First 60 Minutes: Recovery Playbook for an Undocumented B&R CP1584

Scenario: You just walked up to a machine with a B&R X20CP1584 PLC. The OEM is gone. There are no project files, no documentation, and the previous engineer left no notes. The machine is down (or behaving erratically). This is your step-by-step guide for the first hour.

Audience: An automation engineer who has never worked with B&R before but needs to get this machine running — or at least diagnosed — fast.

Phase 1: Visual Assessment (0-5 minutes)

1.1 Read the CPU Label

Locate the physical label on the X20CP1584. You need:

See cp1584-hardware-ref.md for full hardware specifications.

1.2 Read the LED States

The CPU has 5 status LEDs on the front panel. Document what you see before touching anything:

Quick LED decode for common states:

See troubleshooting-index.md Scenario 15 for the complete LED decode table.

1.3 Read the Mode Switch

The operating mode switch has 3 positions:

If the switch is in BOOT, the PLC will NOT run the application. Switch to RUN and power-cycle. If it was intentionally left in BOOT (e.g., by a service technician), someone may have been working on it.

Phase 2: Get Connected (5-20 minutes)

2.1 Find the PLC’s IP Address

Try these methods in order of speed:

Method A: Default IP from DIP switches

The two hex rotary switches on the front panel set the INA2000 station number. The default IP for CP1584 is derived from this:

• INA station 1 → 192.168.1.1
• INA station 2 → 192.168.1.2
• etc.

Set your PC to the same subnet (e.g., 192.168.1.x) and try pinging.

Method B: BOOT mode default IP

If the mode switch is in BOOT position, the default IP is:

• 192.168.1.250 (common BOOT mode default)

Method C: Network scan with brsnmp

python -m brsnmp scan 192.168.1.0/24

Install from github.com/hilch/brsnmp. This uses SNMP to discover B&R devices.

Method D: Serial console

Connect to IF1 (RS232) with a null-modem cable:

• Baud: 57600 (factory default)
• Parity: Even
• Data bits: 8
• Stop bits: 1
• Flow control: None

The serial console shows boot messages including the IP address.

Pinout on X20TB12 terminal block:

• TX (PLC transmit) → PC RX
• RX (PLC receive) → PC TX
• GND → PC GND

See access-recovery.md for complete network discovery procedures.

2.2 Open SDM (System Diagnostics Manager)

Once you have the IP, open a browser and navigate to:

http://<PLC_IP>/sdm

SDM requires no authentication on AR 4.x. It provides:

• Hardware tree — all connected modules, their status, firmware versions, serial numbers
• CPU information — AR version, CPU temperature, memory usage, battery status
• Logger — recent error messages and events
• Diagnostic buffer — last errors with timestamps

Screenshot every SDM page immediately. This is your baseline.

Security warning: SDM on AR 4.x has unpatchable vulnerabilities (CVE-2025-3450, CVE-2025-3449). Do not leave SDM accessible on the network long-term. See cybersecurity-hardening.md.

2.3 Establish Automation Studio Connection (If Available)

If you have Automation Studio installed:

1. Open AS → Online → Settings
2. Enter the PLC’s IP address
3. Browse for target — the PLC should appear
4. Right-click → Connect
5. Do NOT download anything yet — you might overwrite the running program

If you do NOT have Automation Studio, use these alternatives:

• brwatch (github.com/hilch/brwatch) — GUI tool for watching/changing variables (Windows, requires PVI)
• Pvi.py (github.com/hilch/Pvi.py) — Python wrapper for PVI API
• UaExpert (free from Unified Automation) — OPC-UA client for browsing variables

2.4 Quick-Start: Browse Variables via OPC-UA (No AS Required)

If the PLC has OPC-UA enabled (common on AR >= 4.50), you can browse the entire variable namespace without Automation Studio:

1. Download and install UaExpert from unified-automation.com (free)
2. Add a server: opc.tcp://<PLC_IP>:4840
3. If the PLC uses a self-signed certificate (AR 4.x default), UaExpert will warn — click “Continue” to connect
4. In the Address Space panel, expand the nodes:
   • Objects → Server → browse for system variables
   • Look for a node named after the project or application (e.g., MyMachine) — this contains all global variables
5. You can now read any variable by double-clicking it, and write values by selecting a variable and using the Data Access View

What this gives you: The complete variable list (names + data types), current values, and the namespace structure. This is critical intelligence for project-reconstruction.md.

See opcua.md for full OPC-UA details and cybersecurity-hardening.md for certificate management.

