An S2F0 Doesn't Tell You Why: Unimplemented Function or Closed Communication Gate
Two captures from one HSMS session show S2F23 aborted twice for different reasons, and the reply bytes differ only in SystemBytes.
Articles
Practical SCADA notes
Field-oriented references for HMI/SCADA systems, industrial communication, alarms, tags, historians, and project delivery.
An HSMS Reply's Session ID Is Not Always the One You Sent
Select.rsp and Linktest.rsp carry the Session ID the tool chose, not the one you sent. Data replies echo it. Three real HSMS captures.
The Tool Acked the S5F1 Your Host Should Never Have Sent
Alarm integration passes every test and no alarm ever arrives. A real capture: S5F1 sent by the host draws ACKC5 0, and S10F3 draws an abort.
GEM Is Not GEM300: Which SECS Streams E87, E40 and E90 Actually Use
One socket, five primaries: S1F13 answered, S3F17, S14F1 and S16F11 all came back SxF0. What SECS/GEM support does and does not include.
Reading Equipment Constants From the Host: S2F29 for the Namelist, S2F13 for the Values
You asked S2F13 for one ECID and S2F14 came back with two values. Real S2F29 and S2F13 bytes, and the length check host code must run.
Why Your S6F11 Never Arrives: Getting S2F33, S2F35 and S2F37 in the Right Order
Your report is defined but S6F11 never arrives. Real S2F33, S2F35 and S2F37 captures from two equipments, and what a non-zero LRACK tells the host.
The Equipment Stamps Your S6F11, Not Your Host — Checking That Clock With S2F17 and S2F31
Equipment clock drift reorders S6F11 events while HSMS stays green. Reading the clock with S2F17, setting it with S2F31, and why TIACK 0 proves nothing.
Why Your S2F41 Comes Back HCACK 2 While the Tool Screen Says ONLINE
S2F41 START gets HCACK 2 while the tool reads ONLINE. SEMI E30 communication state versus control state, and the captured byte that flips HCACK to 0.
Prove a Full GEM Startup Handshake Without Any Equipment
Run all ten SEMI E30 startup steps, S1F13 to S2F31, with one npx command against a simulator: the wire capture, what each PASS proves, a refused Select.
Why Your SECS/GEM Host Can't Count on Getting an S9 Error Message
Five bad SECS-II messages sent to a live HSMS listener: one drew S9F7, four drew SxF0 aborts. What SEMI E5 stream 9 means and how to read MHEAD.
Why HSMS SystemBytes Uniqueness Is Your Host's Job, Not the Equipment's
A real capture where two HSMS requests share one SystemBytes and the replies come back byte-identical, plus the allocation rules that prevent it.
Which HSMS Timer Just Fired? Telling T3, T6, T7 and T8 Apart
One log line says timeout. A real capture separates T3 from T6, lists the SEMI E37 defaults, and shows the two timers your host must enforce itself.
Why a SECS/GEM Recipe Upload Should Start With S7F1, Not S7F3
A 300-byte PPBODY is 330 bytes on the socket. A real S7F1 and S7F3 capture, and what a host loses by skipping the grant step.
HSMS Active vs Passive: Which Side Dials, and What Happens When Neither Does
Connection refused in 3 ms, or a TCP session where nothing ever arrives. Real captures that tell the two HSMS mode mistakes apart.
SELECTED Is Not Communicating: When S1F13 Never Gets an S1F14
The HSMS session is SELECTED and S1F13 draws only a T3 timeout, while Linktest answers on the same socket in 0 ms. A capture, and two state machines.
Your SECS-II Length Byte Counts Bytes — Unless the Item Is a List
An S1F3 body byte by byte: the item header packs format code and length-byte count, and one wrong length silences the whole connection.
Your HSMS Deselect.req Got No Reply, and the Session Is Still Up
A capture where Deselect.req, Reject.req and two unassigned STypes all draw silence, while Linktest answers instantly and the session stays SELECTED.
Two Hosts, One HSMS Port: Why the First Session Never Finds Out
A capture of two host connections into one passive HSMS listener. Both get Select Status 0, and the first is never told the second arrived.
Why Your SECS-II Message Gets No Reply: The W-Bit Shares a Byte With the Stream
S1F1 sent, no S1F2, T3 expires — and the tool did nothing wrong. Captures of Header Byte 2 showing what packing the W-bit and Stream together costs.
One TCP Read Is Not One HSMS Message: Framing on the Length Header
Replies lost only under load? The parser treats one recv() as one message. Four HSMS captures: coalesced, split, short-bodied, and a 1 MiB length.
Why Your HSMS Separate.req Never Gets a Reply, and What Happens If You Skip It
The host shut down but the tool still shows SELECTED. Two captures side by side: a session ended with Separate.req, and one where only the socket closed.
A Tool That Answers Linktest But Never Completes Select
Alive is not selected. A real capture of Linktest and S1F13 sent before Select, the SEMI E37 Reject.req reason 4, and why T6 fires first, not T7.
