MEB3 Manual

MEB3
Installation and Programming Manual

This manual covers the MEB3 Modbus Plus to Ethernet Bridge.

Effective: February 25, 2025

Niobrara Research & Development Corporation

P.O. Box 3418 Joplin, MO 64803 USA

Telephone: +1 (417) 624-8918

www.niobrara.com
Modicon, Square D, SY/MAX, Compact, Quantum, M340, M580, 984, Momentum,
Unity Pro, Control Expert, Premium are trademarks of Schneider-Electric.
Subject to change without notice.

© Niobrara Research & Development Corporation 2025. All Rights Reserved.

 Contents
1 Introduction.................................................................................................9
2 Installation................................................................................................. 11
Device Mounting/Removal...................................................................11
Power Supply........................................................................................12
3 Ethernet..................................................................................................... 13
Setting the IP Address.......................................................................13
Setting the Subnet Mask...................................................................14
Setting the Default Gate...................................................................14
Ethernet Connection.........................................................................15
MEB3+201 Second Ethernet Port....................................................17
Daisy-Chain Operation..................................................................... 17
Copper Ring Operation.....................................................................18
4 Modbus Plus.............................................................................................. 19
Modbus Plus Configuration..................................................................19
Setting the Node Number.................................................................19
Modbus Plus Cable Connection.......................................................20
Modbus Plus Lights.......................................................................... 22
Modbus Plus Modes..............................................................................23
MEBII Mode (Proxy Disabled)........................................................24
PROXY Mode..................................................................................27
5 Serial Ports................................................................................................ 29
RS-232 Ports.....................................................................................29
RS-485 Ports.....................................................................................31
6 Software Installation.................................................................................34
Updating the MEB3 Firmware..............................................................35
Updating Firmware through the Web server....................................35
Updating Firmware using RPCLOAD.............................................36
7 Modbus/TCP Operation.............................................................................37
Server Operation................................................................................... 37
Default Modbus Routing Table........................................................39
Auto-Fix Modbus Table....................................................................40
Front Panel Modbus Route Edit.......................................................40
Client Operation.................................................................................... 41
AutoFill TCP Table...........................................................................45
Front Panel Edit of TCP Table (IP Routes).......................................46

iii
8 Modbus Serial Operation.......................................................................... 49
Slave Operation (External Master).......................................................49
Default Modbus Routing Tables.......................................................51
Auto-Fix Modbus Table....................................................................52
Front Panel Edit Modbus Route.......................................................52
Master Operation (External Slave).......................................................52
9 Legacy SY/MAX Operation......................................................................55
Translations...........................................................................................55
Modbus to SY/MAX Translations....................................................55
SY/MAX to Modbus Translations....................................................56
Error Translations.............................................................................56
SY/MAX Serial.....................................................................................57
NET-TO-NET Mode.........................................................................59
SY/MAX Ethernet.................................................................................63
SY/MAX Routing.............................................................................65
PowerLogic Serial Modes.....................................................................69
10 Hot MB+ Operation................................................................................71
Automatic Redundant Operation..........................................................71
Requirements and Restrictions.........................................................71
“Primary” Unit Configuration Procedure.........................................72
“Secondary” Unit Configuration Procedure.....................................73
Example............................................................................................ 74
Reasons for Automatic Switchover.......................................................75
Hot MB+ Statistics and Information Registers.....................................75
Serial Number...................................................................................77
MB+ Global Data............................................................................. 77
Controlled Switchover......................................................................77
11 Front Panel Operation..............................................................................78
Keypad Buttons.....................................................................................78
LCD Screen...........................................................................................78
Backlight...........................................................................................78
Operating Screens................................................................................. 78
Splash Screen....................................................................................78
Main Menu Screen........................................................................... 80
Configuration Menu.............................................................................. 80
Comms Menu Screen....................................................................... 81
Ethernet Configuration Menu...........................................................81
IP Addr Screen..................................................................................82
Subnet Mask Screen.........................................................................82
Default Gate Screen.........................................................................83
IP Source Screen...............................................................................83
Ethernet Protocol Screen.................................................................. 83
Ethernet Drop Screen......................................................................84
Modbus Route Screen.......................................................................85

Contents iv
 IP Route Screen................................................................................ 86
Ethernet Mode Screen......................................................................87
Serial Port Menu...............................................................................87
Port 1 Menu......................................................................................88
Modbus Plus Drop Screen................................................................89
Display Edit Screen..........................................................................90
Status Menu Screens.............................................................................90
Stats Screen......................................................................................90
Enet Status Screen............................................................................91
MB+ Status Screen...........................................................................91
App Menu.............................................................................................92
Switch Screen...................................................................................92
Info Menu..............................................................................................93
MAC Address Screen.......................................................................93
Serial Number Screen.......................................................................94
Versions Screen................................................................................94
MB+ Drops Screen...........................................................................94
Enet Drops Screen............................................................................95
System Menu.........................................................................................96
Reboot Screen...................................................................................96
Factory Defaults Screen...................................................................96
Password Screen............................................................................... 97
12 Recommended Cables.............................................................................99
RS-232 Cables.......................................................................................99
MM1 (PC to MEB3).........................................................................99
MM2 (Modicon PLC to MEB3).......................................................99
MM3 (MEB3 to emulate a 9-pin PC port).....................................100
RS-485 Cables.....................................................................................101
MU7 (MEB3 to SY/MAX).............................................................101
MEB3 Master to 4-wire RS-485 Slaves.........................................101
MEB3 to 2-wire RS-485.................................................................102
13 Web Server............................................................................................ 105
First Access......................................................................................... 105
Login...................................................................................................106
Home................................................................................................... 112
Configuration......................................................................................112
Ethernet...........................................................................................112
IP Settings....................................................................................... 113
Ethernet Port Parameters................................................................114
Security........................................................................................... 114
Modbus Routing for Ethernet Port.................................................115
TCP Routing Table.........................................................................118
I/O Scanner..................................................................................... 120
Entries Per Socket......................................................................120

Contents v
 Health Block..............................................................................121
I/O Disable Block......................................................................121
Serial Ports..........................................................................................122
Port Parameters...............................................................................122
Serial Port Modbus Routing Table.................................................123
Serial Port Auto Scan......................................................................124
Modbus Plus Port Parameters.........................................................125
Drop...........................................................................................125
On Ethernet................................................................................ 125
Prog. Channel Timeout..............................................................125
Reply Timeout...........................................................................126
Modbus Plus Global Data (MEBII Mode).....................................126
Proxy...................................................................................................127
MEBII Mode..................................................................................127
PLC Proxy Mode............................................................................ 127
Proxy Config..............................................................................128
Proxy Enable.........................................................................128
Proxy Run.............................................................................128
Routing Mode.......................................................................128
Dest IP...................................................................................128
Index.....................................................................................128
Route..................................................................................... 128
PLC Status Timeout (ms)......................................................129
Inputs Timeout (ms)..............................................................129
Comms Loss Action..............................................................129
Status Block.......................................................................... 129
PLC Status Block Addresses.................................................129
Status Freshness TICK..........................................................130
TICK Location......................................................................130
PLC TICK Address...............................................................130
Offset PLC Address..............................................................130
Enable Routing Mode or Enable IP Direct Mode.................131
Global Data................................................................................ 131
Global Data Out....................................................................131
Global Data In.......................................................................132
Specific Out............................................................................... 133
Specific In.................................................................................. 134
Statistics..............................................................................................135
Ethernet Router Stats...................................................................... 136
SY/MAX 802.3 Ethernet Nodes.....................................................138
Serial Port.......................................................................................140
Port 2 Hot Modbus Statistics..........................................................141
Modbus Plus Router.......................................................................142
MB+ Chipset..................................................................................144

Contents vi
 Modbus Plus Nodes........................................................................ 145
Module Info....................................................................................146
Config Overview............................................................................ 147
Register Viewer..............................................................................147
MbTCP Logger...............................................................................149
Admin Menu....................................................................................... 151
Set Passwords.................................................................................151
Global Configuration......................................................................152
Configuration Backup....................................................................153
Configuration Restore....................................................................153
Hot Modbus Plus............................................................................154
Firmware Update............................................................................155
Reset to Factory Defaults...............................................................156
14 Utilities.................................................................................................. 159
MBP_EXTRACT.EXE.......................................................................159
Command Line Options.................................................................159
Command line Example.................................................................160
PLC Segments, Structures, and DFBs Added................................161
Configuration Structures................................................................165
QDIO_CONFIG.EXE.........................................................................166
PROXY_EXTRACT.EXE..................................................................168

Contents vii
 1 Introduction

The Niobrara MEB3 is a stand-alone DIN rail mount Modbus Plus to Ethernet Bridge. It
features a redundant cable Modbus Plus (MB+) port, one (or two) 10/100BaseTX
Ethernet port, and two isolated serial ports. The MEB3 allows simultaneous pass-through
routing data messages from Modbus/TCP Ethernet, MB+, and Modbus serial between all
ports. Full support of PLC programming message pass-through is also provided on all
communication ports including Control Expert (Unity Pro), Concept, ProWORX, and
Modsoft.

Figure 1.1:MEB3 Front Panel

Port 1 Port 2
(RS-485) (RS-485) Port 2
Port 1
(RS-232) (RS-232)

LCD showing
IP Address,
MB+ Node
Keypad

Dual Cable
Modbus Plus

100BaseTX
Ethernet
24VDC
Power
100BaseTX (MEB+201
Ethernet Only)

MEB3 Manual 9
The MEB3 features at least one 100BaseTX Ethernet port that supports Modbus/TCP as
both a client and a server at the same time. The MEB3 can support up to 64 simultaneous
Modbus/TCP connections. A routing table is used to map the incoming Modbus/TCP
Destination Index (Slave Address) from an Ethernet client to a downstream route that
determines where the message is directed. This route may point to a PLC on MB+, a
slave on one of the MEB's serial ports, or even back out the Ethernet port to a different
device. The Ethernet port also supports the older SY/MAX 802.3 protocol for smoothly
integrating legacy Square D Model 650 and 450 PLCs into a Modbus/TCP system.
The MEB3+201 model includes two 100BaseTX Ethernet ports that support Rapid
Spanning Tree Protocol (RSTP) allowing the MEB3 to be used in a copper ring network
for redundant Ethernet cable connections. It may also be used in a daisy-chain Ethernet
network as well.
The Modbus Plus port supports dual-cable redundant MB+ networking but may simply
be used in a single-cable system by leaving one of the ports open. The standard 5-drop
MB+ routing structure is supported allowing full access to MB+ devices on the local
network or through Modicon Bridge Plus and Bridge Mux devices. The MEB3 MB+
port may be used in a “Proxy” mode that allows Modbus Plus messages routed to the
MEB3’s drop number to be sent across a Modbus/TCP socket to a target PLC such as an
M580.
There are two isolated serial ports on the MEB3. Each port may be selected to use its
RJ-45 connector for RS-232 or a removable 5-pin screw connector for RS-485. The
RS-485 port may operate in 4-wire RS-422, 4-wire RS-485, or 2-wire RS-485 modes
with selectable termination and bias. The two serial ports may be independently
configured for one of 18 different protocols including Modbus RTU, Modbus ASCII, and
SY/MAX. The default mode supports Modbus RTU and can dynamically switch between
being a master or a slave.
The MEB3 features a front panel backlit LCD and keypad that may be used for
configuration and troubleshooting. The IP Address, MB+ node address and most serial
port settings may be configured through this interface which may be password protected
to prevent unauthorized changes.
A built-in web server is included in the MEB3. This password protected, AJAX
Javascript enabled server allows two user levels for configuration, backup/restore,
troubleshooting, and even firmware updating – all from a standard web browser.
The MEB3 also includes a “Hot MB+” mode that allows two MEB3 units to work
together to provide an automatic fully redundant primary/standby system for high
availability systems.

MEB3 Manual 1 Introduction 10

 2 Installation
WARNING: Do not connect the MEB3 to any Ethernet or MB+ network before
configuring the appropriate network addresses. Duplicate network address may
lead to improper network communication, equipment damage, injury, or death.

Device Mounting/Removal
(1) Hook the top notch on the upper lip of the DIN rail.
(2) Rotate the MEB3 until the lower latches click tight.
(3) Use a screw driver to unclip the lower latches to remove the MEB3 from the DIN
rail.(See Figure 2.1 DIN Rail Mounting and Removal)

1 Figure 2.1 DIN Rail Mounting and Removal

DIN Rail
DIN Rail (TS-35)
(TS-35)

Click

MEB3 Manual 11
Power Supply
Connect a suitable 24VDC power to the three position removable connector. The
MEB II requires a 5W minimum supply and will operate on 9-30Vdc but 24Vdc is
recommended. (See Figure 2.2 Power Supply Diagram) An external fuse is
recommended. Typical power supply wire colors are:
• Red = 24Vdc (+)
• Black = 24Vdc (-)
• Green = Earth Ground

Figure 2.2 Power Supply Diagram

DIN Rail
(TS-35)

Fuse
Disconnect

24Vdc Power Supply

MEB3 Manual 2 Installation 12

 3 Ethernet
Setting the IP Address
The MEB3 defaults to a fixed IP Address of 10.10.10.10. This is easy to change through
the use of the front panel keypad. The MEB3 supports fixed IP Address, DHCP, or
BOOTP. Press the key four times to step through the “> Main > Config > Comms >
Ethernet >” pages.
If BOOTP or DHCP is desired, arrow to the IP Source menu item, and then press the
key. The and arrows are used to select FIXED, DHCP, or BOOTP. The key is
used to accept the new value and return to the previous menu.
NOTE: BOOTP and DHCP operation usually requires that the server be configured for
the MAC Address of the MEB3. The MEB3's MAC address is printed on the serial
number label and is also shown on IP Source screen. The example below shows a MAC
Address of 00:20:BD:0C:41:AA.

Figure 3.1 IP Address Source Screen

If a fixed address is required, make sure that the IP Source is set to Fixed, then select the
Address page. The and arrows are used to adjust the values while the and
arrows move between fields. The key is used to accept the new value.

Figure 3.2 IP Address Screen

The “Autofill IP Tables?” offers the automatic filling of the TCP client table. Each of the

MEB3 Manual 3 Ethernet 13

200 entries in the TCP table will be set to the first three octets of the MEB3's IP Address
and the last octet will be set to the index number 0-199.
If the www server is disabled then a prompt will appear asking to enable the www server.
If the www server is enabled and the web password has been resent then a temporary
password is displayed. This temporary password is random and must be entered on the
web page and you must include the “-” in the password.

Setting the Subnet Mask

The Subnet Mask edit page is designed to quickly step through the valid bit-mapped
options. Pressing the and arrows adjusts the mask value. The key is used to
accept the new value.

Figure 3.3 Subnet Mask Screen

The “Auto Set Default Gate?” applies the new subnet mask to the current IP Address to
preset the Default Gate.

Setting the Default Gate

The Default Gate edit page functions just like the IP Address edit page. The Defuault
Gate should be pointed to the local IP Router IP Address. There are two preset to
simplify this settting: MaskedIP and Nullify. “MaskedIP” applies the Subnet Mask to
the MEB3’s IP Address. “Nullify” sets the Default Gate to 0.0.0.0 which will prevent the
MEB3 from communicating through routers.

Figure 3.4 Default Gate Screen

MEB3 Manual 3 Ethernet 14

Ethernet Connection
After the IP Address is configured for the MEB3, it is safe to connect the Ethernet port to
the network. The MEB3 includes a standard RJ-45 Ethernet connector with indicators for
Link/Activity (green LED) and 100Mb (amber LED). (See Figure 3.5 Ethernet Port) The
green Link/Activity light illuminates when the MEB3 has a valid link to the attached
network port and blinks off while experiencing network traffic. The 100Mb amber LED
is illuminated when the Ethernet port has negotiated 100Mb operation and off while
configured for 10Mb operation.
The MEB3's Ethernet port supports 10/100BaseTX auto-crossover operation. Standard
CAT5 cables may be used to connect the MEB3 to Ethernet switches and hubs.

Figure 3.5 Ethernet Port

Link/
Activity
LED

Pin 1 100MB
LED

MEB3 Manual 3 Ethernet 15

 Figure 3.6 Typical Ethernet Connection

Quantum
NOE
Ethernet
Switch
PC with
Cat5 Ethernet
Cables

The status of the Ethernet port may be inspected through the front panel LCD by
choosing “> Main > Status > Enet >”
NOTE: MEB3+101 will always show “Enet2 Link Down”.

Figure 3.7 Ethernet Status

MEBII+101 MEBII+201

The Ethernet port 1 defaults to “Auto” mode but may be manually set to a fixed 10BaseT
or 100BasetT with fixed Full or Half Duplex operation. Ethernet port 2 (if present) is
always “Auto”.

MEB3 Manual 3 Ethernet 16

 Figure 3.8 Ethernet Mode Configuration for Enet Port 1

MEB3+201 Second Ethernet Port

The MEB3+201 includes two Ethernet ports. The current firmware of the MEB3+201
supports this second port as daisy-chain or copper ring operation. A future firmware
upgrade will allow the second port to operate independently with a second IP Address.

