Comprehensive Explanation of PLC: Working Principles & Data Types

Working Principles of PLC

PLC (Programmable Logic Controller), a computer used for industrial control.

Basic Components of PLC

The basic components include Power Supply, CPU, Memory, Input Units, Output Units, Communication Interfaces, Expansion Interfaces.

(1) Power Supply: PLC can be powered by 220VAC or 24VDC, the CPU processing unit requires 5VDC.

(2) CPU (Central Processing Unit), includes the controller, arithmetic unit, and registers.

(3) Memory is a semiconductor circuit with memory function, capable of storing system programs, user programs, and logical variables. It is divided into ROM (Read Only Memory system storage area) and RAM (Random Access Memory).

i. The ROM storage area is divided into system management programs, user program editing, instruction interpretation programs, subroutine calls, and management programs.

ii. The RAM storage area includes user program storage and data storage, used to hold user programs and the ON/OFF status of each point during program execution. The data in the user storage area is readable and writable. The materials used are CMOS RAM or EPRAM and EEPRAM. Capacity is generally measured in ‘words’ (16 bits is 1 word, 8 bits is 1 byte). Therefore, I recommend using even-numbered programming during programming.

(4) The input unit refers to the unit that receives signals, detects the information sent by the signals, and converts it into digital signals of high and low levels. (Divided into discrete and analog signals, analog signals are usually converted into digital signals using A/D conversion circuits. The interface circuits for digital signals are more diverse, divided into internal DC input (12V or 24V), external AC input (100-120V, 200-240V), external AC/DC input, and input circuits connected to signal output.)(AC input, DC input, source-type leakage-type, common cathode common anode, external signal output connected to PLC input unit (PNP, NPN))

(5) The output unit converts the weak electrical signals processed by the CPU into level signals. (Level signals refer to the power ratio of the device output signal to the input signal, usually expressed as P, where P=lgP2/P1.)(Output interfaces are divided into discrete and analog signals. Analog interfaces typically convert digital signals into analog signals using D/A conversion circuits; the forms of digital output circuits are diverse, including relay output, transistor output (PNP, NPN), and thyristor output.)

(6) Communication interfaces enable communication with monitors, printers, other PLCs, computers, and other devices.

(7) Expansion interfaces add some special function modules to the PLC, such as high-speed counting modules, closed-loop control modules, motion control modules, and interrupt control modules.

Working Principles of PLC

PLC Power On → Internal Processing → Communication Processing → Self-Diagnosis → Input Sampling → User Program Execution → Output Refresh

PLC adopts a cyclic scanning method, centralized input and output.

Advantages: High reliability, strong anti-interference ability. Disadvantages: Slow response speed, response lag. PLC uses WDT (Watchdog Timer) to monitor whether the scanning exceeds the preset time.

Internal self-processing: Includes hardware initialization, I/O module configuration checks, power outage protection range settings, etc. During the self-diagnosis testing phase, the CPU detects the status of each module in the PLC. If an anomaly occurs, it immediately diagnoses and processes it, while providing a fault signal and lighting the LED indicator on the CPU panel. When a fatal error occurs, the CPU is forced into STOP mode, halting program execution. The CPU’s self-diagnosis test helps to timely discover or forecast system failures, improving system reliability.

During the communication processing phase: The PLC communicates with its intelligent modules that have CPUs and other external devices to complete data transmission and reception, respond to programmer commands, update the content displayed on the programmer, and update clocks and special registers. In the communication processing phase, the CPU checks for communication tasks. If any exist, it calls the corresponding process to complete communication with other devices (for example, intelligent modules with microprocessors, remote I/O interfaces, programmers, HMI devices, etc.) and processes the communication data accordingly.

(Self-diagnosis → Input Sampling → User Program Execution → Output Refresh →) constitutes one scanning cycle.

Input sampling phase: Scans all input terminals and stores their states (0/1) in the input register (PII). It then closes the input channel and proceeds to the next program step. This method is highly reliable but incurs a certain time delay. In large projects, due to time constraints, periodic input sampling, direct input sampling, interrupt input sampling, and intelligent I/O interface module sampling may be employed to improve speed.

