You are not registered yet. Please click here to register!


 
 
plc storereviewsdownloads
This board is for PLC Related Q&A ONLY. Please DON'T use it for advertising, etc.
 
Try our online PLC Simulator- FREE.  Click here now to try it.

New Here? Please read this important info!!!


Go Back   PLCS.net - Interactive Q & A > PLCS.net - Interactive Q & A > LIVE PLC Questions And Answers

Reply
 
Thread Tools Display Modes
Old October 18th, 2020, 04:27 AM   #1
kexlington
Member
Australia

kexlington is offline
 
Join Date: Jan 2008
Location: Gladstone
Posts: 9
WinLDR weird cross referencing

Hi,
I have a very old machine I am trying to fix. The PLC is an FA-2 Junior and I am able to connect to it and monitor the code using WinLDR.

Luckily for me, there are no comments in the program and I just have a heap of memory addresses. While trying to reverse engineer what is going on, I have found a number of memory registers that change during the course of the machine operating, but when I do a cross reference on these registers results are returned but there is nothing writing to the registers - all results are read only. I really need to find out what these registers do - they appear to be related to the sequence that machine operates with.

This machine is old - there is no HMI or SCADA writing to these memory registers (there's no network connection to the PLC at all). The memory registers must be getting written to somewhere in the program, but I can't find where. Having ~400 rungs of uncommented code doesn't help.

Has anybody out there had this experience while using WinLDR?
  Reply With Quote
Old October 18th, 2020, 04:39 AM   #2
I_Automation
Member
United States

I_Automation is offline
 
I_Automation's Avatar
 
Join Date: Jun 2020
Location: Detroit, Michigan USA
Posts: 305
The registers could be part of file shifts or bit shifts.


Say it is reading 3004 which is never written to, but 3001 is, then it is shifted twice to be in 3004.


If you can zip and post the project we can go through it to try and find the source.
  Reply With Quote
Old October 18th, 2020, 02:03 PM   #3
a062549
Lifetime Supporting Member
China

a062549 is offline
 
Join Date: Feb 2012
Location: Home
Posts: 132
Sound like you're program is doing a pile of SHIFT commands. Was very common to do when wanting to "hold" a value. (Credit here to I_Automation)

Post it as a printed file or attach it, forum as helped me figure out a pile of confusing programming
  Reply With Quote
Old October 20th, 2020, 11:12 PM   #4
kexlington
Member
Australia

kexlington is offline
 
Join Date: Jan 2008
Location: Gladstone
Posts: 9
Please find the attached code.

I searched through the code and I can't find any instances of bit shifting.

An example of my problem is when I cross reference memory address M0052 - there is nothing that writes to this bit but I can see it changing while online (I suspect this bit is related to the portion of code that is causing my particular problem).
Attached Files
File Type: zip Rotoplastic Machine Code.zip (30.4 KB, 10 views)
  Reply With Quote
Old October 21st, 2020, 12:41 PM   #5
I_Automation
Member
United States

I_Automation is offline
 
I_Automation's Avatar
 
Join Date: Jun 2020
Location: Detroit, Michigan USA
Posts: 305
Unfortunately I can't open the file.

My version of WindLDR (v8.15.0) does not support that old of a PLC. The file says it was created with v5.35.

I put in a call to my local Idec office to see what software I need.
  Reply With Quote
Old October 21st, 2020, 02:57 PM   #6
I_Automation
Member
United States

I_Automation is offline
 
I_Automation's Avatar
 
Join Date: Jun 2020
Location: Detroit, Michigan USA
Posts: 305
Idec called back.

Turns out the FA-2J PLC was an Asian market only PLC and the American WindLDR won't open the files.

Getting me the info on the needed software.
  Reply With Quote
Old October 21st, 2020, 03:44 PM   #7
kexlington
Member
Australia

kexlington is offline
 
Join Date: Jan 2008
Location: Gladstone
Posts: 9
Yeah it's a pretty old PLC. I've been waiting in vain for 3 years for this thing to die so that we can justify upgrading it.

