Lock a PLC V-memory value from HMI writes during a stage

Can a PLC lock a V-memory value against HMI writes during a stage?

Yes: save the value with a one-shot at stage entry and copy the saved value back to the target register on every scan while the stage is active, so an HMI write is overwritten within one scan, a few milliseconds on a small PLC.

The mechanism is a register swap. Pick a spare register for storage. On the scan where the stage bit turns on, a one-shot rising instruction passes power for exactly one scan and a copy instruction moves the target value into storage. On every scan the stage bit stays on, a restore rung copies storage back over the target. When the bit drops, the restore rung stops and the register accepts edits again.

The edge instruction appears as OSR in some instruction sets and DIFU in others; the documented behavior is the same in both, an output true for one scan when the rung condition goes from false to true. That single scan is what a capture needs. A plain contact in place of the one-shot would re-copy the target into storage on every scan and preserve the last HMI write instead of the stage-entry value.

Why does hiding the HMI entry object fail to lock the value?

Visibility logic changes only what the screen draws; the entry object still exists in the project and its write still targets the V-memory address, so a macro, a second screen or a leftover object can change the value while it is hidden from view.

Visibility logic is a presentation feature. The entry object stays in the project with its address, so its write path is intact; hiding it only keeps the operator off the keypad. While your frozen value sits behind a display-only object placed on top, the same register remains writable from another screen, a recipe download or a macro.

Use the hiding as the operator aid and drive it from the same stage bit the ladder uses. When the bit is on, hide the entry and show a display object in its place so the screen presents the frozen value; when the bit drops, bring the entry back. One PLC tag driving object visibility, including the two-condition case, is covered in HMI object visibility with two conditions: use one PLC tag. With both layers fed by one bit, the screen and the logic agree on when editing is allowed.

What do you need before writing the lock rungs?

You need four things: the exact V-memory address the entry object writes, a spare storage register the program never writes, the bit or stage condition that marks the protected period, and a list of every rung that reads the target register so a one-scan transient cannot trip one of them.

• The write target. Open the numeric entry object in the HMI project and read its address field. That register, and only that register, is what the rungs protect; two objects writing two registers means two rung pairs.
• The storage register. Pick a spare V-memory register nothing else uses. Check the PLC memory map and every screen in the HMI project so no other object, macro or recipe writes it, and choose a retained address if the value must survive a power-down.
• The stage condition. One bit that is on for exactly the protected period. If several conditions define the period, combine them into a single control relay bit and use that bit in both rungs.
• The consumer list. Every rung that reads the target register. A 16-bit integer value fits one V register, which holds 0 to 65,535 unsigned, so target and storage are each one-register moves. Flag any consumer that acts on the value in the scan it reads it, such as a comparison driving an output, and plan to point it at storage for the duration of the stage.

How do you write the save and restore rungs?

Two rungs do the job: a one-shot rising rung that copies the target register into storage on the false-to-true transition into the stage, and a restore rung that copies storage back to the target on every scan for as long as the stage condition stays true.

In the steps below, V1400 is the target, V1404 the storage and C10 the stage bit. Those are example labels; substitute your own memory map.

1. Write the capture rung: the stage-start contact into a one-shot rising instruction into a copy instruction. When C10 turns on, the one-shot passes for one scan and the copy moves V1400 into V1404.
2. Write the restore rung: the C10 contact into a copy instruction, with no edge instruction, so the copy runs on every scan while C10 is on and moves V1404 back into V1400. Place it directly under the capture rung.
3. Repoint every mid-stage consumer on the list at V1404, so no rung acts on the one-scan transient in V1400.
4. If the program itself must adjust the value during the stage, have that rung write V1404. The restore rung carries the adjustment into V1400 on the next scan.
5. Leave the HMI entry object live between stages. With C10 off, neither rung executes, so an edit lands in V1400 and stays.
6. Save the program and download it with the machine in a safe state, then run the tests in the next section.

What does an HMI write do while the lock is active?

The write lands mid-scan: the new value sits in the target register until the restore rung executes next pass, a gap of one scan, about 1 to 10 ms on a small PLC, usually shorter than the HMI's 100 to 500 ms poll interval.

