Post by caspershes on Checking the device tree, not just the code: what else is worth a static check? ^{CODESYS Forge talk (Post)}
I spend most of my time reviewing other people's CODESYS projects before commissioning, and two kinds of defects keep showing up. Both compile clean. Both read fine. One is in the code. A pause timer whose own input gets cleared inside the branch the timer is supposed to gate: rampDelay(IN := run_2); IF NOT run_2 OR rampDelay.Q THEN run_1 := TRUE; run_2 := FALSE; // the timer's own input, cleared right here ELSE run_1 := FALSE; run_2 := FALSE; END_IF Next scan IN is FALSE, the timer resets, the condition is true again, and the second pump starts immediately. A 30-second ramp delay that actually lasts one task cycle. The setpoint is on the HMI, the operator turns it, and nothing changes. The other is not in the code at all. On one site the outdoor temperature read 0.0 °C in mild weather. The ST was correct, the variable was bound to the channel — but the channel's sensor type was left at "disabled", so nothing was ever digitised. Same class: a module with Disable_module = TRUE, or an analog output bound to a variable while its mode is off. Nothing in the project reports any of this, and the code review never looks there, because the configuration lives in the device tree and not in the POUs. That second class is what pushed me to parse the .export format rather than PLCopenXML alone — the export carries the device tree and the visualization, so "nothing ever writes this alarm variable" stops being a guess and becomes a fact you can check against the screen bindings. Three things about the format that cost me time, in case they save you some: the same device parameter can appear three times (template, internal copy, actual configuration) — the last occurrence is the one in effect; the enum value of a parameter is not in the parameter itself, it is one level down in BaseType/Value; a channel counts as used when a variable is bound to SensorValueN.SensorValue — InputStatus is a bad indicator, people deliberately bind it on spare inputs. So the question. What else would you check automatically, given both the code and the device tree? I am collecting rules from sites, not from style guides, and the configuration side feels largely unexplored. For what it is worth, the checker I use for this is free and runs offline (single exe, no install, nothing uploaded anywhere): https://github.com/caspershes/plc-lint — 43 rules at the moment, reads .export and PLCopenXML. Happy to add rules people here suggest.
Last updated: 2026-10-27

Post by mubeta on Strange problem with the ‘MC_SetPosition’ function ^{CODESYS Forge talk (Post)}
How are the servo drives controlled? EtherCAT, step/dir pulses, other? CANOpen, 1 Mb/s, bus load 35%, cycle time 2ms. Another thought is that - if it's step/dir pulse based control - the pulses from the PLC to the drive are getting missed/lost at high frequencies? If that's the case then there would be multiple troubleshooting steps/corrections that could be investigated. Here, it seems to me that we are getting completely off track with the observed problem. You could try to create a simplified program I had already written this elsewhere. The program before being brought into machines was exhaustively tested in SW emulation and the problem did not occur. However, in emulation I was interested in checking other aspects of the process, not this specific one which is for real a correction made necessary after the fact. The part of the program that does this correction with the function mentioned in the topic, came up from its origins, but I didn't know or didn't think it was really useful. A scruple that later turned out to be necessary. However, for now I do not think I will spend any more time on this verification, already lacking any to do my normal. I remain amazed, however, that a function intended to correct the axis position with the motor in motion and that it should not interfere with this, in fact instead changes behavior as the motor speed changes. Mah! When you manually control the motor directly from the servo drive software at the speeds you are calling for, does it move precisely to the target position? The drive and motor have been working fine for about 10 years. In replacing the machine control system, I opted for CoDeSys where before there was something else. But this is not the subject of the problem. What I need to resolve is the fact that a clutch specially placed at a certain point can slip and, therefore, I have the undeniable need to phase the 'prime mover' to the mechanical position of the machine, detected by a cam for each turn, in order to properly stop at its optimum point. Which for now I have ruled out doing. In fact, if I really have to say, since we have now gone brutally OT, I originally thought that this clutch should only come into action in cases of extreme necessity, as happens in most trials. But this one, the way it is made, slips more easily than I could estimate and the servo-controlled 'prime mover,' and the machine, get out of phase, maybe by a little, but frequently, and when the machine work at it's high speed, (in fact all of the time), I can't adjust properly the 'prime mover' position at fly.