2.5 Quick-Start: Connect via PVI.py (No AS Required)

PVI (Process Visualization Interface) is B&R’s native protocol for variable access. Using the Python wrapper:

pip install Pvi

from pvi import *

with PviConnection() as plc:
    plc.login("192.168.1.10")
    
    # List all variables
    vars = plc.list_variables()
    for v in vars:
        print(f"{v.name}: {v.type} = {v.value}")
    
    # Read a specific variable
    speed_setpoint = plc.read_variable("gMainApp.nSpeedSetpoint")
    print(f"Speed setpoint: {speed_setpoint}")
    
    # Write a variable (to change a setpoint or force an output)
    plc.write_variable("gMainApp.nSpeedSetpoint", 1500)

Prerequisites: PVI.py requires the B&R PVI Development Setup (or at minimum the PVI DLLs) on the connecting PC. See pvi-api.md for installation and advanced usage.

2.6 Quick-Start: brsnmp Network Discovery

If you don’t know the PLC’s IP address, scan the subnet:

pip install brsnmp
brsnmp scan 192.168.1.0/24

This uses SNMP (port 161) to discover all B&R devices. Returns target type, serial number, AR version, and IP address. Works on any machine on the network without Automation Studio.

Phase 3: Diagnose the Problem (20-45 minutes)

3.1 Check the Logger

In SDM or Automation Studio, open the Logger (check ALL boxes). Look for:

Critical errors that stop the program:

Warning-level errors (program may still run):

Tip: In SDM, check the Diagnostic Buffer tab in addition to the Logger. The Diagnostic Buffer shows the last N errors with timestamps, task context, and the full error description — more readable than the raw Logger output.

See diagnostics-sdm.md for detailed SDM usage and ar-rtos.md for AR error internals.

3.2 Check the CF Card via FTP

ftp <PLC_IP>
Username: (try empty, "br", "admin")
Password: (try empty, "br", "admin")

Key directories on the CF card:

• C:\ — System partition (AR OS files, do not modify)
• F:\ — User partition (your program, configuration, logs)
• F:\AS\ — Automation Studio project files
• F:\AS\System\ — System configuration
• F:\Log\ — Log files (AR log, alarm history)
• C:\System\Log\ — Boot logs

Backup the entire CF card via FTP before changing anything:

wget -r ftp://<PLC_IP>/ --mirror

See cf-card-boot.md for complete CF card file layout and ftp-web-interface.md for FTP access details.

3.3 Common Failure Patterns

Phase 4: Get It Running (45-60 minutes)

4.1 If PLC Is in SERVICE Mode

1. Read the error from the Logger
2. If the error is transient (e.g., watchdog timeout from a one-time condition):
   • In AS: Online → Cold Start
   • Or via brwatch: CPU → Coldstart
3. If the error is persistent (e.g., hardware mismatch, missing module):
   • Check the Hardware tree in SDM for missing/faulty modules
   • If a module was replaced, its firmware may need updating (see firmware-version-mgmt.md)
4. If the error is a program error (e.g., divide by zero):
   • Use brwatch or PVI to find the offending variable
   • Change the variable via brwatch’s watch window or Pvi.py
   • Warm restart

4.2 If PLC Is Stuck in BOOT Mode

1. Verify the mode switch is in RUN
2. Check CF card is inserted and detected (CF LED should be green)
3. If CF card is not detected:
   • Remove and reinsert the CF card
   • Try a known-good CF card with a basic AS project
   • See bootloader-recovery.md for full recovery
4. If CF card is detected but still in BOOT:
   • The program on the card may be invalid
   • Connect via AS in BOOT mode and download a new project
   • See cf-card-boot.md for CF card file requirements

4.3 If No CF Card Exists

You need to create a minimal CF card to get the PLC to RUN mode:

1. Obtain a compatible CompactFlash card (B&R extended temperature recommended, see spare-parts.md)
2. In Automation Studio:
   • Create a new project with the X20CP1584 hardware
   • Configure the IP address
   • Create a minimal program (even just a single empty task)
   • Build the project
   • Use Tools → Runtime Utility Center to create the CF card (Offline Installation)
3. Insert the CF card and switch to RUN
4. The PLC should boot into RUN mode with your minimal program
5. See project-reconstruction.md for rebuilding the full application

4.4 If the CPU Is Physically Dead

Symptoms: No LEDs, no response to serial, no network discovery.

