Troubleshooting CM5 HMI Pushbutton Control Failures

Brian Holt6 min read
AutomationDirectHMI ProgrammingTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Reliable pushbutton control returns when the CM5 writes the intended CLICK bit, the button uses a communication-safe action, and every remaining HMI request points to a valid PLC address. Treat the dead rung and PLC-499 hexadecimal code 2 as one control-path problem until tag mapping and communications pass verification.

Reject the quick fixes that hide the fault

Quick fix Why it fails Use instead
Press the second HMI button Its write may refresh communications, change another bit, or mask an incorrect tag assignment. It does not explain why the first command failed. Watch the first button's assigned PLC bit while pressing only that button.
Revert CLICK 3.92 or C-more 8.26 A rollback leaves a wrong tag, invalid address, or unsuitable pushbutton action unchanged. Prove the write path before changing software versions.
Uncheck Ethernet settings Disabling one interface does not remove every HMI tag, device, screen object, or background request that references it. Audit the complete HMI device and tag databases.
Factory-reset the equipment A reset can erase configuration without correcting the project that recreates the fault. Save both projects, document the active ports, and isolate the bad request first.
Force the output A force tests the output path, not whether the CM5 writes the command bit correctly. Separate HMI-write, ladder, and physical-output tests.

Get it running, then fix it properly: use a controlled test bit, remove the communication alarm, and only then return the command to production logic.

Follow the command through the PLC scan

A normally open contact can drive a CLICK output coil only when the contact's PLC memory bit is true during the scan and no later operation changes the destination. Start online monitoring at the contact, not at the coil.

  1. Press the CM5 button and watch its assigned contact bit. If the contact never changes, stay on the HMI, addressing, or communication branch of the diagnosis.
  2. If the contact changes but the coil does not, inspect rung continuity, program execution, task or subroutine conditions, and all instructions that can write the destination.
  3. If the internal coil changes but a physical output does not, inspect output mapping, module status, field power, interlocks, and wiring.

Multiple coils writing one address create last-write-wins behavior. For example, if separate rungs both write Y100, the instruction executed later in the scan determines its final state. Parallel the conditions into one output instruction when either condition should energize the output. In this project, the reported test destination appeared only once, but still search the entire PLC project for the address, including reset, set, copy, initialization, and indirect operations. Repeat the search for both the tested Y output and C coil.

Audit every CM5 tag and button assignment

A visually correct button can be bound to the wrong tag. Open the C-more tag database and compare the inactive button with a known working object field by field.

Check Failure signature Correction
PLC device The button targets an old Ethernet device while production communication uses COM2. Select the active CLICK device connection.
Memory type and address The display changes, but the monitored CLICK contact does not. Map the button to the exact C bit used by the rung.
Read and write tags The indicator follows one address while the button writes another. Compare both bindings; do not treat animation as proof of a successful write.
Duplicate screen objects An overlapping or copied object receives the touch. Inspect object placement and assignments on the active screen.
Remaining device references PLC-499 persists after Ethernet settings are unchecked. Search all tags, objects, and background transactions for the retired connection or invalid address.

Use a temporary unused C bit as a diagnostic endpoint only after confirming that it is not written elsewhere. Press the button while monitoring that bit online. This test removes the output module and field wiring from the fault path.

Choose a button action that survives communication gaps

The C-more pushbutton action determines the write sequence:

  • Toggle: each completed press alternates between writing 1 and 0.
  • Momentary On: writes 1, then writes 0 after the configured delay.
  • Momentary Off: performs the inverse sequence.
  • Set On or Set Off: performs one write of 1 or 0.

Momentary actions depend on two messages arriving in the correct order. A communication interruption can drop either transition and leave the PLC with the wrong state. Toggle actions also depend on the HMI and PLC agreeing about the current state.

For a command that the PLC can acknowledge, configure the CM5 object as Set On. Let the CLICK detect the command, perform the requested action, and reset the command bit in PLC logic. The HMI then issues one request per press, while the controller owns completion and reset. Do not use this pattern for a maintained command that must remain true; choose the object behavior from the required control function.

Clear PLC-499 before trusting the control

PLC-499 with hexadecimal code 2 points the diagnostic path toward a Modbus Illegal Data Address request. The responding device is being asked for an address or data range it does not accept. A serial connection working on COM2 does not prove that every CM5 request is valid; another tag or device definition may still poll an obsolete Ethernet target or an invalid PLC address.

  1. Record which CM5 device definition each tag uses.
  2. Confirm that the active CLICK connection uses the intended serial port and matching communication settings on both ends.
  3. Search the HMI project for tags outside the configured CLICK memory map, wrong memory types, stale tags, and multi-register objects whose requested range crosses an invalid address.
  4. Disable suspect screen objects or tag groups in small batches. Re-test after each change so the request producing PLC-499 can be identified.
  5. Correct or remove the invalid request, download the HMI project, and verify that the alarm no longer returns.

Do not interpret a working button as proof that the error is harmless. Polling and write requests are separate transactions; one valid tag can work while another repeatedly generates the address exception.

Prove the repair from screen to field output

  1. Start with the test output off and confirm that the HMI command bit, rung result, and destination coil all show off.
  2. Press only the repaired CM5 button. Confirm that the assigned C bit changes immediately in online monitoring.
  3. Confirm that the rung follows the contact and that the selected C coil or Y output changes during the same command sequence.
  4. Release the button or allow the PLC acknowledgment logic to reset the command, according to the selected object type.
  5. Repeat several isolated presses. Then operate the previously influential second button and confirm that it no longer changes the first command's behavior.
  6. Navigate away from and back to the screen, repeat the test, and check that PLC-499 hexadecimal code 2 remains absent.
  7. For a physical Y output, complete the final check at the output indicator and field terminal under the machine's approved test conditions.

If the contact changes but the coil still fails, stop editing the HMI and trace PLC execution. If the contact never changes and the communication error returns, stop changing ladder logic and isolate the failing HMI transaction.

FAQ

Can I fix a dead CM5 pushbutton by reverting C-more 8.26?

Not before proving the tag write. Verify the CM5 device, C-bit address, object action, and PLC-499 condition before treating the software version as the cause.

Does a CLICK output used on one rung rule out duplicate writes?

No. Search for every instruction that can write the same C or Y address, including set, reset, copy, initialization, and indirect logic; the final write executed in the scan controls the state.

Can I use a momentary CM5 button for a PLC command?

Yes, but it requires both the on and off messages to arrive. For commands vulnerable to dropped events, use Set On and have the CLICK acknowledge the command and reset its bit.

Does serial communication on COM2 eliminate an Ethernet-related PLC-499?

No. A stale CM5 tag or device reference can continue issuing an invalid request; audit every object and tag until PLC-499 hexadecimal code 2 stops.

Stop here if valid addressing, a single-write test bit, and matched serial settings still cannot produce a repeatable write, or if the controller reports hardware or communication diagnostics outside this test. Save the CLICK and C-more projects, capture the failing tag, connection settings, and error state, then contact AutomationDirect through its official support channel.

Back to blog