B&R CP1584 Master Troubleshooting Index
A scenario-based index mapping common B&R CP1584 diagnostic problems to the research documents that solve them. For an engineer who has inherited an undocumented B&R machine and needs to diagnose a specific problem, start here.
How to Use This Index
- Identify your symptom from the categories below
- Follow the linked document(s) for step-by-step diagnostic procedures
- Cross-reference the “See Also” links for related diagnostic paths
Scenario 1: Machine Won’t Boot / PLC Won’t Start
| Symptom | Primary Document | Secondary |
|---|---|---|
| PLC shows no LEDs after power-on | cp1584-hardware-ref.md — power supply and hardware checks | grounding-emc.md |
| STATUS LED flashing red/yellow pattern | cp1584-hardware-ref.md — LED decode table | diagnostics-sdm.md |
| PLC stuck in BOOT mode | bootloader-recovery.md — full recovery procedures | access-recovery.md |
| PLC enters SERVICE mode after startup | bootloader-recovery.md — SERVICE mode causes | ar-rtos.md — crash/exception handling |
| CF card not detected / CF LED error | cf-card-boot.md — CF card contents and diagnostics | firmware.md |
| Battery dead, PLC loses settings | retentive-data.md — battery replacement procedure | cp1584-hardware-ref.md |
| firmware corrupted / unknown version | firmware-version-mgmt.md — version identification and update | bootloader-recovery.md |
| CP1584 completely unresponsive (brick) | bootloader-recovery.md — unbrick procedures | cp1584-hardware-ref.md |
| Error 25314 (page fault) on startup | ar-rtos.md — exception handling and backtrace | program-reverse-engineering.md |
Scenario 2: Can’t Connect to the PLC from Automation Studio
| Symptom | Primary Document | Secondary |
|---|---|---|
| Don’t know the PLC’s IP address | access-recovery.md — network discovery via BOOT mode | cp1584-forensics.md |
| AS password required / unknown | access-recovery.md — all credential recovery methods | bootloader-recovery.md |
| PLC not found in Auto Search | network-architecture.md — network discovery | access-recovery.md |
| “PLC module stuck in BOOT mode: Service” | bootloader-recovery.md — BOOT:Service recovery | access-recovery.md |
| Connection drops intermittently | network-architecture.md — network diagnostics | grounding-emc.md |
| ANSL port (11169) not responding | pvi-api.md — PVI line configuration | network-architecture.md |
| Migrating from AS4 to AS6, PVI broken | remanufacturing.md — AS4→AS6 migration tools | pvi-api.md |
Scenario 3: Program Running But Machine Behaving Wrong
| Symptom | Primary Document | Secondary |
|---|---|---|
| Outputs not turning on/off correctly | io-card-hardware.md — IO module diagnostics | memory-map.md — verify addressing |
| Analog readings wrong / drifting | analog-calibration.md — calibration procedures | io-card-hardware.md |
| Cycle time violations / watchdog errors | execution-model.md — task scheduling analysis | ar-rtos.md — scheduler internals |
| Intermittent sensor glitches | io-sniffing.md — fieldbus traffic capture | grounding-emc.md |
| POWERLINK communication errors | powerlink-internals.md — EPL diagnostics | io-sniffing.md |
| X2X bus errors / IO module diagnostics | x2x-protocol.md — X2X protocol analysis | io-card-hardware.md |
| CAN bus communication failures | if2772-canopen.md — CANopen diagnostics | io-sniffing.md |
| Servo drive / motor problems | acopos-drives.md — drive diagnostics | encoder-diagnostics.md |
| Encoder faults on motion axis | encoder-diagnostics.md — full encoder diagnostics | acopos-drives.md |
Scenario 4: Need to Understand What the PLC Program Does (No Project Files)
| Goal | Primary Document | Secondary |
|---|---|---|
| Extract variables from running PLC | pvi-api.md — PVI variable enumeration | opcua.md — OPC-UA browsing |
