Programmable Logic

Controllers:
An Emphasis on Design and Application

Kelvin T. Erickson
University ofMissouri-Rolla

~
DOgwOOd
Valley
Press, LLC
 Dedicated to Fran, Esther, and David

Copyright © 2005 Dogwood Valley Press, LLC. All rights reserved.

No portion of this book may be reproduced, stored in a retrieval system, or transmitted in
any form or by any means, including electronic, mechanical, photocopying, scanning,
recording or otherwise, except as permitted under the 1976 United States Copyright Act,
without explicit, prior written permission of the publisher except for brief passages
excerpted for review and critical purposes.

This book was set in Times New Roman and printed on acid-free paper.

Printed in the United States of America

ISBN 0-9766259-0-3

Dogwood Valley Press, LLC

1604 Lincoln Lane
Rolla, MO 65401
1-573-426-3507
http://www.DogwoodValleyPress.com
10 9 8 7 6 5 4 3 2 1
CONTENTS
Preface VII

Chapter 1 Introduction to PLCs 1

l.l Introduction 1
1.2 Automatic Control in Manufacturing 1
1.3 Control System Classifications 2
1.4 History of the PLC 6
1.5 PLC Versus Other Technologies 13
1.6 Basic PLC Architecture 15
1.7 Chapter Summary 20
References 20

Chapter 2 Basic Ladder Logic Programming 23

2.1 Introduction 24
2.2 Simple Ladder Logic 24
2.3 Basic Ladder Logic Synbols 29
2.4 Ladder Logic Diagram 37
2.5 PLC Processor Scan 43
2.6 Programming with NC Contact 53
2.7 Start/Stop 54
2.8 Converting Relay Logic to Ladder Logic 60
2.9 Chapter Summary 64
References 65
Problems 67

Chapter 3 Memory Organization and Addressing 77

3.1 Introduction 78
3.2 IEC61131-3MemoryModel 78
3.3 Modicon QuantumlMomentum Memory 80
3.4 A-B ControlLogix Memory 90
3.5 A-B PLC-5 and SLG-500 Memory 97
3.6 Siemens S7 Memory 115
3.7 GE Fanuc Memory 131
3.8 Chapter Summary 140
References 140
Problems 141
ii Contents

Chapter 4 Input/Output Modules and Installation 147

4.1 Introduction 148
4.2 Discrete Modules 150
4.3 Analog Modules 164
4.4 Specialized Modules 171
4.5 Installation Wiring 176
4.6 Chapter Summary 192
References 192
Problems 195

Chapter 5 Timers and Counters 197

5.1 Introduction 199
5.2 IEC Timers and Counters 199
5.3 Modicon Timers and Counters 200
5.4 A-B ControiLogix Timers and Counters 209
5.5 A-B PLC-5/SLC-500 Timers and Counters 219
5.6 Siemens S7 Timers and Counters 225
5.7 GE Fanuc Timers and Counters 244
5.8 General Timers and Counter Situations 250
5.9 Examples 252
5.10 Chapter Summary 274
References 274
Problems 276

Chapter 6 Sequential Applications 295

6.1 Introduction 296
6.2 Function Chart 297
6.3 Implementing Function Chart in Ladder Logic 303
6.4 Complicated Reset Operation 326
6.5 Parallel Operations 347
6.6 Key Questions in the Sequential Design Process 357
6.7 Manual and Single-Step Sequential Operation 357
6.8 Transitions When PLC Has No Reset 360
6.9 Chapter Summary 360
References 365
Problems 366

Chapter 7 Comparison and Computation 429

7.1 Introduction 430
7.2 Conversion of Physical Quantity 430
7.3 IEC Comparison and Computation 434
7.4 Modicon Comparison and Computation 435
7.5 A-B ControlLogix Comparison and Computation 445
7.6 A-B PLC-5/SLC-500 Comparison and Computation 452
7.7 Siemens S7 Comparison and Computation 463
7.8 GE Fanuc Comparison and Computation 474
7.9 Application Caveats 482
7.10 Examples 482
 Contents iii

7.11 Chapter Summary 512

References 513
Problems 514

Chapter 8 Other Ladder Logic Instructions 567

8.1 Introduction 567
8.2 Other IEC Function Blocks 569
8.3 Other Modicon Function Blocks 569
8.4 Other ControlLogix Function Blocks 580
8.5 Other PLC-5/SLC-500 Function Blocks 599
8.6 Other Siemens S7 Function Blocks 618
8.7 Other GE Fanuc Function Blocks 633
8.8 Examples 647
8.9 Chapter Summary 669
References 669
Problems 672

Chapter 9 Other Function Chart Implementations 677

9.1 Introduction 679
9.2 Counter-Based Sequence 679
9.3 Shift Register-Based Sequence 708
9.4 Sequencer Function Blocks 730
9.5 Unstructured Sequence 754
9.6 Chapter Summary 759
References 759
Problems 761

Chapter 10 Pill Control 765

10.1 Introduction 768
10.2 Feedback Control Performance 772
10.3 Pill Controller 776
10.4 Pill Controller Tuning 785
10.5 Pill Control Enhancements 805
10.6 Operational Aspects 817
10.7 PLC PID Function Blocks 818
10.8 Examples 839
10.9 Chapter Summary 853
References 854
Problems 856

Chapter 11 Function Block Diagram 869'

11.1 Introduction 870
11.2 IEC 61131-3 Function Block Diagram 871
11.3 Modicon Function Block Diagram 874
11.4 ControlLogix Function Block Diagram 877
11.5 Siemens S7 Function Block Diagram 893
11.6 Examples 896
11.7 Chapter Summary 910
iv Contents

