Secret/Undocumented PLC Features

Archie

Member
Join Date
May 2002
Location
Orangeburg, SC
Posts
1,944
After making my latest video and discussing some features about Beckhoff and a few features that are undocumented or buried very deep, it came to mind that it would be good to start a thread and find out if others know of PLC features that are not well known. I'm NOT looking for hacks, cracks, or software pirating, but useful legit features that are typically only found by accident.

Does anyone know of some useful features that are not very well known? Looking for features to any brand of PLC.

This is my contribution on Beckhoff TwinCAT:

http://www.youtube.com/watch?v=2xUttaGaKhE
 
Greetings Archie ...

not sure if this is what you’re looking for, but here’s a trick that my more experienced students like a lot ... suppose that you’re out working on a system in the field and would dearly love to have something like a “simulator switch” to use for temporary troubleshooting purposes ...

the pictures show how to use the keyswitch on a PLC-5 or on an SLC-5/03 (or higher) to control something in your ladder program ... just turn the key between the Run and the REMote positions to switch between ON and OFF ...

disclaimer: obviously this is NOT something to arm Bubba the operator with – because you KNOW he’s going to turn that switch too far and shut everything down ... but used carefully, this can be a VERY handy TEMPORARY troubleshooting tool ...

key_plc5.JPG
 
Using that trick right now in a CLX. The first rung of the main routine in the continuous task uses GSV to get the key swtich position. Status is an INT tag.

A040609A.jpg
 
Siemens S5 had loads of "un documented" instructions, well some I came across were not in the manuals.
some of their standard function blocks used system instructions not shown on any manuals I found.
In fact some i think were actual instructions but by using the way the ram structure was it was possible to create large DB's on the fly to fill the memory with a DB of several kilowords other RS instructions were used in standard blocks i.e. load a hex value into a flagword that is a MC5 machine code instruction then DO RSxx (process the instruction contained in the flagword).
It was possible to make self modifying code or transfer a datablock containing the MC5 instructions & create a function block nasty but have seen it done.
Once came across a system that checked how much memory was left in the plc & in the startup OB it created a DB just large enough to fill the memory, created the header for the block etc.
this was not to stop anybody from copying as if you uploaded it & tried to download it would say not enough memory.
but as a printer buffer on a critical process but then again unless you new how to re-load the plc you had great problems doing a mod.
Although not strictly an undocumented instruction I came across a function block that passed a timer (or the decimal value of a timer address) this foxed me for a while as the value was greater than 255 (the max number for a standard S5 timer, however I realised what the engineer had done.
Timers are addressed as an 8 bit word for the timer number, so 256 is timer 1 as it only processes the lower byte it sees the pointer as a "1". don't know what was in his mind apart from confusing other engineers but passing 0-255 would have done.
 

Similar Topics

Posted just because it's has an Allen Bradley keyed selector switch https://www.youtube.com/watch?v=YeFevEGoPF0 LockPickingLawyer
Replies
6
Views
2,672
Hello. please can any one help me. I need to know (in RSlogix 5000 function block). How can i represent the discrete for example i have the...
Replies
10
Views
3,656
Hey folks; I have been a long time lurker and an occassional poster and was curious if you think that PLC.net has got to be the best or worst...
Replies
17
Views
9,747
Is there a place in the SLC5/03 where I can count and keep the numbers forever? And according to my ex-wife forever is 5 years._____Relax! Its...
Replies
25
Views
7,426
Some help with an annoying problem, please....the majority of program changes (AB5000 platform) are being made by a contractor (a former employee...
Replies
3
Views
1,508
Back
Top Bottom