder object as shown here:

Honeywell 2017 76
OPC UA Configuration

Reference types
The ControlEdge PLC OPC UA Server makes use of the following Reference types
defined in [PLC]:
HasInputVar– used to reference variables declared with the key word VAR_INPUT

Honeywell 2017 77
OPC UA Configuration

HasOutputVar– used to reference variables declared with the key word VAR_
OUTPUT
HasInOutVar– used to reference variables declared with the key word VAR_IN_
OUT
HasLocalVar– used to reference variables declared with the key word VAR
With– used to reference the Ctrl Task that executes a Ctrl Program.
Configure ControlEdge PLC OPC UA Server
Configuration
Binding Protocol to Ethernet Ports

You must establish the physical address or endpoint that enables OPC UA client
access to the ControlEdge PLC OPC UA Server. A maximum of two endpoints can
be defined by binding the ETH1 or ETH2 ports on the ControlEdge PLC to OPC UA
Server. One or two endpoints are possible depending on if both ETH1 and ETH2
are bound to OPC UA Server.
1. From the Home Page of ControlEdge Builder, click the arrow beside
Configure Ethernet Ports, and select ETH1 or ETH2.
2. Under Network Setting, select Use the following IP address and enter the IP
address of the Ethernet port.
3. Under Protocol Binding, select OPC UA Server.
Ethernet port configuration page

4. Click Save to complete the configuration.

Configuring Parameters for OPC UA Server

The ControlEdge PLC OPC UA Server supports the UA TCP transport protocol
which defaults to communicate on TCP port 4840. This communication port as well
as other connectivity and tuning parameters are available for optional configuration.

Honeywell 2017 78
OPC UA Configuration

The ControlEdge PLC OPC UA server uses default values if no alternative value
has been configured. The default configuration is sufficient for getting started with
connectivity.

Attention:
Make sure that the OPC UA client’s time is synchronized to the
controller’s time.

1. From the Home Page of ControlEdge Builder, click Configure Protocols >
OPC UA Server. The OPC UA Server page appears.
OPC UA Server configuration page

2. Configure the parameters if required. See the following table for the parameter
description.

Honeywell 2017 79
OPC UA Configuration

Attention:
It is recommended to use the default values for the parameters.

OPC UA Server parameter description

Parameter Description

The port that clients will use to connect. For example:

Port opc.tcp://192.168.0.15:4840

The default value is 4840.

The maximum age of a request (in milliseconds) the server

allows. Zero value is defined as unlimited.
Max Request Age
The default value, which is 0, indicating that the request age
allowed is unlimited.

The maximum number of concurrent sessions the server

allows.

Max Session Count If you enter a value of 0, the number of sessions allowed is
unlimited.

The default value is 100.

The maximum number of subscriptions allowed by the server

Max Subscription Per for one session.
Session If you enter a value of 0, the number of subscription allowed is
unlimited.

The maximum number of concurrent sessions the server

allows per client.
Max Session Per Client
The default value, which is 0, indicating that the number of
sessions allowed is unlimited.

The minimum timeout for a session (in milliseconds).

Min Session Timeout If you enter a value of 0, the minimum timeout is unlimited.

The default value is 10000.

Max Session Timeout The maximum timeout for a session (in milliseconds).

Honeywell 2017 80
OPC UA Configuration

OPC UA Server parameter description(continued...)

Parameter Description

If you enter a value of 0, the maximum timeout is unlimited.

The default value is 3600000.

The maximum number of browse continuation points

Max Browse managed by a session.
Continuation Points
The default value is 0.

The maximum number of browse results for one browse

operation.
Max Browse Results
The default value, which is 0, indicating that the number of
browse results is unlimited.

The maximum number of nodes to browse.

Max Nodes To Browse The default value, which is 0, indicating that the number of
nodes allowed is unlimited.

The minimum cycle rate of the Subscription.

Min Publishing Interval
The default value is 50 milliseconds.

The maximum cycle rate of the Subscription.

Max Publishing Interval The default value, which is 0, indicating that the publishing
interval allowed is unlimited.

The minimum interval after which the subscription sends a

notification to the client. This notification ensures the
Min Keep Alive Interval subscription is maintained.

The default value is 5000 milliseconds.

Provides assurance to the client that the server is still alive.

The minimum period after which the subscription will be

Min Subscription deleted if no publish request is received.
Lifetime If you enter a value of 0, the subscription lifetime allowed is
unlimited.

The default value is 10000 milliseconds.

Honeywell 2017 81
OPC UA Configuration

OPC UA Server parameter description(continued...)

Parameter Description

Provides assurance to the server that the client is still alive.

The maximum period after which the subscription will be

Max Subscription
deleted if no publish request is received.
Lifetime
The default value, which is 0 milliseconds, indicating that the
subscription lifetime allowed is unlimited.

The maximum number of messages allowed per Subscription

Max Retransmission in the republish queue.
Queue Size
The default value is 10.

The maximum number of notifications allowed per Publish.

Max Notifications Per
Publish The default value, which is 0, indicating that the number of
notifications allowed is unlimited.

The maximum size of data monitored item queues.

Max Data Queue Size
The default value is 100.