References 911
Problems 913

Chapter 12 Structured Text 919

12.1 Introduction 920
12.2 IEC61131-3 Structured Text 921
12.3 Modicon Structured Text 929
12.4 ControlLogix Structured Text 930
12.5 PLC-5 Structured Text 932
12.6 Siemens S7 Structured Control Language 934
12.7 Examples 936
12.8 Chapter Summary 948
References 948
Problems 950

Chapter 13 Instruction List 953

13.1 Introduction 953
13.2 lEC 61131-3 Instruction List 953
13.3 Modicon Instruction List 958
13.4 Siemens S7 Instruction List 958
13.5 GE Fanuc Instruction List 961
13.6 Examples 962
13.7 Chapter Summary 971
References 971
Problems 972

Chapter 14 Sequential Function Chart 975

14.1 Introduction 976
14.2 lEC 61131-3 Sequential Function Chart 976
14.3 Modicon Sequential Function Chart 994
14.4 ControlLogix Sequential Function Chart 1003
14.5 PLC-5 Sequential Function Chart 1011
14.6· Siemens S7 Sequential Function Chart 1019
14.7 Examples 1028
14.8 Chapter Summary 1064
References 1064
Problems 1065

Chapter 15 Troubleshooting 1067

15.1 Introduction 1069
15.2 General Troubleshooting Procedures 1070
15.3 Troubleshooting I/O Modules 1073
15.4 Processor Status Indicators 1083
15.5 Program Problems 1086
15.6 Communication Problems 1089
15.7 Designing for Fault Diagnosis 1091
15.8 Chapter Summary 1091
References 1091
 Contents v

Chapter 16 Sensors and Actuators 1093

16.1 Introduction 1095
16.2 Discrete Sensors 1095
16.3 Analog Sensors 1109
16.4 Discrete Actuators 1148
16.5 Analog Actuators 1155
16.6 Chapter Summary 1166
References 1166
Problems 1168
Appendix - Thermocouple Conversion Polynomial Coefficients 1174

Chapter 17 Communication Networks 1181

17.1 Introduction 1183
17.2 Network Protocols 1184
17.3 Ethernet 1191
17.4 Foundation Fieldbus 1192
17.5 CIP-Related Protocols 1196
17.6 PROFIBUS (OP, PA, PROFlnet) 1203
17.7 P-NET 1208
17.8 WorldFIP 1211
17.9 INTERBUS 1215
17.10 SwiftNet 1217
17.11 AS-i 1219
17.12 Seriplex 1220
17.13 Modicon Protocols 1222
17.14 Allen-Bradley Proprietary Networks 1225
17.15 GEFanucProprietaryNetworks 1226
17.16 Ladder Logic Communication Blocks 1227
17.17 Chapter Summary 1249
References 1249

Chapter 18 Human-Machine Interface 1253

18.) Introduction 1255
18.2 HMI Types 1255
18.3 HMI Panel Design 1259
18.4 Graphical HMI Design 1262
18.5 Graphical HMI Development 1268
18.6 Chapter Summary 1277
References 1277

Chapter 19 Control System Security 1279.

19.1 Introduction 1279
19.2 Factory Automation Network Security 1280
19.3 PLC Processor Security 1284
19.4 Chapter Summary 1297
References 1297
vi Contents

Chapter 20 Selecting a PLC 1299

20.1 Introduction 1299
20.2 Selection Factors 1300
20.3 PLC Families 1303
20.4 Chapter Summary 1308
References 1309

Chapter 21 Control Projects 1311

21.1 Introduction 1311
21.2 Typical Control Design Project 1312
21.3 Example Control Requirements Definition 1320
21.4 Standardization 1327
21.5 Testing 1387
21.6 Chapter Summary 1400
References 1401
Problems 1402

Chapter 22 Example Projects 1405

22.1 Introduction 1405
22.2 Coal Handling System 1405
22.3 Multi-Unit Chemical Process 1411
22.4 Chapter Summary 1416
References 1416

Appendix A Number Systems and Conversions 1417

Appendix B Electrical Diagram Symbols 1423

Appendix C Piping and Instrumentation Diagram (P&ID) Symbols 1426

Glossary 1429

Index 1445
PREFACE
The field of automatic control has been undergoing a transformation over the past
twenty years. Twenty years ago, the engineering undergraduate had a course in feedback
control theory and those interested in control engineering secured a position in the
aerospace or chemical industries. Due to various factors, the number of control engineering
positions in the aerospace industry has been declining, but the number of control
engineering positions in manufacturing has been dramatically increasing to the point that
the majority of control engineering positions is now in manufacturing and involves PLCs.
This book presents the subject of programming industrial controllers, called
programmable logic controllers (PLCs) with an emphasis on the design of the programs.
Many texts teach one how to program the PLC in its languages, but little, if any, attention is
paid to bow does one attack the problem: "Given a set of operational specifications, how
does one develop the PLC program?" This book develops the design process: the tasks
involved, breaking the program into manageable pieces, standard code for the various parts,
and handling the sequential parts of the problem. The emphasis is toward those who will be
programming PLCs.
Because of its popularity (now and in the future), ladder logic is the language that is
used for the majority of the text The industry trend is toward using the IEC 61131-3
(formerly IEC 1131-3) standard, and so it is the primary language. However, IEC 61131-3
is only a voluntary standard and individual manufacturers have some freedom in the
implementation. Therefore, the Allen-Bradley ControlLogix, Modicon, and Siemens S7
implementations of the 61131-3 standard are covered. Because oftheir large installed base,
Allen-Bradley PLC-5/SLC-500 and GE Fanuc PLC languages are also covered.
Due to the limitations of ladder logic, the IEC 61131-3 standard defines four other
languages: function block diagram, structured text, instruction list, and sequential function
chart. These four languages will become more popular in the future. Therefore, this text also
covers these langUages.
Since a typical manufiu:turing plant may contain discrete, continuous, and batch
processes, all of these applications are treated in this text, although the emphasis is on
discrete and continuous processes. The emphasis is on a methodology that can be applied to
any automation project, regardless of the size.
Throughout, the book contains example problems demonstrating good design practice.
In addition, these problems are solved with each PLC covered in the book. The text
culminates in two full-length case studies where the application of the design techniques to·
a large problem is illustrated.
This book takes a practical approach to the design of PLC control systems. Some
mathematical theory is used to backup the presentation on Pill controllers. However, the
theory is not detailed and can be omitted.
Except for Chapters 1 and 13, every chapter begins with a scenario that reflects the
experience of the author and his colleagues in the challenging world offiu:tory automation.