| Browse all IO mapping | cp1584-forensics.md — forensic analysis | memory-map.md |
| Read the CF card contents | cf-card-boot.md — CF card file layout | ftp-web-interface.md |
| Reverse-engineer compiled code | program-reverse-engineering.md — binary analysis | memory-map.md |
| Reconstruct a functional AS project | project-reconstruction.md — full methodology | cp1584-forensics.md |
| Understand task structure | execution-model.md — task classes and scheduling | ar-rtos.md |
| Read alarm/event history | alarm-logging.md — alarm log analysis | diagnostics-sdm.md |
Scenario 5: Need to Make Changes Without Stopping the Machine
| Goal | Primary Document | Secondary |
|---|---|---|
| Change a setpoint or parameter | online-changes.md — runtime modification | pvi-api.md |
| Force an output on/off | online-changes.md — force/override techniques | memory-map.md |
| Modify running program logic | online-changes.md — online download | execution-model.md |
| Save changes persistently | online-changes.md — save to CF card | cf-card-boot.md |
| Change via OPC-UA from external system | opcua.md — variable write via OPC-UA | python-diagnostics.md |
| Change via PVI from Python | pvi-api.md — PVI Python access | python-diagnostics.md |
| Rollback a bad online change | online-changes.md — rollback procedures | cf-card-boot.md |
Scenario 6: Adding Monitoring / Remote Visibility
| Goal | Primary Document | Secondary |
|---|---|---|
| Add SNMP monitoring | iiot-retrofit.md — SNMP setup | ebpf-telemetry.md |
| Add OPC-UA data export | opcua.md — server configuration | iiot-retrofit.md |
| Add MQTT data pipeline | iiot-retrofit.md — full MQTT setup | custom-diagnostic-tools.md |
| Build Grafana dashboard | iiot-retrofit.md — dashboard stack | python-diagnostics.md |
| Trend variables over time | system-variables.md — system variable monitoring | python-diagnostics.md |
| Send email/SMS alerts | alarm-logging.md — alarm notification | iiot-retrofit.md |
Scenario 7: Safety System Problems
| Symptom | Primary Document | Secondary |
|---|---|---|
| Safe IO module fault | safe-io-diagnostics.md — safe IO diagnostics | io-card-hardware.md |
| SafeLOGIC program fault | safe-io-diagnostics.md — safe program analysis | execution-model.md |
| SIL rating verification | safe-io-diagnostics.md — SIL assessment | access-recovery.md |
| Safety parameter backup | safe-io-diagnostics.md — parameter backup | retentive-data.md |
| E-stop circuit issues | io-card-hardware.md — digital input diagnostics | grounding-emc.md |
Scenario 8: Physical Layer / Signal Quality Problems
| Symptom | Primary Document | Secondary |
|---|---|---|
| Intermittent errors from EMI | grounding-emc.md — EMC troubleshooting | physical-layer-sniffing.md |
| Cable/connector problems | physical-layer-sniffing.md — wire-level diagnostics | io-card-hardware.md |
| Shield/ground problems | grounding-emc.md — grounding audit | physical-layer-sniffing.md |
| Oscilloscope signal analysis | physical-layer-sniffing.md — scope techniques | analog-calibration.md |
| Encoder signal quality | encoder-diagnostics.md — encoder signal analysis | physical-layer-sniffing.md |
| Analog signal noise | analog-calibration.md — analog signal conditioning | grounding-emc.md |
Scenario 9: Networking Problems
| Symptom | Primary Document | Secondary |
|---|---|---|
| Can’t reach PLC on network | network-architecture.md — network discovery | access-recovery.md |
| VLAN/firewall blocking PLC | network-architecture.md — network architecture | ar-rtos.md — security posture |
| POWERLINK timing violations | powerlink-internals.md — cycle timing analysis | execution-model.md |
| Modbus communication failures | modbus-gateway.md — Modbus diagnostics | serial-diagnostics.md |
