Programable Logic Controllers (PLC )

Binary Logic

The first binary logic operation, which you will program later on, is the AND function. The AND
function can be best illustrated in a circuit diagram using two keys.

The second binary logic operation is the OR function. The OR function can also be
represented in a circuit diagram.

The third binary logic operation is the memory element ( Set Rest Function). The SR function
reacts
within a circuit diagram to certain voltage states and passes these on accordingly
What is Programmable Logic Controller?

A programmable logic controller (PLC) is a special form of microprocessor-based controller

that uses programmable memory to store instructions and to implement functions such as
logic, sequencing, timing, counting, and arithmetic in order to control machines and processes.

The term logic is used because programming is primarily concerned with implementing logic
and switching operations
for example, if A or B event or Input occurs, switch on C output
if A and B event or Input occurs, switch on D output

Input devices (that is, sensors such as switches, pushbuttons) and output devices (motors,
valves, lamps etc.) in the system being controlled are connected to the PLC. The operator then
enters a sequence of instructions ( a program ) into the memory of the PLC. The controller
then monitors the inputs and outputs according to this program and carries out the control
rules for which it has been programmed.

That is when a process is controlled by a PLC it uses inputs from sensors to make decisions
and update outputs to drive actuators. The control loop is a continuous cycle of the PLC
reading inputs, solving the logic instructions, and then changing the outputs.

PLCs have the great advantage that the same basic controller can be used with a wide range
of control systems. To modify a control system and the rules that are to be used, all that is
necessary is for an operator to key in a different set of instructions. There is no need to rewire.
The result is a flexible, cost-effective system that can be used with control systems, which vary
quite widely in their nature and complexity

PLCs are similar to computers, but whereas computers are optimized for calculation and
Display tasks, PLCs are optimized for control tasks and the industrial environment. Thus PLCs:

 Are rugged and designed to withstand vibrations, temperature, humidity, and noise
 Have interfacing for inputs and outputs , already inside the controller
 Are easily programmed and have an easily understood programming language that is
primarily concerned with logic and switching operations
Scan cycle of PLC

When power is turned on initially the PLC does a quick sanity check to ensure that the
hardware is working properly.

If there is a problem the PLC will halt and indicate there is an error. For example, if the PLC
power is dropping and about to go off this will result in one type of fault. If the PLC passes the
sanity check it will then scan (read) all the inputs. After the inputs values are stored in memory
the programmed logic will be scanned (solved) using the stored values - not the current values.
This is done to prevent logic problems when inputs change during the programmed logic scan.

When the programmed logic scan is complete the outputs will be scanned (the output values
will be changed). After this the system goes back to do a sanity check, and the loop continues
indefinitely. Unlike normal computers, the entire program will be run every scan. Typical times
for each of the stages is in the order of milliseconds or micro secs depending on the processor
speed

.
PLC Hardware

Typically a PLC system has the basic functional components of Processor unit (CPU),
Memory, Power supply unit, Input/Output interface section, communications interface, and the
programming device

 The processor unit or central processing unit (CPU) is the unit containing the
microprocessor. This unit interprets the input signals and carries out the control
actions according to the program stored in its memory, communicating the decisions as
action signals to the outputs.
 The power supply unit is needed to convert the mains AC voltage to the low DC voltage
(5 V / 12V / 24V DC) necessary for the processor and the circuits in the input and output
interface modules.
 The programming device is used to enter the required program into the memory of the
processor. The program is developed in the device and then transferred to the memory
unit of the PLC. Usually the programming device is the computer and program is
transferred to CPU via RS232 communication port or through Ethernet port
 The memory unit is where the program containing the control actions to be exercised by
the microprocessor is stored and where the data is stored from the input for processing
and for the output.
  The Input and Output sections are where the processor receives information from
external devices and communicates information to external devices.
The inputs might thus be from Pushbuttons, selector switches , Limit switches,
temperature sensor, flow sensors, pressure sensors, photoelectric sensors , auxiliary
contacts of switch gears like contactor, overload relay etc.

The outputs might be to motor starter coils, solenoid valves, contactor coils, relay
coils, lamps etc.

Input and output devices can be classified as giving signals that are discrete, digital
or analog

Devices giving discrete or digital signals fig a and fig b are ones where the signals are either
OFF or ON. Thus a switch is a device giving a discrete signal, either no voltage or a voltage.
Digital devices can be considered essentially as discrete devices that give a sequence of
ON/OFF signals.

Analog devices give signals of which the size is proportional to the size of the variable being
monitored. For example, a temperature sensor may give a voltage proportional to the
temperature. ( Fig c)

 The communications interface is used to receive and transmit data on communication

networks from or to other remote PLCs or HMI ( display system) It is concerned with
such actions as device verification, data acquisition, synchronization between user
applications, and connection management.

Field bus interfaces like Profibus , Devicenet , SERCOS III for decentralizing the I/Os
and connecting the 3rd party devices like bar coder, pneumatic valves etc.,
The architecture is shown below

In General it contains following parts.

Internal Architecture of PLC

Fig below shows the basic internal architecture of a PLC. It consists of a central processing
unit (CPU) containing the system microprocessor, memory, and input/output circuitry. The
CPU controls and processes all the operations within the PLC. It is supplied with a clock

that has a frequency of typically between 166MHz and 1 GHz. This frequency determines the
operating speed of the PLC and provides the timing and synchronization for all elements in the
system. The information within the PLC is carried by means of digital signals. The internal
paths along which digital signals flow are called buses. In the physical sense, a bus is just a
number of conductors along which electrical signals can flow. It might be tracks on a printed
circuit board or wires in a ribbon cable. The CPU uses the data bus for sending data between
the constituent elements, the address bus to send the addresses of locations for accessing
stored data, and the control bus for signals relating to internal control actions. The system bus
is used for communications between the input/output ports and the input/output unit.
The CPU

The internal structure of the CPU depends on the microprocessor concerned. In general,
CPUs have the following:

 An arithmetic and logic unit (ALU) that is responsible for data manipulation and carrying
out arithmetic operations of addition and subtraction and logic operations of AND, OR,
NOT, and EXCLUSIVE-OR.

 Memory, termed registers or markers, located within the microprocessor and used to
store information involved in program execution.

 A control unit that is used to control the timing of operations.

The Buses

The buses are the paths used for communication within the PLC. The information is
transmitted in binary form, that is, as a group of bits, with a bit being a binary digit of 1 or 0,
indicating ON/OFF states. The term WORD is used for the group of bits constituting some
information. Thus an 8-bit WORD might be the binary number 00100110. Each of the bits is
communicated simultaneously along its own parallel wire.

The system has four buses:

 The data bus carries the data used in the processing done by the CPU. A
microprocessor termed as being 8-bit has an internal data bus that can handle 8-bit
numbers. It can thus perform operations between 8-bit numbers and deliver results as
8-bit values.

 The address bus is used to carry the addresses of memory locations. So that each
WORD can be located in memory, every memory location is given a unique address.
Just like houses in a town are each given a distinct address so that they can be located,
so each WORD location is given an address so that data stored at a particular location
can be accessed by the CPU, either to read data located there or write the data to that
location. It is the address bus that carries the information indicating which address is to
be accessed. If the address bus consists of eight lines, the number of 8-bit words, and
hence number of distinct addresses, that is 2^8 = 256 addresses. With 16 address lines,
65,536 addresses are possible.
  The control bus carries the signals used by the CPU for control, such as to inform
memory devices whether they are to receive data from an input or output data and to
carry timing signals used to synchronize actions.
 The system bus is used for communications between the input/output ports and the
input/ output unit.

Memory

To operate the PLC system there is a need for it to access the data to be processed and
instructions, that is, the program, which informs it how the data is to be processed. Both are
stored in the PLC memory for access during processing. There are several memory elements
in a PLC system:

 System read-only-memory (ROM) gives permanent storage for the operating system
and fixed data used by the CPU.

 Random-access memory (RAM) is used for the user’s program.

 Random-access memory (RAM) is used for data. This is where information is stored on
the status of input and output devices and the values of timers and counters and other
internal devices. The data RAM is sometimes referred to as a data table or register
table.

Part of this memory, that is, a block of addresses, will be set aside for input and output
addresses and the states of those inputs and outputs. Part will be set aside for preset
data and part for storing counter values, timer values, and EPROM or EEPROM is used
to store programs permanently.

The programs and data in RAM can be changed by the user. All PLCs will have some amount
of RAM to store programs that have been developed by the user and program data. However,
to prevent the loss of programs when the power supply is switched OFF, a battery is used in
the PLC to maintain the RAM contents for a period of time. After a program has been
developed in RAM it may be loaded into an EPROM/ EEPROM memory chip, so as to make it
permanent. In addition, there are temporary buffer stores for the input/output channels.

The storage capacity of a memory unit is determined by the number of binary words that it can
store. Thus, if a memory size is 256 words, it can store 256 x 8 = 2048 bits if 8-bit words are
used and 256 X 16 = 4096 bits if 16-bit words are used.

Some of the typical memory size of PLC starts from 3 MB , 12 MB, 24MB, up to 36 MB. This
memory is for User program
Input/Output Unit

The input/output unit provides the interface between the system and the outside world,
allowing for connections to be made through input/output channels to input devices such as
sensors and output devices such as motor and solenoids. It is also through the input/output
unit that programs are entered from a program panel. Every input/output point has a unique
address that can be used by the CPU. It is like a row of houses along a road; number 10 might
be the “house” used for an input from a particular sensor, whereas number 45 might be the
“house” used for the output to a particular motor.

The input/output channels provide isolation and signal conditioning functions so that sensors
and actuators can often be directly connected to them without the need for other circuitry.

Opto Isolator

Electrical isolation from the external world is usually by means of optoisolators (the term
optocoupler is also often used). Fig above shows the principle of an optoisolator. When a
digital pulse passes through the light-emitting diode, a pulse of infrared radiation is produced.
This pulse is detected by the phototransistor and gives rise to a voltage in that circuit. The gap
between the light-emitting diode and the phototransistor gives electrical isolation, but the
arrangement still allows for a digital pulse in one circuit to give rise to a digital pulse in another
circuit.

The digital signal that is generally compatible with the microprocessor in the PLC is 5 V DC.
However, signal conditioning in the input channel, with isolation, as explained above enables a
wide range of input signals to be supplied to it A range of inputs might be available with a
larger PLC, such as 5 V, 24 V, 110 V, and 240 V digital/discrete, that is, ON/OFF signals .
A small PLC is likely to have just one form of input, such as 24 V.

The output from the input/output unit will be digital with a level of 5 V . However, after signal
conditioning with relays, transistors, the output from the output channel might be a 24 V DC,
500 mA switching signal; a AC voltage of 230 V, 1 A.
With a small PLC, all output may be 24VDC 0.5 A
With modular PLCs, however, a range of outputs can be accommodated by selection of the
modules to be used.

Usually Outputs are specified as being of Relay type or Transistor type

 With the relay type, the signal from the PLC output is used to operate a relay and is able
to switch currents of the order of a few amperes in an external circuit. The relay not only
allows small currents to switch much larger currents but also isolates the PLC from the
external circuit. Relays are, however, relatively slow to operate. Relay outputs are
suitable for AC and DC switching. They can withstand high surge currents and voltage
transients.

 The transistor type of output uses a transistor to switch current through the external
circuit. This gives a considerably faster switching action. It is, however, strictly for DC
switching and is destroyed by overcurrent and high reverse voltage or short circuit. For
protection, either a fuse or built-in electronic protection is used. Optoisolators are used
to provide isolation.

Sourcing and Sinking

The terms Sourcing and Sinking are used to describe the way in which DC devices are
connected to a PLC.

Sinking sensors allow current to flow into the sensor to the voltage common, while sourcing
sensors allow current to flow out of the sensor from a positive source. For both of these
methods the emphasis is on current flow, not voltage. By using current flow, instead of voltage,
many of the electrical noise problems are reduced.

When discussing sourcing and sinking we are referring to the output of the sensor that is
acting like a switch. In fact the output of the sensor is normally a transistor, that will act like a
switch (with some voltage loss). A PNP transistor is used for the sourcing output, and an NPN
transistor is used for the sinking input. When discussing these sensors the term sourcing is
often interchanged with PNP, and sinking with NPN

A simplified example of a sinking output sensor is shown in Figure below. The sensor will have
some part that deals with detection, this is on the left. The sensor needs a voltage supply to
operate, so a voltage supply is needed for the sensor. If the sensor has detected some
phenomenon then it will trigger the active line. The active line is directly connected to an NPN
transistor.

If the voltage to the transistor on the active line is 0V, then the transistor will not allow current
to flow into the sensor. If the voltage on the active line becomes larger (say 12V) then the
transistor will switch ON and allow current to flow into the sensor to the common.
The sensor responds to a physical phenomenon. If the sensor is inactive (nothing detected)
then the active line is low and the transistor is OFF, this is like an open switch. That means the
NPN output will have no current in/out. When the sensor is active, it will make the active line
high. This will turn ON the transistor, and effectively close the switch. This will allow current to
flow into the sensor to ground (hence sinking). The voltage on the NPN output will be pulled
down to V-.

Note: The voltage will always be 1-2V higher because of the transistor. When the sensor is
OFF, the NPN output will float, and any digital circuitry needs to contain a pull-up
resistor.

Sourcing sensors are the complement to sinking sensors. The sourcing sensors use a PNP
transistor, as shown in Figure below (Note: PNP transistors are always drawn with the arrow
pointing to the center.) When the sensor is inactive the active line stays at the V+ value, and
the transistor stays switched OFF. When the sensor becomes active the active line will be
made 0V, and the transistor will allow current to flow out of the sensor.
The sensor responds to the physical phenomenon. If the sensor is inactive (nothing detected)
then the active line is high and the transistor is OFF, this is like an open switch.

That means the PNP output will have no current in/out. When the sensor is active, it will make
the active line high. This will turn ON the transistor, and effectively close the switch. This will
allow current to flow from V+ through the sensor to the output (hence sourcing). The voltage on
the PNP output will be pulled up to V+.

Note: the voltage will always be 1-2V lower because of the transistor. When OFF, the PNP
output will float, if used with digital circuitry a pull-down resistor will be needed.

Most NPN/PNP sensors are capable of handling currents up to a few amps, and they can be
used to switch loads directly

With Sourcing input, using the conventional current flow direction as from positive to negative,
an input device receives current from the input module, that is, the input module is the source
of the current as in Fig below
With Sinking input, using the conventional current flow direction, an input device supplies
current to the input module, that is, the input module is the sink for the current

Similarly if the current flows from the output module to an output load, the output module is
referred to as sourcing Output

If the current flows to the output module from an output load, the output module is referred to
as Sinking output

It is important know the type of input or output concerned so that it can be correctly connected
to the PLC. Thus, sensors with sourcing outputs should be connected to sinking PLC inputs
and sensors with sinking outputs should be connected to sourcing PLC inputs. The interface
with the PLC will not function and damage may occur if this guideline is not followed.
The dashed line in the figure represents the circuit, or current flow path when the sensor is
active. This path enters the PLC input card first at a V+ terminal (Note: there is no common on
this card) and flows through an optocoupler. This current will use light to turn on a
phototransistor to tell the computer in the PLC the input current is flowing. The current then
leaves the card at input 00 and passes through the sensor to V-. When the sensor is inactive
the current will not flow, and the light in the optocoupler will be OFF. The opto coupler is used
to help protect the PLC from electrical problems outside the PLC.
The current flow loop for an active sensor is shown with a dashed line. Following the path of
the current we see that it begins at the V+, passes through the sensor, in the input 00, through
the optocoupler, out the common and to the V-.
Sinking and Sourcing Input wiring diagram for
Logical Sensors or Input devices to PLC

The term sensor is used for an input device that provides a usable output in response to a
specified physical input

For example, a thermocouple is a sensor that converts a temperature difference into an

electrical output. The term transducer is generally used to refer to a device that converts a
signal from one form to a different physical form. Thus sensors are often transducers, but also
other devices can be transducers, such as a motor that converts an electrical input into
rotation.

Sensors allow a PLC to detect the state of a process. Logical sensors can only detect a state
that is either TRUE or FALSE. Examples of physical phenomena that are typically detected are
listed below.

Sensors that give digital or discrete, that is, ON/OFF, outputs can be easily connected to the
input ports of PLCs.

• Inductive proximity - is a metal object nearby ?

• Capacitive proximity - is a dielectric object nearby ?
• Optical presence - is an object breaking a light beam or reflecting light ?
• Mechanical contact - is an object touching a switch ?
• Color sensor - is an color mark nearby ?

When a sensor detects a logical change it must signal that change to the PLC. This is typically
done by switching a voltage or current ON or OFF.

Typical outputs from sensors (i.e inputs to PLCs) are listed below in relative popularity.

 Sinking/Sourcing - Switches current ON or OFF

 Plain Switches ( Push buttons , selector switches ) - Switches voltage ON or OFF.
 Solid State Relays - These switches AC outputs.
 TTL (Transistor Transistor Logic) - Uses 0V and 5V to indicate logic levels.
Mechanical switches

The simplest example of sensor outputs are switches and relays. A simple example
is shown in Figure below

A mechanical switch generates an ON/OFF signal or signals as a result of some mechanical

input causing the switch to open or close.

Example : A mechanical switch might be used to indicate the presence of a work piece on a
machining table, the work piece pressing against the switch and so closing it. The absence of
the work piece is indicated by the switch being open and its presence by it being closed.

Examples of mechanical switches are Limit switches.

Liquid-level switches are used to control the level of liquids in tanks. Essentially, these are
vertical floats that move with the liquid level, and this movement is used to operate switch
contacts.

Switches are available with normally open (NO) or normally closed (NC) contacts or can be
configured as either by choice of the relevant contacts. An NO switch has its contacts open in
the absence of a mechanical input and the mechanical input is used to close the switch. An NC
switch has its contacts closed in the absence of a mechanical input and the mechanical input
is used to open the switch. Mechanical switches are specified in terms of number of poles, that
is, the number of separate circuits that can be completed by the same switching action, and
number of throws, that is, the number of individual contacts for each pole.
Proximity switches

Proximity switches are used to detect the presence of an item without making contact with it.
There are a number of forms of such switches, some being suitable only for metallic objects.