vii
viii Preface

These scenarios present a small problem and the solution and are intended to illustrate
troubleshooting techniques.

Objectives
The main objectives of this text are to teach:
• PLC programming languages (with emphasis on IEC 61131-3)
• Approach to sequential problems
• Good program design practice
• Simple PID control tuning
• Introduction to sensors and actuators
• Factory communications
• Human-machine interface (HMI) concepts

Content Overview
The book starts by introducing programmable logic controllers (PLCs) and their
distinguishing characteristics. Chapters 2 - 5 cover basic ladder logic programming:
contact, timer, and counter instructions. As part of the basics, the memory structure of the
five particular PLCs and installation topics are treated. Chapter 6 covers ladder logic
program design for sequential applications, probably the most significant contribution of
the text. Chapters 7 and 8 treat computation, comparison, and advanced ladder logic
instructions. Alternate sequential implementations in ladder logic are covered in Chapter 9
and PID controller tuning is covered in Chapter 10. Chapters II - 14 cover the other four
IEC programming languages: function block diagram, statement list, instruction list, and
sequential function chart. PLC troubleshooting is covered in Chapter 15. Sensors and
actuators appear in Chapter 16. Chapter 17 introduces factory communication networks.
Operator interface, often called human-machine interface (HMI), issues are treated in
Chapter 18. Control system security is addressed in Chapter 19 and PLC selection is
introduced in Chapter 20. Chapter 21 presents the perspective of an entire automation
project, bringing together the various pieces ofPLC control design. Chapter 22 outlines two
full-length project case studies. One case study is for a process that is primarily discrete and
the other case study is for a process that is primarily continuous in nature. Details about
number systems and drawing symbols are included as appendices, rather than interrupt the
flow of the text material.

The Audience
This book primarily serves the academic market, at the junior or senior undergraduate
electrical, mechanical, or industrial engineering or engineering technology level. This text
is also suitable for the two-year technical school market. There is nothing in the material
that requires a college degree, though the material will be more challenging than the typical
PLC textbook for this level of student.
In addition, this text serves the professional market. Economic and regulatory pressures
in the manufacturing, chemical, petrochemical, pharmaceutical, and food industries have
forced control engineers to design new systems or retrofit existing control systems. Hence,
there are many control engineers (primarily chemical and electrical) who need to rapidly
 Preface ix

educate themselves in an area of technology in which they are probably only somewhat
familiar. This book is valuable to this audience.

Acknowledgements
The author wishes to acknowledge the beneficial suggestions and co=ents of many
colleagues. Steve Ingracia provided the sample panel specification in Chapter 4. Bill
Bichler, Dean Ford, and Esther Erickson reviewed drafts of this book and provided many
suggestions and corrections tn improve the final product. I especially thank Esther and Fran
Erickson for correcting the entire manuscript for gra=atical errors, and Fran for doing the
initial typesetting.
Portions of this material were taught in industrial short courses and university courses
and the students are acknowledged for their help in pointing out error.; in the text and where
the presentation was unclear.
The following are registered trademarks of Schneider Electric: Modicon, Quantum,
Momentum, Concept, Unity, and Modbus. The following are trademarks of Schneider
Electric Modbus Plus, 984, BP85, and BM85. The following are registered trademarks of
Rockwell Autnmation and its various subsidiary entities: Allen-Bradley, ControlLogix,
PLC-2, PLC-3, PLC-5, Rockwell Autnmation, Rockwell Software, and RSLinx. The
following are trademarks of Rockwell Autnmation and its various subsidiary entities:
CompactLogix, Data Highway Plus, DH+, FlexLogix, GuardPLC, MicroLogix, Logix
5000, Pico, PLC-5/11, PLC-5/20, PLC-5120E, PLC-5/26, PLC-5/30, PLC-5/40,
PLC-5/40E, PLC-5/40L, PLC-5/46, PLC-5160, PLC-5160L, PLC-5/80, PLC-5/80E,
PLC-5/86, PLC-51250, RSLogix 5, RSLogix 500, RSLogix 5000, RSNetWorx, SLC,
SLC-500 and SoftLogix. SIMATIC is a registered trademark of Siemens AG. The
following are trademarks of GE Fanuc Autnmation North America, Inc.: CIMPLICITY,
Logicmaster, PACSysterns, Series 90, Series Five, Series One, Series Six, Series Three,
Ver.;aMax, and Ver.;aPro. Foundation is a trademark ofFieldbus Foundation. ControlNet is
a trademark of ControlNet International, Ltd. DeviceNet is a trademark of the Open
DeviceNet Vendor.; Association. PROFlliUS and PROFInet are registered trademarks of
Profibus Nutzerorganisation, e.V. P-NET is a registered trademark of the International
P-NET User Organization. Seriplex is a registered trademark of the Square D Company.
Ethernet is a trademark of Digital Equipment Corporation, Intel, and Xerox Corporation.
SERCOS interface is a trademark of the Interests Group SERCOS interface e.V. (IGS).
VisSim is a registered trademark of Visual Solutions, Inc., Westford, Massachusetts.
MATLAB and SIMULINK are registered trademarks of The Mathworks, Inc., Natick,
Massachusetts. Microsoft, Windows, and Visual Basic are registered trademarks of
Microsoft Corporation.