Daisy-Chain Operation
The MEB3+201 may have its Ethernet ports connected in a Daisy-Chain fashion.
NOTE: Communication to downstream Ethernet devices may be lost if one of the daisy-
chain units fails or loses power.

Figure 3.9 Daisy-Chain Ethernet Connection

MEB3 Manual 3 Ethernet 17

Copper Ring Operation
The MEB3+201 may be used in a copper RSTP ring with an appropriate Ethernet switch
such as the Schneider-Electric ConneXium TCSESM083F23F0. This ring operation
provides redundant cable paths to each MEB3.

Figure 3.10 Copper Ring Operation

MEB3 Manual 18
 4 Modbus Plus
Modbus Plus Configuration
Setting the Node Number
The Modbus Plus (MB+) node of the MEB3 may be assigned an address between 1 and
64 with a default value of 1. This address must be unique within the local MB+ network
segment. To edit the MB+ drop number choose:
“> Main > Config > Comms > Modbus+ >“
The and arrows are used to adjust the new MB+ drop. The key is used to accept
the new value.
NOTE: If the MEB3 is physically connected to the local MB+ network, it will
automatically skip MB+ drop numbers that are already in use. The drop numbers of the
Ethernet and serial ports will also be skipped if they fall within the valid MB+ range.

Figure 4.1: Edit Modbus Plus Drop (Proxy Disabled)

After selecting the new MB+ drop number, the screen will change to ask if the user
would like to AutoFix the Routing Tables. Choosing Yes will result in the Modbus
Routing Tables for the Ethernet and serial ports 1and 2 being updated to include the new
drop number of the MB+ port. If No is selected, these tables will not be updated and
many of the routes will not longer work properly – they must then be edited manually.
Next “MBP Proxy” will be prompted. “Disabled” means that the unit will be in MEBII
mode. “Enabled” puts the unit into Proxy mode and then prompts for the IP Address of
the target PLC.

Figure 4.2: Edit Modbus Plus Drop (Proxy Enabled)

MEB3 Manual 4 Modbus Plus 19
Modbus Plus Cable Connection
NOTE: See the Modicon Modbus Plus Network Planning and Installation Guide
890 USE 100 00 for complete instructions on proper MB+ cable installation
methods and considerations.
Modbus Plus has very specific rules about minimum and maximum cable lengths,
number of nodes per segment, the use of repeaters, and cable termination. It is
extremely important to follow the rules spelled out in the above mentioned guide
for proper network operation.

Figure 4.3 Modbus Plus Pinout

Shield
Pin 1

Data A Data B
Pin 2 Pin 3

The MEB3 includes two MB+ DB9 connectors labeled “A” and “B”. (See Figure 4.3
Modbus Plus Pinout) These ports may be used in a “dual-cable” Modbus Plus network.
This does not mean that the MEB3 has two MB+ nodes, it behaves as a single MB+ node
with two physical network connectors. The dual-cable system uses redundant wiring
between nodes for added network integrity. (See Figure 4.4 Typical Dual-Cable MB+
Connection)

MEB3 Manual 4 Modbus Plus 20

 Figure 4.4 Typical Dual-Cable MB+ Connection

Cable B

Terminator on
End node Terminator on
End node
Cable A

Terminator on
End node

Terminator on
End node

MEB3 Manual 4 Modbus Plus 21

The MEB3 may be used in a “single-cable” network by simply connecting the MB+
network to port “A”. (See Figure 4.5 Typical Single-Cable MB+ Connection)

Figure 4.5 Typical Single-Cable MB+ Connection

Port B
Not Used

Terminator on
End node
Single-Cable

Terminator on
End node

Modbus Plus Lights

The MEB3 includes one green LED and two red error LEDs to provide visual status of
the MB+ network operation.
If the red error A or error B lights blink momentarily, it indicates that a message error was
detected on the corresponding network port. A steady ON error light indicates that a hard
fault exists. The fault may either be in the cable or on a node connected to that cable. If
communication on one cable is lost, the other should continue normally.
The green Active light flashes in patterns to indicate the operating state of the MB+ node.

MEB3 Manual 4 Modbus Plus 22

(See Table 4.1: MB+ Green Active Flashes)

Table 4.1: MB+ Green Active Flashes

Green Active Flashes Meaning
Six steady flashes per second Normal Operating State
One flash per second Offline, monitoring network traffic
Two flashes, then OFF for two seconds Hears traffic but never receives the Token
Three flashes, then OFF for 1.7 seconds Sole Station, no other nodes detected
Four flashes, then OFF for 1.4 seconds Offline, Duplicate Node Address Detected

Modbus Plus Modes

The Modbus Plus port on the MEB3 may operate in one of two different modes: MEBII
and PROXY.
Key features of MEBII mode are:
• MEBII Mode routes messages from MB+ based on the “slave channel” number
that follows the MEB3’s drop number in the MB+ route. The slave channel
number must be within the range of 1-8.
• Incoming MB+ routes must not end with the MEB3’s node number as this is an
illegal route and an exception response will be returned.
• MEBII Mode supports Modbus Plus Global Data to the MEB3’s 2048 mailbox
registers only. Peer Cop Specific Data is not supported.
Key features of Proxy Mode are:
• Proxy Mode routes messages from MB+ that have a route that terminates with the
MB+ node number of the MEB3 are tunneled across Modbus/TCP Ethernet to a
target PLC (usually an M580 or M340). This allows a new PLC to replace an
older one without needing to change MB+ routing.
• Proxy tunnel messages to the target PLC may have register and coil offsets
applied to Modbus read and write messages. This can be very useful for changing
the 1-based PLC (Quantum, 984) to the 0-based PAC (M580, M340).
• Proxy tunnel messages to the target PLC may have register space conversions
applied to change Analog Input Reads (FC04) to Holding Register Reads (FC03)
or Discrete Input Reads (FC02) to Coil Reads (FC01). This may be useful for
M340 applications that do not support 3x or 1x address spaces.
• Modbus Plus messages arriving at the MEB3 are routed based on the drop number
of the MEB3 port matching the next drop in the route. Unlike the MEBII,

MEB3 Manual 4 Modbus Plus 23

 messages are no longer limited to a single incoming message per slave channel.
• Proxy Mode allows Peer Cop operation where Specific Data Inputs and Outputs
are automatically transferred from the Proxy Target PLC to/from targets on
Modbus Plus. Specific Outputs are only published on Modbus Plus when the
Proxy Target PLC is in RUN.
• Proxy Mode allows Peer Cop operation where Global Data Inputs and Outputs are
automatically transferred from the Proxy Target PLC to/from targets on Modbus
Plus. Global Data Outputs are only published on Modbus Plus when the Proxy
Target PLC is in RUN.
• Proxy Mode allows the MEB3’s Modbus/TCP I/O Scanner to automatically move
data between external Modbus/TCP devices to the Proxy Target PLC. I/O
Scanner Outputs are only pushed to the remote Ethernet Devices when the Proxy
Target PLC is in RUN.

MEBII Mode (Proxy Disabled)

The factory default mode for the MB+ port is “MEBII”. Messages routed from Modbus
Plus into the MEB3 are routed based on the drop number of the incoming route using the
following table:

Table 4.2: MB+ Route Presets

Drop following MB+ Node Target
1 Serial Port 1
2 Serial Port 2
3 Internal Registers
4, 5, 6, 7, 8 Ethernet

MEB3 Manual 4 Modbus Plus 24

A message to be sent over Modbus Plus to the MEB3 must have a drop number 1 through
8 following the MEB’s drop number. These drop numbers are the Modbus Plus Slave
Channels as used by the old Schneider Electric Modbus Plus Chipset used by the MEBII.
Any other incoming route will result in an exception response.

Figure 4.6 MEBII Mode Routing Example

MB 3 MB 2 MB 1

1234 1234 1234

56 56 56 Drop 102
7890 7890 7890

MB+ 5

MB+ 45

192.168.0.20

192.168.0.25 192.168.0.26

Table 4.3: MEBII Routing Example TCP Table

TCP Table Entry Target IP
25 192.168.0.25
26 192.168.0.26

MEB3 Manual 4 Modbus Plus 25

This example has the normal Auto-Fill TCP Table Entries for drops 25 and 26 that point
to the IP Addresses of the M340 at 192.168.0.25 and the Quantum at 192.168.0.26.

Modbus Plus messages from the Compact 984 will use the routes shown in the following
table to reach each target.

Table 4.4: MEBII Routing Example

MB+ Route from Compact Target
PLC
45.2.1 Meter 1
45.2.2 Meter 2
45.2.3 Meter 3
45.4.25 M340
45.5.26 Quantum

MEB3 Manual 4 Modbus Plus 26

PROXY Mode
Proxy mode allows the full Modbus Plus route to be sent through the MEB3.

Figure 4.7 Proxy Mode Routing Example

MB 3 MB 2 MB 1

1234 1234 1234

56 56 56 Drop 102
7890 7890 7890

MB+ 5

MB+ 45

Drop 90
192.168.0.20

192.168.0.25 192.168.0.26

Table 4.5: Proxy Routing Example

MEB3 Manual 4 Modbus Plus 27

 MB+ Route from Compact Target
PLC
45.102.1 Meter 1
45.102.2 Meter 2
45.102.3 Meter 3
45.90.25 M340
45.90.26 Quantum

MEB3 Manual 4 Modbus Plus 28

 5 Serial Ports
The MEB3 includes two isolated serial ports. Separate connectors are provided for each
port with an RJ-45 connector for RS-232 and a removable 5-position screw terminal
connector for RS-485/422.
NOTE: Port 1 is electrically isolated from Port 2. The RS-232 connector of a given port
is not isolated from the RS-485 connector of the same port.

RS-232 Ports

Figure 5.2 RS-232 Port 1 Figure 5.1 RS-232 Port 2

RX Pin 1 TX
LED LED

RX
LED

TX Pin 1
LED

The RJ-45 connectors are used for RS-232 operation. The pin configuration is shown in
Table 5.1: RJ45 RS-232 Pinout. The Niobrara MM1 cable is used to connect one of these
ports to the a standard 9-pin serial port on a PC. (See Figure 12.1.: MM1 Serial Cable)

MEB3 Manual 5 Serial Ports 29

Table 5.1: RJ45 RS-232 Pinout
Pin Function
1 No Connection
2 DSR (pulled high)
3 Data TX
4 Data RX
5 Signal GND
6 RTS
7 CTS
8 Chassis GND

MEB3 Manual 5 Serial Ports 30

 Figure 5.3 Typical RS-232 Connections

MM1 MM2
Cable Cable

Compact 984
with 9-pin
RS-232
PC with
9-pin
RS-232

RS-485 Ports
Port 1 and 2 may be used for RS-485 (4-wire or 2-wire) and RS-422 operation. A 5-pin
removable screw terminal connector is provided. The pinout is shown in Figure 5.4
RS-485 Port.

Table 5.2: 5-position RS-485 pinout

Pin Function
Shield No internal connection
RX- (-) data into MEB3
RX+ (+) data into MEB3
TX- (-) data out from MEB3
TX+ (+) data out from MEB3

MEB3 Manual 5 Serial Ports 31

 Figure 5.4 RS-485 Port

Shield RX- RX+ TX- TX+

Figure 5.5 Jumper for 2-wire RS-485

TX- RX+ RX- Shield

TX+

(+)
(-) Shield

For 2-wire RS-485 operation, jumper the TX+ to RX+ to make the (+) connection, then
jumper the TX- to RX- to make the (-) connection.

MEB3 Manual 5 Serial Ports 32

 Figure 5.6 Normal 4-wire RS-485 Wiring

TX- RX+ RX-

TX+ Shield

MEB3 Manual 5 Serial Ports 33

 6 Software Installation

The MEB_SETUP.EXE file includes this user manual, MEBSW32.EXE configuration

software, the MEB3 firmware files, the RPCLOAD.EXE firmware loader utility, the
NRDTOOL.EXE register viewer utility, The latest version of this file is located at
www.niobrara.com. Follow the link for “Download Area”, select “Module Software” and
then “MEB_SETUP.EXE”.

MEB3 Manual 6 Software Installation 34

Updating the MEB3 Firmware
On occasion it may be necessary to update the operating system of the MEB3.

NOTE: Updating firmware in a Hot MB+ must be done through the Web server.
The Primary unit must be updated first. An automatic switchover will occur as the
firmware is updated. After the completion of the update, proceed to update the
new Primary.

Updating Firmware through the Web server

This action may be quickly done through the built-in web server.
1. Log into the MEB3's web server as user:ADMIN.
2. Click on the “Admin” link in the left green menu column.
3. Click on the “Update Firmware” link in the left green menu column.
4. Click on the “Browse” button and select the “C:\Niobrara\Firmware\MEB3.qrc”
file.
5. Press the “Start Download” button to begin the update.

MEB3 Manual 6 Software Installation 35

Updating Firmware using RPCLOAD
The RPCLOAD program may be used to install the MEB3 firmware through the Ethernet
connection using Modbus/TCP.
If the MEB3 already supports the built-in web server, use the firmware update feature of
the web server instead of RPCLOAD. The update process is much faster using the web
server.
1. Make sure the MEB3 is powered and running.
2. Start RPCLOAD.EXE. The Windows Start Menu link is “Start, Programs,
Niobrara, MEB, RPCLOAD MEB3 Firmware”.
3. Click on the Browse button and select MEB3.qrc.
4. Select the Modbus TCP tab.
5. Enter the IP Address of the target MEB3 (i.e. 192.168.0.205)
6. Make sure that the TCP port is set to 502.
7. Make sure that the Modbus Drop is set to 255.
8. Press the “Start Download” button. RPCLOAD will open a progress bar to show
the status of the download.

Figure 6.1: RPCLOAD Screen

MEB3 Manual 6 Software Installation 36

 7 Modbus/TCP Operation

The MEB3 can operate as both a Modbus/TCP Server (slave to external masters) and
Client (master to external slaves) at the same time. Up to 64 simultaneous TCP/IP
connections may be made to the MEB3. These connections are dynamically split
between client and server operation.

Server Operation
The MEB3 listens for Modbus/TCP connections on the standard Modbus/TCP port
number of 502. Modbus/TCP commands or queries generated by a client are processed
by the MEB3 by examining the Destination Index (Modbus Slave Address) of the
message.
A look-up table is used to map the Destination Index to a route that tells the MEB3 where
to send the message. This table consists of a column for the Destination Index, a
translation description, and a downstream route. Some of the translation descriptions
allow for remapping of target address space data such as remapping 3x input queries to
4x outputs (with optional offsets).
The example in Figure 7.1 shows a PC connected via Ethernet to an MEB3.
The MEB3's MB+ port is set to drop 45. A Compact 984 PLC is connected to the MB+
network and has a drop of 5. A Bridge Plus is also on the MB+ network and is used to
connect to a Quantum PLC on a second MB+ network at drop 15.
A network of power meters is connected to port 2 (drop 102) of the MEB3. The three
power meters are addressed as Modbus slaves 1, 2, and 3.
Table 7.1 gives a Modbus Routing table for this example. The PC would use index 1 to
communicate with the Compact PLC. Index 2 would access the Quantum PLC. Index 3
will reach power meter #1.
NOTE: Index 0 has a route of NONE. The MEB3 will internally process incoming
Modbus/TCP messages with no route, the special index 255, or any route that doesn't
leave the MEB3. This action may result in unexpected reply data since this data is from
the MEB itself.

MEB3 Manual 37
 Figure 7.1 Ethernet Modbus Routing Example

MB 3 MB 2 MB 1

1234 1234 1234

56 56 56 Drop 102
7890
7890 7890
MB+ 6
MB+ 5

Bridge Plus

MB+ 45

192.168.15.205

MB+ 15

Table 7.1: Ethernet Modbus Routing Table Example

Index Type Route Comments
0 OTHER NONE MEB3 Itself
1 MODBUS 45,5 Compact 984 PLC
2 MODBUS 45,6,15 Quantum PLC on far side of Bridge Plus
3 MODBUS 102,1 Power Meter 1
4 MODBUS 102,2 Power Meter 2
5 MODBUS 102,3 Power Meter 3

MEB3 Manual 7 Modbus/TCP Operation 38

Default Modbus Routing Table
The default Modbus Routing table for the Ethernet port maps Modbus/TCP destination
index values 1-64 to the MB+ node on the MEB3's MB+ network. Table entries 1
through 64 are set to have the first drop be the MB+ port number and the second drop be
the same as the index for drops 1 through 64. Entries 65 through 96 use Port 1's drop
number, 1 through 32. Entries 97 through 128 use Port 2's drop number, 1 though 32.

Table 7.2: Default Ethernet Modbus Routing Table for MB+ Drop 1, Port 1 drop 101,
and Port 2 drop 102
Index Type Route
0 OTHER NONE
1 MODBUS 1,1
2 MODBUS 1,2
3 MODBUS 1,3
... MODBUS ...
63 MODBUS 1,63
64 MODBUS 1,64
65 MODBUS 101,1
66 MODBUS 101,2
67 MODBUS 101,3
68 MODBUS 101,4
... MODBUS ...
95 MODBUS 101,31
96 MODBUS 101,32
97 MODBUS 102,1
98 MODBUS 102,2
99 MODBUS 102,3
100 MODBUS 102,4
... MODBUS ...
127 MODBUS 102,31
128 MODBUS 102,32
129 OTHER NONE

MEB3 Manual 7 Modbus/TCP Operation 39

Auto-Fix Modbus Table
The MEB3 offers to “Auto-Fix” the Modbus Routing tables after the MB+ drop number
is altered. The Ethernet and both serial port Modbus Routing tables are examined and
entries where the first drop of the route matches the old MB+ drop number are changed to
match the new drop number.

