An S2F0 Doesn't Tell You Why: Unimplemented Function or Closed Communication Gate
Two captures from one HSMS session show S2F23 aborted twice for different reasons, and the reply bytes differ only in SystemBytes.
Articles
Practical SCADA notes
Field-oriented references for HMI/SCADA systems, industrial communication, alarms, tags, historians, and project delivery.
An HSMS Reply's Session ID Is Not Always the One You Sent
Select.rsp and Linktest.rsp carry the Session ID the tool chose, not the one you sent. Data replies echo it. Three real HSMS captures.
The Tool Acked the S5F1 Your Host Should Never Have Sent
Alarm integration passes every test and no alarm ever arrives. A real capture: S5F1 sent by the host draws ACKC5 0, and S10F3 draws an abort.
GEM Is Not GEM300: Which SECS Streams E87, E40 and E90 Actually Use
One socket, five primaries: S1F13 answered, S3F17, S14F1 and S16F11 all came back SxF0. What SECS/GEM support does and does not include.
HSMS Linktest Timeout While Data Still Flows: Close the Socket Anyway
A swallowed Linktest.req burns T6 while an S1F1 on the same socket answers with a full S1F2 in 0.3 ms, and the host should close the connection anyway.
An S1F4 Carries No SVIDs — Get the Names From S1F11 First
An S1F4 body carries no SVIDs at all. Real S1F11/S1F12 bytes showing where a host learns SVID numbers and names, and how S2F29 differs.
Your HSMS Session Is SELECTED and S1F3 Still Comes Back as S1F0
SELECTED is E37, COMMUNICATING is E30. Real bytes showing an S1F3 sent before S1F13/S1F14 aborted as S1F0, and the same S1F3 answered after.
Reading Equipment Constants From the Host: S2F29 for the Namelist, S2F13 for the Values
You asked S2F13 for one ECID and S2F14 came back with two values. Real S2F29 and S2F13 bytes, and the length check host code must run.
Why Your S6F11 Never Arrives: Getting S2F33, S2F35 and S2F37 in the Right Order
Your report is defined but S6F11 never arrives. Real S2F33, S2F35 and S2F37 captures from two equipments, and what a non-zero LRACK tells the host.
The Equipment Stamps Your S6F11, Not Your Host — Checking That Clock With S2F17 and S2F31
Equipment clock drift reorders S6F11 events while HSMS stays green. Reading the clock with S2F17, setting it with S2F31, and why TIACK 0 proves nothing.
Why Your S2F41 Comes Back HCACK 2 While the Tool Screen Says ONLINE
S2F41 START gets HCACK 2 while the tool reads ONLINE. SEMI E30 communication state versus control state, and the captured byte that flips HCACK to 0.
Prove a Full GEM Startup Handshake Without Any Equipment
Run all ten SEMI E30 startup steps, S1F13 to S2F31, with one npx command against a simulator: the wire capture, what each PASS proves, a refused Select.
Why Your SECS/GEM Host Can't Count on Getting an S9 Error Message
Five bad SECS-II messages sent to a live HSMS listener: one drew S9F7, four drew SxF0 aborts. What SEMI E5 stream 9 means and how to read MHEAD.
Why HSMS SystemBytes Uniqueness Is Your Host's Job, Not the Equipment's
A real capture where two HSMS requests share one SystemBytes and the replies come back byte-identical, plus the allocation rules that prevent it.
Which HSMS Timer Just Fired? Telling T3, T6, T7 and T8 Apart
One log line says timeout. A real capture separates T3 from T6, lists the SEMI E37 defaults, and shows the two timers your host must enforce itself.
Why a SECS/GEM Recipe Upload Should Start With S7F1, Not S7F3
A 300-byte PPBODY is 330 bytes on the socket. A real S7F1 and S7F3 capture, and what a host loses by skipping the grant step.
HSMS Active vs Passive: Which Side Dials, and What Happens When Neither Does
Connection refused in 3 ms, or a TCP session where nothing ever arrives. Real captures that tell the two HSMS mode mistakes apart.
SELECTED Is Not Communicating: When S1F13 Never Gets an S1F14
The HSMS session is SELECTED and S1F13 draws only a T3 timeout, while Linktest answers on the same socket in 0 ms. A capture, and two state machines.
Your SECS-II Length Byte Counts Bytes — Unless the Item Is a List
An S1F3 body byte by byte: the item header packs format code and length-byte count, and one wrong length silences the whole connection.
