Map an HMI address to a generic Ethernet module tag

The address is a word, not a tag name

A controller project stores data as named variables. A driver set up for an EtherNet/IP assembly exchange counts words in the block the connection carries; it has no way to reach those variables by name. Type a controller variable name into a word-based address field and the field holds text that points at nothing in the exchange. The exchange only ever carries the words you sized it for.

That is why the recipe starts in the controller project. The generic module creates the block, and the controller software creates one tag set for it under the module name you typed: Name:O.Data[n] for words your logic writes and the panel reads, Name:I.Data[n] for words the panel writes and your logic reads. Those generated tags are the only data the panel can address.

Some panel drivers for this controller family address variables by name instead, with no exchange at all. If the driver you selected documents that for your controller, use it and skip word mapping entirely. The same idea, publishing controller variables to a panel by name, is what publishing PLC variables to an HMI through a symbol configuration covers. Pick one method and stay with it; a project that mixes a name here and a word number there is the one that takes a day to debug.

What you need

• The controller project open in its programming software, and a maintenance window for the download. Adding a module to the I/O configuration takes a download, so make the change with the machine stopped.
• The panel programming software with the driver for assembly-style EtherNet/IP exchanges selected.
• The panel's IP address on the same subnet as the controller: 192.168.1.10 for the controller and 192.168.1.50 for the panel under a 255.255.255.0 mask is the usual small-system pattern.
• A written point list: every bit and value the panel shows, and every one it sends.
• One spare, non-critical test bit per direction for the checkout.

Create the exchange in the controller project

1. In the I/O configuration, select the controller's Ethernet port entry and add a new module under it.
2. Pick the module type for devices that have no profile of their own: the generic Ethernet module.
3. Enter the panel's IP address and give the module a short name. The name becomes the tag prefix; this article uses Panel01.
4. Keep the assembly instances at the classic recipe values: Input Instance 1, Output Instance 2, Configuration Instance 4. These three numbers tell the connection which data blocks to exchange, and panel drivers made for this recipe expect them.
5. Set the word sizes from the point list: how many words your logic sends on the output side, how many the panel sends back on the input side. Each direction caps at 250 words, which is 500 bytes at two bytes per word.
6. Leave the connection timing at the values the dialog proposes unless the panel's documentation specifies its own.
7. Accept the dialog and download with the machine stopped. The software now lists the module's generated tags under Panel01: Panel01:O.Data[0] upward for the output side, Panel01:I.Data[0] upward for the input side, each array as long as the size you entered.

Address the panel with type, word and bit

Open the tag or address dialog in the panel software and build the address from three parts:

• Data type. The letter keeps its meaning on both ends in this recipe. Type O on the panel reads the words your logic writes into the generated O.Data array; type I on the panel writes the words your logic reads from I.Data.
• Word number. Panel word numbers start at 1 and the generated array starts at index 0, so panel word = array index + 1. Panel01:O.Data[0] is type O, word 1; Panel01:O.Data[3] is word 4.
• Bit. The bit number is the same on both ends, 0 through 15 within a 16-bit word.

Type nothing but that triple. The field holds a word position in the exchange, so a controller variable name typed there means nothing to the driver. The rule holds on the panel's side of the fence too: a name that lives only in panel macro logic is not an address either, because macro variables never appear in the address map that external references point into.

Example: a 6-word exchange for a run lamp and a speed setpoint

Inputs. A filling line's point list calls for three status bits the panel shows (run, fault, batch done), one speed setpoint the operator enters as 0 to 9999, and one strobe bit marking a fresh setpoint. From that list: output side 4 words, input side 2 words, module named Panel01, panel at 192.168.1.50, instances at the classic 1, 2 and 4. The instance numbers and the 250-word cap come from the classic recipe. The word counts here are a typical sizing for this kind of line.

Rule. The controller's output words carry what the panel reads; its input words carry what the panel writes. Panel word numbers are one-based, so panel word = array index + 1, and the bit number passes through unchanged.

Arithmetic.

• Status capacity: 4 words x 16 bits per word = 64 bits on the output side. The three status bits sit in Panel01:O.Data[0], bits 0, 1 and 2. The run lamp maps to type O, word 0 + 1 = 1, bit 0. Batch done, the last of the three, maps to type O, word 1, bit 2.
• Setpoint: the range 0 to 9999 fits one unsigned 16-bit word, whose maximum is 65535. The panel writes it to type I, word 0 + 1 = 1, which is Panel01:I.Data[0].
• Strobe: type I, word 2, bit 0, which is Panel01:I.Data[1], bit 0.
• Byte check: 4 words x 2 bytes = 8 bytes out, 2 words x 2 bytes = 4 bytes in. Both directions sit well inside the cap of 250 words = 500 bytes.

Result. A 4-word out, 2-word back exchange at instances 1, 2 and 4, with three addresses to type on the panel: O word 1 bits 0 through 2 for the status bits, I word 1 for the setpoint, I word 2 bit 0 for the strobe.

Decision. Sixty-four bits of output capacity against 3 used leaves 61 bits free, so one module entry carries this line's status list with room for the next machine. The threshold to act on is 250 words per direction. The moment a point list would pass it, split the data across a second generic module entry, because one implicit connection cannot carry more.

How to check it worked

1. Back up both projects before the download, and keep the copy that matches the validated setup.
2. After the download, look at the module's connection status in the controller. It should show the connection running. If it shows faulted, re-check the panel IP, the three instances and both sizes before changing anything else.
3. Toggle the spare test bit from the controller logic and watch it on the panel. If the design lets the panel write, toggle a second test bit from the panel and watch it in the controller. One bit per direction separates an address mistake from a direction mistake.
4. Check the first and the last word of every range you mapped, and check a multi-word value with a number that moves both words: write 100000 into a 32-bit value and read the two words as 34464 and 1, since 100000 = 1 x 65536 + 34464.
5. A ping confirms the network path; the moving test bit confirms the mapping. Run both.
6. If the panel reports an invalid address on a word you know you sized, walk the checks in fixing HMI invalid address errors when tagging PLC memory.

When the point list outgrows one exchange

Each direction caps at 250 words, so growth past that means a second generic module entry under the same Ethernet port. The software generates a separate tag set for it, the panel project addresses each module as its own target, and the word ranges split to match. If your logic passes the exchanged words into an add-on instruction, give each instance of that instruction its own tag; why each add-on instruction instance needs its own tag explains the trap when you copy logic from the first machine to the second.

Recommendation: add one generic Ethernet module per panel with Input Instance 1, Output Instance 2 and Configuration Instance 4, size each direction from the written point list up to 250 words (500 bytes), and type every panel address as type letter, one-based word and bit against the generated tags. Never type a controller variable name into the word field, and never chase a faulted connection by resizing or renumbering: correct the IP, the sizes or the address triple.

Questions