I'm the intern on a filling line and I've been handed this one. 1769-L33ER, Studio 5000 v33. About once a shift the controller goes to major fault, OK LED red, the operators clear it from the PanelView and it runs fine until the next time.
Major Faults tab shows Type 04 Code 20 Array subscript too large, and it names R_Fill rung 14. That rung is one MOV, Recipe[Idx].Target into Fill_Target. Recipe is Recipe[20] and Idx is a DINT that comes from the HMI. I cleared the fault and watched the rung online for an hour and saw nothing, and it won't fault in Emulate either.
The rung looks fine to me, so is the controller just flaky, or am I missing something obvious?
Controller's fine. Recipe[20] means elements 0 to 19. What is Idx when it faults? The fault log won't tell you but the HMI will: what does the operator type into it, and does the screen let them type 20? Firmware on the L33 matches V33, I guess.
The screen has a numeric entry for recipe number, 1 to 20, and it writes straight into Idx. So if they pick recipe 20 it reads Recipe[20]. I think that's past the end, isn't it? Why doesn't it fault on Emulate then?
> Why doesn't it fault on Emulate then?
Because nobody typed 20 into your emulated HMI. The controller checks the index at runtime on whatever Idx holds, and the fault is a hard stop, not a status bit, so the line goes down for a typo. TIA calls it an access error, Logix calls it T04:C20.
Two things, do both. Gate the rung: a LIM with Idx between 1 and 20 in front of the MOV, then SUB 1 into a working DINT so recipe 1 is element 0. Then a program fault routine in R_Fill's program so a bad index logs and clears instead of stopping the line. Writeup with the fault routine part here: https://plctr.com/control-logix-plc-ladder-troubleshooting/
Put it in as a LIM 1 Idx 20 with a SUB 1 into Idx_0 and the MOV reads Recipe[Idx_0] now. Asked the operators, and yes, recipe 20 is the night shift sanitizer cycle, which is why it was once a shift. Rung as it is now:
XIC Fill_Req LIM 1 Idx 20 SUB Idx 1 Idx_0 MOV Recipe[Idx_0].Target Fill_Target
So recipe 20 off the HMI was reading past the end of a 20 element array, and the LIM plus the offset stop it. Haven't done the fault routine yet, I don't fully understand the program fault handler so that's next week.
Thanks mikko and hanab.
Marking solved. Added T04:C20 to the title so the next search finds it.