Factory Field Notes

OT cybersecurity is getting harder, and this episode explains why: AI lowers the bar for attackers, more plant hardware is reachable from the internet, and recovery time now sets the insurance premium. Five more r/PLC questions follow.

Subscribe for weekly industrial automation discussions built from the most upvoted questions in the community.

Learn more at Joltek:

- OT Remote Access, a plant manager's guide: https://www.joltek.com/blog/ot-remote-access

- ISA/IEC 62443 explained: https://www.joltek.com/blog/isa-iec-62443

- PLC Platform Migration: https://www.joltek.com/blog/plc-platform-migration

- TIA Portal download and install: https://www.joltek.com/blog/tia-portal-download-install-free-plc-programming-siemens

It starts with refrigerated store shelving whose controls were attacked. The attackers raised the temperature set point and the food was thrown out. I have worked in refrigerated food plants that held 3 degrees Celsius, where product above its limit too long is waste. Dragos counted a 64% rise in ransomware attacks on industrial organizations in 2025, across 3,300 victims, and manufacturing was more than two thirds of them.

Two things drive it. AI makes it cheaper to scan for vulnerabilities and to write phishing messages that are hard to spot. And plant hardware is more connected: PLC 5 era controllers sat on isolated or flat networks, while SCADA, MES and edge IPCs, often on old Windows, now reach the web. A typical audit finding is a rogue device on a guest network exposing everything behind it.

Remote access done right is a hardware key, an authenticator, a DMZ between IT and OT, and one engineering workstation as the only way in. Lock everything down instead and people find workarounds, like an IPC on a cellular connection. The business feels it in insurance. Illustratively, a plant paying $2,000,000 a year in premiums that cuts recovery from two weeks to one might pay closer to $1,200,000.

Amusement park rides use the same PLCs, sensors and robots as a plant. The logic is simpler than a high speed line. The difference is safety validation. Then a 38 year old Omron C60K on a rail car, its program saved as an audio file, replaced by 54 lines of code where the original had 1,193. That gap is a red flag. Almost any 24 VDC PLC covers its 20 inputs and 15 outputs. The panel, power supply and support matter more than the CPU.

Two months in as the only PLC programmer at a plant is an organizational problem, not a personal failing. Ask in interviews why the position is open, and find mentors at sister sites or through ISA. To learn at home, use free software and a used PLC rather than an Arduino, on the platform your target employers run. Last, a MicroLogix bagger that needs a reject station and a labeler.

Timestamps

0:00 Cyber attacks, AI and this week's questions

1:07 Refrigerated store shelving hacked through its set point

3:35 Why OT attacks keep rising: AI lowers the bar

4:38 More connected hardware than the PLC 5 era

5:45 What OT audits find: rogue devices on guest networks

7:09 Remote access done right: hardware key, MFA, DMZ

8:13 Phishing, social engineering and IPCs at the edge

9:36 Lock it down too hard and people find workarounds

10:56 Cyber insurance premiums and recovery time

13:11 Amusement park ride controls: simple or not?

15:29 Ride safety testing and empty test trains

16:30 Why ride controls are simpler than a production line

17:35 Reviving a 38 year old Omron C60K on a rail car

19:39 54 lines of code to replace 1,193

20:52 Hand drawn ladder diagrams and where ladder logic came from

24:36 Two red flags in the rewrite

25:54 When it makes sense to upgrade a running PLC

26:58 Specifying the replacement for a rail car

29:26 Brands, total cost of ownership and support

30:49 Two months in and the only PLC programmer

32:58 Why controls teams are so thin

34:46 The interview question that reveals a burnout job

38:38 How to handle the pressure: mentors and directors

41:07 Learning PLC programming at home

43:14 Does a C and C++ background transfer to PLCs?

44:16 TIA Portal on a Mac, RSLogix 500 and CODESYS

46:44 A home lab PLC for $200 to $300

48:12 Adding logic to an upgraded bagger

49:35 Getting online with a MicroLogix in RSLogix 500

51:13 Do web development skills transfer to ladder logic?

53:26 Two weeks for a beginner, an afternoon for an expert

Connect:

LinkedIn: https://www.linkedin.com/in/vladromanov

Joltek: https://www.joltek.com

SolisPLC: https://www.solisplc.com

#OTCybersecurity #PLCProgramming #IndustrialAutomation #PLC

AOIs and UDTs are the fastest way to make a PLC program maintainable and the fastest way to make it impossible to troubleshoot. This episode works through where that line sits, plus four more questions from r/PLC.

Subscribe for weekly industrial automation discussions built from the most upvoted questions in the community.

