The panel keeps showing each bore's last good read after its wireless link fails, and the driver's comms banner is global, so ten healthy PLCs look the same as the dead one. Give every PLC a heartbeat register that steps once per second and wraps at 60; the panel marks a bore stale only when its own register stops moving, after a threshold set from the measured worst link gap.
When one bore's wireless link to the control room drops, the overview page keeps the last numbers it read. Ten or more bores share one page on a 6-inch touch panel, a comms banner appears at the top, and nothing on the page says which bore went quiet. A bore can sit at 'running' with a plausible flow rate for the whole outage. The banner is driven by a driver-wide error flag, so no device number travels with it. The fix is per-PLC freshness: a heartbeat register in every bore PLC that steps once per second, and a compare on the panel that marks one bore stale when its own register stops moving. Below are the symptoms, the timing rule with the arithmetic, and the test that confirms the mark lands on the right bore.
What the screen is showing when the link dies
The panel displays what it last read successfully. When the radio path or the bore PLC stops answering, the driver raises its comms error, the banner appears, and that bore's tags hold their last good values. Nothing on screen marks them as old.
What you see, what it points to
- A bore still shows 'running' and a flow rate after its link fails. The panel is holding the last successful read. Treat every value on that page as unverified until each bore carries its own freshness signal.
- The comms banner appears but no bore is singled out. The banner comes from a driver-wide tag; with 10 PLCs configured it says an error exists and stops there.
- One bore's numbers freeze while its neighbours keep moving. The fault is in that bore's radio path, power supply or PLC, and the moving neighbours show the panel and the rest of the network are healthy.
- All ten bores blank whenever the banner appears. A screen-wide overlay driven by the global flag hides nine healthy bores every time one link stumbles. Keep the alarm and the value masking separate.
The panel software's help file has a system tags section. It lists an error-status tag (SYS_ERR) and an error-code tag (SYS_ERR). The status bit says an error exists; the code classifies the fault. Neither carries a device number, and that gap is what the rest of this article fills.
Check the driver settings for a built-in per-device heartbeat
Some panel drivers build the freshness check in. One maker's driver documentation describes the setting: when heartbeat is enabled, the HMI checks that a specific value in the PLC is updated within a specified interval, and treats the device as errored when it is not. If your driver's per-device settings include a heartbeat option, point it at a changing register in each PLC and drive each bore's overlay from that device's own error state. The rest of this article becomes your verification plan.
One controlled test tells you what you have. Agree a window with operations, interrupt one known bore's link, and record exactly what the page does. If nothing names that bore, build the compare below.
While you are in the device list, note that a device which never answers makes every scan wait out its timeout before the driver moves on. The article on HMI PLC timeout and invalid checksum errors explains what those errors mean.
The fix: one heartbeat register per PLC, one stale bit per bore
- Add the register in the PLC. In each bore PLC, add a counter in a register the panel already reads. Increment it once per second and wrap it from 60 back to 1. A 60 s wrap is short enough to watch a full cycle during commissioning. Drive the increment from the PLC's own scan logic, so the register moves whenever the PLC is powered and scanning, independent of process activity.
- Give each bore its own tags on the panel. Three application tags per bore: HB_NOW for the value just read, HB_LAST for the previous sample, HB_STALE as a bit. Ten bores means thirty tags, all plain reads the panel already performs.
- Stagger the sampling. Run one check per bore from a repeating timer, offset so the panel samples one bore at a time. Read HB_NOW. If it differs from HB_LAST, copy it across and clear HB_STALE and the bore's watchdog. If it matches, let the watchdog run and set HB_STALE when it reaches the threshold in the worked example below.
- Compare changed-or-not. The check asks whether the value moved, never whether it equals an expected number. A wrap from 60 to 1 is movement. A bore PLC that reboots and restarts its counter is movement. Only a powered-down PLC or a dead link holds the value still, and both deserve a stale mark.
- Mask with a label. Drive each bore's overlay from its own HB_STALE. When the bit sets, cover that bore's status and flow with a labeled block, for example 'COMM LOST, LAST SEEN 09:41', and leave it up until the next changed sample clears the bit. An unlabeled blank reads as zero or stopped, so always carry the label.
- Keep the banner. The driver-wide comms alarm stays on screen as the plant-wide announcement. The stale bits carry the device identity.
- Retire dead devices properly. When a bore leaves service for good, remove it from the device list so its timeouts stop slowing every scan. The article on stopping an HMI polling PLCs that are not installed walks through that cleanup.
One line belongs next to the mask: a stale 'running' is not proof the bore is running. Until the mark clears, anyone acting on that bore confirms its state by an independent method.
The same register works in both directions. How a PLC detects an HMI connection from heartbeat and port status is the PLC-side version of the compare, for the times the controller needs to know the panel is alive.