The eddy current type of proximity switch has a coil that is energized by a constant alternating
current and produces a constant alternating magnetic field. When a metallic object is close to
it, eddy currents are induced in it The magnetic field due to these eddy currents induces an
EMF back in the coil with the result that the voltage amplitude needed to maintain the constant
coil current changes. The voltage amplitude is thus a measure of the proximity of metallic
objects. The voltage can be used to activate an electronic switch circuit, basically a transistor
that has its output switched from low to high by the voltage change, creating an on/off device.
The range over which such objects can be detected is typically about 0.5 to 20 mm.

Another switch type is the reed switch. This consists of two overlapping, but not touching
strips of a springy ferromagnetic material sealed in a glass or plastic envelope .
When a magnet or current-carrying coil is brought close to the switch, the strips become
magnetized and attract each other. The contacts then close. The magnet closes the contacts
when it is typically about 1 mm from the switch.

Such a switch is widely used with burglar alarms to detect when a door is opened, with the
magnet being in the door and the reed switch in the frame of the door. When the door opens,
the switch opens.

These switches also find application in detecting the position of pneumatic cylinders or
Hydraulic cylinder.

A proximity switch that can be used with metallic and nonmetallic objects is the capacitive
proximity switch. The capacitance of a pair of plates separated by some distance depends
on the separation; the smaller the separation, the higher the capacitance. The sensor of the
capacitive proximity switch is just one of the plates of the capacitor, the other plate being the
metal object for which the proximity is to be detected Thus the proximity of the object is
detected by a change in capacitance. The sensor can also be used to detect nonmetallic
objects, since the capacitance of a capacitor depends on the dielectric between its plates. In
this case the plates are the sensor and the earth and the nonmetallic object is the dielectric.

The change in capacitance can be used to activate an electronic switch circuit and so create
an on/off device. Capacitive proximity switches can be used to detect objects when they are
typically between 4 mm and 60 mm from the sensor head. An example of the use of such a
sensor might be to determine whether a cake is present inside a cardboard box, when such
boxes move along a conveyor belt.
Another type, the inductive proximity switch, consists of a coil wound a round a ferrous
metallic core. When one end of this core is placed near a ferrous metal object, there is
effectively a change in the amount of metallic core associated with the coil and so a change in
its inductance. This change can be monitored using a resonant circuit, the presence of the
ferrous metal object thus changing the current in that circuit. The current can be used to
activate an electronic switch circuit and so create an ON/OFF device. The range over which
such objects can be detected is typically about 2 mm to 15 mm. An example of the use of such
a sensor is to detect whether bottles passing along a conveyor belt have metal caps ON.

Photoelectric Sensors and Switches

Photoelectric switch devices can either operate as transmissive types, in which the object
being detected breaks a beam of light, usually infrared radiation, and stops it reaching the
detector Fig a , as in Fig b, which shows a U-shaped form in which the object breaks the light
beam; or reflective types, in which the object being detected reflects a beam of light onto the
detector Fig c. The transmissive form of sensor is typically used in applications involving the
counting of parts moving along conveyor belts and breaking the light beam; the reflective form
is used to detect whether transparent containers contain liquids to the required level
The radiation emitter is generally a light-emitting diode (LED). The radiation detector might
be a phototransistor, often a pair of transistors, known as a Darlington pair, to increase the
sensitivity. Depending on the circuit used, the output can be made to switch to either HIGH or
LOW when light strikes the transistor. Such sensors are supplied as packages for sensing the
presence of objects at close range, typically less than about 5 mm. Another possible detector
is a photodiode. Depending on the circuit used, the output can be made to switch to either
HIGH or LOW when light strikes the diode

Yet another possibility is a photoconductive cell. The resistance of the photoconductive cell,
often cadmium sulfide, depends on the intensity of the light falling on it.

With these sensors, light is converted to a current, voltage, or resistance change. If the output
is to be used as a measure of the intensity of the light, rather than just the presence or
absence of some object in the light path, the signal will need amplification and then conversion
from analog to digital by an analog-to-digital converter. An alternative is to use a light-to-
frequency converter, the light then being converted to a sequence of pulses, with the
frequency of the pulses being a measure of the light intensity. Integrated circuit sensors,
incorporate the light sensor and the voltage-to-frequency converter
Encoders

Incremental encoder

The term encoder is used for a device that provides a digital output as a result of angular or
linear displacement. An incremental encoder detects changes in angular or linear
displacement from some datum position; an absolute encoder gives the actual angular or
linear position

Fig above shows the basic form of an incremental encoder for the measurement of angular
displacement. A beam of light, perhaps from an LED, passes through slots in a disc and is
detected by a light sensor, such as a photodiode or phototransistor. When the disc rotates, the
light beam is alternately transmitted and stopped, and so a pulsed output is produced from the
light sensor. The number of pulses is proportional to the angle through which the disc has
rotated, the resolution being proportional to the number of slots on a disc. With 60 slots, then,
since one revolution is a rotation of 360, a movement from one slot to the next is a rotation of
6. By using offset slots it is possible to have over a thousand slots for one revolution and thus
a much higher resolution.

This setup with just one track A is a very basic form of incremental encoder with no way of
determining the direction of rotation. With a single track, the output is the same for both
directions of rotation.

With two tracks A ,B , one track is one-quarter of a cycle displaced from the other track. As a
consequence, the output from one track will lead or lag that from the other track, depending on
the direction of rotation. A third track of just a single aperture is also included; this gives one
pulse per revolution and so can be used for counting the number of full revolutions.
Absolute encoder

The absolute encoder differs from the incremental encoder in having a pattern of slots that
uniquely defines each angular position. With the form shown in fig below the rotating disc has
four concentric circles of slots and four sensors to detect the light pulses. The slots are
arranged in such a way that the sequential output from the sensors is a number in the binary
code, each number corresponding to a particular angular position. With four tracks there will be
4 bits, and so the number of positions that can be detected is 2^4 = 16 that is, a resolution of
360/16 = 22.5 deg. Typical encoders have up to 10 or 12 tracks. The number of bits in the
binary number will be equal to the number of tracks. Thus with 10 tracks there will be 10 bits,
and so the number of positions that can be detected is 2^10, that is, 1024, a resolution of
360/1024 = 0.35deg

Though the normal form of binary code is shown in the figure, in practice a modified form of
binary code called the Gray code is generally used. This, unlike normal binary, has only 1 bit
that changes in moving from one number to the next (see Table ). This code provides data with
the least uncertainty, but since we are likely to need to run systems with binary code, a circuit
to convert Gray to binary code has to be used.
Temperature Sensors

Bimetal sensor

A simple form of temperature sensor that can be used to provide an on/off signal when a
particular temperature is reached is the bimetal element. This consists of two strips of

different metals, such as brass and iron, bonded together as in fig. The two metals have
different coefficients of expansion. Thus, when the temperature of the bimetal strip increases,
the strip curves in order that one of the metals can expand more than the other. The higher
expansion metal is on the outside of the curve. As the strip cools, the bending effect is
reversed. This movement of the strip can be used to make or break electrical contacts and
hence, at some particular temperature, it give an ON/OFF current in an electrical circuit. The
device is not very accurate but is commonly used in domestic central heating thermostats
because it is a very simple, robust device.

Resistive temperature detector (RTD)

Another form of temperature sensor is the Resistive temperature detector (RTD). The electrical
resistance of metals or semiconductors changes with temperature. In the case of a metal, the
ones most commonly used are platinum, nickel, or nickel alloys. Such detectors can be used
as one arm of a Wheatstone bridge and the output of the bridge taken as a measure of the
temperature (See fig a). For such a bridge, there is no output when the resistors in the bridge
arms are such that P/Q = R/S. Any departure of a resistance from this balance value results in
an output. The resistance varies in a linear manner with temperature over a wide range of
temperatures, though the actual change in resistance per degree is fairly small.

A problem with a resistance thermometer is that the leads connecting it to the bridge can be
quite long and themselves have significant resistance, which changes with temperature. One
way of overcoming this problem is to use a three-wire circuit, as shown in Figure b. Then
changes in lead resistance affect two arms of the bridge and balance out. Such detectors are
very stable and very accurate, though expensive. They are available in the form of wire-wound
elements inside ceramic tubes or as thin film elements deposited on a suitable substrate.
Thermistors

Semiconductors, such as thermistors show very large changes in resistance with temperature.
The change, however, is nonlinear. Those specified as NTC have negative temperature
coefficients, that is, the resistance decreases with increasing temperature, and those specified
as PTC have positive temperature coefficients, that is, the resistance increases with increasing
temperature
Thermal Diodes and Thermo transistors

Thermodiodes and Thermotransistors are used as temperature sensors since the rate at which
electrons and holes diffuse across semiconductor junctions is affected by the temperature.
Integrated circuits can combine such a temperature-sensitive element with the relevant
circuitry to give an output voltage related to temperature.

A digital temperature switch can be produced with an analog sensor by feeding the analog
output into a comparator amplifier, which compares it with some set value, producing an output
that gives a logic 1 signal when the temperature voltage input is equal to or greater than the
set point and otherwise gives a logic 0 signal

Thermocouple

The thermocouple consists essentially of two dissimilar wires, A and B, forming a junction (Fig)
When the junction is heated so that it is at a higher temperature than the other junctions in the
circuit, which remain at a constant cold temperature, an EMF is produced that is related to the
hot junction temperature.

The EMF values for a thermocouple are given in Table, assuming that the cold junction is at 0
deg C. The thermocouple voltage is small and needs amplification before it can be fed to the
analog channel input of a PLC. There is also circuitry required to compensate for the
temperature of the cold junction, since often it will not be at 0 deg C, but room temperature and
its temperature affects the value of the EMF. The amplification and compensation, together
with filters to reduce the effect of interference from the mains supply, are often combined in a
signal processing unit. Thermocouples have the advantages of being able to sense the
temperature at almost any point, ruggedness, and being able to operate over a large
temperature range. They have the disadvantages of giving a nonlinear response, giving only
small changes in EMF per degree change in temperature, and requiring temperature
compensation for the cold junction.
Position/Displacement Sensors

The term position sensor is used for a sensor that gives a measure of the distance between a
reference point and the current location of the target, while a displacement sensor gives a
measure of the distance between the present position of the target and the previously recorded
position

Resistive linear and angular position sensors are widely used and relatively inexpensive.
These are also called linear and rotary potentiometers. A DC voltage is provided across the full
length of the track and the voltage signal between a contact that slides over the resistance
track and one end of the track is related to the position of the sliding contact between the ends
of the potentiometer resistance track (See fig )The potentiometer thus provides an analog
linear or angular position sensor.
LVDT

Another form of displacement sensor is the Linear Variable Differential Transformer (LVDT),
which gives a voltage output related to the position of a ferrous rod. The LVDT consists of
three symmetrically placed coils through which the ferrous rod moves (See Figure).

When an alternating current is applied to the primary coil, alternating voltages, V1 and V2, are
induced in the two secondary coils. When the ferrous rod core is centered between the two
secondary coils, the voltages induced in them are equal. The outputs from the two secondary
coils are connected so that their combined output is the difference between the two voltages,
that is, V1 – V2. With the rod is at centre, the two alternating voltages are equal and so there is
no output voltage. When the rod is displaced from its centre position, there is more of the rod
in one secondary coil than the other. As a result, the size of the alternating voltage induced in
one coil is greater than that in the other. The difference between the two secondary coil
voltages, that is, the output, thus depends on the position of the ferrous rod. The output from
the LVDT is an alternating voltage. This is usually converted to an analog DC voltage and
amplified before inputting to the analog channel of a PLC.

Capacitive displacement sensors are essentially just parallel plate capacitors. The
capacitance will change if the plate separation changes, the area of overlap of the plates
changes, or a slab of dielectric is moved into or out of the plates (fig below) All these methods
can be used to give linear displacement sensors. The change in capacitance has to be
converted into a suitable electrical signal by signal conditioning.
Strain Gauges

When a wire or strip of semiconductor is stretched, its resistance changes. The fractional
change in resistance is proportional to the fractional change in length, that is, strain.

where DR is the change in resistance for a wire of resistance R and G is a constant called the
gauge factor. For metals, the gauge factor is about 2; for semiconductors, about 100. Metal
resistance strain gauges are in the form of a flat coil so that they get a reasonable length of
metal in a small area. Often they are etched from metal foil (Figure a) and attached to a
backing of thin plastic film so that they can be stuck on surfaces, like postage stamps on an
envelope. The change in resistance of the strain gauge, when subject to strain, is usually
converted into a voltage signal by the use of a Wheatstone bridge.

A problem that occurs is that the resistance of the strain gauge also changes with temperature,
and thus some means of temperature compensation has to be used so that the output of the
bridge is only a function of the strain. This can be achieved by placing a dummy strain gauge
in an opposite arm of the bridge, that gauge not being subject to any strain but only the
temperature

By attaching strain gauges to other devices, changes that result in strain of those devices can
be transformed, by the strain gauges, to give voltage changes. They might, for example, be
attached to a cantilever to which forces are applied at its free end. Fig c
The voltage change, resulting from the strain gauges and the Wheatstone bridge, then
becomes a measure of the force. Another possibility is to attach strain gauges to a diaphragm,
which deforms as a result of pressure . The output from the gauges and associated
Wheatstone bridge then becomes a measure of the pressure

Pressure Sensors

Pressure sensors can be designed to give outputs that are proportional to the difference in
pressure between two input ports. If one of the ports is left open to the atmosphere, the gauge
measures pressure changes with respect to the atmosphere and the pressure measured is
known as gauge pressure. The pressure is termed the absolute pressure if it is measured with
respect to a vacuum. Commonly used pressure sensors that give responses related to the
pressure are diaphragm and bellows types. The diaphragm type consists of a thin disc of
metal or plastic, secured around its edges. When there is a pressure difference between the
two sides of the diaphragm, its center deflects. The amount of deflection is related to the
pressure difference.

This deflection may be detected by strain gauges attached to the diaphragm (see Figure d), by
a change in capacitance between it and a parallel fixed plate, or by using the deflection to
squeeze a piezoelectric crystal (Figure a).
When a piezoelectric crystal is squeezed, there is a relative displacement of positive and
negative charges within the crystal and the outer surfaces of the crystal become charged.
Hence a potential difference appears across it.

Pressure switches

Pressure switches are designed to switch ON or OFF at a particular pressure. A typical form
involves a diaphragm or bellows that moves under the action of the pressure and operates a
mechanical switch. Figure above shows two possible forms. Diaphragms are less sensitive
than bellows but can withstand greater pressures.

Liquid level detectors

Sensor which give a signal when the level in some container reaches a particular level. A float
switch that is used for this purpose consists of a float containing a magnet that moves in a
housing with a reed switch. As the float rises or falls, it turns the reed switch on or off, the reed
switch being connected in a circuit that then switches a voltage ON or OFF.
Output Devices
The output ports of a PLC are relay or opto-isolator with transistor, depending on the devices
that are to be switched ON or OFF. Generally, the digital signal from an output channel of a
PLC is used to control an actuator, which in turn controls some process. The term actuator is
used for the device that transforms the electrical signal into some more powerful action, which
then results in control of the process.
Some examples are Relay, solenoid coils, lamps , contactor coils , pneumatic cylinders ,
Valves, etc

Relay / contactor coils

When a current passes through a relay or contactor coil , a magnetic field is produced. This
can then attract ferrous metal components in its vicinity. With the relay, this attraction is used
to operate a switch.

Relays or contactor coil can thus be used to control a larger current or voltage and,
additionally, to isolate the power used to initiate the switching action from that of the controlled
power. For a relay connected to the output of a PLC, when the output switches on, the
magnetic field is produced, and this pulls on the contacts and so closes a switch or switches.
The term contactor is used when large currents are being switched from large voltage
sources.

PLC output 24VDC To auxillary component

SOLENOIDS
Solenoids are the most common actuator components. The basic principle of operation is there
is a moving ferrous core (a piston) that will move inside wire coil as shown in fig below
Normally the piston is held outside the coil by a spring. When a voltage is applied to the coil
and current flows, the coil builds up a magnetic field that attracts the piston and pulls it into the
center of the coil. The piston can be used to supply a linear force. Well known applications of
these include pneumatic valves, hydraulic valves etc
Digital Systems

Digital systems used in PLCs are

1. Binary system
2. Hexadecimal system
3. Decimal system
4. Binary coded decimal

Decimal system

The number system used for everyday calculations is the decimal system.
This is based on the use of 10 digits: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9.

With a number represented by this system, the digit position in the number indicates the weight
attached to each digit, the weight increasing by a factor of 10 as we proceed from right to left.

Thus if we have the denary number 1234, we have 1 with a place value of 10 ^ 3,
2 with a place value of 10^2, 3 with a place value of 10^1, and 4 with a place value of 10^0.

The Binary System

The binary system is based on just two digits: 0 and 1. These are termed binary digits, or bits.
When a number is represented by this system, the digit position in the number indicates the
weight attached to each digit, the weight increasing by a factor of 2 as we proceed from right to
left.

Bit 0 is termed the least significant bit (LSB) and the highest bit in a binary number is termed
the most significant bit (MSB). For example, with the binary number 1010, the LSB is the bit
at the right end of the number (0 in this example). The MSB is the bit at the left end of the
number (1 in this example).
The conversion of a binary number to a decimal number involves the addition of the powers of
2 indicated by the place position of a number in the overall number. Thus for the binary
number 1010, we have 1 with a place value of 2^3, 0 with a place value of 2^2, 1 with a place
value of 2^1, and 0 with a place value of 2^0, and so the conversion to a denary or decimal
number is as follows:

Thus the decimal equivalent is 10.

Binary numbers are used in computers because the two states represented by 0 and 1 are
easy to deal with in switching circuits, where they can represent OFF and ON

Hexadecimal System

The hexadecimal system (hex) is based on 16 digits/symbols: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B,

C, D, E, F. When a number is represented by this system, the digit position in the number
indicates that the weight attached to each digit increases by a factor of 16 as we proceed from
right to left. Thus we have

For example, the decimal number 15 is F in the hexadecimal system. To convert from decimal
numbers into hex we successively divide by 16 and note the remainders. Thus the decimal
number 156, when divided by 16, gives 9 with remainder 12, and so in hex is 9C. To convert
from hex to denary, we multiply the digits by the power of 16 appropriate to its position in the
number. Thus hex 12 is 1x16^1 + 2 x16^0 = 18. To convert binary numbers into hexadecimal
numbers, we group the binary numbers into fours starting from the least significant number.

