AB SLC-500 Beginner Questions

Lancie, he found the RSLogix on a 'Russian Mirror' - probably a pirate site. And he mentioned an 'NT' machine talking to it. The SLC is functioning as a semi-intelligent 'remote i/o' unit.
 
The SLC is functioning as a semi-intelligent 'remote i/o' unit.
As Spock said, "that is not logical". If he does not have RsLogix running yet, how could he be entering numbers using only the SLC? I know of no way to enter/receive numbers from a PLC using Windows NT without some additional program - maybe Archie's magic HMI program?
 
Welcome to the world of Allen Bradley.

Now I know what hardware not to use for my own projects! :D

Look, that program "BROADMOOR M 4-15-04" most likely is still in the PLC memory (not the EEPROM memory). If so, the LAST thing that you want to do is load from the EEPROM (if it is installed). The EEPROM is an snap-in removable module. The program in it may not be an up-to-date copy, unless someone took the time to copy all changes and modifications to the EEPROM. (The usual case is that the EEPROM program is an early copy without all the changes that were made in order to get the system running). If you load that EEPROM program into the PLC memory, and you do not first copy the internal PLC program so a computer hard drive or USB drive, then you may lose the only working copy. Then someone would have to try to re-engineer all the changes and revisions. BE CAREFUL! Check it out before you do something you might regret.

This system is constantly completely powered down, no backup power. If it was not in NVM, then the old NT machine would have to load it.

I pulled the unit, and indeed it has the EEPROM. I pulled it fully out, no power, and it booted right back up so the program is in the EEPROM. This is not a complex system meant to control industrial machine lines. It turns 6 valves on and off. I have all the "automation" if I wanted to talk to the valves directly, I would just use my own FPGA between the PC and the valves. But since the SLC-500 is there already, why not use it.

Unless your company purchased the Rockwell RSLogix 500 software as an option with the machine purchase, then to get a copy you will have to buy it or do without. That is the hidden "gotcha" that many company managers are not aware when they buy a machine. They assume that they are getting a complete unit with everything necessary to operate and maintain it throughout its lifetime. Imagine their surprise when they find out that it did not come with a spare tire or even a wrench to remove the broken program!

If you found a Version 8.4 copy on a mirror drive, then most likely RSLogix 500 was purchased at some time in the past.

This statement implies that there is a HMI program (Human-Machine Interface) running that is trying to send and receive data from the Programmable Logic Controller. If so, that is the operater interface and might explain all those B3 bits used as inputs in the PLC rungs. They could be getting data from the HMI program that controls each valve.

For example, on Rung 0001, the binary bit address B3:0/4 (a single bit in the PLC memory that can only have a value of "0" or "1") and labeled "Head and Body from pm" has no output anywhere in the program that would turn it on or off. B3:0/4 only occurs two places, on Rungs 0001 and 0002. I made a quick search and there are no obvious indirect addressing that includes B3:0/4. That means that it must be turned on or off from outside the PLC. I will bet a dollar that your machine also has some type of HMI, probably a Allen Bradley PanelView operator panel, or similar (maybe even just the RSView operator program). To make any changes, you will also have to understand how the HMI program works with the PLC program (that you posted here).

Lancie, he found the RSLogix on a 'Russian Mirror' - probably a pirate site. And he mentioned an 'NT' machine talking to it. The SLC is functioning as a semi-intelligent 'remote i/o' unit.

It was a pirate site, but it was not a "cracked" version. Actually I never even unzipped it because once I realized what the syntax meant controlling individual bits, I was able to talk to it directly.

And yes there is a "semi intelligent remote i/o" unit. It is the old NT 4.0 machine that is dying. I am spending lots of time fixing these things when caps explode, the touch controller goes out, all sorts of troubles. So I am putting in some Windows 7 machines with a new touchscreen, so therefore I need to emulate the frontend.

As Spock said, "that is not logical". If he does not have RsLogix running yet, how could he be entering numbers using only the SLC? I know of no way to enter/receive numbers from a PLC using Windows NT without some additional program - maybe Archie's magic HMI program?

