ALL ABOUT SCADA

All about SCADA – Supervisory Control And Data Acquisition:..

SCADA stands for supervisory control and data acquisition. It generally refers to an industrial control system: a computer system monitoring and controlling a process.

* Industrial processes include those of manufacturing, production, power generation, fabrication, and refining, and may run in continuous, batch, repetitive, or discrete modes.

* Infrastructure processes may be public or private, and include water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, Wind Farms, civil defense siren systems, and large communication systems.

* Facility processes occur both in public facilities and private ones, including buildings, airports, ships, and space stations. They monitor and control HVAC, access, and energy consumption.

Systems concepts

The term SCADA usually refers to centralized systems which monitor and control entire sites, or complexes of systems spread out over large areas (anything between an industrial plant and a country). There is, in several industries, considerable confusion over the differences between SCADA systems and distributed control systems (DCS). Generally speaking, a SCADA system usually refers to a system that coordinates, but does not control processes in real time. The discussion on real-time control is muddied somewhat by newer telecommunications technology, enabling reliable, low latency, high speed communications over wide areas. Most differences between

SCADA and DCS are culturally determined and can usually be ignored. As communication infrastructures with higher capacity become available, the difference between SCADA and DCS will fade. Most control actions are performed automatically by Remote Terminal Units (“RTUs”) or by programmable logic controllers (“PLCs”). Host control functions are usually restricted to basic overriding or supervisory level intervention. For example, a PLC may control the flow of cooling water through part of an industrial process, but the SCADA system may allow operators to change the set points for the flow,and enable alarm conditions, such as loss of flow and high temperature, to be displayed and recorded. The feedback control loop passes through the RTU or PLC, while the SCADA system monitors the overall performance of the loop.

Data acquisition begins at the RTU or PLC level and includes meter readings and equipment status reports that are communicated to SCADA as required. Data is then compiled and formatted in such a way that a control room operator using the HMI can make supervisory decisions to adjust or override normal RTU (PLC) controls. Data may also be fed to a Historian, often built on a commodity Database Management System, to allow trending and other analytical auditing. SCADA systems typically implement a distributed database, commonly referred to as a tag database, which contains data elements called tags or points. A point represents a single input or output value monitored or controlled by the system. Points can be either “hard” or “soft”. A hard point represents an actual input or output within the system, while a soft point results from logic and math operations applied to other points. (Most implementations conceptually remove the distinction by making every property a “soft” point expression, which may, in the simplest case, equal a single hard point.) Points are normally stored as value-timestamp pairs: a value, and the timestamp when it was recorded or calculated. A series of value-timestamp pairs gives the history of that point. It’s also common to store additional metadata with tags, such as the path to a field device or PLC register, design time comments, and alarm information.

Hardware in SCADA systems

SCADA solutions often have Distributed Control System (DCS) components. Use of “smart” RTUs or PLCs, which are capable of autonomously executing simple logic processes without involving the master computer, is increasing. A functional block programming language, IEC 61131-3 (Ladder Logic), is frequently used to create programs which run on these RTUs and PLCs. Unlike a procedural language such as the C programming language or FORTRAN, IEC 61131-3 has minimal training requirements by virtue of resembling historic physical control arrays. This allows SCADA system engineers to perform both the design and implementation of a program to be executed on an RTU or PLC.

A Programmable automation controller (PAC) is a compact controller that combines the features and capabilities of a PC-based control system with that of a typical PLC. PACs are deployed in SCADA systems to provide RTU and PLC functions. In many electrical substation SCADA applications, “distributed RTUs” use information processors or station computers to communicate with protective relays, PACS, and other devices for I/O, and communicate with the SCADA master in lieu of a traditional RTU. Since about 1998, virtually all major PLC manufacturers have offered integrated HMI/SCADA systems, many of them using open and non-proprietary communications protocols. Numerous specialized third-party HMI/SCADA packages, offering built-in compatibility with most major PLCs, have also entered the market, allowing mechanical engineers, electrical engineers and technicians to configure HMIs themselves, without the need for a custom-made program written by a software developer.

Remote Terminal Unit RTU connects to physical equipment. Typically, an RTU converts the electrical signals from the equipment to digital values such as the open/closed status from a switch or a valve, or measurements such as pressure, flow, voltage or current. By converting and sending these electrical signals out to equipment the RTU can control equipment, such as opening or closing a switch or a valve, or setting the speed of a pump.