An Accepted Select and a Refused One Differ by a Single Byte
Real Select.rsp captures: accepted, refused with SEMI E37 Select Status 1, 2 or 3, and answered under another SessionID. Where 'select failed' hides it.
HSMS Select Timeout: Three Causes That Look Identical in the Host Log
Silence, mismatched SystemBytes, or a wrong SessionID: real captures of three Select failures and the SEMI E37 timers T5, T6 and T7 behind each log line.
Your SECS/GEM Host Logs 'No Reply' and the Equipment Did Answer
The host logs no reply, but the equipment answered. A real capture of a Select.rsp with mismatched SystemBytes, decoded byte by byte, and why T6 fires.
What a Redundant PLC Actually Protects — and How to Commission One
A hot-standby pair earns its cost only if switchover is proven and sync loss is alarmed. What CPU redundancy covers, and testing both directions.
Getting Modbus RTU Through a Serial Device Server Without Dropping Frames
Commissioning a serial-to-Ethernet device server carrying Modbus RTU: operating mode, packing timers, TCP framing, idle timeouts and half-duplex control.
HMI Command Reset Behavior After PLC Restart
Designing and testing HMI command bits, acknowledgements and startup recovery so a stale command can't fire after a PLC or controller restart.
Alarm Help Text That Survives 02:00: Cause, Consequence, and the Action You Actually Want
Alarm help text is written once during rationalization and never read again. What belongs in cause, consequence and response for a 02:00 operator.
HMI Color and Shape Semantics for Operator Screens
Practical HMI notes for using color, shape, text, and state rules so operator screens stay readable during abnormal conditions.
Your HMI Breadcrumb Should Follow the Plant, Not the Project Tree
Make each HMI screen state where it is: ISA-101.01 display hierarchy as the breadcrumb, command labels that show scope, and tests for copied screens.
Your HMI Says Step 40 — It Should Say What Step 40 Is Waiting For
A sequence screen showing only a step number sends the operator hunting across four displays. Separate state, step, and hold reason, and latch the reason.
Setting Modbus RTU Timing So Radios and Old Meters Actually Answer
How to choose Modbus RTU baud rate, silent interval (t3.5), and turnaround delay so slow serial devices get a fair chance to reply on a SCADA link.
Pull the Cable: Proving an Industrial Ethernet Ring Actually Fails Over
A commissioning sequence for RSTP, MRP and PRP rings that measures what operators see: convergence time, dropped subscriptions, half-open sockets.
An Equipment Constant Is a Recipe Change With a Different Name
The host wrote the EC, EAC came back 0, and nine lots ran on the old value. SEMI E5 EAC codes, a real S2F13 readback, S2F29, and the SAT matrix.
What SECS/GEM Spooling Actually Saves When the Host Drops for an Hour
SEMI E30 spooling covers only streams the host enabled with S2F43. SPOOL LOAD vs UNLOAD, S2F44 RSPACK and STRACK, S6F24 RSDA, and real S2F43 bytes.
Modbus RTU Timeouts Are Usually a Wiring Problem: An RS-485 Commissioning Walkthrough
Commissioning a Modbus RTU link the right way: prove polarity, termination, biasing and grounding before you ever open the register map.
How to Test SCADA Server Switchover Without Fooling Yourself
A green redundancy icon proves the heartbeat works and nothing else. What to check on clients, alarms, historian and background jobs during a failover.
How to Downsample Historian Data Without Losing the Trip That Mattered
Averaging old process data hides trips and flattens peaks. Classifying tags, picking a method per class, and testing a purge job before production.
Why the HMI Shows the New Recipe While the Machine Still Runs the Old One
Split selected, downloaded and active recipe state into separate tags, compare what the PLC echoes against what you sent, and give rejections a reason.
Your SCADA Backup Isn't a Backup Until It Restores on a Clean Machine
A SCADA restore drill on a clean machine: what the backup set misses, OPC UA certificate traps, RPO and retention per artefact, and a measured RTO.
SCADA Service Account Password Rotation: Trigger It on Events, Not a Calendar
Nobody memorizes a service account password, so a 90-day policy buys little. What IEC 62443-3-3 SR 1.2 and NIST 800-63B actually ask for.
Why Alarm Acknowledge, Latch, and Reset Must Stay Separate Signals
One shared bit for acknowledge and reset is how alarms vanish while the fault is live. Separating active, latch, ack, return-to-normal and reset.
Why Your HMI Screen Is Slow: Measure Tag Load Before You Redraw Graphics
Split a five-second faceplate into first-load and update delay, then work down through tag counts, scan classes, trend queries and PLC load.
What HCACK=0 Really Tells You About a SECS/GEM Remote Command
SEMI E5 HCACK and CPACK codes read against a real S2F41 capture: why HCACK=4 exists, E30 control-state gating, and a retry that won't START twice.