Learn more at Joltek:
- OT Networking Fundamentals, the full course: https://www.joltek.com/education/ot-networking-fundamentals
- Rockwell PLC Lifecycle and Migration Guide: https://www.joltek.com/blog/rockwell-plc-lifecycle-migration-guide
- Safety in Industrial Automation: https://www.joltek.com/blog/safety-industrial-automation-manufacturing

The meme that started this puts a beginner being told to learn how to code next to a veteran recognising his own Add On Instruction in a dozen places. Both ends of that bell curve are real, and the middle is where the damage happens. An AOI is syntactic sugar, a wrapper around logic you would otherwise copy, the same idea as a function in Python or C++. It feels harder because of the interface, not the concept. A function written in ladder logic is genuinely unusual if you learned to program anywhere else.

The rule of thumb I use is to avoid AOIs and UDTs until you are replicating and editing the same code often enough that changing every instance by hand is the larger risk. At that point pair them, because the UDT carries the data and the AOI carries the execution. The failure mode is version sprawl. Tank version 1.3, tank 1.4, tank 2.7 and tank 2.8 in one project is not an AOI any more. It is four programs wearing the same name, and it defeats the reason you created it.

Nesting deserves its own warning. In traditional software a pipeline runs tests and tells you what broke when an inner function changes. On the plant floor that safety net does not exist, so a change two levels down surfaces as a machine behaving strangely at 2 AM.

On reverse engineering, the drawings are worth more than people assume. A 60 year old pipe bender that still bends 80 millimetre tube with a 10 millimetre wall is usually better built than its replacement. Start from the schematic, then talk to the operators, because the undocumented changes made over decades are what the drawings will not tell you. The SIMATIC 505 in that project began as a Texas Instruments product, moved to Siemens, was discontinued, and is built today by Control Technology Inc.

The 5069 question has a clean diagnostic order. When the backplane shows one slot and the rest flash, stop trying to flash the analog module and flash the controller first. Then pull every card, seat one module with no field wiring attached, confirm it appears in RSLinx, and add the next.

The career question closes it out. Hands on electrical troubleshooting is an advantage over a pure software background, not a gap to apologise for, because this field sits between the physical and the software and you have lived the half that cannot be simulated. Average controls engineer compensation reached $119,682 in 2025 and 38% of manufacturers name the skilled worker shortage as a top threat.

Timestamps
0:00 Intro and what this series is
0:53 A home PLC training rig, and what to add next
3:36 Managed switches, Stratix and Moxa on a learning bench
5:24 Safety circuits you troubleshoot but never design
6:17 Build an IPC or a spare PC to run Ignition and Node RED
8:08 The AOI love hate meme from r/PLC
10:26 Why an AOI is syntactic sugar
11:01 When an AOI and UDT pair earns its place
13:21 The AOI bell curve across a career
15:01 Tank version 1.3, 1.4, 2.7: when it stops being an AOI
15:30 Nesting AOIs, and why no test pipeline catches it
16:43 Converting a 60 year old pipe bender from relays
19:30 The SIMATIC 505, from Texas Instruments to CTI
21:22 Why you still talk to the operators
22:36 A used washer and dryer, and the schematic in the lid
24:34 A 5069 IF8 card and a backplane that sees one slot
26:48 Flash the controller first, not the analog module
28:01 Strip the rack to one card and build back up
30:45 From industrial electrician to PLC programmer
33:47 Tell your employer before you self study alone
36:36 Does hands on experience beat a software degree
38:24 How the transition happens in practice
43:06 Why you cannot learn this field without hardware

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com

#AOI #PLCProgramming #Studio5000 #IndustrialAutomation

Is CODESYS any good? I learned it, read about half of the CODESYS book, and give my honest take: a reliable runtime that wins on hardware choice and loses on ecosystem integration and on how it gets sold. Also: commissioning bags, locked OEM code and careers.

Subscribe for weekly industrial automation discussions built from the most upvoted questions in the community.

Learn more at Joltek:
- Bringing New Machinery Into the Plant: https://www.joltek.com/blog/manufacturing-challenges-new-machinery-plant
- Systems Integrator Playbook: A Plant's Guide: https://www.joltek.com/blog/system-integrators
- Edge Solutions in Industrial Automation: https://www.joltek.com/blog/edge-solutions-industrial-automation

CODESYS runs under the hood of Phoenix Contact PLCnext, and Opto 22 controllers can run it too, so the runtime itself is proven. The catch is the ecosystem. In Studio 5000 you pull the AOIs and UDTs for a PowerFlex 525 or a Kinetix 5500 in minutes, and CODESYS gives you no native CIP Motion. Synchronizing many axes at high speed is a different story, and moving a project from one vendor's hardware to another, say Opto 22 to WAGO, still means mapping and device files. Running on many vendors can be insurance, as the pandemic parts shortage showed. The bigger barrier is commercial: few sellers push it into plants already standardized on Rockwell, Siemens or Schneider Electric.

