How to read and troubleshoot analog 4-20mA loop devices .


Here is a part of simplifying of PLC wiring diagram at a water treatment plant (see picture above). There are three transmitters that connect to a PLC  analog current input module and with some reasons, they mysteriously failed to work at the same time at the same PLC module. Of course this event is rarely happened in real instrumentation field !. This example just to give idea what we are going to encounter in the field and how to solve these problems.

Most 4-20  signal generators or process meters sold in the market provide basic modes such as: source, simulate  and to generate at least 24 Vdc for powering the loop. We will use our tool: 4inONE-4to20mA signal generator and a trainer in these examples.

Case 1.

A Cl2 Analyzer device powered by 110 VAC (AIT). The range was between 0 -10 mg/L(ppm). It showed 4.9 mg/L on device display itself but it showed 0 reading on SCADA monitor.

-> Check the analog output of Cl2 Analyzer. If the current reading  shows approximately 12 mA, the problem should be somewhere else than the transmitter itself. Check the fuse and wire, make sure no blown fuse or broken loop. Open the loop, remove Isolator block (iso) and connect the probes  in “SOURCE” mode like showing on the picture A. ON android app, set the source to “12” mA.

420source Picture A.

If SCADA reading shows around 5 mg/L, the most likely failure come from Isolator block, otherwise we might have a faulty PLC analog current module.

Case 2.

A two-wires Flow Meter(FIT) which has range: 0-10 MGD indicated  8.75 MGD on its display but only showed 2.5 MGD on SCADA monitor.

->Let find both values in mA.

mA= (U/Ufs*16) +4 

mA=reading in mA, U=reading in MGD , Ufs=Full scale of MGD

mA1=(2.5/10*16)+4 = 8 mA , mA2 =(8.75/10*16)+4 = 18 mA

To verify PLC input module that connect to two-wire transmitter, we need to connect the probes on “SIMULATE” mode like showed on picture B. Set android app to “18” mA. Make sure there is no blown fuse or broken loop.  If  SCADA monitor shows much less than 8.75 MGD, The problem might come from a bad PLC input module or  PLC/SCADA scaling errors.

420simulatePicture B.


Case 3.

.A two-wires Level Transmitter (LIT) will shut down intermittently and will show erratic current readings.

-> Check Transmitter operation by connecting probes on “LOOP POWER” mode . (picture C). Monitor current reading on Android app.

420loop Picture C.

Replace Level Transmitter if the problem persists. If not continue to next step. Remove isolator and check existing 24 Vdc voltage. Using autographic and data logging on Android app, connect the probes like showed on picture D. Monitor current loop  trending  without isolator block installed.

420readingPicture D.


AIT = Analytical Indicating Transmitter

FIT =Flow Indicating Transmitter

LIT =Level Indicating Transmitter




Read Allen Bradley tags using Python 2.7 and pass the values to node-red.



Read and write  Allen Bradley tag values using  python which utilize Common Industrial Protocol (CIP) on Ethernet/IP. This method will work on Controllogix and Compactlogix PLCs. The script  will be executed in Node-red and the return value will be displayed on dashboard and can be read on wireless devices such as tablets or smartphones.


1.Raspberry pi 3 (Jessie).

2.Node-Red (It was already installed in latest Jessie but  we might still need to get update to work with dashboard node).

3.Dashboard node. Here is the link to get this node:

4.python 2.6 or newer.

5.Python CIP library.

Get the library and code example from the following link:

Step 1 :

If you follow on my previous article, you can switch Raspberry 3 pi to AP mode. Assign eth0 to static IP address. For  example : wan address:

static eth0  IP address :

Connect PLC networks to Raspberry ethernet port. Make sure there is no conflict between Raspberry eth0 static address with gateway or PLC IP addresses. To access raspberry pi via tablets or smartphones you can use android app such as VNC viewer or ConnectBot. Alternatively you can also use VNC viewer or PuTTY on Windows version.

Step 2.

Use pylogix library to get a taglist and to read a tag value from PLC. Here is the example of  python script to read “VLV_O3_HEADER_ISO_ZSC” tag from Controllogix PLC with IP address:
  1. from eip import PLC
  2. comm = PLC()
  3. comm.IPAddress =""
  4. def ex_read():
  5.   ret = comm.Read("VLV_O3_HEADER_ISO_ZSC")
  6.   print ret
  7. ex_read()


Step 3.

Start node-red. To get return value from python script, we need to put on “EXEC” node.

Edit exec node:


Step 4.

Build a flow.





Another “Swiss Army Knife” for PLC Networks : Raspberry Pi 3


We can turn Raspberry pi 3 as  AP(Access point) and can be utilized with wireless devices to scan PLCs or field devices network.


1.Raspberry pi 3

2.Power Supply (for Raspberry)

3.Wireless device ( tablet, laptop, or cellphone)

4.Ethernet cable

Keep in the mind that the following procedure is for Raspberry Pi 3 (Jessie raspbian)  which I am quite sure it might work for some  older versions with slightly modifications. I got the script from several sources online and I did modification to work on  PLC network that use static IP addresses.