The term “Supervisory Station” refers to the servers and software responsible for communicating with the field equipment (RTUs, PLCs, etc), and then to the HMI software running on workstations in the control room, or elsewhere. In smaller SCADA systems, the master station may be composed of a single PC. In larger SCADA systems, the master station may include multiple servers, distributed software applications, and disaster recovery sites. To increase the integrity of the system the multiple servers will often be configured in a dual-redundant or hot-standby formation providing continuous control and monitoring in the event of a server failure.

For some installations, the costs that would result from the control system failing are extremely high. Possibly even lives could be lost. Hardware for some SCADA systems is ruggedized to withstand temperature, vibration, and voltage extremes, but in most critical installations reliability is enhanced by having redundant hardware and communications channels, up to the point of having multiple fully equipped control centres. A failing part can be quickly identified and its functionality automatically taken over by backup hardware. A failed part can often be replaced without interrupting the process. The reliability of such systems can be calculated statistically and is stated as the mean time to failure, which is a variant of mean time between failures. The calculated mean time to failure of such high reliability systems can be on the order of centuries.

SCADA systems have traditionally used combinations of radio and direct serial or modem connections to meet communication requirements, although Ethernet and IP over SONET / SDH is also frequently used at large sites such as railways and power stations. The remote management or monitoring function of a SCADA system is often referred to as telemetry. This has also come under threat with some customers wanting SCADA data to travel over their pre-established corporate networks or to share the network with other applications. The legacy of the early low-bandwidth protocols remains, though. SCADA protocols are designed to be very compact and many are designed to send information to the master station only when the master station polls the RTU. Typical legacy SCADA protocols include Modbus RTU, RP-570, Profibus and Conitel. These communication protocols are all SCADA-vendor specific but are widely adopted and used. Standard protocols are IEC 60870-5-101 or 104, IEC 61850 and DNP3. These communication protocols are standardized and recognized by all major SCADA vendors. Many of these protocols now contain extensions to operate over TCP/IP. It is good security engineering practice to avoid connecting SCADA systems to the Internet so the attack surface is reduced. RTUs and other automatic controller devices were being developed before the advent of industry wide standards for interoperability. The result is that developers and their management created a multitude of control protocols. Among the larger vendors, there was also the incentive to create their own protocol to “lock in” their customer base. A list of automation protocols is being compiled here. Recently, OLE for Process Control (OPC) has become a widely accepted solution for intercommunicating different hardware and software, allowing communication even between devices originally not intended to be part of an industrial network.

Replacing Relays

Replacing Relays

Next, lets use a plc in place of the relay. (Note that this might not be very cost effective for this application but it does demonstrate the basics we need.) The first thing that's necessary is to create what's called a ladder diagram. After seeing a few of these it will become obvious why its called a ladder diagram. We have to create one of these because, unfortunately, a plc doesn't understand a schematic diagram. It only recognizes code. Fortunately most PLCs have software which convert ladder diagrams into code. This shields us from actually learning the plc's code.

First step- We have to translate all of the items we're using into symbols the plc understands. The plc doesn't understand terms like switch, relay, bell, etc. It prefers input, output, coil, contact, etc. It doesn't care what the actual input or output device actually is. It only cares that its an input or an output.

First we replace the battery with a symbol. This symbol is common to all ladder diagrams. We draw what are called bus bars. These simply look like two vertical bars. One on each side of the diagram. Think of the left one as being + voltage and the right one as being ground. Further think of the current (logic) flow as being from left to right.
Next we give the inputs a symbol. In this basic example we have one real world input. (i.e. the switch) We give the input that the switch will be connected to, to the symbol shown below. This symbol can also be used as the contact of a relay.

A contact symbol

Next we give the outputs a symbol. In this example we use one output (i.e. the bell). We give the output that the bell will be physically connected to the symbol shown below. This symbol is used as the coil of a relay.

A coil symbol

The AC supply is an external supply so we don't put it in our ladder. The plc only cares about which output it turns on and not what's physically connected to it.

Second step- We must tell the plc where everything is located. In other words we have to give all the devices an address. Where is the switch going to be physically connected to the plc? How about the bell? We start with a blank road map in the PLCs town and give each item an address. Could you find your friends if you didn't know their address? You know they live in the same town but which house? The plc town has a lot of houses (inputs and outputs) but we have to figure out who lives where (what device is connected where). We'll get further into the addressing scheme later. The plc manufacturers each do it a different way! For now let's say that our input will be called "0000". The output will be called "500".