1. Verify 24V power supply to the CPU (check terminal block: +24V on pins 5-6, GND on pins 1, 4)
2. Check the integrated fuse (non-replaceable — if blown, the CPU module must be replaced)
3. If power is good and still no LEDs, the CPU is likely dead
4. Do not attempt to repair the CPU module — it is not field-repairable
5. Source a replacement (see spare-parts.md for part numbers and compatible replacements)
6. The CF card from the dead CPU will work in a replacement CPU (same model), preserving the program
7. See remanufacturing.md for upgrade options

Emergency Quick Reference Card

Print this and tape it inside the cabinet door:

B&R X20CP1584 EMERGENCY REFERENCE
====================================
MODE SWITCH:  BOOT / RUN / DIAG
DEFAULT IP:   192.168.1.<INA station#>
BOOT IP:      192.168.1.250
SERIAL:       57600, 8, E, 1
SDM URL:      http://<IP>/sdm
FTP:          ftp://<IP>  (user: br, pass: br)
BATTERY:      CR2477N, 3V/950mAh (Renata only!)
REPLACE IN:   1 minute (power off) or hot-swap
CPU TEMP:     Shutdown at 110C / board 95C
LED R/E RED:  BOOT/SERVICE mode
LED DC RED:   Battery dead
LED CF:       Green=OK, Yellow=accessing
LED S/E:      PLK state (blink pattern)
====================================
DO NOT:
- Remove CF card while running
- Use non-Renata battery (fire risk!)
- Connect to internet without VPN/firewall
- Leave SDM/FTP open on production network
====================================
TOOLS:
brwatch      - github.com/hilch/brwatch (watch/force vars)
brsnmp       - github.com/hilch/brsnmp (network discovery)
Pvi.py       - github.com/hilch/Pvi.py (Python PVI)
systemdump.py- github.com/hilch/systemdump.py (system dumps)
UaExpert     - OPC-UA client (free from Unified Automation)
Wireshark    - Network capture (install POWERLINK dissector)
====================================

Key Findings

1. The first 5 minutes are LED and label reading. Do not touch anything until you have documented the current state. The LEDs tell you 80% of what you need to know.
2. SDM is your best friend when you have no project files. It requires no authentication (AR 4.x) and gives you hardware tree, CPU info, temperature, memory, battery status, and error logs.
3. FTP gives you access to the CF card contents without removing the card. Back up everything via FTP before making any changes.
4. The mode switch matters. If it is in BOOT, the PLC will never run the application. Switch to RUN.
5. Battery death causes retentive data loss. If the DC LED is red, replace the CR2477N battery within 1 minute (power off) or hot-swap it.
6. The CP1584 overtemperature threshold is 110°C (CPU) / 95°C (board) per the official B&R datasheet. The CPU enters reset state at these temperatures.
7. brwatch is a GUI-only Windows tool. It cannot be pip-installed and has no CLI/JSON output mode. It requires PVI Development Setup to be installed.
8. If the CPU is physically dead (no LEDs, no serial response), the module must be replaced. It is not field-repairable. The CF card is transferable to a replacement CPU of the same model.
9. OPC-UA browsing (UaExpert) and PVI (Pvi.py) can replace most Automation Studio functions for diagnostic purposes — variable reading/writing, namespace browsing, and monitoring.
10. The Logger error 25314 (page fault) is the most common cause of SERVICE mode. It indicates the program tried to access invalid memory. A cold restart often clears it if the cause was transient (e.g., after an online change). If it recurs immediately, there is a deeper program logic issue.

Phase 5: What to Document Before You Leave

Even if the machine is running again, spend 10 minutes documenting what you found. Future-you (or the next engineer) will thank you.

5.1 Minimum Documentation Checklist

5.2 Critical Backups to Take

1. Full CF card image via FTP:

   wget -r ftp://<PLC_IP>/ --mirror -o backup.log
   

2. System dump (if AS is available): AS → Online → Create System Dump → saves .sys file
3. SDM screenshots of every page
4. Serial console boot log: Connect serial console, power-cycle the PLC, capture all boot output

See documentation-reconstruction.md for the full documentation methodology and cf-card-boot.md for CF card imaging best practices.

Cross-References

• cp1584-hardware-ref.md — Complete hardware specifications, LED decode tables, pinouts
• troubleshooting-index.md — Scenario-based troubleshooting index
• access-recovery.md — Network discovery, credential recovery
• bootloader-recovery.md — Full recovery from corrupted/missing CF card
• cf-card-boot.md — CF card file layout and boot sequence
• diagnostics-sdm.md — SDM detailed usage and diagnostic buffer interpretation
• retentive-data.md — Battery replacement and data recovery
• firmware-version-mgmt.md — Firmware identification and updates
• ftp-web-interface.md — FTP and web server access
• cybersecurity-hardening.md — Security hardening for production
• spare-parts.md — Part number identification and sourcing
• remanufacturing.md — CPU replacement and migration options
• documentation-reconstruction.md — Systematic documentation methodology
• opcua.md — OPC-UA server configuration and certificate management
• pvi-api.md — PVI API for programmatic variable access
• ar-rtos.md — AR OS internals and error code interpretation
• execution-model.md — Task classes, cycle times, and watchdog behavior
• io-card-hardware.md — IO module LED codes and signal troubleshooting
• io-sniffing.md — Fieldbus traffic analysis for sensor diagnostics
• project-reconstruction.md — Rebuilding an AS project from an undocumented system