| PLC-to-PLC communication issues | plc-to-plc.md — inter-PLC diagnostics | powerlink-internals.md |
| Time sync / timestamp problems | time-sync.md — NTP/SNTP configuration | diagnostics-sdm.md |
| Serial port (RS232/RS485) problems | serial-diagnostics.md — serial diagnostics | config-file-formats.md |
Scenario 10: Hardware Degradation / Aging System
| Symptom | Primary Document | Secondary |
|---|---|---|
| CPU running hot / thermal throttling | hardware-monitoring.md — temperature monitoring | cp1584-hardware-ref.md |
| Fan failure | hardware-monitoring.md — fan monitoring | cp1584-hardware-ref.md |
| Memory (RAM/CF) degradation | hardware-monitoring.md — memory health | cf-card-boot.md |
| Deciding: repair vs replace | remanufacturing.md — decision matrix | spare-parts.md |
| Direct drop-in CPU upgrade (CF-compatible) | remanufacturing.md — X20CP1585/CP1684 upgrade path | firmware-version-mgmt.md |
| Next-gen ARM migration (X20EM, multicore) | cp1584-hardware-ref.md — X20EM ARM platform | remanufacturing.md — AS 6.5 multicore |
| Spare parts identification | spare-parts.md — part number decoding | cp1584-hardware-ref.md |
| Migration to newer B&R hardware | remanufacturing.md — migration paths (includes AS 6.5 multicore + ST-OOP benefits) | project-reconstruction.md |
| Migration to non-B&R platform | remanufacturing.md — CODESYS/Siemens/Beckhoff | program-reverse-engineering.md |
| License issues | license-mgmt.md — license recovery | access-recovery.md |
Scenario 11: No OEM Support — Complete Documentation Reconstruction
| Goal | Primary Document | Secondary |
|---|---|---|
| Systematic documentation approach | documentation-reconstruction.md — methodology | cp1584-forensics.md |
| IO mapping from scratch | documentation-reconstruction.md — IO documentation | memory-map.md |
| Wiring diagram from inspection | documentation-reconstruction.md — wiring docs | physical-layer-sniffing.md |
| Program logic documentation | project-reconstruction.md — logic reconstruction | program-reverse-engineering.md |
| Maintenance manual creation | documentation-reconstruction.md — manual creation | spare-parts.md |
| Building a diagnostic workstation | diagnostic-workstation.md — workstation setup | documentation-reconstruction.md |
Scenario 12: Security Vulnerability Assessment
| Concern | Primary Document | Secondary |
|---|---|---|
| Check all known CVEs for CP1584 | ar-rtos.md §14 — complete CVE table with 50+ entries | firmware.md — AR version landscape |
| ANSL DoS (CVE-2025-11044, CVSS v4.0 8.9) | ar-rtos.md §14.9 — ANSL flooding vulnerability (race condition; shorter cycle times increase exploitability) | network-architecture.md |
| SDM data deletion (CVE-2025-3450, CVSS 7.5) | ar-rtos.md §14.22 — critical SDM vulnerability | diagnostics-sdm.md |
| SDM XSS/session takeover (SA25P003) | ar-rtos.md §14.15-14.17 — SDM web vulnerabilities | ftp-web-interface.md |
| FTP weak TLS (CVE-2024-5800) | ar-rtos.md §14.23 — weak DH groups in AR 4.x | ftp-web-interface.md |
| SSL/TLS broken crypto (CVE-2024-8603) | ar-rtos.md §14.21 — broken cryptographic algorithm | ftp-web-interface.md |
| AS certificate bypass (CVE-2025-11043) | ar-rtos.md §14.19 — AS TLS validation | access-recovery.md |
| PVI credential logging (CVE-2026-0936) | ar-rtos.md §14.18 — PVI logfile leak | pvi-api.md |
| Configure firewall rules for PLC | ar-rtos.md §14.25 — recommended firewall rules | network-architecture.md |
| CRA (Cyber Resilience Act) compliance | ar-rtos.md §14.24 — CP1584 marked CRA non-compliant | access-recovery.md |
| SA26P009/010 (XZ Utils, Linux kernel) | ar-rtos.md §14.25-14.26 — NOT affected (VxWorks-based) | remanufacturing.md |
| Network isolation strategy | network-architecture.md — VLAN design | ar-rtos.md — security posture summary |
