The R in a tag database is the driver reporting a read-only address type, not an editable setting. Input bits, analog inputs and system registers accept no writes; on Modbus, discrete inputs and input registers are read only while coils and holding registers accept writes. Re-address the pushbutton to a spare writable bit and OR it with the field input in the rung that carries the permissives.
A pushbutton on the panel does nothing, and the tag database shows R where the project needs R/W. That R is a status report, not a setting. It tells you the address under the button accepts no writes. The working fix is to re-address the button to a spare writable bit, branch that bit in parallel with the field input in the ladder, and commission it against the permissives. This page walks the diagnosis, the ladder change and the checks that make the command safe to leave in front of an operator.
Why does my HMI pushbutton tag show read only?
The R is a status the panel's tag database reports from the driver and the address type. Input bits, analog inputs and system registers are read only because the PLC writes them from the field on every scan. The pushbutton is aimed at data the panel can only read.
The panel software builds that column from two choices you made: the driver and the address. When the driver knows an address type only carries data the PLC produces, it flags the tag R. The column is showing a property of the data in the PLC. Diagnose the pair of driver and address before you touch anything else. Match your symptom first:
- The button does nothing and the tag shows R: the object sits on a read-only address type, most often a physical input bit.
- The PLC bit flips for one scan and falls back: the tag points at an input or output address, and the logic rewrites it from the field image on every scan.
- The tag shows R/W but the PLC value never moves: the driver, the station address or the cable path is wrong and the write lands nowhere, so check the driver selection first.
- The lamp on the object works but the command does nothing: reading needs no write permission, so a working lamp shows the link is alive while the write still fails on the address type.
Can I change the tag attribute from R to R/W?
No. The R column is a readout of what the driver allows. No edit in the tag database turns a read-only address type into a writable one. The attribute moves only when the tag points at a different address or address type.
Some panel software never exposes the attribute as an editable field at all. Drivers that speak Modbus behave differently: they ask you to choose an address type when you create the tag, and the type you pick is where the R comes from. The same rule explains why an HMI toggle cannot force a PLC physical input: a toggle can write only data the PLC leaves writable. Re-pointing the tag is the edit that changes anything. Re-labeling it changes nothing.
Which PLC addresses are read only?
Modbus builds the rule into its protocol, so the read-only set is exact. Discrete inputs (function 02) and input registers (04) have no write function, while coils (05 and 15) and holding registers (06 and 16) accept writes. A compliant driver has no write function code to send for the read-only types.
Outside Modbus, open the help file for the selected driver. It splits the address types into data the PLC produces, which reads back only, and data the program owns, which takes writes. The consequence at the panel is timing, and it is measurable. A value forced into an input address survives less than one scan, because the PLC rewrites its input image from the terminals at the start of each scan. Small controllers commonly finish a scan in 1 to 10 ms, and a human press lasts on the order of 200 ms, so the field wiring wins every time. The field-side view is set out in PLC X inputs: physical states, not writable memory bits.
Output bits are the trap in the other direction. Many drivers will write them, and the rung that drives the output writes straight back over the panel's value. Let the ladder decide when an output energizes, and keep command tags off output addresses even where a write is possible.
Where should the pushbutton write instead?
Point the tag at a spare internal bit the driver can write, one bit per command. Check the cross-reference or assignment list first: the count of other references must be zero before you assign it.
On the small fixed-I/O PLCs that sit behind panels like this, that writable range is the C bits. The bit has one job: it exists as the HMI command and for nothing else. Open the cross-reference or the assignment list in your programming software and confirm the count of other references is zero; anything else means pick another bit. Give each button its own bit and note the choice in the project comments, so the next person who opens the program finds the command in one search. Keep the button off physical I/O even where the driver permits a write; the next section builds the bridge in the ladder instead.
How do I add the command bit to the ladder logic?
Branch the command bit in parallel with the input inside the rung that already carries the permissives and the seal. The output then sees the input OR the command behind the same stop and guard conditions either way. Never add a separate rung that feeds the output directly.
In address terms, if the field input is X0 and the command bit is C0, the branch puts the X0 contact and the C0 contact side by side. Both feed the same series chain of permissives and the seal-in contact. Sealing is the standard way a momentary start command works, and the pattern is walked through in pushbutton sealing with internal bits.