The maximum size of event monitored item queues.

The default value is 1000.

Max Event Queue Size

Attention:

Currently, this parameter cannot be

configured.

The maximum number of subscriptions that can be created.

Max Subscription
Count The default value, which is 0, indicating that the number of
subscriptions allowed is unlimited.

The maximum number of items that can be monitored.

Max Monitored Item
Count The default value, which is 0, indicating that the number of
items allowed is unlimited.

Max Monitored Item The maximum number of items that can be monitored for
Per Subscription Count each subscription.

Honeywell 2017 82
OPC UA Configuration

OPC UA Server parameter description(continued...)

Parameter Description

The default value, which is 0, indicating that the number of

items allowed is unlimited.

The maximum number of items that can be monitored for

Max Monitored Item each session.
Per Session Count The default value, which is 0, indicating that the number of
items allowed is unlimited.

For more information about the parameter descriptions, see the specification in the
https://opcfoundation.org/.

3. Click Save to complete the configuration.

Key Parameters to establish OPC UA communication
To establish the communication between OPC UA Sever and OPC UA client,
below key parameters of Server must be provided and be required in the
configuration in OPC UA side.
Server Endpoint URL

The URL of ControlEdge PLC OPC UA Server defined as follows:

<ControlEdge PLC OPC Server URL>:= “opc.tcp://” <IP>”:”<Port>
“opc.tcp://” is the protocol string portion of the URL. This string is constant since the
protocol used by the ControlEdge PLC OPC UA Server is TCP.
<IP> is the IP address of ETH1 or ETH2 on the ControlEdge PLC.

<Port> is the port number for the transport protocol. Port number 4840 is the default
for OPC UA.
In the following URL examples, the IP address of ETH1 port on the ControlEdge
PLC is set to 192.168.1.10. The IP address of ETH2 port on the ControlEdge PLC is
set to 192.168.2.10.
Note that one or both URLs may exist depending on the port configuration.
opc.tcp://192.168.1.10:4840
opc.tcp://192.168.2.10:4840

Honeywell 2017 83
OPC UA Configuration

When both Ethernet ports are configured as shown in the example above, the
ControlEdge PLC OPC UA Server considers the links to be redundant. In this case,
the ControlEdge PLC OPC Server is listening on both endpoints. When one link is
lost, clients can use the URL of the second link to connect to the Server. It is worth
noting that the ControlEdge PLC OPC UA Server maintains the session created on
the failed link until the session timeout period expires after which the session will be
deleted.
In the case of redundant ControlEdge PLC, the IP address follows the primary PLC.
Therefore, if a switchover occurs, the client reconnects to the ControlEdge PLC
OPC UA Server on the new primary with the same URL that was used to connect to
the server on the failed primary.
Namespace

OPC UA uses namespaces to uniquely differentiate between the names and IDs it
defines and those defined by companion specifications or the local server. The
ObjectTypes defined in the UA specification for IEC 61131-3 derive from the OPC
UA Device Integration Types which in turn derive from the OPC UA Core
ObjectTypes. Thus the ControlEdge PLC OPC UA Server includes these 3
namespaces in addition to its own namespace. The list of namespaces used in the
Server is shown below:

Namespace
Namespace Description
Index

Namespace for NodeIds and

0 http://opcfoundation.org/UA/ BrowseNames defined in the OPC
UA specification.

Namespace index 1 is reserved for

the local server, for nodes specific
URL:<IP Address>: to the server like those shown in
Honeywell:ControlEdgePLC:UAServer section 4.1. Note that this URI is
where IP Address is the IP of the Ethernet also the ServerURI (appears in
1
port that is bound to OPC UA Server. If UA index 0 of the ServerArray
is enabled on both ETH1 and ETH2, then property). It is also the
the IP of ETH1 is used for IP Address. ApplicationURI in the
subjectAltName field of the
server’s certificate.

Namespace for NodeIds and

2 http://opcfoundation.org/UA/DI/
BrowseNames defined in [DI].

Honeywell 2017 84
OPC UA Configuration

Namespace
Namespace Description
Index

Namespace for NodeIds and

3 http://PLCopen.org/OpcUa/IEC61131-3/
BrowseNames defined in [PLC].

Namespace for NodeIds and

BrowseNames of ControlEdge PLC
DataTypes. This namespace is
4 URN:Honeywell:UA:ControlEdgePLC:Types
also used for node instances and
standard properties of [DI] and
[PLC]

Namespace for NodeIds and

BrowseNames of nodes used to
5 URN: Honeywell:UA:ControlEdgePLC
access the underlying ControlEdge
PLC data.

OPC UA Client
IEC 61131-3 OPC UA Function Blocks
The function blocks within the OPCUA library are the native IEC 61131-3 OPC UA
Function blocks as defined in [PLC-C]. The figures below illustrate the common
interface of each function block regardless of the task that it performs.

Honeywell 2017 85
OPC UA Configuration

The table below references the above figures to describe the behavior of the IEC
61131-3 OPC UA Function Blocks.