Figure 7.2: Edit Modbus Plus Drop

Table 7.3: Ethernet Modbus Routing Table for MB+ Drop 25 after Auto-Fix
Index Type Route
0 OTHER NONE
1 MODBUS 25,1
2 MODBUS 25,2
3 MODBUS 25,3
... MODBUS ...
63 MODBUS 25,63
64 MODBUS 25,64

Front Panel Modbus Route Edit

The Ethernet Modbus Routing tables may be viewed and modified from the front panel.
The “Index” field may be changed with the UP and DOWN arrows. Pressing the ENTER
button on the Index field will exit this screen.

MEB3 Manual 7 Modbus/TCP Operation 40

 Figure 7.3: Modbus Route Edit Screen

Pressing ENTER button on the TEST field will cause the MEB3 to generate a Modbus
opcode 03 Holding Register read of the target device. The test will report PASS or FAIL
A “Downstream Timeout” is a failure but an Error 01 (Illegal Opcode) or Error 02 (Illegal
Register) are PASS because the target device responded with the error.

Figure 7.4: Modbus Route Edit TEST Screens

Client Operation
The MEB3 may act as a Modbus/TCP Client even while simultaneous Server operations
are occurring. Modbus Plus or serial master devices may generate read or write messages
that are routed out the MEB3's Ethernet port to access remote Servers.
The MEB3 uses a look-up table to map routing drop numbers to TCP/IP addresses. This
table is called the TCP Routing Table. This table consists of a drop number, target IP
Address, and an optional Downstream Route. Messages passing through the MEB3 from
MB+ or the serial ports (or the Ethernet port itself) that are directed out the Ethernet port
are sent to the TCP Routing Table to determine the target device.
Figure 7.5 shows an MEB3 connected to a Compact 984 PLC via Modbus Plus. The
Ethernet port is set to be drop 90 and is connected to a Quantum PLC at IP Address
192.168.15.24 and an M340 PLC at 192.168.15.25 and an M580 at 192.168.15.20. The
M580 is configured in the MEB3 as the Proxy Target.

MEB3 Manual 7 Modbus/TCP Operation 41

 Figure 7.5 Modbus/TCP Client Routing Example

MB+ 21

MB+ 15 M580
Proxy Target
192.168.15.241 Drop 90 192.168.15.20

Quantum
Server
192.168.15.24

M340
Server
192.168.15.25

MEB3 Manual 7 Modbus/TCP Operation 42

MEB3 Manual 7 Modbus/TCP Operation 43
The table below shows routes for MSTRs for the Compact PLC in this example.
• The first drop (21) in the route is the MB+ number of the MEB3.
• The second drop (4, 5, 6, 7, and 8) is the drop number that tells the MEB3 to route
the message out of the Ethernet port. See Chapter ??? for more information on
MB+ inbound routing.
• The third drop (1, 2, and 3) is the TCP table look-up drop. This number defines
the target IP Address.
• The fourth drop (0, 1, 2, 3, 4, 5, and 255) is the destination index for the
Modbus/TCP message sent to the target IP device. The local M340 and Quantum
NOEs don't care about the value of this number. This number is used in the
Modbus Routing table in the remote MEB3 to determine the target for the MSTR
message.

Table 7.4: MSTR Routes for Compact PLC in Figure 7.5

MSTR MB+ Route Target
21.0.0.0.0 M580
21.90.24.0.0 Quantum at 192.168.0.24
21.90.25.0.0 M340 at 192.168.0.25
21.90.3.1.0 Compact in Figure 7.1
21.90.3.2.0 Quantum in Figure 7.1
21.90.3.3.0 Power Meter 1 in Figure 7.1
21.90.3.4.0 Power Meter 2 in Figure 7.1
21.90.3.5.0 Power Meter 3 in Figure 7.1
21.90.3.0.0 MEB3 in Figure 7.1

There are a few subtle issues of note in this example:

• The MEB chooses to open new client sockets based on the entry in the TCP table.
When a message arrives at the Ethernet port, the drop following the Ethernet port
is examined to determine the target IP Address. If there is already a client socket
opened to this target then the new message then this new message will be sent on
this socket. Client sockets are multi-threaded by the MEB3. In other words,
multiple outstanding message are allowed on a client socket at the same time.
• There are 200 entries in the TCP table. This feature may be exploited to cause the
MEB to open multiple client connections to a given target by simply adding the
same IP Address to multiple table entries. Use caution with this method as there
are only 64 total sockets available.

MEB3 Manual 7 Modbus/TCP Operation 44

 • There were only 8 data slave channels on the Schneider Electric MB+ chipset
used in the older MEBII. This is not the case with the MEB3. The Niobrara
chipset allows up to 32 slave messages to be processed through the MB+ port at
the same time.
• Other PLCs on the same MB+ network could use exactly the same routes as this
PLC. With the old SE chipset in the MEBII, when multiple MB+ messages
attempt to use the same data channel at the same time, the MB+ network takes
care of this situation automatically, all of the messages get though, it just slows
down a little as they take turns. This rarely happens with the MEB3 since it is not
limited to eight individual slave paths.

NOTE: When the MEB3's Ethernet port is in Modbus+SYMAX mode, the TCP table is
how the unit decides to connect a client message via Modbus/TCP or SY/MAX 802.3. If
the IP Address for a given drop number is 0.0.0.0 then the message is sent out as
SY/MAX 802.3 to that drop number. See Chapter ???.

AutoFill TCP Table

Changing the IP Address from the front panel keypad will prompt the user to
automatically adjust the TCP Routing Table. This feature will automatically fill in the
first three bytes of the local IP Address and have the fourth byte match the drop number.

Table 7.5: Default Ethernet TCP Routing Table

Drop IP Address Route
0 0.0.0.0 NONE
1 0.0.0.0 NONE
2 0.0.0.0 NONE
3 0.0.0.0 NONE
Table 7.6: Ethernet TCP Routing Table for 206.223.51.155 after AutoFill
Drop IP Address Route
0 206.223.51.0 NONE
1 206.223.51.1 NONE
2 206.223.51.2 NONE
3 206.223.51.3 NONE

MEB3 Manual 7 Modbus/TCP Operation 45

Front Panel Edit of TCP Table (IP Routes)

MEB3 Manual 7 Modbus/TCP Operation 46

Figure 7.6: IP Route Edit Screen
The IP Routes may be edited from the front panel. The UP and DOWN buttons on the
INDEX field scroll through the 200 entries. Pressing the ENTER button while on the
INDEX field exits the screen.
Pressing the ENTER button while on the ZERO field will zero the IP Address. This is
useful in SY/MAX Ethernet applications.
Pressing the ENTER button while on the AUTO field will auto load the AutoFill value
for this Index.

MEB3 Manual 7 Modbus/TCP Operation 47

 8 Modbus Serial Operation

The MEB3 serial ports can operate as both a Modbus Master and Slave using either
Modbus RTU and Modbus ASCII protocols. The protocol modes are labeled “Modbus
RTU” and “Modbus ASCII”. All Modbus serial modes can dynamically switch between
functioning as a Master or a Slave.
NOTE: The mode “MODBUS HOST” is a version of the RTU mode with special
message translation features.

Slave Operation (External Master)

A Modbus mode port on the MEB3 listens for Modbus serial messages whenever it is
idle. When a message arrives and has a good checksum, the Modbus Slave Address in
the message is examined and compared to entries in the Modbus Routing Table for that
serial port. If the entry for that drop number is not empty, then the MEB3 will forward
that message according to this defined route. If the entry is empty (NONE), then the
message is ignored.
A look-up table is used to map the Destination Index to a route that tells the MEB3 where
to send the message. This table consists of a column for the Destination Index, a
translation description and a downstream route.
The example in Figure 8.1 shows a PC connected via RS-232 to an MEB3 Port 1.
The MEB3's MB+ port is set to drop 45. A Compact 984 PLC is connected to the MB+
network and has a drop of 5. A Bridge Plus is also on the MB+ network and is used to
connect to a Quantum PLC on a second MB+ network at drop 15.
A network of power meters is connected to port 2 (drop 102) of the MEB3. The three
power meters are addressed as Modbus slaves 1, 2, and 3.
Table 8.1 gives a Modbus Routing table for this example. The PC would use index 1 to
communicate with the Compact PLC. Index 2 would access the Quantum PLC. Index 3
will reach power meter #1.
NOTE: The MEB3 will internally process incoming Modbus RTU messages with the
special index 255, or any route that doesn't leave the MEB3. This action may result in
unexpected reply data since this data is from the MEB3 itself.

MEB3 Manual 49
 Figure 8.1 Serial Master Modbus Routing Example

MB 3 MB 2 MB 1

AMPS A 123 AMPS A 123 AMPS A 123

B 125 C 122 B 125 C 122 B 125 C 122
Mode Select Mode Select
Mode Select

D PowerLogic D PowerLogic
D PowerLogic MB+ 6
Power Meter Power Meter
Power Meter

Drop 102
MB+ 5

Bridge Plus

MB+ 45

Drop 90
192.168.15.205

Modbus
Master
MB+ 15

Table 8.1: Serial Modbus Routing Table Example

Index Type Route Comments
1 MODBUS 45,5 Compact 984 PLC
2 MODBUS 45,6,15 Quantum PLC on far side of Bridge Plus
3 MODBUS 102,1 Power Meter 1
4 MODBUS 102,2 Power Meter 2
5 MODBUS 102,3 Power Meter 3

MEB3 Manual 8 Modbus Serial Operation 50

Default Modbus Routing Tables
The default Modbus Routing table for each serial port maps Modbus Slave Address
(Index) values 1-64 to the MB+ node on the MEB3's MB+ network. Table entries 1
through 64 are set to have the first drop be the MB+ port number and the second drop be
the same as the index for drops 1 through 64. Entries 65 through 96 use Port 1's drop
number, 1 through 32 (port 2 only). Entries 97 through 128 use Port 2's drop number, 1
though 32 (port 1 only).

Table 8.2: Default Serial Port Modbus Routing Table for MB+ Drop 1, Port 1 drop 101,
and Port 2 drop 102
Index Type Route for Port 1 Route for Port 2
1 MODBUS 1,1 1,1
2 MODBUS 1,2 1,2
3 MODBUS 1,3 1,3
... MODBUS ... ...
63 MODBUS 1,63 1,63
64 MODBUS 1,64 1,64
65 MODBUS NONE 101,1
66 MODBUS NONE 101,2
67 MODBUS NONE 101,3
68 MODBUS NONE 101,4
... MODBUS NONE ...
95 MODBUS NONE 101,31
96 MODBUS NONE 101,32
97 MODBUS 102,1 NONE
98 MODBUS 102,2 NONE
99 MODBUS 102,3 NONE
100 MODBUS 102,4 NONE
... MODBUS ... NONE
127 MODBUS 102,31 NONE
128 MODBUS 102,32 NONE

MEB3 Manual 8 Modbus Serial Operation 51

Auto-Fix Modbus Table
The MEB3 offers to “Auto-Fix” the Modbus Routing tables after the serial port drop
number is altered. The Ethernet and both serial port Modbus Routing tables are
examined and entries where the first drop of the route matches the old serial drop number
are changed to match the new drop number.

Front Panel Edit Modbus Route

Figure 8.2: Edit Modbus Serial Route

Pressing ENTER button on the TEST field will cause the MEB3 to generate a Modbus
opcode 03 Holding Register read of the target device. The test will report PASS or FAIL
A “Downstream Timeout” is a failure but an Error 01 (Illegal Opcode) or Error 02 (Illegal
Register) are PASS because the target device responded with the error.

Figure 8.3: Modbus Route Edit TEST Screens

Master Operation (External Slave)

The MEB3 serial ports may be used to connect Modbus slave devices to Ethernet and
MB+ masters. A typical use is to connect a string of Modbus power meters to the MEB3.
Figure 13.9 shows a string of power meters connected to the RS-485 port 2 of the MEB3.

MEB3 Manual 8 Modbus Serial Operation 52

Port 2 is configured for Modbus RTU mode and set to match the baud rate and parity of
the meters. The drop number of port 2 is left at 102 (default). The normal routing to each
each meter is simply the route to reach port 2, followed by the slave address of the meter.

MEB3 Manual 8 Modbus Serial Operation 53

 9 Legacy SY/MAX Operation

The MEB3 serial and Ethernet ports can operate in a variety of modes to support legacy
Square D SY/MAX PLCs and older PowerLOGIC meters.

Translations
The MEB3 translates Modbus messages to SY/MAX (and vice versa) as each message
passes through the device. There are two possible translations that can be set by the
“Mode” setting in the Modbus Routing Table.
• Other (SY/MAX Non-Priority)
• SY/MAX Priority - Some SY/MAX devices (such as a NIM) only support
Priority messages.
NOTE: Some Modbus devices may refer to Holding Register 100 as 4x0100, 4:0100,
40100, or 4000100. The 4 at the beginning simply means it is a Holding Register.
Analog Input registers (3x) are shown as 3x0001, 3:0001, 300001, or 300001. Output
coils (0x) may be shown as 0x0025, 0:0025, 25. Input bits (1x) start with a 1 like
1x1234, 1:1234, 11234, or 101234.
NOTE: Some Modbus devices may start at register 0 instead of register 1. (This is
commonly referred as JBUS.) It may be necessary to offset each register number by 1 to
access the proper data.
NOTE: SY/MAX bit numbers are 1 to 16 with bit 1 as the least significant bit. This
manual will note bit references as Sxxxx-yy where xxx is the SY/MAX register number
and yy is the bit number. For example, register 20, bit 14 will be shown as S20-14.

Modbus to SY/MAX Translations

• Holding Registers (4x) – Holding Registers (read/write) are directly mapped 1-
to-1 to SY/MAX registers. A Modbus client wanting the data from SY/MAX
register 1503 would send a Holding Regsister Read (FC03) to remote register
1503. Modbus single (FC06) and multiple register writes (FC16) are supported
with the target register chosen simply as the SY/MAX register number.
• Analog Input Registers (3x) – Modbus clients may access SY/MAX registers as

MEB3 Manual 55
 though they are Modbus 3x data (read only). The mapping is just like 4x registers
and is simply the target SY/MAX address.
• Coils (0x) - Modbus coils (read/write) may be mapped into SY/MAX registers.
The translation starts as SY/MAX register 1, bit 1 (S1-1) = Modbus coil 0x1. S1-
16 = 0x16. S2-1 = 0x17. The formula to determine the Modbus coil from a
SY/MAX bit is: COIL = ((REG – 1) * 16) + (BIT).
• Input Bits (1x) – Modbus discrete inputs (read only) are mapped exactly the same
as 0x coils.
Incoming Modbus commands (4x, 3x, 1x, 0x) are translated into Non-Priority SY/MAX
Read or Write messages. Coil write messages (FC05 and FC15) are translated as bit-
masked NP writes when possible to allow single SY/MAX bits to be modified.
NOTE: FC15 multiple coil write message may not be able to be processed when the bits
span multiple SY/MAX registers. The SY/MAX bit-masked NP Write message cannot
handle this type of masking operation. The MEB3 will send back a Modbus Exception
code 5 error when this condition occurs.
NOTE: A few SY/MAX end devices (NIMs for example) do not support Non-Priority
messages. In this case, select Priority

SY/MAX to Modbus Translations

SY/MAX Priority and Non-Priority Read and Write command messages are translated
into Holding Register Read (FC03) and Write (FC16) messages. SY/MAX Random
Access Read messages are translated into PowerLOGIC's Modbus Random Access Read
(FC100).
If the SY/MAX client needs to access other memory spaces on a Modbus serial server,
the Modbus Host serial mode may be used. This mode allows the user to manually
configure the translation for both the read and the write. Supported Modbus Function
Codes are 03 (4x read), 04 (3x read), 02 (1x read), 01 (0x read), 05 (0x single write), 06
(4x single write), 15 (0x multiple write), and 16 (4x multiple write).
NOTE: Standard Priority and non-bit-maksed Non-Priority SY/MAX write messages will
translate into 16 FC05 coil messages or one 16-bit FC15 message. All 16 bits will be
forced.
NOTE: SY/MAX Read and Write messages support up to 128 registers. Modbus
messages are limited to a maximum of 125 registers on a read and 120 registers on a
write. Individual servers may have additional register count restrictions.

Error Translations
Modbus and SY/MAX do not share the same error messages. Table 9.1 shows the
MEB3's translations.

MEB3 Manual 9 Legacy SY/MAX Operation 56

All other errors are passed straight through with no translation.
Modbus SY/MAX Meaning
Exception Error Code
Code
2 3 Illegal Address
3 5 Illegal Value
10 29 Illegal Route
11 17 Device Not Responding
Table 9.1: Modbus and SY/MAX Error Translations

SY/MAX Serial
MEB3 ports 1 and 2 may be configured to SY/MAX mode to directly connect to a
SY/MAX PLC. The RS-485 port is typically used along with the MU7 (MEB3 to
SY/MAX) cable.
Default values for SY/MAX ports are 9600, EVEN, 8, 1, RS-422, and BCC.
The drop number of the SY/MAX mode port will be the last drop of an incoming route
and the first drop of an output TREAD, TWRITE, or TALARM message from the
SY/MAX PLC.
SY/MAX mode ports are full duplex and allow the PLC to be both a master and a slave at
the same time.
Figure 9.1 SY/MAX Serial Routing Example shows a SY/MAX Model 400 PLC
connected with an MU7 cable to the RS-485 port 1 of an MEB3. This port is set to
SY/MAX at drop 101.
An entry in the Ethernet Modbus Routing table must be modified to access the Model
400 PLC. For this example, Entry 1 was chosen since there wasn't a MB+ node 1 and it
would be easy to remember. The new route is shown in Table 9.2: Modbus Routing Table
for Ethernet Port. The type set to OTHER or Priority since this is not a MODBUS target.
A Modbus/TCP client such as the M340 PLC in this example would simply use
Modbus/TCP index 1 to access the SY/MAX PLC.

MEB3 Manual 9 Legacy SY/MAX Operation 57

Table 9.2: Modbus Routing Table for Ethernet Port
Index Type Route Comments
0 OTHER NONE
1 OTHER 101 Model 400 PLC
2 MODBUS 5,2
3 MODBUS 5,3
4 MODBUS 5,4
5 MODBUS 5,5
6 MODBUS 5,6 Compact 984 PLC
7 MODBUS 5,7

The Compact PLC can read and write the SY/MAX PLC using MB+ MSTR Read and
Write messages. In this example, the MSTR route would be 5.101.0.0.0 since the
message needs to go out MEB3 port 1. The remote register in the MSTR is simply the
SY/MAX target register.
The SY/MAX PLC may also use TREAD and TWRITE messages to access both the
M340 and Compact PLCs.
The route to the Compact would be 101,5,6 while the route to the M340 would be
101,90,25,1 assuming that the Ethernet port on the MEB3 is set to 90 and TCP table entry
25 has the IP Address of the M340.

MEB3 Manual 9 Legacy SY/MAX Operation 58

 Figure 9.1 SY/MAX Serial Routing Example

Drop 101 MB+ 5

MU7 Cable

MB+ 6

192.168.0.241

192.168.0.25

NET-TO-NET Mode
The MEB3 may be connected to a SY/NET network using the NET-TO-NET mode. This
mode is used to connect the MEB3 to an RS-422 port on a CRM-510 NIM, RS-422 port
on a SY/LINK (SFI-510) PC card, Niobrara SPE4, EPE5, or even MEB modules.
The following rules apply to NET-TO-NET ports:
• Both ports must be set to NET-TO-NET mode. This may involve setting DIP
switches on the NIM.
• Both ports must be set to the same SY/NET drop number. Set the MEB3 port to
match the NIM.
• Both ports must have the same baud rate, parity, data bits, stop bits, and

MEB3 Manual 9 Legacy SY/MAX Operation 59

 checksum. Most NIMs use BCC but the CRM-511 and 512 may be set to use
CRC-16.
The route message includes the NET-TO-NET drop number only once for the port pair.

Figure 9.2 NET-TO-NET Serial Routing Example

Drop 117 MB+ 5

MU7 Cable

MB+ 6

192.168.0.241

192.168.0.25

1
7

1 1
8 9

MEB3 Manual 9 Legacy SY/MAX Operation 60

Figure 9.2 NET-TO-NET Serial Routing Example show an MEB3 port 1 connected NET-
TO-NET to a CRM-510 set to node 17. This NIM is on a small “Blue Hose” SY/NET
with two other NIMs set to 18 and 19. NIMs 17 and 18 have a PLC connected to the 0xx
port with a CC-100 cable. NIM 19 has the PLC connected to port 119. The MEB3 is
connected to the 117 port so the drop number of the MEB3 port 1 must also be set to 117.
Both the NIM port and MEB3 must be set to NET-TO-NET mode.

Table 9.3: Modbus Routing Table for Ethernet Port

Index Type Route Comments
0 OTHER NONE
1 MODBUS 5,1
2 MODBUS 5,2
3 MODBUS 5,3
4 MODBUS 5,4
5 MODBUS 5,5
6 MODBUS 5,6 Compact 984 PLC
7 MODBUS 5,7
... ... ...
16 MODBUS 5,16
17 OTHER 117,17 PLC on NIM port 17
18 OTHER 117,18 PLC on NIM port 18
19 OTHER 117119 PLC on NIM port 119
20 MODBUS 5,20

The Modbus/TCP Ethernet routing table shows the Modbus/TCP Index values of 17, 18,
and 19 that will allow clients to access the SY/MAX PLCs.
The Compact PCL can access any of the SY/MAX processors with MSTR routes of
5.117.17 or 5.117.18 or 5.117.119. Notice that the second drop of the MSTR route is
always 117 because it is MEB3 port 1 connected to the NIM.
Any of the SY/MAX PLCs may access devices through the MEB3 with TREAD or
TWRITE messages.

Table 9.4: SY/MAX NET-TO-NET Routes

MEB3 Manual 9 Legacy SY/MAX Operation 61

 Source Target Route
PLC 17 Compact 17,117,5,6
PLC 18 Compact 18,117,5,6
PLC 119 Compact 119,117,5,6
PLC 17 M340 17,117,90,25,1
PLC 18 M340 18,117,90,25,1
PLC 119 M3340 119,117,90,25,1

MEB3 Manual 9 Legacy SY/MAX Operation 62

SY/MAX Ethernet
The MEB3's Ethernet port may be configured to support Modbus/TCP and SY/MAX
802.3 protocols at the same time. Thus the user may bridge older SY/MAX Ethernet
enabled PLCs (Model 450 and Model 650) to Modbus/TCP, Modbus Plus, and various
serial networks.

MEB3 Manual 9 Legacy SY/MAX Operation 63

 NOTE: Always check that the SY/MAX 802.3 node number is unused on the
LAN before setting the MEB3's address. SY/MAX Ethernet devices that detect
duplicate drops remove themselves from the LAN and in many cases must be
power cycled before they function again. This action may result in equipment
damage, personal injury, or death.
The SY/MAX 802.3 protocol supports up to 100 physical node addresses (0-99). Logical
Node numbers 100-199 are possible on Niobrara devices (MEB, EPE5, RPC) by setting a
serial or MB+ port to “On Ethernet YES”. Node numbers above 100 also consume the
node modulo 100. For example, if the MEB3's Ethernet port is set to 55 then node 155 is
also required to be within this MEB3. Therefore serial port 1 may be set to drop 155 and
have “On Ethernet YES” configured.

MEB3 Manual 9 Legacy SY/MAX Operation 64

SY/MAX Routing
The MEB3 in the combination Modbus/TCP+SY/MAX Ethernet mode simply becomes
another drop in the SY/MAX route between the source and the target. Inbound Ethernet
messages include the MEB3's Ethernet port drop number as the next drop in the route.

MEB3 Manual 9 Legacy SY/MAX Operation 65

 Figure 9.3 SY/MAX Ethernet Routing Example

MB+ 5

MB+ 6

192.168.0.241
SY/MAX Drop 21

192.168.0.25

Media
Converter

M650
Drop 22 EPE5
Drop 112

M450
Drop 24

M400 EPE5 ThinWire

Drop 23 Ethernet

MEB3 Manual 9 Legacy SY/MAX Operation 66

Table 9.5: SY/MAX Ethernet Routes
Source Target Route
Model 650 Compact 22,21,5,6
Model 400 Compact 112,23,21,5,6
Model 450 Compact 24,21,5,6
Model 650 M340 22,21,21,25,1
Model 400 M340 112,23,21,21,25,1
Model 450 M340 24,21,21,25,1
Compact Model 650 5.21.22
Compact Model 400 5.21.23.112
Compact Model 450 5.21.24
M340 Model 650 192.168.0.241 index 22
M340 Model 400 192.168.0.241 index 23
M340 Model 450 192.168.0.241 index 24

The outbound messages to the M340 PLC have the MEB's Ethernet drop number in the
route twice. The first entry to select the MEB, the next entry to route the message back
out the Ethernet port. The drop following the second entry is the TCP Table entry of the
M340 PLC.
The MEB3 uses the entry in the TCP routing table to decide to send the message out as
Modbus/TCP (entry not 0.0.0.0) or SY/MAX 802.3 (entry is 0.0.0.0).

MEB3 Manual 9 Legacy SY/MAX Operation 67

Table 9.6: Modbus Routing Table for Ethernet Port
Index Type Route Comments
0 OTHER NONE
1 MODBUS 5,1
2 MODBUS 5,2
3 MODBUS 5,3
4 MODBUS 5,4
5 MODBUS 5,5
6 MODBUS 5,6 Compact 984 PLC
7 MODBUS 5,7
... ... ...
21 MODBUS 5,21
22 OTHER 21,22 Model 650
23 OTHER 21,23,112 Model 400
24 OTHER 21,24 Model 450
25 MODBUS 5,25

MEB3 Manual 9 Legacy SY/MAX Operation 68

Table 9.7: Ethernet TCP Routing Table
Drop IP Address Route Description
0 0.0.0.0 NONE SY/MAX node 0
1 192.168.0.1 NONE Modbus/TCP
2 192.168.0.2 NONE Modbus/TCP
3 192.168.0.3 NONE Modbus/TCP
... ... ...
20 192.168.0.20 NONE Modbus/TCP
21 192.168.0.21 NONE Modbus/TCP
22 0.0.0.0 NONE SY/MAX node 22
23 0.0.0.0 NONE SY/MAX node 23
24 0.0.0.0 NONE SY/MAX node 24
25 192.168.0.25 NONE Modbus/TCP
26 192.168.0.26 NONE Modbus/TCP
... ... ...
200 192.168.0.200 NONE Modbus/TCP

PowerLogic Serial Modes

All newer Square D PowerLogic electric meters and breaker panels communicate with
Modbus serial and Modbus/TCP Ethernet protocols. Older meters like the CM2000 and
PowerLink AS units use the SY/MAX based PLOGIC and PNIM protocols. The MEB3
supports all of these protocols plus a mixed mode called CHEVRON which allows both
PNIM and Modbus RTU devices to reside on the same daisy-chain.
Note that some PowerLogic devices only support 4-wire RS-485, some only support 2-
wire RS-485, and some may be used in either mode.
Note that some PowerLogic devices only support EVEN parity, some only support
NONE, and some support both settings.aa

MEB3 Manual 9 Legacy SY/MAX Operation 69

Table 9.8: Common PowerLogic Devices
Device Protocols RS-48 Parity Notes
Series 5
CM100 PLOGIC 4-wire EVEN Must cycle power when changing
CM200 PNIM between PNIM and PLOGIC
CM2000 PLOGIC 4-wire EVEN Dynamically switches between
PNIM NONE PNIM and PLOGIC
CM3000 Modbus 4-wire NONE
CM4000 RTU 2-wire EVEN
Modbus ODD
ASCII
PM600 PLOGIC 4-wire EVEN Dynamically switches between
PNIM 2-wire NONE PNIM and PLOGIC
Modbus
RTU
PM700 Modbus 2-wire NONE
PM800 RTU EVEN
Modbus ODD
ASCII
Enercept Modbus 2-wire NONE
RTU
BCM Modbus 4-wire NONE
RTU 2-wire EVEN
ODD
BCPM Modbus 4-wire NONE
RTU 2-wire EVEN
ODD
PowerLink PLOGIC 4-wire EVEN Must cycle power when changing
AS PNIM only between PNIM and PLOGIC

PowerLink Modbus 4-wire NONE

G3 RTU 2-wire EVEN
Modbus ODD
ASCII

MEB3 Manual 9 Legacy SY/MAX Operation 70

 10 Hot MB+ Operation
Automatic Redundant Operation
The MEB3 features a unique operating mode called “Hot MB+” that allows two MEB3
units to operate in a fully redundant, hot-backup system. One MEB3 acts as the
“Primary” unit performing the typical serial, Ethernet, and Modbus Plus message routing
and translations, while the “Secondary” unit monitors the Primary and waits for its
chance to take over should something fail (power supply, Ethernet link, or Modbus Plus
connection). When a changeover event occurs, the Secondary unit becomes the new
Primary and assumes it's IP Address and MB+ node number, and all routing information.
Both units are configured exactly the same and online configuration changes are only
allowed on the Primary. The Secondary unit monitors the EEPROM configuration of the
Primary and if the two units are not configured exactly the same, the Secondary
automatically pulls the entire configuration from the Primary.

Requirements and Restrictions

• Port 2 of both MEB3s are required to be be connected together with either 4-wire
RS-422 or RS-232 cables. This serial connection is required for automatic
configuration transfers when the Primary and Secondary miss-match. This
connection must be full-duplex 4-wire RS-422 or RS-232. 2-wire RS-485 is not
permitted.
• The Primary and Secondary units require adjacent TCP/IP Addresses. For
example, if the Primary is at address 192.168.5.178, the Secondary will be at
address 192.168.5.179.
• The Primary and Secondary units require adjacent MB+ drop numbers. For
example, if the Primary is at node 53, the Secondary will be at node 54.
• Online modifications of the configuration are only allowed in the Primary unit.
The Secondary unit is effectively “read-only”. The Secondary unit only allows
“USER” web access (not “ADMIN”).
• Modifications made in the Primary are only updated in the Secondary after a
“Store to EEPROM” operation has occurred. Future “Store to EEPROM”
operations are temporarily locked out while the Secondary is fetching the new
configuration.
• The transition from Secondary to Primary is not “bumpless”. It takes about 16
seconds for the Modbus Plus chipset to restart to the Primary's address.
• SY/MAX 802.3 Ethernet operation is not supported in Hot MB+ mode at this
time.

MEB3 Manual 10 Hot MB+ Operation 71

 • Modbus serial slave and RNIM slave operation on Port 1 are not supported at this
time.
• Modbus serial master, Chevron mode, PNIM, and RNIM master operations on
port 1 are supported in RS-485 driver modes allowing redundant access of serial
slaves from both Modbus Plus and Ethernet.
• Any PLC programming connection active through the Primary will close during a
transfer from Secondary to Primary.
• It is recommended that each MEB3 have it's own power supply and Ethernet
connection to an independent switch to avoid any singly point of failure.
• MB+ Global Data is used between the Primary and Secondary MEB3s and is not
available for general mailbox use. The Global Data may be used by other MB+
devices to see the state and serial numbers of both Primary and Secondary units.

“Primary” Unit Configuration Procedure

1. Mount one of the MEB3 units on a DIN rail. This unit will be the “Primary”.
2. Do not connect any serial, Ethernet, or MB+ cables at this time.
3. Apply power to this unit.
4. It is recommended to perform a Factory Reset on the unit at this time. Select
“System”, “Factory”, “Defaults” to reset the unit to a known state.
5. Configure this unit with the Primary IP Address, Modbus Plus drop number,
Modbus routing tables, IP tables, and serial port 1 parameters. This configuration
may be done through the front panel LCD/keypad and/or web server. Be certain
to store the configuration to EEPROM.
6. Connect the Ethernet and MB+ cables to the Primary unit.
7. Test the routing and the rest of the configuration to be sure that everything is
operating correctly.
8. If configuring through the front panel:
Select “System”, “Hot MB+”, “Init Prim”. This changes the system
operation to Hot MB+ mode and takes control of Port 2 for Hot MB+
interconnection.
If configuring through the web server:
Select “Config”, “Port 2”, and change the mode to “Hot MB+”. Now
select “Init Primary” then “Store EEPROM”.
The “Primary” unit is now fully functional.

MEB3 Manual 10 Hot MB+ Operation 72

“Secondary” Unit Configuration Procedure
1. Mount the second MEB3 on a DIN rail This unit will be the “Secondary”.
2. Do not connect any serial, Ethernet, or MB+ cables at this time.
3. Apply power to the second MEB3.
4. It is recommended that the unit be reset to Factory Defaults by selecting
“System”, “Factory”, “Defaults”.
5. From the front panel select “System”, “Hot MB+”, “Init Sec”.
6. Connect a 4-wire RS-422 cable between port 2 of each MEB3. (RS-232 cabling
may also be used.). The RX and TX lights on both port 2 should be flashing
quickly.
7. Return to the main splash screen. The MB+ drop number should be the
Primary+1. The IP Address should be showing “Reading Config”. The
Secondary unit is fetching the entire configuration from the Primary.
8. When the Secondary unit is finished fetching the configuration from the Primary,
it reboots and assumes normal Hot MB+ operation.
9. Now connect the Ethernet and MB+ cables. The IP Address should be Primary+1.

MEB3 Manual 10 Hot MB+ Operation 73

Example

Figure 10.1 Hot MB+ Example

Port 2
4-wire RS-422
Cable

To MB+ Network

MEB3 Manual 10 Hot MB+ Operation 74

 Figure 10.2 Hot MB+ Port 2 RS-422 Cable

Reasons for Automatic Switchover

• Primary becomes sole station on MB+.
• Primary loses Ethernet link. Both Ethernet ports must lose link on an MEB3+201
for a switchover to occur.
• “Revert to Secondary” command written to Primary via Modbus communication.
• Secondary unit will become Primary if Primary MB+ Global Data is not present
and port 2 communications are lost. For example, power is removed from the
Primary.
• Firmware update is completed on Primary unit.
• Unequal Firmware in the two units will cause the unit with the oldest firmware to
become the Primary. This will allow the oldest unit to have its firmware to be
updated because only the Primary unit may have its firmware upgraded through
the web page.

