Modicon 984 - Forcing DI / DO via Modbus

[Glenikins]

Hi there, We have a pair of Modicon 984 PLCs on one of our offshore installations. Each PLC appears to have three in-use serial Modbus connections: - one each to a SCADA PC which provides various graphical displays showing data (read only from the PLC, no writes) - two each to another PC which runs two separate applications, each using one Modbus connection: a. ProWorx (used for monitoring the PLC application logic) b. What looks like a proprietary program by Restbury International which provides a simple mechanism for technicians to force digital inputs and outputs in the PLC on and off. The Restbury International package (known as "PSM") has recently ceased to work, and we have no documentation on it. Consequently we have lost the ability to easily force I/O. Of course, we could use the ProWorx package for this, but we require a simplified mechanism that the technicians can use that requires no training, and offers no scope for inadvertent modifications to logic, etc.! Our aim therefore is to utilise the working SCADA PC, and add to its functionality a graphic screen that does the same as the broken PSM package. We have been able to identify (almost beyond doubt...) that the PSM package wrote to the "raw" I/O addresses in the PLC in order to force inputs and outputs on and off. For example, address ranges 00033, 00034 etc. for digital outputs, and 10033, 10034, etc. for digital inputs. The implication of this is that the PSM package was effectively over-writing the values of digital inputs being read from the physical DI cards in the PLC, and also overwriting the coils driven by the PLC application logic before they are written to the DO cards in the PLC. We do not have a spare PLC to test this wih, and would like to be a little more certain that configuring our SCADA package to write 1's and 0's to these Modbus addresses will have the desired effect of overrding the PLC digital I/O. We would have expected the 10033... addresses to be overwritten by values coming in from DI cards and the 00033... addresses to be overwritten by the PLC application logic. So - the query (at last...) - does anyone have any experience with functionality like this, and the relationship between digital I/O addresses, I/O cards, logic, and Modbus? I hope that's clear, and thanks in advance for any help.