Eugen

Help decoding a program and writing comments

9 posts in this topic

This is a machine with a CQM1 PLC and a NT31C HMI. Battery of the HMI run out and the HMI program was lost. I got the PLC program and identified some of the memory locations, can use the machine but not fully. Omron is not my thing so I am looking for some help to identify program functionality.

some sequencer functionality and a servo, not many I/O's. The entry from the HMI is converted and has some math maybe to address the 16bit limitation, not sure.

Is a home made machine and the original controls contractor cannot be located.

Share this post


Link to post
Share on other sites

You're looking for someone to reverse engineer a program and make an HMI project for it?

That's asking a lot....

You would be surprised how quickly you can learn to navigate a project in CX-Programmer.

Right click on any item in the program and select Find.

Comments will be appended to every instance of an address.

Physical IO is addressed 0.01 for example, there is no preceding letter like all the other memory areas.

I've reverse engineered many projects on many platforms and CX-Programmer is probably one of the easier ones to do it with.

Share this post


Link to post
Share on other sites

Are you sure the program is lost? What do you see on the screen?

The battery in the NT31C is for the clock only. The program is stored in flash memory.

Share this post


Link to post
Share on other sites
44 minutes ago, IO_Rack said:

Are you sure the program is lost? What do you see on the screen?

The battery in the NT31C is for the clock only. The program is stored in flash memory.

Then probably the flash is gone

picture attached

 

2 hours ago, photovoltaic said:

You're looking for someone to reverse engineer a program and make an HMI project for it?

That's asking a lot....

You would be surprised how quickly you can learn to navigate a project in CX-Programmer.

Right click on any item in the program and select Find.

Comments will be appended to every instance of an address.

Physical IO is addressed 0.01 for example, there is no preceding letter like all the other memory areas.

I've reverse engineered many projects on many platforms and CX-Programmer is probably one of the easier ones to do it with.

I already identified some of the data and I can input from CX enogh to run the machine. However the problem is with one timer. Value goes to one address DM130 4 hex digits and then does some math gymnastics and ends up at timer 1. I cannot put a high value for the timer.

NT31C.png

Share this post


Link to post
Share on other sites
18 hours ago, Eugen said:

I cannot put a high value for the timer

It is probably scaled in the HMI... or was scaled. It's also possible the data type is different. If I remember correctly, the CQM1 used only BCD data type for timers. Instruction set changed significantly with the CQM1H. 

If you can post the PLC program then do so. If not, take a screen shot of the timer and we'll be able to help you with that.

Share this post


Link to post
Share on other sites
3 hours ago, IO_Rack said:

It is probably scaled in the HMI... or was scaled. It's also possible the data type is different. If I remember correctly, the CQM1 used only BCD data type for timers. Instruction set changed significantly with the CQM1H. 

If you can post the PLC program then do so. If not, take a screen shot of the timer and we'll be able to help you with that.

Thanks I sent a message

Share this post


Link to post
Share on other sites

Thanks again IO.rack, This is the best i can read this program so far.

Program has n cycles, number of cycles is entered on DM100.

Each cycle has a heating time and cool time. Heating time on DM120 and cooling time on DM130.

Each timer entry is on respective DM address 4 digits hex while for cooling seems to be 000.0 in sec for heating looks like 00.00 sec so the time limit is very limited. I cannot enter a bigger time value. than FF.ff. I dont want to change the program if the provissions are there and I am missing something.

There is no HMI for the moment I am trying to drive the machine from CX. But I am considering getting NS5SQ11BV2 (recomandation from OMRON) any other option you sugest.

Program attached ,

Thanks

 

OmronPLC_march17_cmnt.cxp

Share this post


Link to post
Share on other sites

I can post more detail when I get some time. For now, a value of FF is illegal for BCD. It appears you are monitoring in HEX which is correct for reading BCD. Make sure you enter the value in BCD. You will need to precede your entry with #. For example, double click DM130 and enter #0120. I saw in the program that is is multiplied by #10 and the result goes in DM230 which is used by the 0.1 second timer. So the timer value will now be #1200. (120.0 seconds).

When programming the NT30, you'll also need to make sure the value is interpreted as BCD/Hexidecimal. There is a selection for that in the Numeral Display object.

1 person likes this

Share this post


Link to post
Share on other sites

Here is another tip.... Select DM130 in the ladder program then click the Address Reference Tool. This will show you every instance where it is used in the program. I can see where it looks like HMI buttons are used to increment and decrement this value. I can also see where the value is clamped between 0 and #900.

Mr_PLC_AddressRefTool.thumb.JPG.6fefd798

1 person likes this

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now