I am entering numbers because I am a good software programmer and hardware designer. I just have no clue about these AB units. I have a custom program I have written in C# that opens raw TCP-IP connections to the SLC500 at the appropriate IP address and port and formats the packets according to the format document I found online a long time ago. I got it to the point where I could talk to it, but I had no idea what I was saying. But I could confirm what I said was received because I could read back changed values in registers.

Fast forward to today when I got the PDF translation of the missing piece, the Rosetta stone of the system. It then made sense. I went over there tonight and using my program I can send bits and voila, the valves turned on. No uber expensive crappy software required!

So I think I have pretty much got this worked out. That PDF made my day!
 
I have written in C# that opens raw TCP-IP connections to the SLC500 at the appropriate IP address and port and formats the packets according to the format document I found online a long time ago.
Okay, that explains how you are sending/receiving data. I was wrong about that part.
I pulled the unit, and indeed it has the EEPROM. I pulled it fully out, no power, and it booted right back up so the program is in the EEPROM.
You are under the impression that the EEPROM is the ONLY version of non-volitile memory in this PLC. That is not true. It has a battery that usually lasts about 10 years that will keep the program memory alive. It also has a capacitor that will keep the memory alive for about 30 days if the battery fails. The EEPROM is additional to those two backups.

The SLC version will not load the EEPROM unless its Status file has been configured to Load Memory Module on Boot, or one of the other 3 selections. I doubt if your SLC is loading its EEPROM memory. Like I said, that could be dangerous until you verify that it contains the exact same program that is currently running.

In the SLC program for the attached Status file, none of the bits have been set to load the EEPROM memory.

RSLogix 500 Memory Module.jpg
 
Last edited:
An assumption being made here is that the RSS file presented is the same as that in the EEPROM and, given the 'Load and Run' parameter, running in the system. Comparing using RSLogix is the only fully accurate method of being sure. Though if 2k1Toaster uses the PDF version as a guide and things work satisfactorily then that is all that matters.
 
One question that seems to have been overlooked is having to re-program the values each time the plc is powered up. I may be wrong but if it is loading the EEPROM at powerup it may be re-loading data values stored on the EEPROM. Also, unless your C# program is proprietary it would be nice to post it or the source code for a tool that the other forum users could use.
 
Thanks, I should have checked it. Hard to believe but true.

It is hard to believe. Whoever designed it in the first place made it overly complex for what it is. A $5 microcontroller could do the same thing.

An assumption being made here is that the RSS file presented is the same as that in the EEPROM and, given the 'Load and Run' parameter, running in the system. Comparing using RSLogix is the only fully accurate method of being sure. Though if 2k1Toaster uses the PDF version as a guide and things work satisfactorily then that is all that matters.

If the unit dies eventually, then I will just rip it out. FOr now it seems to work fine. I know it has never been updated since being installed, so unless it was shipped to us with different EEPROM contents, it should be OK.

One question that seems to have been overlooked is having to re-program the values each time the plc is powered up. I may be wrong but if it is loading the EEPROM at powerup it may be re-loading data values stored on the EEPROM. Also, unless your C# program is proprietary it would be nice to post it or the source code for a tool that the other forum users could use.

All the "variables" it uses I program every power up into the "N" registers. Then I execute the various programs with the "B" bits.

Once the software is a little more polished, I can strip the proprietary part out and post the code. It is really not that hard, there are just a lot of pieces to understand architecturally so you can actually do something with it.

Archie posted his Advanced HMI version to access SLC PLCs without the RSLogix software several years ago.

http://www.plctalk.net/qanda/showthread.php?t=42656

I might have to check that out too. I couldn't find any good software so I had to roll my own. I am sure mine is not as bullet proof as someone who works with these things all day.
 
Well after the project got put on hold, it is now back on!

I have one last piece of the puzzle left and it is because I can't really read the diagram. It doesn't appear to be a flowchart in my eyes, but I am thinking it must be somehow...

I think I have all the latches and things like that working, but there must be some timer that I am not resetting properly since the program never shuts off. If I start from the old unit, then stop it. Then use my code to start anything else it runs for the remainder of the timer and then shuts off. I sort of expect that. I am guessing it is a timer, I guess it could just be a counter.