Disclaimer
Information furnished herein is believed tn be accurate and reliable; however no
responsibility is assumed for any error.;. The user assumes full responsibility for the
accuracy and appropriateness of this information.
1 Introduction to PLCs

Chapter Topics:

• Control system categories

• History of PLCs
• PLC versus other technologies
• PLC architecture

OBJECTIVES

Upon completion of this chapter, you will be able to understand:

• Two ways to categorize a control system
• PLC history and developments
• The differences between PLC, relay and PC-based control
• Basic PLC architecture

1.1 INTRODUCTION
Programmable logic controllers (PLCs) are definitely the workhorses of modern
manufacturing automation. Automatic control allows the production ofa consistent product
at reasonable cost and the PLC is the most prevalent control technology in manufacturing.
In order to establish a context for PLCs, the need for automatic control in manufacturing is
justified along with the major ways control systems are classified. The history of the PLC is
outlined and placed in the context of the parallel development of computer control in the
chemical industry. The use of the PLC in automation is compared with other automation
technologies, with special attention to a comparison of PLC versus personal
computer-based control. Finally, the architecture ofthe PLC is described and its place in the
context of an automation system is shown.

1.2 AUTOMATIC CONTROL IN MANUFACTURING

There are many reasons automatic control is indispensable to manufacturing. The most
important reasons are:
• To improve the quality and lower the cost of production.
• To attain optimal performance.
• To relieve the drudgery of many routine, repetitive manual operations.

1
2 Introduction to PLCs

Over the last three decades, manufacturing has been receiving more emphasis from the
engineering community. To an enterprise, profitability usually depends on productivity and
automation is a means towards greater productivity. Usually, the most important question is
not, "Should we automate production?" but "What should be automated to increase
productivity?"
As an example, throughout the 1950's and 1960's the American automakers were
placing their emphasis on the power and style of their automobiles and not on producing a
high quality product at the lowest possible cost. The gasoline shortages of the early 1970's
forced many people to buy smaller automobiles and they discovered that the small
automobiles produced by the Japanese automakers were of better quality and at a lower cost
than the equivalent American automobiles. To remain competitive, the American
automakers started placing more emphasis on manufacturing quality automobiles at the
lowest possible cost and automation was the means toward their goal. This renewed
emphasis on manufacturing extended to other industries and will not soon diminish.
The basic elements of an automatic control system are shown in Figure 1.1. A control
system has three basic elements:
Input sensors: Convert physical phenomena (for example,
position) to electrical signal.
Programmable Logic Controller: Using the measurements, calculate control actions.
Output actuators: Convert electrical signal to a physical action (for
example, motor rotation).
In this text, the PLC is the controller, which was initially developed out of the needs of the
automotive industry. In the chemical industry, a distributed control system (DCS) is
typically used in place of the PLC. As will be shown later, DCS and PLC systems are
merging into one device called a programmable electronic system (PES).

1.3 CONTROL SYSTEM CLASSIFICATIONS

Control systems are commonly categorized two ways: (1) type of sensors/actuators,
and (2) type of process. Either way is valid, but in certain contexts one is often preferred
over the other. For example, many people choose whether to use a PLC versus a DCS based
on the type of sensofstactuators.

Programmable
Input
Logic
Sensors Measurements Resultant
Controller
Actions

Process

Figure 1.1. Basic elements of an automatic control system.

 1.3 CONTROL SYSTEM CLASSIFICATIONS 3

1.3.1 Type of Sensors/Actuators

When considering the sensor or actuator, there are two major types: (1) discrete, and (2)
analog. A discrete control system has mainly discrete sensors and actuators. Similarly, an
analog system has mainly analog sensors and actuators. A discrete sensor or actuator has
one of two values, for example: on/off, open/closed, present/not present, running/stopped,
or extended/retracted. An analog sensor or actuator theoretically has an infinite number of
values. For example, an analog sensor value could represent position, velocity,
acceleration, temperature, pressure, flow, or weight. An analog actuator value could
represent valve position, motor speed (for motor controller), damper position, or strip-chart
recorder value. Because an analog sensor or actuator value is converted to an integer value
within the input/output (I/O) module, an analog value practically assumes a finite number of
values. This point becomes more apparent when analog I/O modules are discussed in
Chapter 4.
Bear in mind that most real programmable logic control systems are a combination of
analog and discrete elementS. For example, Figure 1.2 depicts some of the elements of a
heating, ventilation and air conditioning (RYAC) system. The proximity switches that
detect the presence of a person in a room are discrete sensors and the control valve for an air
solenoid is a discrete actuator. As an example of the PLC operation, the damper is opened
whenever anyone is present in the room and closed when no one is present for 15 minutes.
The airflow sensor is an analog sensor and the fan motor speed command is an analog
actuator signal. The PLC calculates the desired fan speed in order to maintain the airflow at
a desired value.