Thus, for the binary number 1110100110 we have:

11 1010 0110 Binary number

3 A 6 Hex number

For conversion from hex to binary, each hex number is converted to its 4-bit equivalent.
Thus, for the hex number 1D we have 0001 for the 1 and 1101 for the D:
1 D Hex number
0001 1101 Binary number
Thus the binary number is 0001 1101.
Binary Coded Decimals

Because the external world tends to deal mainly with numbers in the decimal system and
computers with numbers in the binary system, there is always the problem of conversion.

There is, however, no simple link between the position of digits in a decimal number and the
position of digits in a binary number. An alternative method that is often used is the binary
coded decimal system (BCD).

With this system, each decimal digit is coded separately in binary.

For example, the decimal number 15 has the 5 converted into the binary number 0101 and the
1 into 0001:

Thus

1 5 Decimal number

0001 0101 Binary number to give the number 0001 0101 in BCD.

With the BCD system, the largest decimal number that can be displayed is 9, and so the four
binary digits are 1001.

To convert a BCD number to a decimal number, each group of four binary numbers is
separately converted to a decimal number.

For example, the BCD number 0011 1001 has a decimal number of 3 for 0011 and 9 for 1001,
and so the decimal number is 39.

0011 1001 BCD number

3 9 Denary number

Numeric data is often entered into PLCs by rotary or thumb-wheel switches with a 0 to 9 range.
Thus there may be a bank of such switches, one giving, say, the hundreds, one the tens, and
one the ones. The output from each switch is then converted, independently, into binary to give
the overall result of a binary coded decimal number. Some PLCs have a function that can be
called up to convert such BCD numbers to binary numbers; in other PLCs it has to be done by
programming.
Memory Types

RAM (Random Access Memory) - this memory is fast, but it will lose its contents when power
is lost, this is known as volatile memory. Every PLC uses this memory for the central CPU
when running the PLC.

ROM (Read Only Memory) - this memory is permanent and cannot be erased. It is often used
for storing the operating system for the PLC.

EPROM (Erasable Programmable Read Only Memory) - this is memory that can be
programmed to behave like ROM, but it can be erased with ultraviolet light and reprogrammed.

EEPROM (Electronically Erasable Programmable Read Only Memory) – This memory can
store programs like ROM. It can be programmed and erased using a voltage, so it is becoming
more popular than EPROMs.

Hard Disk - Software based PLCs run on top of another operating system (such as Windows)
that will read and save values to a hard drive, in case power is lost.

All PLCs use RAM for the CPU and ROM to store the basic operating system for the PLC.
When the power is ON the contents of the RAM will be kept, but the issue is what happens
when power to the memory is lost. Originally PLC are used RAM with a battery so that the
memory contents would not be lost if the power was lost. This method is still in use, but is
losing favor. EPROMs have also been a popular choice for programming PLCs. The EPROM
is programmed out of the PLC, and then placed in the PLC. When the PLC is turned on the
ladder logic program on the EPROM is loaded into the PLC working RAM and run.

This method can be very reliable, but the erasing and programming technique can be time
consuming. EEPROM memories are a permanent part of the PLC, and programs can be
stored in them like EPROM.
Processing Inputs and Outputs

A PLC is continuously running through its program and updating it as a result of the input
signals. Each such loop is termed a cycle. PLCs could be operated by each input being
examined as it occurred in the program, its effect on the program determined, and the output
correspondingly changed. This mode of operation is termed as continuous updating.

Because there is time spent interrogating each input in turn with continuous updating, the time
taken to examine several hundred input/output points can become comparatively long.

To allow more rapid execution of a program, a specific area of RAM is used as a buffer store
between the control logic and the input/output unit. Each input/output has an address in this
memory. At the start of each program cycle the CPU scans all the inputs and copies their
status into the input/output addresses in RAM. As the program is executed, the stored input
data is read, as required, from RAM and the logic operations are carried out. The resulting
output signals are stored in the reserved input/output section of RAM. At the end of each
program cycle all the outputs are transferred from RAM to the appropriate output channels.

The outputs then retain their status until the next updating. This method of operation is termed
mass I/O copying. The sequence can be summarized as follows

1. Scan all the inputs and copy into RAM.

2. Fetch, decode, and execute all program instructions in sequence, copying output
instructions to RAM.
3. Update all outputs.
4. Repeat the sequence.

The time taken to complete a cycle of scanning inputs and updating outputs according to the
program instructions, that is, the cycle time, though relatively quick, is not instantaneous and
means that the inputs are not watched all the time, but instead that samples of their states are
taken periodically. A typical cycle time is on the order of 10 to 50 ms. This means that the
inputs and outputs are updated every 10 to 50 ms and thus there can be a delay of this order
in the system reaction. It also means that if a very brief input cycle appears at the wrong
moment in the cycle, it could be missed. In general, any input must be present for longer than
the cycle time. Special modules are available for use in such circumstances.

Consider a PLC with a cycle time of 40 ms. What is the maximum frequency of digital impulses
that can be detected ? The maximum frequency will be if one pulse occurs every 40 ms, that
is, a frequency of 1/ 0.04 = 25 Hz.

The cycle or scanning time for a PLC, i.e. its response speed, is determined by:
1. The CPU used.
2. The size of the program to be scanned.
3. The number of inputs/outputs to be read.
4. The system functions that are in use; the greater the number, the slower the scanning time.
Centralized and Decentralized distribution of Digital and Analog Inputs /Outputs

Centralized I/Os

Centralized I/Os –
connected directly
inline with PLC

Decentralized I/Os.
The I/Os can be distributed at the further distance from PLC.
If the I/Os are to be distributed at long distances, using Field bus interfaces, the I/Os can be
distributed at the further distance from PLC. This will reduce the wiring and voltage drop due to
long wiring.

Commonly used field bus interface for decentralized I/Os are Profibus , SERCOS III,
DeviceNet, CanOpen, ProfiNet IO
Architecture of Centralized and Decentralized I/Os
Total System Architecture
PLC Components
Inline I/Os and function Modules
Selection of PLC for Centralized and Decentralized I/Os

Only Local I/Os

Number of I/Os connected Inline ( Analog, digital, Counter, Encoder modules) should not
exceed 32 bytes
Local and distributed I/Os
Technical data of Low range PLC
Technical data of Medium range PLC
High end PLC Technical data
I/O Addressing

Address definition of Inputs, Outputs and Markers

Addressing examples:
%QX2.7
%IB13
%IW18
%MD20

Addressing example with Symbolic names:

Valve_1 AT %QX2.7 : BOOL
LedBar AT %IB13 : BYTE
ST1_Value AT %IW18 : WORD
Temp1 AT %MD20 : DWORD

Variable1 : INT;
Variable2 : REAL;
Variable3 : STRING[30];
Variable4 : ARRAY[1..5] OF REAL;
Variable5 :BOOL;
IEC 61131 programming

 The international standard IEC 61131 was created as a basis for uniform PLC
programming, where modern software technology designs are considered.

 IEC 61131-3 is the standard for a common usage of programmable logic controllers and
other industrial controls.

 IEC 61131-3 standardizes the way people work with controls

 The standard comprises 7 parts:

 IEC 61131-1 General overview, definitions

 IEC 61131-2 Hardware
 IEC 61131-3 Programming languages
 IEC 61131-4 User guidelines
 IEC 61131-5 Messaging service specification
 IEC 61131-7 Fuzzy logic
 IEC 61131-8 Technical report

All programming instructions and methods in this document is as per IEC 61131-3 standards

Objectives of the IEC 61131-3

Portable PLC software that is independent of hardware to a large extent
The aim of the project-oriented approach is to structure the entire automation task
All control elements are managed under one project
Strictly hierarchically structured software model with object-oriented elements
All language elements of the programming languages are defined
This standard allows for comprehensively describing a complete automation system.
PLC programming Software

A programming device is usually a desktop console, or a computer or Handheld terminal. Only

when the program has been designed on the programming device and is ready, it transferred
to the memory unit of the PLC.

• A handheld programming device normally contains enough memory to allow the unit to retain
programs while being carried from one place to another.

• Desktop consoles are likely to have a visual display unit with a full keyboard and screen
display.

• Personal computers are widely configured as program development workstations. Some

PLCs only require the computer to have appropriate software; others require special
communication cards to interface with the PLC. A major advantage of using a computer is
that the program can be stored on the hard disk or a CD and copies can be easily made.

PLC manufacturers provide programming software for their PLCs. For example, Bosch
Rexroth has Indralogic software in their Indraworks Engineering software platform . This PLC
development software uses Windows based programming environment.. It supports all types
programming methods of IL, LD, and SFC languages. We can switch back and forth between
IL and LD at will while we are working. We can program your own function blocks, and a wide
range of utilities is available for configuring special function modules for the Bosch Rexroth
PLC systems. There is no need to program special function modules, you just configure them.
The package includes powerful editors and diagnostics functions to help get applications up
and running quickly and efficiently. It offers offline simulation for all PLC types and thus
enables simulation of all devices and application responses for realistic testing.

By testing early in a project’s development, overall project quality can be improved. Installation
and commissioning can thus be quicker and less expensive because program faults can be
detected and corrected early on during development.

Examples of programming softwares of other suppliers

1. Rockwell Automation manufactures RSLogix programming softwares for the Allen-

Bradley PLC-5 family of PLCs,
2. OMRON has CX-One software
3. Telemecanique has ProWorx 32 for its Modicon range of PLCs.
4. Siemens has SIMATIC STEP 7 for S7 series of PLCs

nespress.com
Standard Data Types in IEC 61131-3
The IEC 61131−3 standard defines five groups of basic data types
− Bit sequence (ANY_BIT),
− Integer with / without sign (ANY_INT),
− Floating point (ANY_REAL),
− Date, and Time (ANY_DATE),
− String, Duration,

Data Types

In the following table the properties of the five data type groups are described:

− Name (Keyword)
− Description (Short description)
− Number of Bits (Data width)
− value range (with related IEC−Literal)
− Defaullt values „initial“
The data width and the value range given below, is depending on the target system and the
implementation of the software

Instead of the keyword TOD it also possible to use the keyword TIME_OF_DAY
Instead of keyword DT it also possible to use the keyword DATE_AND_TIME
Default value for a string is an empty character sequence.
Types of PLC programming languages

Programs for microprocessor-based systems have to be loaded in machine code, a sequence

of binary code numbers to represent the program instructions. However, assembly language
based on the use of mnemonics can be used. For example, LD (instruction) is used to indicate
the operation required to load the data that follows the LD , and a computer program called an
assembler is used to translate the mnemonics into machine code.

Programming can be made even easier by the use of the so-called high-level languages, such
as C, BASIC, Pascal, FORTRAN, and COBOL. These languages use prepackaged functions,
represented by simple words or symbols descriptive of the function concerned. For example,
with C language the symbol & is used for the logic AND operation. However, the use of these
methods to write programs requires some skill in programming, and PLCs are intended to be
used by engineers without any great knowledge of programming. As a consequence, ladder
programming (LAD) , and other programming methods was developed as a means of writing
programs that can then be converted into machine code by software for use with the PLC
microprocessor. This method of writing programs adopted by most PLC manufacturers, but
each tended to develop its own version, and so an international standard has been adopted for
all methods of programming PLCs like IEC61131-3

Some of the methods of programming the PLCs are

1. Ladder diagram LD
2. Structured Text ST
3. Function block diagram FBD
4. Instruction List IL
5. Sequential function chart SFC

The two languages (IL and ST) are text-based languages, the other three languages (LD, FBD
and SFC) are graphical languages.
Ladder Diagram (LD)

LD is a graphical programming language. LD is equivalent to FBD. The program organization

units can be clearly structured and linked graphically. This type of programming is particularly
suited for Boolean operations because the signal flow can be clearly presented.

This is very commonly used method of programming PLCs. Writing a program is then
equivalent to drawing a switching circuit.
The ladder diagram consists of two vertical lines representing the power rails. Circuits are
connected as horizontal lines, that is, the rungs of the ladder, between these two verticals.

In drawing a ladder diagram, certain conventions are adopted:

• The vertical lines of the diagram represent the power rails between which circuits are
connected. The power flow is taken to be from the left-hand vertical across a rung.

• Each rung on the ladder defines one operation in the control process.

• A ladder diagram is read from left to right and from top to bottom. Fig shows the
scanning motion employed by the PLC. The top rung is read from left to right. Then the
second rung down is read from left to right and so on. When the PLC is in its run
mode, it goes through the entire ladder program to the end, the end rung of the
program being clearly denoted, and then promptly resumes at the start .This procedure
of going through all the rungs of the program is termed a cycle. The end rung might be
indicated by a block with the word END or RET, for return, since the program promptly
returns to its beginning. The scan time depends on the number of runs in the program,
taking about 1ms per 1000 bytes of program and so typically ranging from about 10 ms
up to 50 ms.

• Each rung must start with an input or inputs and must end with at least one output. The
term input is used for a control action, such as closing the contacts of a switch. The
term output is used for a device connected to the output of a PLC, such as a relay. As
the program is scanned, the outputs are not updated instantly, but the results stored in
memory and all the outputs are updated simultaneously at the end of the program scan.

• Electrical devices are shown in their normal condition. Thus a switch that is normally
open until some object closes it is shown as open on the ladder diagram. A switch that
is normally closed is shown closed.

• A particular device can appear in more than one rung of a ladder. For example, we
might have a relay that switches on one or more devices. The same letters and/or
numbers are used to label the device in each situation.

• The inputs and outputs are all identified by their addresses, the notation used depends
on the PLC manufacturer. This is the address of the input or output in the memory of
the PLC
LD Ladder Diagram
i i q

 Available for almost all PLCs and is common method of programming used by all users
 Originates from electromechanical relay systems
 Describes the current flow from contacts to coils
 Standardized symbols
 Suitable for boolean operations
Example from Logic Gates to Ladder diagram
Structured Text (ST)

ST is a textual programming language that can be considered a high level language. Very
good structuring of program code is possible using elements such as IF, CASE instructions
and FOR, WHILE, REPEAT loops.

If we know how to program in any high level language, such as Basic or C or PASCAL, we will
be comfortable with Structured Text (ST) programming. ST programming is part of the IEC
61131 standard. An example program is shown below

Key features
 High-level language
 Syntax comparable with PASCAL
 Constructs for controlling the program flow:
 Looping
(FOR, REPEAT-UNTIL, WHILE-DO)
 Conditional execution
(IF-THEN-ELSE, CASE)
 The best of all languages

One important difference between ST and traditional programming languages is the nature of
program flow control. A ST program will be run from beginning to end many times each
second. A traditional program should not reach the end until it is completely finished.

ST has been designed to work with the other PLC programming languages. For example, a
ladder logic program can call a structured text subroutine.
Function block diagram (FDB)

FBD is a graphical programming language. Existing program organization unit, e.g. libraries, can be linked
graphically. This type of programming is particularly suited for boolean operations as the signal flow is clearly
presented

Function Block Diagrams (FBDs) are another part of the IEC 61131-3 standard. The primary concept behind a
FBD is data flow. In these types of programs the values flow from the inputs to the outputs, through function
blocks.

FBD Function Block Diagram

OR
OR A
ANND
D
i1
i1 q1
q1
i2
i2 i3
i3

 Functions are represented as function blocks.

 The programming is similar to an electronic wiring diagram
 Easy to understand
Continuous Function Chart (CFC)

The continuous function chart is based on the function chart. However, CFC does not work
with networks but with elements that can be placed as required. This allows for example for
feedback.

Sequential function charts (SFC )

SFC is a graphical programming language that mainly serves for coding step chain controls. It
Organizes a control process. The most important elements of SFC are steps that represent a
certain condition of the machine or equipment (e.g. lift moves upward/downward, or machine in
teach mode)
Actions that contain the control algorithm of the condition can be added to steps.
There are transitions (transition conditions) between the steps that are responsible for the
transition to the next step. Steps and transitions are connected with each other through
directed connections.
This means there is a sequence of steps and transitions in SFC that alternate and are
connected with each other. Such a sequence is referred to as sequence cascade.
All of the previous methods are well suited to processes that have a single state active at any
one time. This is adequate for simpler machines and processes, but more complex machines
are designed to perform simultaneous operations. This requires a controller that is capable of
concurrent processing - this means more than one state will be active at any one time. This
could be achieved with multiple state diagrams, or with more mature techniques such as
Sequential Function Charts.

SFC Sequential Function Chart

Key features
 Sequence represented in the form of a diagram, comparable with a flow diagram
 Important elements are steps with action blocks and transitions
 The actions are instructions which are executed as long as the step is active
 A transition at the output of the step decides how long the step is been executed
Instruction List (IL)

IL is a textual programming language similar to assembler. As the name indicates, the code
consists of a list of instructions. Each instruction starts with a new line. The code can only be
structured conditionally. Branching is implemented using jumps (JMP).

Instruction list (IL) programming is defined as part of the IEC 61131 standard. It uses very
simple instructions similar to the original mnemonic programming languages developed for
PLCs.

It is the most fundamental level of programming language - all other programming languages
can be converted to IL programs. Most programmers do not use IL programming on a daily
basis, unless they are using hand held programmers.

IL Instruction List

LD i1
OR i2
AND i3
ST q1

 Assembler-like programming language (like S5)

 Line-oriented: only one instruction per line
 Still the most usual programming language in Europe.
Program Organization Unit

It is used to modularize the User PLC program. POUs can be implemented in any type of
programming language

Program Organization Unit (POU)

Functions, function blocks, and programs are program organization units to which actions can
be added. Each POU consists of a declaration part and a code. The code is written in one of
the IEC 61131-3 programming languages IL, ST, LD, FBD or CFC. POUs can invoke other
POUs. Recursions are not allowed.
Elements of POU

A POU consist of the following parts:

− Definition of the POU Type with POU Name (and Data type with Functions)
− Declaration section with the variable declarations
− POU−Body with the program code

Function (FUN)

A function is a POU that when executed delivers exactly one data element (this itself can
contain more elements such as a field or a structure).

This means FUNs do not have a memory to store states. When they are called using the same
arguments, they will always return the same value.

