GE-9030 HARDWARE CONFIGURATION USING CMM302 GENIUS MODULE; Quickpanel JR upgrade

Greetings Gentlemen,

I backed up some existing systems for a client. Here are the basics:
1- GE9030 MASTER RACK WITH CPU331; end of rack has Genius CMM302. The cable goes to the next SLAVE rack with no CPU.
2- Same as above
These two master slave setups are running in a redundant fashion, that is if one fails the other takes over. I backed up the code in both CPU's.

This was last week. Today, I'm making notes for recommendations to this client for further planning regarding backups. This is a GE-ZENITH Y517 Automatic Transfer Switch.

Questions:
In the office here I noticed there is no hardware config file, so I started up the Remote IO Manager AKA Hardware Config manager, and imported the CPUCFG.CFG and IOCFG.CFG files for each program in their respective folders for each program: Y517M1 and Y571M2. I opened the new file I saved: Y517M1.hwcfg (and the one for Y517M2) and each one of the files shows the MAIN RACK, no problem. BUT.... where in the heck is the SLAVE rack? It should be shown on the Rack 1 tab (?) !!! Or am I missing something BECAUSE .... it is not an expansion rack system like I am used to seeing, but rather the slave rack is cabled to the GENIUS CMM302.

Does any one out there in PLCTALK.NET world know anything about this kind of configuration?

Was I supposed to backup the hardware config onsite and I neglected to do so?

Or... is the CMM302 another can of worms? That is, I have to back up the config another way?

Or... do I have to manually enter the hardware config on TAB 1 of each of my backup configuration files?

SAME PROJECT- DIFFERENT QUESTION:

The HMI is a TCP QUICKPANEL JR. They are NOT uploadable. I have put in a request to the OEM for backup code (as well as annotated code for LM90). Assuming I get the code, should I work with PROFACE to upgrade to a newer supportable HMI for backup? I looked on eBay and the prices of the Quickpanel Jr. are getting ridiculous and the selection looks scary.

What HMI would Y'all recommend for an upgrade path. I need to treat this client well. It is in fact the Naval Air Force.

Thanks in Advance for ANY comments or suggestions.

Byron

Are the I/O modules all in the "slave" rack? If so, that rack may have a CPU chip embedded in the rack. That was a fairly common redundancy strategy using the CMM302. If the "slave" rack is ten-slots with a CPU chip its part number will be IC693CPU321 or IC693CPU323. If it is 5 slots it will be either IC693CPU311 or IC693CPU313. If that is the case you will also need to upload the program and configuration file from the "slave". A look at the hardware configuration details for the CMM302 will give some clues. I expect that the Genius bus address of the CMM302 in one of the PLCs is 31 and in the other it will be 30. Both of them will be exchanging data with a third Genius bus address which will the CMM302 in the "slave" rack.

The QuickPanel Jr is an old platform, although not quite as old as the 90-30. You can still get replacements for both the PLC and the HMI. If you are asked to recommend upgrades, consider replacing both the PLC and HMI.

If the customer will permit it, either post the project files here or send them to me by email. I think you have my email from the time of your project with the PCM module. If not, send me a PM and I'll give it to you.

If as you indicate both racks have a CPU331 and a CMM302 then they are likely running a special Redundant block of code called Max-On that uses the Genius bus to swap from primary to secondary.
You can research it here: http://support.ge-ip.com/support/index?page=home&locale=en_US
by searching the term max-on.

The only configuration needed is what you find in the CPU of each Rack.
The QuickPanel Jr. is easily replaced by a modern QuickPanel+ from GEIP. There is a simple two step process to convert the screens and the only manual updating will be if the old system uses "Panel Trigger" and/or "Passwords" which are also very easy fixes.

Thanks Steve and Russ,
Tied up with calls at the moment and I hope to respond later. I can offer more info then, code; screenshots; pics; etc.
Byron

Okay... now to explain the problem as best as I can. I'm uploading a PDF which should explain the issues I'm having with properly backing up the PLC code for this VERY important client (Naval Air Station)
Please read the PDF.
I uploaded the 2 LM90 programs and the HWCONFIG which I created from the CFG files at my office. I didn't think of doing it in the field.
In my next post I will list the questions I have now.
Thanks for being interested.