I am just wondering if there is an easier more "traditional" flowchart type diagram that can be had for these. I can view the output in the software which looks just like the PDF. I had thought that the PDF was cropped for printing, but it appears that is really what it is.
 
but there must be some timer that I am not resetting properly since the program never shuts off.
The old program was started/stopped by bit B3:0/8 "Start From Panel Mate", which if other conditions were TRUE, caused the B3:0/15 "System Latch" to be sealed ON. Then the system would run until the "System Cycle Counter" reaches its Preset Value, which is being adjusted every X seconds (as controlled by the Move on Rung 22) during the cycle by the Move instruction on Rung 23 from N11:39 to the C5:1 Counter Preset Value. N11:39 contains and is labeled as the Number of Intervals. N11:39 is not set within the program but may have been set by the HMI or "PM" (PanelMate?) device originally.
 
I believe that I don't get how to read the "flowchart" properly. Or at the very least, I am not confident that I can.

The old program was started/stopped by bit B3:0/8 "Start From Panel Mate", which if other conditions were TRUE, caused the B3:0/15 "System Latch" to be sealed ON.Then the system would run until the "System Cycle Counter" reaches its Preset Value, which is being adjusted every X seconds (as controlled by the Move on Rung 22) during the cycle by the Move instruction on Rung 23 from N11:39 to the C5:1 Counter Preset Value. N11:39 contains and is labeled as the Number of Intervals. N11:39 is not set within the program but may have been set by the HMI or "PM" (PanelMate?) device originally.

I am guessing you know this from line 0019 correct? That is the line I used to get the program to start as well. I read that as:

Code:
            B3:0/15 =    (
                            (
                                (
                                    (B3:0/8 == TRUE) && 
                                    (
                                        (B3:1/12 == TRUE) ||(B3:1/13 == TRUE) ||(B3:1/14 == TRUE) ||(B3:1/15 == TRUE)
                                    )
                                ) || (B3:0/15 == TRUE)
                            ) &&
                            (B3:0/13 == FALSE) &&
                            (B3:0/14 == FALSE) &&
                            (C5:1/DN == FALSE) &&
                            (B3:4/14 == FALSE)
                        );

So the "system latch" gets set when all these "PM" suffixed bits get set. In my current code I do set these "PM bits" and this does get the program going, but again not the timer. The "C5:1/DN" is called the "System Cycle Timer Done" bit in the register mapping.

I don't understand the C5 thing. There is a C5.0.PRE, C5.1, C5.1.PRE, C5.1/DN. From the notes these are the cycle presets, the actual cycle counter and the done flag I guess. So I guess these are just free running counters that can be preloaded to some value and then count up (?) until overflow and then stop and set the done bit. That's pure guessing. Or is it all manually controlled at "counter" is just a convenient name for a standard register that happens to count?

On line 0022, it does something with C5:1.ACC when the same system latch B3:0/15 is set if I read that line properly. Yes? There seems to be something done if T4:0/DN is false that I don't understand.

The "MOV" block has a source and destination. How do I read the "source" of that block? Not physically, I mean if I were to read aloud verbally that graphical block of code... N[N7:53]:[C5.1.ACC]. What is the "-21846" value? The "15" value? Is it storing that in the preset value of Timer 4?

I also understand at a basic level what you are saying happens on 0023, as that would make sense within the system. I just don't understand how you translated the pretty picture into that phrase.

This reminds me of when I was learning Chinese. It made no sense at the beginning, but after a few hundred characters it becomes much easier to understand the rest since the symbols all build on eachother.

I really appreciate the fast and constructive help. I try to do the same in areas I have competency in on other forums and I am glad communities like these exist.

b0022___KiMxn7krCq.jpg
 
I believe that I don't get how to read the "flowchart" properly.
The correct name is "PLC ladder logic". Ladder logic is based on the older electrical relay logic (which has been used in the electrical field for a hundred years. Both are based on Boolean or binary arithmetic. Normally Open contacts in series = AND logic, Normally closed contacts in series = Not AND or NAND logic; Normally Open instructions in parallel = OR logic; Normally closed instructions in parallel = Not OR or NOR logic.

The "C5:1/DN" is called the "System Cycle Timer Done" bit in the register mapping.
Yes, it is called that, but the address C5:1 is a COUNTER controlled by Timer T4.0. It is a counter based on a timer that has a variable time period that can be adjusted by moving a different value to the Preset of the Timer.