User program execution phase: In this phase, data from the input register (PIQ) and internal element registers (internal relays, counters, timers) are extracted, and the status and data of related elements are processed according to logical and arithmetic operations in the program, with results written to the output image register and relevant memory. Therefore, within the PLC, the status of internal element registers is continuously changing.

Output processing phase: After the program execution is complete, all output relay statuses in the internal element registers are transferred to the output latch at once during the output phase, isolated and driven through power amplification circuits to the output end, and the external PLC wiring drives the actual load.

Input-output lag time: This time is also known as system response time, including input circuit filtering time, output circuit lag time, and lag time caused by scanning operation mode. The response delay of PLCs is generally several milliseconds to dozens of milliseconds, which does not affect typical systems. If a shorter response time is required, we can use a faster scanning PLC or adopt interrupt measures.

(1) Input circuit filtering time. This is mainly due to external signals possibly containing noise interference, voltage spikes, and external jitter that can impact our input signals. Therefore, RC filtering circuits (composed of voltage and current sources driving capacitors and resistors) and optocouplers (using optocouplers on the input side to electrically isolate internal and external circuits) are used to eliminate these influences. The time constant of the filtering circuit determines the duration of the filtering time.

(2) Output module circuit lag time: This depends on the type; relay output modules generally have a lag time of 10ms, bidirectional thyristors have a lag time of 1ms-10ms, and transistors have a lag time of less than 1ms.

(3) Lag time caused by the scanning operation mode: This can last up to 2-3 scanning cycles.

Data processing inside the hardware is performed in binary.

Negative number processing is also implemented using the binary complement.

Uses: Internal processing.

In the Mitsubishi FX series, the soft element numbers for input and output relays are X0~X7 Y010~Y017.

Uses: Input and output relay soft element numbering.

BCD code represents decimal numbers in binary form; for example, the BCD code for 10 is 0001 0000.

Uses: BCD digital switches, 7-segment display.

In the Mitsubishi FX series, binary is used for real number calculations, and decimal is used for real number monitoring.

String constants can be up to 32 bits.

Character length is 8 bits, so D100 (16 bits) can represent two characters.

String data starts from a specified position (either D100 or M100), and when it encounters the OOH code (NULL code, which requires 16 bits), it indicates the end of the string. If it does not encounter OOH or only encounters general characters, it will not detect the end of the string.

In the Mitsubishi FX series, the bit number specification is (KnX0 ………).

Bit soft elements are processed as ON/OFF information, such as X, Y, S, M.

Numeric soft elements are processed as word information, such as T, C, D, R.

However, our bit soft elements can also be used as words through combination. The bit number Kn and the starting soft element number’s bit number are 4-bit units; K1K4 represents 16 bits; K1K8 represents 32 bits.

Continuous word specification.

Sub-soft element bit specification (D100.E).

(Bit (BOOL) → Byte (BYTE) → Word (WORD)/Integer (INT) → Double Word (DWORD)/Double Integer (DINT)/Floating Point (REAL))

ASCII/String (STRING)

1 TTL level signal is 1 bit; 8 bits make a byte; 2 bytes make a word; 2 words make a double word.

Bits are BOOL, Boolean type, range is 0 / 1.

Bytes range from 0—255; 0-FF; adjacent 8 bits are (0-7) (IB1=I1.0~I1.7).

Words range from 0—65535; 0000-FFFF; adjacent two bytes (IW2=IB2+IB3).

Double words range from 0—2 to the power of 32; 00000000-FFFFFFFF; adjacent two words (ID4=IW4+IW6=IB4+IB5+IB6+IB7).

Addressing methods include bit addressing, byte addressing, word addressing, and double word addressing.

