bernie_carlton
Lifetime Supporting Member + Moderator
Lancie, he found the RSLogix on a 'Russian Mirror' - probably a pirate site. And he mentioned an 'NT' machine talking to it. The SLC is functioning as a semi-intelligent 'remote i/o' unit.
As Spock said, "that is not logical". If he does not have RsLogix running yet, how could he be entering numbers using only the SLC? I know of no way to enter/receive numbers from a PLC using Windows NT without some additional program - maybe Archie's magic HMI program?The SLC is functioning as a semi-intelligent 'remote i/o' unit.
Welcome to the world of Allen Bradley.
Look, that program "BROADMOOR M 4-15-04" most likely is still in the PLC memory (not the EEPROM memory). If so, the LAST thing that you want to do is load from the EEPROM (if it is installed). The EEPROM is an snap-in removable module. The program in it may not be an up-to-date copy, unless someone took the time to copy all changes and modifications to the EEPROM. (The usual case is that the EEPROM program is an early copy without all the changes that were made in order to get the system running). If you load that EEPROM program into the PLC memory, and you do not first copy the internal PLC program so a computer hard drive or USB drive, then you may lose the only working copy. Then someone would have to try to re-engineer all the changes and revisions. BE CAREFUL! Check it out before you do something you might regret.
Unless your company purchased the Rockwell RSLogix 500 software as an option with the machine purchase, then to get a copy you will have to buy it or do without. That is the hidden "gotcha" that many company managers are not aware when they buy a machine. They assume that they are getting a complete unit with everything necessary to operate and maintain it throughout its lifetime. Imagine their surprise when they find out that it did not come with a spare tire or even a wrench to remove the broken program!
If you found a Version 8.4 copy on a mirror drive, then most likely RSLogix 500 was purchased at some time in the past.
This statement implies that there is a HMI program (Human-Machine Interface) running that is trying to send and receive data from the Programmable Logic Controller. If so, that is the operater interface and might explain all those B3 bits used as inputs in the PLC rungs. They could be getting data from the HMI program that controls each valve.
For example, on Rung 0001, the binary bit address B3:0/4 (a single bit in the PLC memory that can only have a value of "0" or "1") and labeled "Head and Body from pm" has no output anywhere in the program that would turn it on or off. B3:0/4 only occurs two places, on Rungs 0001 and 0002. I made a quick search and there are no obvious indirect addressing that includes B3:0/4. That means that it must be turned on or off from outside the PLC. I will bet a dollar that your machine also has some type of HMI, probably a Allen Bradley PanelView operator panel, or similar (maybe even just the RSView operator program). To make any changes, you will also have to understand how the HMI program works with the PLC program (that you posted here).
Lancie, he found the RSLogix on a 'Russian Mirror' - probably a pirate site. And he mentioned an 'NT' machine talking to it. The SLC is functioning as a semi-intelligent 'remote i/o' unit.
As Spock said, "that is not logical". If he does not have RsLogix running yet, how could he be entering numbers using only the SLC? I know of no way to enter/receive numbers from a PLC using Windows NT without some additional program - maybe Archie's magic HMI program?
Okay, that explains how you are sending/receiving data. I was wrong about that part.I have written in C# that opens raw TCP-IP connections to the SLC500 at the appropriate IP address and port and formats the packets according to the format document I found online a long time ago.
You are under the impression that the EEPROM is the ONLY version of non-volitile memory in this PLC. That is not true. It has a battery that usually lasts about 10 years that will keep the program memory alive. It also has a capacitor that will keep the memory alive for about 30 days if the battery fails. The EEPROM is additional to those two backups.I pulled the unit, and indeed it has the EEPROM. I pulled it fully out, no power, and it booted right back up so the program is in the EEPROM.
Archie posted his Advanced HMI version to access SLC PLCs without the RSLogix software several years ago.Also, unless your C# program is proprietary it would be nice to post it or the source code for a tool that the other forum users could use.
Thanks for the link. I knew about and have used Archie's AdvancedHMI program. I was just looking for more options and trying to increase my programming knowledge.Archie posted his Advanced HMI version to access SLC PLCs without the RSLogix software several years ago.
http://www.plctalk.net/qanda/showthread.php?t=42656
Thanks, I should have checked it. Hard to believe but true.