When triggered, a counter counts 1 each time, from 0 up to its Preset Value (Word C5:1.PRE). When the C5:1.ACC Accumulator value reaches the count set by C5:1.PRE, then its DONE bit (C5:1/DN) is turned on and stays on until the counter is reset (by using a RES reset instruction - Rung 24 in your program).
I don't understand the C5 thing.
There are User Manuals for the RSLogix500 software that explain all of the instructions in detail. You can get them from:

http://literature.rockwellautomation.com/intradoc-cgi/nph-idc_cgi.exe?IdcService=GET_SEARCH_RESULTS&QueryText=%28dWebExtension+%3CMATCHES%3E+%27pdf%27+%3Cand%3E+%28%3Cnot%3E+xViewableFile+%3CMATCHES%3E+%27No%27+%3Cor%3E+xViewableFile+%3CMATCHES%3E+%27%27%29+%3Cand%3E+%3Cnot%3E+xReleaseToFlag+%3CMATCHES%3E+%27Restricted+Item%27+%3Cand%3E+dSecurityGroup+%3CMATCHES%3E+%27Literature%27+%3Cand%3E+%3Cnot%3E+xBrand+%3CMATCHES%3E+%27Other+-+Other%27%29+%3CAND%3E+dDocTitle+%3CSUBSTRING%3E+%60MANUAL%60+%3CAND%3E+%28xLanguage+%3CSUBSTRING%3E+%60EN+-+English%60+%3COR%3E+xLanguage+%3CSUBSTRING%3E+%60MU+-+Multi+Lingual%60%29&DefaultQuery=&urlTemplate=%2Fidc%2Fgroups%2Fpublic%2Fdocuments%2Fwebassets%2Fsearch_results.hcst&ftx=&SortField=dDocTitle&SortOrder=Asc&SortSpec=&passedLangVal=EN+-+English&prepopVal=Manual&passedType=dDocTitle&passedParameter=Manual&submitQueryForm.x=13&submitQueryForm.y=10

On line 0022, it does something with C5:1.ACC when the same system latch B3:0/15 is set if I read that line properly. Yes?
No, Rung 0022 is where it sets the value of the Timer T4:0.PRE to be N11:0 if the System Latch B3:0/15 is ON. Rung 23 is where the Counter counts the number of times that Timer T4:0 has run from 0 up to the value of T4:0.PRE.
There seems to be something done if T4:0/DN is false that I don't understand.
If the System Latch is ON, then Timer T4:0 runs until it reaches 15 seconds (or whatever value the timer is set for by the Move from N11:0 to T4:0.PRE). At 15 seconds, its T4:0/DONE bit goes ON, causing the timer to self-reset itself to 0 (Timers reset if the rung logic goes false, then true again (which is caused by the XIO T4:0/DN instruction (Examine If Open) in front of the Timer box.
I also understand at a basic level what you are saying happens on 0023, as that would make sense within the system. I just don't understand how you translated the pretty picture into that phrase.
As you might suspect from learning other symbolic languages, it is a matter of study and experience using it for years. Because you know other computer languages already, you can probably learn all you need to know from simply reading parts of the RSLogix500 software programming manual.
 
Last edited:

Similar Topics

I am relatively new to PLCs and I need a little help. I have a SLC 500: 1747-L524 series C Power supply: 1746-p2 Input Cards: 1746-IN16 (3x)...
Replies
7
Views
2,049
I have a program that I've used 100 times. SQO settings: File N7:0, Mask 0FFFFh, Dest B3:1, Control R6:0, Length 8, Pos 2. Length & Position...
Replies
48
Views
970
Everyone, i am in the process of purchasing the Slc 500 version of software to support what we have and i have a question. Several of our...
Replies
9
Views
773
In a slc 500 plc I am trying to move data with out using a lot of moves. I want to move data from n7:1 to n7:2 and data that was in n7:2 to n7:3...
Replies
16
Views
1,362
Customer has a circa 2004 SLC-500 PLC. Fieldbus is a 1747-SDN DeviceNet scanner. Customer has SLC-500 file (.rss) with no comments. Has no *.dnt...
Replies
7
Views
562
Back
Top Bottom