Let me know if you can't get the software, I just might happen to know where you can get a copy
  Reply With Quote
Old October 21st, 2020, 04:49 PM   #8
Lare
Member
Finland

Lare is offline
 
Join Date: Jan 2006
Location: Finland
Posts: 1,436
Quote:
Originally Posted by kexlington View Post
Please find the attached code.

I searched through the code and I can't find any instances of bit shifting.

An example of my problem is when I cross reference memory address M0052 - there is nothing that writes to this bit but I can see it changing while online (I suspect this bit is related to the portion of code that is causing my particular problem).

rung273 and 275 have store and move word inscrunctions to M40 bit.

Probably they write 16bits (M40..M55 bits)?
  Reply With Quote
Old October 23rd, 2020, 02:00 AM   #9
kexlington
Member
Australia

kexlington is offline
 
Join Date: Jan 2008
Location: Gladstone
Posts: 9
I see... I'm not very familiar with this type of PLC, I didn't pick this up. But after reading the help file on these instructions I can see what is going on.

So the important thing to say here is that the JST0 and WMOV instruction can move data to boolean addresses (not only just words).

Gotta love these old PLCs, where the programming is half a step above assembly!
  Reply With Quote
Old October 23rd, 2020, 05:33 AM   #10
I_Automation
Member
United States

I_Automation is offline
 
I_Automation's Avatar
 
Join Date: Jun 2020
Location: Detroit, Michigan USA
Posts: 305
Almost all PLC's treat boolean bits as words of bits.


For Allen Bradley SLC, ML & PLC5 there are bits B3:0/0 to B3:0/15 that can be checked individually or read and written to as the work B3:0

You can also read words of digital input cards and write words to digital outputs (say to turn off all outputs during a fault or E-stop)


And some move and copy commands have a length value that can read or write that many words together.
  Reply With Quote
Old October 23rd, 2020, 12:07 PM   #11
Lare
Member
Finland

Lare is offline
 
Join Date: Jan 2006
Location: Finland
Posts: 1,436
Quote:
Originally Posted by kexlington View Post
I see... I'm not very familiar with this type of PLC, I didn't pick this up. But after reading the help file on these instructions I can see what is going on.

So the important thing to say here is that the JST0 and WMOV instruction can move data to boolean addresses (not only just words).

Gotta love these old PLCs, where the programming is half a step above assembly!

I haven't programmed Idec at all, but Schneider Twido was prepranted Idec PLC with less commands.
Cross referendce shows only start address for indirect addressing, so you need to check every bit from cross reference and look if it is used with word commands.
  Reply With Quote
Old October 23rd, 2020, 12:45 PM   #12
drbitboy
Lifetime Supporting Member
United States

drbitboy is offline
 
drbitboy's Avatar
 
Join Date: Dec 2019
Location: Rochester, NY
Posts: 1,431
Quote:
Originally Posted by kexlington View Post
I
Gotta love these old PLCs, where the programming is half a step above assembly!



Half seems generous to me ...
  Reply With Quote
Reply
Jump to Live PLC Question and Answer Forum

Bookmarks


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Topics
Thread Thread Starter Forum Replies Last Post
Archestra: Deleting unused tags. Cross referencing, checking for unsed tags... SouthernStang LIVE PLC Questions And Answers 0 March 10th, 2020 03:21 PM
Cross referencing specific member of RSlogix 5000 unsaint32 LIVE PLC Questions And Answers 4 June 26th, 2017 06:39 PM
Cross referencing 2 variables to a chart in 5000? krakenfan69 LIVE PLC Questions And Answers 11 November 25th, 2014 04:39 PM
RSView Tag Cross Referencing? jonny311 LIVE PLC Questions And Answers 1 June 22nd, 2007 01:16 AM
RSLogix 5 data cross referencing ptine LIVE PLC Questions And Answers 12 November 28th, 2006 09:29 AM


All times are GMT -4. The time now is 02:26 AM.


.