1.3.2 Type of Process

A process is a sequence of chemical, physical, or biological activities for the

conversion, transport, or storage of material or energy (ISA, 1995). Industrial
manufacturing processes are generally classified as continuous, batch, or discrete-parts
manufacturing. This classification sterns from the way the output appears: as a continuous
flow (continuous); in finite quantities of material (batch); or in finite quantities of parts
(discrete-parts manufacturing).
Continuous Process. In a continuous process, material passes in a continuous stream
through the processing equipment. Once the process has established a steady operating
state, the nature of the process does not depend on the length of time the process is operating

Damper
Valve
Programmable Actuator
Logic c!os""open [)Jk(J~i;:::'::::I::;=\
Proximity Switches Controller Air solenoid

Airflow
Sensor

Figure 1.2. Control elements of HVAC system.

4 Introduction to PLCs

(lSA, 1995). Commodity chemical manufacturing typically falls into this category. A
continuous steel rolling mill, simplified in Figure 1.3, is an example continuous process.
The control system manipulates the force at each stand and the speed of each roller in order
to control the thickness and speed of the steel sheet at the exit. As the thickness of the steel
sheet is reduced by each roller stand, the speed ofthe sheet must be increased proportionally
to maintain a constant steel mass flow rate. If the last roller stand rotates a little too slow,
material will accumulate between the third and fourth stands and eventually cause a jam. If
the last roller stand rotates a little too fast, the sheet will be tom. Either scenario is not
desirable.
Batch Process. In a hatch process, finite quantities (batches) of material are produced
by subjecting quantities of input materials to a defined order ofprocessing actions using one
or more pieces of equipment. Batch processes are discontinuous processes from a material
flow standpoint. Batch processes are neither discrete nor continuous, though they have
characteristics ofboth (ISA, 1995). Food, beverage, pharmaceutical, and specialty chemical
processes are usually encompassed by this category. An example of a small batch process is
illustrated in Figure 1.4. In this process, ingredients A and B are measured into tanks.
Ingredient A is heated to a desired temperature and then the two ingredients are pumped to a
third vessel where a chemical reaction occurs. After a certain length of time, the resultant
product is pumped through a filter and then on to storage.
Discrete-Parts Manufacturing Process. In a discrete-parts ma'nufacturing process, a
specified quantity ofmaterial moves as a unit (part or group ofparts) between workstations,
and each unit maintains its unique identity (lSA, 1995). At a workstation, a unit may be
modified (drilled, machined, painted, etc.) or may be combined with one or more other parts
(assembly). Packaging operations also fall into this category. An example of a discrete-parts
workstation is shown in Figure 1.5. Incoming parts are received on the input conveyor,
moved to the drilling station where a few holes are drilled, moved to the computer
numerical control (CNC) station where the part is shaped, and then moved to the output
conveyor. A simple packaging operation is shown in simplified form in Figure 1.6. An
empty carton arrives on the incoming conveyor. When the loading area is clear, the carton is
moved into position. The parts are marshaled to form a row and the row is pushed into the
carton. The carton is indexed down and succeeding rows of parts are placed in the carton.
When fully loaded, the carton is moved out to the next station where the flaps are sealed.
Processes are often primarily one of the three main types, though they often contain at
least one ofthe other types. For example, the output of many batch processes is packaged in

Controlled pressure

Thick steel
block
Sheet steel

High speed
Slow speed

Figure 1.3. Continuous steel rolling mill.

 1.3 CONTROL SYSTEM CLASSIFICATIONS 5

Ingredient lngredienl
A B

Pump 1 Pump 2

Tank 2
Level HEAT
rt-lo--.,..--.l--- TEMP
Pump 4

PS

Tlnk3
Level Pump 6

Tlnk4
Reaction Vessel Level Product Silo

Figure IA. Small batch process.

Drilling
Machine

CNC
Machine

Input
Conveyor

Robot

Figure 1.5. Discrete parts workcell.

6 Introduction to PLCs

Parts fed
inlO this bin

Ram to push
parts into carton

Figure 1.6. Packaging station.

containers smaller than a batch. The packaging operation is a discrete-parts operation. Even
a discrete-parts manufacturing plant, for example, a small gasoline engine manufacturing
facility, has waste recycling or treatment facilities that often contain continuous or batch
processes.

1.4 mSTORY OF THE PLC

The development of automatic control technology has two very definite parallel tracks.
Distributed control system (DCS) technology evolved from the needs of continuous
processes. Programmable logic controllers evolved from the needs of batch and discrete
manufacturing processes.
Controllers for continuous processes (e.g., flow, level, pressure) can be traced to float
regulator mechanisms in Greece in the period of 300 to I B.C. (Mayr, 1971). These
primitive contrQllers eventually evolved to pneumatic control hardware of the 1900's where
air pressure was the method of actuation and signal transmission. Electronic controllers
started to supplant these pneumatic controllers in the 1960's (Merritt, 1999). Electronics
also made the development of computer systems possible and computers were applied to
continuous control problems in the late 1950's. These devices were business computers
retrofitted for process control service and mainly used for supervisory control and data
acquisition. There were some attempts to implement direct digital control of a process but
the reliability and performance of early computer technology was inadequate. In the
mid-1970's the microprocessor was introduced in direct control for Pill loops and
eventually led to the development of the DCS in the late 1970's where the control was
distributed among several devices rather than being concentrated in one central computer.
Current DCS systems are basically smaller and more powerful versions of the early DCS
control system~.
Early technology for discrete and batch control employed the relays developed for the
telegraph industry of the 1800's. In 1836 Samuel F. B. Morse invented the
electromechanical relay as a means to increase the station-to-station distance of his newly
 1.4 HISTORY OF THE PLC 7

