How to read AI/DI from SNAP-PAC-S2/EB brains to a local server without changing the running strategy? + HMI brand compatibility

MQTT/SparkplugB & OPC UA
, ,
1

How to read AI/DI from SNAP-PAC-S2/EB brains to a local server without changing the running strategy? + HMI brand compatibility

Hi everyone,

I have a SNAP-PAC-S2 running a plant process (cannot be stopped right now). We recently added a site-wide SCADA, so the process is visible. Now I need to log real sensor data to a local server.

Constraints & context:

Controller: SNAP-PAC-S2, firmware R8.5d (no REST API).

I/O is on Ethernet brains in the same LAN:

EB1_1 = SNAP-PAC-EB1 @ 192.168.100.19 (Enabled)

Unidad_Entradas_Salidas = SNAP-PAC-EB2 @ 192.168.100.20 (Enabled)

Analog modules to read: SNAP-AIMA-8 in slots 12, 13, 14 on EB1_1 (8 channels each).

Important: I cannot modify the S2 strategy right now (so I can’t add a Modbus server/slave block inside the strategy).

What I’d like to do
Read analog (float32) and digital values from the server over TCP/IP in real time and store them locally—without touching the existing strategy.

Questions

Can I read the I/O directly from the EB brains (EB1/EB2) using Modbus/TCP or OptoMMP without any strategy changes?

If yes, could you point me to the exact Modbus mapping (Input Register start address per slot/channel for AIMA-8 on EB1_1 slots 12/13/14)?

What Unit/Slave ID is expected (typically 1?), and is the register numbering base-0 or base-1 for standard clients?

What is the correct word/byte order for float32 from AIMA-8 (big-endian word order / any swap)?

If OptoMMP is preferred, could you share the relevant MMP addresses for those AI channels?

Follow-up: Is it feasible to connect a third-party HMI (non-Opto) to the SNAP-PAC-S2/EB to view the process, for example via Modbus/TCP or EtherNet/IP? Any best-practice recommendations or caveats?

Any guidance, examples, or links to the Modbus/TCP guide (Form 1678) or OptoMMP references would be greatly appreciated.

Thanks a lot!

— Brayan Stiven Nilo Ortiz

2

You can read I/O data via Modbus-TCP or OptoMMP, without touching the running PAC Control strategy.

The registers to be read you can find by using the PAC Manager Tool. It has tools to show you the MMP address and convert it to the corresponding Modbus-TCP register.

You can connect a 3rd party HMI, but since the firmware on your PAC is already 13+ years old, I am not sure if that will work seamless. What 3rd party HMI are you thinking of?

You can use PAC Display HMI, but even here I am not sure if the latest version is working with firmware 8.5.

There is also a OptoOPCServer (DA) that can be used. OPC-UA is not available from us for the PAC system.

In all cases, to access the strategy tags you need the tag database file ending with .idb.txt

1 Like
3

Hi @gerhardK,
Thanks a lot for your reply. Your guidance on mapping the modules with PAC Manager and converting MMP→Modbus/TCP worked—I’m now reading I/O without touching the running strategy.

My setup:

Controllers: SNAP-PAC-S2 (fw 8.5) and GRV-EPIC-PR1.

HMIs: Schneider Harmony and Siemens KTP700.

Is it feasible to link them over TCP/IP (Modbus-TCP or OptoMMP) or over serial (Modbus-RTU), given that I have the strategies and the .idb.txt tag database?
If there are caveats due to the older firmware (e.g., address base, big-endian, compatibility), could you share recommended settings and best practices?

Thanks for your time and support.

4

@bnilo You can’t read the Tags from the PAC Control program via Modbus-TCP or RTU in your current setup. For that you would have to modify the running strategy on the controller. Either by moving the relevant tags into the OptoMMP scratchPad area (Modbus-TCP only), or implement the PAC Control Modbus Integraton Kit, which is a bit more work.