Final step- We have to convert the schematic into a logical sequence of events. This is much easier than it sounds. The program we're going to write tells the plc what to do when certain events take place. In our example we have to tell the plc what to do when the operator turns on the switch. Obviously we want the bell to sound but the plc doesn't know that. It's a pretty stupid device, isn't it!

The picture above is the final converted diagram. Notice that we eliminated the real world relay from needing a symbol. It's actually "inferred" from the diagram. Huh? Don't worry, you'll see what we mean as we do more examples.

Shift Registers

Shift Registers

In many applications it is necessary to store the status of an event that has previously happened. As we've seen in past chapters this is a simple process. But what do we do if we must store many previous events and act upon them later.
Answer: we call upon the shift register instruction.

We use a register or group of registers to form a train of bits (cars) to store the previous on/off status. Each new change in status gets stored in the first bit and the remaining bits get shifted down the train. Huh? Read on.

The shift register goes by many names. SFT (ShiFT), BSL (Bit Shift Left), SFR (Shift Forward Register) are some of the common names. These registers shift the bits to the left. BSR (Bit Shift Right) and SFRN (Shift Forward Register Not) are some examples of instructions that shift bits to the right. We should note that not all manufacturers have shift registers that shift data to the right but most all do have left shifting registers.

A typical shift register instruction has a symbol like that shown above. Notice that the symbol needs 3 inputs and has some data inside the symbol.

The reasons for each input are as follows:

• Data- The data input gathers the true/false statuses that will be shifted down the train. When the data input is true the first bit (car) in the register (train) will be a 1. This data is only entered into the register (train) on the rising edge of the clock input.
• Clock- The clock input tells the shift register to "do its thing". On the rising edge of this input, the shift register shifts the data one location over inside the register and enters the status of the data input into the first bit. On each rising edge of this input the process will repeat.
• Reset- The reset input does just what it says. It clears all the bits inside the register we're using to 0.

The 1000 inside the shift register symbol is the location of the first bit of our shift register. If we think of the shift register as a train (a choo-choo train that is) then this bit is the locomotive. The 1003 inside the symbol above is the last bit of our shift register. It is the caboose. Therefore, we can say that 1001 and 1002 are cars in between the locomotive and the caboose. They are intermediate bits. So, this shift register has 4 bits.(i.e. 1000,1001,1002,1003)

Lets examine an application to see why/how we can use the shift register.

Imagine an ice-cream cone machine. We have 4 steps. First we verify the cone is not broken. Next we put ice cream inside the cone.(turn on output 500) Next we add peanuts.(turn on output 501) And finally we add sprinkles.(turn on output 502) If the cone is broken we obviously don't want to add ice cream and the other items. Therefore we have to track the bad cone down our process line so that we can tell the machine not to add each item. We use a sensor to look at the bottom of the cone. (input 0000) If its on then the cone is perfect and if its off then the cone is broken. An encoder tracks the cone going down the conveyor. (input 0001) A push button on the machine will clear the register. (input 0002)

Here's what the ladder would look like:

Let's now follow the shift register as the operation takes place. Here's what the 1000 series register (the register we're shifting) looks like initially:

10xx Register
15	14	13	12	11	10	09	08	07	06	05	04	03	02	01	00
												0	0	0	0

A good cone comes in front of the sensor (input 0000). The sensor (data input) turns on. 1000 will not turn on until the rising edge of the encoder (input 0001). Finally the encoder now generates a pulse and the status of the data input (cone sensor input 0000) is transferred to bit 1000. The register now looks like:

10xx Register
15	14	13	12	11	10	09	08	07	06	05	04	03	02	01	00
												0	0	0	1

As the conveying system moves on, another cone comes in front of the sensor. This time it's a broken cone and the sensor remains off. Now the encoder generates another pulse. The old status of bit 1000 is transferred to bit 1001. The old status of 1001 shifts to 1002. The old status of 1002 shifts to 1003. And the new status of the data input (cone sensor) is transferred to bit 1000. The register now looks like:

10xx Register
15	14	13	12	11	10	09	08	07	06	05	04	03	02	01	00
												0	0	1	0

Since the register shows that 1001 is now on, the ladder says that output 0500 will turn on and ice cream is put in the cone.