Common Common
Armature NC
- NC,

Coil
- NO
,
NO

(a) (b)

Figure 1.7. Electromechanical relay: (a) unenergized; (b) energized.

developed telegraph system, then limited to about 20 miles. This electromechanical device
sensed the small telegraphic signal current and "relayed" or amplified this signal to carry the
information to the next station or relay. An electromechanical relay consists of a coil ofwin:
magnetically coupled to a moveable piece of iron, called an armature (Figure 1.7). A spring
holds the armature in its resting position in which there is continuity between the
"Co=on" and "NC" connections (Figure 1.7a). When a sufficient current passes through
the coil, the armature is forced downward causing continuity to be established between the
"Co=on" and the "NO" connections (Figure 1.7b). Eventually, interconnections of
electromechanical relays were used to implement logic functions, as explained in Chapter 2.
In concert with electromechanical relays, drum sequencers were developed to control
sequential processes, where the operation is expressed as a sequence of steps. An
electromechanical drum sequencer (Figure 1.8) is a cylinder with pegs strategically placed
to make or break contacts. When the contact is closed, power is applied to relay logic or a
final control element. The drum advances one row at a time triggered by an external event.
As the drum advances, it makes or breaks control circuits in a pattern prescribed by the
position of each peg in a row.
Relay and sequencer technology remained relatively stagnant until the late 1960's. The
only real change was the replacement of electromechanical relays with solid-state
(electronic) relays in the 1960's. Computers were tried but were even less reliable than relay
systems because of the harsh environment of the typical factory. A state-of-the-art
manufacturing cohtrol system consisted of racks of relays (Figure 1.9a) whose wiring was
documented by drawings called relay ladder logic diagrams (Figure 1.10). Relay systems

Figure 1.8. Electromechanical drum sequencer.

8 Introduction to PLCs

(a) (b)

Figure 1.9. Small control system: (a) relay rack; (b) PLC replacement.

were maintenance headaches: prone to failure and hard to troubleshoot. In addition, a

change to the function of the control system meant a wiring change at a minimum and often
meant additional relays.
The machine tool and automotive industries were large users of relay control systems.
A simple machine tool would require six months to a year to completely debug (Morley,
200 I). Every year, automotive manufacturing facilities would be shut down for two to three
months in order to implement the changes due to the new automobile models. The lost
production due to these changes was significant.
Richard Morley is credited with inventing the initial concept for the PLC in January,
1968 while working for Bedford Associates (Morley, 2001). Faced with the design of a
machine tool control for a high-performance lathe, he decided to try something different
from the solid-state relays or minicomputers which were state-of-the-art at that time.
Initially, he conceived a machine or box that was rugged, that contained its own direct
interface to the machine tool and that had its own application-specific language. Eventually,
the language was changed to ladder logic since that is what the control engineers already
knew.
Bedford Associates chose to "spin off' the part of the company dealing with this new
controller as a separate company called Modicon. The Modicon (MOdular DIgital
CONtroller) 084 was introduced in 1969 and is generally credited as the first PLC and
proved the concept of the PLC.
 1.4 mSTORY OF THE PLC 9

RD. '0.,
11051 !lOSO
01
D1VERTER GATE 2 (OllS)
02
J~,.
OFF ",REM
'--=-:--r.......s.:....~ESR2
I G2SESRTocii4G:2BC1~RT.oiSGmD1
I GATE 21
OJ

04
xoo i 1- 16031 Bl~:2 liIIiJ 16033 Iiilll 16034 Iiilll
GC2RR
1603S
CO?<.'VEYOR 2
~~ RELAY

os !i I: I60Sl :,~
.
!I ~
~;o;;;;~!FT.o74GillD-1
06

07

08
II iI ! i
~~u
B1
16071 :t: 16072 G~\607J G:RI6074 G"IM ;E~~y GATE 2J

09 i .1 ri~ !~-
10
i uill
O
-'lOO";X;.t!-l l6iiiT :i!§D GATE 2 REMOTE
II
16111
GG2RSR")- SELECTED RELAY
1161205911.61
12
lJ

14 ~
IS ;'----""ili---------------<J~1[:~
16151 G2SSR GATE 2 SAFETY
SWITCH RELAY
116116031607
16 2059.il6i

17
18

19 1-- G2Bl ""i6i91 r __-Q@!JD-!

G2HIR
GATE 2/BUNKER 1
RELAY
16191 1161 It73 ISH
20 J.~Hlll2 2169
21 L - -...... -<B- IN POSITION

22
~

23 1"'--
02C2e-
~
i6zj,
16231
, __--<:.:ill:m:rj
G2C2R
GATE 2ICONV-
EYOR2RELAY
110911391163
24 1171 JS09lfiQ1
C-\w 1705 1909 ll7l
2S L - -...... -{-..:::.r- IN POSlTlON

Figure 1.10. Relay ladder logic diagram for a part of the relay rack in Figure 1.9.