Recommendation: Give every remote PLC its own heartbeat register stepping once per second, sample each bore on the staggered timer at the interval set in the worked example, and mark a bore stale after 10 s without movement. Where the panel driver offers a built-in per-device heartbeat, use it and keep the same 10 s thinking. Raise the watchdog to five times the worst gap in an hourly health log when that log shows jitter beyond half the watchdog, and keep the driver-wide comms banner as the plant-wide alarm.
Worked example: stale threshold for a 10-bore field on a 1 s heartbeat
Inputs
- Heartbeat rate: 1 step per second, counter wrapping from 60 to 1. A 60 s cycle keeps commissioning simple: you can watch a full wrap by eye.
- Field size: 10 bores, each with its own PLC and its own counter register. The arithmetic scales linearly; 12 or 20 bores change only the staggering.
- Check interval: 2 s per bore, staggered, from the repeating timer on the panel.
- Threshold: 10 s of silence, chosen as 10 beats of margin at the 1 s rate. Ten beats rides out several back-to-back radio retry bursts, each costing 2 to 3 beats, and still raises the mark inside a quarter minute.
The interval and threshold are the two design settings; the margin rule at the end scales them to other links.
Rule in words. Sample each bore's register at the check interval. Whenever the new value differs from the last, the bore is fresh: clear the stale bit and restart the watchdog. When the watchdog reaches 10 s with no change, set that bore's stale bit. Stagger the ten checks across one full cycle so the panel reads one bore at a time.
Arithmetic
- Sample spacing across the field: one full cycle ÷ 10 bores = 200 ms between one bore's check and the next, so a mark lands on the right bore within 200 ms of its watchdog expiring.
- Watchdog margin: 10 s ÷ 1 s per step = 10 missed beats of headroom before the mark.
- Worst-case mark time: 10 s watchdog plus up to one full check interval = 12 s from the last good read to a stale mark on a genuinely dead link.
- Self-clearing dropouts: 8 s of silence or less produces at most 4 unchanged samples, and the movement arrives at the sample that would otherwise let the watchdog fire. A silence longer than 10 s draws the mark.
Result. Each bore gets its own stale bit, set 10 to 12 s after its last good read, only on that bore. Nine healthy bores keep live values throughout.
Decision. Set the watchdog at 10 s when the beat steps every 1 s and an hourly health log shows worst gaps of two beats or less. On a busier link, set the watchdog to five times the worst measured gap: a 4 s worst gap gives 20 s, a 6 s gap gives 30 s. Cutting the threshold below the measured jitter buys false stale marks; if 30 s is too slow for the process, the link needs shorter retries.
Test before you trust the page
- Commissioning: on a healthy bore, watch the register step from 1 to 60 in one 60 s cycle.
- Baseline: log all 10 heartbeat registers for 1 h of normal running and confirm the worst gap between changes sits inside the watchdog's margin, two beats or less for the 10 s setting.
- Failure: with operations' agreement, drop one bore's radio or power its PLC down for 30 s. That bore's stale bit sets within 12 s. The other nine keep updating with no mark.
- Recovery: restore the link. Fresh values return and the labeled block clears at the first changed sample, within one check interval.
- Cross-check: repeat on a different bore. The mark follows the failed link, never the page position, and a powered-down PLC marks exactly as a dead radio does.
That is the whole design: identity comes from data each PLC generates about itself, and the panel's judgment never spans more than one bore at a time. For more on keeping shop-floor and andon-board screens honest, see shop-floor screens and andon boards.
Questions
How do I set the stale threshold on a slower or busier wireless link?
Log 1 h of healthy running and find the worst gap between heartbeat changes across the bores. Set the watchdog to five times that gap with a 10 s floor: a 2-beat worst gap gives 10 s, a 4 s gap gives 20 s, a 6 s gap gives 30 s. At the staggered sample interval from the worked example, that is 5, 10 or 15 consecutive unchanged samples. If the resulting alarm is too slow for the process, shorten the link's retries, because a watchdog set under the measured jitter only produces false marks.
Does the heartbeat counter have to survive a PLC power cut?
No. The compare asks whether the value changed since the previous sample, so a counter that restarts at 1 after a power cut counts as movement, and the bore reads healthy again after two samples. What matters is that the register increments while the PLC is powered, in a location the panel reads. A bore whose PLC is off stops incrementing, so the panel marks that bore stale, which is the correct outcome.
Can the driver's own error tag do this without extra logic?
Keep it, but keep it in its place. The error-status bit and its code are global to the driver, so ten configured devices share one bit and one code, and the banner is your plant-wide alarm that something is wrong somewhere. What the banner lacks is a device number. That identity has to come from the heartbeat compare described here, one stale bit per bore.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.