Reading Equipment Constants From the Host: S2F29 for the Namelist, S2F13 for the Values
You asked S2F13 for one ECID and S2F14 came back with two values. Real S2F29 and S2F13 bytes, and the length check host code must run.
Articles
Practical SCADA notes
Field-oriented references for HMI/SCADA systems, industrial communication, alarms, tags, historians, and project delivery.
Why Your S6F11 Never Arrives: Getting S2F33, S2F35 and S2F37 in the Right Order
Your report is defined but S6F11 never arrives. Real S2F33, S2F35 and S2F37 captures from two equipments, and what a non-zero LRACK tells the host.
The Equipment Stamps Your S6F11, Not Your Host — Checking That Clock With S2F17 and S2F31
Equipment clock drift reorders S6F11 events while HSMS stays green. Reading the clock with S2F17, setting it with S2F31, and why TIACK 0 proves nothing.
Why Your S2F41 Comes Back HCACK 2 While the Tool Screen Says ONLINE
S2F41 START rejected with HCACK 2 while the equipment screen reads ONLINE. Separating the SEMI E30 communication state from the three control states, with a real HSMS capture showing the byte where HCACK flips from 2 to 0.
Prove a Full GEM Startup Handshake Without Any Equipment
Run all ten SEMI E30 startup steps — S1F13 through S2F31 — with one npx command against a simulator, with the equipment-side wire capture of the run, what each PASS proves, and what a refused Select actually prints.
Why Your SECS/GEM Host Can't Count on Getting an S9 Error Message
Five bad SECS-II messages pushed at a live HSMS listener. One drew a real S9F7, the rest came back as SxF0 aborts. What SEMI E5 stream 9 means and how to read MHEAD.
Why HSMS SystemBytes Uniqueness Is Your Host's Job, Not the Equipment's
A real capture where two HSMS requests share one SystemBytes and the replies come back byte-identical, plus the allocation rules that prevent it.
Which HSMS Timer Just Fired? Telling T3, T6, T7 and T8 Apart
One log line says timeout. A real HSMS capture separates T3 from T6, pins the SEMI E37 defaults (T3 45 s, T6 5 s, T7 10 s, T8 5 s) and shows the two timers your host has to enforce itself.
Why a SECS/GEM Recipe Upload Should Start With S7F1, Not S7F3
A 300-byte PPBODY is 330 bytes on the socket. A real S7F1 and S7F3 capture, and what a host loses by skipping the grant step.
HSMS Active vs Passive: Which Side Dials, and What Happens When Neither Does
Connection refused in 3 ms, or a TCP session where nothing ever arrives. Real captures that tell the two HSMS mode mistakes apart.
SELECTED Is Not Communicating: When S1F13 Never Gets an S1F14
The HSMS session is SELECTED and S1F13 draws only a T3 timeout, while Linktest answers on the same socket in 0 ms. A capture, and two state machines.
Your SECS-II Length Byte Counts Bytes — Unless the Item Is a List
An S1F3 body byte by byte: the item header packs format code and length-byte count, and one wrong length silences the whole connection.
Your HSMS Deselect.req Got No Reply, and the Session Is Still Up
A capture where Deselect.req, Reject.req and two unassigned STypes all draw silence, while Linktest answers instantly and the session stays SELECTED.
Two Hosts, One HSMS Port: Why the First Session Never Finds Out
A capture of two host connections into one passive HSMS listener. Both get Select Status 0, and the first is never told the second arrived.
Why Your SECS-II Message Gets No Reply: The W-Bit Shares a Byte With the Stream
S1F1 sent, no S1F2, T3 expires — and the tool did nothing wrong. Captures of Header Byte 2 showing what packing the W-bit and Stream together costs.
One TCP Read Is Not One HSMS Message: Framing on the Length Header
A host that only drops replies under load is usually a parser treating one recv() as one message. Four captures: two messages in one write, one split, a body short of its length field, and a prefix claiming 1 MiB.
Why Your HSMS Separate.req Never Gets a Reply, and What Happens If You Skip It
The host shut down but the tool still shows SELECTED. Two captures side by side: a session ended with Separate.req, and one where only the socket closed.
A Tool That Answers Linktest But Never Completes Select
In HSMS, alive and connected are different states. A real capture of Linktest and S1F13 sent before Select ever goes out, the Reject.req reason 4 that SEMI E37 asks for there, and why the timer that fires first is T6, not T7.
An Accepted Select and a Refused One Differ by a Single Byte
Real Select.rsp captures — accepted, refused with SEMI E37 Select Status 1/2/3, and answered under a different SessionID — and where 'select failed' loses the detail.