When declaring a function it is important that the function contains a return type.
A function can be used as often as required in the entire project. FUNs need not be
instantiated because the data of functions are temporary.
Data and procedure (instructions in the program) can be encapsulated and hidden.
Functions can be called from programs, function blocks and functions.

Parameterized POU without static variables (without memorized values), which returns
always the same result with the same input parameters as a function result value.

The call for this POU in text languages can occur as an operator in expressions.
Programmer can create his own function and call these functions in the POU as many times as
needed
Function block (FB)

A function block is a program organization unit that returns several data during operation.
Instances (copies) must be created from function blocks. The data of the instances are static.
They are retained until the instance is called the next time.

This means FBs have a memory.

1. Data and procedure can be encapsulated or hidden.
2. FBs can be called from tasks, programs and function blocks.

Parameterized POU with static variables (with memorized values).A Function Block (e.g. Timer
or Counter module) with the same input parameters returns results, which depend on the
status of the internal (VAR) and external (VAR_EXTERNAL) variables, which remain
unchanged between FB−Calls.

Instance of a function block

Instances (copies) of a function block have to be created in order to use a function block.
Each instance possesses its own identifier (the instance name), and a data structure which
contains its inputs, outputs, and internal variables.
Instances are declared locally or globally as variables by indicating the name of the function
block as the type of the instance.
Program (PRG)

A program is a POU that returns several data during operation.

There are no instances (copies) of programs. This means the program only exists once.
The data of programs are static (they are retained until the program is called the next time).
Data and procedure (instructions in the program) can be encapsulated or hidden.
Programs can be called from programs and tasks. A program call in a function is not allowed.

This POU−Type represents the “Main Program” All variables of the complete program, to
which physical address have been assigned (e.g. Inputs and Outputs of the PLC) must be
declared inside of this POU or above (Resources, Configuration) .All remaining properties like
Function blocks

Program code section (POU Body)

In the Program section of a POU the binary logic and/ or the data processing is to be
programmed using one of the following programming languages
− Instruction list (IL)
− Ladder Diagram (LD)
− Functions block diagram (FBD)
− Structured Text (ST)
Declaration section of Program Organization Units (POU)

A PLC’s memory system is very complex, allowing it to store information not only about the
control program but about the status of all the inputs and outputs as well. To keep track of all
this information, it uses a system called addressing or variables declaration. An address or
declaration is a label or number that indicates where a certain piece of information is located
in a PLC’s memory.

Declarations are used to define all variables of a POU. A project variable in the declaration
can be bound to a specific input, output or memory address of the control configured in the
device tree.

Variables are of two types Local variables and Global variables

Global variable declaration area: All variables defined in these objects are recognized
throughout the project or all POUs in that project.

Local variable declaration area: All variables defined in these objects are recognized only by
this POU in which it is declared.
All of the local variables of a block are declared between the keywords VAR and END_VAR.
External access to local variables is not possible. In other words, they can not be written from
the outside.

The keyword "AT" must be followed by a valid address that corresponds with the currently
active control configuration in the device tree.

Note the following when assigning a variable to an address:

● Write access to variables assigned an input is not possible.

● AT declarations can only be carried out for local and global variables, not for input and
output block variables.
● If AT declarations are used with structure or function block components, all instances
will use the same memory, which is the same as using static variables in classic
programming languages such as "C".
● The memory layout of structures is dependent on the target system

Several variable types:

VAR_INPUT Input variables

VAR_OUTPUT Output variables
VAR Local variables
VAR_GLOBAL Global variables
VAR_IN_OUT Variable can be changed and returned
VAR_RETAIN Variable keeps value after power off
VAR_PERSISTANT Variable keeps value after software redeployment

Example:

VAR
Loc1: INT; (* Loc1 is a Local Variable*)
END_VAR

Between the keywords VAR_GLOBAL and END_VAR all the global variables of a POU are
declared. These have external connection; in other words, they can be written from the outside

Example:
VAR_GLOBAL
Global_Var1: REAL; (* Global_Var1 is Global Variable*)
END_VAR

Usage of Variable types inside of the 3 POU Types

as shown in the table above, all variable types can be used together with a “Program”
1. Function blocks cannot provide global variables to other POU’s, this is only permitted in
Programs, Resources and Configurations
2. Function blocks can access such global variables only by using the variable type
“VAR_External”
3. Functions are the most restrictive POU’s, because they can only use “VAR” and
“VAR_INPUT” variable types
4. Functions return their “Result” via the Function Value
5. Except for the “Local” variable type “VAR”, all other variable types can be used to
exchange information between different POU’s
Formal parameters and Return values of a POU

Input Variables - VAR_INPUT

Variables that are used as input variables for a block are declared between the keywords
VAR_INPUT and END_VAR.

This means that when the block is called, a value can be transferred to these variables.

1.The actual parameters are passed on to the POU as values i.e. not the variable itself is
passed to the POU but a copy of it

2. This assures that the value passed via the input variable cannot be altered inside of the
called POU

3. This concept is also known as call by value

Example

Output variables - VAR_OUTPUT

All output variables of the block are declared between the keywords VAR_OUTPUT
and END_VAR.

This means that the values of these variables can be returned to the block called. They can be
queried and used there.

Example
VAR_OUTPUT
iOut1:INT; // 1st Output variable
END_VAR
Formal parameter (VAR_IN_OUT)
Variables that are used as input-output variables for a block are declared between
the keywords VAR_IN_OUT and END_VAR.

1. The actual parameters are passed on to the POU as a pointer to its memory location,
i.e. the variable itself is passed on to the POU and can be read and altered inside of the
called POU
2. Alterations of the value affect directly the value of passed variable outside of the POU
3. This concept is also know as call by reference
4. This type of variable offers “Pointers”, like in high level languages (e.g. “C”),
5. in a high level language they are used as Return values from subroutines, by returning
the memory address of the corresponding parameter

Global variables
Variables, constants or remanent variables that are to be recognized across the entire project
can be declared as global variables.
The variables are declared locally between the keywords VAR_GLOBAL and
END_VAR
External and internal access to Variables
Validity of variables
Retain and Persistent Variables

Remanent variables can retain their value throughout the usual program run period.
These include Retain variables and Persistent variables.

Retain variables are identified by the keyword RETAIN. These variables maintain their value
even after an uncontrolled shutdown of the controller as well as after a normal switch OFF and
ON of the controller (resp. at the command 'Online' 'Reset. When the program is run again, the
stored values will be processed further. A concrete example would be an piece-counter in a
production line, that recommences counting after a power failure.

Retain variables retain their value after an uncontrolled shutdown or in response to the online
command Warm reset as well as after switching the control OFF and ON normally (reboot).
When the program restarts, the saved values are used for further processing.

All other variables are reinitialized in this case, either with their initialized values or with default
initialization.

However, retain variables are reinitialized in case of a Reset (origin) Reset (cold) or a new
program download.

The retain property can be combined with the persistent property

All other variables are newly initialized, either with their initialized values or with the standard
initializations.

Contrary to Persistent variables, Retain Variables are reinitialized at a new download of the
program.

If a local variable is declared as RETAIN in a program, this exact variable is saved in the retain
area (like a global retain variable).

If a local variable is declared as RETAIN in a function block, the entire instance of this function
block is saved in the retain area (all of the block data), although only the declared retain
variable is treated as such.

If a local variable is declared in a function as RETAIN, it has no effect! The variable is not
saved in the retain area! If a local variable is declared as PERSISTENT is a function, it also
has no effect

Persistent variables are identified by the keyword PERSISTENT. Unlike Retain variables,
these variables retain their value after a re-Download (i.e. not at the command 'Online'
'Reset'), because they are not saved in the "retain area". If also persistent variables should
maintain their values after a uncontrolled shutdown of the controller, then they have to be
declared additionally as VAR RETAIN PERSISTENT variables. A concrete example of
"persistent Retain-Variables" would be a operations timer that recommences timing after a
power failure.

Example:
VAR RETAIN
rem1:INT; (* 1. Retain variable*)
END_VAR

Example
VAR PERSISTENT
rem1:INT; (* 1. Persistent variable*)
END_VAR

Example:
VAR RETAIN PERSISTENT
rem1:INT; (* 1. Retain Persistent variable*)
END_VAR

If a local variable is declared as VAR RETAIN, then exactly that variable will be saved in the
retain area (like a global retain variable)
• If a local variable in a function block is declared as VAR RETAIN, then the complete instance
of the function block will be saved in the retain area (all data of the POU), whereby only the
declared retain variable will be handled as a retain.
• If a local variable in a function is declared as VAR RETAIN, then this will be without any
effect. The variable will not be saved in the retain area ! If a local variable is declared as
PERSISTENT in a function, then this will be without any effect also !

Constants

Constants are identified by the key word CONSTANT. They can be declared locally or globally.

Syntax:
VAR CONSTANT
<Identifier>:<Type> := <initialization>;
END_VAR

Example:

VAR CONSTANT
con1:INT:=12; (* 1. Constant*)
END_VAR
Variables declaration

A variables declaration has the following syntax:

<Identifier> {AT <Address>}:<Type> {:=<initialization>};

The parts in the braces {} are optional.

Regarding the identifier, that is the name of a variable, it should be noted that it may not
contain spaces or umlaut characters, it may not be declared in duplicate and may not be
identical to any keyword. Upper/lowercase writing of variables is ignored, in other words VAR1,
Var1 and var1 are not different variables. Underlines in identifiers are meaningful, e.g. A_BCD
and AB_CD are interpreted as different identifiers. Multiple consecutive underlines at the
beginning of an identifier or within a identifier are not allowed. The length of the identifier, as
well as the meaningful part of it, are unlimited.

All declarations of variables and data type elements can include initialization. They are brought
about by the ":=" operator. For variables of elementary types, these initializations are
constants. The default initialization is zero for all declarations

Example:

var1:INT:=12; (* Integer variable with initial value of 12*)

If you wish to link a variable directly to a definite address, then you must declare the variable
with the keyword AT.

If we wish to link a variable directly to a definite address, then we must declare the variable
with the keyword AT. The advantage of such a procedure is that you can assign a meaningful
name to an address, and that any necessary changes of an incoming or outgoing signal will
only have to be made in one place (e.g., in the declaration).
Notice that variables requiring an input cannot be accessed by writing. A further restriction is
that AT declarations can only be made for local and global variables and not for input- and
output variables from POUs.

Examples:

counter_heat7 AT %QX0.0: BOOL;

lightcabinetimpulse AT %IX7.2: BOOL;
download AT %MX2.2: BOOL;
Global variable declaration

Example

VAR_GLOBAL
(* Variables declarations *)
END_VAR

Editing Remanent Global Variables Lists

If they are supported by the runtime system, remanent variables may be processed. There are
two types of remanent global variables:

Retain variables remain unchanged after an uncontrolled shutdown of the runtime system
(off/on) or an 'Online' 'Reset' in IndraLogic. Persistent variables remain unchanged after a
controlled shutdown of the runtime system (stop, start) or an 'Online' 'Cold reset' or a
download.

Persistent variables are not automatically also Retain variables !

Remanent variables are additionally assigned the keyword RETAIN or PERSISTENT.

Network variables are also defined in this syntax.

Syntax:
VAR_GLOBAL RETAIN
(* Variables declarations *)
END_VAR
VAR_GLOBAL PERSISTENT
(* Variables declarations *)
END_VAR
Behavior of variables after Power Off / ON and Stop / Run (Remanence)

Like in the previous generation of PLC’s, the behavior of variables after Power OFF/ON and
Stop / Run can be affected by internal settings. PLC software is using the statements
“VAR_RETAIN” and VAR_PERSISTENT” in the declaration section, to determine, if the
Status / Value of a variable is cleared after Power OFF/ON or Stop / Run or not.

Case A

Case B
VAR

Between VAR and END_VAR, all local variables of a program organization unit are declared.
They do not have a link to the outside, which means writing them externally is not possible.
VAR_INPUT
Between VAR_INPUT and END_VAR, all variables are declared that serve as input variable of
a program organization unit. This means the value of the variable can be transferred at the
point of calling. These input variables are transferred (read) to the function block.
VAR_OUTPUT
Between VAR_OUTPUT and END_VAR, all variables are declared that serve as output
variables of a program organization unit. This means these values are returned to the calling
program organization unit where they can be queried and used further. These output variables
are transferred (written) to the function block.
VAR_RETAIN
Remanent variables can retain their value longer than the usual program runtime. Remanent
variables are retain variables and persistent variables. These variables retain their values after
an uncontrolled shutdown and after switching on and off the controller (according to the
’Online’ ’Reset’) command.
When the program is restarted, the stored values are used for further processing.
However, retain variables are reinitialized in the event of ’Reset Cold’, ’Reset Origin’ and,
unlike persistent variables, in the event of another program Download.
VAR_CONSTANT
Constants are identified using the keyword CONSTANT. They can be declared locally or
globally.
VAR_GLOBAL
Declare variables as local variables if they have to be known in the entire project.
This is not done in the variable declaration window but in a special editor: in the PLC Editor,
choose the tab ’Resources’ in the folder 'Global Variables'. The editor for global variables
works like the declaration editor.
VAR_IN_OUT
Between VAR_IN_OUT and END_VAR, all variables are declared that serve as input and
output variables of a program organization unit. Important: With these variables, the value of
the transferred variable is directly modified!
Task configuration

A task is a temporal processing unit of an IEC program. It is defined by a name, priority and
type that specifies the condition, which triggers the task. This condition can either be defined
with respect to time (cycle interval, free-wheeling), or by an internal or external event that
triggers the task (e.g. rising edge of a global project variable or an interrupt event of the
controller). Each task can be assigned a sequence of programs POUs that is to be processed
while the task is being executed. The interaction of priority and condition defines the
chronological order in which the task is processed. A watchdog can be configured for each
task.

We can also control the processing of your PLC project using the task management.

A Task is a time unit in the processing of an IEC program. It is defined by a name, a priority
and by a type determining which condition will trigger the start of the task. This condition can
be defined by a time (cyclic, freewheeling) or by an internal or external event which will trigger
the task; e.g. the rising edge of a global project variable or an interrupt event of the PLC
controller.

For each task you can specify a series of POUs programs that will be started by the task. If the
task is executed in the present cycle, then these programs will be processed for the length of
one cycle.

The combination of priority and condition will determine in which chronological order the tasks
will be executed.

For each task we can configure a watch dog (time control) can be configured.

Additionally there is the possibility to link System events (e.g. Start, Stop, Reset) directly with
the execution of a project POU.

Different types of task that can be configured for the PLC program are

The task will be processed cyclic according to the time definition Eg. T#20ms

Interval
1. the period of time, after which the task should be restarted
2. If a number is entered, then you can choose the desired time in mS
Inputs in [ms] −format will be shown in the TIME format (e.g. ”t#200ms”)

Watchdog
Time −> Monitoring time, after which the PLC is stopped with a “Cycle time error”
Sensitivity−> Number of times the Monitoring time can be triggered, before the PLC
goes to STOP
The task will be processed as soon as the program is started and at the end of
one run, program/task will be automatically restarted in a continuous loop. There is no cycle
time defined.

The task will be started as soon as the variable, which is defined in the gets a rising edge.

The task will be started as soon as the system event, Ex. External digital input connected to
PLC hardware Input module gets the rising edge

For the execution of a Task, the following rules apply:

1. That task is executed, whose condition has been met; i.e., if its specified time has expired,
or after its condition (event) variable exhibits a rising edge
2. If several tasks have a valid requirement, then the task with the highest priority will be
executed
3. If several tasks have valid conditions and equivalent priorities, then the task that has had
the longest waiting time will be executed first.
4. The processing of the program calls will be done according to their order (top down) in the
task editor
Library Manager

The library manager shows all libraries that are connected with the current project. The POUs,
data types, and global variables of the libraries can be used the same way as user-defined
POUs, data types, and global variables.

The ’standard.lib’ library can be integrated in the PLC Editor to use IEC61131-3 standard
modules. In addition to this library, the PLC Editor offers a great number of other libraries to
optimize the PLC program very easily

The ’standard.lib’ library is available as standard. It contains all functions and function modules
required as standard modules by IEC61131-3 for an IEC programming system.
The difference between a standard function and an operator is that the operator is implicitly
known to the programming system whereas the standard modules have to be linked to the
project as library.

Elements of the ’util.lib’ library

This library contains an additional collection of various modules that can be used for BCD
conversion, bit/byte functions, mathematical help functions, as controllers, signal generators,
function manipulators as well as for processing analog values.
Module categories:
 BCD conversion
 Bit/byte functions
 Mathematical help functions
 Controller
 Signal generators
 Function manipulators
 Analog value processing

Arrays

An Array is a powerful data structure that stores variable data having the same data type. It is
just like a small fixed number of boxes linked together one after the other storing things that
are related to each other. An array is said to be a static data structure because, once declared,
its original size that is specified by the programmer will remain the same throughout the whole
program and cannot be changed.

Example

Var

myArray : Array[1..20] of Integer;

myArray2 : Array[1..50] of REAL;

<arrayName> : Array[n..m] of <Data Type>;

END_Var

An array data structure defines the size of the array and the data type that it will
use for storing data. In the above example, the array stores up to 20 integers OR
50 real numbers . This size depends on your program requirements.

Arrays are used just like ordinary variables. They are used to store typed data just
like the ordinary variables. To assign data to arrays and read data from arrays see
below example .

In the example above, we have declared 20 integers and we should be able to

access each and one of them and here is how we do it.
To assign values to a particular integer of an array, we do it like this:

myArray[5] := 10;
myArray[1] := 25;

<arrayName>[index] := <relevant data>

Reading the value from Array

Reading a value from an array is done as follows:

Var
myVar : Integer;
myArray : Array[1..5] of Integer;
End_Var

Inside PLC program (ST)

myArray[2] := 25;
myVar := myArray[2];

In the PLC variable <<myVar>>, the value of array element 2 is read

Just like ordinary variables, arrays should be initialized, otherwise scrap data will remain stored
in them. If we want to initialize 2 whole 20-sized integer and boolean arrays to 0 and false
respectively, we do it like below

Var
i : INT;
myIntArray : Array[1..20] OF INT;
myBoolArray : Array[1..20] OF BOOL;

End_var

FOR i := 1 to 20 DO

myIntArray[i] := 0;
myBoolArray[i] := FALSE;

END_FOR
Data structures

A data structure is a user-defined data type that groups various data together. By grouping the
data, large volumes of data handled by a program are made easier to understand and can be
registered or changed much easier.