Interface Behavior

The Function Block command or task is initiated by a rising edge at the Execute
input. While the value of Execute is equal to TRUE, the Busy, Done and Error
Execute
outputs can be examined independently to determine the status of the function
Input
block execution. Furthermore, the Busy, Done and Error outputs are mutually
exclusive, i.e. only one of these outputs can be set at a given time.

Input parameters are read at the rising edge of Execute input. Inputs are only
<input
read once. Therefore, in order for changes to input parameters to take effect,
parameters>
the Execute input must be re-initiated.

Honeywell 2017 86
OPC UA Configuration

Interface Behavior

The Busy output is an indication that the function block has not completed.
Busy Output This output is set to TRUE at the rising edge of Execute. It is reset when either
Done or Error is set.

The Done output, when set, is the indication that the function block has
completed successfully. This output is used to trigger the next step in a
sequence of function blocks.

Done
Output Tip:

Once the Done output is TRUE, the Execute input must be

reset prior to re-trigger of UaConnect function block.

If an error occurs during the execution of the function block, this output is set.
The ErrorID output contains the error number. Refer to [] for the list of error
codes.
Error
n Since the function block did not complete successfully, the Done output
Output
remains reset.

n Timeout input indicates the maximum time for the Function Block to
complete. If the timeout value expires, then the Error output is set.

Output parameters may be invalid while Busy output is set. Monitor the Done
<output
output to trigger valid usage of output parameters (see flowchart diagram
parameters
below)

IEC 61131-3 OPC UA function block usage

Use of IEC 61131-3 OPC UA function blocks in the OPCUA library requires special
handling of BUSY, DONE and ERROR output parameters as shown in the diagram
to the right. Failure to perform the special handling of the corresponding output
parameters will result in unexpected program errors. Consider use of the OPC UA
Helper Function Blocks to facilitate implementation of the required special handling.
See next section for details.

Honeywell 2017 87
OPC UA Configuration

Usage Considerations

The following table outlines a typical usage scenario when combining OPC UA
function blocks. Use the table to map the program phase tasks to function blocks
from the OPCUA or Honeywell Helper libraries. See Prepare Phase for Reads,
Writes or Method Calls on page 92 to Utilities on page 107 for more information.

Program
Task OPC UA Library Honeywell Helper Library
Phase

Establish
Prepare connection to UA UaConnect HonUaConnectSecurityNone
Server

Honeywell 2017 88
OPC UA Configuration

Program
Task OPC UA Library Honeywell Helper Library
Phase

Get the
namespace-index
of a namespace-
URI for the
UaNamespaceGetIndex
variables in the See note1
(translatepath)
target OPC UA
server’s address
space to be read or
written

Get the node

handle for the
variables in the UaNodeGetHandle
target OPC UA See note2
servers address UaNodeGetHandleList
space to be read or
written

Get the method

handle for a UaMethodGetHandle See note3
method call

Translate Path - UaTranslatePath

Get node
UaTranslatePathList HonUaTranslatePathList
parameters using
path of the node. UaTranslatePaths

Reading of
variables in the UaRead HonUaReadNode
namespace of UA UaReadList HonUaReadNodeList
Server

Writing of variables UaWrite HonUaWriteNode

Work
in the namespace
of UA server UaWriteList HonUaWriteNodeList

Execution of
methods supported UaMethodCall HonUaCallMethod
by UA Server

Cleanup Release node UaNodeReleaseHandle See note4

Honeywell 2017 89
OPC UA Configuration

Program
Task OPC UA Library Honeywell Helper Library
Phase

handle UaNodeReleaseHandleList

Release the method

UaMethodReleaseHandle
handle

Terminate the
connection to OPC UaDisconnect HonUaConnectSecurityNone
UA Server

Monitor Handle to
signal loss of
handle due to See note5 HonUaHandleDetector
ControlEdge PLC
Utilities reset.

Utility block to
monitor and signal See note6 HonUaStateDetector
a change in state.

Note:

1. Currently, there is no Honeywell Helper Function Block for UaNamespaceGetIndex.

However, refer to the structured text code for HonUaTranslatePathList for an example.

2. Currently, there are no stand-alone Honeywell Helper Function Blocks for

UaNodeGetHandle and UaNodeGetHandleList. HonUaReadNode and
HonUaWriteNode are designed to include UaNodeGetHandle. HonUaReadNodeList
and HonUaWriteNodeList are designed to include UaNodeGetHandleList.

3. Currently, there is no stand-alone Honeywell Helper Function Block for

UaMethodGetHandle. This is included in HonUaCallMethod.

4. Currently, there are no Honeywell Helper Function Blocks for UaNodeReleaseHandle,

UaNodeReleaseHandleList and UaMethodReleaseHandle.

5. There are no IEC 61131-3 OPC UA blocks defined for these funtions.

6. There are no IEC 61131-3 OPC UA blocks defined for these funtions.

There are several ways to facilitate development of a PLC program with OPC UA
function blocks:

Honeywell 2017 90
OPC UA Configuration

n Understand the OPC UA Function Block state model (Execute-Busy-Done).

n Connect a graphical OPC UA Client to the target OPC UA server (see tip
below). Browse the target server address space to become familiar with OPC
UA communication parameters including:
l Node Identifier
l Node Namespace Index and associated Namespace URI
l Node data type
l Method Node ID and Object Node ID
n Use the Honeywell Helper Function Blocks. These function blocks are
implemented with structured text. Each helper function block can be used
directly in the same way function blocks from OPCUA Library are used.
Alternatively, use the Honeywell Helper Function Blocks as examples to
create custom helper function blocks.

