Two HMIs writing to one PLC: who wins the write

What the PLC does with two writers

On this kind of link the panels are the masters and the PLC answers; the panels never talk to each other. Each write replaces the register's old value, and the PLC serves the requests it receives in arrival order. Say the local operator enters 100 °C and the remote operator enters 120 °C to the same setpoint: the logic samples whichever number landed last before the pass that uses it. For a small controller with a modest program, a logic pass runs about 1 to 10 ms, so entries made seconds apart are separate decisions, not a race inside one scan.

The write carries no source. An ordinary write object puts a value in an address, and the program reads that address with no station ID attached, so the logic has nothing to test that would tell panel one's 100 °C from panel two's 120 °C. If you need the source, you create it in the address map, which is what the fix below does.

Some buses settle this in hardware: a multi-master I2C bus arbitrates bit by bit on the wire, so two masters never fight over a finished byte. An Ethernet link between two panels and one PLC has no equivalent layer. The serial-port version of the same two-master wish fails louder, with timeouts and garbled replies before silent overwrites; why two HMI panels fail on one PLC serial port walks that failure.

Symptoms and what each one points to

When a second panel joins a PLC it can write to, these are the five things you see. Check them in this order.

• A setpoint reverts seconds after entry. Another station is writing the same address. Look at the other panel's screens for a numeric input on that register before blaming the link.
• The value flips between two numbers. Both panels are writing, and each entry overwrites the other. Watch the register in the programming software while each operator enters a value; the flip names the writer.
• Writes time out from one panel only. That panel's network identity or connection settings, not the PLC. Check its address first.
• Both panels drop communication together, off and on. Duplicate IP address. The documentation for at least one EtherNet/IP controller family describes duplicate-address detection putting both devices into a conflict state until one gets a new address. Fix the addresses before you test anything about control.
• The machine obeys a setpoint nobody just entered. Two writers with no authority rule. That is the design gap the next section closes.

Checks to run first

1. Prove the sharing path. Change a display-only value at one panel and watch the second panel pick it up after its next screen read, typically a few hundred milliseconds. The register is the only channel; the panels share nothing directly.
2. Give every device its own IP address. When you copy the project to the second panel, its network settings ride along, so change the address on the second unit before both go on the wire, and check both against the plant network plan.
3. List the writable objects. For each panel, write down every button, numeric input and mode selection and the address each one writes. Two columns, one per station.
4. Watch, then decide. Write the register from each panel in turn and read it back in the programming software; a panel whose writes never land needs the isolation steps in how to prove why an HMI reads the PLC but cannot write. Then assign authority per address: read-only, selector-gated or per-station register.

The fix: one address, one owner

If the second panel only displays, strip write access from its objects in the project. Two readers cannot collide, and this is the right answer for most second screens.

If both stations must command, wire a two-position local/remote selector to a PLC input and give each station its own command registers. The logic feeds the process setpoint from the active station's register and ignores the idle one. Define three things in that logic: a command already latched is dropped when the selector moves; the operator re-enters the setpoint after taking authority, so no stale number fires; and a status bit both screens display shows which station holds authority.

If no selector is possible, let both stations write their own registers and have the logic compare them; when they disagree, hold the last agreed value and raise a mismatch flag until the operators reconcile.

Clamp whatever the logic accepts: compare each incoming setpoint against the process minimum and maximum before it reaches an output. Enforce HMI increment and decrement limits in PLC logic shows the guard pattern.

Recommendation: make the remote panel read-only when it only monitors. When both stations must command, give each panel its own command registers and let a two-position local/remote selector choose in PLC logic, then run the four-write test below before the machine runs. Never leave two panels writing the same process address directly.

Example: two panels on one PLC, proved with four writes

The case is the one this article answers: two panels on one PLC over Ethernet, identical projects except each panel's own IP address. The address map has one shared setpoint register feeding the process, two station command registers, one per panel, and a two-position selector input wired to the PLC. The entries below, 100 °C from the local panel and 120 °C from the remote, are placeholders; the pass mark is what counts.

The rule: the logic accepts only the active station's command register, so the shared register should follow the selector and nothing else. A logic pass runs about 1 to 10 ms on a small controller, so wait 2 seconds after each write and read the register back before the next attempt. Run the test with the machine's output path disabled or on a spare command bit, never on a live output; test writes before motion is the discipline to follow.

The arithmetic: 2 selector positions x 2 panels = 4 write attempts. Expect exactly 2 accepted, one per position by the authorized panel, and exactly 2 rejected, since 2 minus 1 authorized per position = 1 blocked per position. So 4 attempts - 2 accepted - 2 rejected = 0 unexpected outcomes.

• Selector at LOCAL: the local panel writes 100 °C; the register reads 100 °C. The remote panel attempts 120 °C; the register still reads 100 °C.
• Selector at REMOTE: the remote panel writes 120 °C; the register reads 120 °C. The local panel attempts 100 °C; the register still reads 120 °C.

Result: 2 accepted where authorized, 2 rejected where not, 0 surprises, and the authority rule holds. Any unexpected write, even 1 of 4, fails the test, and the usual cause is the address map: a panel writing the process setpoint directly, past the guard, instead of into its station register. Correct the mapping and rerun all 4 attempts; do not accept 3 of 4. Two clean passes, 8 writes with 0 unexpected outcomes, is enough to trust the rule on the floor.

The decision, per case

• Second panel only displays: strip its write access and you are done.
• Both stations command: per-station command registers, a two-position selector choosing in PLC logic, and the four-write proof before the line runs.
• No selector available: both stations write their own registers, and the logic compares, holds and flags until the operators agree.

Questions