Communications arrive on their own schedule, between scans or between rungs depending on the processor, so the new value sits in the target register until the restore rung's next execution. Scan time sets that bound: programs of a few hundred rungs on small PLCs commonly complete in 1 to 10 ms, so the foreign value survives at most one scan, and usually less, because a write delivered early in a scan only waits for the restore rung's position in the same pass. The interaction between a button write and the input scan is covered in HMI button writes vs the PLC input scan: what changes.

Display is a separate number. The HMI polls the register on its own interval, commonly 100 to 500 ms for a non-critical setpoint, so a flash lasting one scan stays invisible unless a poll request lands inside the scan where the transient lives.

Worked example: what happens when someone writes 980 over a locked 1250?

A packer locks a 1250-piece batch target in V1400 during its dispense stage; a stale screen writes 980 into V1400 mid-stage, and the lock returns the register to 1250 within one 5 ms scan, before the next poll 50 ms later can display the wrong number.

The line packs 1250 pieces per batch. Example values for the arithmetic: target register V1400, storage register V1404, stage bit C10, a processor that scans in 5 ms, an HMI that polls V1400 every 250 ms.

• Stage entry, 14:32:05.000. C10 turns on. The one-shot passes for one scan and the copy moves 1250 from V1400 into V1404. Both registers hold 1250, which fits one 16-bit register because 1250 sits well below the 65,535 unsigned maximum.
• Rogue write, 14:32:12.200. A screen left open from the previous shift writes 980 into V1400. Communications deliver it, and V1400 briefly holds 980.
• Restore, within 5 ms. The restore rung copies V1404 back and V1400 returns to 1250. The exposure is one scan at most, 5 ms out of the 250 ms poll cycle. The next poll at 14:32:12.250 arrives after the restore, so the screen shows 1250 and never 980.
• Mid-stage logic. The dosing comparison reads V1404 while C10 is on, so no rung acts on the 980.
• Release, 14:33:40. The batch finishes and C10 drops. The restore rung stops. The operator enters 1400 for the next batch, V1400 holds it, and the next stage entry captures 1400 into V1404, so no batch runs against the old 1250.

How do you test the lock and the release?

Test three transitions with the machine in a safe state: capture on entry, overwrite during the stage, and release on exit, monitoring both registers in the PLC while an operator makes a deliberate test entry from the HMI.

Run the checks with product flow stopped and both registers in a monitor table you can watch side by side.

1. Capture. Record the current value, start the stage, and confirm V1404 now matches V1400.
2. Protect. During the stage, enter a test value such as 100 from the HMI. A monitor table usually refreshes too slowly to catch a one-scan transient, so the check is equality: while C10 is on, V1400 must equal V1404 after every refresh.
3. Release. End the stage, enter a new value, and confirm it sticks in V1400 and no longer reverts. Confirm V1404 stops following.
4. Re-entry. Start the stage again with the new value and confirm V1404 captures that new number.
5. Both exits. If the stage can end normally or through an abort, run the release check through both paths and confirm the stage bit drops each time. A bit that survives an abort keeps the restore rung running and defeats edits.

When is this lock the wrong tool?

Treat this as value preservation, not a safety function: the write still reaches the register for up to one scan, so if the target feeds motion, a dose or an interlock, the protection belongs in the safety-rated or hard-wired layer, sized and validated for that duty.

The rungs preserve a value; they do not screen the write path. Expect the one-scan transient, handle it with the consumer list, and keep the entry object available between stages so operators keep their normal workflow.

Two neighboring jobs need different tools. A value that feeds motion, a dose or an interlock is a safety question, and that answer belongs in the hard-wired or safety-rated layer. A value an operator may enter but only within a range is a clamping question: clamping HMI numeric entry limits in PLC ladder logic shows how to bound the entry in the same program. Clamp for range, lock for timing, and the pair covers most setpoint protection jobs.

Recommendation: Use the one-shot capture and the per-scan restore for any HMI-written setpoint that must hold through a stage: capture on the stage bit's rising edge, restore while the bit stays on, read the storage register in every mid-stage consumer, and let edits return once the bit drops. Drive the object visibility from the same bit so the screen matches the logic, and leave motion and dose limits to the safety layer.

Questions