QUESTIONS:
1. CMM302 GCM (Genius Communications Module) How to configure it?

2. I've read several PDF manuals and see reference to the Hand Held Programmer and a program called "Control". Is this referring to CIMPLICITY Control?

3. I fired up Proficy to see if it does configuration of the module and did not see anything more than what LogicMaster does. Does Proficy FULLY replace Cimplicity? (in other words is it necessary to have Cimplicity if I already have Proficy?

4. Is there actually CODE in the CMM302 that can only be accessed by the HHP? (one of the manuals indicated HHP or CONTROL)

5. I do have the HHP for Genius and also for PLC. What kind of learning curve for CMM302?

PROBLEMS & QUESTIONS
1. I backed up the program from the CPU in the field. I assumed the remote rack would have been populated in Logicmaster and the
Hardware configuration program as well. I was wrong. At the office I imported the CPUCFG.CFG and IOCFG.CFG into the HWC program. It does NOT show the hardware configuration for RACK 1. Is either method of backing up the Hardware Configuration okay? (that is with the HWC program or importing the two .CFG files from the program folder)

2. The program logic I uploaded stops at Q64. The expansion rack has three OUTPUT modules. The main rack stops at Q65 so I would
think the expansion rack should go from Q66 to Q112. Does the CMM302 module have logic in it?

3. In reading through the manuals I could find online, it appears there are several ways to “configure” the module: Hand Held Programmer (HHP) ; A program they refer to as “Control” (which I assume is CIMPLICITY CONTROL” and for some reason they just call it Control in this reference). So, are these the only ways?

4. When they refer to “configure” is that not what LM90 does?

5. What about code? (I’m stuck on the PCM module and PCOP thinking)

6. The expansion rack for Y517M2 is labeled as “NON-CPU SLOTS” whereas the rack for Y517M1 does not have that label. In the field I assumed they both were NON-CPU RACKS… I hope I did not ASSume incorrectly.

7. Quickpanel Jr. … As I understand it: The JR. does NOT support uploadable code, and the other models you had to check the box in the programming software to allow uploadable code before you downloaded the code to the HMI. Is this correct?

8. Well ***RANT***SNIP*** I’m remembering the old saying we had back in the day…”It comes in Threes”. I have two now, so the other one will be here shortly… MY OTHER CLIENT AS OF YESTERDAY: QuickPanel Jr. … I know the programmer … he is deceased… No backups..
So… question:
How do I extract the executable that was downloaded to the HMI? It obviously has the compiled executable runtime version of the program, so how can I extract it and from there figure out how to reverse engineer it. Otherwise I might call his widow and simply ask what, if any, of his old programming gear is left and if she is interested in selling it or…??? Or I might monitor the PLC while pressing buttons and document the pictures of each screen so I can write a new program… IDEAS???

RussB said:

If as you indicate both racks have a CPU331 and a CMM302 then they are likely running a special Redundant block of code called Max-On that uses the Genius bus to swap from primary to secondary.
You can research it here: http://support.ge-ip.com/support/index?page=home&locale=en_US
by searching the term max-on.

Click to expand...

I will do that: search for MAX-ON... meanwhile, I discovered the code is not the same. The two programs are different.

The only configuration needed is what you find in the CPU of each Rack.

Click to expand...

But the code for the expansion racks is missing and they both appear to be NON CPU RACKS, at least one is labeled that way.

The QuickPanel Jr. is easily replaced by a modern QuickPanel+ from GEIP. There is a simple two step process to convert the screens and the only manual updating will be if the old system uses "Panel Trigger" and/or "Passwords" which are also very easy fixes.

Click to expand...

That's good to know. I put in a call to Proface and haven't gotten a reply yet. Maybe EVERYONE back east is snowed in or something. It is 80 degrees in my office here in California. Anyway, both units - QuickPanel Jr. - two clients - As I understand it from the manuals: Jr.'s are NOT uploadable even if the check box was checked (?) So... How to hack it. The client from yesterday- programmer passed away about 2 years ago. I keep telling ALL of my clients the importance of backing up ALL programmable code. Follow my advice and you won't need half of my services....

