Post by madskaizer on Task Priority Documentation? ^{CODESYS Forge talk (Post)}
Hi All I was watching the Wago PFC300 webinar ( https://www.wago.com/global/lp-thank-you-onlineseminar-pfc-300 ), and the presenters comment about priority 1 being way above the Ethernet task priority, so that a priority 1 PLC program can actually loose SCADA connection, made me try to round up some hard evidence on Codesys Priorities. I find there is very little information on "correct" task priority configuration. There is a lot of different hardware manufacturers, using Codesys Runtime, that has different descriptions in their manuals on how to set up priority. https://doku.amk-motion.com/en/Subsystems/PDK_202975_A-Serie_en/Content/Projekt/AMKAMAC/PDK_202975_A4-A5_Produktbeschreibung/Funktionalitaet/PLC-Programming/PLC%20Tasks.htm?TocPath=PLC-Programming%7C_____7 https://product-help.schneider-electric.com/Machine%20Expert/V1.1/en/SoMProg/index.htm?#t=SoMProg%2FTask_Editor%2FTask_Editor-7.htm&rhsearch=priority&rhhlterm=priority&rhsyns=%20&SUBSTRSRCH=1 https://content.helpme-codesys.com/en/CODESYS%20Development%20System/_cds_f_task_configuration.html So my questions :) 1) If there is only 1 PLC_PRG task, does priority matter? 2) What is the priority of Ethernet / communication, if nothing is entered? 3) What is the priority of Codesys OPC UA server? 4) Some users here on forge mentions that Wago PLC programs should run as priority 11, but where does this recommendation origin from? 5) What are you recommendations for a relatively slow process, like building automation? It uses OPC UA for communication to SCADA, maybe some MODBUS-RTU and MODBUS-TCP, usually around 100 I/O, been running with everything in a single task at priority 1, 50-100ms cycle time. Some controllers have separate MODBUS tasks, but doesn't seem like a big difference. How would you recommend splitting up communication, IO fieldbus and programs into differently prioritized tasks? I know its a complex matter and all about my application, but I really miss there was just some kind of guidance in the documentations and with all new standard Codesys programs having priority 1 as default, makes it seem less important, than it really is.
Last updated: 2025-08-11

Post by baltzer on ICertificateVerifier.VerifyCertificate doesn't appear to override an ERR_CERT_HAS_EXPIRED rejection in TCP_Client.Upgrade() ^{CODESYS Forge talk (Post)}
Follow-up: working workaround found (routing TLS outside CODESYS) For anyone finding this thread later with the same problem (a third-party device presenting a self-signed and/or expired certificate that ICertificateVerifier/udiVerificationMode won't let you connect through) - we never got a working fix within NBS itself, but found a practical workaround worth sharing. Approach: run a local TLS-terminating proxy on the same host as the CODESYS runtime, and have CODESYS talk plain, unencrypted TCP to it instead of connecting to the remote device directly over TLS: CODESYS --plain TCP--> 127.0.0.1:<port> --stunnel/TLS--> <remote device>:<port> We used stunnel (client mode), with certificate verification explicitly disabled at that layer (verifyChain = no, verifyPeer = no) - a simple, well-documented one-line option, unlike anything we could get working inside NBS. Running it as a systemd service with Restart=always means it survives reboots and recovers automatically if the proxy or the remote device drops. On the CODESYS side, this required no changes beyond pointing TCP_Client at 127.0.0.1 instead of the device's real IP, and removing the TLSContext/ICertificateVerifier code entirely - the rest of our application-layer logic (framing, checksums, etc.) was completely unaffected, since none of that ever depended on where the TLS termination happened. Confirmed working end-to-end against a real device with an expired self-signed certificate, running on CODESYS Control for Raspberry Pi SL (Linux). We haven't yet set this up on Windows - stunnel does have Windows builds available, so the same general approach should be possible there too, but that combination isn't tested or confirmed by us at this point. Caveat: this only makes sense when the proxy and the CODESYS runtime are on the same trusted host (in our case, both on the same Raspberry Pi) - don't expose the proxy's plaintext side on a reachable network interface, since that would create an unauthenticated plaintext path to the device. The original question - whether there's a supported way to override an ERR_CERT_HAS_EXPIRED/self-signed rejection from within NBS's own TLSContext/ICertificateVerifier - remains open as far as we know. Still happy to hear from anyone who's solved that particular piece, since the workaround above is a practical detour rather than an actual answer to the original question.
Last updated: 2026-08-06

Sort by relevance or date