1.Install hostapd, udhcpd and iptables

Install the necessary tools
  1. sudo apt-get update
  2. sudo apt-get install hostapd udhcpd -y
  3. sudo apt-get install iptables -y


2. Create back up for these files, in case of installation failed.

  1. sudo touch /etc/network/interfaces.bak
  2. sudo cp /etc/network/interfaces /etc/network/interfaces.bak
  3. sudo touch /etc/dhcpcd.bak
  4. sudo cp /etc/dhcpcd.conf /etc/dhcpcd.bak


3.Build the following  script (

Basically this script is to create several configuration (conf) files and will load them into default ones. DHCP (Dynamic Host Configuration Protocol)  configuration will give away the dynamic  IP addresses between and to your wireless devices and to access wlan0  meanwhile it will give a static IP address for raspberry pi:  . For older version , it is necessary to setup configuration on /etc/network/interfaces for interfacing with network (wlan0,eth0, etc )  but on newest Jessie installation, the network configuration is located on /etc/dhcpcd.conf . HostAPD configuration will create hotspot and APN ( Access Point Name). The next is NAT (Network Address Translation ) which works as a translator between external router that connect to eth0 and WIFI guests who access  wlan0.    :

  1. #! /bin/bash
  2. #1. Configure DHCP----------------------------------------------
  3. x=tem.tem
  4. touch $x
  5. sudo rm -rf /etc/default/udhcpd
  6. #sudo mkdir /etc/default
  7. sudo touch /etc/default/udhcpd
  8. echo "start " >>   $x
  9. echo "end" >> $x
  10. echo "interface wlan0" >> $x
  11. echo "remaining yes" >> $x
  12. echo "opt dns" >> $x
  13. echo "opt subnet" >> $x
  14. echo "opt router" >> $x
  15. echo "opt lease 864000" >> $x
  16. sudo mv  $x /etc/udhcpd.conf
  17. touch $x
  18. echo  "# Comment the following line to enable" >> $x
  19. echo "#DHCPD_ENABLED=\"no\"" >> $x
  20. echo "# Options to pass to busybo>> $x
  21. echo "DHCPD_OPTS=\"-S\"" >> $x
  22. sudo mv $x  /etc/default/udhcpd
  23.         #give the Pi a static IP address
  24. sudo ifconfig wlan0
  25. #2.------------------------------SETUP AP (Access Point) Interface -------------------------------
  26. touch  $x
  27. echo "source-directory /etc/network/interfaces.d" >> $x
  28. echo "auto lo" >> $x
  29. echo "iface lo inet loopback" >> $x
  30. echo "" >> $x
  31. echo "auto eth0" >> $x
  32. echo "iface eth0 inet dhcp" >> $x
  33. echo "" >> $x
  34. echo "iface wlan0 inet static" >> $x
  35. echo "    address" >> $x
  36. echo "    netmask" >> $x
  37. echo "    wireless-power off" >> $x
  38. echo "" >> $x
  39. echo "iface default inet dhcp" >> $x
  40. echo "up iptables-restore < /etc/iptables.ipv4.nat" >> $x
  41. sudo chmod --reference=/etc/network/interfaces $x
  42. sudo chown --reference=/etc/network/interfaces $x
  43. sudo mv $x  /etc/network/interfaces.ap
  44. sudo chmod --reference /etc/network/interfaces.bk /etc/network/interfaces.ap
  45. #3. Configure HostAPD------------------------------------------------
  46. touch $x
  47. echo "interface=wlan0" >> $x
  48. echo "driver=nl80211" >> $x
  49. echo "ssid=WifiPLC" >> $x
  50. echo "hw_mode=g" >> $x
  51. echo "channel=6" >> $x
  52. echo "macaddr_acl=0" >> $x
  53. echo "auth_algs=1" >> $x
  54. echo "ignore_broadcast_ssid=0" >> $x
  55. echo  "wpa=0" >> $x
  56. echo "wpa_passphrase=My_Passphrase" >> $x
  57. echo "wpa_key_mgmt=WPA-PSK" >> $x
  58. echo "wpa_pairwise=TKIP" >> $x
  59. echo "rsn_pairwise=CCMP" >> $x
  60. echo "ieee80211n=1"   >> $x
  61. echo "wmm_enabled=1" >> $x
  62. echo "ht_capab=[HT40][SHORT-GI-20][DSSS_CCK_40]" >> $x
  63. sudo mv  $x  /etc/hostapd/hostapd.conf
  64. #4. Configure NAT--------------------------------------------
  65. touch $x
  66. echo "DAEMON_CONF=\"/etc/hostapd/hostapd.conf\"" >> $x
  67. sudo mv $x /etc/default/hostapd
  68. touch $x
  69. sudo sh -c "echo 1 >> /proc/sys/net/ipv4/ip_forward"
  70. sudo echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
  71. sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  72. sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
  73. sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
  74. sudo sh -c "iptables-save >> /etc/iptables.ipv4.nat"
  75. #------------------------------5. Fire it up! R----------------------------------------
  76. sudo service hostapd start
  77. sudo service udhcpd start
  78. #-----------------------------6.get the hotspot to start on boot----------------------
  79. sudo update-rc.d hostapd enable
  80. sudo update-rc.d udhcpd enable
  81. #------------------------Create
  82. sudo apt-get install dnsmasq -y
  83. sudo service dnsmasq start
  84. sudo update-rc.d dnsmasq enable
  85. sudo apt-get install udhcpc -y