| Full system hardening plan | cybersecurity-hardening.md — complete hardening guide | ar-rtos.md — CVE table |
| Firewall rules for CP1584 | cybersecurity-hardening.md §4 — complete firewall reference | ar-rtos.md §14.27 |
| Secure remote access setup | cybersecurity-hardening.md §7 — VPN + bastion architecture | network-architecture.md |
| Security incident response | cybersecurity-hardening.md §8 — detection and recovery | safe-io-diagnostics.md |
| OPC-UA security configuration | opcua.md — certificates, encryption, access control | access-recovery.md |
| PPT30 OPC-UA DoS (SA25P006, CVE-2025-11482) | opcua.md — concurrent connection handling limits | cybersecurity-hardening.md — firewall rules for OPC-UA |
| XZ Utils impact on B&R (SA26P009) — CP1584 NOT affected | ar-rtos.md §14.25 — confirms VxWorks-based PLCs unaffected | cybersecurity-hardening.md |
| Linux kernel vulns (SA26P010) — CP1584 NOT affected | ar-rtos.md §14.26 — confirms VxWorks-based PLCs unaffected | remanufacturing.md — Linux PCs need patching |
| AS cert validation bypass (SA25P004, Jan 2026) | cybersecurity-hardening.md §9.2 — update AS to 6.5 | firmware-version-mgmt.md — AS 6.5 details |
| ANSL flooding DoS (SA25P005, CVE-2025-11044) | cybersecurity-hardening.md §1.1 — patched in R4.93 | network-architecture.md — ANSL firewall rules |
| mapp auth bypass (SA22P014) | cybersecurity-hardening.md §9.2 — open on AR 4.x | opcua.md — restrict OPC-UA access |
| SDM multiple new CVEs (SA2025P003) | cybersecurity-hardening.md §3.3 — block SDM at firewall | diagnostics-sdm.md |
Scenario 13: Machine Just Powered On After Long Storage / Downtime
| Symptom | Primary Document | Secondary |
|---|---|---|
| Battery dead, retentive data lost | retentive-data.md — battery replacement and data recovery | cp1584-hardware-ref.md |
| CF card not detected or read errors | cf-card-boot.md — CF card diagnostics and replacement | bootloader-recovery.md |
| PLC boots to SERVICE mode after long idle | bootloader-recovery.md — SERVICE mode causes | ar-rtos.md — crash analysis |
| Network settings lost (battery died) | access-recovery.md — BOOT mode network config | network-architecture.md |
| IP address unknown, can’t connect | access-recovery.md — DIP switch default IP | cp1584-forensics.md |
| Motion axes don’t move (encoder lost) | encoder-diagnostics.md — encoder realignment | acopos-drives.md |
| Calibration drift on analog sensors | analog-calibration.md — recalibration procedures | io-card-hardware.md |
| OPC-UA certificates expired | opcua.md — certificate renewal | license-mgmt.md |
| Safety system fault after startup | safe-io-diagnostics.md — safety reset procedure | io-card-hardware.md |
| Need full backup before running machine | ftp-web-interface.md — CF card backup | cf-card-boot.md |
| Firmware version check before production | firmware-version-mgmt.md — version audit | ar-rtos.md §14 — CVE check |
External Tools Quick Reference
| Tool | Purpose | Used In |
|---|---|---|
| brwatch (github.com/hilch/brwatch) | Watch, change, log variables; set IP; reboot | pvi-api.md, access-recovery.md |
| brsnmp (github.com/hilch/brsnmp) | SNMP discovery, IP config, inventory | iiot-retrofit.md, access-recovery.md |
| systemdump.py (github.com/hilch/systemdump.py) | Create/load system dumps from CLI | ebpf-telemetry.md, diagnostics-sdm.md |
| Pvi.py (github.com/hilch/Pvi.py) | Python wrapper for B&R PVI | pvi-api.md, python-diagnostics.md |
| UaExpert (free from Unified Automation) | OPC-UA client for browsing PLC variables | opcua.md, project-reconstruction.md |
| Wireshark with POWERLINK dissector | Capture and analyze EPL traffic | powerlink-internals.md, io-sniffing.md |