The machine builder question splits the room. Earlier in my career a supplier that password protected its controls did not sell into the plant, and we once ripped out a vendor's custom board and rebuilt the machine on Rockwell. In food and beverage I met industrial PCs running closed applications over Modbus and CANopen. My view: full access after the FAT, VAT and handover, with liability moving to the owner. Safety sections can hand over passwords once validated. Never before acceptance.

The commissioning bag starts with a USB to RS232 cable, a USB to RJ45 console cable (a Cisco style serial cable, not an Ethernet adapter), a real USB to Ethernet dongle, gender changers, the USB type B cable for CompactLogix and ControlLogix, and HDMI plus DisplayPort for IPCs. Peeling the "protective film" off an HMI can tear off the touch layer and its ribbon cable, a repair of $1,000 or more. A $6,000 to $8,000 vision sensor came back to my desk in 2016 with its pigtail cut at the sensor body. Give specific instructions.

For the engineer who feels lost five years out: maintenance counts, shadowing is normal (my first year at Procter & Gamble meant night shifts commissioning multimillion dollar lines), and a SCADA seat touches PLCs, HMIs, networks, MES and ERP. Ask about the KPIs, propose improvements, and train on your platform: Inductive University for Ignition, Cisco, AWS or Azure.

Timestamps
0:00 Intro and the ISA Montreal section
0:44 FAT, VAT and SAT: commissioning acronyms
1:30 What is in a PLC commissioning bag
6:00 The HMI protective film that was the touch screen
8:08 A vision sensor pigtail cut at the sensor
10:50 About Vladimir Romanov
11:22 Life on the road during commissioning trips
13:48 Road rules: real food, packing light, checked bags
17:02 Exercise, the sauna and starting SolisPLC
19:45 Career advice: five years out and feeling lost
21:40 Why maintenance experience counts
23:16 Shadowing on night shift is normal early on
25:14 Turning a SCADA monitoring job into learning
31:02 Building practical skills from a SCADA seat
32:36 Should you move into low current ELV systems?
33:43 Courses and certifications worth your time
36:01 Should machine builders give customers PLC access?
38:55 Safety passwords and liability at handover
41:32 Why no access before the VAT and FAT
42:18 Is CODESYS any good?
43:58 CODESYS on PLCnext and Opto 22
44:28 Integration gaps: drives and CIP Motion
46:18 Hardware choice as supply chain insurance
47:32 Why CODESYS is hard to sell into plants

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com

Studio 5000 trends only help if they capture the fault, and the intermittent ones never happen while you are watching. This is the trend setup I use: fixed axes, honest sample rates, a trigger, and BOOLs packed into a DINT.

Subscribe for weekly industrial automation discussions built from the most upvoted questions in the community.

Learn more at Joltek:
- PLC Scan Cycles, Polling and SCADA Data: https://www.joltek.com/blog/plc-scan-cycles-polling-scada-systems-data
- Rockwell PLC Lifecycle and Migration Guide: https://www.joltek.com/blog/rockwell-plc-lifecycle-migration-guide
- Root Causes of Downtime in Industrial Automation: https://www.joltek.com/blog/root-causes-downtime-industrial-automation

The trending answer starts with a story from two years into my career. A servo drive on a high speed line overtorqued and crashed product, and our only history was an MES collector sampling every PLC tag once every five minutes. The event lasted maybe ten seconds, so nothing useful was recorded around it. I was sent to the floor with a laptop to trend it live, and it never happened again while anyone watched.

A trend made by right clicking a tag in Logix Designer shows a rough waveform, but it is unscaled and its time span is arbitrary. Fix the Y axis to the range you expect, pick a time span that fits the event, and set a sample period that reflects how fast the signal can really change, because sensors and relays respond slower than the scan. Then add a start trigger on the transition you care about so the trend keeps samples from before and after the event. Each trend is limited to 8 pens, so write up to 32 BOOLs into the bits of one DINT and trend that single tag.

On Studio 5000 version choice, the Rockwell Automation Product Compatibility and Download Center listed 38.03 as the preferred revision at the time of recording, with 37.05, 36.06 and 35.05 still active. Newest is not automatically right. If the plant already runs version 34, 33 or older, a new major revision means new installs on every laptop and server, so I lean toward what the site already runs, provided the release notes do not flag the drives or protocols you depend on.

The PanelView Plus 700 question comes from a Shanklin shrink sealer bought at auction, running an older CompactLogix 1769 L35E whose firmware tops out at revision 20. A login screen that renders without its username and password fields usually means the HMI cannot reach the controller. Confirm the PLC still holds its program and shows RUN, check the Ethernet path and any switch, ping both devices, and verify the controller path in the PanelView configuration menu and in RSLinx. The bigger red flag is the DeviceNet scanner: back the program up now and bring in a systems integrator, because rebuilding lost DeviceNet configuration is painful.