In parallel with the developments at Bedford Associates in 1968, a group of engineers

at the Hydramatic Division of General Motors specified a controller with similar features
(Stone et al, 1968). The GM specification requirements are summarized in the following
categories:
I. The control hardware and/or device must be easily and quickly programmed and
reprogrammed at the user's facility with a minimum of service interruption.
2. All system components must be capable of operation in industrial plants without
special support equipment, hardware, or environments.
3. The system must be easily maintained and repaired. Status indicators and plug-in
modularity should be designed into the system to facilitate troubleshooting and
repairs with minimum downtime.
10 Introduction to PLCs

4. The control hardware must occupy less plant space and consume less power than
the relay control system equivalent.
5. The programmable controller must be capable of communication with central
data-collection systems for the purpose ofsystem status and operation monitoring.
6. The system must be capable of accepting l20-volt AC signals from standard
existing control system push buttons and limit switches.
7. Output signals from the logic controller must be capable of driving motor starter
and solenoid valve loads operating at 120 volts AC. Each output shall be designed
to switch and continuously operate a load device of2-ampere rating.
8. The control hardware must be expandable from its minimum configuration to its
maximum configuration with minimum system alteration and downtime.
9. The unit is to be competitive in purchase and installation cost with relay and
solid-state logic systems currently in use.
lD. The memory structure employed in the programmable controller shall be
expandable to a minimum of 4000 memory words or elements.
A few companies were interested in developing such a device. In addition to Modicon,
other initial respondents to the specification included Information Instruments, Inc.,
Reliance Electric, Digital Equipment Corp., and Struthers-Dunn. Shortly after the
pioneering Modicon 084, Information Instruments, Inc. introduced the PDQ logic
controller and Reliance Electric produced the Automate 33. Based on the PDP-8 series
computer, Digital Equipment Corp. developed the PDP-14 programmable controller.
Struthers-Dunn introduced the VIP programmable controller.
Initially, this new controller was named the programmable controller, abbreviated as
the PC. When the personal computer was introduced, it was also called a PC. To avoid
confusion, the programmable controller was renamed to the programmable logic controller
(pLC).
By today's standards all of the early PLCs were primitive since they only implemented
relay logic. There were no timer, counter, or arithmetic functions. Some of the early PLCs
were designed as sequencer replacements (for example, the Texas Instruments 510).
Two aspects of the initial PLCs are generally credited with their success. First, the
electronic circuits were designed to be highly reliable and to work in the harsh industrial
environment. Dick Morley tells the following tale about the Modicon 084 (Morley, 200 I):
Landis [a machine tool company] decided to purchase the MODICON units
and not use the PDP-14. When DIGITAL [sic] tried to get back into Landis, Landis
wrapped a welder cable (operating) around the 084 and poured Coke over the unit.
The 084 kept right on trucking. Digital retreated with grace.
Second, the programming language was based on standard electrical relay ladder logic
drawings. Some earlier computer applications in manufacturing had failed because the
plant technicians and engineers had difficulty learning the computer language. In contrast, .
most of them already knew relay ladder logic design and so could quickly learn PLC ladder
logic.
Though adoption by industry was initially slow, other well-known electrical controls
manufacturers began either developing their own PLCs, or reselling someone else's PLC.
Of the original five PLC developers, only Digital Equipment Corp. and Struthers-Dunn no
longer produce PLCs. Modicon is now a part of AEG Schneider Automation. Information
 1.4 HISTORY OF THE PLC 11

Instruments, Inc. was later purchased by Allen-Bradley, which is now part of Rockwell
Automation. Reliance Electric was also purchased by Rockwell Automation. There are
currently over 40 vendors ofPLCs (Cleaveland, 1999).
Table 1.1 presents an abbreviated list of PLC developments. From the relatively
primitive beginnings, the general trend has been toward more functions, larger memory,
and more sophisticated communication.
The initial PLCs used bit-slice processors (e.g., Advanced Micro Devices 2901) to
solve the logic. Microprocessors eventually assumed all of the processing functions of the
PLC. However, due to the relative slowness of the microprocessor, bit-slice logic-solving
co-processors were used on the larger PLCs until the late 1980's. The microprocessor
spurred the development of intelligent I/O modules and ever physically smaller PLCs.
Currently, the smallest PLC is no larger than a relay and has 6 I/O points.

Table 1.1 PLC Developments

Year Nature of developments

1968 Initial concept developed
1969 Hardware CPU controller, with logic instructions, 1K ofmemory and 128
I/O points
1971 First application outside automotive industry
1972 Timing and counting instructions
1973 Arithmetic and data move instructions
Computer-to-PLC communications
1974 Several processors within a PLC, 12K of memory, 1024 I/O points,
CRT programming terminal
1975 PID control
1976 Remote input/output systems
1977 .Microprocessor-based small PLC
1978 PLC-to-PLC communications
1980 Intelligent I/O modules
Enhanced software features (e.g., documentation)
Program with personal computers
1983 Large PLCs: 4M of memory, 8192 I/O points
1985 GM manufacturing automation protocol (MAP)
1986 Other languages (not ladder logic)
1993 Connection to Ethernet
lEC 61131-3 standard languages
1994 Standard remote I/O protocols
1996 PC-based control as PLC alternative
2000 IEC 61158 communication networks
12 Introduction to PLCs