| as6-migration-tools (github.com/br-automation-community) | AS4 to AS6 project migration scripts | remanufacturing.md, firmware-version-mgmt.md |
| paho.mqtt.c-ar (github.com/br-automation-community) | MQTT client library for B&R AR | iiot-retrofit.md, custom-diagnostic-tools.md |
| SystemDumpViewer | GUI viewer for SystemDump.xml files | diagnostics-sdm.md |
| systemdump.py (github.com/hilch/systemdump.py) | CLI: create, upload, delete, inventory system dumps without browser | diagnostics-sdm.md, cp1584-forensics.md |
| Automation Studio Profiler | Task timing and CPU profiling | execution-model.md, ar-rtos.md |
SDM (built-in web UI at /sdm) | Browser-based hardware diagnostics | diagnostics-sdm.md, system-variables.md |
| B&R VS Code Tools (github.com/br-automation-com/vscode-brautomationtools) | Edit, build, transfer AS projects from VS Code (AS 4.x compatible) | remanufacturing.md, custom-diagnostic-tools.md |
| Automation Studio Code (bundled with AS 6.3+) | Official B&R VS Code-based editor with AS Copilot AI (AS 6.x only) | remanufacturing.md, firmware-version-mgmt.md |
| AS Copilot (B&R, cloud service) | AI assistant for ST code generation within AS Code (free until end 2025) | remanufacturing.md |
| BR.AS.LibraryExporter.exe (bundled with AS 6.5+) | CLI tool for exporting libraries from AS projects (-P -n -o -c syntax) | remanufacturing.md |
| ST VS Code extension (Serhioromano.vscode-st) | IEC 61131-3 syntax highlighting in VS Code | remanufacturing.md |
| Loupe Package Manager (loupeteam.github.io) | CLI for managing Loupe packages in AS | remanufacturing.md |
| SafeDODiag (github.com/br-automation-community/SafeDODiag) | AS library: diagnoses why safe digital outputs are not enabled (mapp Safety, Safety Release, X20SO21x0/X20SO41x0) | safe-io-diagnostics.md |
| openSAFETYLogbrowser (github.com/banickn/openSAFETY-logbrowser) | Electron app: log browser for openSAFETY protocol | safe-io-diagnostics.md |
| acopos-cheat-sheet (github.com/hilch/bar-acopos-cheat-sheet) | Quick reference for ACOPOS servo drive parameters and commands | acopos-drives.md |
| TrakDiag (github.com/hilch/TrakDiag) | AS library: ACOPOStrak linear motor system diagnosis | acopos-drives.md |
| BrSecurity (hilch.github.io/BrSecurity) | AS library: Password, Encrypt, Decrypt functions | access-recovery.md, cybersecurity-hardening.md |
| OMJSON (github.com/loupeteam/OMJSON) | AS library: WebSocket + JSON communication from PLC | iiot-retrofit.md, custom-diagnostic-tools.md |
| OMSQL (github.com/loupeteam/OMSQL) | AS library: SQL database communication from PLC | iiot-retrofit.md |
| TCPComm / UDPComm (github.com/loupeteam) | AS libraries: Simplified wrappers for AsTCP/AsUDP | custom-diagnostic-tools.md |
| PLC-data-trace (github.com/hilch/PLC-data-trace) | AS project: Records PLC variables in high-priority task, saves to CSV | custom-diagnostic-tools.md, python-diagnostics.md |
| mappRemoteShell (github.com/br-automation-community/mappRemoteShell) | Sample project: Execute shell commands on remote PC via OPC-UA + Python | custom-diagnostic-tools.md |
| ListAllBurPLCs (github.com/Chihing/ListAllBurPLCs) | Lists all B&R PLCs on the network | network-architecture.md, access-recovery.md |
| demo-br-asyncua (github.com/hilch/demo-br-asyncua) | Python example: Access B&R PLC with asyncua (asyncio OPC-UA) | opcua.md, python-diagnostics.md |
| OpcUaSamples (github.com/br-automation-community/OpcUaSamples-sample-AS) | OPC-UA configuration and coding samples from AS4.1 to newest AS | opcua.md |
| easyuaclient-as-project (github.com/br-automation-community/easyuaclient-as-project-dev) | Easy OPC-UA client wrapper library for AS | opcua.md |
| canopen-message-interpreter (github.com/hilch/canopen-message-interpreter) | Python script: Interpret CAN traces as CANopen (CiA DS301) | if2772-canopen.md |