Hot MB+ Statistics and Information Registers

The Hot MB+ mode uses a number of the standard Port 2 statistical counters with new
meanings. Of particular interest are the State values in registers 2133 and 2134 and the
MEB's serial number in registers 2137 and 2138.

It may be desirable to have an HMI periodically poll the Primary MEB3 to read the state
of the Primary and Secondary units. The serial number of the primary unit may also be

MEB3 Manual 10 Hot MB+ Operation 75

quickly determined.
4x Description Meaning
Register
2133 State of this unit's Hot MB+ 0=Startup State
1=Operating as Primary
2=Operating as Secondary
3=Becoming Secondary
4=Becoming Primary
5=OFFLINE
6=Init – waiting for command
7=Receiving config from Primary
8=Secondary, MB+ is sole station
9=Hold OFFLINE
10=Hold Sole Station
2134 State of peer unit's Hot MB+ 0=Startup State
1=Operating as Primary
2=Operating as Secondary
3=Becoming Secondary
4=Becoming Primary
5=OFFLINE
6=Init – waiting for command
7=Receiving config from Primary
8=Secondary, MB+ is sole station
9=Hold OFFLINE
10=Hold Sole Station
255=Peer UNKNOWN
2137 Low word of this unit's Serial S/N 800111 would have a
Number decimal value of 13679.
2138 High word of this unit's Serial S/N 80111 would have a decimal
Number value of 12.

To calculate the S/N, multiply

this value by 65536 and then add
the value from register 2137.

(12 x 65536) + 13679 = 800111

Table 10.1: Hot MB+ Statistics

MEB3 Manual 10 Hot MB+ Operation 76

Serial Number
Reading registers 2137 and 2138 from the MEB3 will provide the serial number of the
MEB3. This may very helpful for determining which physical MEB3 is the primary.
Register 2137 contains the least significant word of the serial number while 2138
contains the most significant word. To calculate the actual serial number, take the value
in 2138 and multiply it by 65536 and then add the value in 2137.
For example if R[2137] = 13751 and R[2138] = 12 then

S/N = (12 x 65536) + 13751 = 800183

MB+ Global Data

Each MEB3 in a Hot MB+ system publishes five words of Modbus Plus Global Data.

Global Data Meaning Example

Word
0 Incrementing Counter Increments once per second
1 State of This Unit 1-10, 255 (see Table 10.1)
2 State of Peer Unit 1-10, 255 (see Table 10.1)
3 This Unit's Serial Number LSW 13751
4 This Unit's Serial Number MSW 12

This Global Data may be subscribed to by any PLC on the local MB+ network. Mapping
this data into a PLC allows easy access by an HMI or SCADA that is already polling the
PLC.

Controlled Switchover
It may be desired to periodically trigger a controlled switchover between the two Hot
MB+ units.
A single Modbus write of the special value 43776 (decimal) to register 8092 in the
Primary MEB3 will trigger a “Revert to Secondary” on this unit.
When this command is sent to the Primary MEB3 in a functioning Hot MB+ system, it
will trigger a Hot-Swap. That is, the Primary becomes Secondary and Secondary
becomes Primary. This command will only take effect if the Primary “sees” the
Secondary as being online and fully functional as a standby unit. If the Primary thinks
the Secondary is not able to take over as primary, this command is ignored.

MEB3 Manual 10 Hot MB+ Operation 77

 11 Front Panel Operation
Keypad Buttons
The front panel includes five push buttons.
• The RIGHT arrow advances to the next screen or field. In many cases, it has
the same behavior as the key.
• The LEFT arrow escapes to the previous screen or field. Changes are saved
when the left arrow is pressed.
• The UP arrow moves up in a list or increments a selection.
• The DOWN arrow moves down in a list or decrements a selection.
• The ENTER key accepts the values on a screen and exits to a previous screen.

LCD Screen
The MEB3 includes a high resolution LCD screen main screen to assist the user in
configuring and troubleshooting the device. Ethernet, MB+, and serial port parameters
and may be observed and modified. Statistical information is also provided through the
front panel interface.

Backlight
The LCD backlight will illuminate on any button press. The timeout for the backlight is
configured through Modbus drop 255 register 7003 and defaults to 300 seconds.

Operating Screens
Splash Screen
The main page shows the IP Address of the MEB3 and the MB+ node number and status,
and SY/MAX 8023 drop number (if enabled).
Error conditions may be displayed on the splash screen as they occur. Indications for
duplicate IP Address, duplicate SY/MAX 802.3 node, or the various Modbus Plus status
descriptions are shown.
Certain errors will flash the backlight until a key is pressed to draw attention to the
MEB3. A red LED is positioned behind the LCD and will glow red on Proxy error
conditions.

MEB3 Manual 11 Front Panel Operation 78

 User Label Fixed IP Address
“Test Lab” 192.168.15.241
SY/MAX 90

Modbus Plus
Figure 11.1: Splash Screen Node = 21
Proxy PLC in RUN
Normal Operation

Possible values for the Modbus Plus Status are:

• Monitor – The MEB3 is monitoring the MB+ network waiting to be asked to join
the token rotation.
• Normal – The MEB3 is participating in normal token operation.
• No Token – Traffic is being heard on the MB+ network but the MEB3 is not
claiming the token. Most likely a physical RS-485 transmitter problem.
• Sole Sta. – The MEB3 is in “Sole Station” and is unable to pass the token to any
other nodes. It is attempting to restart the network.
• Duplicate – The MEB3 has heard another node set to its address active on the
network. The MEB3 will be silent and not participate on the network until the
duplicate node is removed or its drop number is changed.
• Reset – The Modbus Plus board within the MEB3 is being reset. This will happen
any time the MB+ drop number is changed and during startup.
Possible values for the Proxy Status are:
• Missing – If the word “Proxy:” is not shown then the unit is in MEBII mode and
Proxy is disabled. This is the factory default mode.
• Proxy:Cfg – Proxy mode is enabled but the service is in “CONFIG” mode. Global
Data and Peer Cop are disabled. Proxy routing to the target PLC (if configured) is
active.
• Proxy:Run – Proxy mode is enabled. A good Modbus/TCP connection is active to
the target PLC and the target PLC is in RUN. Peer Cop and Global Data should
be active for both outputs and inputs. Proxy routing to the target PLC is active.
• Proxy:Sto – Proxy mode is enabled. A good Modbus/TCP connection is active to
the target PLC and the target PLC is in STOP. Peer Cop and Global Data Inputs
are pushed to the target PLC but Outputs are not published onto Modbus Plus.
Proxy routing to the target PLC is active.
• Proxy:??? – Proxy mode is enabled. A good Modbus/TCP connection is not
active to the target PLC. Peer Cop and Global Data are both disabled. Proxy
routing to the target PLC is inactive since the MEB3 cannot connect via

MEB3 Manual 11 Front Panel Operation 79

 Modbus/TCP.

Main Menu Screen

Pressing a key while the splash screen is displayed will move to the Main menu page. A
pointer along the left margin indicates the sub-menu to be chosen. Pressing the UP or
DOWN arrows will move the pointer. Pressing the RIGHT arrow or ENTER buttons will
select the sub-menu. Pressing the LEFT arrow will return to the splash screen page.

Pointer

Figure 11.2: Main Menu Screen

Configuration Menu
Selecting the Config item leads to the Config menu and a choice of Comms and Display.
The Comms sub-menu moves on to Ethernet, serial port, and MB+ options while the
Display sub-menu allows the user to adjust the screen contrast.

Figure 11.3: Config Menu Screen

MEB3 Manual 11 Front Panel Operation 80

Comms Menu Screen
The Comms menu allows the selection of editing the settings for the Ethernet, Serial
ports, or Modbus Plus port.

Figure 11.4: Comms Menu Screen

Ethernet Configuration Menu

The Ethernet menu allows the selection of editing the settings for the IP Address, Subnet
Mask, Default Gateway, IP Source, Ethernet Protocol, port drop number, Modbus Routes,
IP Route table, and the physical Ethernet port mode settings.

Figure 11.5: Ethernet Menu Screen

MEB3 Manual 11 Front Panel Operation 81

IP Addr Screen
The IP Address of the MEB3 may be quickly changed using the IP Addr screen. Move
the cursor with the LEFT and RIGHT arrows and adjust the octet with the UP and
DOWN arrows. Holding the UP or DOWN key will scroll the value quickly. When the
new address is finished, press the ENTER key and a prompt for “AutoFill IP Tables?” is
presented. Select “Yes” to have the MEB3 automatically fill the TCP table with the first
3 octets of this IP Address and the fourth octet the index value.

Press Enter
Then prompt for
AutoFill

Figure 11.6:IP Address Screens

Default 10.10.10.10

Subnet Mask Screen

The Subnet Mask of the MEB3 may be quickly changed using the Mask screen. The UP
and DOWN buttons are sued to adjust the number of bits in the mask. When the new
mask is finished, press the ENTER key and a prompt for “Auto Set Default Gate?” is
presented. Select “Yes” to have the MEB3 automatically apply the subnet mask to the IP
Address to generate most of the default gateway setting..

Default 255.0.0.0
Press Enter
Then prompt for
Auto Set
Now 255.255.255.0 DefaultGate

Figure 11.7:Subnet Mask Screens

MEB3 Manual 11 Front Panel Operation 82

Default Gate Screen
The Default Gateway of the MEB3 is edited just like the IP Address. The LEFT and
RIGHT buttons move the cursor while the UP and DOWN buttons are sued to adjust the
value. Press ENTER to accept the new value.
Set the Default Get to 0.0.0.0 to disable routing operation outside the local subnet.

After Auto Set

Now 192.168.1.1

Figure 11.8:Default Gate Screen

IP Source Screen
The MEB3 may have a fixed IP Address or use BOOTP or DHCP to have its IP settings
configured. The IP Source screen allows the user to configure the appropriate setting.
Use the UP and DOWN buttons to select the setting. DHCP and BOOTP typically
require the server to be configured for the MAC address of the MEB3's Ethernet
port.This MAC address is shown on the screen in hexadecimal (00:20:BD:0C:35:04).

Figure 11.9:IP Source Screen

Ethernet Protocol Screen

The Ethernet port may be configured for only Modbus/TCP or a combination of
Modbus/TCP plus SY/MAX 802.3 for support of legacy SY/MAX Ethernet devices. The
Protocol screen allows the setting of the mode.

MEB3 Manual 11 Front Panel Operation 83

 WARNING: Set the drop number of the Ethernet port to SY/MAX 802.3 drop
that is not present on the connected network before setting the port to
MB+SYMAX mode. Choosing a duplicate drop on the network will result in both
nodes halting SY/MAX communication which may result in equipment damage,
injury, or death.

Figure 11.10:Ethernet Protocol Screens

Ethernet Drop Screen

The drop number of the Ethernet port defaults to 0 and rarely needs to be changed. This
drop number is used to set the SY/MAX 802.3 Ethernet node number when the Ethernet
port is set to MB+SYMAX protocol mode.
WARNING: Set the drop number of the Ethernet port to SY/MAX 802.3 drop
that is not present on the connected network before setting the port to
MB+SYMAX mode. Choosing a duplicate drop on the network will result in both
nodes halting SY/MAX communication which may result in equipment damage,
injury, or death.
After selecting the new drop number by pressing the Enter button, a prompt for “Auto-
Fix Routing Tables?” is presented. Selecting Yes will automatically adjust entries in the
Ethernet and serial ports 1 and 2 Modbus Routing tables. Route entries with the old drop
number as the first drop in the route will be changed so the new drop number replaces the
old value.

Figure 11.11:Ethernet Drop Screen

MEB3 Manual 11 Front Panel Operation 84

Modbus Route Screen
The Modbus Routing table for the Ethernet port may be edited through the Modbus Route
screen. This screen shows a single entry from the table with the index on the top line.
The cursor is moved with the left and right arrows. Values are altered with the up/down
buttons.
The enter button exits the screen when on the index field.
The enter button on the TEST field causes a test message to be sent using the route to the
target device.

Index = 001
Up/Down to edit Route Up/Down to change,
*** to delete element Enter to exit screen

Enter on “TEST” to Modbus for Modbus Target

generate test message OTHER for SY/MAX

Figure 11.12:Modbus Route Edit Screen

The TEST message is an opcode 03 Modbus Holding Register read of remote registers
8188. Possible results from this read are:
• A valid reply is received from the target slave. The screen will show PASS along
with the decimal value of the remote register 4x8188. On older SY/MAX PLCs,
this value is the PLC model number.
• A valid error reply is received from the target slave. The screen will show PASS
along with the returned error code. Possible errors are:
◦ Error 01 = Illegal Opcode. This means that the slave does not support
Modbus opcode 03 (Holding Register read). The slave is replying to the
test message, it just does not support the test message.
◦ Error 02 = Illegal register. This means that the slave does not have
Holding Register 4x8182. This is also a PASS condition, it just means that
the test message asked for a register that does not exist in the slave.
• The network was unable to receive a reply from the slave. This is a FAIL
condition with the error message Downstream Timeout.
• The MEB3 was unable to generate the query because the first drop in the route
was not a valid drop number of another port in the MEB3. The FAIL message
will show

MEB3 Manual 11 Front Panel Operation 85

 Pass Fail

Figure 11.13:Modbus Route Test Results Screens

IP Route Screen
The IP Routing table for the Ethernet port may be edited through the IP Route screen.
This screen shows a single entry from the table with the index on the top line. The cursor
is moved with the left and right arrows. Values are altered with the up/down buttons.
The enter button exits the screen when on the index field.
The enter button on the ZERO field causes the IP Address to be set to 0.0.0.0. This is
handy for zeroing an entry for SY/MAX 802.3 Ethernet entries.

Index = 002
Up/Down to edit Address Up/Down to change,
Left/Right to change field Enter to exit screen

Enter on “AUTO” to
Auto-fill the entry
ZERO – press Enter to
Figure 11.14:IP Route Screen zero the entire entry

The AUTO field sets the entry to the MEB's IP Address with the last octet set to match
the index.

MEB3 Manual 11 Front Panel Operation 86

Ethernet Mode Screen
The Ethernet Mode screen allows the physical configuration of the Ethernet port. The
port defaults to “AUTO” mode which automatically sets itself to match the attached
device. The possible settings are:
• AUTO
• 10BaseT – Full Duplex
• 10BaseT – Half Duplex
• 100BaseT – Full Duplex
• 100BaseT – Half Duplex

Figure 11.15:Ethernet Port Mode Screens

Serial Port Menu

The Serial menu allows the selection a particular serial port to edit. Choices are Port 1
and Port 2.

Figure 11.16: Serial Pot Menu Screen

MEB3 Manual 11 Front Panel Operation 87

Port 1 Menu
Both serial port share the same menu list.

Figure 11.17: Serial Pot 1 Menu Screen

Settings available fro the two serial ports are:
• Protocol
◦ Modbus RTU (default)
◦ Modbus ASCII
◦ Modbus Host (RTU with special translations)
◦ Chevron (combination Modbus RTU master with RNIM master)
◦ Dual Slave (combination Modbus RTU slave and SY/MAX slave)
◦ Hot Modbus Plus (Port 2 only)
◦ SY/MAX, NET-TO-NET, RNIM Master, RNIM Slave (legacy Square D PLC
serial protocols)
◦ PNIM and PLOGIC (legacy PowerLOGIC protocols)
◦ IDEC (legacy Square D Model 50 and Micro-1)
◦ Transfer (legacy Square D PLC Hot Backup)
◦ Peripheral, Share, Transfer (legacy Square D ASCII)
◦ Gateway (legacy Niobrara ASCII)
◦ Multidrop (legacy Niobrara serial network)
• Baud Rate – 50, 75, 110, 134.5, 150, 300, 600, 1200, 1800, 2400, 4800, 7200,
9600 (default), 19200
• Parity – EVEN (default), ODD, NONE
• Data Bits – 8 (default), 7 (ASCII modes only)
• Stop Bits – 1 (default), 2
• Driver – RS-232 (default), RS-422, RS-485 + Bias, RS-485 - Bias

MEB3 Manual 11 Front Panel Operation 88

 • Drop – 101 (default for port 1), 102 (default for port 2)
• Modbus Routes – See Modbus Route Screen on page 85

Modbus Plus Drop Screen

The MB+ Drop edit screen shows the current MB+ drop number and allows the user to
edit the new number. Valid entries are 1-64. The MEB3 will not allow the user to select
a drop number that it already sees on the MB+ network. It will also not allow the new
drop number to be the same as either serial port drop or the Ethernet port drop.