Tip:
Use a graphical OPC UA Client
Consider use of a graphical OPC UA Client to access attributes of
the target OPC UA server and the nodes within its address space.
The example below shows the Browse output from OPC Foundation
Sample Client for an individual node.
Output from OPC Foundation Sample Client for an individual node

Honeywell 2017 91
OPC UA Configuration

To determine the NodeId attributes (NamespaceIndex,

IdentifierType and Identifier), view the value to the right of the
NodeId object in the Browse output. In this example:
NamespaceIndex = 4
IdentifierType = String
Identifier = ReadWrite.LocaleIds

The following sections describe the detailed usage information to perform work
tasks such as UaRead, UaReadList, UaWrite, UaWriteList or UaMethodCall. These
sections follow the order of tasks introduced in the table above (shown below
graphically).

Prepare Phase for Reads, Writes or Method Calls

Establishing a connection to the target OPC UA server is the primary objective of
the Prepare Phase. OPC UA servers require a physical network location or
endpoint URL for connectivity. The endpoint URL for an OPC UA server consists of
several parts: prefix, host and port. “opc.tcp://” is an example of a valid prefix portion
of the URL. It identifies the endpoint as an OPC Server and the protocol. The host
portion is either a hostname or IP address. The port number is the target port of the
OPC UA Server, which may vary among OPC UA Server providers. Consult with
the target OPC UA Server documentation to verify the endpoint URL.
A new session is established each time a connection is established.
Establishing Connection with HonUaConnectSecurityNone

This function block uses the UaConnect function block to establish an OPC UA
session to a remote OPC Server using a specified Server URL and Session name.
The security related fields of SessionConnectInfo are set to values that indicate no
use of security. If successfully established, the named session will have a 30

Honeywell 2017 92
OPC UA Configuration

second timeout.
HonUaConnectSecurityNone

VAR_INPUT

ServerEndpointURL String255 e.g., “opc.tcp://192.168.1.30:51210/UA/SampleServer”

Each time Connect executes a new session is created on the

SessionName STRING
server. This name will be associated with that session

VAR_OUTPUT

The handle associated with this connection. Handle is valid

ConnectionHandle DWORD
until Disconnect is set.

Error BOOL If set, signals an error occurred when attempting to connect

ErrorID DWORD Error ID if any, returned by the server

VAR_IN_OUT

When set TRUE and if ConnectionHandle is zero, initiates a new

Connect BOOL connection. Upon completion of 1 connection attempt (successful or
unsuccessful) will automatically reset to FALSE.

Disconnect BOOL Set to FALSE

Use the HonUaconnectSecurityNone function block as an example to create a

custom connect helper block if alternative values for non-security related fields of
SessionConnectInfo are required (such as LocalIDs or SessionTimeout).

Honeywell 2017 93
OPC UA Configuration

Accessing the Address Space of target OPC UA Server

The information that the target OPC UA Server makes available to clients is referred
to as its address space. The elements of the address space are represented as a
set of nodes. Refer to [OPC-3] to address space concepts including nodes, node
attributes and interconnections. Using standard OPC UA notation, the diagram
below shows the set of nodes common to all OPC UA Servers. As indicated by the
diagram key, this set of nodes includes objects, variables, and properties. The
diagram also illustrates the relationships between nodes. Use a graphical OPC UA
client connected to the target OPC UA Server to view the set of standard nodes for
the target OPC UA Server.

Every OPC UA node, regardless of its node type (e.g. object, variable, property,
etc.) is represented by a node identifier, which consists of the following:

Element Nodeld

NamespaceIndex 1

IdentifierType String

Identifier Instrument_01.Temp

Honeywell 2017 94
OPC UA Configuration

OPC UA uses namespaces to uniquely differentiate between the names and IDs it
defines and those defined by OPC UA companion specifications (e.g. FDI) or the
target OPC UA server itself. In the example NodeId shown above, the
NamespaceIndex is 1 which is the index reserved for the “local” server.
NamespaceIndex 0 is reserved for OPC Foundation. It is the index to NodeIds and
BrowseNames defined in the OPC UA specifications. Consult with the target OPC
UA Server documentation for a list of supported name spaces. Alternatively, use a
graphical OPC UA Client connected to your target OPC Server, to browse to the
NameSpaceArray property node (see diagram above). This node contains the
required information for the registered Namespaces on the target OPC UA Server.
Each index in the array is associated with a Namespace URI. Use the Namespace
URI with UaGetNamespaceIndex function block to resolve each Namespace index
from your PLC program. Since a namespace index can change dynamically, best
practice is to resolve the namespace URI programmatically.