Data structures are used in almost every program or software system. Data structures provide
a means to manage huge amounts of data efficiently, such as large databases and internet
indexing services usually, efficient data structures are a key to designing efficient algorithms.
Some formal design methods and programming languages emphasize data structures, rather
than algorithms, as the key organizing factor in software design.

Records are among the simplest data structures. A record is a value that contains other
values, typically in fixed number and sequence and typically indexed by names. The elements
of records are usually called fields or members.

Data structure that, unlike arrays, collects different data types that define a particular structure
such a book, product, person and many others. The programmer defines the data structure
under the Type user definition.

Data can be easily reused as one entity. If the same pattern is repeated in the data, you can
define a data structure to enable easily reusing the data in programming

Data can be easily changed. Even if there are changes to the data, the definition of the data
structures can be modified to automatically change the data structures symbols in the symbol
table as well.
Example 2

In the PLC program we can use array of Instance for the data types as follows.

Pointers

Pointers in a PLC are the same thing as pointers in a regular computer program. They are a memory
location that "points to" another memory location. In PLC programming it is sometimes also referred to
as "indirect addressing".

For example, if we have a variable V100 which is a pointer, then the contents of V100 will point to
another address. If V100 contained the value "1234", then a read instruction that dealt with it as a
pointer could use that to read address "V1234". If we change V100 to "1235", the read instruction
would now be reading from address "V1235".

There are lots of applications where we want to be able to do things like this, primarily involving things
like looking up tables of data where the address we want to read is based on the result of some
calculation or logic.

For example, if we had parameters stored in the PLC for 10 different product models, you could read the
correct parameter set based on an offset which you could calculate from the model index.
Pointers with array

Program in ST

Monitoring
SCADA

SCADA (supervisory control and data acquisition) generally refers to industrial control system (ICS):
That is computer systems that monitor and control industrial, infrastructure, or facility-based processes,
as described below:

 Industrial process include those of manufacturing, production, power generation, fabrication and
refining, and may run in continuous, batch, repetitive, or discrete modes.
 Infrastructure processes may be public or private, and include water treatment and distribution,
wastewater collection and treatment, oil and gas pipelines, electrical power transmission and
distribution, wind farms, Civil defense sirens systems, and large communication systems.
 Facility processes occur both in public facilities and private ones, including buildings, airports,
ships, and space stations. They monitor and control HVAC access, and energy consumption.
 For machine operation , production data monitoring, generating production reports, Trend
monitoring of certain process parameters like temperature, viscosity & Diagnostic system in
Factory automation machines.

Components of SCADA system

A SCADA system usually consists of the following subsystems:

A Human machine interface or HMI is the apparatus which presents process data to a human
operator and through this, the human operator monitors and controls the process.

A supervisory (computer) system, gathering (acquiring) data on the process and sending commands
(control) to the process.

Remote terminal Units (RTUs) connecting to sensors in the process, converting sensor signals to
digital data and sending digital data to the supervisory system.

(PLCs) used as field devices because they are more economical, versatile, flexible, and configurable
than special-purpose RTUs.

Communication infrastructure connecting the Supervisory system to the Remote terminal units either
on Ethernet or RS485 bus or some form of Network communication.

Various process and analytical instrumentation

Supervision Vs Control ( SCADA Vs DCS)

There is, in several industries, considerable confusion over the differences between SCADA systems
and Distributed control system (DCS). Generally speaking, a SCADA system always refers to a system
that coordinates, but does not control processes in Real time. The discussion on real-time control is
covered by newer telecommunications technology, enabling reliable, low latency, high speed
communications over wide areas. Most differences between SCADA and DCS are culturally determined
and can usually be ignored. As communication infrastructures with higher capacity become available,
the difference between SCADA and DCS will fade.

However

 DCS is process oriented, while SCADA is data acquisition oriented.

 DCS is process driven, while SCADA is event driven.
 DCS is commonly used to handle operations on a single locale, while SCADA is preferred for
applications that are spread over a wide geographic location

The term SCADA usually refers to centralized systems which monitor and control entire sites, or
complexes of systems spread out over large areas (anything from an industrial plant to a nation). Most
control actions are performed automatically by RTUs or by PLCs. Host control functions are usually
restricted to basic overriding or supervisory level intervention. For example, a PLC may control the flow
of cooling water through part of an industrial process, but the SCADA system may allow operators to
change the set points for the flow, and enable alarm conditions, such as loss of flow and high
temperature, to be displayed and recorded. The feedback control loop passes through the RTU or PLC,
while the SCADA system monitors the overall performance of the loop.

Data acquisition begins at the RTU or PLC level and includes meter readings and equipment status
reports that are communicated to SCADA as required. Data is then compiled and formatted in such a
way that a control room operator using the HMI can make supervisory decisions to adjust or override
normal RTU (PLC) controls. Data may also be fed to a Historian, often built on a commodity Database
Management system, to allow trending and other analytical auditing.

SCADA systems typically implement a distributed database, commonly referred to as a tag database,
which contains data elements called tags or points. A point represents a single input or output value
monitored or controlled by the system. Points are normally stored as value-timestamp pairs: a value,
and the timestamp when it was recorded or calculated. A series of value-timestamp pairs gives the
history of that point. It's also common to store additional metadata with tags, such as the path to a field
device or PLC register, design time comments, and alarm information.

A Human machine interface or HMI is the apparatus which presents process data to a human operator,
and through which the human operator controls the process.

An HMI is usually linked to the SCADA system's databases and software programs, to provide trending,
diagnostic data, and management information such as scheduled maintenance procedures, logistic
information, detailed schematics for a particular sensor or machine, and expert-system troubleshooting
guides.

The HMI system usually presents the information to the operating personnel graphically, in the form of
a mimic diagram. This means that the operator can see a schematic representation of the plant being
controlled. For example, a picture of a pump connected to a pipe can show the operator that the pump is
running and how much fluid it is pumping through the pipe at the moment. The operator can then switch
the pump OFF. The HMI software will show the flow rate of the fluid in the pipe decrease in real time.
Mimic diagrams may consist of line graphics and schematic symbols to represent process elements, or
may consist of digital photographs of the process equipment overlain with animated symbols.

The HMI package for the SCADA system typically includes a drawing program that the operators or
system maintenance personnel use to change the way these points are represented in the interface. These
representations can be as simple as an on-screen traffic light, which represents the state of an actual
traffic light in the field, or as complex as a multi-projector display representing the position of all of the
elevators in a skyscraper or all of the trains on a railway.

An important part of most SCADA implementations is alarm handling. The system monitors whether
certain alarm conditions are satisfied, to determine when an alarm event has occurred. Once an alarm
event has been detected, one or more actions are taken (such as the activation of one or more alarm
indicators, and perhaps the generation of email or text messages so that management or remote SCADA
operators are informed). In many cases, a SCADA operator may have to acknowledge the alarm event;
this may deactivate some alarm indicators, whereas other indicators remain active until the alarm
conditions are cleared. Alarm conditions can be explicit—for example, an alarm point is a digital status
point that has either the value NORMAL or ALARM that is calculated by a formula based on the values
in other analogue and digital points—or implicit: the SCADA system might automatically monitor
whether the value in an analogue point lies outside high and low limit values associated with that point.

Examples of alarm indicators include a siren, a pop-up box on a screen, or a coloured or flashing area on
a screen (that might act in a similar way to the "fuel tank empty" light in a car); in each case, the role of
the alarm indicator is to draw the operator's attention to the part of the system 'in alarm' so that
appropriate action can be taken.

SCADA solutions often have Distributed control system (DCS) components. Use of "smart" RTUs or
PLCs, which are capable of autonomously executing simple logic processes without involving the
master computer, is increasing. A standardized control programming language, IEC61131-3 (a suite of 5
programming languages including Function Block, Ladder, Structured Text, Sequence Function Charts
and Instruction List), is frequently used to create programs which run on these RTUs and PLCs. Unlike
a procedural language such as the C programming language or Fortran, IEC 61131-3 has minimal
training requirements by virtue of resembling historic physical control arrays. This allows SCADA
system engineers to perform both the design and implementation of a program to be executed on an
RTU or PLC.

A programmable automation controller (PAC) is a compact controller that combines the features and
capabilities of a PC-based control system with that of a typical PLC. PACs are deployed in SCADA
systems to provide RTU and PLC functions. In many electrical substation SCADA applications,
"distributed RTUs" use information processors or station computers to communicate with digital
protective relays, PACs, and other devices for I/O, and communicate with the SCADA master in lieu of
a traditional RTU.

Most of major PLC manufacturers have offered integrated HMI/SCADA systems, many of them using
open and non-proprietary communications protocols. Numerous specialized third-party HMI/SCADA
packages, offering built-in compatibility with most major PLCs, have also entered the market, allowing
mechanical engineers, electrical engineers and technicians to configure HMIs themselves, without the
need for a custom-made program written by a software developer.

Remote terminal unit

The RTU connects to physical equipment. Typically, an RTU converts the electrical signals from the
equipment to digital values such as the open/closed status from a switch or a valve, or measurements
such as pressure, flow, voltage or current. By converting and sending these electrical signals out to
equipment the RTU can control equipment, such as opening or closing a switch or a valve, or setting the
speed of a pump. It can also control the flow of a liquid.
Supervisory station

The term supervisory station refers to the servers and software responsible for communicating with the
field equipment (RTUs, PLCs, etc.), and then to the HMI software running on workstations in the
control room, or elsewhere. In smaller SCADA systems, the master station may be composed of a single
PC. In larger SCADA systems, the master station may include multiple servers, distributed software
applications, and disaster recovery sites. To increase the integrity of the system the multiple servers will
often be configured in a dual-redundant or hot-standby formation providing continuous control and
monitoring in the event of a server failure.

For some installations, the costs that would result from the control system failing are extremely high.
Possibly even lives could be lost. Hardware for some SCADA systems is ruggedized to withstand
temperature, vibration, and voltage extremes, but in most critical installations reliability is enhanced by
having redundant hardware and communications channels, up to the point of having multiple fully
equipped control centres. A failing part can be quickly identified and its functionality automatically
taken over by backup hardware. A failed part can often be replaced without interrupting the process. The
reliability of such systems can be calculated statistically and is stated as the mean time to failure, which
is a variant of mean time between failures.The calculated mean time to failure of such high reliability
systems can be on the order of centuries.

Communication infrastructure and methods

SCADA systems have traditionally used combinations of radio and direct serial or modem connections
to meet communication requirements, although synchronous optical networking is also frequently used
at large sites such as railways and power stations. The remote management or monitoring function of a
SCADA system is often referred to as telemetry.

Some customers wanting SCADA data to travel over their pre-established corporate networks or to share
the network with other applications. SCADA protocols are designed to be very compact and many are
designed to send information to the master station only when the master station polls the RTU or PLC.

Typical legacy SCADA protocols include MODBUS RTU, PROFIBUS, OPC on TCP/IP etc. These
communication protocols are all SCADA-vendor specific but are widely adopted and used. Standard.
These communication protocols are standardized and recognized by all major SCADA vendors. Many of
these protocols now contain extensions to operate over TCP/IP. Although some believe it is good
security engineering practice to avoid connecting SCADA systems to the Internet

Many industries, such as wastewater collection and water distribution, have used existing cellular
networks to monitor their infrastructure along with internet portals for end-user data delivery and
modification. This practice has been ongoing for many years with no known data breach incidents to
date. Cellular network data is fully encrypted, using sophisticated encryption standards, before
transmission and internet data transmission, over an "https" site, is highly secure.

Recently, OLE for process control (OPC) has become a widely accepted solution for
intercommunicating different hardware and software, allowing communication even between devices
originally not intended to be part of an industrial network.
Field bus systems

Fieldbus is an industrial network system for real-time distributed control. It is a way to connect
instruments in a manufacturing plant. Fieldbus works on a network structure which typically allows
daisy chain, star, ring, branch, and tree network topologies.

Previously computers were connected using RS232 serial communications systems) by which only two
devices could communicate.

While the fieldbus is the equivalent of the current LAN type connections, which require only one
communication point at the controller level ( Master ) and allow multiple (hundreds) of Analog and
Digital points to be connected at the same time. This reduces both the length of the cable required and
the number of cables required. Furthermore, since devices that communicate through fieldbus require a
microprocessor , multiple points are typically provided by the same device.

In electrical and electronic engineering a daisy chain is a wiring scheme in which multiple devices are
wired together in sequence or in a ring. Daisy chains may be used for power, analog signals, digital data,
or a combination thereof.

There are a wide variety of concurring fieldbus standards. They are also now named as classical field
bus system Some of the most widely used ones include:

 AS Interface
 CanOpen
 Profibus
 DeviceNet
 Interbus
 MODBUS
 SERCOS Interface
 Etc.,

 Overview Fieldbus systems (classic, Ethernet-based)

 Fieldbus systems (mostly based on RS485)

- PROFIBUS
- DeviceNet
- CANopen

 Industrial Real-time Ethernet

- EtherNet/IP
- PowerLink
- PROFINET
- SERCOS III
- EtherCAT
 - ...

Recently a number of Ethernet-based industrial communication systems have been established, most of
them with extensions for real-time communication. These have the potential to replace the traditional
field buses in the long term. Ethernet technology combines the peripheral, drive, safety functionality and
office communication in a common medium , providing a simple, cost-effective and powerful solution.

Fast Ethernet technology offers number of advantages

1. Recognized, future proof technology

2. Data throughput 10 to 100 times faster then classical field bus solutions
3. No need for expensive, proprietary hardware
4. Use of Standard components, Ex. CAT5e copper cable with double shielding . ( Standard
Ethernet cable)
5. Consistent information technology (IT) implementations stretching from the office to the field
level
6. Flexible , compatible automation systems based on a global standard
7. Supports worldwide networking for diagnostics and maintenance

Some of the new Ethernet-based industrial communication systems:

 EtherCAT
 EtherNet/IP
 Ethernet Powerlink
 PROFINET IO
 PROFINET IRT
 SERCOS III
The most important ones are

Field bus systems

Advantages

1. For large transfer lines, using Field bus concept different decentralized nodes can be created and
the Digital and Analog I/Os and other accessories can be distributed into these nodes.
2. This will reduce wiring and cost
3. Easy to trouble shoot and thereby reduce the machine downtime.

Disadvantages

 Fieldbus systems are more complex, so users need to be more extensively trained or more highly
 qualified
 The price of fieldbus components is higher
 Slightly longer reaction times with fieldbus, depending on the system
 One or more fieldbus standards may predominate in future and others may become obsolete.
This increases the investment risk when implementing fieldbus
Profibus

Profibus communication is used to exchange data with Master profibus control

There are two variations of PROFIBUS in used today; the most commonly used PROFIBUS DP, and the
lesser used, application specific, PROFIBUS PA:

 PROFIBUS DP (Decentralized Peripherals) is used to operate sensors, drives, PLCs, actuators ,

Barcoders etc., via a centralized controller in production (factory) automation applications. The
many standard diagnostic options, in particular, are focused in this system

 PROFIBUS PA (Process Automation) is used to monitor measuring equipment via a process

control system in process automation applications. This variant is designed for use in
explosion/hazardous areas . The Physical Layer (i.e. the cable) conforms to IEC 61158-2, which
allows power to be delivered over the bus to field instruments, while limiting current flows so
that explosive conditions are not created, even if a malfunction occurs. The number of devices
attached to a PA segment is limited by this feature. PA has a data transmission rate of 31.25
kbit/s. However, PA uses the same protocol as DP, and can be linked to a DP network using a
coupler device. The much faster DP acts as a backbone network for transmitting process signals
to the controller. This means that DP and PA can work tightly together, especially in hybrid
applications where process and factory automation networks operate side by side.
  In this bus topology Data transmission between the Master Profibus control and slave
profibus is using twisted pair cables with impedances of 150 ohms . Speed of data
transmission ranges from from 9.6 kbit/s to 12 Mbit/s can be used. The cable length
between two nodes is limited from 100 to 1200 m, depending on the bit rate used.
Number of possible nodes is 128. This transmission method is primarily used with
PROFIBUS DP.
 With MBP (Manchester Bus Powered) transmission technology, data and field bus
power are fed through the same cable. The power can be reduced in such a way that
use in explosion-hazardous environments is possible. The bus topology can be up to
1900 m long and permits branching to field devices (max. 60 m branches). The bit rate
here is a fixed 31.25 kbit/s. This technology was specially established for use in process
automation for PROFIBUS PA.

Every Profibus slave needs to be configured with Profibus master control . This requires the
corresponding device data sheet for the slave device. Every profibus slave manufacturer
supplies their device data sheet in form of "RX**0107.GSD" ( GSD file ). This file has to be
included in the Master control. This GSD-file, when configuring the bus master, is required for
each node

Profiles are pre-defined configurations of the functions and features available from PROFIBUS
for use in specific devices or applications. Profiles are important for openness, interoperability
and interchangeability, so that the end user can be sure that similar equipments from different
vendors perform in a standardized way. User choice also encourages competition that drives
vendors towards enhanced performance and lower costs.

There are PROFIBUS profiles for Drives, Encoders, Laboratory instruments, Intelligent Pumps,
Pneumatic / hydraulic valve systems, Cameras, Robots , etc

To utilize these functions, various service levels of the DP protocol were defined:

 DP-V0 for cyclic exchange of data and diagnosis

 DP-V1 for acyclic and cyclic data exchange and alarm handling
 DP-V2 for isochronous mode and data exchange broadcast (slave-to-slave
communication)
CanOpen

CANopen is a communication protocol and device profile specification for embedded systems used in
automation.. The CANopen standard consists of an addressing scheme, several small communication
protocols and an application layer defined by a device profile. The communication protocols have
support for network management, device monitoring and communication between nodes, including a
simple transport layer for message segmentation/de-segmentation.

The lower level protocol implementing the data link and physical layers is usually Controller
Area Network (CAN), although devices using some other means of communication (such as
Ethernet Powerlink , EtherCAT) can also implement the CANopen device profile.