As the conveying system continues to move on, another cone comes in front of the sensor. This time it's a good cone and the sensor turns on. Now the encoder generates another pulse. The old status of bit 1000 is transferred to bit 1001. The old status of 1001 shifts to 1002. The old status of 1002 shifts to 1003. And the new status of the data input (cone sensor) is transferred to bit 1000. The register now looks like:

10xx Register
15	14	13	12	11	10	09	08	07	06	05	04	03	02	01	00
												0	1	0	1

Since the register shows that 1002 is now on the ladder says that output 0501 will turn on and peanuts are put on the cone. Since 1001 now holds the status of a broken cone, 500 remains off in the ladder above and no ice-cream is inserted into this cone. As the conveying system continues to move on, another cone comes in front of the sensor. This time it's also a good cone and the sensor turns on. Now the encoder generates another pulse. The old status of bit 1000 is transferred to bit 1001. The old status of 1001 shifts to 1002. The old status of 1002 shifts to 1003. And the new status of the data input (cone sensor) is transferred to bit 1000. The register now looks like:

10xx Register
15	14	13	12	11	10	09	08	07	06	05	04	03	02	01	00
												1	0	1	1

Since the register shows that 1003 is now on the ladder says that output 0502 will turn on and sprinkles are put on the cone. (Its done, yummy...)Since 1002 now holds the status of a broken cone, 501 remains off in the ladder above and no peanuts are put onto this cone. Since the register shows that 1001 is now on the ladder says that output 0500 will turn on and ice cream is put in that cone.

As the conveying system continues to move on, another cone comes in front of the sensor. This time it's another broken cone and the sensor turns off. Now the encoder generates another pulse. The old status of bit 1000 is transferred to bit 1001. The old status of 1001 shifts to 1002. The old status of 1002 shifts to 1003. And the new status of the data input (cone sensor) is transferred to bit 1000. The register now looks like:

10xx Register
15	14	13	12	11	10	09	08	07	06	05	04	03	02	01	00
												0	1	1	0

Notice that the status of our first cone has disappeared. In reality its sitting in location 1004 but it's useless for us to draw an application with 16 processes here. Suffice it to say that after the bit is shifted all the way to the left it disappears and is never seen again. In other words, it has been shifted out of the register and is erased from memory. Although it's not drawn, the operation above would continue on with each bit shifting on the rising edge of the encoder signal.

Timers

Timers

Let's now see how a timer works. What is a timer? Its exactly what the word says... it is an instruction that waits a set amount of time before doing something. Sounds simple doesn't it.

When we look at the different kinds of timers available the fun begins. As always, different types of timers are available with different manufacturers. Here are most of them:

• On-Delay timer-This type of timer simply "delays turning on". In other words, after our sensor (input) turns on we wait x-seconds before activating a solenoid valve (output). This is the most common timer. It is often called TON (timer on-delay), TIM (timer) or TMR (timer).
• Off-Delay timer- This type of timer is the opposite of the on-delay timer listed above. This timer simply "delays turning off". After our sensor (input) sees a target we turn on a solenoid (output). When the sensor no longer sees the target we hold the solenoid on for x-seconds before turning it off. It is called a TOF (timer off-delay) and is less common than the on-delay type listed above. (i.e. few manufacturers include this type of timer)
• Retentive or Accumulating timer- This type of timer needs 2 inputs. One input starts the timing event (i.e. the clock starts ticking) and the other resets it. The on/off delay timers above would be reset if the input sensor wasn't on/off for the complete timer duration. This timer however holds or retains the current elapsed time when the sensor turns off in mid-stream. For example, we want to know how long a sensor is on for during a 1 hour period. If we use one of the above timers they will keep resetting when the sensor turns off/on. This timer however, will give us a total or accumulated time. It is often called an RTO (retentive timer) or TMRA (accumulating timer).

Let's now see how to use them. We typically need to know 2 things:

1. What will enable the timer. Typically this is one of the inputs.(a sensor connected to input 0000 for example)
2. How long we want to delay before we react. Let's wait 5 seconds before we turn on a solenoid, for example.