Wire numbering at scale means page and coordinate cross references; the Procter & Gamble drawings I worked with earlier in my career ran to thousands of pages per machine. Treat prints like software, with major and minor revisions. The episode also reviews a 3D printed home control cabinet built on an AutomationDirect Productivity1000 PLC that sells for about $165, where lever terminal blocks earn praise and red DC wiring does not, since NFPA 79 calls for blue on ungrounded DC control conductors. A Panasonic FP0 test bench whose 24 VDC supply died while testing a relay output gets the field answer: check I/O one point at a time.

Timestamps
0:00 Intro and this week's most upvoted questions
0:35 3D printed home control cabinet on an AutomationDirect PLC
3:56 Reading the PLC power supply spec
6:57 Wire gauge, color codes and lever terminal blocks
11:01 Why engineers should build a training kit
12:28 Failed power supply on a Panasonic FP0 test bench
17:33 I/O checkout one point at a time
19:05 Wire numbering methods and conventions
22:52 Page and coordinate cross referencing
24:02 Revision control for electrical prints
25:51 PanelView Plus login lost on an auction machine
28:12 CompactLogix L35E checks: program, Ethernet, RSLinx
32:29 DeviceNet red flag: back up the PLC now
33:13 Studio 5000 v36 vs v37 vs v38
36:23 Match the versions the plant already runs
38:06 Studio 5000 trends: a servo overtorque story
41:43 Trend setup: fixed axes, time span, sample rate
44:13 Trend triggers: capture before and after the event
45:17 Pack BOOLs into a DINT to beat the pen limit

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com

PLC training kit design decides whether students learn what the plant floor actually looks like. A Mitsubishi trainer and a student capstone panel show where good intentions fall short: banana plugs, a single channel E-stop, and a missing ground.

Subscribe for weekly industrial automation discussions built from the most upvoted questions in the community.

Learn more at Joltek:
- Safety in Industrial Automation and Manufacturing: https://www.joltek.com/blog/safety-industrial-automation-manufacturing
- Guide to Installing a Windows VM on Proxmox: https://www.joltek.com/blog/guide-installing-windows-vm-on-proxmox
- Humble Beginnings: Consulting and Upskilling in Systems Integration: https://www.joltek.com/blog/humble-beginnings-consulting-upskilling-systems-integration
- Workforce Development and Education: https://www.joltek.com/services/service-details-workforce-development-education

The longest segment is a teardown of a PLC trainer built for an engineering university and sponsored by Mitsubishi Electric. The ingredients are right: a Mitsubishi PLC and HMI, a D800 series VFD, a stack light, a potentiometer, relays and a proximity sensor. The problem is how the I/O reaches the student. Every point breaks out to banana plugs, so nobody lands a wire in a terminal block, the first thing they will do in a real panel. 24 VDC is yellow and 0 VDC is blue, the faceplate diagrams never say whether a push button is normally open or normally closed, and the E-stop is a single channel push button in an E-stop housing. ISO 13850 treats the emergency stop as a complementary protective measure that stays latched until someone deliberately resets it, and in practice that function runs on dual channels through a safety relay or safety controller. A trainer that teaches the shape of an E-stop without the circuit behind it teaches the wrong lesson. I prefer a compact core kit with everything else brought in through terminals.

The capstone panel is a two tank transfer system built on an Arduino Opta with an ESP32 on a breadboard, and the wire trays and crimped terminations are genuinely good. The design choice worth questioning is the relay stack. The Opta already has four relay outputs rated for 10 A each, and they drive a hobbyist relay board also rated for 10 A, so switching is doubled without adding capacity. The power supply ground is not landed, and the E-stop does not remove power from the panel the way it is wired.

The episode opens with the meme every Rockwell user knows: a laptop choking on a Logix Designer project. Rockwell Automation lists 8 GB of RAM and 4 logical cores as the minimum for Studio 5000 Logix Designer version 38, with 16 GB and 8 cores recommended. The 4 GB laptop IT hands out saves a little on hardware and loses far more in engineering hours. The workaround is a virtualized engineering workstation on Windows Server or Proxmox that engineers reach from thin machines.

The last two questions are about the job. Do PLC and DCS engineers need electrical knowledge? In most cases yes, because whoever specifies the I/O on a Siemens S7-1200 G2 or an AutomationDirect Productivity controller usually commissions it too. At Procter & Gamble and Kraft Heinz, where I worked earlier in my career, technicians carried routine maintenance and engineers were the last line of defense, with support like Rockwell TechConnect behind them. And what does a control systems engineer at a mine do all day? Field troubleshooting, long term projects, RCA review on day shift, and coordination with IT, vendors and contractors.