Figure 11.18: Modbus Plus Edit Screen

Pressing the Enter button will prompt “Auto-Fix Routing Tables?” Selecting “Yes” will
cause the MEB3 to adjust the Modbus routing tables for both serial ports and the Ethernet
port to replace the first drop in a route that matches the “Current” drop with the “New”
drop.
If Proxy mode is disabled, then after the “Auto-Fix” prompt for enabling Proxy Mode.
• Disabled – MEBII mode is selected.
• Enabled – Proxy mode is selected.
If Proxy mode is Enabled then the user is prompted for the Target PLC IP Address. This
address is edited just like the IP Address front panel screen.
The Proxy Stat page allows the user to place the Proxy Mode into “Config” or “Run”

MEB3 Manual 11 Front Panel Operation 89

Display Edit Screen

Figure 11.19: Display Contrast Edit Screen

The Display screen allows the user to adjust the contrast value for the display. The UP
and DOWN arrows allow the changing of the setting. The ENTER or LEFT arrows
accept the new value.

Status Menu Screens

Figure 11.20: Status Menu Screen

The Status menu item gives access to physical status and communication statistics for all
ports.

Stats Screen
Each port has multiple screens to give statistical counters about communication through
the port. LEFT and RIGHT arrows change between ports. UP and DOWN move between
pages for a given port. ENTER returns to the previous menu.

MEB3 Manual 11 Front Panel Operation 90

 Figure 11.21: Stats Screens

Enet Status Screen

The Enet status screen shows the current physical connection status of the Ethernet port.

Figure 11.22: Status Menu Screen

MB+ Status Screen

The MB+ status screen shows information about the state of the MB+ port.

Figure 11.23: Status Menu Screen

MEB3 Manual 11 Front Panel Operation 91

App Menu
The APP menu allows the user to halt the MEB3 application. This feature should only be
used when directed by Niobrara Technical Support.

Figure 11.24: App Menu Screen

Switch Screen
The Switch screen allows the user to HALT or RUN the MEB3 application. The MEM
PROT setting is ignored at this time and is the same as RUN.

Figure 11.25: Switch Screen

MEB3 Manual 11 Front Panel Operation 92

Info Menu
The Info Menu provides access to various information about the MEB3 firmware and
network connections.

Figure 11.26: Info Menu Screen

MAC Address Screen

The MAC address screen shows the hardware address of the Ethernet port in
hexadecimal. This information is useful when the IP Address is set by BOOTP or DHCP.

Figure 11.27: MAC Address Screen

MEB3 Manual 11 Front Panel Operation 93

Serial Number Screen
This screen shows the serial number of the MEB3.

Figure 11.28: Serial Number Screen

Versions Screen
The Versions menu gives access to the MEB3 firmware, DUCM firmware, and boot
version.

Figure 11.29: Versions Screen

MB+ Drops Screen

The MB+ drops screen shows the addresses of local MB+ nodes that are recognized by
the MEB3. This page is dynamically updated and may stretch to show more than one
screen. The UP and DOWN keys may be used to move between screens if needed.
The MB+ node of the MEB3 is highlighted.

MEB3 Manual 11 Front Panel Operation 94

 Figure 11.30: MB+ Drops Screen

Enet Drops Screen

The Enet drops screen will show the SY/MAX 802.3 drops accessible to the MEB3. This
page may extend beyond a single screen and the UP and DOWN buttons are used to
move between screens.
Any drop numbers local the MEB3 are highlighted. This includes the Ethernet port and
any other port with “ON ETHERNET” set to YES.

Figure 11.31: SY/MAX Ethernet Drops Screen

MEB3 Manual 11 Front Panel Operation 95

System Menu
The System menu provides access to the front panel password, reboot, and reset to
factory defaults.

Reboot Screen
This screen allows the user to force a hardware reboot of the MEB3 without physically
removing the power.

Figure 11.32: Reboot Screen

Factory Defaults Screen

The Factory screen allows the user to quickly reset the MEB3 to factory defaults. The
reset process also includes a reboot. Selecting “NO” will return to the previous menu
without altering the current setup.

Figure 11.33: Factory Defaults Screen

MEB3 Manual 11 Front Panel Operation 96

Password Screen
The MEB3 may have a password enabled to limit front panel operation. The password is
a four digit number (0000-9999) that must be entered before settings are altered. Once
the password is entered, it settings may be altered until a reboot or the backlight timeout
occurs.
Setting the password to 0000 disables the feature.

Figure 11.34: Password Screen

MEB3 Manual 11 Front Panel Operation 97

 12 Recommended Cables

RS-232 Cables
MM1 (PC to MEB3)
The Niobrara MM1 cable may be used to connect the MEB3 RS-232 port to a standard
PC 9-pin male port. The pinout is shown in Figure 12.1.: MM1 Serial Cable.

Figure 12.1.: MM1 Serial Cable

RJ-45 Connection PC Serial Port Pin

1 1
2 2
3 3
4 4
5 5
6 6
7 7
8 8
9

MM2 (Modicon PLC to MEB3)

The Niobrara MM2 cable may be used to connect the MEB3 RS-232 port to a standard
Modicon 9-pin female PLC programming port. These ports are common on the Quantum
PLC, Compact 984, 984, BM85 Bridge Mux, and other older Modicon products. This is
the same cable as the MM1 with a male 9-pin connector. The pinout is shown in Figure
12.2.: MM2 Serial Cable.

MEB3 Manual 99
Figure 12.2.: MM2 Serial Cable

RJ-45 Connection Modicon PLC Serial Port Pin

1 1
2 2
3 3
4 4
5 5
6 6
7 7
8 8
9

MM3 (MEB3 to emulate a 9-pin PC port)

The Niobrara MM3 cable may be used to make the MEB3 RS-232 port appear as a
standard PC 9-pin male port. This cable is often used along with an MM1 cable to
connect two RJ-485 RS-232 ports together such as an MEB3 to a newer Compact 984
PLC. The pinout is shown in Figure 12.3.: MM3 Serial Cable.

Figure 12.3.: MM3 Serial Cable

RJ-45 Connection PC Serial Port Pin

1 1
2 2
3 3
4 4
5 5
6 6
7 7
8 8
9

MEB3 Manual 12 Recommended Cables 100

RS-485 Cables
MU7 (MEB3 to SY/MAX)
The Niobrara MU7 cable is used to connect the RS-485 port of the MEB3 to a standard
SY/MAX DB9 female port. This cable is normally used to connect the MEBI directly to
a SY/MAX PLC or NIM module.
NOTE: The MEB3 port driver mode is normally set to RS422 when connected to a
SY/MAX serial port.

Figure 12.4.: MU7 Serial Cable

Phoenix 5-pin Connection SY/MAX Port

TX(+) 1 TX-
TX(-) 2 TX+
RX(+) 3 RX-
RX(-) 4 RX+
Shield 5
6
7
8
9

Driver Mode: RS-422

MEB3 Master to 4-wire RS-485 Slaves

The MEB3 may be used to be a master on a 4-wire RS-485 network. An example of this
network is a string of PowerLogic meters attached to the MEB3.
An external terminator should be used at the last slave across its RX pair. Normally, this
is a 120 ohm resistor or the PowerLogic MCT-485.
The Driver Mode for the MEB3 port should be set to RS-422. This mode enables the
transmitter of the port at all times to bias the receivers of all of the slaves. This mode
also enables the internal termination and bias of the MEB3's receiver.
Belden 8723 or equivalent is recommended for this type of network.
The shield wire should only be grounded at one location - usually at the master. A simple

MEB3 Manual 12 Recommended Cables 101

method of grounding the shield is to connect the Shield terminal of the MEB's RS-485
connector to the Earth Ground terminal of the MEB3's power supply connector.

Figure 12.5.: 4-wire RS-485 Master

Phoenix 5-pin Slave A Slave B Slave C

Connection
TX(+) RX(+) RX(+) RX(+)
TX(-) RX(-) RX(-) RX(-)
RX(+) TX(+) TX(+) TX(+)
RX(-) TX(-) TX(-) TX(-)
Shield Shield Shield Shield
Driver Mode: RS-422 Terminator only on
(term and bias enabled) last slave

MEB3 to 2-wire RS-485

The MEB3 may be used as a master or slave on a 2-wire RS-485 network. An example
of this network is a string of 2-wire RS-485 PowerLogic meters attached to the MEB3.
The MEB3 must have the TX(+) and RX(+) lines jumpered together to make the (+)
connection on a 2-wire network. The TX(-) and RX(-) lines must also be jumpered
together to connect to the (-) line.
Terminator should be used at the last slave on each end of the daisy-chain. Normally, this
is a 120 ohm resistor.
Bias should only be enabled on one device of the 2-wire network. Typically, the bias is
enabled at the Master device since it is required to be active on the network.
If the MEB3 is the Master of the network, then it should be located at one end of the
daisy-chain and the Driver Mode should be set to RS485+Bias. The RS845+Bias mode
enables the internal bias and termination resistors.
NOTE: RS485+Bias mode always enables both the internal termination and bias
resistors. If another device on the 2-wire network is providing the bias then the
MEB3 port must be set for RS485-Bias and an external termination resistor must
be used.
Belden 9841 or equivalent is recommended for this type of network.
The shield wire should only be grounded at one location - usually at the master. A simple
method of grounding the shield is to connect the Shield terminal of the MEB's RS-485
connector to the Earth Ground terminal of the MEB3's power supply connector.

MEB3 Manual 12 Recommended Cables 102

Figure 12.6.: 2-wire RS-485 Network with internal Bias

Phoenix 5-pin Node A Node B Node C

Connection
TX(+) (+) RX(+) RX(+)
TX(-) (-) RX(-) RX(-)
RX(+)
RX(-)
Shield Shield Shield Shield
Driver Mode: Terminator on last
RS485+Bias slave

Figure 12.7.: 2-wire RS-485 Network without internal Bias

Node A Phoenix 5-pin Node B Node C

Connection
RX(+) TX(+) RX(+) RX(+)
RX(-) TX(-) RX(-) RX(-)
RX(+)
RX(-)
Shield Shield Shield Shield
Terminator on last Driver Mode: Bias on some slave, Terminator on last
slave RS485-Bias could be same as slave
terminator

MEB3 Manual 12 Recommended Cables 103

 13 Web Server

The MEB3 uses a built-in Web server for remote configuration over the Ethernet
network. This Web server requires the use of Javascript.

First Access
In order to comply with California SB 327, the MEB3 applies a unique password to web
access each time the module is reset to factory defaults. The user may access the
password via the front panel. Use the arrow keys to navigate to Main > System >
Password. The screen will look similar to the screen below:

Figure 13.1: Web Interface default password

MEB3 Manual 105

For additional security, the web interface is disabled by default. To enable, navigate to
Main > System > WWW, then the UP or DOWN arrow key to change it to “Enabled.”

Figure 13.2: Enable WWW

Note: If the user sets the IP address from the front panel before connecting to a network,
the MEB3 will first ask if the user wants to autofill the TCP table, and will then ask if the
web interface should be enabled. This eliminates the extra steps of also having to repeat
the process above.

Login
After retrieving the default password, open a browser and navigate to the IP address that
has been assigned to the MEB3. The page should appear as below:

MEB3 Manual 13 Web Server 106

 Figure 13.3: First Login Screen

Enter the password, then click Submit. Remember to include the dash in the password.
The following page will result:

MEB3 Manual 13 Web Server 107

 Figure 13.4: Create Passwords Screen

The MEB3 Web server supports two user access levels: “User” and “Admin”. These
usernames are not changeable and are not case sensitive. “User” provides read-only
access to view the configuration of the MEB3. “Admin” provides full configuration edit
capabilities as well as backup/restore and firmware upgrade. Create passwords for these
levels, and store them. The passwords cannot be retrieved from the MEB3 by any
method. Once the passwords have been set, the screen will show as below:

MEB3 Manual 13 Web Server 108

 Figure 13.5: Create Passwords Screen

Once these passwords have been configured, every subsequent login to the MEB3 will be
as follows.

MEB3 Manual 13 Web Server 109

Figure 13.6 shows the Login page. Enter the appropriate username and password to gain
access to the MEB3.

If the “User” account is used and the operator attempts to modify a setting in the MEB3,
a pop-up notification will appear to announce that modifications are not allowed for this
user level. (See Figure 13.7)

Figure 13.6: Login Screen

MEB3 Manual 13 Web Server 110

 Figure 13.7 “User” attempting to modify settings

MEB3 Manual 13 Web Server 111

Home
Figure 13.8: Home

AJAX
Comms Status

Menu Tree

Login User ID

The typical web page includes an AJAX status box showing the state of the Javascript
communication between the browser and the MEB3. The background of this box turns
red when comm errors are occurring.
The menu tree may has the following branches: Home, Configuration, Tools, and Admin.
NOTE: Admin is not present when logged in as “user”.

Configuration
The Configuration menu provides access to the settings for Ethernet, Port 1, Port 2, and
Modbus Plus.

Ethernet
There are pages for setting the IP Address, Ethernet Protocol, IP Security, Modbus
Routing, TCP Client Routing, and I/O Scanner.

MEB3 Manual 13 Web Server 112

IP Settings
The IP Settings page allows the Admin to select the IP Parameters for the module.

MEB3 Manual 13 Web Server 113

Ethernet Port Parameters
This page allows the Admin to configure the MEB3 to operate in Modbus/TCP or
SY/MAX+Modbus/TCP mode and set the SY/MAX 802.3 drop number.

Security
The Security page allows the user to configure the inbound access control list, or ACL.
The ACL is a list of up to 256 rules that the MEB3 uses to determine if a new incoming
TCP connection will be allowed at the time of its request. This list allows the user to
allow certain IP addresses or groups of addresses. The rules use an IP address and a mask
to create a list of connections that will be allowed. The user can also at any time disable

MEB3 Manual 13 Web Server 114

a rule. This will usually result in blocking connection requests from the IP addresses in
that rule.
The figure below shows all the default entries, plus one added for reference. The first
two entries (0 and 1) are controlled by the front panel. When a user chooses the “ACL
Dsabl” from the front panel, these entries are set to “Accept TCP” for 15 minutes, and
will temporarily allow a connection on any port from any IP address.
The next two entries (2 and 3) may be controlled from the front panel or the web
interface. If enabled, they allow connections from any IP address at the specified port.
Entries 4 and 5 use the MEB3's IP address and subnet mask to create rules that would
allow connections from any IP address within the MEB3's subnet.
Entry 6 has been created as an example. This rule as shown will allow connections on
any device from subnet 192.168.10.x for Port 502 only.
Entry 7 has been created as another example. This rule will allow port 80 (web)
connections from only node 192.168.10.17 and any node on subnet 192.168.15.x (entry
5).
Entry 255 is a fixed entry that blocks all connections on all TCP ports that are not
specifically allowed by the active rules above it.

Modbus Routing for Ethernet Port

The Ethernet port has 253 entries in its Modbus Routing table. The Route typically
consists of the drop number of the outbound MEB3 port followed by any additional drops
needed to reach the target.

MEB3 Manual 13 Web Server 115

Each entry includes a “Mode” setting that can alter the incoming message including
offsetting the target memory locations.
• Other (Non-Priority SY/MAX) – Modbus messages are translated into Non-
Priorty SY/MAX messages.
• Modbus Pass-Through – Modbus messages are not altered.
• SY/MAX Priority – Modbus messages are translated into Priority SY/MAX
messages.
• Modbus Remap (Input Regs to Holding Regs) – Modbus Function Code 04
(Analog Input Read) messages are translated into Function Code 03 (Holding
Register Read). No register offsets are applied. All other Function Codes are
passed-through.
• Modbus Remap (3x reads access 4x, 1x reads 0x) – Modbus Function Code 04
(Analog Input Read) messages are translated into Function Code 03 (Holding
Register Read). Function Code 02 (Binary Input) messages are translated into
Function Code 01 (Coils). No register offsets are applied. All other Function
Codes are passed-through.
• Modbus Remap (3x reads access 4x, 1x reads 0x) with offset – Modbus Function
Code 04 (Read) messages are translated into Function Code 03 (Holding Register
Read). Function Code 02 (Binary Input) messages are translated into Function
Code 01 (Coils). Each address space may have its own offset configured.
◦ FC 01 (Read Coils) 0x Offset is added to the starting coil.
◦ FC 02 (Read Discrete Inputs) 1x Offset is added to the starting coil and the FC
is changed to 01.
◦ FC 03 (Read Holding Registers) 4x Offset is added to the starting register.
◦ FC 04 (Read Input Registers) 3x Offset is added to the starting register and the
FC is changed to 03.
◦ FC 05 (Write Single Coil) 0x Offset is added to the coil.
◦ FC 06 (Write Single Register) 4x Offset is added to the register.
◦ FC 15 (Write Multiple Coils) 0x Offset is added to the starting coil.
◦ FC 16 (Write Multiple Register) 4x Offset is added to the starting register.
◦ FC 22 (Mask Write Single Register) 4x Offset is added to the register.
◦ FC 23 (Read/Write Registers) 4x Offset is added to the read and write starting
registers.
• Modbus Pass-Through with offset - Each address space may have its own offset
configured.
◦ FC 01 (Read Coils) 0x Offset is added to the starting coil.