The only other way I know is from scratch... and while we have a working QPJR, monitor the PLC code while pressing buttons and documenting pictures of each window of the HMI. If I could hack the firmware I'd be working for Mossad or CIA...

Byron said:

Okay... now to explain the problem as best as I can. I'm uploading a PDF which should explain the issues I'm having with properly backing up the PLC code for this VERY important client (Naval Air Station)
Please read the PDF.
I uploaded the 2 LM90 programs and the HWCONFIG which I created from the CFG files at my office. I didn't think of doing it in the field.
In my next post I will list the questions I have now.
Thanks for being interested.

Click to expand...

I looked at the two programs that you have "M1" & "M2" they are not Max-On, skip that. Looks like Steve is correct in that what you 'assumed' was an expansion rack is actually a low end 'embedded' IC693CPU313 or CPU323. The label that can't be read which you say is "non-cpu slots" don't mean much other than you can't plug a CPU in there. If it is an Expansion rack it will have a set of DIP switches to set which rack it is under about the second or third module and if a CPU it will have PROM chip or two there.
The photo is not readable but there is a tag on the right end of the rack with a part number. Or plug in Proficy ME or LM90 into the power supply and see if you can connect.

Take a look at these screen shots for how the CMM302 in each program you loaded are configured.

Get GFK-0412 and compare it with the screen shots that I made to see what and how the Genius bus is configured.

Which Navy Base? I was a Navy Aviation Electrician and was on many of the West Coast Naval Air Stations although that was back in the late 1960's and early 70's.

Thanks Russ for the comments. I saw the data in your screenshots in LM90.

Did you use Proficy?

The program referenced as "Control" , is that Cimplicity Control?

Does Proficy completely replace Control or are there occasions where you need it?

What I'm hoping for is a complete annotated backup from GE-ZENITH the actual OEM. This is for a U.S. Naval Air Station so I would hope they have the sense to provide these backups. I'm going to recommend some hardware purchases as well, for backup.

The QuickPanel Jr. if new enough could have the program in it to be uploaded out but it is usually a 50/50 shot. If you need to reverse Engineer it, hopefully there are not too many screens and not too much data on each. If you have the ladder logic from the attached processor with good documentation it will help a lot.

Genius Again:
You said that you have a Genius HHM. It normally used SBA 0 but one of your CCM302 modules uses that SBA so be sure to change the HHM to maybe 12 or 13 as those are not used in your system.

RussB said:

Get GFK-0412 and compare it with the screen shots that I made to see what and how the Genius bus is configured.

Which Navy Base? I was a Navy Aviation Electrician and was on many of the West Coast Naval Air Stations although that was back in the late 1960's and early 70's.

Click to expand...

Lemoore... Hospital emergency generator transfer switch... VERY important. A lot of "maintenance managers" have no idea the importance of programmable components code backups: PLC; SERVO; HMI; DRIVES; PC's; ETC... Even with P.C.'S I just clone the hard drive so all the code including licenses is backed up, put in a Faraday enclosure and they are good to go when TSHTF or TEOTWAWKI

I'm mainly nervous about the QuickPanel Jr. If GE-ZENITH screws up with no backups or blows me off I can still go back and do a more complete PLC CODE backup. The QP-JR is another matter.

Byron said:

Thanks Russ for the comments. I saw the data in your screenshots in LM90.

Did you use Proficy?

The program referenced as "Control" , is that Cimplicity Control?

Does Proficy completely replace Control or are there occasions where you need it?

What I'm hoping for is a complete annotated backup from GE-ZENITH the actual OEM. This is for a U.S. Naval Air Station so I would hope they have the sense to provide these backups. I'm going to recommend some hardware purchases as well, for backup.

Click to expand...

Yes, I am using Proficy ME version 8,60 it is what has replaced LogicMaster 90, VersaPro, Cimplicity Control and Cimplicity Machine Edition which are now all obsolete and should only be used to assist in upgrading to Proficy ME. IMHO

Here is the list of hardware supported in Proficy ME: