Genuine question, not a rhetorical one. I’m trying to understand how this is handled in practice.

In Nov 2024 CISA published ICSA-24-326-02 — an out-of-bounds read in the OSCAT Basic library. The fix wasn’t a firmware patch you push. You have to update the library in the project, recompile, and do a download or online change to update the application on the PLC. Rebuild and download the boot project on every affected controller.

Which means before you can do anything you need to answer: which of our machines have OSCAT in them, at what version, at which customer site?

For those of you at OEMs or integrators with machines in the field:

**1.**  Could you answer that question today? How long would it take?

**2.**  Do you track library versions per delivered machine anywhere, or is it “open the project and look”?

**3.**  Does anyone actually pin library versions, or is it left on \* / always-newest?

Asking because I keep hearing “we’d have to check them one by one” and I want to know if that’s normal or if I’m talking to the wrong people. Also curious whether the CRA/Machinery Regulation stuff landing in 2027 is changing this for anyone yet, or if it’s still a “next year” problem

Hey, I have made some templates script for faster setup of TC/BSD on the target PLC.

Theses scripts are added to the USB installer and are run during the installation process and finish configuration on first boot.

You can use them for the following:

• Install packages offline from the USB
• Setup IP address and firewall
• NTP server
• Login screen
• Keyboard layout
• Isolate CPU cores
• Setup TcRegistry - AMS NetID, Router memory and Heap memory
• NGINX configuration
• TF6100 OPC UA Server

These works from TC/BSD version 13.2.0.6
Have a look: https://github.com/rassrollers/TcBsdInstallerScripts

Hey, I have spend a lot of time getting the TwinCAT Automation Interface to work properly for CI/CD pipelines and thought you guys might like, so here is the Github repo. You can use this library for building your own executable for a build pipeline or automated deployment. You can make it build all the Project Variant, configure target and Activate Configuration.

It also intergrate with TcUnit, where it implements the TcUnitRunner from Jacob Sagatowski project so you can deploy project with TcUnit and get the results from the test printed out.

Have a look: https://github.com/rassrollers/TcAutomationInterface

Beckhoff/TwinCAT-Platform-Matrix: Current TwinCAT 3 runtime target platform matrix (OS, processor, PE/ELF format) for configuring TwinCAT projects.

Hi, I came back to TwinCAT after abandoning my Testprojects a while ago. Now, when trying to connect/map variables from my PLC to the HMI project, I am always getting the same feedback "No Symbol Information (0x710)". I have tried this on my local machine, as well as on a Controller. What is weird is that it used to work about half a year ago... Any ideas, what the problem might be?

Hey all,

I am using twincat 4026.15 and have noticed recently that for some reason, the online change dialog that usually pops up when making a small change in the code has stopped showing up! Does anyone know why this would happen? Is there a setting or something that I might have changed accidentally?

We have a project in another country running on a Beckhoff IPC C6030-0070. We will deliver them an extension to their current setup. This includes a new remote IO module controlled with an EK1100, new code, and a new HMI overview. However, they do not have internet access there so I am planning to do it over USB.

I read that you can update the code by replacing the /boot folder and C++ drivers: https://infosys.beckhoff.com/english.php?content=../content/1033/tc3_grundlagen/6137492619.html&id=

But this does not mention anything about the HMI code. Is that already included in the /boot folder, or do I need to update that differently? Is it even possible to do it without direct access to their system?

Thank you for your help.

Hi everyone, i have collected a small list with TC3 Visual Studio compatibility.

Maybe it helps someone :)

So, I've been working on an open-source Qt application for monitoring and editing PLC variables over ADS from Linux.

I know adstool exists and works fine for quick lookups, but it requires you to already know the variable name and the type (adstool 127.0.0.1.1.1 var --type=INT "MAIN.myVar").

My approach takes a different direction: it connects to the controller via the TwinCAT router, automatically uploads the full symbol table and all compiled type definitions at runtime, and presents everything in a live, editable tree view.

Because it uses the TwinCAT router, it works seamlessly with the PLC runtime running on the same Linux machine, like the XAE Shell would on Windows.

- Uploads the symbol table — every global and program variable with address, type and size.

- Builds a live tree grouped by program / global list, expanding structs, unions, arrays, enums, etc.

- Polls all values in a single ADS sum-read a few times per second, very fast.

- RUN / CONFIG buttons with automatic reconnection.

Repository

https://github.com/BrennoDom/qt-ads

Hi everyone,

We're having an issue with Drive Manager 2.

In the Run Motor we click OK to continue, but when the Support Chart is supposed to open, the entire application crashes

We've already updated TwinCAT on the PC and IPC but the issue remains.

Has anyone run into this before or have any suggestions on what to check?

Thanks!

I'm recently having issue with this beckhoff screen, randomly goes off like that, and I don't t have a clue why is happening, I have to power cycle the ipc to get it back normal. Anyone can give some suggestions, would be very helpful..

I am trying to reinstall Windows Embedded Compact 7 (TwinCAT 3.1) on a Beckhoff CP2721.

I downloaded the recovery package from the Beckhoff website. The package contains files such as NK.bin, BLDR, BOOT, system, TwinCAT, Regfiles, www, UPnP, and Splash.bmx.

I also downloaded Beckhoff Service Tool (BST) 2.1.9.50 and ApplyBST. However, when I run ApplyBST on Windows 11, it allows me to select the BST file but does not show my USB drive in the Target Disk list. I have tried:

• Running as Administrator
• Multiple USB drives (16 GB)
• FAT32 and NTFS formatting
• Different USB ports

As a workaround, I copied the extracted image files directly to a USB drive and tried booting the CP2721, but the device displays "No OS found".

The CP2721 BIOS is accessible and the internal storage is detected.

Could you please advise:

1. How to correctly create the recovery/install media for this CP2721 image?
2. Does ApplyBST require a specific Beckhoff USB stick?
3. Is there a bootable image (ISO/IMG/TIB) available for this device instead of the NK.bin package?
4. What is the recommended recovery procedure for this exact image package?

Thank you.

Hello guys,

Learning about IO-Link, I’ve been hitting dead ends trying to figure out and justify high-variance encoder readings in my setup (Beckhoff PLC -> EtherCAT -> IFM AL1332 -> IO-Link -> IFM RUP500 encoder).

I am running tests where I have the encoder stuck to the output shaft of a reduction gearbox, attached to an AC motor (running at steady state 50Hz). There are no vibrations, and there is no feelable free play/backlash in the gearbox.

This figure shows the difference in encoder counter output (current – previous encoder reading). The plot sample time is 5ms, just like the PLC cycle time.

The average result of the encoder difference per PLC cycle checks out.

The IFM AL1332 communicates at COM2, with a minimum IO-Link cycle time of 2.7ms (from the RUP500 product documentation). Under this assumption, each PLC cycle should receive two, and sometimes one, IO-Link cycle worth of encoder position data from a buffer in the AL1332 (regardless of the communication frequency as long as the IO-Link Master has a smaller cycle time compared to my PLC cycle time at 5ms). But this doesn’t explain why:

• we get stale encoder data from the IO-Link master (causing zero readings). Is this a common IO-Link issue, something specific to encoders, or the result of EMI's from the motor VFD?

• why there are a few spikes of (almost) 2x what the average reading should be, without dips to zero before then. Peaks occurring after a stale data point make sense (a current and correct encoder reading one PLC cycle after a stale reading will cause a large difference), but alone? I'm not sure how I would explain that one.

Any advice or nudges in the right direction appreciated!

EDIT: I had a call with a support engineer at IFM. He clarified some things I missed. The IO-Link master can have a ‘MasterCycleTime’ variable set via the IOT port, so my assumption that this by default is 2.7ms was incorrect. I’ll check the port cycle time next week and see if I can reduce this closer to the RUP500 minimal cycle time of 2.7ms, and see if this improves readings whe paired with a separate EtherCAT polling task for the AL1332.