Your HSMS Deselect.req Got No Reply, and the Session Is Still Up
A capture where Deselect.req, Reject.req and two unassigned STypes all draw silence, while Linktest answers instantly and the session stays SELECTED.
Two Hosts, One HSMS Port: Why the First Session Never Finds Out
A capture of two host connections into one passive HSMS listener. Both get Select Status 0, and the first is never told the second arrived.
Why Your SECS-II Message Gets No Reply: The W-Bit Shares a Byte With the Stream
S1F1 sent, no S1F2, T3 expires — and the tool did nothing wrong. Captures of Header Byte 2 showing what packing the W-bit and Stream together costs.
One TCP Read Is Not One HSMS Message: Framing on the Length Header
Replies lost only under load? The parser treats one recv() as one message. Four HSMS captures: coalesced, split, short-bodied, and a 1 MiB length.
Why Your HSMS Separate.req Never Gets a Reply, and What Happens If You Skip It
The host shut down but the tool still shows SELECTED. Two captures side by side: a session ended with Separate.req, and one where only the socket closed.
A Tool That Answers Linktest But Never Completes Select
Alive is not selected. A real capture of Linktest and S1F13 sent before Select, the SEMI E37 Reject.req reason 4, and why T6 fires first, not T7.
An Accepted Select and a Refused One Differ by a Single Byte
Real Select.rsp captures: accepted, refused with SEMI E37 Select Status 1, 2 or 3, and answered under another SessionID. Where 'select failed' hides it.
HSMS Select Timeout: Three Causes That Look Identical in the Host Log
Silence, mismatched SystemBytes, or a wrong SessionID: real captures of three Select failures and the SEMI E37 timers T5, T6 and T7 behind each log line.
Your SECS/GEM Host Logs 'No Reply' and the Equipment Did Answer
The host logs no reply, but the equipment answered. A real capture of a Select.rsp with mismatched SystemBytes, decoded byte by byte, and why T6 fires.
Why Adding a Rework Loop Made Our First-Pass Yield Go Up
Rework quietly breaks linear MES route models. How to bind visit numbers, dispositions, and equipment events to the right route step instance.
MQTT Payload Schema Versioning for SCADA Edge
Versioning MQTT telemetry payloads so historians, HMI clients, MES connectors and analytics survive a field change instead of breaking on one.
An Equipment Constant Is a Recipe Change With a Different Name
The host wrote the EC, EAC came back 0, and nine lots ran on the old value. SEMI E5 EAC codes, a real S2F13 readback, S2F29, and the SAT matrix.
How to Fix Bad Historian Data Without Overwriting the Original
A failed transmitter pegs a tag at full scale for eleven hours. Correcting the record with an audit trail that survives review, raw sample intact.
What SECS/GEM Spooling Actually Saves When the Host Drops for an Hour
SEMI E30 spooling covers only streams the host enabled with S2F43. SPOOL LOAD vs UNLOAD, S2F44 RSPACK and STRACK, S6F24 RSDA, and real S2F43 bytes.
Why the PLC and MES Shift Counts Never Match, and Which One to Trust
The shift report says 1,738 good parts and the HMI says 1,742. Where to look first: counter style, historian deltas, S6F11 event time, or the spool.
What HCACK=0 Really Tells You About a SECS/GEM Remote Command
SEMI E5 HCACK and CPACK codes read against a real S2F41 capture: why HCACK=4 exists, E30 control-state gating, and a retry that won't START twice.
Your Historian Event Frame Is Only as Good as Its End Trigger
Event frames pay off only if their boundaries hold. Where to take start and end triggers, what to capture as attributes, and frames that never close.
Every S6F11 Arrived and the Lot History Still Has Holes
Where lot traceability breaks when built from equipment events: missing lot context, GEM event time, spool replay order, and split/merge genealogy.
Your GEM Link Is Green and MES Still Can't Rebuild the Run
Linking SECS/GEM collection events with S2F33/S2F35/S2F37, why report content empties after a tool restart, and proving S6F11 matches the real sequence.
Why Operators Code Everything as "Other" — Fixing an MES Downtime List
Designing downtime reason codes operators pick correctly under pressure: prompt timing, auto-coding from PackML state, and the fields reports need.
The One Bit That Decides Whether a SECS/GEM Alarm Is Set or Cleared
S5F1 carries ALCD, ALID and ALTX. Bit 8 of ALCD means set or clear; drop it and MES alarms never clear. Plus S5F5/S5F6 recovery after a host restart.
HMI vs SCADA vs MES vs Historian
A field-oriented comparison of common industrial software layers and where their responsibilities overlap.