Bit addressing: I0.0 I0.1 I0.2 I1.5 I2.7 I2.8 (Error)

Byte addressing: VB0 VB1 VB2 VB3… (Interval is 1)

Word addressing: VW0 VW2 VW4 VW6 VW32… (Interval is 2)

Double word addressing: VD0 VD4 VD8 VD32…. (Interval is 4)

How to understand Siemens’ data storage type as high word low position?

MD100

MW100MW102

MB100MB101MB102MB103

M100.7/6/5/4/3/2/1/0M101.7/6/5/4/3/2/1/0M102.7/6/5/4/3/2/1/0 M103.7/6/5/4/3/2/1/0

Among them, M103.0 is the low position of the high byte; M100.7 is the high position of the low byte.

How to understand Mitsubishi’s data storage type as high word high position? (Storage increases from right to left)

D100

D101D100

D101. F/E/D/C/B/A/9/8/7/6/5/4/3/2/1/0D100.F/E/D/C/B/A/9/8/7/6/5/4/3/2/1/0

Among them, D101.F is the high position of the high byte; D100.0 is the low position of the low byte.

①

Immediate Addressing

②

Direct Addressing

a) Absolute Address

b) Symbolic Address

③

Indirect Addressing

a) Memory Indirect Addressing

i. 16-bit Pointer (DB, T, C)

ii. 32-bit Pointer (Memory Indirect Addressing)

b) Register Indirect Addressing

i. 32-bit Pointer Internal Addressing

ii. 32-bit Pointer Memory Cross Addressing

V memory (Variable Memory) is generally used to store intermediate logical results and is very common.

M memory (Flag Memory) is generally used for flags and is not frequently used. MB0-MB13 stores these 14 bytes.

Stored permanently in EEPROM, retained during power outages.

SM memory (System Memory): Can be viewed in F1 help or in the WIN symbol table for S7-200 instructions.

SM0.0: This bit is always on.

SM0.1: Activated during the first scan, used for program initialization.

SM0.5: Clock pulse, closed for 0.5s, open for 0.5s.

L memory (Local Memory): V memory is globally valid, while L memory is only locally valid. Local memory requires dynamic allocation by the CPU. When an interrupt program or subroutine is called, the CPU allocates local memory to the interrupt program or subroutine. Additionally, local memory must be initialized during allocation because the data is random.

AC Register (Accumulator Register): Can pass parameters to subroutines and store intermediate calculation results. The S7-200 provides 4 32-bit accumulators (AC0 AC1 AC2 AC3).

Note: In S7-300, registers include: ACCUx accumulator registers, AR1/AR2 address registers, data block registers, status words.

In S7-300, storage areas include: I/Q input/output process image areas, M (bit storage area), T timers, C counters, PQ/PI immediate access output/input modules, DB shared data blocks, DI background data blocks, L local data.

(1) Clarify the system control requirements.

The system requires 3 buttons to control forward, reverse, and stop, and requires overload protection for the motor, as well as self-locking and interlocking for forward and reverse.

(2) Determine input and output devices and allocate corresponding I/O terminals.

(3) Draw the system control circuit diagram.

Main circuit, control circuit.

(4) Write the PLC control program.

Forward control, reverse control, stop control, overload protection.

(5) Program debugging.

(6) Install the system control circuit and perform on-site debugging.

After the program is debugged, on-site debugging is performed. (Hardware issues & Software issues).

(7) System put into operation.

Trial for a period.

In STEP7, constant values can be bytes, words, double words, and the CPU uses binary to store constants. In STEP7, constants can also be represented in decimal, hexadecimal, ASCII code, floating point, etc.

B#W16, W#16#, DW#16# represent hexadecimal byte constant, hexadecimal word constant, hexadecimal double word constant.

2# represents binary constant.

L# represents 32-bit double integer constant.

P# represents address pointer constant.

S5T# represents 16-bit S5 time constant.

T# represents signed 32-bit IEC time constant.

DATE is ITC’s time constant.

C# represents 16-bit counter constant (BCD code).

ASCII characters are represented using single quotes ”, each ASCII code occupies one byte.

When inputting constants, be sure to use English punctuation.