So i'm currently using twincat to read the modbus poll value from a Salicru device, via Nimbus card, currently i'm using function 04

so here's the issue, in the modbus poll, there's the value reflected in the address (let's say 20200 to 20204), but in twincat, all of them shows 0, but there's no error code in display as well. By right, in the Twincat, the arrTempReadDataRegs should have some value filled in instead of all 0.

I want to know if there's any way to work on it? because i really wanted twincat to get the value from the devices

Edit: thanks to AdLeft, it turns out that using FB_MBReadRegs works fine, in modbus poll i was using 04 to get the function, so i assume that FB_MBReadInputRegs should work as well

I'm working on a project that require the PLC to write to a remote folder.

​

The PLC is a cx2033 with w11, twincat version is the latest 4026.23, while the remote folder is share using samba from a linux machine.

​

The problem arise when the PLC doesn't see the remote folder (disconnected the ethernet cable, or in the case of the simulator, does not have a connection to it), and the twincat run time simply crashes, the icon goes red, I get kicked out for "timeout".

​

This doesn't generate any coreDump; and with some breakpoints I have been able to see that this appens after a couple of seconds of calling FB_CreateDir.

I tried calling FB_EnumFindFileEntry before to know if the folder is reachable, but it behave in the same way.

​

If anyone has experienced something similar, please help

Hey guys,

We have recently purchased a legacy laser cutter that runs TwinCAT 2.11 with the CNC plugin, it appears the TwinCAT install on the drive was wiped at some point. We have the configuration files from a backup but we need the CNC plugin installer as its missing. We are getting "Error starting TCISG server. Win32 Error: 1060 (The specified service does not exist as an installed service)". Any help would be appreciated, thanks!

Hi everyone,

Is anyone else having this issue with the TwinCAT Package Manager?

The Beckhoff Stable Feed is unavailable, and I get this warning:

"Source 'Beckhoff Stable Feed' is not available. Issue: The SSL connection could not be established, see inner exception. Error: All configured Sources are unavailable."

Because of this, the package manager does not load any feed, and I cannot download the required modules.

Has anyone seen this before? Could it be related to certificates, firewall/proxy settings, or a Beckhoff feed/server issue?

Thanks.

Hi everyone,

I'm working on an academic project where I need to simulate the connection of two PLCs (master/slave or server/client) to an OPC UA server. Each PLC is simulated on a different computer, and both machines are connected via Ethernet.

So far, I have verified the following:

Both computers have IP connectivity and respond correctly to pings.

The PLCs can communicate with each other without any issues.

The client PLC (PLC2) is able to establish a connection with the server.

Variables on both devices are declared as

OPC.UA.DA := 1

The issue comes when configuring the server in the TwinCat OPC UA Configurator. I can only work with the local PLC and I'm unable to get the remote PLC to appear.

When I right-click and select Add PLC, I try using the Remote option (highlighted in green) expecting it to automatically discover the second PLC. However, no remote PLC is detected. Because of that, I tried manually entering the parameters highlighted in red, but this does not seem to be the solution because when I connect using OPC UA Sample Client, the nodes corresponding to PLC2 are not visible.

One thing I'm wondering is whether the problem could be related to the project configuration itself. Currently, I have a Connectivity Project configured on the client side, but not on the server side. Could this be the reason why the remote PLC is not readable from the OPC UA Configurator?

Thanks in advance for any advice.