Why a Successful Modbus Write Doesn't Mean the Motor Started
A Modbus TCP write response says the transaction was accepted, not that the motor moved. Command discipline: permissives, readback, and the retry trap.
The Banner Was Empty and the Plant Was Not Quiet
Filtering an alarm banner is not suppressing an alarm, and ISA-18.2 draws that line for a reason. What the default view owes the operator during a flood.
If the Vendor VPN Lands on the PLC Subnet, You Don't Have a DMZ
Remote access designed against IEC 62443-3-3 SR 5.2 and SR 1.13, denied paths tested at commissioning, and the port and timeout numbers that break it.
How Long Should an Alarm Delay Be? Set It From Process Time, Not a Default
Setting on-delays, off-delays, debounce and deadband from process behaviour and ISA-18.2 — filtering nuisance alarms without hiding the first warning.
Finding the First-Out Alarm When Your SCADA Floods
Alarm floods bury the initiating cause. Preserving first-out, trusting sequence-of-events timestamps, and stopping comms failures becoming floods.
Make HMI Commands Prove They Worked, Not Just That You Clicked
How to drive HMI state from feedback instead of command bits, set timeouts from real actuator travel, and show operators why a command was rejected.
Your GEM Link Is Green and MES Still Can't Rebuild the Run
Linking SECS/GEM collection events with S2F33/S2F35/S2F37, why report content empties after a tool restart, and proving S6F11 matches the real sequence.
How to Test OPC UA Redundant Failover Before the Plant Depends On It
A field-tested procedure for OPC UA redundant failover: ServiceLevel, subscription recovery, certificates, and catching stale data before operators do.
It Connects with None but Fails with Basic256Sha256: Debugging OPC UA Trust
Why a client browses fine with security off but drops the secure channel, and how to fix trust stores, endpoints and certificate names in a project.
HMI Permissive and Interlock Display Checklist
How to show permissives, interlocks, inhibits, bypasses, command readiness, and first-out causes on practical HMI screens.
Modbus Exception Codes: The Device Answered, It Just Said No
Reading Modbus exception responses on the wire, telling a refused request from a dead link, and chasing illegal-address and gateway causes.
Alarm Rationalization Workshop Checklist
Running alarm rationalization sessions that produce usable priorities, causes and operator response guidance instead of another unread spreadsheet.
Why Operators Code Everything as "Other" — Fixing an MES Downtime List
Designing downtime reason codes operators pick correctly under pressure: prompt timing, auto-coding from PackML state, and the fields reports need.
OPC UA Certificate Renewal Checklist
A practical checklist for renewing OPC UA application certificates without breaking SCADA clients, historians, gateways, or production HMI connections.
Why Your HMI Should Never Merge Mode and State Into One Field
Mode is who may command the equipment; state is what it is doing. SEMI E30's control state model splits them — here is how to split the HMI to match.
A Clean Modbus Poll Can Still Show the Wrong Number: Commission the Register Map First
Modbus connects, unit IDs respond, polls complete — and the operator still reads a swapped float. Proving a register map before the historian trusts it.
How to Catch a Frozen SCADA Value Before the Operator Trusts It
A SCADA screen shows a believable number long after the device stopped updating. Heartbeat, watchdog and stale-data tags that make freshness visible.
Five HMI/SCADA Project Decisions That Are Expensive to Undo
Tag names, alarm counts, screen hierarchy, broken-wire handling, and command state after a restart — with the numbers ISA-18.2, ISA-101.01 and NAMUR NE 43 already give you.
SCADA Network Troubleshooting Checklist
A layered checklist for troubleshooting SCADA communication problems from physical link to protocol behavior.
The One Bit That Decides Whether a SECS/GEM Alarm Is Set or Cleared
S5F1 carries ALCD, ALID and ALTX. Bit 8 of ALCD means set or clear; drop it and MES alarms never clear. Plus S5F5/S5F6 recovery after a host restart.
OPC UA Client Commissioning Checklist
A practical checklist for commissioning OPC UA client connections from SCADA, HMI, historian, or gateway software to PLCs and automation servers.
HMI Faceplate Design Checklist
A practical checklist for designing HMI faceplates that operators can use quickly, consistently, and safely during normal operation and troubleshooting.
Why Remote I/O Drops Four Minutes After a Clean Switch Startup
Industrial Ethernet switch commissioning by the numbers: the IGMP querier and the 260-second membership interval, auto-negotiation half-duplex traps, RSTP's 20-second max age against IEC 62439-2 ring classes, and the real port numbers to test.
Shelving vs. Suppression: Quieting SCADA Alarms Without Hiding Real Risk
How ISA-18.2 splits shelving, designed suppression, out-of-service and interlock bypass — and configuring them so every hidden alarm keeps an owner.
SCADA Commissioning Checklist
A commissioning checklist for validating HMI and SCADA screens, tags, alarms, trends, historians, users, backups and comms paths before handover.