Last updated: 2025-01-18

Post by kuegerls on PROFINET Controller SL: WRREC remains BUSY forever, no DCE/RPC packets transmitted (RevPi Connect 5 + NORD SK205E) ^{CODESYS Forge talk (Post)}
Hello , I am currently evaluating the CODESYS PROFINET Controller SL on a Revolution Pi Connect 5 and have encountered a problem with acyclic PROFINET Record Access (WRREC/RDREC). System Hardware: Revolution Pi Connect 5 Runtime: CODESYS Control 4.16.0.0 (SDK 3.5.21.10) Development System: CODESYS V3.5 SP21 (64-bit) CommFB: 3.5.17.10 ProfinetCommon: 4.6.0.0 PROFINET Controller Device: PN-Controller 4.6.0.0 PROFINET Device: NORD DRIVESYSTEMS SK205E with SK TU4-PNT GSDML: GSDML-V2.46-NORDDRIVESYSTEMS-PNT-20251016.xml Network The PROFINET network is completely separated from the office network. RevPi: eth0 → Office network eth1 → PROFINET wlan0 → Visualization The PN Controller is configured to use eth1. IP configuration: RevPi (eth1): 192.168.100.1/24 NORD Drive: 192.168.100.3 Connection is established successfully. Current Status The PN Controller reports: Controller Status = Run Online = TRUE IP Active = TRUE Connections = 1 Cyclic PROFINET IO communication works correctly. Problem I am trying to access PKW parameters via WRREC (Record Index 100). The request buffer contains: 01 14 00 04 92 00 00 00 00 00 00 which corresponds to Reference = 0x01 Request = Read Axis = 0 Parameter = 170 + 1000 Subindex = 0 Value = 0 The WRREC call is fbWRREC( REQ := xWrReq, ID := ConnectionID, INDEX := 100, LEN := 11, RECORD := ADR(TxBuffer) ); REQ is pulsed for one PLC cycle only. Observed Behaviour WRREC enters BUSY state and never finishes. Observed values: BUSY = TRUE DONE = FALSE ERROR = FALSE STATUS = 16#FFFFFFFF indefinitely. Packet Capture A Wireshark capture was taken on the PROFINET network. Observed traffic: PROFINET RT LLDP DCP Observed: successful cyclic IO Not observed: DCE/RPC Record Write Record Read RPC Bind No RPC packets are transmitted at all. Diagnostic Messages The controller repeatedly reports AR alarm.ind(err) AR CMI timeout although cyclic IO communication continues to work. Already Verified The following points have already been checked: correct Ethernet interface (eth1) correct CREATE_ID result correct Device ID correct Slot/Subslot correct GSDML correct REQ pulse RECORD buffer is larger than LEN cyclic IO communication works different Record Indices (100...104) tested Question Is there any known issue or limitation where WRREC/RDREC requests remain permanently BUSY and no RPC Record Access packets are generated? Could this behaviour be related to Runtime 4.16.0.0, PN Controller 4.6.0.0, the missing runtime license (currently running in demo mode), or any known issue with the PROFINET Controller SL? I am currently evaluating the PROFINET Controller SL and therefore the runtime is operating in demo mode. Could you please confirm whether WRREC/RDREC (acyclic Record Data services) are fully supported in demo mode, or whether a valid license is required for these services? If required, I can provide: complete project archive Wireshark capture (.pcap) GSDML online screenshots diagnostic log Thank you very much for your help. Best regards, Stefan
Last updated: 2026-07-17

Post by thejesh on WebVisu: switch-frame destroys and rebuilds referenced visualization - is retention configurable? ^{CODESYS Forge talk (Post)}
Hi, HTML5 Conrtrol elements on CODESYS V3.5 SP22 Patch 2, WebVisu only (no TargetVisu). The client is Chromium 147 in kiosk mode on a Raspberry Pi CM5 panel; the runtime is CODESYS Control Win V3 x64/CODESYS Control RTE V3 x64 on a separate IPC. I have measured that changing a Frame element's switch-frame variable destroys the currently referenced visualization and fully rebuilds it on return, including all embedded HTML5 controls. We would like to know whether this lifecycle is configurable. Measurement 1: Curently, our production page contains a good number of custom HTML5 controls and will only increase , each of which the WebVisu client instantiates as a separate