MEB3 Manual 13 Web Server 116

 ◦ FC 02 (Read Discrete Inputs) 1x Offset is added to the starting coil.
◦ FC 03 (Read Holding Registers) 4x Offset is added to the starting register.
◦ FC 04 (Read Input Registers) 3x Offset is added to the starting register.
◦ FC 05 (Write Single Coil) 0x Offset is added to the coil.
◦ FC 06 (Write Single Register) 4x Offset is added to the register.
◦ FC 15 (Write Multiple Coils) 0x Offset is added to the starting coil.
◦ FC 16 (Write Multiple Register) 4x Offset is added to the starting register.
◦ FC 22 (Mask Write Single Register) 4x Offset is added to the register.
◦ FC 23 (Read/Write Registers) 4x Offset is added to the read and write starting
registers.
NOTE: Entries with no route will allow that index to access the MEB3's internal
registers.
NOTE: Entries with the first drop in the route that does not match a drop number of any
port on the MEB3 will access the MEB3's internal registers.
NOTE: Using the Ethernet port's drop number as the first drop in the route will cause the
message to be routed back out the Ethernet port. This feature allows the MEB3 to
translate between Modbus/TCP and SY/MAX 802.3 Ethernet.
NOTE: Index 254 is reserved for FC 101 and FC 102 which are Niobrara special route
messages.

Figure 13.9: Offset Example shows routing table entries that use offsets. Entries 20 and
21 have the route of 90,20 which point the client back out the Ethernet port to an M580

MEB3 Manual 13 Web Server 117

CPU. Entries 22 and 23 have the route 21,22 which point to a Quantum CPU on Modbus
Plus.
The M580 CPU is 0-based while the Quantum is 1-based. So if a 1-based client uses the
yellow entries (20 and 22) it would access the same registers and coils as a 0-based client
using the blue entries (21 and 22).

Figure 13.9: Offset Example

TCP Routing Table

The TCP Routing table is used for Modbus/TCP Client operation. Messages routed to the
Ethernet port are inspected for the next drop number in the route. That drop number
points to the entry in this table for that target IP Address. If there are additional drops in
the route then the next drop will be the Destination Index for the client Modbus/TCP
message otherwise the “Downstream Drop” is used for the Destination Index.
NOTE: SY/MAX 802.3 Ethernet client operation is selected by setting the drop number
IP Address to 0.0.0.0.

MEB3 Manual 13 Web Server 118

The “Auto-Fill IP Table” button is used to apply the MEB3’s E1 IP Address matching the
4th octet to the entry’s index.

MEB3 Manual 13 Web Server 119

I/O Scanner
The MEB3 includes a Modbus/TCP I/O Scanner. This scanner allows automatic Read,
Write, and Read+Write time based messages to be generated between the MEB3 and up
to 128 Modbus TCP servers. I/O Scanner Read and Write Master Address operates on the
Mailbox registers (1-2048) in the MEB3's internal registers. The Modbus Plus Proxy
Mode determines the operation of the I/O Scanner.
• If the Modbus Plus Mode is set to MEBII then the I/O Scanner will send Reads
and Writes as long as it is enabled.
• If the Modbus Plus Mode is set to PROXY then the I/O Scanner Reads and Writes
will only operate when the Target PLC is connected and the PLC is in RUN.

Entries Per Socket

The “Entries Per Socket” defines the number of entries targeting the same IP Address that
are multi-threaded on a single socket. For example if 6 entries are targeting the same
remote IP Address and the “Entries Per Socket” is set to 4 then two sockets will be
opened to the remote target.

MEB3 Manual 13 Web Server 120

Health Block
The “Health Block Start Address” sets the MEB3 mailbox register where the 8 words of
health bits for the I/O Scanner starts. A Start Address = 0 disables the health block.
Each entry in the I/O Scanner has a health bit in these 8 words. Entry 1’s health bit will
be the Most Significant bit of the first word of the health block. Entry 128’s health bit
will be the Least Significant bit of the eighth word of the health block.
The “Health Block Register Space” is ignored. The Start Address is always in the 4x
Mailbox Registers.

I/O Disable Block

The “I/O Disable Block” is an optional 8 word block with one bit per entry that allows an
individual entry to be disabled when set. The Start Address is the Maibox 4x register in
the MEB3. The Register Space setting is ignored.

MEB3 Manual 13 Web Server 121

Serial Ports
Port Parameters
The Port Parameters page will show the settings for a given serial port. Various protocol
modes have different settings that may be displayed. Changing the protocol mode will
prompt the “Admin” to “Apply typical settings” for the new mode. Selecting “OK” will
change many of the settings to match the normal usage of the new mode.

MEB3 Manual 13 Web Server 122

Serial Port Modbus Routing Table
Each serial port includes its own 253 entry look-up table for Modbus Slave operation.

MEB3 Manual 13 Web Server 123

The first drop in the Route field is the drop number of the outbound MEB3 port. Just like
the Ethernet port, this table supports Mode will protocol changes and offsets.

Serial Port Auto Scan

Each serial port may be configured to automatically poll attached slave(s) on a timed
interval. This table provides the configuration for each of the 48 possible entries.
NOTE: The Auto Scan Table for port 2 is disabled when the MEB3 is in Hot Modbus
Plus operation.
NOTE: Port 2 Auto Scan may be used to generate read/write messages onto MB+ by
entering the MB+ port drop number as the first entry in the Route field.

MEB3 Manual 13 Web Server 124

Modbus Plus Port Parameters
The MB+ port settings may be altered on this page.

Drop
The “Drop” number for the Modbus Plus port is restricted to be in the range of 1 through
64 inclusive and must not match any other node number on the local Modbus Plus
network. This drop number must not match the drop number of either serial port or
Ethernet port within the MEB3.

On Ethernet
The “On Ethernet” setting may be used when the Ethernet port is set for “Modbus/TCP &
SY/ENET”. With this setting set to “YES” the MB+ port becomes a virtual SY/ENET
node.

Prog. Channel Timeout

The “Prog. Channel Timeout” is the number of minutes that the MEB3 will leave an idle
984 Programming Channel open. This setting does not apply to Control Expert (Unity)
programming as Unity uses Data channels and not Programming channels.

MEB3 Manual 13 Web Server 125

Reply Timeout
The “Reply Timeout” setting is in cS units. The default of 1000 equates to 10.00
seconds.

Modbus Plus Global Data (MEBII Mode)

The MEB3 may be configured to publish up to 32 words of data from its mailbox
registers (Holding Registers 1-2048) as port of MB+ Global Data when the port is in
MEBII mode. It may also be configured to subscribe to the Global Data outputs of each
of the other 63 nodes on the MB+ network. The subscription data will be placed in the
mailbox registers of the MEB3.
NOTE: Hot Modbus Plus operation uses the Global Data output and is thus not available
for customer use while in MEBII mode.

MEB3 Manual 13 Web Server 126

Proxy
MEBII Mode
The factory default setting for the Modbus Plus port is MEBII Mode. In this mode, Peer
Cop is disabled and routing from Modbus Plus masters is done with the MEBII
requirement of the drop number following the MB+ port to be in the range of 1-8.

PLC Proxy Mode

Proxy mode enabled turns on Peer Cop (Global Data and Specific Data), provides
tunneled Modbus Plus data to the Target PLC, and full drop routing from Modbus Plus.

MEB3 Manual 13 Web Server 127

Proxy Config
Note: The “Proxy Run” must be set to “Config” to edit any of the Proxy settings
including Global Data, Specific In, and Specific Out.

Proxy Enable
Two options for Proxy Enable are “MEBII Mode” and “PLC Proxy Mode”. Setting to
PLC Proxy Mode enables the “PLC Proxy” menu tree.

Proxy Run
• “Config” stops all Proxy Modbus Plus outputs (Global Data and Specific Output).
• “Config” allows editing of all Proxy settings.
• Modbus Plus traffic routed to the MEB3’s drop is routed to the Dest IP target in
both “Config” and “Run” modes.
• “Run” enables Global Data Outputs and Specific Outputs.
• “Run” enables writing of the PLC Status Block and TICK.

Routing Mode
“Direct to Modbus/TCP” routes incoming Modbus Plus messages that terminate in the
MEB3’s drop number to the target PLC on Modbus/TCP Ethernet at “Dest IP” using
“Index”. All Peer Cop read and write messages use this connection. Writing of the PLC
Status Block and TICK use this connection as well as the UMAS query to determine
RUN/STOP status of the target PLC.
“Route” allows the user to define a full 8 drop route to point to the target PLC using
networks other than Ethernet. For example, the target PLC could be connected to one fo
the serial ports of the MEB3. This feature would rarely be used but would be selected by
clicking on the “Enable Routing Mode” button at the bottom of the web page.

Dest IP
The “Dest IP” setting is the IP Address of the target PLC. This value is shown when
“Direct to Modbus/TCP” Routing is selected. This must be a hard-coded IPv4 address.

Index
The “Index” setting is the Modbus/TCP destination index for the target PLC. Normally
this would be set to 0 or 255 if the target is the CPU’s Ethernet port or NOC. Valid values
are 0-255. This value is shown when “Direct to Modbus/TCP” Routing is selected.

Route
The “Route” setting is the comma separated route to the target PLC when “Route”
Routing mode is selected. The route may be up to 8 drops.

MEB3 Manual 13 Web Server 128

PLC Status Timeout (ms)
This value sets the time limit for a response for the UMAS PLC Status query generated
by the MEB3 to the target PLC. This query determines if the target PLC is in
RUN/STOP. The default value is 500mS.

Inputs Timeout (ms)

This value sets the time limit for a valid update via Modbus Plus for Global Data Inputs
or Specific Data Inputs. If the particular input is not updated before this timer expires
then the “Comms Loss Action” is applied and the status bit for that input is cleared. The
default value is 1000mS.

Comms Loss Action

When set to “Zero”, the MEB3 will zero Global Data Inputs and Specific Data Inputs that
are offline. “Hold Last Value” means that the data will not be changed. The default is
“Hold Last Value”.

Status Block
The status block is a group of 12 16-bit integers that provide a bit-map of the online
status of the Global Inputs, Specific Outputs, and Specific Inputs. Bit 0 of word 0 is the
status of Global Input for Node 1. A bit value of 1 indicates that the Node data is healthy.
The status block is disabled by default.

Table 13.1: Status Block

Group Word Bit-to-Network Node Relationship
Global Input 0 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
1 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17
2 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33
3 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49
Specific 4 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
Output 5 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17
6 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33
7 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49
Specific 8 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
Input 9 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17
10 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33
11 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49

PLC Status Block Addresses

This setting locates the %MW address for the beginning of the 12 word Health Status

MEB3 Manual 13 Web Server 129

Block written by the MEB3 to the target PLC.

Status Freshness TICK

The MEB3 can write to the target PLC a word of status about the MEB3 itself. This data
is split into two bytes. The Most Significant Byte of the data is the state of the Modbus
Plus network while the Least Significant Byte is an 8-bit counter that increments with
each write of the data to the target PLC. This counter may be used as a watchdog by the
PLC to ensure that the connection from the MEB3 is active.

Table 13.2: TICK Description

MSB LSB Example Example
Value Value
(Dec) (Hex)
Meaning MB+ State Counter
0=Monitor 0-255
1=Normal (0-xFF)
2=No Token
3=Sole Station
4=Duplicate Drop
5=Reset
Duplicate Drop, Count = 123 4 123 (x7B) 1147 x047B
Normal, Count = 124 1 124 (x7C) 380 x017C
Monitor, Count = 255 0 255 (xFF) 255 x00FF
Sole Station, Count = 0 3 0 (x00) 768 x0300
Reset, Count = 1 5 1 (x01) 1281 x0501

TICK Location
The TICK work may be “Attached to Status Struct” as the 13 th word of the block or it
may be “Separately Located”. It is recommended that TICK be attached to the Health
Block Structure if possible to minimize the number of messages to be written to the target
PLC.

PLC TICK Address

If the TICK word is “Separately Located” then this is the %MW address for the TICK
word to be written in the target PLC.

Offset PLC Address

The MEB3 may be configured to alter read and write messages arriving from Modbus
Plus sent to the target PLC. This may be useful when replacing a 1-based PLC (Quantum
or Compact 984) with a 0-based PLC (M340 or M580).
The following example shows the Mapping for replacing a Schneider Electric Proxy with
Legacy Compatibility Offset Enabled. 3x reads are remapped to 4x reads offset by 2049

MEB3 Manual 13 Web Server 130

and 1x reads are remapped to 0x coils offset by 2049.

Enable Routing Mode or Enable IP Direct Mode

This button toggles the Routing Mode between Routing and IP Direct.

Global Data
The Global Data page of the Proxy Settings is used to configure both Global Data Output
(Publish) and Global Data Input (Subscribe). These settings may only be modified while
the Proxy is set for “Config”.

Global Data Out

As part of the Peer Cop operation, the MEB3 may read a block of up to 32 words of data
from the target PLC and publish this data as Global Data on Modbus Plus. This data may
be subscribed by any other node on the local Modbus Plus network. Global Data does
not pass through Bridge Plus routers.
• The target PLC source may be %MW or %M located variables.
• The length of day may be set from 0 (disabled) to 32 words.
• If the source is %MW then the data may be published as straight binary (BIN) or
BCD. The MEB3 automatically converts the binary source data into BCD before
publishing onto Modbus Plus.
• This data is published onto Modbus Plus as long as the MEB3 is actively
communicating with the target PLC and the target PLC is in RUN.

MEB3 Manual 13 Web Server 131

Figure 13.10: Global Data Out

Global Data In
The MEB3 may be configured to subscribe to Global Data published by any of the
possible 63 other Modbus Plus nodes on the local network. Each node on the network
may publish up to 32 words of Global Data Output. The MEB3 has the ability to extract
all or part of the Global Data Output from specific nodes and write that data into the
target PLC.
• Dest Ref is the %MW (or %M) starting address in the target PLC.
• Index is the word offset within the block of published Global Data. This setting
may be from 1 to the number of words actually published by the remote node. The
maximum value is 32.
• Word Count is the number of 16-bit words for the subfield. 0 = disabled.
• Bin/BCD is used only for %MW and if set to BCD, the MEB3 converts the BCD
value from the Global Data input to binary before writing to the target PLC.

MEB3 Manual 13 Web Server 132

Figure 13.11: Global Data In

NOTE: Although each node supports up to 8 subfields of data extraction, keep in mind
that each subfield may result in a separate Modbus/TCP write from the MEB3 to the
target PLC. This multiple subfield configuration made sense on a Quantum PLC where
the CPU MB+ (or NOM) could do direct memory writes at the end of the scan. This is
terribly inefficient when the MEB3 must do multiple Modbus/TCP writes. A better
solution is to do a single subfield of all of the Global Data for a given node and use PLC
code to move subfields within its own memory.

Specific Out
The MEB3 in Proxy mode may publish up to 500 words of data as Specific Outputs onto
Modbus Plus. Each node on the local Modbus Plus network may be a possible target for
Specific Outputs.
• The table includes a row for each Destination Node.
• The source Data Type may be %MW or %M in the source PLC.
• The Source Ref. Is the %MW or %M starting address in the PLC. %M starting
address are not restricted to 16-bit boundaries.
• The maximum number of words for each target node32 is 32.
• If the Source Ref is %MW then the MEB3 may do a BIN/BCD conversion
automatically.

MEB3 Manual 13 Web Server 133

Specific In
The MEB3 in Proxy mode may subscribe to up to 500 words of data as Specific Inputs
from Modbus Plus. Each node on the local Modbus Plus network may be a possible
source for Specific Inputs.
• The table includes a row for each Source Node.
• The Data Type may be %MW or %M in the target PLC.
• The Dest. Ref. Is the %MW or %M starting address in the PLC. %M starting
address are not restricted to 16-bit boundaries.
• The maximum number of words from each source node is 32.
• If the Dest. Ref. is %MW then the MEB3 may do a BIN/BCD conversion
automatically.

MEB3 Manual 13 Web Server 134

Statistics
Pages are provided for statistical counter pages for each port.
Many of these pages have “Reset Counter” buttons that allow either the “User” or
“Admin” to zero the counters.
Some counters have an * which means that nonzero values in these counters usually
indicate a problem. Many of these counters have their background color change from
white to red when nonzero.
NOTE: These counters are typically unsigned words and will roll over from 65535 to 0
with no indication that a rollover has occurred.
NOTE: These counters do not survive a power cycle/reboot.

MEB3 Manual 13 Web Server 135

Ethernet Router Stats

MEB3 Manual 13 Web Server 136

The Ethernet Router page shows counters for the Modbus/SY/MAX router for this port.
The top table shows overall counters for the port.

The lower table shows counters for the Modbus/TCP sockets. The MEB3 has 64 sockets
for Modbus/TCP. This pool of sockets is used for both client and server connections.
• The “Address” column is the remote IP Address for the socket. A value of 0.0.0.0
indicates that the socket is not active.
• The “Last Accessed Index” shows the most recent Destination Index (Modbus
Slave) for the socket.

MEB3 Manual 13 Web Server 137

 • The “Last Error Index” shows the Destination Index for the most recent Modbus
Exception Code for the socket. “---” is displayed if no errors have yet occurred.
• The “Last Error Code” shows the most recent Modbus Exception (Error Code) for
the socket. 0 is displayed if no errors have occurred.
• The C/S column shows a “C” for a client connection and “S” for server.
• “Connection Time” is the number of seconds the socket has been active.
• “Message Count” is the number of messages processed through the socket.