Prepare with base UA blocks Prepare with Honeywell Helper UA blocks

The input to UaNodeGetHandle (as circled

The input to HonUaTranslatePathList (as
above) requires steps external to PLC
circled above) requires steps external to PLC
program to obtain the nodeIDds within each
program to obtain starting NodeId and a list
registered namespace of the target OPC UA
of relative paths. This information is used by
Server.
the target OPC Server to obtain the nodeIds
n Consult the target OPC UA for variables to read or write.
documentation HonUaTranslatePathList optionally performs
the dynamic resolution to a given namespace
n Use graphical OPC UA client to browse
index. See Obtaining Nodelds with
the address space
HonUaTranslatePathList on the next page for
more information.

Tip:

n Requires special Tip:

handling to ensure
HonUaReadNode,
completion of base

Honeywell 2017 95
OPC UA Configuration

Prepare with base UA blocks Prepare with Honeywell Helper UA blocks

UA block before
passing input to
subsequent block.

n UaNodeGetHandle HonUaReadNodeList,
maps target OPC HonUaWriteNode and
Server nodeId to a HonUaWriteNodeList use
node handle NodeIds rather than node
maintained by handles as input. The
ControlEdgePLC mapping to node handles is
OPC UA Client. Node built in to these Honeywell
handles must be helper function blocks.
explicitly supplied to
the base read and
write blocks.

Attention:

The input to UaConnect and HonUaConnectSecurityNone requires steps

external to PLC program to obtain the URL of the target OPC UA Server.

Obtaining Nodelds with HonUaTranslatePathList

HonUaTranslatePathList is a convenient way to get NodeIds within a single

namespace registered with the target OPC UA server. It uses
UaNamespaceGetIndex and UaTranslatePaths.

This function block requires the nodeID as a starting point in the address space of
the target OPC UA server. HonUaTranslatePathList optionally resolves the
namespace index in relative paths. If the substitution token ‘#’ is inserted into the
relative paths in RelativePathList then the block acquires the index of this Uri from
namespace table of the target server. It then substitutes that index at each ‘#’.
For example, if a string in the RelativePathList is "/#:Drum1001/#:LIX001/#:Output"
and NameSpaceUri "http://opcfoundation.org/sampleserver" is located at index 4 in
the namespace index table of the target server, then HonUaTranslatePathList
modifies the string to "/4:Drum1001/4:LIX001/4:Output" prior to passing to the target
server for translation.

Honeywell 2017 96
OPC UA Configuration

HonUaTranslatePathList

VAR_INPUT

Connection handle obtained from Connection block (e.g.,

ConnectionHandle DWORD
“Connect_SecurityNone” above)

The RelativePathList is evaluated using this node as a

NodeIdStartNode UaNodeID
starting point.

Relative paths to the target nodes using

RelativePathList String255List NodeIdStartNode as a starting point. See above for
syntax.

Supplied if NamespaceIndex substitution is desired in

NamespaceUri STRING
any Relative Path. Otherwise, may be set to empty string.

VAR_OUTPUT

If set, signals an error occurred when attempting to

Error BOOL
translate paths

ErrorID DWORD Error ID if any, returned by the server

Flag indicating that the function block execution has

Done BOOL completed. This flag will be reset FALSE the next time
ExecuteTranslate is set TRUE.

NodeIdOutCount UINT Number of NodeIDs returned

Node IDs corresponding to the relative paths in

NodeIdOutList UaNodeIDList
RelativePathList

Honeywell 2017 97
OPC UA Configuration

VAR_OUTPUT

Error ID associated with translating the corresponding

NodeErrorIdList UaNodeIDList relative path to a Node ID. Note that ErrorID above will be
set if any element of this list has a status other than good.

VAR_IN_OUT

When set TRUE, initiates the relative path to NodeID translation.

ExecuteTranslate BOOL Upon completion of 1 such attempt (successful or unsuccessful)
will automatically reset to FALSE.

Work Phase

Work Phase with base UA blocks Work Phase with Honeywell Helper UA blocks

Tip:

Requires special
handling to ensure
completion of base UA
block before passing Tip:
input to subsequent Node handle mapping is built-
block in to HonUaRead,
HonUaReadList, HonUaWrite
and HonUaWriteList

Reading a single variable

HonUaReadNode

Honeywell 2017 98
OPC UA Configuration

VAR_INPUT

Connection handle obtained from Connection block (e.g.,

ConnectionHandle DWORD
“Connect_SecurityNone” above)

NodeIdRead UaNodeID Node ID whose data value is to be read.

Flag indicating whether or not the NodeIdRead data value is

IsArray BOOL
an array.

ArrayIndex UINT If IsArray is TRUE then this identifies the array index to read.

VAR_OUTPUT

DataStatus UDINT Status code associated with the DataValueOut

DataValueOut UAVariant Value of the node (attribute 13)

TimeStamp UADateTime Source timestamp associated with DataValueOut

Error ID if any, returned by the server when attempting to

ErrorID DWORD
invoke the Read service.

If set, signals that an error occurred when attempting to invoke

Error BOOL
the Read service .

ReadEnabled BOOL When set, indicates that block is enabled and read service will

Honeywell 2017 99
OPC UA Configuration

VAR_OUTPUT

be called with each task cycle.

