TI 505 Timer value changing

[rodney312s]

Hey all. We have several TI505 PLCs and we are having trouble with some of the timer presets getting wrote to a value of 32757. Sometimes it is the same timer and sometimes it is a different one but the value is always 32757. We are communicating with the 505s through ethernet. All the 505s are controlled through WonderWare and are connected to an SQL server for data storage. Has anyone seen this before? How can we track down where this timer is getting wrote from? We have went through the programs on the other HMIs looking for a tagname that might have accidentally got the wrong access name but we have found nothing. Any help is greatly appreciated and thanks in advance.

 

[Ken Moore]

Timers and counters use the same memory area in a TI plc, have you checked to ensure that you don't have a counter using the same memory registers?

It could also be caused by an HMI tag with the wrong counter address.

505.TCP1 could be counter 1 or timer 1.


Ken

 

[rodney312s]

Thanks for your reply Ken.
I have looked through the updated cross reference and it shows the TC as only being used once. I have also went online with the PLC and searched for the Timer and only found it once there as well. We have an in house network as well as a network with other plants. Could it be possible that a program in one of our other plants is writing into these timers and counters? Is there a way to track the information coming into a PLC over ethernet? I also dumped the database from our other WW programs into an excel file and searched for similar tags writing to this PLC and didn't find anything.

 

[Terry Woods]

Indexed or Indirect Addressing

Have you checked to see if your program is using Indexed or Indirect Addressing?

 

[bkottaras]

Have you checked to see if your program is using Indexed or Indirect Addressing?

That would be my guess too.
Have you made any changes to anything lately?
If you did, you definetely writting to registers thast you don't want to.

 

[rodney312s]

Would that be in the PLC or the WonderWare program? I have heard of using indirect tags in WW but i'm not sure how or where to look for them. and i'm not familiar with indexed addressing at all. We have had some integrators in our plant installing different pieces of equipment and it is very possible that they are using the indexed or indirect addressing but i just am not sure where to look. thanks

 

[Terry Woods]

Indexed and Indirect Addressing occurs in the PLC program although there could be some influence applied by the HMI... it all depends on what you guys have written in both the PLC program and the HMI.

 

[Terry Woods]

You might find that there is an "LDA" (Load Address) function somewhere in the PLC program. This function returns a memory-based address related to a particular memory item - such as a Timer/Counter. That returned address might then be used inconjunction with one or more math operations to calculate a new (Indirect) address.

 

[Terry Woods]

Indirect Addressing is indicated with an "@" sign, as in @V100.
"@V100" means to read the value at V100 as an address rather than a simple value.
So... if V100 contained 50 (decimal) then "reading @V100" would cause the processor to read "50" at V100 which then causes the processor to "fetch" the value stored at V50.

Ooops... not exactly... the value stored at V100 would have been written there by an LDA (Load Address) function which provides a "logical address" which is not exactly the same as the common address.

In any case, that value can also be subjected to various math operations before it is "read".

You might also look for an "MWI" (Move Word with Index) function.

 

[cciblazer]

I would narrow it now first. Find out wheter or not there has been any editing done to the HMI's or PLC. Next I would try to isolate it by removing an HMI comms to the plc. Recently I had a similar 545-1103 that was acting up and had to replace it. I do not recall timers going to max value. It took a while to narrow now because it would function fine for awhile then bits etc would change states when they shouldn't. Once I relaced the processor all was well.

 

[Henny]

Hello



As a note on Terry Woods remark about indirect addressing.



If your program contains special functions you could then a TCP value could also be assigned like TCP1(V100):=250 .

When V100 is 10 then TCP10 = 250 meaning 25 seconds.

It could also be indirect assigned in a subroutine.

For example at a subroutine call P1 = TCP1 and in the subroutine is a math statement that looks like Math T1 = 100 and another statement Like Math P1(T1):=350 then in this example TCP 100 = 350 meaning 35 seconds.



I also agree with Cci Blazer that you should try to isolate the problem for example does this happen once a day or at the start of a particular process at your plant?

If you know that then you have a starting point where to look at your program.





Regards



Henny