Timestamps
0:00 Intro and the most upvoted questions this month
0:56 Logix Designer laptop meme: why engineering software needs real RAM
4:24 Thin laptops vs a virtualized engineering workstation on Proxmox
5:40 Mitsubishi PLC trainer review for an engineering university
8:15 Banana plugs, color codes, and why terminals matter
11:48 A single channel E-stop is not an E-stop
14:43 How I would design a PLC training kit
16:05 Capstone panel review: PLC and ESP32 two tank system
18:28 Arduino Opta and doubled up relays
23:38 Land the ground and research dual channel safety
24:13 Do PLC programmers need electrical wiring knowledge?
28:05 Engineers vs technicians at large manufacturing plants
30:12 What a control systems engineer at a mine does day to day
32:38 When everything runs normally: projects, shifts, and team structure

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com

HMI SCADA platform to learn in 2026 is the wrong first question, and this Reddit round up explains why the backend matters more than the graphics library. Ignition is still the free starting point, but the real skill gap is somewhere else entirely.

Subscribe for weekly industrial automation and manufacturing discussions.

Learn more at Joltek:
- Connecting an Allen Bradley PLC to Ignition: https://www.joltek.com/blog/connecting-allen-bradley-plc-ignition
- Understanding Industrial Ethernet Reliability: https://www.joltek.com/blog/industrial-ethernet-reliability
- Humble Beginnings: Consulting and Upskilling in Systems Integration: https://www.joltek.com/blog/humble-beginnings-consulting-upskilling-systems-integration
- Workforce Development and Education: https://www.joltek.com/services/service-details-workforce-development-education

Someone asked which HMI and SCADA platform is worth learning in 2026, and said they wanted something with richer graphical libraries than Wintek or Siemens can offer. The honest answer disappointed the comment section a little. Modern UI components are being commoditized by AI assisted design tools across every platform, Ignition included, so chasing the platform with the prettiest screens is chasing the wrong variable. The place a HMI and SCADA build actually lives or dies is the back end. That means the historian structure, the network that feeds it, and whether the database is organized to answer the questions the plant will eventually ask about batching, throughput, and overall equipment effectiveness. Ignition remains the right free starting point because Inductive University runs a full course at no cost and the gateway trial resets on a two hour cycle indefinitely, but the platform choice matters far less than whether there is a real project waiting to apply it to.

The rest of this episode covers four more questions pulled from the top of r/PLC this month. A Siemens PLC salvaged from a flooded scrap panel now runs a Street Fighter arcade cabinet over Modbus, which is a genuinely useful reminder of how conformally coated boards survive water if the short circuit never reaches the fuse. A photo of a Stratix switch mid configuration becomes a full explanation of device level ring, the ring topology that gives a plant two paths back to the switch instead of one so a single cable failure never takes a node off the network entirely. A wash down panel built for an ice cream line raises a real design question worth sitting with. Why do a PLC and safety module worth roughly $20,000 sit at the bottom of the enclosure while ABB variable frequency drives worth $600 to $1,000 each sit at the top, closer to any moisture that gets past the gasket seals. And a newly graduated automation technician, twenty one years old and the only backup before his one experienced colleague quits, asks how to manage the fear of messing up on a continuous production line. That answer draws directly on what it felt like starting as a controls engineer at Procter and Gamble in 2014 without having heard the word PLC before, which is a more common starting point in this field than most new hires are told.

The programming language debate closes the episode. Ladder logic, structured text, and function block diagrams all compile to the same binary, so the language itself is never the technical constraint. What actually decides the choice is the customer, the industry, and how much complexity the next person troubleshooting the program will need to untangle.

Timestamps
0:00 Intro and where to catch me at ICC and ISA
0:59 Flooded Siemens PLC rebuilt into a Street Fighter arcade controller
5:08 Device level ring explained on a real Stratix switch
10:59 Ice cream wash down panel teardown: Kinetix servos and ABB VFDs
19:00 Imposter syndrome and advice for a new automation technician
26:58 Which HMI and SCADA platform to learn in 2026
32:32 Ladder logic vs structured text vs function block diagrams

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com

#HMISCADA #IndustrialAutomation #Ignition #PLCProgramming #Manufacturing

NAT in industrial networks solves a real addressing problem and quietly creates three new ones. This is the buy or readdress decision, fully costed, from a live plant deployment.

Most plants meet network address translation the same way. A new machine arrives, the builder has assigned an addressing scheme that has nothing to do with the plant, and somebody decides whether to renumber every device in that panel or put a NAT device in front of it.

Subscribe for weekly breakdowns of the technical decisions that land on an engineering manager's desk.

Learn more at Joltek:
- IP Addresses in Industrial Automation and OT Networks: https://www.joltek.com/blog/ip-addresses-industrial-automation-ot-networks
- Modern Plant Network Requirements for Manufacturing: https://www.joltek.com/blog/modern-plant-network-requirements-manufacturing
- Plant Floor OT Networking: https://www.joltek.com/blog/plant-floor-ot-networking
- IT and OT Architecture and Integration: https://www.joltek.com/services/service-details-it-ot-architecture-integration

Readdressing looks cheapest on a quote and is not. Renumbering a panel needs connectivity to the PLC, the HMI, the drives and the servo drives, and in a Rockwell Automation environment that means a licensed copy of Studio 5000 or RSLogix, and very likely FactoryTalk View ME. Plenty of small and mid sized plants have nobody on staff who can do that and then verify every device still communicates.