HSMS Select Timeout: Three Causes That Look Identical in the Host Log
Real captures of the three ways a Select gets no usable answer — silence, mismatched SystemBytes, and a wrong SessionID — and the SEMI E37 timers T5, T6 and T7 that decide what your log shows.
Your SECS/GEM Host Logs 'No Reply' and the Equipment Did Answer
A real HSMS capture from 127.0.0.1:5501: request and mismatched Select.rsp decoded byte for byte, what a host's SystemBytes-keyed pending reply table does with the frame, and why the timer that fires is T6 and not T3.
What a Redundant PLC Actually Protects — and How to Commission One
A hot-standby pair earns its cost only if switchover is proven and sync loss is alarmed. What CPU redundancy covers, and testing both directions.
Getting Modbus RTU Through a Serial Device Server Without Dropping Frames
Commissioning a serial-to-Ethernet device server carrying Modbus RTU: operating mode, packing timers, TCP framing, idle timeouts and half-duplex control.
HMI Command Reset Behavior After PLC Restart
Designing and testing HMI command bits, acknowledgements and startup recovery so a stale command can't fire after a PLC or controller restart.
Alarm Help Text That Survives 02:00: Cause, Consequence, and the Action You Actually Want
Alarm help text is written once during rationalization and never read again. What belongs in cause, consequence and response for a 02:00 operator.
HMI Color and Shape Semantics for Operator Screens
Practical HMI notes for using color, shape, text, and state rules so operator screens stay readable during abnormal conditions.
Your HMI Breadcrumb Should Follow the Plant, Not the Project Tree
Making an HMI screen state its own identity: ISA-101.01 display hierarchy as the breadcrumb skeleton, command labels that show scope, and testing copied screens.
Your HMI Says Step 40 — It Should Say What Step 40 Is Waiting For
A sequence screen showing only a step number sends the operator hunting across four displays. Separate state, step, and hold reason, and latch the reason.
Setting Modbus RTU Timing So Radios and Old Meters Actually Answer
How to choose Modbus RTU baud rate, silent interval (t3.5), and turnaround delay so slow serial devices get a fair chance to reply on a SCADA link.
Pull the Cable: Proving an Industrial Ethernet Ring Actually Fails Over
A commissioning sequence for RSTP, MRP and PRP rings that measures what operators see: convergence time, dropped subscriptions, half-open sockets.
An Equipment Constant Is a Recipe Change With a Different Name
The host wrote the EC, the tool returned EAC = 0, and nine lots ran on the old value. SEMI E5 EAC codes, a real S2F13 readback on the wire, the S2F29 namelist, and the SAT matrix.
What SECS/GEM Spooling Actually Saves When the Host Drops for an Hour
SEMI E30 spooling only covers streams the host enabled with S2F43. SPOOL LOAD vs UNLOAD, the S2F44 RSPACK and STRACK codes, S6F24 RSDA, and the S2F43 bytes on a real socket.
Modbus RTU Timeouts Are Usually a Wiring Problem: An RS-485 Commissioning Walkthrough
Commissioning a Modbus RTU link the right way: prove polarity, termination, biasing and grounding before you ever open the register map.
How to Test SCADA Server Switchover Without Fooling Yourself
A green redundancy icon proves the heartbeat works and nothing else. What to check on clients, alarms, historian and background jobs during a failover.
How to Downsample Historian Data Without Losing the Trip That Mattered
Averaging old process data hides trips and flattens peaks. Classifying tags, picking a method per class, and testing a purge job before production.
Why the HMI Shows the New Recipe While the Machine Still Runs the Old One
Split selected, downloaded and active recipe state into separate tags, compare what the PLC echoes against what you sent, and give rejections a reason.
Your SCADA Backup Isn't a Backup Until It Restores on a Clean Machine
Running a restore drill: what falls out of the backup set, the OPC UA certificate traps, RPO and retention per artefact, and a measured RTO against the target.
SCADA Service Account Password Rotation: Trigger It on Events, Not a Calendar
Nobody memorizes a service account password, so a 90-day policy buys little. What IEC 62443-3-3 SR 1.2 and NIST 800-63B actually ask for.
Why Alarm Acknowledge, Latch, and Reset Must Stay Separate Signals
One shared bit for acknowledge and reset is how alarms vanish while the fault is live. Separating active, latch, ack, return-to-normal and reset.
Why Your HMI Screen Is Slow: Measure Tag Load Before You Redraw Graphics
Split a five-second faceplate into first-load and update delay, then work down through tag counts, scan classes, trend queries and PLC load.
What HCACK=0 Really Tells You About a SECS/GEM Remote Command
Reading SEMI E5 HCACK and CPACK codes against a real S2F41 wire capture: why HCACK=4 exists, E30 control-state gating, and a retry that won't fire a second START.
