Tracing Data in Modicon Networks

[MetAldaMan]

Hello,
I would like to know the best way to find the source of data in a holding register. I am using Proworx NXT with various Modicon PLCs.

Example:
I find a register, 4xxxx1, being used in a program. A search for this register shows no other locations for it aside from the place where I saw it within the specific PLC that I am working on.

It is my understanding that a MSTR command in another PLC on the network can access and write to any registers it wants to in any plc on the network, aside from protected registers. Please correct me if I'm wrong.

Considering that I believe the previous statement to be true, I am under the impression that I would have to search every MSTR command on every PLC on the network to find every possible instance where my original 4xxxx1 register could be being altered.

I really hope I'm wrong about that. I want to know the best way(s) to find the source of communicated data in a modicon PLC program. Please advise.
Thanks!

 

[MetAldaMan]

bump

 

[Ken Roach]

You're correct.

I've done analysis of interconnected systems like this and it's a big effort both in analyzing the network and in reviewing the programs.

The biggest challenge is when the MSTR commands are not cyclic or repeating; if they happen on an event, or on a startup, you're not necessarily going to catch them with a protocol analyzer.