| Persist (github.com/loupeteam/Persist) | AS library: Store any variable type to permanent memory | retentive-data.md |
| CSVFileLib (github.com/loupeteam/CSVFileLib) | AS library: Read/write variable values to CSV files | custom-diagnostic-tools.md |
| mappPanel (github.com/br-automation-community/mappPanel) | Sample: PLC to T-Panel communication over OPC-UA | hmi-integration.md |
| B&R DevOps Package (github.com/br-automation-community/BnR-DevOps-Package) | DevOps practices for AS project development | documentation-reconstruction.md |
| BuildVersion (github.com/br-na-pm/BuildVersion) | Git commit + AS build info captured in variable declarations | documentation-reconstruction.md |
| FindUsbStickOnBAndRPlc (github.com/hilch/FindUsbStickOnBAndRPlc) | AS library: Find and use USB sticks on PLC for file I/O | custom-diagnostic-tools.md, cf-card-boot.md |
| mappCleanUp (github.com/br-automation-community/mappCleanUp) | AS sample: Delete old files from PLC directory by criteria | cf-card-boot.md |
| UserLog (github.com/tmatijevich/UserLog) | AS library: Synchronous user logbook writing | alarm-logging.md |
| LogThat (github.com/loupeteam/LogThat) | AS library: Easy diagnostic info into CPU Logger | diagnostics-sdm.md |
| MyDiag (github.com/hilch/MyDiag) | AS library: Wrapper around ArEventLog and AsArSdm for CPU logger | diagnostics-sdm.md |
The “I Just Inherited This Machine” Checklist
NEW: For a complete step-by-step first-hour playbook, see first-60-minutes.md.
For an engineer walking up to a B&R CP1584 machine with zero documentation:
- Physical: Read CPU label → cp1584-hardware-ref.md
- Network: Discover PLC on network → access-recovery.md, network-architecture.md
- Diagnostics: Open SDM in browser → diagnostics-sdm.md
- Variables: Browse via OPC-UA or PVI → opcua.md, pvi-api.md
- Config: Read CF card via FTP → ftp-web-interface.md, cf-card-boot.md
- Program: Understand running logic → project-reconstruction.md
- Safety: Assess safety system → safe-io-diagnostics.md
- Document: Build maintenance manual → documentation-reconstruction.md
- Secure: Review access controls AND check firmware version against CVE table → access-recovery.md, ar-rtos.md §14
- Monitor: Set up remote visibility → iiot-retrofit.md, python-diagnostics.md
Scenario 14: Migrating from Automation Studio 4 to AS 6
| Goal | Primary Document | Secondary |
|---|---|---|
| Analyze AS4 project for AS6 compatibility | remanufacturing.md §5 — migration analysis | firmware-version-mgmt.md |
| Run automated migration analysis | Use as6-migration-tools (github.com/br-automation-community/as6-migration-tools) — detects deprecated libs, unsupported hardware, breaking changes | remanufacturing.md §5.3 |
| Handle deprecated INA2000 in PVI code | pvi-api.md §2 — PVI 6.x drops INA2000, ANSL migration | python-diagnostics.md |
| Update OPC-UA client code for AR 6 | opcua.md — AR 6.x OPC-UA changes | remanufacturing.md |
| Hardware upgrade with AS6 support | remanufacturing.md — target CPU comparison table | cp1584-hardware-ref.md |
| CP1584 is obsolete (SN 2022/54, LTB Feb 2023) | remanufacturing.md — discontinuation notice and spare parts strategy | spare-parts.md |
| Migrate mappMotion code to mappMotion 6 | remanufacturing.md — mappMotion update helper | acopos-drives.md |
| Check mapp technology license requirements | license-mgmt.md — license checker tool | remanufacturing.md |
| AS 6.5 multicore + ST-OOP benefits | remanufacturing.md — AR 6.5 features | execution-model.md |
Document Cross-Reference Map
cp1584-hardware-ref.md ──── cp1584-forensics.md ──── cf-card-boot.md
│ │ │
├── firmware.md ────────├── config-file-formats.md ──┘
├── hardware-monitoring.md │ │
├── grounding-emc.md │ ├── bootloader-recovery.md
│ │ │