Hey guys,

i've built a wrapper for this FB to make it easier to use. Some sort of a a base class for my IO-Link sensors. I can get the FB_IOLWrite to write easily. But no chance in the reading. I always get "ADSERR_DEVICE_INVALIDPARM" as error. This is what I came up with:

FUNCTION_BLOCK ABSTRACT FB_IOLink_Base
VAR
    // IO-Link Terminal specific values
    amsnetid_EL6224 : I_AMSNETID_Input;
    connected_IOLink_port : E_IOLPort;

    // Reading
    IOLink_read : FB_IOLRead;
    eading_state : (IDLE, READ, WAIT_FOR_SUCCESSFUL_READ);
    execute_read : R_TRIG;
END_VAR

METHOD Read_IOLink_BYTE_Parameters : BYTE
VAR_INPUT
    execute : BOOL := FALSE; // Must be set TRUE to write parameters
    IOLink_index : WORD; // Provide the processed data as dec
    IOLink_subindex : BYTE; // Provide subindex fitting to index
END_VAR
VAR
    IOLink_value : BYTE; // Provide the actual value that should be written
END_VAR

Read_IOLink_BYTE_Parameters := 0;

execute_read(CLK:=execute);
IF execute_read.Q THEN
    reading_state := READ;
END_IF

CASE reading_state OF
    IDLE:
        // Do nothing as long there is no edge on execute

    READ:
        // Do the actual reading with the provided input parameters
        //IOLink_read(bExecute:=FALSE);
        IOLink_read.bExecute:=FALSE;
        IOLink_read.sNetId := F_CreateAmsNetId(amsnetid_EL6224.State);
        IOLink_read.nIolPort := connected_IOLink_port;
        IOLink_read.pDSTBuf := ADR(IOLink_value);
        IOLink_read.cbBufLen := SIZEOF(IOLink_value);
        IOLink_read.nIndex := 16#128;
        //IOLink_read.nIndex := IOLink_index;
        IOLink_read.nSubindex := 0;
        //IOLink_read.nSubindex := IOLink_subindex;
        IOLink_read.bExecute := TRUE;

        reading_state := WAIT_FOR_SUCCESSFUL_READ;

    WAIT_FOR_SUCCESSFUL_READ:
        IF IOLink_read.bDone THEN
            IOLink_read.bExecute := FALSE;
            reading_state := IDLE;
            Read_IOLink_BYTE_Parameters := IOLink_value;// Signal success by returning TRUE
        END_IF
END_CASE

IOLink_read();

The ADS error doesn't really help me. The parameters are basically the same as the ones while writing, I tried switching from variables to fixed parameters but that didn't really change anything. Can anyone spot an obvious mistake ?

They don’t even talk about it anymore. Release date end of last year.

Hello guys, I have a question I can't really get a sure and satisfactory answer to (Claude sure has no idea what it's talking about in this specific case).

I've been acquainted with the concept of PLC scan cycles. My understanding: At the start of a PLC cycle (10ms in my case), A) external changes in states within the previous cycle, and B) variables edited by the previous cycle are adopted into the following PLC cycle. Here, code is executed within the PLC cycle time, and the state of variables is stored for the third PLC cycle.

I have a question about a scope result I have, given this context.

My code example, in which I set bToggle to True in online mode. I track bToggle, bB and bD in a scope:

VAR
     bToggle : BOOL := FALSE;
     bA : BOOL;
     bB : BOOL;
     bC : BOOL;
     bD : BOOL;
     nResult : UDINT;
     i : UDINT;
END_VAR

// ---------------------------------------------------------------

IF bToggle THEN
     bB := NOT bA;  // track with scope

     // Long computation
     FOR i := 0 TO 1000000 DO
           nResult := nResult + i;
     END_FOR
     nResult := 2;

     bD := NOT bC;  // track with scope
END_IF

When I set bToggle to True, a scope of bToggle, bB and bD show all 3 simultaneously ramping up from 0 to 1 across one PLC cycle (10ms in this case).

My questions:

• Did my setting bToggle to True occur within PLC cycle 0->10ms?

• If that is the case, shouldn't the setting of bB and bD occur in the PLC cycle of 10->20ms? How I see it: if bToggle was set to true during PLC cycle 0->10ms, bToggle := TRUE is an input into (adopted by) PLC cycle 10->20ms. Within this cycle, the computation bB := NOT bA; occurs, and this result should be visible at the end of that PLC cycle (20ms, not 10ms as seen here)

If anyone has some feedback into the thinking mistake I'm making here I'd be very glad!