When the instructions before the timer symbol are true the timer starts "ticking". When the time elapses the timer will automatically close its contacts. When the program is running on the plc the program typically displays the elapsed or "accumulated" time for us so we can see the current value. Typically timers can tick from 0 to 9999 or 0 to 65535 times.

Why the weird numbers? Again its because most PLCs have 16-bit timers. We'll get into what this means in a later chapter but for now suffice it to say that 0-9999 is 16-bit BCD (binary coded decimal) and that 0 to 65535 is 16-bit binary. Each tick of the clock is equal to x-seconds.

Typically each manufacturer offers several different ticks. Most manufacturers offer 10 and 100 ms increments (ticks of the clock). An "ms" is a milli-second or 1/1000th of a second. Several manufacturers also offer 1ms as well as 1 second increments. These different increment timers work the same as above but sometimes they have different names to show their timebase. Some are TMH (high speed timer), TMS (super high speed timer) or TMRAF (accumulating fast timer)

Shown below is a typical timer instruction symbol we will encounter (depending on which manufacturer we choose) and how to use it. Remember that while they may look different they are all used basically the same way. If we can setup one we can setup any of them.

This timer is the on-delay type and is named Txxx. When the enable input is on the timer starts to tick. When it ticks yyyyy (the preset value) times, it will turn on its contacts that we will use later in the program. Remember that the duration of a tick (increment) varies with the vendor and the timebase used. (i.e. a tick might be 1ms or 1 second or...)

Below is the symbol shown on a ladder diagram:

In this diagram we wait for input 0001 to turn on. When it does, timer T000 (a 100ms increment timer) starts ticking. It will tick 100 times. Each tick (increment) is 100ms so the timer will be a 10000ms (i.e. 10 second) timer. 100ticks X 100ms = 10,000ms. When 10 seconds have elapsed, the T000 contacts close and 500 turns on. When input 0001 turns off(false) the timer T000 will reset back to 0 causing its contacts to turn off(become false) thereby making output 500 turn back off.

Relay Outputs

Relay Outputs

By now we should have a good understanding of how the inputs are used. Next up is the output circuits.

One of the most common types of outputs available is the relay output. A relay can be used with both AC and DC loads. A load is simply a fancy word for whatever is connected to our outputs. We call it a load because we are "loading the output" with something. If we connected no load to the output (i.e. just connect it directly to a power supply) we would certainly damage the outputs. This would be similar to replacing the lightbulb in the lamp you're using to read this with a piece of wire. If you did this, the lamp would draw a tremendous amount of current from the outlet and certainly pop your circuit breaker or blow your fuse or your brains. (Take our word. Please don't try it! Extremely dangerous!)

Some common forms of a load are a solenoid, lamp, motor, etc. These "loads" come in all sizes. Electrical sizes, that is. Always check the specifications of your load before connecting it to the plc output. You always want to make sure that the maximum current it will consume is within the specifications of the plc output. If it is not within the specifications (i.e. draws too much current) it will probably damage the output. When in doubt, double check with the manufacturer to see if it can be connected without potential damage.

Some types of loads are very deceiving. These deceiving loads are called "inductive loads". These have a tendency to deliver a "back current" when they turn on. This back current is like a voltage spike coming through the system.

A good example of an inductive load that most of us see about 6 months per year is an air conditioning unit. Perhaps in your home you have an air conditioner. (unless you live in the arctic you probably do!) Have you ever noticed that when the air conditioner "kicks on" the lights dim for a second or two. Then they return to their normal brightness. This is because when the air conditioner turns on it tries to draw a lot of current through your wiring system. After this initial "kick" it requires less current and the lights go back to normal. This could be dangerous to your PLCs output relays. It can be estimated that this kick is about 30 times the rated current of the load. Typically a diode, varistor, or other "snubber" circuit should be used to help combat any damage to the relay. Enough said. Let's see how we can use these outputs in the "real plc world".

Shown above is a typical method of connecting our outputs to the plc relays. Although our diagram shows the output connected to an AC supply, DC can be used as well. A relay is non-polarized and typically it can switch either AC or DC. Here the common is connected to one end of our power supply and the other end of the supply is connected to the load. The other half of our load gets connected to the actual plc output you have designated within your ladder program.

The relay is internal to the plc. Its circuit diagram typically looks like that shown above. When our ladder diagram tells the output to turn on, the plc will internally apply a voltage to the relay coil. This voltage will allow the proper contact to close. When the contact closes, an external current is allowed to flow through our external circuit. When the ladder diagram tells the plc to turn off the output, it will simply remove the voltage from the internal circuit thereby enabling the output contact to release. Our load will than have an open circuit and will therefore be off. Simple, isn't

Relays

Relays

Now that we understand how the PLC processes inputs, outputs, and the actual program we are almost ready to start writing a program. But first lets see how a relay actually works. After all, the main purpose of a plc is to replace "real-world" relays.

We can think of a relay as an electromagnetic switch. Apply a voltage to the coil and a magnetic field is generated. This magnetic field sucks the contacts of the relay in, causing them to make a connection. These contacts can be considered to be a switch. They allow current to flow between 2 points thereby closing the circuit.

Let's consider the following example. Here we simply turn on a bell (Lunch time!) whenever a switch is closed. We have 3 real-world parts. A switch, a relay and a bell. Whenever the switch closes we apply a current to a bell causing it to sound.

Notice in the picture that we have 2 separate circuits. The bottom(blue) indicates the DC part. The top(red) indicates the AC part.

Here we are using a dc relay to control an AC circuit. That's the fun of relays! When the switch is open no current can flow through the coil of the relay. As soon as the switch is closed, however, current runs through the coil causing a magnetic field to build up. This magnetic field causes the contacts of the relay to close. Now AC current flows through the bell and we hear it. Lunch time!

A typical industrial relay

AC Inputs

AC Inputs

Now that we understand how dc inputs work, let's take a close look at ac inputs. An ac voltage is non-polarized. Put simply, this means that there is no positive or negative to "worry about". However, ac voltage can be quite dangerous to work with if we are careless. (Remember when you stuck the knife in the toaster and got a shock? Be careful) Typically, ac input modules are available that will work with 24, 48, 110, and 220 volts. Be sure to purchase the one that fits your needs based upon the input devices (voltage) you will use.

OUCH... use care!!

AC input modules are less common these days than dc input modules. The reason being that today's sensors typically have transistor outputs. A transistor will not work with an ac voltage. Most commonly, the ac voltage is being switched through a limit switch or other switch type. If your application is using a sensor it probably is operating on a dc voltage.

We typically connect an ac device to our input module as shown above. Commonly the ac "hot" wire is connected to the switch while the "neutral" goes to the plc common. The ac ground (3rd wire where applicable) should be connected to the frame ground terminal of the plc.(not shown) As is true with dc, ac connections are typically color coded so that the individual wiring the device knows which wire is which. This coding varies from country to country but in the US is commonly white (neutral), black (hot) and green (3rd wire ground when applicable). Outside the US it's commonly coded as brown (hot), blue (neutral) and green with a yellow stripe (3rd wire ground where applicable).

The PLCs ac input module circuit typically looks like this:

The only things accessible to the user are the terminals labeled COMMON, INPUT 0000, INPUTxxxx... The common terminal gets connected to the neutral wire.

A common switch (i.e. limit switch, pushbutton, toggle, etc.) would be connected to the input terminals directly. One side of the switch would be connected directly to INPUT XXX. The other end goes to the ac hot wire. This assumes the common terminal is connected to neutral. Always check the manufacturers specifications before wiring, to be sure AND SAFE.

The photocouplers are used to isolate the PLCs internal circuit from the inputs. This eliminates the chance of any electrical noise entering the internal circuitry. They work by converting the electrical input signal to light and then by converting the light back to an electrical signal to be processed by the internal circuit.

One last note, typically an ac input takes longer than a dc input for the plc to see. In most cases it doesn't matter to the programmer because an ac input device is typically a mechanical switch and mechanical devices are slowwwwww. It's quite common for a plc to require that the input be on for 25 or more milliseconds before it's seen. This delay is required because of the filtering which is needed by the plc internal circuit. Remember that the plc internal circuit typically works with 5 or less volts dc.

The Guts Inside

The Guts Inside

The PLC mainly consists of a CPU, memory areas, and appropriate circuits to receive input/output data. We can actually consider the PLC to be a box full of hundreds or thousands of separate relays, counters, timers and data storage locations. Do these counters, timers, etc. really exist? No, they don't "physically" exist but rather they are simulated and can be considered software counters, timers, etc. These internal relays are simulated through bit locations in registers. (more on that later)

What does each part do?