└── io-card-hardware.md ───┘ └── access-recovery.md
│
ar-rtos.md ──── execution-model.md ───── memory-map.md ────────┘
│ │
├── diagnostics-sdm.md ──── system-variables.md
│
└── ebpf-telemetry.md ────── custom-diagnostic-tools.md
│
network-architecture.md ──── powerlink-internals.md ── io-sniffing.md
│ │ │
├── plc-to-plc.md ──────────────────┘ │
│ │
├── if2772-canopen.md ────────────────────────────────┘
│
├── modbus-gateway.md
│
└── serial-diagnostics.md
pvi-api.md ──── python-diagnostics.md ─── opcua.md ── iiot-retrofit.md
│
├── ftp-web-interface.md
│
time-sync.md ──── alarm-logging.md ──────── safe-io-diagnostics.md
│
└── hmi-integration.md
cybersecurity-hardening.md ── ar-rtos.md ── network-architecture.md
│ │
├── access-recovery.md ├── firmware-version-mgmt.md
│ │
└── diagnostics-sdm.md ── ftp-web-interface.md
program-reverse-engineering.md ── project-reconstruction.md
│
acopos-drives.md ── encoder-diagnostics.md ──── analog-calibration.md
│
└── x2x-protocol.md
online-changes.md ── retentive-data.md ──── license-mgmt.md
│
└── firmware-version-mgmt.md
remanufacturing.md ── spare-parts.md ──── remanufacturing.md
│
└── cp1584-hardware-ref.md
access-recovery.md ── documentation-reconstruction.md ── diagnostic-workstation.md
Scenario 15: IO Module LED Patterns — Quick Decode
| LED Pattern | Meaning | Primary Document | Action |
|---|---|---|---|
| All modules: ‘r’ blinking continuously | X2X bus communication lost | x2x-protocol.md — X2X diagnostics | Check X2X cable, terminator, CPU RUN state |
| Single module: ‘e’ blinking, ‘r’ steady green | I/O power supply missing to that module | io-card-hardware.md — power supply diagnostics | Check PS module terminal 1-5, verify jumpers |
| Single module: ‘e’ double flash | X2X power overloaded or I/O power too low | io-card-hardware.md — LED decode | Check total station current, reduce load |
| ‘e’ steady red + green flash | Invalid firmware on module | firmware-version-mgmt.md | Update module firmware |
| PS module: ‘l’ red steady | X2X Link power supply overloaded | io-card-hardware.md — power budget | Reduce number of modules or add PS |
| PS module: ‘r’ single flash | Module in RESET mode | io-card-hardware.md | Check reset trigger, re-initialize |
| ACOPOS: Green steady | Drive running normally | acopos-drives.md — LED reference | None |
| ACOPOS: Green blink | Drive can’t enable | acopos-drives.md — enable diagnostics | Check X2.6 enable, 3-phase power |
| ACOPOS: Red steady | Active fault — note code | acopos-drives.md — fault code tables | Look up code, fix cause, reset |
| ACOPOS: Red/Green alternating | Bootloader mode | acopos-drives.md — firmware update | Do NOT power off during update |
| ACOPOS: All LEDs off | No 24V DC control power | acopos-drives.md — power diagnostics | Check 24V supply, fuse, wiring |
| CPU: R/E green steady | Application running | cp1584-hardware-ref.md — CPU LED tables | None |
| CPU: R/E red steady | BOOT or SERVICE mode | cp1584-hardware-ref.md — mode switch | Check mode switch, logbook |
| CPU: R/E red blink + RDY/F yellow blink | License violation | license-mgmt.md — license check | Check TG dongle/container |
| CPU: S/E off/off (POWERLINK) | Interface not active or misconfigured | cp1584-hardware-ref.md — PLK states | Check AS config, cable |
| CPU: S/E off, red blinking | System stop with error code | cp1584-hardware-ref.md — stop error codes | Count blink pattern (RAM or HW error) |
| CPU: DC red | Backup battery empty | retentive-data.md — battery replacement | Replace Renata CR2477N within 1 min |
Key Findings
-
This index is the fastest way to find the right document for any CP1584 problem. Organized by symptom and diagnostic scenario, it maps common problems to the specific research documents that contain the solution procedures.