An assumption being made here is that the RSS file presented is the same as that in the EEPROM and, given the 'Load and Run' parameter, running in the system. Comparing using RSLogix is the only fully accurate method of being sure. Though if 2k1Toaster uses the PDF version as a guide and things work satisfactorily then that is all that matters.
One question that seems to have been overlooked is having to re-program the values each time the plc is powered up. I may be wrong but if it is loading the EEPROM at powerup it may be re-loading data values stored on the EEPROM. Also, unless your C# program is proprietary it would be nice to post it or the source code for a tool that the other forum users could use.
Archie posted his Advanced HMI version to access SLC PLCs without the RSLogix software several years ago.
http://www.plctalk.net/qanda/showthread.php?t=42656
The old program was started/stopped by bit B3:0/8 "Start From Panel Mate", which if other conditions were TRUE, caused the B3:0/15 "System Latch" to be sealed ON. Then the system would run until the "System Cycle Counter" reaches its Preset Value, which is being adjusted every X seconds (as controlled by the Move on Rung 22) during the cycle by the Move instruction on Rung 23 from N11:39 to the C5:1 Counter Preset Value. N11:39 contains and is labeled as the Number of Intervals. N11:39 is not set within the program but may have been set by the HMI or "PM" (PanelMate?) device originally.but there must be some timer that I am not resetting properly since the program never shuts off.
The old program was started/stopped by bit B3:0/8 "Start From Panel Mate", which if other conditions were TRUE, caused the B3:0/15 "System Latch" to be sealed ON.Then the system would run until the "System Cycle Counter" reaches its Preset Value, which is being adjusted every X seconds (as controlled by the Move on Rung 22) during the cycle by the Move instruction on Rung 23 from N11:39 to the C5:1 Counter Preset Value. N11:39 contains and is labeled as the Number of Intervals. N11:39 is not set within the program but may have been set by the HMI or "PM" (PanelMate?) device originally.
B3:0/15 = (
(
(
(B3:0/8 == TRUE) &&
(
(B3:1/12 == TRUE) ||(B3:1/13 == TRUE) ||(B3:1/14 == TRUE) ||(B3:1/15 == TRUE)
)
) || (B3:0/15 == TRUE)
) &&
(B3:0/13 == FALSE) &&
(B3:0/14 == FALSE) &&
(C5:1/DN == FALSE) &&
(B3:4/14 == FALSE)
);
The correct name is "PLC ladder logic". Ladder logic is based on the older electrical relay logic (which has been used in the electrical field for a hundred years. Both are based on Boolean or binary arithmetic. Normally Open contacts in series = AND logic, Normally closed contacts in series = Not AND or NAND logic; Normally Open instructions in parallel = OR logic; Normally closed instructions in parallel = Not OR or NOR logic.I believe that I don't get how to read the "flowchart" properly.
Yes, it is called that, but the address C5:1 is a COUNTER controlled by Timer T4.0. It is a counter based on a timer that has a variable time period that can be adjusted by moving a different value to the Preset of the Timer.The "C5:1/DN" is called the "System Cycle Timer Done" bit in the register mapping.
There are User Manuals for the RSLogix500 software that explain all of the instructions in detail. You can get them from:I don't understand the C5 thing.
No, Rung 0022 is where it sets the value of the Timer T4:0.PRE to be N11:0 if the System Latch B3:0/15 is ON. Rung 23 is where the Counter counts the number of times that Timer T4:0 has run from 0 up to the value of T4:0.PRE.On line 0022, it does something with C5:1.ACC when the same system latch B3:0/15 is set if I read that line properly. Yes?
If the System Latch is ON, then Timer T4:0 runs until it reaches 15 seconds (or whatever value the timer is set for by the Move from N11:0 to T4:0.PRE). At 15 seconds, its T4:0/DONE bit goes ON, causing the timer to self-reset itself to 0 (Timers reset if the rung logic goes false, then true again (which is caused by the XIO T4:0/DN instruction (Examine If Open) in front of the Timer box.There seems to be something done if T4:0/DN is false that I don't understand.
As you might suspect from learning other symbolic languages, it is a matter of study and experience using it for years. Because you know other computer languages already, you can probably learn all you need to know from simply reading parts of the RSLogix500 software programming manual.I also understand at a basic level what you are saying happens on 0023, as that would make sense within the system. I just don't understand how you translated the pretty picture into that phrase.