Then there is warranty, which rarely comes up in the engineering discussion and always comes up later. It sits with the original machine builder and is commonly void once the equipment is modified. If your team renumbers that panel and the builder can no longer reach it at the addresses in their own records, you own that conversation.

The third problem catches technically strong teams. Putting everything on the plant network means deciding what traffic belongs there. A PLC and an HMI are usually fine. Hundreds of drives are a grey area. Vision systems publishing images to a server are not, and safety systems add their own polling load.

NAT is the other route. It sits between the panel and the plant and translates one to one. The PLC at 192.168.1.10 inside the cabinet is published to the plant as 10.10.10.100, the HMI at .11 becomes .110, nothing inside the panel changes, and the builder's scheme survives. Rockwell Automation sells the 1783-NATR for this, higher tier Stratix switches can do it with the feature licensed, and vendors including Moxa build industrial switches with the capability.

This is not a free translation layer. You only translate what you explicitly map, so a drive with no entry is genuinely unreachable from the plant side. An engineer at a desk running RSLinx can reach the PLC and cannot open that drive in Connected Components Workbench. Standing at the panel, they need a different address range on their laptop, and an IT provisioned machine may not let them change it. The workaround is that the NAT device usually holds an address on both networks, so you can add a temporary entry, do the work, and remove it afterwards.

The hardware runs from roughly $1,000 to several thousand dollars per device. On top of that you pay engineering hours to build and document every entry, and you maintain two address schemes per machine for as long as that equipment runs. That spreadsheet becomes load bearing, and every contractor you bring in has to be told what they are walking into.

Neither route is wrong, but neither is only about one panel. Once a plant starts down the NAT path it tends to spread into every machine that follows, so this is a standard you are setting, not a purchase you are making. Choose on purpose, write the choice down, and make sure the next person who opens that panel knows which one you picked.

Timestamps
0:00 The plant with a NAT device in every machine
3:10 What network address translation actually is
4:10 Why machine builders hand you an addressing problem
6:40 Option one: readdress every device in the panel
9:00 What readdressing really costs in licences and hours
10:00 The warranty exposure nobody budgets for
10:40 Which devices actually belong on the plant network
12:22 Option two: how NAT sits between the panel and the plant
14:30 The laptop problem: plant side versus equipment side
16:45 When an IT provisioned laptop cannot reach the drive
17:25 The temporary translation entry workaround
18:30 What NAT costs to buy and to keep running
20:50 How to make the call

More from Joltek:
Website: https://www.joltek.com
Book a modernization consultation: https://www.joltek.com/book-a-modernization-consultation

Structured text vs ladder logic is the oldest argument in PLC programming, and this week a CODESYS convert changed sides and said so publicly. I agree with where he landed and not with how he got there.

Subscribe for weekly industrial automation and manufacturing discussions.

Learn more at Joltek:
- IP Addresses in Industrial Automation and OT Networks: https://www.joltek.com/blog/ip-addresses-industrial-automation-ot-networks
- Root Causes of Downtime in Industrial Automation: https://www.joltek.com/blog/root-causes-downtime-industrial-automation
- Rockwell PLC Lifecycle and Migration Guide: https://www.joltek.com/blog/rockwell-plc-lifecycle-migration-guide
- Workforce Development and Education: https://www.joltek.com/services/service-details-workforce-development-education

The phrase I want to retire is "use the right tool for the job." It sounds like judgement and it is an evasion, because most IEC 61131-3 languages can accomplish ninety percent of what a control system needs. The same interlock builds in ladder, in structured text, or in a function block diagram, and all three run. That is exactly why the phrase settles nothing.

Ladder still dominates discrete control for a historical reason that has not gone away. It mirrors the electrical schematics machines were already built from, and many of those schematics have not changed. A technician tracing a fault at two in the morning holds the print in one hand and the rung on screen in the other. That correspondence is worth more than elegance. Where continuous process is involved, function block diagrams win for the same reason: a P&ID reads as flow and so does a function block diagram.

Structured text earns its place in data handling, recipe management, and anything algorithmic. It also dominates on CODESYS, and this is the part most people miss. It is not objectively better there. The documentation, the community answers and the examples all lean that way, so you get unstuck faster. Platform documentation quality decides language choice more often than anyone admits, which is why a Rockwell Automation shop and a Siemens shop reach different defaults without either being wrong.

The question nobody asks is the one that matters: what happens to this program after you leave? A control system outlives the engineer who wrote it. If the next person needs a steeper learning curve to change one setpoint, you optimised for the wrong thing.

