Internet PLC Forum

Thanks for helping to document the timer behavior. You are mostly right simply based on your observation! The followings describe exactly what happens during the timer updates:

1. Following reset, the input state for all TIMERs is set to zero to indicate that the TIMERs are inactive.
   The contact associated with each TIMER is set to 0 to indicate that the TIMER has not timed out.
   The timer present value are all set to -1, indicating that the timer is inactive.

2. On the each scan of the ladder logic the evaluates the control input state for each structure during the
   ladder logic scan.  This state is maintained in the data structure associated with the TIMER.

3. If the ladder logic scan determines that the TIMER control input is 0 or false, the contact associated with the
   TIMER is set to 0 or de-asserted and the timer PV is set to -1.

4. If the ladder logic scan detects that the TIMER control input has transitioned to l, then the TIMER is active.
   The TIMER PV is reloaded from SV and the TIMER's contact is set to 0 or FALSE. These changes happen when the
   rung of ladder logic that controls the TIMER is executed.  These changes are visible to all other rungs of ladder
   logic that follows the rung that controls the TIMER.

5. Every 0.01s the timer countdown task is run. If a timer's PV is >= 0 it will be processed either every time the
   timer countdown task is run (for high speed timers with 0.01s time-base) or every 10th time the timer countdown
   task is run (for regular timers with 0.1s time-base). Timer countdown task runs on interrupt and
   is independent of the PLC program scan time so that the timer can count down accurately even if the program
   scan time is > 0.01s.

   At the start of each ladder logic scan, each TIMER that is active at the end of the previous scan may have its PV
   decremented based on either a 0.1 second or 0.01 clock., the I/O scan cycle check and if the TIMER's PV is now 0,
   then the contact associated with this TIMER will be set asserted (set TRUE).  Please note that contact
   transitions for 0..1 at the start of the ladder logic scan and NOT at the rung of code that controls the TIMER. THAT"S RIGHT!!

The most important points to take away from this long winded guess on TIMER behavior is that a TIMER's contact is set TRUE (1) at the beginning of the scan and the contact is set FALSE (0) at the ladder logic rung that controls the TIMER is evaluated.   THAT's RIGHT!!

Try using a PC based Modbus software to test the communication with your device and see if the address and data wrtten is acceptable. That gives you better visibility of what's going on between the Modbus client and the Modbus server. Once you can confirm that the address or data is valid you can then use the same function, address and data to send from the PLC to the device.

One such tool is the Modbus Poll software that you can download from:

http://www.modbustools.com/

They have a free evaluation version that will run for a few minutes and then stop. You can restart it again.

Also try using Modbus function 16 (0x10) to execute the WRITEMODBUS command instead of function 06 in case the device does not support function 06 at this particular address.

Is the FMD88-10 the master to read 32-bit data from a slave device?

All Modbus registers are accessed in 16-bit only. To access 32-bit data you normally would need to read two adjacent Modbus registers into two DM16[] and access them as a DM32[] variable.

The PLC handles number in Big Endian. If the slave (server) arrange the data in Little Endian you will need to use TBASIC to swap the two adjacent DMs so that the are arranged in  Big Endian.

Are there any other interrupt intensive activities going on at the same time. E.g. High speed counter or pulse measurement?

What is your PLC firmware version? If it is >= r83 you could try upgrade the firmware to the latest where interrupt service routine has been improved to avoid overrun of the interrupt service queue where there are lots of interrupt happening at high speed, as reported by Gary. The improved interrupt service has worked well for Gary and eliminated the issue he mentioned, although his issue is quite different from your report.

Are you using the touch screen to trigger an input?

Note that the PLC physical input is refreshed every end of the ladder logic scan. That means that if the HMI triggers a physical input when the ladder logic program has already passed the rung that uses the input (to latch a relay or count down a timer), the input bits will be refreshed at the end of the ladder logic scan and the changes from the HMI is lost. This can cause the input trigger from the HMI to be unseen by the ladder program.

The correct way is always for the HMI to turn on an internal relay bit and the internal relay bit is then used by the ladder logic program for decision making. The program can then clear the internal relay bit after the command has be executed. This ensure that the input will not be cleared by the I/O refresh cycle.

Topics is related to TRI PLC

http://www.triplc.com/yabbse/index.php?board=1;action=display;threadid=2300

Your code is automatically protected from downloading by any user once it is transferred to the PLC. There is no backdoor means to recover the program from the PLC. That is the feature of these OEM PLCs. However you do need to backup your program properly because if you lose the source program we will not be able to help you recover the program.

Given the low cost of SD card, some OEM would put a copy of the actual program inside a password-protected ZIP file and attach the SD card to the control panel. Only the OEM knows the password to unzip the program. That ensure that a secure copy of the source code follows the machine but only the OEM can access the program.