VAR_IN_OUT

When set TRUE, enables this read block. Read service will be called with
EnableRead BOOL
each task cycle. See ReadEnabled above to verify that block is enabled.

When set TRUE, disables this read block. Read service will not be called
DisableRead BOOL with each task cycle. See ReadEnabled above to verify that block is
disabled.

Reading a list of variables

HonUaReadNodeList

VAR_INPUT

Connection handle obtained from Connection block

ConnectionHandle DWORD
(e.g., “Connect_SecurityNone” above)

NodeIdCount UINT The number of Node IDs in NodeIdReadList

NodeIdReadList UaNodeIDList Node identifiers of the nodes whose values are to be

Honeywell 2017 100

OPC UA Configuration

VAR_INPUT

read by this block (max 20 identifiers).

Flag indicating whether or not the NodeIdReadList data

IsArray BOOL
values are arrays

If IsArray is TRUE then this identifies the array index for

each data value of NodeIdReadList to read.
ArrayIndices UINTList
NodeIdReadList and ArrayIndices must contain the
same number of elements.

VAR_OUTPUT

Error ID if any, returned by the server when attempting

ErrorID DWORD
to invoke the Read service.

If set, signals that an error occurred when attempting

Error BOOL
to invoke the Read service

When set, indicates that block is enabled and the Read

ReadEnabled BOOL
service will be called with each task cycle.

Status code associated with corresponding value of

DataStatusList UaDWORDList
the DataValueOutList

DataValueOutList UAVariantList Value of each node (attribute 13)

Source Timestamp associated with corresponding

TimeStampList UaDateTimeList
value of the DataValueOutList

Error ID associated with corresponding value of the

NodeErrorIdList UaDWORDList DataValueOutList. Note that ErrorID above will be set if
any element of this list has a status other than good.

VAR_IN_OUT

When set TRUE, enables this read block. Read service will be called
EnableReadList BOOL with each task cycle. See ReadEnabled above to verify that block is
enabled.

When set TRUE, disables this read block. Read service will not be
DisableReadList BOOL called with each task cycle. See ReadEnabled above to verify that
block is disabled.

Honeywell 2017 101

OPC UA Configuration

Writing a single variable

HonUaWriteNode

VAR_INPUT

Connection handle obtained from Connection block (e.g.,

ConnectionHandle DWORD
“Connect_SecurityNone” above)

NodeIdWrite UaNodeID Node ID whose data value is to be written.

Flag indicating whether or not the NodeIdWrite data value is

IsArray BOOL
an array

ArrayIndex UINT If IsArray is TRUE then this identifies the array index to write.

DataValue UAVariant Value to be written (attribute 13)

VAR_OUTPUT

Error ID if any, returned by the server when attempting to invoke the

ErrorID DWORD
Write service.

If set, signals that an error occurred when attempting to invoke the

Error BOOL
Write service

When set, indicates that block is enabled and write service will be
WriteEnabled BOOL
called with each task cycle.

VAR_IN_OUT

EnableWrite BOOL When set TRUE, enables this write block. Write service will be called with

Honeywell 2017 102

OPC UA Configuration

VAR_IN_OUT

each task cycle. See WriteEnabled above to verify that block is enabled.

When set TRUE, disables this write block. Write service will not be called
DisableWrite BOOL with each task cycle. See WriteEnabled above to verify that block is
disabled.

Writing a list of variables

HonUaWriteNodeList

VAR_INPUT

Connection handle obtained from Connection block

ConnectionHandle DWORD
(e.g., “Connect_SecurityNone” above)

NodeIdCount UINT The number of Node IDs in NodeIdWriteList

Node identifiers of the nodes whose values are to be

NodeIdWriteList UaNodeIDList
written by this block (max 20 identifiers).

Flag indicating whether or not the NodeIdWriteList data

IsArray BOOL
values are arrays

If IsArray is TRUE then this identifies the array index for

ArrayIndices UINTList each data value of NodeIdWriteList to read.

NodeIdWriteList and ArrayIndices must contain the

Honeywell 2017 103

OPC UA Configuration

VAR_INPUT

same number of elements.

DataValueList UAVariantList Values to be written (attribute 13).

VAR_OUTPUT

Error ID if any, returned by the server when attempting to

ErrorID DWORD
invoke the Write service.

If set, signals that an error occurred when attempting to

Error BOOL
invoke the Write service

When set, indicates that block is enabled and the Write

WriteEnabled BOOL
service will be called with each task cycle.

Error ID associated with corresponding value of the

DataValueList when attempting to write the value. Note
NodeErrorIdList UaDWORDList
that ErrorID above will be set if any element of this list has
a status other than good.

VAR_IN_OUT

When set TRUE, enables this write block. Write service will be called
EnableWriteList BOOL with each task cycle. See WriteEnabled above to verify that block is
enabled.

When set TRUE, disables this write block. Write service will not be
DisableWriteList BOOL called with each task cycle. See WriteEnabled above to verify that
block is disabled.