Four more questions in this one. A spinning yarn machine conversion running Siemens ET 200SP alongside Odot remote I/O came back commissioned, one hundred and sixty eight stations of it, which raises a real point about wire tray sizing and heat in a dusty environment. A drive photographed with water under its bus bars leads into what sanitation does to enclosures in food and beverage. And a customer who demanded 0.75 millimetres squared on every input got a bulky panel, plus a fair question about whether that argument was worth having.

Then the one that deserves a straight answer. A controls engineer laid off after four years, told the plant's control team cost too much, asks how to avoid being first on the list. Controls is badly understood by the people who approve budgets, and engineers here are poor at communicating the value they create. The average controls engineer earns $119,682, up 4.3 percent year over year, while 38 percent of manufacturers name the skilled worker shortage as a top business threat. Both are true at once, so the problem is visibility, not demand.

The episode closes on hiring. A small integrator cannot find juniors who can explain what DHCP does. The degree has never been the signal. Extracurriculars are, and so is showing up on time.

Timestamps
0:00 Intro
1:00 Siemens ET 200SP and Odot remote I/O: a yarn machine conversion update
3:30 Panel review: I/O density, wire tray sizing, and heat
6:00 Why run two flavors of I/O in one panel
7:10 Water inside a VFD: what washdown really does to enclosures
11:10 Structured text vs ladder logic: where ladder actually came from
13:40 Why "the right tool for the job" is the wrong framing
16:00 Platform documentation decides the language more than preference does
17:10 A customer demanded 18 AWG on every input: is the customer always right
21:20 Laid off after four years, and how not to be first on the list
28:40 A strange mix of skills, and which layers command a premium
31:40 Hiring junior engineers: what a degree does not tell you
33:40 The DHCP interview question, and better questions to ask instead
40:00 Lateness, moonlighting, and the habits that end a junior career
48:20 Wrap up

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com

Three weeks into a new PLC programming job with zero PLC experience, no training and nobody nearby to ask. That question drives this episode, along with four more from the plant floor.

Subscribe for weekly industrial automation and manufacturing discussions.

Learn more at Joltek:
- Unmanaged Switches and Cybersecurity: https://www.joltek.com/blog/industrial-unmanaged-switches-cybersecurity
- PLC Lifecycle and Migration: https://www.joltek.com/blog/rockwell-plc-lifecycle-migration-guide
- Industrial Ethernet Reliability: https://www.joltek.com/blog/industrial-ethernet-reliability

The career question is the one worth sitting with. A computer science graduate takes a PLC programmer role, is promised training, gets one day of introduction, then is left alone while the rest of the team sits in another country. Three weeks in, they are asking whether an associate degree in industrial maintenance would have been smarter. My answer is no, and it is not close. Nobody hired that person believing they had ten years of ladder logic behind them. What is missing is not a degree, it is a request. Find the program, price it, say how long it takes and what it lets you do that you cannot do today, and hand your manager a decision that is easy to approve. I went through this at Procter and Gamble. By the time the company sent me to official Rockwell Automation training I knew more than the course covered, because I had been learning RSLogix 500 and Studio 5000 on live projects. The average controls engineer now earns $119,682, up 4.3 percent year over year, and 38 percent of manufacturers name the skilled worker shortage as a top business threat. Leverage sits with the person willing to learn on the job.

The episode opens with a first control panel built by someone four years into filling and capping machines. The layout is good: breakers top left, a 24 volt supply feeding the switch and the controller, wire duct run so the wiring lands clean. Two things stand out. The controller is a Siemens SIMATIC S7-200 Smart, which is obsolete, so the toolchain question is real before a single rung gets written. A current S7-1200 G2 in TIA Portal is a better place to spend learning hours. The five port switch also looks unmanaged, fine on a bench and a problem once that habit reaches a production network.

On why there are so few good PLC tutorials on YouTube, coverage is genuinely thin outside Rockwell Automation and Siemens, and it is not gatekeeping. It is cost. A used PLC or HMI runs a few hundred dollars. A bench that can demonstrate coordinated servo work on Kinetix, Sercos or Siemens drives runs into tens of thousands of dollars and past $100,000. The industry also moves slowly, so a ten year old RSLogix tutorial is still accurate.

The technical highlight is a CANopen motion problem on a Schneider Electric Lexium LXM32 drive. The JOG_LXM32 block will not accept a velocity change while running. MC_MoveVelocity latches velocity only on the rising edge of execute. MC_JOG does accept a live change, but on restart the drive intermittently receives the velocity from the previous move, and synchronous PDO transmission did not fix it. The shipped workaround keeps rewriting the velocity variable with slightly different values so every scan forces a fresh write. Ugly, effective, and the customer accepted it. On the Rockwell side I have solved the same problem by leaving commanded velocity alone and dynamically changing the gear ratio to a virtual axis.

