If an HMI or OPC client reads a PLC's inputs but a test write of 1 leaves memory unchanged, the fault is in access, and the output cards stay on the shelf. On CPUs with the DL205 multi-level password, a password outside the documented format, an uppercase A followed by exactly seven digits, keeps reads open and writes closed. Set that format and test both directions with a read-back.
An HMI that reads a PLC without trouble can still be shut out of writes, and the fault looks exactly like two dead output cards. On CPUs that support the multi-level password of the DL205 family, a password outside the documented format leaves the communication port open to reads and closed to memory changes. The format that preserves operator writes is precise: an uppercase A followed by exactly seven digits, 8 characters in total. If your HMI shows every input but an OPC quick client write of a 1 to an unused output leaves the value at 0, check the CPU password before you order a single card. This article gives the symptom pattern, the checks that separate an access fault from a wiring fault, and the fix.
Why reads work while writes fail
A read and a write are separate transactions. A successful read tells you the cable, the protocol driver and the OPC server all work. Permission to change memory is a separate matter, and a healthy HMI screen covers one direction only. Test both, because only the write test reaches the cards.
The DL205 User Manual, Appendix A on auxiliary functions, documents multi-level password protection for three CPUs in that family: the D2-240, the DL250-1 and the D2-260. The feature protects the ladder program without closing the communication port to an operator interface, which is exactly what an HMI connection needs. To invoke it, the password must be an uppercase A followed by seven numeric characters; the manual's example is A1234567.
A password outside that pattern does not set up that arrangement. External clients keep read access and lose write access, so inputs keep arriving on the HMI while OPC writes change nothing in memory. That is why the symptom so often starts with a program update: the CPU comes back from the bench with a freshly typed password, one character off, and the format is strict. A lowercase a, six digits where seven are required, a stray space: each blocks external writes while every read keeps working. The same wrong pattern can block HMI button presses too; the article on PLC passwords that block HMI button presses covers that symptom from the operator's side.
Symptoms and what each points to
Run the read-back test from the next section first, then match what you see to a row:
| What you see | What it points to |
|---|---|
| HMI reads inputs, a quick client write of 1 leaves memory at 0 | Access blocked at the CPU: password pattern, write permission, or a write aimed at the wrong address |
| Programming software connects with a password, external writes still fail | Programming access and operator-interface write access are separate; compare the stored password with the documented format |
| The value moves for one scan and returns to 0 | The ladder overwrites the point every scan; some OPC servers read an unchanged value as no change and skip the next write, so force a change of state: write 0 first, then 1 |
| The value changes and holds, the output stays off | Downstream of the CPU: program logic, the module status LED, 50-pin connector seating, module power, field wiring |
| Run indicator off, every output dead | The CPU is not in RUN; outputs operate only in RUN, so restore the operating state first |
One more split: if the PLC memory changes but the HMI screen never updates, the tag binding is at fault, not access. Fix an imported HMI tag that ignores PLC register writes walks through that case.
Checks before you order output cards
- Read the CPU mode and its run indicator. Outputs operate only while the CPU is in RUN. A mode fault kills every output at once, not the outputs of two specific cards.
- From the OPC quick client, write a value of 1 to an unused output and read the address back before and after, then across 10 consecutive scans. On a typical 100 ms scan cycle that is 1 second of observation; scale the watch window to your program's scan time. This one comparison splits the fault: memory unchanged points at access, memory changed points at the cards and wiring.
- If the memory is unchanged, open the CPU's password settings in the programming software and compare the stored password character by character with the documented pattern: uppercase A, then exactly seven digits, 8 characters in total.
- If the memory changes and holds, watch the point across several scans, then check the module status LED, the connector seating and module power before blaming the module.
- Record the current password state and who authorized a change before you touch anything. A password edit needs the programming connection on site; the HMI or OPC link cannot perform one.
Example: two output cards that were never bad
A line runs a D2-260 with two output cards behind a 50-pin connector, and an HMI reads inputs through an OPC server. The CPU comes back from a program update and the outputs stay dark. The HMI still shows every input. An OPC quick client writes a value of 1 to an unused output, and the memory stays at 0.