about:srcdoc iframe. I counted live targets via the Chromium remote debugging endpoint (curl http://localhost:9222/json/list) before and after switching. Production displayed (index 0) 108 iframes Switched to a light page (index 1) 46 iframes Switched back to Production 108 iframes 62 controls are destroyed on leaving the page and re-instantiated on return. Observed latency was approximately 2.5 -5s away from the heavy page and approximately 4.0 -5 s back to it. This was measured with the panel otherwise idle: 2.8% system CPU, 97.1% idle, 2 h 56 min uptime, no remote-desktop session running, hardware acceleration confirmed active in chrome://gpu. I had previously measured the same behaviour under a much higher CPU load and have since resolved that load separately (VISU_TASK cycle period), so I am confident the rebuild is the frame lifecycle itself and not CPU starvation. Measurement 2 — frame offset instead of switch index I then displayed the same overlay page by a different mechanism. Instead of using a switch-frame index, I placed the page in a fixed Frame parked off-screen below the visible canvas, and drive its Y offset from an INT in Structured Text to move it into view. With this approach the overlay appears immediately, the production page underneath is never torn down and keeps updating, and no visualization is destroyed or rebuilt in either direction. The iframe count does not change at any point. This is the same visualization, containing the same HTML5 controls, as in Measurement 1 — the only difference is how it is brought on screen. So the rebuild appears to be a property of the switch-frame mechanism specifically, not of the page or its control count. Questions: Is the destroy-and-rebuild behavior on switch-frame the intended and documented lifecycle for WebVisu? Is there any setting, property or client option that causes a referenced visualization to remain instantiated when it is not the active index — the equivalent of keeping it mounted but not displayed? Does the runtime or client offer any form of caching or pre-instantiation for referenced visualizations, so that a return switch does not pay the full construction cost? Is the cost specific to HTML5 controls, or would the same rebuild occur with an equivalent number of native visualization elements? We ask because it would inform whether reducing our HTML5 control count is a viable solution. Is there a recommended pattern for showing a full-screen page over a live production screen without tearing the production screen down? My current workaround is to keep every page permanently instantiated and move it on and off screen by driving a frame offset variable, which avoids the rebuild entirely but means every page stays live and consumes client resources for the life of the session. This works, but I would prefer to use the supported mechanism if one exists. Any help on this is greatly appreciated. Thank you!
Last updated: 2026-08-07

Post by paulg on RasPi CAA Serial example - unexpected behavior during debug ^{CODESYS Forge talk (Post)}
I've trimmed down the CAA Serial Codesys example to only listen on one port but, when stepping through the Case structure in debug mode, it jumps out of the structure during a specific point in every scan (I'll point it out below after describing the setup and listing the code). I'm using a Pi 4 Model B, and I have an Arduino Nano Every plugged in via USB which is streaming the following serial message at 1 Hz: Time since opening connection: 1 s Time since opening connection: 2 s ...and so on. The Pi shows the Nano at /dev/ttyACM0 so I edited CODESYSControl_User.cfg to read: Linux.Devicefile=/dev/ttyACM The code in my PLC_PRG is (ignore some of the comments, I hadn't deleted them out from the original example): PROGRAM PLC_PRG VAR xStartTest : BOOL:= TRUE; iState : INT; xTestDone : BOOL;(* True, when the test was done succesfully *) (* Settings to communicate with the COM Port *) aCom1Params : ARRAY [1..7] OF COM.PARAMETER; como1 : COM.Open; comc1 : COM.Close; comw1 : COM.Write; comr1 : COM.Read; //sWrite : STRING := 'Test String!'; sRead : STRING(25); szRead : CAA.SIZE; xCom1OpenError : BOOL; xCom1CloseError : BOOL; xCom1WriteError : BOOL; xCom1ReadError : BOOL; END_VAR //This example shows the communication of two COM Ports with each other. //The first one writes a string of characters, which is read by the second one. //After successful execution, the two COM Ports are closed and the test is done. IF xStartTest THEN CASE iState OF 0: //The parameters are set for the COM Port aCom1Params[1].udiParameterId := COM.CAA_Parameter_Constants.udiPort; aCom1Params[1].udiValue := 1; // the correct Port should be adapted aCom1Params[2].udiParameterId := COM.CAA_Parameter_Constants.udiBaudrate; aCom1Params[2].udiValue := 115200; aCom1Params[3].udiParameterId := COM.CAA_Parameter_Constants.udiParity; aCom1Params[3].udiValue := INT_TO_UDINT(COM.PARITY.NONE); aCom1Params[4].udiParameterId := COM.CAA_Parameter_Constants.udiStopBits; aCom1Params[4].udiValue := INT_TO_UDINT(COM.STOPBIT.ONESTOPBIT); aCom1Params[5].udiParameterId := COM.CAA_Parameter_Constants.udiTimeout; aCom1Params[5].udiValue := 0; aCom1Params[6].udiParameterId := COM.CAA_Parameter_Constants.udiByteSize; aCom1Params[6].udiValue := 8; aCom1Params[7].udiParameterId := COM.CAA_Parameter_Constants.udiBinary; aCom1Params[7].udiValue := 0; //The first Port is opened with the given parameters como1(xExecute := TRUE, usiListLength:=SIZEOF(aCom1Params)/SIZEOF(COM.PARAMETER),pParameterList:= ADR(aCom1Params)); IF como1.xError THEN xCom1OpenError := TRUE; iState := 1000; END_IF //After a successful opening, the next state is reached IF como1.xDone THEN iState := 15; END_IF 15: // the reading process is started comr1(xExecute := TRUE,hCom:= como1.hCom, pBuffer:= ADR(sRead), szBuffer:= SIZEOF(sRead)); IF comr1.xError THEN xCom1ReadError := TRUE; END_IF //After completion the size of the written bytes are saved IF comr1.xDone OR comr1.xError THEN szRead := comr1.szSize; iState := 20; END_IF 20: // If everything was successful the ports are closed and the handles are released comc1(xExecute := TRUE,hCom:= como1.hCom); IF comc1.xError THEN xCom1CloseError := TRUE; END_IF IF comc1.xDone OR comc1.xError THEN iState := 25; END_IF 25: // The first port is closed and the used handle released xTestDone := TRUE; xStartTest := FALSE; iState := 0; como1(xExecute := FALSE); comw1(xExecute := FALSE); comc1(xExecute := FALSE); ELSE iState := 0; END_CASE END_IF I realize as I write this that the .udiPort should be 0 and not 1, but that shouldn't be causing the issue I'm seeing. I'm forcing xStartTest:=TRUE every scan so that I can step into each line and observe what's happening. What I see is that the port parameters are set and the port is opened with no errors, but the code jumps out of the case structure to the last line every time it reaches (and I step into) the iState:=15 line (at the end of the iState:=0 block). So every scan cycle it goes through the block for iState=0 and jumps out at the same spot. I'm a little new to PLC programming so I may be misunderstanding the flow, but shouldn't this case structure keep moving down in the same scan? If it only handles one case per scan, why doesn't the value of iState persist? Thanks! Update: I restarted the Codesys control today and I was then able to see an error for como1.eError of "WRONG_PARAMETER". I tried doing some digging and another post made me think I should add another line to CODESYSControl_User.cfg, so I now have: [SysCom] Linux.Devicefile=/dev/ttyACM portnum := COM.SysCom.SYS_COMPORT1 So now when I set .udiPort to 1, I get "NO_ERROR" but I also don't read anything from the port (i.e. szRead = 0 always). If I try setting the port to 0 (which I'm confused about, because I added a COMPORT1 line but the device shows on the Pi as ACM0), I get the "WRONG_PARAMETER" error again. Is there an easier way to troubleshoot the Pi and view what ports the Codesys runtime is actually able to see while the Pi is running?
Last updated: 2024-06-06

Sort by relevance or date