-
Start with the LED and error code tables. For any hardware fault, the LED pattern on the CPU, IO modules, or ACOPOS drives points directly to the relevant diagnostic document and the likely root cause.
-
Most intermittent problems require protocol-level diagnostics. If a problem can’t be reproduced consistently, check the “Intermittent Problems” scenarios for protocol sniffing approaches that capture evidence without disturbing the running system.
-
Security scenarios are critical for network-connected CP1584 systems. With 20+ unpatchable CVEs on AR 4.x, any CP1584 on a network should be hardened according to cybersecurity-hardening.md.
-
The first-60-minutes.md playbook covers emergency response. For a machine that just went down with no documentation, start with first-60-minutes.md for the immediate recovery workflow, then use this index for deeper investigation.
Scenario 16: Engineering Workstation Security — AS and PVI Vulnerabilities
| Concern | Primary Document | Secondary |
|---|---|---|
| AS certificate bypass (CVE-2025-11043, SA25P004) | cybersecurity-hardening.md §9.4 — AS accepts invalid certs, MitM risk | access-recovery.md |
| AS SQLite critical vulns (25 CVEs, CVSS 9.8, SA25P007) | cybersecurity-hardening.md §9.4 — code execution via crafted project files | firmware-version-mgmt.md §11.2 |
| PVI credential logging (CVE-2026-0936, SA26P001) | pvi-api.md §16 — credentials in plaintext log files | cybersecurity-hardening.md §9.4 |
| Isolating the engineering workstation | cybersecurity-hardening.md §7 — VPN + bastion architecture | network-architecture.md |
| PVI log files as credential source for recovery | pvi-api.md §16.5 — search workstations for PVI logs | access-recovery.md |
Scenario 17: HMI Panel and OPC-UA Server Security
| Concern | Primary Document | Secondary |
|---|---|---|
| PPT30 OPC-UA DoS (CVE-2025-11482, CVSS v4.0 8.7, SA25P006) | opcua.md §13 — permanent OPC-UA crash via resource exhaustion | cybersecurity-hardening.md §9.2 |
| OPC-UA anonymous access left enabled | opcua.md §13 — hardening checklist | access-recovery.md |
| OPC-UA self-signed cert expired | opcua.md §6 — certificate regeneration | cybersecurity-hardening.md §5 |
| HMI panel OS version unknown | hmi-integration.md — panel identification | spare-parts.md |
| SDM web interface XSS (CVE-2025-3448, CVE-2025-11498) | diagnostics-sdm.md §15 — SDM security | cybersecurity-hardening.md §9.2 |
Last updated: July 2026 (added Scenario 17: HMI/OPC-UA security; added SA25P006 CVE-2025-11482 and SA2025P003 CVE details to cybersecurity-hardening.md and opcua.md; added CISA republication dates for ICSA-26-125-03 and ICSA-26-141-04)