Calling a Method

HonUaCallMethod

Honeywell 2017 104

OPC UA Configuration

VAR_INPUT

Connection handle obtained from Connection block

ConnectionHandle DWORD
(e.g., “Connect_SecurityNone” above)

Node ID of the object node whose method is to be

NodeIdentifierObject UaNodeID
called by this block

NodeIdentifierMethod UaNodeID Node ID of the method node to be called by this block

Input arguments for this method. Note that some

InputArguments UAVariantList
methods may not require any input arguments.

Flag indicating that the method call has completed.

Done BOOL This flag will be reset FALSE the next time
ExecuteCall is set TRUE.

VAR_OUTPUT

Error ID if any, returned by the server when attempting to

ErrorID DWORD
invoke the Call service.

If set, signals that an error occurred when attempting to

Error BOOL
invoke the Call service

Output arguments returned by this method. Note that

OutputArguments UAVariantList
some methods may not return output arguments

Status code associated with each argument in the

InputArgResults UaDWORDList
InputArguments.

Honeywell 2017 105

OPC UA Configuration

VAR_IN_OUT

When set TRUE, invokes the method call. Upon completion of 1 method
ExecuteCall BOOL call attempt (successful or unsuccessful) will automatically reset to
FALSE.

Cleanup Phase
Releasing resources that were previously acquired during the Prepare and Work
Phases is the primary objective of the Cleanup Phase.

Cleanup Phase with Honeywell Helper UA

Cleanup Phase with base UA blocks
blocks

Terminate Connection with HonUaConnectSecurityNone

This function block uses the UaDisconnect function block to terminate an OPC UA
session to a remote OPC Server using the ConnectionHandle.
Terminate Connection with HonUaConnectSecurityNone

VAR_INPUT

ServerEndpointURL String255 e.g., “opc.tcp://192.168.1.30:51210/UA/SampleServer”

SessionName STRING Each time Connect executes a new session is created on the

Honeywell 2017 106

OPC UA Configuration

VAR_INPUT

server. This name will be associated with that session

VAR_OUTPUT

The handle associated with this connection. Handle is valid

ConnectionHandle DWORD
until Disconnect is set.

Error BOOL If set, signals an error occurred when attempting to connect

ErrorID DWORD Error ID if any, returned by the server

VAR_IN_OUT

Connect BOOL Set to FALSE

When set TRUE initiates a disconnect of the current ConnectionHandle

Disconnect BOOL (as indicated by ConnectionHandle). Upon completion of 1 disconnect
attempt (successful or unsuccessful) will automatically reset to FALSE.

Utilities
In addition to the helper blocks described in the previous Prepare and Work phase
sections, the Honeywell OPC UA Helper Block library includes several utilities that
are convenient for error detection, error handling and debugging.
Monitoring the target OPC UA Server handle

HonUaHandleDetector prevents usage of an invalid Server handle to the target

OPC Server. Currently, a server handle is invalidated if the ControlEdgePLC resets.
A future release of the ControlEdgePLC will allow OPC UA server handles to ride
through a ControlEdgePLC reset.
HonUaHandleDetector

Honeywell 2017 107

OPC UA Configuration

VAR_INPUT

When set TRUE enables the block functionality. When set FALSE
Enable BOOL
disables the block functionality.

When Enable is set TRUE, the block will monitor DWORDIn for change
DWORDIn DWORD
to 0. If this occurs then SignalOut is set TRUE.

VAR_OUTPUT

SignalOut BOOL See DWORDIn above

Detecting Boolean Resets

HonUaStateDetector is a convenient way to detect that a Boolean flag has been

reset from TRUE to FALSE.
HonUaStateDetector

VAR_INPUT

When set TRUE enables the block functionality. When set FALSE disables
Enable BOOL
the block functionality.

When Enable is set TRUE, the block will monitor BOOLIn for change to
BOOLIn BOOL
FALSE. If this occurs then SignalOut will be set TRUE.

VAR_OUTPUT

SignalOut BOOL See BOOLIn above

Converting Variant Values to String

HonUaVariantToString is useful for debugging purposes. It converts the fields of a

variant to a single string.

Honeywell 2017 108

OPC UA Configuration

HonUaVariantToString

VAR_INPUT

VariantIn UAVariant Variant value (i.e., as returned from FB “ReadNode”)

VAR_OUTPUT

StringOut STRING String representation of VariantIn

Configuring an OPC UA Client

Importing OPC UA Library
To import OPC UA Library
1. In IEC Programming Workspace, from the project tree window, right-click
Libraries and select Insert> Firmware Library.
The Include library dialog appears.
2. Open OPCUA folder and select opcua.fwl, then click Include.
The OPCUA library is displayed under Libraries.
Importing Data Types of HonUaFbHelperTypes
To import Data Types of HonUaFbHelperTypes
1. In IEC Programming Workspace, from the project tree window, select Data
Types, click File> Import.
The Import / Export dialog appears.
2. Select Extended IEC 61131-3 Import, and click OK.
the Object types dialog appears.
3. Select Datatypesand click OK.
The Extended IEC 61131-3 dialog appears.

Honeywell 2017 109

OPC UA Configuration

4. Browse to \Users\Public\Documents\ControlEdge Build-

er\Libraries\OPCUAFBHelpers”, and select the target data type. Click OK.
The HonUaFbHelperTypes is displayed under Data Types.
Importing an OPC UA POU
1. InIEC Programming Workspace, from the project tree window, select Logical
POUs, and click File> Import.
The Import / Export dialog appears.
2. Select Extended IEC 61131-3 Import, and click OK.
the Object types dialog appears.

