Read Ladder prg witout comments

Hello Everybody
I am a Tech officer in an educational institute and try to revive a PLC course. We have AB SLC 5/02 and 5/03 PLC's and when uploading from one unit a got a program which I would like to know what it does. What is the professional way to analyze and read such ladder program and where to you start?
Further question would be on the SLC 5/02 processor card is a large empty socket. What is this for?
Have this PLC's an RTC or is this an extra module/insert?

If anybody can help, thanks in advance.

Regards
Alf

there are no comments because you aren't viewing the original program. As far as what the program does, it could be anything from a garage door opener, to a sequental space shuttle launch. Without viewing it, and seeing what the PLC is connected to, there is no way of knowing.

as far as the empty slots in the rack, it is for other cards.

I think Alfred is referring to the IC socket on the processor's board. This can be used for EEPROM (programmable in place on the card) or a UVPROM (which must be programmed off the card). Otherwise the program is held in battery backed memory which isn't the most reliable in sudden outages. The CPU can be set up to read that stored program and data on every power up, when its battery-backed memory experieces a problem (checksum error) or only on programmer command.

Hi Alfred,


You definately need to know what the program is controlling before you can figure what the program does. What's connected to the I/O is your first step.

I think that there is a socket on the SLC 5/02 processors for a memory module.

On SLC 5/03 and higher, registers S:37 through S:42 are Year, Month, Day, Hour, Minute, and Second.

Programming Manual:

http://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1747-rm001_-en-p.pdf


I hope this helps.

Sooo many replies in this short time. Fantastic.
Yes, I know that if you dont have the original program you have no comments. I am just asking for ideas how to make from a ladder prg. a flowchart.
The program is in a "training PLC" and all inputs are switches and outputs are LED's only.
Thanks for mentioning the batterie backup problem, the Lithium batterie is dated 93 and still holding the memory.
If I understand correctly the RTC is built into SLC 5/03 and above but what to you do in SLC 5/02 if RTC is needed?

Thank you all and regards
Alfred

You can program your own using a TON that measures seconds, then ADD or CTU (I prefer the ADD to end up with consecutive integers) with compare instructions and roll-over handling to simulate what the real time clock would do. Use a separate integer for seconds, minutes, hours and day. Months can get complicated but I have read about solutions for that too. Just search the forums.

For a timer where I'm conerned about the accumulation of error or other inaccuracy, I program it like this.
XIO T4:0/DN TON T4:0 .01 32767 0
GEQ T4:0.ACC 100 SUB T4:0.ACC T4:0.PRE T4:0.ACC

I recommend using the subtract method above to reset the preset value of the timer using the GEQ instead of the DN bit. You can program your own done bit by placing a coil in parallel with the SUB. Note that your done bit will essentially be a oneshot since Source A in the GEQ is decremented as soon as it's true.

The reason for this odd looking code: If you subtract the timer preset from the accumulator, you preserve those hundredths of seconds that get lost if you just RESet following a Done condtion. The TON instruction preserves the "overrun" in the ACC when the done bit is set, and you can then do the SUB, but then I THINK you must unlatch the DN bit to ensure that the timer will continue timing. I'M WORKING FROM MEMORY, SO SOMEONE PLEASE CONFIRM OR CORRECT THAT LAST STATEMENT!

Place this "Subtract to reset" code immediatley AFTER the TON instruction which updates the timer element. So you're inaccuracy is limited to the execution time of very few instructions which are repeatable.

I think I usually set the PRE to 32767 and use a GEQ to test for > 1 second ignoring the DN bit altogether ... can't remember for sure.

In real world applications, I've seen the timer ACC exceed the PRE by .08 sec regularly! Usually it's only a few hundredths, but that's a huge problem for a homemade RTC that will accumulate these errors 24/7.

It won't affect a training course, but students should see alternative ways of programming because in the field with >20ms scan times and comms etc, the programs they deal with are going to be polished off with code like this.

If you get a chance, maybe you could test it both ways and let us know how much bigger the error could be with the XIC T4:0/DN RES T4:0 code that is commonly used compared to what I have above.

PaulC.
Hope this is accurate and helps you!

Alfred,

What you are trying to do is reverse engineer the program's comments. If you have a schematic diagram this is the place to start. If you don't have the schematic, then your first task is to make one by tracing all of the wiring to and from the plc and assigning a name to every device. If the wires are not numbered, this is a good time to add those also.

Whether found or created, you then start by adding the names of all of the devices as comments to the input and output address in the PLC program. At this point I like to make a hard copy and stare at it for a good long while. One of the real nice features of RSLogix is the ability to add cross reference information for a device right under that device everywhere it appears in the printout. Make sure this is turned on in the report options!