SY/MAX 802.3 Ethernet Nodes

This table shows all of the visible SY/MAX Ethernet devices on the MEB3's local
Ethernet network.
NOTE: The MEB3 Ethernet port must be set for SY/MAX+Modbus mode for this table
to be accurate.
Any SY/MAX Ethernet drop number occupied by this MEB3 is highlighted in green.
This includes any serial port or the MB+ port that is set for “ON Ethernet YES”. Serial
ports that have a drop number greater than 100 and configured for “ON Ethernet YES”
will also consume the SY/MAX drop number minus 100.
The “Rescan” button will cause the MEB3 to generate the multicast
Drop Number of peer devices are highlighted in blue.

MEB3 Manual 13 Web Server 138

MEB3 Manual 13 Web Server 139
Serial Port
Serial ports 1 and 2 have counter pages to show the SY/MAX / Modbus router
information associated with that port.

MEB3 Manual 13 Web Server 140

Port 2 Hot Modbus Statistics
The statistics page for Port 2 is different when the MEB3 is configured for Hot Modbus
Plus operation.

MEB3 Manual 13 Web Server 141

Modbus Plus Router
The Router statistics page shows the normal Modbus router counters for the MB+ port.

MEB3 Manual 13 Web Server 142

MEB3 Manual 13 Web Server 143
MB+ Chipset
The MB+ Chipset page shows information provided by the MB+ chipset. These counters
are not resettable.

MEB3 Manual 13 Web Server 144

Modbus Plus Nodes
This table shows all possible 64 MB+ stations on the MEB3's local MB+ network. The
MEB3's drop number is highlighted in green. All other visible nodes are highlighted in
blue.

Proxy

MEB3 Manual 13 Web Server 145

Module Info
The Module Info page shows the MEB3's serial number and various firmware versions.

MEB3 Manual 13 Web Server 146

Config Overview
The Config Overview page provides a complete listing of all of the configuration of the
MEB3. This page may be printed to provide a hard copy of the module's setup.
Note: This page takes several seconds to populate. At the end of the configuration is a
text line “This is the end of the Configuration Listing.”

Register Viewer
The Register Viewer allows the User or Admin to view/modify register data in a target.
The Target is determined using the Modbus Routing Table Index for the Ethernet Port.
NOTE: The present fimware only allows access to Modbus Index 255 (the MEB3 itself).
Access to 4x (Holding Registers) or 6x (Files) are supported.

MEB3 Manual 13 Web Server 147

Multiple viewing windows may be opened. Windows may be closed by clicking the “X”
in the upper left corner of the window. The polling rate of each viewing window is
adjustable with the pull-down in the upper corner of each window.

MEB3 Manual 13 Web Server 148

MbTCP Logger
The MEB3 offers the ability to log Modbus/TCP data that is coming in or going out of
the Ethernet port. On inbound connections, the user selects from a pull down menu the
entry in the Modbus routing table for the Ethernet port to monitor. Once the entry is
selected, the user will click the “Enable” button to start the capture. While that logging is
enabled, the user may select another indexes, and enable them at the same time.
For outbound connections, the user selects and index in the TCP routing table, then clicks
“Enable.” This will capture all Modbus/TCP traffic between the MEB3 and the device at
the IP address to which the TCP table entry points.
In both cases, clicking “Disable All” will stop all data logging for all connections.
Clicking “Reset Log” will erase all logged traffic that had been stored.

MEB3 Manual 13 Web Server 149

Once data has been logged, the user can click on the “Log File” link to view the captured
data in the browser window. Right-click the link to save the data to a text file, which
could be emailed to NR&D technical support for analysis.

MEB3 Manual 13 Web Server 150

Admin Menu
The Admin menu heading is only shown when the “Admin” account is used for the web
login.

Set Passwords
The Set Passwords page allows the Administrator to modify the “Admin” and/or “User”
passwords.

MEB3 Manual 13 Web Server 151

Global Configuration
The “Global Configuration” page allows the Admin to adjust items that pertain to the
entire module. At this point the “User Label” is the only value set on this page. The User
Label is shown on the title bar of each web page and the splash screen of the LCD.

MEB3 Manual 13 Web Server 152

Configuration Backup
The configuration of the MEB3 may be pulled from the MEB3 and saved as an XML file
on the PC. The common method is to right click the “here” link and choose “Save Link
As...” or “Save Target As...” and then save the file.
The default filename is of the form: config_192_168_15_241.MEB3 where
192.168.15.241 is the IP Address of the MEB3 in question.

Configuration Restore
The Restore link will allow the Admin to restore a previously saved backup file to the
MEB3. The upper “File Name” selector is for downloading a full .MEB3 backup file. A
complete factory default is done before the restoration is started. All IP settings and

MEB3 Manual 13 Web Server 153

passwords will be set to those in the .MEB3 file.
The lower “Partial Restore File Name” selector is for downloading a “partial
restore” .MEB3 file. The “partial” restore file is built from a Niobrara Utility program
such as “Extract_NOM.EXE” and these files usually just include Peer Cop
configurations. This “partial” file does not reset the MEB3 to factory defaults before
doing the restore function. Therefore, IP settings and passwords are not altered.

Hot Modbus Plus

The Hot Modbus Plus page may be used to initialize the MEB3 as the first Primary or
Secondary unit.

MEB3 Manual 13 Web Server 154

Firmware Update
The Firmware Update page allows the Admin to install a new version of the MEB3.qrc
file.
NOTE: It is always recommended that a new backup of the MEB3 configuration be done
before updating the firmware.
The new firmware is usually installed in the c:\Niobrara\Firmware\ folder.

MEB3 Manual 13 Web Server 155

Reset to Factory Defaults
The MEB3 may be reset to Factory Defaults by typing “YES” into the text field.
Resetting to Factory using this web page will keep the current Ethernet settings (IP
Address, Subnet Mask, Default Gateway, and ACL table) and Web Passwords but will
revert all other settings to factory default.
NOTE: Resetting the MEB3 to Factory Default using the front panel LCD will also
revert the IP settings to 10.10.10.10, reset the web server passwords so the temporary
password must be entered.

MEB3 Manual 13 Web Server 156

MEB3 Manual 13 Web Server 157
 14 Utilities
MBP_EXTRACT.EXE
This utility is used to modify a QUANTUM .ZEF project file from EcoStruxure Control
Expert (ECE) or Unity Pro to remove the Modbus Plus configuration and convert it to a
useful format for the M580. The utility steps through the original file to find all Peer Cop
configuration for the native CPU MB+ port and any NOM 212 XX modules. Global
Data Inputs and Outputs, Specific Data Inputs and Outputs, and Quantum DIO racks are
found and removed from the configuration.
This program will provide configuration for an MEB3 that will replace the Quantum
CPU MB+ port. Configuration for additional MEB3 units will be provided for each
NOM card in the CPU rack. Up to 3 NOMs are supported and are numbered NOM1,
NOM2, and NOM3 with NOM1 being the NOM with the lowest slot number. If there are
more than 3 NOM modules configured in the rack then the remaining NOMs are ignored.
The source file must be a .ZEF. If you have a .XEF file then import it into ECE and do a
new export as a .ZEF.

Command Line Options

MBP_EXTRACT uses command line options that start with the “-’ character and must be
separated by a space. The case of the command is ignored.
The first option should be the filename of the zef. The target file that is built will be this
original filename with “_MBP” added to the end of the root of the name.
-OFFSET will automatically adjust the starting location for the mailbox %MW blocks by
1 to align with %SW141 = 1 set by UMAC.
-CPUIPa.b.c.d will define the M580 replacement CPU’s IP Address. This IP Address
will be the Proxy Target for all MEB3s.
-CPUNODEx will define the Modbus/TCP index used by each MEB3 for the Proxy
Target. This value defaults to 0 and is not required.
-CPUMEB3IPa.b.c.d will define the IP Address of a.b.c.d to the MEB3 that is replacing
the Quantum CPU MB+ port.
-CPUMEB3DROPx with set the MEB3 MB+ drop number to x for the MEB3 that is

MEB3 Manual 159

replacing the Quantum CPU MB+ port. This value should match the rotary switches (or
LCD setting) of the Quantum CPU.
-NOM1MEB3IPa.b.c.d will define the IP Address of a.b.c.d to the MEB3 that is
replacing the first NOM. NOM1 is the lowest slot number of any NOM in the rack.
-NOM1MEB3DROPx will define the MEB3 MB+ drop number to x for the MEB3 that
is replacing the first NOM.
-NOM2MEB3IPa.b.c.d will define the IP Address of a.b.c.d to the MEB3 that is
replacing the second NOM. NOM2 is the second lowest slot number of any NOM in the
rack.
-NOM2MEB3DROPx will define the MEB3 MB+ drop number to x for the MEB3 that
is replacing the second NOM.
-NOM3MEB3IPa.b.c.d will define the IP Address of a.b.c.d to the MEB3 that is
replacing the third NOM. NOM3 is the third lowest slot number of any NOM in the rack.
-NOM3MEB3DROPx will define the MEB3 MB+ drop number to x for the MEB3 that
is replacing the third NOM.

Command line Example

A Quantum CPU at MB+ node 18 with a NOM at MB+ node 60 is to be replaced by an
M580 at 192.168.15.20. Two MEB3s will be used with the one replacing the CPU at
192.168.15.18 and its MB+ set to 18. The second will replace the NOM at 192.168.15.19
and its MB+ set to 60. The source file is “qtest.ZEF” and UMAC will be setting
%SW141 = 1 so -offset will be used.
>mbp_extract qtest.ZEF -cpuip192.168.15.20 -cpumeb3ip192.168.15.18 -cpumeb3drop18 -nom1meb3ip192.168.15.19 -nom1meb3drop60 -offset

The resulting filename will be “qtest_MBP.ZEF” This file will be opened within UMAC
to generate the M580 zef.
MBP_EXTRACT generates a folder same name as the original filename. Inside this
folder are the MEB3 partial restore configuration files for each of the MEB3s and a few
files for troubleshooting.
For the above example the folder \qtest\ contains the following files:
Directory of C:\Niobrara\MEB3\QTEST
02/21/2025 02:48 PM 24,992 convertnotes.txt
02/21/2025 02:48 PM <DIR> DTM
02/21/2025 02:00 PM 89 DtmAuditRecord.xml
02/21/2025 02:48 PM 942 MEB3_192_168_15_18_Partial_Restore.meb3
02/21/2025 02:48 PM 1,198 MEB3_192_168_15_19_Partial_Restore.meb3
02/21/2025 02:48 PM 4,992 MW_Register_List.txt
02/21/2025 02:00 PM 139,309 orig_unitpro.xef
02/21/2025 02:00 PM 67,604 Project_Definition.xpdf
02/21/2025 02:00 PM 410 props.xml
02/21/2025 02:48 PM 4,242 qbus.txt
02/21/2025 02:48 PM 96,538 unitpro.xef
10 File(s) 340,316 bytes

MEB3 Manual 14 Utilities 160

The file “convertnotes.txt” gives a text description of all MB+ head units found, any
QDIO networks found and the module descriptions of each rack, and any Peer Cop
settings (Specific Inputs, Outputs, Global Data Inputs, or Outputs).
“MW_Register_List”.txt is a summary of all %MW registers used in the project.
“MEB3_192_168_15_18_Partial_Restore.meb3” is the Partial Restore file for the MEB3
that replaces the Quantum CPU.
“MEB3_192_168_15_19_Partial_Restore.meb3” is the Partial Restore file for the MEB3
that replaces the NOM.

PLC Segments, Structures, and DFBs Added

MBP_EXTRACT removes an NOMs and MB+ related configuration from the original
ZEF. It also adds several data structures to store the MB+ related Quantum configuration
and several DFBs and program sections (if needed).
MBP_Extract searches through the original ZEF and builds a list of all assigned %MW
registers. If there is room near the top of the %MW memory it will claim blocks of these
registers for a mailbox used by each MEB3 to exchange data with the M580. The size of
these blocks depends upon the MB+ configuration in the original Quantum. At a
minimum there will be a MEB3_Health block of 13 words for each MEB3. If other
configuration was present then additional blocks are added. The PLC Inputs (data written
to the M580 from the MEB3) are grouped together while the PLC Outputs (data read
from the M580 by the MEB3) are in the next group. This allows a minimum of
communication messages between the MEB3 and the M580. Each data block is named
with a reference to the original slot number of the head (CPU or NOM) and the MB+
node of the target MEB3. Possible data blocks are shown below:
• Health (PLC Input)
• Global Data In (PLC Input)
• Specific Data In (PLC Input)
• QDIO Data In (PLC Input)
• Global Data Out (PLC Output)
• Specific Data Out (PLC Output)
• QDIO Data Out (PLC Output)

MEB3 Manual 14 Utilities 161

In the previous example Head Slot 2 was the Quantum CPU and Head Slot 4 was the
NOM. The CPU MB+ port had no Peer Cop or QDIO networks attached so it only has
the MEB3_Hs4_Hn18_Health block variable. The NOM had Global Data, Specific Data,
and QDIO so it has block variables for each of these groups.
The original Quantum application had 3 QDIO racks connected to the NOM network. It
also included Global Data from Node 178 and Specific Data settings for Nodes 45 and
47.

The original source had two simple sections;

MEB3 Manual 14 Utilities 162

After the conversion to the M580 is complete new segments were added for both MEB3
units.

The Config sections include a DFB for Watchdog operation and if QDIO is present the
section also includes a DFB for each QDIO rack. These configuration sections as well as
the Input_Assign sections for the Global Data In, Specific Data In, and QDIO In are all
added above the original two program sections.

MEB3 Manual 14 Utilities 163

The Specific Data In is for the Node 45 and 47 Input data.

Each segment copies the mailbox data to the original %I, %IW, %M, or %MW location
and does BCD conversion if needed.
Each QDIO rack with input cards will have a section added for assigning the original %I
and %IW data from the rack.

MEB3 Manual 14 Utilities 164

After the original sections, there are now Output assignment sections added for Global
Data Out, Specific Data Out, and QDIO data Out.

Configuration Structures
Each MEB3 has a configuration structure assigned. This structure is used by the M580
code to send QDIO configuration messages to each rack. It is also used by MBP_MSTR
replacement DFBs for former MB+ read and write messages. If it is necessary to change
the MEB3’s IP address then simply modify the initial value in the structure.

MEB3 Manual 14 Utilities 165

If QDIO racks are included then a configuration structure for each rack is added. Each
rack has configuration data for all possible 16 slots. Use caution in modifying this setup.

QDIO_CONFIG.EXE
This command line utility may be used to read the running configuration from a QDIO
rack through a MEB3.

In the following example, an MEB3 has been added to a MB+ network consisting of a
Quantum CPU at node 1and three CRA QDIO racks at nodes 2, 3, and 4. The MEB3 is
set to node 5 since that node was not used on the network. The MEB3 is set to IP
Address 192.168.10.5 and is on the same subnet as the PC.

MEB3 Manual 14 Utilities 166

 CRA #2 CRA #3 NOM #60 CRA #4

MEB3 #5

192.168.10.5

QDIO

C:\Niobrara\MEB3>qdio_config 192.168.10.5 2
Starting this program will create a text file with the IP Address and Index in the filename.

MEB3 Manual 14 Utilities 167

It is highly recommended that each CRA setup be documented while still in control of the
original Quantum PLC.

PROXY_EXTRACT.EXE
This command line utility may be used to read the running configuration from a SE
Proxy and build a full MEB3 configuration file to make a drop-in replacement for the SE
Proxy.
Connect the PC to the Proxy’s Ethernet network. Start the program with the IP Address
of the Proxy.
C:\Niobrara\MEB3>proxy_extract 192.168.15.121
A Modbus/TCP connection is established and the setup of the Proxy is extracted and a
new “_Partial_Restore” setup file for the MEB3 is created. Two additional text files are
created that give a register based and textual description of the Proxy setup.

A quick view of the .txt file shows the actual configuration.

MEB3 Manual 14 Utilities 168

To finish the installation do these steps:
1. Reset the MEB3 to factory defaults through the front panel by selecting “System
> Factory” and then “Defaults”.

MEB3 Manual 14 Utilities 169

 2. Select “System > WWW” to enable the web server.
3. Select “System > Password” to find the temporary password. Note this value
including the “-”. It will be of the form 123-456.
4. Connect to the IP Address (10.10.10.10) web server on port 80. Enter the
temporary password.

5. Enter new Admin and User passwords.

6. Click on the “Click Here” link to proceed.

MEB3 Manual 14 Utilities 170

 7. Click on the “Store to EEPROM” link.

8. Click on “Admin > Restore”.

9. Click on “Partial Restore Filename Choose File” button and Select the
Proxy_ip_index_Partial_Restore.meb3 file.

10. Click the “Start Configure” button.

MEB3 Manual 14 Utilities 171

 11. The MEB3 will then reboot at the new IP Address with the new Proxy
configuration but still keep the Admin and User passwords.

12. Be sure to do the “Store to EEPROM” after completing the upload.

MEB3 Manual 14 Utilities 172

At this point you can inspect the Proxy settings to verify that they match the original SE
hardware.

MEB3 Manual 14 Utilities 173

MEB3 Manual 14 Utilities 174