The checks: the CPU is in RUN and its run indicator is on, so the mode is clear. The read-back stays at 0 after the write across 10 consecutive scans, about 1 second on that line's 100 ms scan, so the fault sits upstream of the cards, in access. The stored password is A482160: one uppercase A plus six digits, 7 characters. The documented pattern is one uppercase A plus seven digits, 8 characters. The password is one digit short, and the CPU has treated every external client as read-only since the update.
The fix: enter A4821600, one uppercase A plus seven digits, 8 characters. Reconnect the client, write a value of 1 to the same unused output, and the memory moves from 0 to 1 and holds across 10 scans. The output status LED follows the command. Both cards were healthy, and the replacement order is cancelled.
Choose your own digits. A4821600 is an illustration, and the manual's example A1234567 should not be your working password either.
The fix: set the multi-level password in the documented format
- Arrange authorized programming access on site. Password changes happen in the programming software over the programming connection; the HMI and OPC side cannot perform one.
- Put the machine in a safe state first. A programming session can stop or alter the running program, so keep people and loads clear while you are connected to the CPU.
- In the CPU's password settings, set the multi-level password as an uppercase A followed by exactly seven digits: 8 characters total, no spaces, no lowercase, and your own digits.
- Save the program and password to the CPU, then reconnect the HMI or OPC client.
- Test both directions. Read the inputs as before, then write a value of 1 to an unused output and confirm the memory moves from 0 to 1 and holds across several scans.
- Hand the machine back once both tests pass, and record the password pattern and its authorization for whoever opens this CPU next.
If production is down right now and access is the confirmed cause, the documented recovery is to correct or remove the password through the programming software with authorization, then set the multi-level format above. A removed password is a temporary state; put the formatted one back before the job closes.
The decision for each case
Decide on the read-back, and the cards come last. If a write of 1 leaves the PLC memory unchanged across 10 scans, the fault is access: RUN state, password pattern, write permission, target address. Fix those and keep the cards on the shelf.
If the memory changes and holds while the output stays off, go downstream from the CPU: the program logic that may overwrite the point, the module status LED, the seating of the 50-pin connector, module power and the field circuit. Only a correct memory value, a dark status LED and sound wiring together point at a failed output module, and with two modules silent at once after a program update, a shared upstream cause is the far better bet. When no password is set anywhere and writes still fail with reads healthy, the next suspect is a hardware write-enable path; the key-switch cause of HMI write errors when reads still work is the usual one.
Recommendation: Before any output card comes off the shelf, run the read-back test: CPU in RUN, an OPC quick client write of a value of 1 to an unused output, then read the address back across 10 consecutive scans. If the memory is unchanged, fix access, and on a D2-240, DL250-1 or D2-260 the first comparison is the password format: an uppercase A followed by exactly seven digits, 8 characters total. If the memory changes and holds, follow the signal downstream through the module LED, the 50-pin connector and the field wiring, and order cards only when that path checks out.
If the same cell also needs a notice board or andon screen beside the HMI, that is a separate screen with a separate job; we build shop-floor displays for exactly that.
Questions
Does the uppercase A plus seven digits rule apply to every PLC?
No. The multi-level password format is documented for the D2-240, DL250-1 and D2-260 CPUs in Appendix A of the DL205 User Manual. Other CPU families print their own password rules in their own manuals, and some protect program access only. Find the password section for your exact CPU and match its required format before you change anything.
Why did the outputs fail right after the program update?
Because that is when the password state changed. The CPU came back from the programming bench with a freshly entered password, and a password typed outside the required pattern blocks external writes from that moment. Inputs keep reading normally on the HMI, so the operator interface looks healthy and two good output cards take the blame.
Can I choose the seven digits myself?
Yes. The requirement is the pattern, not the values: an uppercase A followed by seven numeric characters, 8 characters in total. Pick digits your site controls, enter them in the CPU's password settings through the programming software, and record them where authorized staff can find them. There is nothing special about any particular seven digits.
Planning information, not legal or engineering advice. Rules differ by place: check codes and permits with your local authority and your licensed trades.