3. Select POUand click OK.

The Extended IEC 61131-3 dialog appears.
4. Browse to \Users\Public\Documents\ControlEdge Build-
er\Libraries\OPCUAFBHelpers”, and select the target POU. Click OK.
The HonUaFbHelpers is displayed under Logic POUs.
Configuring an OPC UA Logic
ControlEdge PLC OPC UA Client supports data value read and write through below
logic sequence.
Make sure that the OPC UA Server's time is synchronized to the Client (the
controller's) time.
To configure an OPC UA Logic

1. Establish the connection between OPC UA Client and OPC UA Server;

2. Get the namespace index of OPC UA Server once the connection is suc-
cessfully established;
3. Get the Node handle;

Honeywell 2017 110

OPC UA Configuration

4. Read the value of or write a value to a variable. The following diagram

presents the data access workflow:

Example logic for reading list of variables from OPC UA Server

Two main function blocks with some auxiliary logics are used for this application.

1. HonUaConnectSecurityNone – Used for all read/write applications, to estab-

lish the connection with OPC UA server or disconnect an existing connection.
l ServerEndpointURL and sessionName need to be configured
l Parameter “Disconnect” used to disconnect an existing connection, as
there has a auxiliary function block to monitor the status of the
connection and handle error scenarions(Enable =1): If no connection is
detected (ConnectionHandle=0), this FB 2 will trigger the execution of
FB “Ua…” to reestablish the connection.

Honeywell 2017 111

OPC UA Configuration

Attention:
Only in two scenarios the value of “ConnectionHandle” will be
0, after power on or disconnect the connection manually, so if
user want to disconnect the connection, normally procedure is
disable this HonUaHandleDetector first and then do
disconnect operation.

2. HonUaReadNodeList
l DisableReadList – When set TRUE, disables this read block. Read
service will not be called with each task cycle.

l EnableReadList – When set TRUE, enables this read block. Read

service will be called with each task cycle. Output of
HonUaReadNodeLIst connects to this parameter and the rise edge of
this parameter will trigger the execution of HonUaConnectSecurityNone.
l NodeIdCount – The number of Node IDs in NodeIdWriteList. Define how
many variable are expected to be read from OPC UA Server.
l NodeIdReadList – Node identifiers of the nodes whose values are to be
read by this block (max 20 identifiers).Structure type, consists of three
elements
IdentifierType – Array, to define the identifier type of the variables
expected to be read from Server, we can get detail information of the
variable in Server side, normally it is string type (Initial value =1);
Identifier – Array, The variable name

Namespace – Array, define namespace for each variable, we can get

detail information of the variable in Server side or we can use
“GetNameSpace”.

Honeywell 2017 112

Notices

Notices
Trademarks
Experion® is a registered trademark of Honeywell International, Inc.
ControlEdge™ is a trademark of Honeywell International, Inc.

Other trademarks
Microsoft and SQL Server are either registered trademarks or trademarks of
Microsoft Corporation in the United States and/or other countries.
Trademarks that appear in this document are used only to the benefit of the
trademark owner, with no intention of trademark infringement.

Third-party licenses
This product may contain or be derived from materials, including software, of third
parties. The third party materials may be subject to licenses, notices, restrictions
and obligations imposed by the licensor. The licenses, notices, restrictions and
obligations, if any, may be found in the materials accompanying the product, in the
documents or files accompanying such third party materials, in a file named third_
party_licenses on the media containing the product, or at
http://www.honeywell.com/ps/thirdpartylicenses.

Documentation feedback
You can find the most up-to-date documents on the Honeywell Process Solutions
support website at:
http://www.honeywellprocess.com/support
If you have comments about Honeywell Process Solutions documentation, send
your feedback to:
[email protected]
Use this email address to provide feedback, or to report errors and omissions in the
documentation. For immediate help with a technical problem, contact your local
Honeywell Technical Assistance Center (TAC).

How to report a security vulnerability

For the purpose of submission, a security vulnerability is defined as a software
defect or weakness that can be exploited to reduce the operational or security
capabilities of the software.

Honeywell 2017 113

Notices

Honeywell investigates all reports of security vulnerabilities affecting Honeywell

products and services.
To report a potential security vulnerability against any Honeywell product, please
follow the instructions at:
https://honeywell.com/pages/vulnerabilityreporting.aspx
Submit the requested information to Honeywell using one of the following methods:
n Send an email to [email protected].
or
n Contact your local Honeywell Technical Assistance Center (TAC) listed in the
“Support” section of this document.

Support
For support, contact your local Honeywell Process Solutions Customer Contact
Center (CCC). To find your local CCC visit the website,
https://www.honeywellprocess.com/en-US/contact-us/customer-support-
contacts/Pages/default.aspx.

Training classes
Honeywell holds technical training classes that are taught by process control
systems experts. For more information about these classes, contact your Honeywell
representative, or see http://www.automationcollege.com.

Honeywell 2017 114