Match the panel object to the rung before you download. The button only writes the bit; the logic does everything else, including clearing it. If a lamp beside the button should show the command state, drive it from the command bit too. The difference between a lamp on the input and a lamp on the command is covered in why a panel pushbutton LED only stays on while pressed.
Check the branch placement when you review the rung. The command must reach the output coil only through the same series elements the field button passes through.
Example: what does the finished start circuit look like?
A start button on X0, a guard permissive on X7 and a stop on X1 need one spare bit: address the panel button to C0, evaluate the output as (X0 OR C0) AND X7 AND X1, and both start paths work under the same stop.
The cell has a 24 V DC palm button on X0, a guard switch on X7 that reads 1 while closed, and a stop wired so X1 reads 1 while released; the contactor coil is the output bit OUT. The first attempt aimed the panel button at X0, which is why the tag read R and the write went nowhere: the contact was open, so the next input image update put X0 back to 0 within one scan, about 1 to 10 ms on this class of controller, while the operator held the press for roughly 200 ms. The rung never sealed. The repair assigns C0 as the panel's command bit and evaluates one expression:
OUT = (X0 OR C0) AND X7 AND X1
| X0 field start | C0 panel start | X7 guard | X1 stop released | OUT |
|---|---|---|---|---|
| 1 | 0 | 1 | 1 | 1 |
| 0 | 1 | 1 | 1 | 1 |
| 0 | 1 | 0 | 1 | 0 |
| 1 | 1 | 1 | 0 | 0 |
Row by row: (1 OR 0) AND 1 AND 1 = 1, the field button alone. (0 OR 1) AND 1 AND 1 = 1, the panel button alone. (0 OR 1) AND 0 AND 1 = 0, so an open guard blocks the panel command. (1 OR 1) AND 1 AND 0 = 0, so the stop outvotes both sources. The panel added one OR term and no new route past the guard or the stop. A momentary object on C0 keeps that table true, because the bit returns to 0 on release. A toggle object would hold the rung sealed and need a deliberate reset in the PLC.
How do I test and commission the new command?
Watch three values online at once: the command bit, the physical input and the output. Then run the negative case. Press the panel button with the guard permissive absent and watch the output hold at 0 before an operator ever uses it.
- Put the machine in its agreed test state and write down the rung and the output the command touches.
- Go online with the command bit, the physical input and the output visible, then press the panel button for about 2 s: the command bit follows the press, the physical input holds where the field wiring puts it, and the output runs only where the permissives allow.
- Release the button and watch the command bit return to 0 on its own within 1 s.
- Open the guard and press again for the same 2 s: the command bit writes 1 and the output holds at 0. This is the step that matters.
- Press the field button alone and check the original path behaves exactly as before.
If the panel software includes an offline simulator, run the screen through it first. The simulator checks the screen side; the connected PLC settles the driver, the address and the timing.
Never use an HMI write to test past an interlock or a safety function. If a response surprises you, stop and restore the last validated program before anything runs.
Recommendation: whenever a command object shows R, re-address it to a spare writable bit and OR that bit with the field input inside the rung that already carries the permissives; leave input bits, analog inputs, system registers and output images read-only in every project you hand over.
The decision by case: a momentary start takes a momentary object with a sealing rung. A maintained command takes a toggle object with a reset defined in the PLC. A status lamp or a readout keeps R, because read-only is the correct attribute there.
Questions
Why did the same address show R/W with one driver and read only with another?
Drivers differ. A pushbutton on C0 and a lamp on X1 can both show R/W under one panel's native serial driver, while a Modbus driver that makes you choose an address type at tag creation shows the read-only types as R. Treat the driver and address pair as the diagnostic and the tag column as its readout.
How do I latch a panel command until a second press?
Use the panel's toggle or set and reset object, and give the rung a defined reset. The bit stays at 1 after the operator walks away, so something in the PLC has to clear it: a second press, a cycle-end bit or the stop. Program that reset deliberately and test it with the same watch you run on the start command.
Can a numeric entry field on the panel write to the PLC?
Yes, through the same rule as the pushbutton. A numeric entry needs a writable word: an internal word the logic consumes or a Modbus holding register, written with function 06 or 16. Keep it off analog inputs and input registers, which are read only, and treat the entered value as a setpoint the logic validates before it acts.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.