For each CanOpen device it is necessary to have an EDS file (*.EDS) which contains the data
required for operating the device on the field bus. This file, when configuring the bus master, is
required for each node. This allows tools such as service tools, configuration tools,
development tools, and others to handle the devices properly. Every vendor with CanOpen
devices provides this EDS file
Some of the data objects used for communications are

 PDO: Process Data Object - Inputs and outputs. Values of type RPM, Voltage, Frequency,
 Current etc.
 SDO: Service Data Object - Configuration settings, possibly NODE ID, baud rate, offset, gain
etc.
 COB-ID: CAN Object Identifiers.
 CAN ID: CAN Identifier. This is the 11 bit CAN message identifier which is at the beginning of
every CAN message on the bus.
 DCF: Device Configuration File. This is modified EDS with settings for node ID and baud rate.

Communication models and Protocol

Different kinds of communication models are used in the messaging between CANopen nodes.

In a master/slave relationship, one CANopen node is designated as the master, which sends or requests
data from the slaves. The NMT protocol is an example of a master/slave communication model.

The NMT protocols are used to issue state machine change commands (e.g. to start and stop the
devices), detect remote device bootups and error conditions.

A client/server relationship is implemented in the SDO protocol, where the SDO client sends data (the
object dictionary index and subindex) to an SDO server, which replies with one or more SDO packages
containing the requested data (the contents of the object dictionary at the given index).

A producer/consumer model is used in the Heartbeat and Node Guarding protocols. In the push-model
of producer/consumer, the producer sends data to the consumer without a specific request, whereas in
the pull model, the consumer has to request the data from the producer.

The Heartbeat protocol is used to monitor the nodes in the network and verify that they are alive.

. A heartbeat producer (usually a slave device) periodically sends a message with binary function code
of 1110 and its node id (COB ID = 0x700 + node id). The data part of the frame contains a byte
indicating the node status. The heartbeat consumer reads these messages. If the messages fail to arrive
within a certain time limit (defined in the object dictionary of the devices) the consumer can take action
to, for example, reset the device or indicate an error.

The SDO protocol is used to set and read values from the object dictionary of a remote device. The
device whose object dictionary is accessed is the SDO server and the device accessing the remote device
is the SDO client. The communication is always initiated by the SDO client. In CANopen terminology,
communication is viewed from the SDO server, so that a read from an object dictionary results in an
SDO upload and a write to dictionary is an SDO download
Process Data Object (PDO) protocol is used to process real time data among various nodes. You can
transfer up to 8 bytes (64bits) data per one PDO either from or to the device. One PDO can contain
multiple object dictionary entries and the objects within one PDO is configurable using the mapping and
parameter object dictionary entries

DeviceNet

DeviceNet is a network system used in the automation industry to interconnect control devices for data
exchange. It uses CAN ( Controller Area Network) as the backbone technology and defines an
application layer to cover a range of device profiles. Typical applications include information exchange,
safety devices, and large I/O control networks.

DeviceNet was originally developed by American company Allen -Bradley (now owned by Rockwell
Automation). It is layered on top of the CAN technology. DeviceNet adapts the technology from
ControlNet, which is another industrial protocol developed by Allen-Bradley, and takes advantage of
CAN, making it low-cost and robust compared to the traditional RS-485 based protocols.
Nodes are distributed along a DeviceNet network by the means of a trunkline-dropline
topology. This topology allows for ease in wiring and access to the network from multiple taps.
In addition, nodes can be easily removed and added to reduce production downtime, increase
network flexibility, and decrease troubleshooting time. Since the physical layer is optically
isolated from device, communication power and device power can share the same bus
(Further reducing the complexity of the network and components within).

DeviceNet supports 125 kbit/s, 250 kbit/s and 500 kbit/s data rates. Depending on the chosen
cable type, DeviceNet can support communication up to 500 meters (Round thick cable).
Typical round cable supports up to 100 meters. While flat style cable supports up to 380
meters at 125 kbit/s and 75 meters at 500 kbit/s.

Up to 64 nodes on a single logical network. (Node addresses range from 0 - 63) The network
has a low node priority scheme

Supports master/slave as well as peer-to-peer communication, although majority of the

devices work in the master/slave configuration

Allows multiple masters on a single logical network. Networked devices can be simultaneously
controlled and configured. Engineered to withstand noisy environments. Supports 4 message
types to/from slave devices (Strobed, Polled, Cyclic, COS (change of state)). Some devices
support more than 1 message type

For each DeviceNet device it is necessary to have an EDS file (*.EDS) which contains the data
required for operating the device on the field bus. This file, when configuring the bus master, is
required for each node. This allows tools such as service tools, configuration tools,
development tools, and others to handle the devices properly.

Example : The EDS file for Rexroth Servo Amplier - IndraDrive device is an ASCII file with the
name "IndraDrive_DVN.EDS".
Field bus system on Ethernet based Protocols

Advantages of Ethernet based protocol compared to traditional field bus system

 Generally accepted in office communications as the world-wide standard

 Makes consistent communication possible from the management level into the field
level
 Basis for the use of IT technology and applications from office communications
 Basis for communication in distributed automation systems
 Offers a transparent and application-neutral protocol
 World-wide networking for maintenance and monitoring equipment
 Large selection of favorable components/assemblies
 100 meter distances possible using economical copper cable
 Higher transmission rate compared with traditional field bus systems
SERCOS III

Meaning of SERCOS is Serial Real Time Communication System

SERCOS III is the third generation of the SERCOS interface a globally standardized open digital
interface for the communication between industrial controls, motion devices, and input/output devices
(I/O). SERCOS III merges the hard real time aspects of the SERCOS interface with Ethernet It is based
upon and conforms to the Ethernet standard (IEEE 802.3 & ISO/IEC 8802-3).

SERCOS III provides

 Cyclic updates to devices at rates as low as 31.25 µsec

 Support for up to 511 Slave devices on one network
 Redundancy: Bump-less physical layer single-fault recovery
 Detection of a dropped physical connection within 25 µsec (less than one cycle update)
 Hot plugging: insertion & configuration of devices into network while cyclic communication is
active
 As it is Ethernet based protocol , standard CAT5e copper cable with double shielding is enough
for communication.

 sercos III is designed in such a way that no additional network infrastructure (standard Ethernet
switches, Hubs, etc.) is required to operate. In fact, no additional standard Ethernet (non-sercos
III capable) components may be placed within a sercos III network, as their presence will
adversely affect the timing and synchronization of the network.
 SERCOS III operates primarily in a Master/Slave arrangement exchanging cyclic data between nodes.
The Master initiates all data transmission during a Sercos real-time cycle. All data transmissions begin
and end at the Master (circular).

Two main types of telegrams are used within the sercos III Cycle. The Master Data Telegram (MDT),
and the Acknowledge telegram (AT). Both telegram types are issued by the Master (control). The MDT
contains information provided by the Master to Slaves. It is filled by the Master, and read by Slaves. The
AT is issued by the Master, but actually populated by each Slave with their appropriate response data
(feedback values, input states, etc.). More than one Slave uses the same AT, filling in its pre-determined
area in the AT telegram, updating checksums, and then passing the telegram to the next device. This
method reduces the impact of the Ethernet frame overhead on the performance of the network The
amount of data sent from the Master to Slaves, as well as the sum of the data returned by the Slaves,
may exceed the maximum 1500-byte data field size. To comply with this limit, sercos III may use more
than one MDT telegram in a cycle, as well as more than one AT telegram (up to 4 in each case).

Communication across a sercos III network occurs in strict cyclic intervals. A cycle time is chosen by
the user for a given application, ranging from 31.25 µsec. to 65 msecs. Within each cycle, data is
exchanged between sercos III nodes using two types of telegrams: MDTs and ATs After all MDTs and
ATs are transmitted, sercos III nodes allow the remaining time in the cycle to be used as an NRT (Non
real time) Channel, which can be used to exchange data using other formats, such as IP.
Each sercos III device contains a numeric address used by other devices on the sercos III network to
exchange data. The address may be any whole integer from 1 to 511

Data Link Physical layer connection for data communications

SERCOS III supports standard 100Base-TX or 100Base-FX (100 Mb/s baseband) Full Duplex physical
layer (PHY) entities. Auto negotiation must be enabled on each PHY, but only 100Mbit full duplex is
supported. Auto (MAU [Media Attachment Unit]-Embedded) Crossover is specified between the two
Physical Medium Attachment (PMA) units present with a duplex port. These two units are referred to as
the Primary Channel and Secondary Channel in the sercos III specification. Dual interfaces are required
(two duplex interfaces per device). Within the sercos III specification the dual interfaces are referred to
as P1 and P2 (Ports 1 and 2).

Connection methods in SERCOS III

Line Topology

A line topology is the simpler of the two possible arrangements, and provides no redundancy. However,
this configuration saves the cost of one cable. In it, only one of the two interfaces on the Master is used.

In it, only one of the two interfaces on the Master is used. Telegrams are issued out of the transmit PMA
on the Master’s active port. Either port on the Master may be the active one. Sercos III determines this
during phase-up (initialization). The first Slave receives the telegrams on the connected interface’s
receive port PMA, modifies them as required, and issues them out on the transmit PMA of the second
interface. Each cascading Slave does likewise until the last Slave in the Line is reached. That Slave,
detecting no sercos III connection on its second port, folds the telegram back on the receiving interface’s
transmit port. The telegram then makes it way through each Slave back to the Master. Note the last
Slave also emits all sercos III telegrams on its second port, even though no sercos III connection is
detected. This is for snooping, ring closures (see below), as well as hot-plugging.
Ring Topology

A ring topology simply closes the network by attaching the unused port on the last device in a ring back
to the unused port on the Master. When the sercos III Master senses that a ring exists, it sets up two
counter-rotating telegrams. The same data is issued simultaneously out of the transmit PMAs of both
ports on the Master. From there both telegrams are managed essentially identically as they make their
way through each Slave, ending back at the opposite port on the Master they were emitted from.
Advantages to this topology include tighter synchronization, as well as automatic infrastructure
redundancy
Redundancy on SERCOS III

When a ring network is employed, sercos III provides for automatic infrastructure redundancy. If any
interconnection point in the ring ceases to function, the associated sercos III nodes will detect a “ring
break” and “loop back” the end nodes, effectively operating as two lines rather than one ring.

The operation is “bump-less”, as the detection & recovery time to such a break is less than 25 µsecs,
which is less than the minimum Sercos III cycle time. Sercos III can also recover from ring breaks and
“heal” with no interruption in operation. Since Sercos III telegrams continue to be emitted by transmit
PMAs on unconnected ports, and receive PMAs on unconnected ports continue to monitor for incoming
data, when a sercos III port recognizes that a ring has by physically re-closed, it will re-activate the
counter-rotating telegrams to functionally close the rings again. This operation is also bump-less.

Hot-plugging

Another feature of Sercos III is hot-plugging, which is the ability to add devices to an active network.
Using the features described for redundancy, a network can detect when a new device is attached to an
active network. Processes exist that configure the new device, and announce it’s availability to the
Master control. After that, the Master control can select to make use of the new device based on the
application currently running.
PROFINET

PROFINET is the open industrial Ethernet standard of PROFIBUS & PROFINET International (PI) for
automation . PROFINET uses TCP/IP and IT standards, and is, in effect, real-time Ethernet.

The PROFINET concept features a modular structure so that users can select the cascading functions
themselves. They differ essentially because of the type of data exchange to fulfill the partly very high
requirements of speed.

In conjunction with PROFINET, the two perspectives PROFINET CBA and PROFINET IO exist.
PROFINET CBA is suitable for the component-based communication via TCP/IP and the real-time
communication for real-time requirements in modular systems engineering. Both communication
options can be used in parallel.

PROFINET IO was developed for real time (RT) and isochronous real time (IRT- It means regularly, or
at equal time intervals) communication with the decentralize periphery. The designations RT and IRT
merely describe the real-time properties for the communication within PROFINET IO.

To achieve these functions, three different protocol levels are defined:

 TCP/IP for PROFINET CBA and the commissioning of a plant with reaction times in the range
of 100ms
 RT (Real-Time) protocol for PROFINET CBA and PROFINET IO applications up to 10 ms
cycle times
 IRT (Isochronous Real-Time) for PROFINET IO applications in drive systems with cycles times
of less than 1ms

Interfacing the peripherals is implemented by PROFINET IO. It defines the communication with field
connected peripheral devices. Its basis is a cascading real-time concept. PROFINET IO defines the
entire data exchange between controllers (devices with "master functionality") and the devices (devices
with "slave functionality"), as well as parameter setting and diagnosis. PROFINET IO is designed for
the fast data exchange between Ethernet-based field devices and follows the provider-consumer model.
Field devices in a subordinate PROFIBUS line can be integrated in the PROFINET IO system without
any effort and seamlessly via an IO-Proxy (representative of a subordinate bus system). A device
developer can implement PROFINET IO with any commercially available Ethernet controller. It is well-
suited for the data exchange with bus cycle times of a few ms. The configuration of an IO-System has
been kept nearly identical to the "look and feel" of PROFIBUS. PROFINET IO always contains the real-
time concept.
PROFINET and the peripherals (PROFINET IO)

A PROFINET IO system consists of the following devices:

 The IO Controller, which controls the automation task.

 The IO Device, which is a field device, monitored and controlled by an IO Controller. An IO
device may consist of several modules and sub-modules.
 The IO Supervisor is software typically based on a PC for setting parameters and diagnosing
individual IO Devices.

An Application Relation (AR) is established between an IO Controller and an IO Device. These ARs are
used to define Communication Relations (CR) with different characteristics for the transfer of
parameters, cyclic exchange of data and handling of alarms.

The characteristics of an IO Device are described by the device manufacturer in a General Station
Description (GSD) file. The language used for this purpose is the GSDML (GSD Markup Language) -
an XML based language. The GSD file provides the supervision software with a basis for planning the
configuration of a PROFINET IO system.

Within PROFINET IO, process data and alarms are always transmitted in real time (RT). Real time in
PROFINET is based on the definition of IEEE and IEC, which allow for only a limited time for
execution of real-time services within a bus cycle. The RT communication represents the basis for the
data exchange for PROFINET IO. Real-time data are treated with a higher priority than TCP (UDP)/IP
data. RT provides the basis for the real-time communication in the area of distributed periphery and for
the PROFINET component model (PROFINET CBA). This type of data exchange allows bus cycle
times in the range of a few hundred microseconds.

The isochronous data exchange with PROFINET is defined in the isochronous real-time (IRT) concept.
PROFINET IO field devices with IRT functionality have switch ports integrated in the field device.
They can be based e.g. on the Ethernet controllers. The data exchange cycles are usually in the range of
a few hundred microseconds up to a few milliseconds. The difference to real-time communication is
essentially the high degree of determinism, so that the start of a bus cycle is maintained with high
precision. The start of a bus cycle can deviate up to 1 µs (jitter). IRT is required, for example, for motion
control applications (positioning control processes).

PROFINET supports the deterministic data traffic, for example, for high-precision control tasks & the
redundancy concept defined in PROFINET significantly increases system availability
Ethernet IP

EtherNet/IP is an application layer protocol treating devices on the network as a series of "objects".
EtherNet/IP is built on the Common Industrial Protocol (CIP), for access to objects from ControlNet and
DeviceNet networks.

EtherNet/IP uses Ethernet physical layer network infrastructure. EtherNet/IP can be implemented in
software on a microprocessor. No special hardware such as application-specific integrated
circuits(ASICs) or Field Programmable Gate Arrays (FPGAs) are required. EtherNet/IP is built on the
TCP/IP protocols.

EtherNet/IP can be used in automation networks which can tolerate some amount of non-determinism.
This is because Ethernet physical media might not have deterministic delays.

EtherNet/IP can be easily confused as a simple combination of Ethernet and the Internet Protocol
Instead, it is an industrial application layer protocol used for communication between industrial control
systems and their components, such as a programmable automation controller, programmable logic
controller or an I/O system. The "IP" in EtherNet/IP, stands for "Industrial Protocol".

EtherNet/IP was developed in the late 1990s by Rockwell Automation as part of Rockwell's industrial
Ethernet networking solutions. EtherNet/IP is most commonly used in industrial automation settings
(e.g., water processing plants, manufacturing facilities, utilities) in the US and Asia for communication
to and from Rockwell Automation's Allen-Bradley-brand control systems

EtherNet/IP classifies Ethernet nodes as predefined device types with specific behaviors. Among other
things, this enables:

 Transfer of basic I/O data via User Datagram Protocol (UDP)-based implicit messaging
 Uploading and downloading of parameters, setpoints, programs and recipes via TCP (i.e.,
explicit messaging)
 Polled, cyclic and change-of-state monitoring via UDP, such as RPI and COS in Allen Bradley's
ControlLogix control systems.
 One-to-one (unicast), one-to-many (multicast), and one-to-all (broadcast) communication via
TCP.
 EtherNet/IP makes use of well known TCP port number 44818 for explicit messaging and UDP
port number 2222 for implicit messaging

The EtherNet/IP application layer protocol is based on the Common Industrial Protocol (CIP) standard
used in DeviceNet, CompoNet and ControlNet.
Embedded System

An embedded system is a computer system designed for specific control functions within a larger
system ,often with real time computing constraints. It is embedded as part of a complete device often
including hardware and mechanical parts. By contrast, a general-purpose computer, such as a personal
computer (PC), is designed to be flexible and to meet a wide range of end-user needs. Embedded
systems control many devices in common use today.

Embedded systems contain processing cores that are typically either Microcontrollers or Digital signal
processors (DSP). The key characteristic, however, is being dedicated to handle a particular task. They
may require very powerful processors and extensive communication,

Example: Air traffic control systems may usefully be viewed as embedded, even though they involve
Mainframe computers and dedicated regional and national networks between airports and radar sites
(each radar probably includes one or more embedded systems of its own).

Since the embedded system is dedicated to specific tasks, design engineers can optimize it to reduce the
size and cost of the product and increase the reliability and performance. Some embedded systems are
mass-produced, benefiting from economies of scale.

In process industries HMI products handling SCADA system and soft PLC functions controlling the
machine processes can also viewed as example for Embedded systems.

Physically, embedded systems range from portable devices such as digital watches , MP3 players, large
stationary installations like traffic lights, factory controllers ,or the systems controlling nuclear power
plants Complexity varies from low, with a single microcontroller chip, to very high with multiple units,
peripherals and networks mounted inside a large enclosure.