Why a Successful Modbus Write Doesn't Mean the Motor Started
A Modbus TCP write response says the transaction was accepted, not that the motor moved. Command discipline: permissives, readback, and the retry trap.
The Banner Was Empty and the Plant Was Not Quiet
Filtering an alarm banner is not suppressing an alarm, and ISA-18.2 draws that line for a reason. What the default view owes the operator during a flood.
If the Vendor VPN Lands on the PLC Subnet, You Don't Have a DMZ
Designing SCADA remote access against IEC 62443-3-3 SR 5.2 and SR 1.13, testing the denied paths at commissioning, and the port and timeout numbers that break it.
How Long Should an Alarm Delay Be? Set It From Process Time, Not a Default
Setting on-delays, off-delays, debounce and deadband from process behaviour and ISA-18.2 — filtering nuisance alarms without hiding the first warning.
Finding the First-Out Alarm When Your SCADA Floods
Alarm floods bury the initiating cause. Preserving first-out, trusting sequence-of-events timestamps, and stopping comms failures becoming floods.
Make HMI Commands Prove They Worked, Not Just That You Clicked
How to drive HMI state from feedback instead of command bits, set timeouts from real actuator travel, and show operators why a command was rejected.
Your GEM Link Is Green and MES Still Can't Rebuild the Run
Linking SECS/GEM collection events with S2F33/S2F35/S2F37, why report content empties after a tool restart, and proving S6F11 matches the real sequence.
How to Test OPC UA Redundant Failover Before the Plant Depends On It
A field-tested procedure for OPC UA redundant failover: ServiceLevel, subscription recovery, certificates, and catching stale data before operators do.
It Connects with None but Fails with Basic256Sha256: Debugging OPC UA Trust
Why a client browses fine with security off but drops the secure channel, and how to fix trust stores, endpoints and certificate names in a project.
HMI Permissive and Interlock Display Checklist
How to show permissives, interlocks, inhibits, bypasses, command readiness, and first-out causes on practical HMI screens.
Modbus Exception Codes: The Device Answered, It Just Said No
Reading Modbus exception responses on the wire, telling a refused request from a dead link, and chasing illegal-address and gateway causes.
Alarm Rationalization Workshop Checklist
Running alarm rationalization sessions that produce usable priorities, causes and operator response guidance instead of another unread spreadsheet.
Why Operators Code Everything as "Other" — Fixing an MES Downtime List
Designing downtime reason codes operators pick correctly under pressure: prompt timing, auto-coding from PackML state, and the fields reports need.
OPC UA Certificate Renewal Checklist
A practical checklist for renewing OPC UA application certificates without breaking SCADA clients, historians, gateways, or production HMI connections.
Why Your HMI Should Never Merge Mode and State Into One Field
Mode is who may command the equipment; state is what it is doing. SEMI E30's control state model splits them — here is how to split the HMI to match.
A Clean Modbus Poll Can Still Show the Wrong Number: Commission the Register Map First
Modbus connects, unit IDs respond, polls complete — and the operator still reads a swapped float. Proving a register map before the historian trusts it.
How to Catch a Frozen SCADA Value Before the Operator Trusts It
A SCADA screen shows a believable number long after the device stopped updating. Heartbeat, watchdog and stale-data tags that make freshness visible.
Things I Learned from Real HMI/SCADA Projects
Project notes about naming, alarms, screenshots, networking, commissioning, backups, and documentation habits that matter later.
SCADA Network Troubleshooting Checklist
A layered checklist for troubleshooting SCADA communication problems from physical link to protocol behavior.
The One Bit That Decides Whether a SECS/GEM Alarm Is Set or Cleared
S5F1 carries ALCD, ALID and ALTX. Bit 8 of ALCD is set-versus-clear, and dropping it leaves an MES alarm list that never goes green. Plus the S5F5/S5F6 recovery after a host restart.
OPC UA Client Commissioning Checklist
A practical checklist for commissioning OPC UA client connections from SCADA, HMI, historian, or gateway software to PLCs and automation servers.
HMI Faceplate Design Checklist
A practical checklist for designing HMI faceplates that operators can use quickly, consistently, and safely during normal operation and troubleshooting.
Industrial Ethernet Switch Commissioning Checklist
A field checklist for commissioning managed industrial Ethernet switches used by SCADA servers, PLCs, remote I/O, drives, cameras, and protocol gateways.
Shelving vs. Suppression: Quieting SCADA Alarms Without Hiding Real Risk
How ISA-18.2 splits shelving, designed suppression, out-of-service and interlock bypass — and configuring them so every hidden alarm keeps an owner.
SCADA Commissioning Checklist
A commissioning checklist for validating HMI and SCADA screens, tags, alarms, trends, historians, users, backups and comms paths before handover.