4.Create script
  1. sudo nano script
  1. #! /bin/bash
  2. #sudo cp  /etc/init.d/hostapd.bak /etc/init.d/hostapd
  3. #sudo cp /etc/init.d/udhcpd.bak /etc/init.d/udhcpd
  4. sudo /etc/init.d/hostapd stop
  5. sudo /etc/init.d/udhcpd stop
  6. sudo ifdown wlan0
  7. sudo ifconfig wlan0 down
  8. sudo rm -rf /etc/network/interfaces
  9. sudo cp /etc/network/interfaces.ap /etc/network/interfaces
  10. sudo ifconfig wlan0 up
  11. sudo ifup wlan0
  12. sudo service hostapd start
  13. sudo service udhcpd start
  14. sudo service hostapd status


Run and

run wifi and AP
  1. sudo ./
  2. sudo ./


If there is no errors , you should able to see SSID name “WifiPLC” on your wireless devices under WIFI setting menu. Login and when ask the password, type “My_Passphrase”  that will save and connect it to your wireless devices. To test it, connect eth0 (ethernet port) on Raspberry Pi  to DHCP router that connect to Internet. The router will assign a dynamic IP address . Now you are able to connect to Internet. Type “” on your phone browser to verify it.

This is last step if you need a static IP  and skip it if  you just need dynamic IP address . Eth0  still has a dynamic IP address and will not communicate with PLC static IP address network. Identify gateway address and check all existing PLC IP address and find a static IP address for Raspberry PI that will not cause conflicts with other numbers. In this example the gateway is and the number has not been used by other PLCs is To activate a static IP address, add the following to the very bottom of /etc/dhcpcd.conf file.

  1. # static IP setup
  2. interface eth0
  3. static ip_address=
  4. static routers=
  5. static domain_name_servers=


Save it as  /etc/dhcpcd.conf.

Reboot your Raspberry Pi , connect Ethernet port to  a PLC  router. Now if you have PLC CPUs  or Ethernet  modules  which have  “192.168.1.xx ” , type those number on your browser. Let says “”. Most new Field devices or PLCs  have HTTP protocol capability on port 80/8080, so you will  see something like this  :


Using Raspbian shell terminal, we can find MAC number using “arp’ command,  install “nmap” utility to explore and troubleshoot  the network such as scanning particular IP address blocks, checking open/closed ports etc.

“Poorman” PLC I/O board

Process or manufacturing plants have PLCs which get signal inputs from mechanical buttons, switches, limit switches and send signal outputs to activate relays, solenoid valves etc.  In many cases, they use 24V DC power supply for PLC CPUs  and their I/O modules.  This voltage level is used for input modules and deliver 24VDC  from output module  to turn  solenoid valves, coils etc.

For non-critical use  and ignoring  the latency  , we can build  simple 5V to 24V DC I/O adapter that can be used with our Microcontrollers to drive 24V DC rating relays and  supplying  switches/buttons.



Don’t get confused with the schematic above . Yes, it works !. The reason there are two “opto couplers”  above ( Actually only one opto coupler with two sockets which I will explain later)  is that we can use GPIO from our Microcontrollers,  AVRs, Arduino boards etc  like we intended. For example we can use Pin 1 as input OR as  output  from the same block diagram above. Let says we have 8 I/O pins, each pin will go to both red and green block  so we just need to focus on our code/program without worrying which one is for input or output.


(See the picture) The main part here is 4N29 opto coupler that can “convert”  either 5V DC to 24V DC or from 24V DC to 5V DC. The red square on the picture is a 4N29 socket  for output ,and the green one is a socket for input.  We have two sockets but we only need one opto coupler IC . When output signal needed , move this  IC to the red socket, otherwise we just leave it on green socket. Never put  two ICs on both sockets at same time to avoid input/output conflicts. The inputs/output devices will be connected to  blue square terminal block. Put the relays, bulbs, solenoids, switches,  and buttons there .

Convert legacy control panel into LCD alarm and warning system with Arduino.

In the old days, We used to have electronic controllers or PLCs to send the warnings or alarms on the panel by turning combination of  light indicators  on or off. To understand these signals we have to refer their operation manuals to interpret these messages. For example if they have three indicators on the panel which has Light A(LA), Light B(LB) and Light C(LC),  it will be 2^3 =8 combinations of warning/alarms. To make it easy to understand , they provide us a troubleshooting table to tell operators or technicians to trace the problem. Continue reading “Convert legacy control panel into LCD alarm and warning system with Arduino.”