In general, "embedded system" is not a strictly definable term, as most systems have some element of
extensibility or programmability. For example, handheld computers share some elements with
embedded systems such as the operating systems and microprocessors that power them, but they allow
different applications to be loaded and peripherals to be connected. Moreover, even systems that do not
expose programmability as a primary feature generally need to support software updates. On a
continuum from "general purpose" to "embedded", large application systems will have subcomponents
at most points even if the system as a whole is "designed to perform one or a few dedicated functions",
and is thus appropriate to call "embedded".
OPC Server/OPC Client

OPC Servers are software applications (drivers) that comply with one or more OPC specifications as
defined by the OPC Foundation. OPC Servers communicate natively with one or more Data Sources on
one side and with OPC Clients on the other. In an OPC Client / OPC Server Architecture, the OPC
Server is a Slave while the OPC Client is the Master. Communication between the OPC Client and OPC
Server is bi-directional meaning the OPC Clients can read from and write to OPC Servers.

An OPC Server is a software application that acts as an API(Application Programming Interface) or

protocol converter. An OPC Server will connect to a device such as a PLC, DCS, RTU, or a data source
such as a database or User interface, and translate the data into a standard-based OPC format. OPC
compliant applications such as an HMI (Human Machine Interface), historian, spreadsheet, trending
application, etc. can connect to the OPC Server and use it to read and write device data. An OPC Server
is analogous to the role a printer driver plays to enable a computer to communicate with an ink jet
printer. An OPC Server is based on a Server/Client architecture

OPC uses COM or DCOM technology and the client / server model.

The OPC server has direct access to control-specific information and makes this available to
clients. OPC clients, in turn, can accept links to the servers and via these access the data
within a control.
Based on Microsoft Windows technology, OPC now stands for Open Productivity & Collaboration.
Previously Previously it stood for OLE Process Control but today the OLE technology has been replaced
by Active X.

OPC (originally OLE for process control) is an industry standard created with the collaboration of a
number of leading worldwide automation hardware and software suppliers, working in co-operation
with Microsoft. The standard defines methods for exchanging real-time automation data between PC-
based clients using Microsoft operating systems. The organization that manages this standard is the OPC
Foundation

Local and Remote OPC Servers

Local servers run as a process on the proprietary computer. A differentiation has to be made
here between InProc servers, also known as process-internal servers, and OutProc or
process-external servers.

An InProc server is inserted directly into the client as a DLL file. This means that no process
limits have to be overcomed. The disadvantage of this is the fact that the server is a
component of the client and the client and server thus have to share the available resources.

The OutProc server is a process on the computer that can be executed on its own. If a client
connects to the OPC server, the EXE file will be automatically started via the COM
mechanism. If the connection is interrupted then all the client messages will be withdrawn and
the OutProc server will automatically end.

OPC servers, which are not implemented on the proprietary computer but rather in other
devices, such as a control or another computer, are designated as remote servers. OPC
clients, which wish to communicate with them have to use DCOM , as this supports
communication between two different computers.

Three process-external Bosch Rexroth servers are available to the "Example OPC Client" for
setting up a connection to the control.

● 'IndraLogic.OPC.02' server
Access to PLC variables of systems with IndraLogic 1G
● 'IndraLogic.OPC.DA' server
Access to PLC variables of systems with IndraLogic 1G and 2G
● 'OPC.IwSCP' server
Access to control parameters and PLC variables of systems with IndraLogic 1G and 2G
OPC Client

An OPC client is a PC application, which communicates with one or more OPC servers and
thus can access control-specific data. The user can use an OPC client to structure information
from controls into groups and read and write it in different ways.

The tasks of an OPC client are as follows:

● Create and delete a server instance
● Login and Logoff groups
● Add and remove items

Once an OPC server instance has been created and groups and items have been logged in,
the data within a control can be accessed with an OPC client.

The following access options are available:

● Synchronous data access
● Asynchronous data access
● Cyclic data access

Example for OPC Client

Winstuido SCADA software

Function modules used in PLC
A range of function modules (fieldbus interfaces and technology modules) are available to
integrate the PLC into heterogeneous control topologies. The modules use the high-speed
system bus to communicate with the control processor – this ensures that the high
requirements for performance and functionality are met. Implementation of functions into the
modules reduce the load on the controller CPU.

 Easy expansion of the functions of the PLC controls

 Many communication and technology interfaces
 Flexible combination options
 Ergonomic design

Some of the Function and technology modules widely used are

Function modules

 Fast I/O modules

 SRAM Module
 Cross communication module
 Profibus Master Module
 DeviceNet Master module
 High speed programmable limit switches (PLS)
 Real time Ethernet modules

Technology Modules
 Counter Module
 Temperature modules
 Encoder Modules
 PMW ( Pulse Width Modulation) Module
 RS232 / RS485 communication module
 SSI encoder Modules
 Strain Guage module
HMI Systems

The HMI system usually presents the information to the operating personnel graphically, in the form of
a mimic diagram. Operator can read the data from PLC and write the data to PLC and by this he control
the machine process.

HMI have following advantages

 Job change is very easy. Usually recipe functionality the Job can be changed faster
 Machine process parameters can be controlled precisely
 Online alarm and error diagonistics which help in easy maintenance

HMIs can broadly used following automation industries

 Printing and converting machines

 Machine tools
 Transfer machines
 Printing presses and processing machines
 Food processing and packaging machines
 Forming machines
 Wood processing machines
 Textile machines
 Handling and assembly systems
Types of HMI

They are broadly classified as

\
Controller-based HMIs --- Alphanumeric key board types and Touch panel types

These controller-based compact operator panels allow you to edit your production data simply
by press-ing a key or touching the screen. The system versions cover a range from simple
small graphics displays to touch screens with full graphics capabilities – with the number of
function keys depending on the system design. The comprehensive interface range fulfills
almost all of your communication wishes, whether Ethernet TCP/IP, field bus or serial.

 Inexpensive operation and visualization

 Compact dimensions
 Easy configuration of the system visualization
 Comprehensive functions with the visualization software. The screens can be
developed as per the machine requirement using the HMI development software and
loaded into HMI
 Support of Asian characters sets
Typical technical data of Control based HMIs
Embedded-PC-based HMI

These panels allow you to operate the machine easily and conveniently via a touch screen or a
virtual keyboard. These "almost a PC" devices only use embedded components to maximize
reliability. Through the multitude of interfaces and slots, the embedded devices can be opti-
mally adapted to comply with machine and system requirements. This flexibility allows you to
use the devices only for visualization or as control hardware. Expand your embedded PCs with
our soft PLC solution or Motion solution for multi-axis applications.

 Compact system design for attachment in control mounting

 Hardware without hard disk or rotating media
 Control and visualization in a single device
 Integrated short-time UPS
 Visualization, operation and observation with the common SCADA visualization
software
Typical technical data of embedded HMI
PC-based HMI

The operator terminals of the PC based HMI series integrate PC, operator and visualization to
form one unit. This device allows you to control, operate and visualize single machines or
stations and even complex production lines – economically and with maximum transparency in
the production.

 Highest performance through latest PC technology

 High investment protection through standardized hardware and software
 Open and flexible for customer-specific solutions
 High production reliability through EMC-certified design
 Operator- and service-friendly system construction
 Vibration resistance up to 1 g during operation
 Shock loading capacity up to 15 g
 Low heat losses through optimized cooling system
 Components, such as processors, motherboards, etc. available over the long term

Typical technical data of PC based HMI

Basic Programming instruction sets in Structured Text & Ladder diagram

ST Operators

Operation Symbol
Put in parentheses (expression)
Function call Function name (parameter list)
Exponentiation EXPT
Building of complements NOT
Multiply *
Divide /
Modulo MOD
Add +
Subtract -
Compare <,>,<=,>=
Equal to,Not equal to = ,<>
Boolean AND AND
Boolean XOR XOR
Boolean OR
Assignment :=

IF instruction

With the IF instruction we can check a condition and, depending upon this condition, execute
instructions.

Syntax:

IF <Boolean_expression1> THEN
<IF_instructions>
{ELSIF <Boolean_expression2> THEN
<ELSIF_instructions1>
.
.
ELSIF <Boolean_expression n> THEN
<ELSIF_instructions n-1>
ELSE
<ELSE_instructions>}
END_IF;
The part in braces {} is optional.

If the <Boolean_expression1> returns TRUE, then only the <IF_Instructions> are executed and none of
the other instructions. Otherwise the Boolean expressions, beginning with <Boolean_expression2>, are
evaluated one after the other until one of the expressions returns TRUE. Then only those instructions
after this Boolean expression and before the next ELSE or ELSIF are evaluated. If none of the Boolean
expressions produce TRUE, then only the <ELSE_instructions> are evaluated.

Example

IF temp<17 THEN
heating_on := TRUE;
ELSE
heating_on := FALSE;
END_IF;

Here the heating is turned ON when the temperature sinks below 17 degrees. Otherwise it
remains OFF.

CASE instruction

With the CASE instructions we can combine several conditioned instructions with the same
condition variable in one construct.
Syntax:
CASE <Var1> OF
<Value1>: <Instruction 1>
<Value2>: <Instruction 2>
<Value3, Value4, Value5>: <Instruction 3>
<Value6 .. Value10>: <Instruction 4>
...
<Value n>: <Instruction n>
ELSE <ELSE instruction>
END_CASE;
A CASE instruction is processed according to the following model:
 If the variable in <Var1> has the value <Value i>, then the instruction <Instruction i> is
executed.
 If <Var 1> has none of the indicated values, then the <ELSE Instruction> is executed.
 If the same instruction is to be executed for several values of the variables, then one can write
these values one after the other separated by commas, and thus condition the common execution

 If the same instruction is to be executed for a value range of a variable, one can write
the initial value and the end value separated by two dots one after the other. So you can
condition the common condition.

Example:

CASE INT1 OF

1, 5: BOOL1 := TRUE;
BOOL3 := FALSE;

2: BOOL2 := FALSE;
BOOL3 := TRUE;

10..20: BOOL1 := TRUE;

BOOL3:= TRUE;

ELSE

BOOL1 := NOT BOOL1;

BOOL2 := BOOL1 OR BOOL2;

END_CASE;
FOR loop

With the FOR loop one can program repeated processes.

Syntax:

INT_Var :INT;

FOR <INT_Var> := <INIT_VALUE> TO <END_VALUE> {BY <Step size>} DO

<Instructions>
END_FOR;

The part in braces {} is optional.

The <Instructions> are executed as long as the counter <INT_Var> is not greater than the
<END_VALUE>. This is checked before executing the <Instructions> so that the <instructions>
are never executed if <INIT_VALUE> is greater than <END_VALUE>.

When <Instructions> are executed, <INT_Var> is always increased by <Step size>. The step
size can have any integer value. If it is missing, then it is set to 1. The loop must also end since
<INT_Var> only becomes greater.

Example:
FOR Counter:=1 TO 5 BY 1 DO
Var1:=Var1*2;
END_FOR;
Erg:=Var1;
Let us assume that the default setting for Var1 is the value 1. Then it will have the value 32
after the FOR loop.
WHILE loop

The WHILE loop can be used like the FOR loop, except that the abort condition can be any
desired Boolean expression. That means that when the condition you enter is met, the loop is
executed.

Syntax:

WHILE <Boolean expression>

<Instructions>
END_WHILE;

1. The <Instructions> are executed repeatedly until the <Boolean expression>

returns TRUE.

2. If the <Boolean expression> is already FALSE the first time it is evaluated,

the <instructions> will never be executed.
3. If <Boolean expression> never receives the value FALSE, the <instructions>
are repeated endlessly, which causes a runtime error.

The programmer must ensure that no endless loops are caused by modifying the condition in
the instruction part of the loop, e.g. has a counter increase or decrease.

WHILE counter<>0 DO
Var1 := Var1*2;
Counter := Counter-1;
END_WHILE;
REPEAT loop

The REPEAT loop differs from the WHILE loop in that the abort condition is checked only after
the loop is executed. As a result, this loop will cycle through at least once no matter what the
abort condition is.

Syntax:

REPEAT
<Instructions>
UNTIL <Boolean expression>
END_REPEAT;

● The <Instructions> are executed until the <Boolean expression> returns TRUE.
● If the <Boolean expression> is already TRUE the first time it is evaluated, the <instructions>
will be executed exactly once.
● If <Boolean expression> never receives the value TRUE, the <instructions>
are repeated endlessly, which causes a runtime error.

The programmer must ensure that no endless loops are caused by modifying the condition in
the instruction part of the loop, e.g. has a counter increase or decrease.

Example:
REPEAT
Var1 := Var1*2;
Counter := Counter-1;
UNTIL
Counter=0
END_REPEAT;

The WHILE and REPEAT loops are more powerful than the FOR loop because you do not
need to know the number of loop cycles before the loop is executed.

In some cases, you will work only with these two types of loops for this reason.
However, if the number of loop cycles is known, a FOR loop is preferred because
it does not cause endless loops.
Basic elements in Ladder programming

Contact

This is a pure LD element.

Each network in LD contains one or more contacts in its left section. A contact is displayed as
follows:

A contact transfers the condition "ON" (TRUE) or "OFF" (FALSE) from left to right until it finally
reaches a spooler in the right section of the network. For this purpose, a Boolean variable that
contains the condition is assigned to the contact.

Several contacts can be arranged in a sequence or in parallel. If there are two parallel
contacts, only one has to have the value TRUE for "ON" to be transferred to the right. If
contacts are connected in a sequence, all contacts must contain the value TRUE for the "ON"
to be transferred to the right from the last contact.
In this way, LD can be used to program an electric circuit in parallel or in a series.

A contact can also be negated, indicated by a slash in the contact icon.

A negated contact only transfers the incoming condition (TRUE or FALSE) if the Boolean
variable assigned to it has the value FALSE.

Spooler

This is a pure LD element. Any desired number of spooler elements can be inserted on the
right side of a LD network. A spooler is displayed as follows:

Several spoolers can only be arranged in parallel. A spooler transfers the value delivered from
the left on to the right and copies it into its assigned Boolean variable. Its input value can be
"ON" (TRUE) or "OFF" (FALSE). A spooler can also be negated, indicated by a slash in the
icon.
In a negated spooler, the negated value of the incoming signal is copied into the Boolean
variable assigned to the spooler. Therefore, a negated spooler will only transfer an "ON" signal
if this variable has the value FALSE.

Set/Reset

Spoolers can also be defined as set or reset spoolers. A set spooler is identified by an "S" in
the spooler icon: (S). A set spooler never overwrites the value TRUE in the related Boolean
variable, i.e. a variable with the truth value TRUE retains this value.

A reset spooler is identified by an "R" in the spooler icon: (R). A reset spooler never overwrites
the value FALSE in the related Boolean variable, i.e. if this variable has the truth value FALSE,
this value remains FALSE.

Add Parallel Contact

Add Parallel Negated Contact

Data Types

BOOL

Variables of data type BOOL can accept truth values TRUE (1) and FALSE (0).

Bit sequence

Data types
REAL / LREAL

The Data types REAL and LREAL are so-called floating point data types. The data types
REAL and LREAL are used with rational numbers. The reserved memory space is 32 bits for
REAL and 64 bits for LREAL.

Allowable values for REAL:

±(1.175494351e-38 to 3.402823466e+38)

Allowable values for LREAL:

±(2.2250738585072014e-308 to 1.7976931348623158e+308)

STRING

A variable of data type STRING can accept any character string. The size specification in the
declaration for reserving memory space refers to numbers and can be made in parentheses or
square brackets. If no size is specified, 80 characters are accepted by default.

In principle, the string length is not limited, but the string functions can only
process lengths of 1-255!

String declaration with 35 characters:

str:STRING(35):= 'This is a String';

Arithmetic Operators

ADD : Addition of variables. Types permitted: BYTE, WORD, DWORD, LWORD, SINT,
USINT, INT, UINT, DINT, UDINT, LINT, ULINT, REAL and LREAL

var1 := 7+2+4+7;

MUL : Multiplication of variables Types permitted: BYTE, WORD, DWORD, LWORD, SINT,
USINT, INT, UINT, DINT, UDINT, LINT, ULINT, REAL and LREAL.

var1 := 7*2*4*7;
SUB
Subtraction of one variable from another.
Types permitted: BYTE, WORD, DWORD, LWORD, SINT, USINT, INT, UINT,
DINT, UDINT, LINT, ULINT, REAL and LREAL.

A TIME variable can also be subtracted from a variable of a different TIME type;
the result will be in a variable of a third TIME type. However, note that negative
TIME values are undefined.

var1 := 7-2;

DIV

Division of one variable by another.

Types permitted: BYTE, WORD, DWORD, LWORD, SINT, USINT, INT, UINT,
DINT, UDINT, LINT, ULINT, REAL and LREAL.

var1 := 8/2;

MOD

Modulo division of one variable by another.

Types permitted: BYTE, WORD, DWORD, LWORD, SINT, USINT, INT, UINT,
DINT, UDINT, LINT, ULINT. This function returns the whole number remainder
of the division as a result.

Var1 := 9 MOD 2; (result: content of Var1 is 1)

MOVE

Assignment of a variable to another variable of a corresponding type

ivar2 := MOVE(ivar1);
// this corresponds with the assignment:
ivar2 := ivar1;
BIT STRING OPERATORs

AND
Bitwise AND from bit operands. If the input bits are 1, the output bit is 1; otherwise, it is 0.
Types permitted: BOOL, BYTE, WORD, DWORD, LWORD.

OR

Bitwise OR from bit operands. If at least one of the input bits is 1, the output bit is 1; otherwise,
it is 0. Types permitted: BOOL, BYTE, WORD, DWORD, LWORD

XOR
Bitwise XOR from bit operands. If only one of the two bit inputs is 1, the result is 1; if both
inputs are 0 or 1, the result is 0. Types permitted: BOOL, BYTE, WORD, DWORD, LWORD.

NOT

Bitwise NOT of a bit operand. The output bit is 1 if the corresponding input bit is 0 and vice
versa. Types permitted: BOOL, BYTE, WORD, DWORD, LWORD.

Relational Operators

GT Greater than.

A Boolean operator with a result of TRUE when the the first operand is greater
than the second.
The operands can be any of the following types:
● BOOL, BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL,
● TIME, LTIME, DATE, TIME_OF_DAY, DATE_AND_TIME and
● STRING.

