Mystery Rockwell Logix5000 Clock Update Tool somewhere on the network

Hi everyone

We've got a ControlLogix5573 PLC that has it's time updated every day to an incorrect time. We've searched through PCs that we thought could be running the Clock Update Tool, but have not found the culprit.
We've worked around it by running the Clock Update Tool on a server, repeatedly syncing every hour so that it corrects itself, but I'd rather track down the root cause.

Is there a way to trace where this sync signal could be coming from? Does it use a specific port or format that we might be able to sniff out?

Other than that, is there a way to tell the PLC to reject requests from the tool?

Thanks everyone

-Squigz

Look carefully for any SSV instructions that set the clock time. A colleague of mine reported the same thing and was ranting about how Rockwell controllers "set their own time randomly".

Instead we found that the machine builder had configured a PanelView Plus to send it own clock time to the ControlLogix, which the controller then used to set the controller time with an SSV.

That being said... detecting a connection from an occasional device on the network is going to take a well-configured sniffer. There's no easy way for the ControlLogix to programmatically tell you what devices are connected to it, and the onboard Web interface of a 1756-ENxx module will not show the connection once it closes.

Edit: Welcome to the PLCTalk forum community, and thanks for a challenging first question !

Does it use a specific port or format that we might be able to sniff out?

Click to expand...

It's not NTP or any other time protocol, but rather a connection over the ordinary CIP protocol on TCP Port 44818 that writes to controller objects (same as the SSV instruction) then commands the controller to accept those values.

If I was setting up Wireshark session, I would try to figure out which devices are currently connected, then set up the IP filters to exclude those and watch for TCP traffic on Port 44818.

You make sure the "Time Sync" is disabled, right? That's for CIP sync.

IF you know when this happens, setup wireshark to capture some packet to see there that's coming from.

nm, Ken already got it.

Try using wireshark to track down update clock signal at the time you know that is affecting your controlLogix PLC.
I am not a wireshark expert.

Oops I did not see Harry said the same.

Ken Roach said:

Look carefully for any SSV instructions that set the clock time. A colleague of mine reported the same thing and was ranting about how Rockwell controllers "set their own time randomly".

Instead we found that the machine builder had configured a PanelView Plus to send it own clock time to the ControlLogix, which the controller then used to set the controller time with an SSV.

Click to expand...

...


I'm guilty of that here, but not from a PanelView. I have my primary Ignition server set every PLC Clock every 24 hours. The PLC's in turn, set the clocks of any attached PowerFlex drive whenever the drive powers up, or DST changes (since AB cannot ship a clock battery with a drive at the absolute top end of the price range for most compact cars).

rdrast said:

...


I'm guilty of that here, but not from a PanelView. I have my primary Ignition server set every PLC Clock every 24 hours. The PLC's in turn, set the clocks of any attached PowerFlex drive whenever the drive powers up, or DST changes (since AB cannot ship a clock battery with a drive at the absolute top end of the price range for most compact cars).

Click to expand...

The Logix5000 platform does not automatically adjust for DST, you have to write code to do it at the appropriate dates and times.

I have never checked, but does this not work for DST.

That box is for manually adjusting for DST. As daba mentioned, you need to write code to manually adjust or "check the box" for it. You have to use a SSV instruction on "ApplyDST" Attribute.

Also of note in the picture Robobob attached, he got the "Enable Time Sync" box checked, AFAIK, that's for CIP sync and will go out to the network looking for a PTP time server to sync up, including another. In vast majority of the cases, that box should be left unchecked unless you deal with motion or A&E timestamping.

Thanks for the info! I have never used that DST function and yes, I am doing motion with this project

Robobob said:

Thanks for the info! I have never used that DST function and yes, I am doing motion with this project

Click to expand...

Checking the DST box in the Date/Time configuration dialog just adds (by default), 60 minutes to the DateTime and LocalDateTime attributes. I believe the CurrentValue remains the same.

You can programmatically change that 60 minutes to say 30 if your time zone has a 30 minute DST (some do, check it out on Wikipedia).

Once set, you can SSV to "Apply DST" (set attribute to INT 1), which does the DST adjustment, or "Apply DST" with attribute set to INT 0, to turn it off.

Here in the UK we change to DST at 0100 on the last Sunday in March, and go back to GMT at 0200 on the last Sunday in October. The code to detect that is trivial - if it's March or October, and a Sunday, and the date is greater than the 25th, it's the last Sunday. Finding out if it is Sunday is the hardest part, thankfully there's an AOI in MosquitoStation example that works it out for you.

Logix 5000 clock update tool log files

Hi,
Did anyone come across the log files filling up their c drive because of this tool. Is there an automatic purge tool.

TimODriscoll said:

Hi,
Did anyone come across the log files filling up their c drive because of this tool. Is there an automatic purge tool.

Click to expand...

You can choose to not have text logging if you prefer that.
You can also set up a windows event scheduler and a batch file.

Here is a link which talks about deleting files with an "Older than" criteria. You can also specify a filetype.

Here is help on how you can delete only files which are of a txt/xml type: https://ss64.com/nt/forfiles.html