Hopefully you understand ladder and since this is a training program hopefully it won't be too complex. As you go through the ladder over and over, you have to deduce what the unnamed bits and registers are. (Maybe, after your eyes get crossed from staring at naked ladder, play a game or two of Su doku to brush up on deductive logic )

When you have added another bank of comments, do another print out with these comments and go again. In the end, you may just end up writing your own program as you find things you do and don't like about the existing one.

Good luck and if you get stuck, there is always the site here where you can post some code and ask people here what they think it does. Chances are, if someone here hasn't seen it before, it doesn't need to be done. :site:

Greetings Alfred,



and welcome to the forum ...



the existing program is quite probably just some student’s homework assignment from a previous class ... after you’ve been through it, why don’t you just zip up the .RSS file and post it here? ... we’d be glad to take a look at it for you and see if we come up with the same analysis that you do ...

Thank you for the offer of having a look at this file. The idea to convert to a schematic slipped my mind. OkiePC's approch looks complicated and most likely somebody have written a subroutin to do this job already but would this suitable for the task I have in mind. I would like to controll any kind of plant/lights/heating which at the moment is activated on public holidays because people forgett or have no simple means to controll them. Today is Australia Day and I would be able to visit sites where the stairwell and underground carpark lights are fully ON and NOBODY, not even the cleaner is there. I know this for sure because I have installed the timeclocks to controll this and it is based on a weakly cycle. Now to convince my customers to use some more sophisticated controlls I will have to work out a pay back time which I have not done yet but it would to a bit for the environment.
I am off to celebrate Australia Day now and have breakfast on the ACT goverments account at the Lake.

Regards
Alfred

RSS file

I like to take up the offer and upload the file in question.
Do I have to change the file extension from rss to something different to be able to upload?

Regards
Alfred

no...just put it in a zip file and upload it. Most of us have access to RSLogix, either on our laptops, or on workstations.

Alfred,

If you don't want to bother with ZIP (compressing it), then just change the file name from *.RSS to *.ZIP, and make a note in your post that the extension must be changed back to RSS after downloading.

ALso if you have one of those old SLC DEMO training models, you can tell a lot about how the program was intended to work by matching up the Input switches. If I remember, the first 6 were Normally Open momentary switches, Inputs I:1/0 to I:1/3, I:2/0, I:2/1, I think, and the last 5 were 2-position selector switches, I:2/2 to I:2/7.

You could start "documenting" your program by going and labeling what type of switch for each Input. By the time you get through doing this, you will probably see a pattern that will help you figure out what it does. The Outputs on the DEMO units were all lights form O:3/0 to O:3/7.

P.S. A good guess (based on student questions to this forum) is that it is a Traffic Light program!

I have misslayed my Winzip on a CD but the renaming is quick.
Attached is a zip file which actually is an rss file. Just change the file extension to rss and load in in RSLogix. I dont think it is a traffic light but i am looking forward to the experts conclusion.

Regards
Alfred

Alfred,

I think it is a class assignment called "ADVANCED ASSignment-ALFred". It is some type of Liquid Level Control, using two motors (Pumps?). It also has an Alternator that switches the Lead Pump each cycle. It has an analog Level input that controls the liquid between 1800 and 2200. If the level drops below 800, the second Lag Pump starts up. It has an Auto-Start function that uses the PLC Clock and Calendar to automatically start the pump system on certain days from 6:37 AM to 8:52 PM. It also has manual Start and Stop buttons, and Level Switch Inputs that automatically stop the pumps and alternate the lead funciton.

The attached file contains my comments based on my quick analysis of the program. The *.ZIP file is really a *.RSS file. Just save it then change the name.

Now please tell us what you plan to do with this? I saw things that looked flaky. It probably is an old student program, with all the poor programming that students usually do. WARNING! I hope that you do not try to use it like it is now. I had very few clues to go with. It could be something totally different.

"ADVANCED ASSignment-ALFred".

The ADVANCED *** is the default file name and the ALF is just to remind me is my download.
I will now find the execise panel I have heard about, consisting of pumps, tanks and float switches but never seen used. From your analyze I may can match program to panel.
With your comments and the panel matching I will use this to study the program myself and learn. Further to your comment that this is a bit "flaky" only and not outright silly I would guess that the Rockwell guy which sold this equipment to the Institute has written it. I will take a picture of this pump panel and upload it tomorrow for your perusal.
We have some more SLC 5/02 and /03 PLC's and for the sake of curiousity I will upload all programs, if any, to see whats been left there. The PLC powercord has last been safety testet and labled in 1998. This indicates that the PLC's have not seen a student for 6-7 years.

Thank you very much for your help.

Kind regards

Alfred