Tracking down a MSG WRITE

Got a trouble call from a customer this AM that one of the compressor systems is getting its setpoint overwritten and mode (local/remote) constantly changed. The SP comes from another CLX and is rock-steady in that program. Disabling the MSG instruction causes the compressor program to get a 0 value, which we are unable to overwrite. We unplugged the local HMI (serial cable) to the compressor PLC and it did not help, so we assume there is a MSG write instruction out there writing to this PLC, but as we all know, this is the problem with MSG instructions. I'd be curious if anyone has any solutions in tracing MSG writes.

I would start with using a managed switch to mirror the port, and use wireshark to trace it.

That was my only thought at first. I got lucky and went to the web page of the ethernet card (in this case a NET-ENI) and happened to see another incoming connection. Turns out one of the automation guys who was in last night fired up his test PLC and left it on, which happened to be an older copy of a program that writes to that compressor.

For reasons such as this, we have a policy to NEVER do MSG Writes to other PLCs....always read the info you need.

As does this customer, but there are several instances where they still exist and we are trying to help them convert all of them.