The label tells you nearly everything, you just have to read the right part of it. What's the catalogue number on the leftmost module in each rack, the one the power supply sits next to? Not the model name, the number with the dash in it.

Photograph every label while you're in there. You'll be back in those panels twenty times otherwise.

Went round with a phone this morning.

Panel 3 leftmost module says 1769-L33ER, and the one next to it is 1769-IQ16. Panel 7 is 6ES7 315-2EH14-0AB0, which is the green stripe one. The two grey racks both say 1747-L542 and there's a fabric ribbon cable between them that I have not touched.

6ES7 315-2EH14 is a S7-315-2 PN/DP, so that one is a 300 series. Important part for you: a 300 does not open in TIA Portal without the STEP 7 V5.x option package, and most people just keep a laptop with STEP 7 V5.6 on it for exactly this.

The backup you want is an upload of the whole station, hardware config and blocks together, not just the blocks. And check whether the CPU has a memory card in the slot, because on a 300 that card is where the program actually lives.

There is a card in it, yes, a little yellow one.

The grey ones I looked up and 1747-L542 is a SLC 5 removed link No Ethernet port that I can see, just a round socket and a blue 9 pin. Is that the ribbon cable thing being a second rack of the same PLC?

Yes, the ribbon is the expansion cable, so those two racks are one processor with its I/O split across them. Count them as one backup, not two.

5/04 is DH+ on the blue connector, so it's RSLogix 500 and a 1784-U2DHP, or an old 1770-KFD if I remember right. If nobody has bought one of those in twenty years you'll find it in a drawer with a serial cable taped to it. The round socket is DH-485 and you can ignore it.

So you have three families and three packages, which is normal for a site of any age. There's a writeup that lays out which part of the label means what: https://plctr.com/understanding-plc-hardware-and-software-components/

Found a U2DHP in the store, and RSLogix 500 is on the old desktop in the office along with STEP 7. So I can get at all four now.

One thing I'm not sure about. For the L33ER I saved an ACD and I'm told that is the backup. For the 5/04 the RSS file uploaded fine. But the super says the SLC backup is no good without something else and won't say what.

He means the data table. An upload gives you the program and the current values, and on a 5/04 half the machine setup lives in N and F files that somebody typed in years ago and never wrote down. Save the RSS, then also print or export the data table so you have the numbers in a form you can read without the software.

Same reason people keep a printout in the panel door. Do that and the backup is worth something when the machine is down and the laptop will not talk to it.

All four done and written up. Two ACD files off the CompactLogix racks, a full station upload off the 315 with STEP 7 V5.6 including the hardware config, and an RSS plus a data table export off the 5/04 pair.

What I had wrong at the start was thinking one piece of software opens a PLC. It's the CPU family that decides, and you read that off the catalogue number on the leftmost module, not off the badge on the door.

I've started a sheet with a row per panel, CPU number, software, and which cable it needs. Still no idea what is in the two panels over in the old pump house, they're padlocked and nobody has the key. Thanks rsdave, kiran_s and louk.

That sheet will outlast all of us. Keep it in the panel too.