• INPUT RELAYS-(contacts)These are connected to the outside world. They physically exist and receive signals from switches, sensors, etc. Typically they are not relays but rather they are transistors.
• INTERNAL UTILITY RELAYS-(contacts) These do not receive signals from the outside world nor do they physically exist. They are simulated relays and are what enables a PLC to eliminate external relays. There are also some special relays that are dedicated to performing only one task. Some are always on while some are always off. Some are on only once during power-on and are typically used for initializing data that was stored.
• COUNTERS-These again do not physically exist. They are simulated counters and they can be programmed to count pulses. Typically these counters can count up, down or both up and down. Since they are simulated they are limited in their counting speed. Some manufacturers also include high-speed counters that are hardware based. We can think of these as physically existing. Most times these counters can count up, down or up and down.
• TIMERS-These also do not physically exist. They come in many varieties and increments. The most common type is an on-delay type. Others include off-delay and both retentive and non-retentive types. Increments vary from 1ms through 1s.
• OUTPUT RELAYS-(coils)These are connected to the outside world. They physically exist and send on/off signals to solenoids, lights, etc. They can be transistors, relays, or triacs depending upon the model chosen.
• DATA STORAGE-Typically there are registers assigned to simply store data. They are usually used as temporary storage for math or data manipulation. They can also typically be used to store data when power is removed from the PLC. Upon power-up they will still have the same contents as before power was removed. Very convenient and necessary!!

One-shots

One-shots

A one-shot is an interesting and invaluable programming tool. At first glance it might be difficult to figure out why such an instruction is needed. After we understand what this instruction does and how to use it, however, the necessity will become clear.

A one-shot is used to make something happen for ONLY 1 SCAN. (you do remember what a scan is, right??) Most manufacturers have one-shots that react to an off to on transition and a different type that reacts to an on to off transition. Some names for the instructions could be difu/difd (differentiate up/down), sotu/sotd (single output up/down), osr (one-shot rising) and others. They all, however, end up with the same result regardless of the name.

Above is the symbol for a difu (one-shot) instruction. A difd looks the same but inside the symbol it says "difd". Some of the manufacturers have it in the shape of a box but, regardless of the symbol, they all function the same way. For those manufacturers that don't include a differentiate down instruction, you can get the same effect by putting a NC (normally closed) instruction before it instead of a NO(normally open) instruction. (i.e. reverse the logic before the difu instruction)

Let's now setup an application to see how this instruction actually functions in a ladder. This instruction is most often used with some of the advanced instructions where we do some things that MUST happen only once. However, since we haven't gotten that far yet, let's set up a flip/flop circuit. In simple terms, a flip/flop turns something around each time an action happens. Here we'll use a single pushbutton switch. The first time the operator pushes it we want an output to turn on. It will remain "latched" on until the next time the operator pushes the button. When he does, the output turns off.

Here's the ladder diagram that does just that:

Now this looks confusing! Actually it's not if we take it one step at a time.

• Rung 1-When NO (normally open) input 0000 becomes true DIFU 1000 becomes true.
• Rung 2- NO 1000 is true, NO 1001 remains false, NC 1001 remains true, NC 1000 turns false. Since we have a true path, (NO 1000 & NC 1001) OUT 1001 becomes true.
• Rung 3- NO 1001 is true therefore OUT 500 turns true.

Next Scan

• Rung 1- NO 0000 remains true. DIFU 1000 now becomes false. This is because the DIFU instruction is only true for one scan. (i.e. the rising edge of the logic before it on the rung)
• Rung 2- NO 1000 is false, NO 1001 remains true, NC 1001 is false, NC 1000 turns true. Since we STILL have a true path, (NO 1001 & NC 1000) OUT 1001 remains true.
• Rung 3- NO 1001 is true therefore OUT 500 remains true.

After 100 scans, NO 0000 turns off (becomes false). The logic remains in the same state as "next scan" shown above. (difu doesn't react therefore the logic stays the same on rungs 2 and 3)

On scan 101 NO 0000 turns back on. (becomes true)

• Rung 1-When NO (normally open) input 0000 becomes true DIFU 1000 becomes true.
• Rung 2- NO 1000 is true, NO 1001 remains true, NC 1001 becomes false, NC 1000 also becomes false. Since we no longer have a true path, OUT 1001 becomes false.
• Rung 3- NO 1001 is false therefore OUT 500 becomes false.