Last is a PanelView 7 Plus that tests clean in FactoryTalk View Studio ME, then loses tags and throws communication errors once downloaded. The poster reports a controller firmware update fixed it. I doubt that is the mechanism. A PanelView 7 Plus talks to controllers as old as a PLC-5. Flashing the controller almost certainly invalidated the shortcut in RSLinx Enterprise, and rebuilding that path is what restored communication. When an HMI works on the desk and fails on the panel, start at the path, not the code.

Timestamps
0:00 Intro
0:20 First control panel build: any advice?
1:45 The S7-200 Smart is obsolete
4:25 Lost three weeks into a new PLC programming job
8:15 Why going back to school is the wrong move
8:50 How to ask your manager for training and get a yes
10:20 Is there a lack of PLC tutorials on YouTube?
14:45 The worst motion control workaround I have seen
15:45 MC_JOG, JOG_LXM32 and the velocity that will not change
18:50 Dynamic gearing as the Rockwell alternative
20:45 PanelView 7 Plus download and communication errors
23:20 Why the RSLinx Enterprise path is the real suspect
25:00 Wrap up

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com

AI in industrial automation is producing real productivity gains and real risk at the same time. This is an honest account of where it helps and where it will confidently hand your team a wrong answer.

Subscribe for industrial automation and manufacturing perspective from active project work.

Learn more at Joltek:
- Edge Computing, AI and Manufacturing Data: https://www.joltek.com/blog/edge-computing-ai-value-manufacturing-data
- Root Causes of Downtime in Industrial Automation: https://www.joltek.com/blog/root-causes-downtime-industrial-automation
- Workforce Development and Education: https://www.joltek.com/services/service-details-workforce-development-education
- Operations and Performance Improvement: https://www.joltek.com/services/service-details-operations-performance-improvement

Start with the economics, because it is the first question a manager asks. A basic subscription runs $20 per month and runs out of capacity within a few hours a day under heavy use. The higher tier is $200 per month. Against a loaded engineering rate that is not a meaningful line item. The real cost is the learning curve, paid up front by the people least able to spare the time. Anyone expecting a gain in week one will stop before getting one.

Where the gains are genuine. Problem definition comes first and is underrated. A systems architect is usually handed a vague requirement already attached to a proposed solution. Putting that in front of a model and asking where the approach fails produces counterpoints worth raising before anybody commits. Second, carrying context across platforms. Experience spread over Rockwell Automation, Siemens, Omron, Mitsubishi Electric, Phoenix Contact PLCnext and Opto 22 cannot be held in working memory, and returning to one after months away is where scaffolding a known function saves hours.

Third, and this is the strongest case, reading code somebody else wrote. A conveyor that will not start, logic written by a firm nobody can reach, is a normal Tuesday. Screenshotting routines into a model and describing the symptom narrows the search dramatically. Equipment arriving with German or Italian rung comments used to cost a day and now costs an hour.

Now the failures, because these determine what you permit. Ask for a whole application in one prompt and you get something unusable. The palletizer example makes the point: infeed handling, staging and orientation, end of arm tooling, and recipe management are separate problems, and the architect decomposes them before prompting. The tool does not do that for you, and it is precisely the skill your senior people have and your junior people do not.

Part number families are where confident wrong answers live. Give it a PowerFlex fault code without naming the exact drive family and it answers for a different one, with no hedging. Firmware revisions compound it, as do instruction sets deprecated years ago that it will still recommend. Structured text is handled noticeably better than ladder logic, which follows from how little advanced ladder material exists publicly.

The organizational conclusion. These tools accelerate a competent engineer and do not replace judgment. On live equipment the person at the keyboard is the last line of defence, because a wrong rung is not a bad draft, it is a hazard to equipment and to people. With 94 percent of executives acknowledging the manufacturing skills gap, and 59 percent of frontline skilled workers over 55 planning to retire within five years according to a 2024 Schneider Electric survey, the pressure to make less experienced engineers productive faster is not going away. These tools help with that, and they also make it easier for someone without the experience to produce confident nonsense. Your review standards have to account for both.

Timestamps
0:00 What this video is and is not
1:10 Which model, and why software engineers converge on one
2:10 Two workflows: a desktop context store and the phone in the field
4:20 What the subscription actually costs
5:20 Where it helps first: defining a vague problem
9:00 The palletizer example: decompose before you prompt
11:50 A real request: an hourly productivity screen
12:50 Carrying context across Rockwell, Siemens, Omron and Opto 22
15:10 Where it breaks: less common platforms and firmware revisions
17:15 Why structured text works better than ladder logic
18:40 Troubleshooting: turning a vague complaint into a direction
22:40 The PowerFlex problem: fault codes differ across drive families
24:40 Reading code you have never seen, in a language you do not speak
27:00 Why you are still the last line of defence
28:30 The learning curve nobody wants to pay

Connect:
LinkedIn: https://www.linkedin.com/in/vladromanov
Joltek: https://www.joltek.com
SolisPLC: https://www.solisplc.com