A snap7 S7-1200 read – plc.db_read(12, 0, 12) against a CPU 1214C – returns twelve bytes on the bench and an exception on the machine, and the difference is two checkboxes in TIA Portal, neither of them on the Pi. python-snap7 3.1.2 talks the S7 protocol to TCP port 102 in pure Python, so there … Read more
A 1756-OF8 is a 0…20 mA module, and at full counts it puts out 21.29 mA. Nothing in the hardware knows that the positioner on the end of the wire wants 4 mA for closed and 20 mA for open, or that 0 mA on an air-to-open valve is the same as closed and 21 … Read more
A PowerMonitor 1000 puts L1 current in input registers 30201 and 30202, as one IEEE 754 float with the high word in 30201, and answers function code 04 for it. Those four facts — which register, how many, which order, which function code — are the whole job of getting a Modbus RTU power meter … Read more
Motor := 1; inside an IF with no ELSE is an OTL, and the Logix Structured Text manual’s own first example uses [:=] and a separate branch to avoid exactly that. Structured text for ladder people usually starts as a translation of a rung, and the rung’s OTE — which writes its bit false on … Read more
A one button start and a one button stop written as separate rungs both end in OTE Motor, and the second one wins every scan, which is why the panel lamp flickers at scan rate and the contactor never pulls in. Two things fix it: an ONS or OSR so the press lasts one scan, … Read more
A 1734-AENT on a remote I/O rack stores its chassis size in non-volatile memory, and the user manual says in as many words that the chassis size setting is not communicated to the adapter during a connection request from the controller. Download a project with the new rack in it and the adapter you just … Read more
On an S7-1200 or an S7-1500 there are four places a function block can keep state that is not in its instance DB, and every one of them makes a second FB instance of FB_Valve share memory with the first. The report is always one of three: valve 2 opens when valve 1 is commanded, … Read more
A spare CPU firmware mismatch looks like this: a new 1756-L83E ships at firmware revision 1.xxx, and a project saved from Logix Designer v33 will not download to it until the controller is at some 33.xxx. Those two facts sit on the same page of the ControlLogix 5580 user manual, and between them they are … Read more
An optimized block on an S7-1500, or on an S7-1200 at V4.x, is created with a 100 byte memory reserve, which is room for 25 Reals of new Statics before a download in RUN has to reinitialise the instance DB. Whether an S7-1500 interface change makes the load preview put “reinitialize” against the block is … Read more
A UDT holding a STRING, eight REALs, four DINTs and four BOOLs is 140 bytes, and the Data Type Editor in Studio 5000 prints that number under Data Type Size before you have written a rung. Fifty of them in a PLC recipe UDT array is 7000 bytes and one base tag, and that last … Read more
A GET on a CPU 1511 that reads from a CPU 1214C and comes back with ERROR = 1 and STATUS = 8 has almost always been refused by the 1214C, and the 1214C has no code in it to blame. Two settings on the partner decide whether PUT and GET ever return data, and … Read more
Siemens gives you a Retain checkbox and a published memory budget. Rockwell gives you neither. Here is what each one really keeps, and how to check it.