Example in ST and LD

IF (Var1 > 20) THEN

Var2 := 10
END_IF
LT Lesser than

A Boolean operator with a result of TRUE when the the first operand is less than the second.
The operands can be any of the following types:
● BOOL, BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL,
● TIME, LTIME, DATE, TIME_OF_DAY, DATE_AND_TIME and
● STRING.

Example in LD and ST

The result is TRUE

VAR1 := 20 < 30; // VAR1 is TRUE

LE - Less than or equal.

A Boolean operator with a result of TRUE when the first operand is less than or equal to the
second operand.
The operands can be any of the following types:
● BOOL, BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL,
● TIME, LTIME, DATE, TIME_OF_DAY, DATE_AND_TIME and
● STRING.
Ex in LD and ST

The result is TRUE

VAR1 := 20 <= 30; // TRUE

GE - Greater than or equal

A Boolean operator with a result of TRUE when the first operand is greater than
or equal to the second operand.
The operands can be any of the following types:
● BOOL, BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL,
● TIME, LTIME, DATE, TIME_OF_DAY, DATE_AND_TIME and
● STRING.

Example in ST and LD
VAR1 := 60 >= 40; // TRUE

The result is TRUE

EQ - Equality

A Boolean operator with a result of TRUE when the operands are equal.

The operands can be any of the following types:

● BOOL, BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL,
● TIME, LTIME, DATE, TIME_OF_DAY, DATE_AND_TIME and
● STRING

Example in LD and ST

The result is true

VAR1 := 40 = 40; // TRUE
NE - Inequality

A Boolean operator with a result of TRUE when the operands are not equal.
The operands can be any of the following types:
● BOOL, BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL,
● TIME, LTIME, DATE, TIME_OF_DAY, DATE_AND_TIME and
● STRING.

Example in ST and LD
VAR1 := 40 <> 40; // FALSE

The result is FALSE

Numeric Operators

ABS
Returns the absolute value of a number.
Example in ST and LD

i:=ABS(-2);

Result in variable “ i “ is 2

SQRT
Returns the square root of a number.

IN can be one of the following types:

● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in LD and ST

q:=SQRT(16);

LN

Returns the natural logarithm of a number.

IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD

q:=LN(45);
LOG

Returns the base 10 logarithm of a number.

IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD

q:=LOG(314.5);

EXP

Returns the exponential function.

IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in LD and ST

q:=EXP(2);
SIN

Returns the sine value of a number. The value is calculated in radians.

IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD

q:=SIN(0.5);

( Result in q is 0.479426 )

COS

Returns the cosine value of a number. The value is calculated in radians.

IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD
q:=COS(0.5);

(* Result in q is 0.877583 )
TAN

Returns the tangent value of a number. The value is calculated in radians.

IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.
Example in ST and LD

q:=TAN(0.5);

( Result in q is 0.546302 )

ASIN

Returns the arc sine value (inverse function of sine) of a number. The value is calculated in
radians.
IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD

q:=ASIN(0.5);

( Result in q is 0.523599 )
ACOS

Returns the arc cosine value (inverse function of sine) of a number. The value is calculated in
radians.
IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD
q:=ACOS(0.5);

( Result in q is 1.0472 )

ATAN

Returns the arc tangent value (inverse function of cosine) of a number. The value is calculated
in radians.
IN can be one of the following types:
● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD
q:=ATAN(0.5);

( Result in q is 0.463648 )
EXPT
Exponentiation of one variable with another

IN1 and IN2 can be any of the following types:

● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT,
● REAL, LREAL.
OUT must be REAL or LREAL type.

Example in ST and LD

var1 := EXPT(7,2);

(Result is 49 )
Constants

TIME

TIME constants are used especially to operate the default timer module. These constants can
be used in order to enter time information

Syntax for a time constant:

t#<time declaration>
T#<time declaration>
time#<time declaration>
TIME#<time declaration>

Eg T#1000ms
T# 1hr12m50s

Number Constant

Number values can appear as binary numbers, octal numbers, decimal numbers
and hexadecimal numbers.

If an integer value is not a decimal number, its base must be written before the
integer constant, followed by a hash mark (#).

In hexadecimal numbers, the numeric values for the numbers 10 to 15 are usually
specified by the letters A-F.
Underscores are allowed within a number value.

14 (Decimal number)
2#1001_0011 (Binary number)
8#67 (Octal number)
16#A (Hexadecimal number)

The type of these number values can be one of the following:

● BYTE, WORD, DWORD, LWORD,
● SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT.

REAL Constants

REAL and LREAL constants can be specified as decimal fractions and with exponents.
Standard Function blocks

SR - Set / Reset

Function block sets bi-stable function blocks as dominant.

Inputs:

SET1: BOOL; Set: If this input is TRUE, the output Q1 is set to 1.

RESET: BOOL; Reset: If this input is TRUE, the output Q1 is reset to 0.

Output:
Q1: BOOL; becomes TRUE as soon as SET1 becomes TRUE.
Deceleration
SRInst : SR;
VarBOOL1 : BOOL;
VarBOOL2 : BOOL;
VarBOOL3 : BOOL;

IN LD

In ST
SRInst(SET1:= VarBOOL1 , RESET:=VarBOOL2 );
VarBOOL3 := SRInst.Q1;
R_TRIG

This Function block, detects a rising edge.

Input:
CLK : BOOL; Boolean input signal that checks for a rising edge.

Output:
Q : BOOL; Becomes TRUE as soon as there is a rising edge at CLK.

As long as the input variable CLK returns FALSE, the output Q and the auxiliary
variable M are FALSE. As soon as CLK returns TRUE, first Q returns TRUE
and then M is set to TRUE, i.e. for each subsequent call of the function block
instance, Q is first set to TRUE, then it returns FALSE again, followed by a rising
edge in CLK.

Q := CLK AND NOT M;

M := CLK;

Declaration

RTRIGInst : R_TRIG ;

In LD

In ST
RTRIGInst(CLK:= VarBOOL1);
VarBOOL2 := RTRIGInst.Q;
F_TRIG

Function block, detects a falling edge.

Input:

CLK : BOOL; Boolean input signal that checks for a falling edge.

Output:

Q : BOOL; Becomes TRUE as soon as a falling edge is detected at CLK.

As long as the input variable CLK returns TRUE, the output Q and the auxiliary variable M are
FALSE. As soon as CLK returns FALSE, first Q returns TRUE and then M is set to TRUE, i.e.
for each subsequent call of the function block instance, Q is first set to TRUE, then it returns
FALSE again, followed by a falling edge in CLK.
Q := NOT CLK AND NOT M;
M := NOT CLK;

Declaration

FTRIGInst : F_TRIG ;

In LD

In ST
FTRIGInst(CLK:= VarBOOL1);
VarBOOL2 := FTRIGInst.Q;
Counter

CTU

Function block for counting upward

Inputs

CU : BOOL; A rising edge at this input starts CV counting up.

RESET : BOOL; If this input is TRUE, CV is reset to 0.
PV : WORD; Upper limit for CV's upward counting.

Outputs:

Q : BOOL; Becomes TRUE as soon as CV has reached the upper limit PV.
CV : WORD; Counting continues until PV is reached. If RESET is TRUE, the counting variable
CV is initialized with 0. If CU has a rising edge of FALSE to TRUE, CV is increased by 1.

Declaration example:

CTUInst : CTU;

In LD

In ST

CTUInst(CU := VarBOOL1, RESET:=VarBOOL2 , PV:= VarWORD1);

VarBOOL3 := CTUInst.Q;
VarINT1 := CTUInst.CV;
CTD

Function block for counting downward

Inputs:

CD : BOOL; A rising edge at this input starts CV counting down.

LOAD : BOOL; If this input is TRUE, CV is at the upper limit PV.
PV : WORD; Upper limit, starting value for CV's downward counting.

Outputs:

Q : BOOL; Becomes TRUE as soon as CV is 0.

CV : WORD; Value from which counting down by 1 occurs from starting value PV until 0 is
reached.
If LOAD is TRUE, the counting variable CV is initialized with upper limit PV. If CD has a rising
edge from FALSE to TRUE, CV is decreased by 1 as long as CV is greater than 0 (i.e., if it
does not cause underflow). Q returns TRUE if CV equals 0.

Declaration

CTDInst : CTD;

In LD

In ST

CTDInst (CD:= VarBOOL1, LOAD:=VarBOOL2 , PV:= VarWORD1);

VarBOOL3 := CTDInst.Q;
arINT1 := CTDInst.CV;
CTUD

Function block that functions as an incrementer / decrementer

Inputs:
CU : BOOL; A rising edge at this input starts CV counting up.
CD : BOOL; A rising edge at this input starts CV counting down.
RESET : BOOL; If TRUE, CV is set to 0.
LOAD : BOOL; If TRUE, CV is set to PV.
PV : WORD; Upper limit for CV's upward or downward counting

Outputs:
QU : BOOL; Becomes TRUE as soon as CV >= PV.
QD : BOOL; Becomes TRUE as soon as CV has counted down to 0.
CV : WORD; Value that is to be counted upward or downward.
If RESET is true, the counting variable CV is initialized with 0. If LOAD is true, then CV is
initialized with PV.
If CU has a rising edge of FALSE to TRUE, CV is increased by 1. If CD has a rising edge from
FALSE to TRUE, then CV is decreased by 1 respectively, as long as CV does not cause
underflow.

QU returns TRUE, if CV is now greater than or equal to PV.

QD returns TRUE if CV now equals 0.

Declaration
CTUDInst : CUTD;

In LD

In ST

CTUDInst(CU := VarBOOL1, CU:= VarBOOL2, RESET := VarBOOL3, LOAD:=VarBOOL4 ,

PV:= VarWORD1);
VarBOOL5 := CTUDInst.QU;
VarBOOL6 := CTUDInst.QD;
VarINT1 := CTUDInst.CV;
Timer

TP

Function block that functions as a pulse generator. At timer counts up to a given upper limit.
While it is counting upward, the "pulse variable" is TRUE; otherwise, it is FALSE.

Inputs:

IN : BOOL; A rising edge at this input causes the time in ET to start counting upward.
PT : TIME; Upper limit for time in ET.

Outputs:

Q : BOOL; TRUE as long as the time in ET is counting upward (pulse).

ET : TIME; Current time status.

As soon as IN becomes TRUE, the time in ET is counted upward in milliseconds until the value
is equal to the value in PT; afterward the value remains constant.

Q is TRUE after IN has changed to TRUE and ET is still less than or equal to PT. Otherwise, it
is FALSE.

In this way, Q returns a signal for the time period specified in PT.
Declaration example:
TPInst : TP ;

In LD

Example in ST:

TPInst(IN := VarBOOL1, PT:= T#5s);

VarBOOL2 :=TPInst.Q;

TON

Function block that implements switch ON delay. After the input has become TRUE, a
specified time period is allowed to elapse until the output also becomes TRUE.

Inputs:

IN : BOOL; A rising edge at this input starts the time counting up in ET.
PT : TIME; Upper limit for the time in ET (delay period).

Output:

Q : BOOL; Receives a rising edge as soon as ET has reached the upper limit PT (delay period
has expired).
ET : TIME; Current delay period status.

TON(IN, PT, Q, ET) means: Q is TRUE if IN is TRUE and ET is equal to PT. Otherwise, it is
FALSE.

In this way, Q has a rising edge when the time in PT given in milliseconds has elapsed.
In LD

IN ST:
TONInst (IN := VarBOOL1, PT:= T#5s);
VarBOOL2 :=TONinst.Q;

TOF

Function block that implements a switch off delay. When the input changes from TRUE to
FALSE (falling edge), a specified time period is allowed to elapse before the output also
becomes FALSE.

Inputs:

IN : BOOL; A falling edge at this input starts the delay time counting up in ET.
PT : TIME; Upper limit for ET's upward counting (delay period).

Outputs:

Q : BOOL; Receives a falling edge as soon as ET has reached the upper limit PV (delay
period has expired).
ET : TIME; Current delay period status.
TOF(IN, PT, Q, ET) means: As soon as IN becomes FALSE, the time in ET is counted upward
in milliseconds until the value is equal to the value in PT; afterward the value remains constant.

Q is FALSE if IN is FALSE and ET is equal to PT. Otherwise, it is TRUE. In this way, Q has a
falling edge when the time in PT given in milliseconds has elapsed.

Declaration example:
TOFInst : TOF ;

In LD

Example in ST:
TOFInst(IN := VarBOOL1, PT:= T#5s);
VarBOOL2 :=TOFInst.Q;
PID controllers

A proportional–integral–derivative controller (PID controller) is a generic control loop feedback

mechanism (controller) widely used in industrial control systems – a PID is the most commonly used
feedback controller. A PID controller calculates an "error" value as the difference between a measured
process variable and a desired set point. The controller attempts to minimize the error by adjusting the
process control inputs.

The PID controller calculation (algorithm) involves three separate constant parameters, and is
accordingly sometimes called three-term control: the proportional, the integral and derivative
values, denoted P, I, and D. These values can be interpreted in terms of time: P depends on the present
error, I on the accumulation of past errors, and D is a prediction of future errors, based on current rate of
change. The weighted sum of these three actions is used to adjust the process via a control element such
as the position of a control valve, or the power supplied to a heating element.

By tuning the three parameters in the PID controller algorithm, the controller can provide control action
designed for specific process requirements. The response of the controller can be described in terms of
the responsiveness of the controller to an error, the degree to which the controller overshoots the
setpoint and the degree of system oscillation. Note that the use of the PID algorithm for control does not
guarantee optimal control of the system or system stability.

Some applications may require using only one or two actions to provide the appropriate system control.
This is achieved by setting the other parameters to zero. A PID controller will be called a PI, PD, P or I
controller in the absence of the respective control actions. PI controllers are fairly common, since
derivative action is sensitive to measurement noise, whereas the absence of an integral term may prevent
the system from reaching its target value due to the control action.
PID Theory

The PID control scheme is named after its three correcting terms, whose sum constitutes the
manipulated variable (MV). The proportional, integral, and derivative terms are summed to calculate the
output of the PID controller. Defining u(t) as the controller output, the final form of the PID algorithm
is:

where

Kp: Proportional gain, a tuning parameter

Ki: Integral gain, a tuning parameter
Kd: Derivative gain, a tuning parameter
e: Error = SP − PV
t: Time or instantaneous time (the present)

Proportional term
Plot of PV vs Time, for three values of Kp (Ki and Kd held constant)

The proportional term makes a change to the output that is proportional to the current error value. The
proportional response can be adjusted by multiplying the error by a constant Kp, called the proportional
gain.

The proportional term is given by:

A high proportional gain results in a large change in the output for a given change in the error. If the
proportional gain is too high, the system can become unstable (see the section on loop tuning). In
contrast, a small gain results in a small output response to a large input error, and a less responsive or
less sensitive controller. If the proportional gain is too low, the control action may be too small when
responding to system disturbances. Tuning theory and industrial practice indicate that the proportional
term should contribute the bulk of the output change

Droop

A pure proportional controller will not always settle at its target value, but may retain a steady-state
error. Specifically, drift in the absence of control, such as cooling of a furnace towards room
temperature, biases a pure proportional controller. If the drift is downwards, as in cooling, then the bias
will be below the set point, hence the term "droop".

Droop is proportional to the process gain and inversely proportional to proportional gain. Specifically
the steady-state error is given by:

e = G / Kp

Droop is an inherent defect of purely proportional control. Droop may be mitigated by adding a
compensating bias term (setting the set point above the true desired value), or corrected by adding an
integral term.
Integral term

The contribution from the integral term is proportional to both the magnitude of the error and the
duration of the error. The integral in a PID controller is the sum of the instantaneous error over time and
gives the accumulated offset that should have been corrected previously. The accumulated error is then
multiplied by the integral gain (Ki) and added to the controller output.

The integral term is given by:

The integral term accelerates the movement of the process towards set point and eliminates the
residual steady-state error that occurs with a pure proportional controller. However, since the
integral term responds to accumulated errors from the past, it can cause the present value to
overshoot the set point value (see the section on loop tuning).
Derivative Term

The derivative of the process error is calculated by determining the slope of the error over time and
multiplying this rate of change by the derivative gain Kd. The magnitude of the contribution of the
derivative term to the overall control action is termed the derivative gain, Kd.

The derivative term is given by:

The derivative term slows the rate of change of the controller output. Derivative control is used to
reduce the magnitude of the overshoot produced by the integral component and improve the combined
controller-process stability. However, the derivative term slows the transient response of the controller.
Also, differentiation of a signal amplifies noise and thus this term in the controller is highly sensitive to
noise in the error term, and can cause a process to become unstable if the noise and the derivative gain
are sufficiently large. Hence an approximation to a differentiator with a limited bandwidth is more
commonly used. Such a circuit is known as a phase-lead compensator
Tuning Process of PID

One tuning method of PID is to first set Ki and Kd values to zero. Increase the Kp until the output of the
loop oscillates, then the Kp should be set to approximately half of that value for a "quarter amplitude
decay" type response. Then increase Ki until any offset is corrected in sufficient time for the process.
However, too much Ki will cause instability. Finally, increase Kd, if required, until the loop is
acceptably quick to reach its reference after a load disturbance. However, too much Kd will cause
excessive response and overshoot. A fast PID loop tuning usually overshoots slightly to reach the set
point more quickly; however, some systems cannot accept overshoot, in which case an over-damped
closed-loop system is required, which will require a Kp setting significantly less than half that of the Kp
setting causing oscillation
PID Function block

Inputs to FB

Outputs from FB
Signal Generators

BLINK

The function block BLINK generates a pulsating signal. The input consists of ENABLE of the
type BOOL, as well as TIMELOW and TIMEHIGH of the type TIME. The output OUT is of the
type BOOL.

If ENABLE is set to TRUE, BLINK begins to set the output for the time period TIMEHIGH to
TRUE and afterwards to set it for the time period TIMELOW to FALSE.

When ENABLE is reset to FALSE, output OUT will not be changed, i.e. no further pulse will be
generated. If you explicitly also want to get OUT FALSE when ENABLE is reset to FALSE, you might
use "OUT AND ENABLE" (i.e. adding an AND box with parameter ENABLE) at the output.