S7-1200 and S7-1500 in TIA Portal: tags, timers, data blocks, drive control and the diagnostics buffer when it all goes red.
A new SM 1223 goes into slot 2, the panel comes back up, and the ERROR LED flashes red while the STOP/RUN LED sits solid yellow. The module that came out was 6ES7223-1BL32-0XB0. The one from stores is 6ES7223-1BL32-1XB0, and those two part numbers are the same sixteen inputs and sixteen outputs in the same … Read more
FB120 carries the orange half-circle in the project tree and the block you have open is the one you wrote on Tuesday. On an S7-1500 that symbol is the result of a checksum comparison, not a time stamp comparison, and the manual lists more than a dozen separate checksums behind it. Three of them have … Read more
The batch record says the mixer started at 06:14 and the operator watched it start at 07:14, on the Sunday the clocks moved. The CPU 1516-3 PN/DP is keeping perfect time. What is wrong is that somebody wired RD_SYS_T into the timestamp and RD_SYS_T hands back the module time, which on this family is always … Read more
MOVE_BLK with COUNT := 20 aimed at an ARRAY[1..10] of Real on a CPU 1516-3 PN/DP does not put the CPU in STOP and does not hand you an error in the diagnostics buffer. The enable output drops to 0, and on a box inserted with the editor’s default settings there is no ENO pin … Read more
The guard door opens once and gets recorded twice: 06:41:12.310 in the Logix log, 06:41:12.650 in the S7-1500’s diagnostics buffer. The two controllers are eight metres apart on the same machine, both nominally synchronised, and the gap is a third of a second every time you look. Neither clock is broken. The Logix side is … Read more
BadIdentityTokenRejected is the answer an OPC UA server gives when the secure channel is up, the client certificate is trusted, and the session request arrives with no user in it, and on an S7-1500 with guest authentication off that is exactly where a first Python OPC UA client stops. It is the third of four … Read more
A snap7 S7-1200 read – plc.db_read(12, 0, 12) against a CPU 1214C – returns twelve bytes on the bench and an exception on the machine, and the difference is two checkboxes in TIA Portal, neither of them on the Pi. python-snap7 3.1.2 talks the S7 protocol to TCP port 102 in pure Python, so there … Read more
A PowerMonitor 1000 puts L1 current in input registers 30201 and 30202, as one IEEE 754 float with the high word in 30201, and answers function code 04 for it. Those four facts — which register, how many, which order, which function code — are the whole job of getting a Modbus RTU power meter … Read more
On an S7-1200 or an S7-1500 there are four places a function block can keep state that is not in its instance DB, and every one of them makes a second FB instance of FB_Valve share memory with the first. The report is always one of three: valve 2 opens when valve 1 is commanded, … Read more
An optimized block on an S7-1500, or on an S7-1200 at V4.x, is created with a 100 byte memory reserve, which is room for 25 Reals of new Statics before a download in RUN has to reinitialise the instance DB. Whether an S7-1500 interface change makes the load preview put “reinitialize” against the block is … Read more
A GET on a CPU 1511 that reads from a CPU 1214C and comes back with ERROR = 1 and STATUS = 8 has almost always been refused by the 1214C, and the 1214C has no code in it to blame. Two settings on the partner decide whether PUT and GET ever return data, and … Read more
Siemens gives you a Retain checkbox and a published memory budget. Rockwell gives you neither. Here is what each one really keeps, and how to check it.