The ability of PLCs to communicate appeared in 1973 when Modicon introduced the
Modbus communication network. Initially, Modbus was used for computer-to-PLC
communication. Other manufacturers soon followed with their proprietary communication
networks and also developed remote I/O communication networks. The lack of
standardization made it very complicated for a PLC of one vendor to communicate with the
PLC of another vendor. In the mid-1980's, General Motors attempted to resolve the
situation with the development of GM MAP (manufacturing automation protocol).
However, the connection cost of this network was relatively high and thus was never well
accepted. Eventually, initial misgivings about using Ethernet in a manufacturing
environment were overcome and Ethernet appeared as a communication option for the
larger PLCs. Today, even the smallest PLCs can interface to Ethernet. During the 1990's,
the Instrument Society of America (ISA) sponsored the development of two
communication networks: one suitable for remote I/O and the other for PLC-to-PLC
communication. Due to political pressures, this standard (lEC 61158) eventually included
eight networks (Amos, 2000). Therefore, the convergence toward one or two standard
networks may never happen. Often, the most complicated part ofcommissioning a system is
getting the communication networks and connections properly configured.
Initially, PLC programming was done with a hand-held programmer and eventually
with a dedicated CRT programming terminal, both supplied by the PLC vendor. With the
advent of the personal computer (PC) in the 1980's, the PLC vendors developed PC-based
programming software and operator interface stations. When graphical user interfaces
(GUls) were developed for personal computers, they were also applied to operator interface
stations. Since most PLC systems had an operator interface, it seemed natural to also utilize
the PC to replace the PLC processor. This type of control system is called PC-based control
or a "soft" PLC. The differences between PLCs and PC-based control are considered in the
next section.
Listings of the ladder logic program on the early PLCs consisted of the relay and
function block symbols and the numbers for the I/O points and memory locations. A
maintenance person would require a few months to learn the operation of a reasonably
complicated program. In 1980, a small company introduced programming software for the
Allen-Bradley PLCs where the user could attach symbols and descriptions to the numeric
I/O and memory locations, include comments in the program, and print a cross-reference
listing of the program. Today, these documentation features are standard fOf PLC
programming software.
Incorporation of PID control and motion control into the PLC happened slowly.
Control schemes for continuous processes utilized PID control and were generally
implemented with distributed control systems (DCSs). Nevertheless, analog I/O modules
were incorporated into PLC systems in order to read analog values and to output calculated
values to the operator panel. Initially, PID control was handled as an intelligent I/O module
and the PID control algorithm was executed by the microprocessor on the module.
Eventually, PID control was implemented as a function block in the PLC processor. The
incorporation of motion control into the PLC processor proceeded along the same lines as
for PID control. Initially, it was handled only in separately programmed intelligent I/O
modules. This weakness of the PLC-based motion control also spurred the development of
PC-based motion control since the PC could handle the sophistication ofmotion control and
were not constrained by the limitations of ladder logic. To counter this weakness, many
newer PLCs have tightly coupled the motion module with the PLC processor so that the
 1.5 PLC VERSUS OTHER TECHNOLOGIES 13

motion module is not separately programmed, but is a part of the program in the PLC
processor.
The original PLC language was ladder logic. However, each PLC manufacturer did not
implement ladder logic in the same fashion; therefore, programs could not be easily copied
between PLC manufacturers. In addition, ladder logic is not very well suited to arithmetic
calculations, Pill control, or motion control. This need to incorporate other control
languages and to copy programs among PLC vendors led to the development of the IEC
61131-3 (originally numbered 1131-3) standard (lEC, 1993). The industry trend is toward
using the IEC 61131-3 standard, and thus it is the primary focus of this text. However,
61131-3 is only a voluntary standard and individual manufacturers have some freedom in
the implementation.
The PLC evolved from its initial role as a "relay replacer" and the DCS evolved from its
initial role as a "Pill loop replacer". The distinction between PLC and DCS systems
persisted throughout the 1990's. While both control technology types claimed to do some of
the functions of the other type, it was not until the 61131-3 standard blended them that the
distinction became obsolete. This merging of the PLC and DCS technology suggests a new
term to describe control technology: programmable electronic system (PES). This term is
now used in many standards such as the lSA S84.0 I (ISA, 1996) for safety-instrumented
systems.

1.5 PLC VERSUS OTHER TECHNOLOGIES

As demonstrated by the history of the PLC, it is not the only technology available for
implementing factory automation. Table 1.2 shows a comparison of available control
system technologies. This table clearly shows why PLCs quickly supplanted relay systems.
Except for recovery from power failure, the PLC has a clear advantage over relay
systems. Figure 1.9b shows the PLC replacement of the relay rack of Figure 1.9a and
illustrates the smal1er space required for the PLC system. Less clear are the advantages of
PLCs over computers.
In many respects, the architecture of the PLC resembles a general-purpose computer.
In fact, some of the early PLCs (e.g., PDP-14) were computer-based. However, there are
some important characteristics of a PLC that distinguish it from a general-purpose or
personal computer.
A PLC can be placed in an industrial environment. In contrast to the typical
computer, a PLC can be placed in areas with substantial amount of:
Electrical noise
Electromagnetic interference
Mechanical vibration
Extreme temperatures (e.g., 1400 F)
Non-condensing humidity (95%)
Most PLCs are placed in cabinets in order to protect them and the electrical wiring from dust
and other airborne contaminants. However, some manufacturers offer PLC modules with a
conformal coating that protects the electronics from dust and certain other airborne
contaminants.
A PLC is more reliable. Manufacturing is often an unforgiving environment. General
Motors estimates that production line downtime costs $15,000 a minute (Garber, 2001). In
14 Introduction to PLCs

Table 1.2. Compari&on of Control System Hardware

Characteristic Relay Systems Computers PLC Systems

Price per function Moderate Low Low

Physical size Bulky Fairly compact Compact

Operating speed Slow Fairly fast Fast

Industrial environment Excellent Fair to good Good

Design Time-consuming Usually simple Simple

Complicated operations No Yes Yes

Simple to
Installation Time-consuming Simple
complex

Easy to change function Difficult Usually simple Very simple

Poor-many Good if std. I/O Good - few std.

Ease of maintenance
contacts modules cards

Power failure recovery osec. 10 - 100 sec. I - 3 sec.

some processes, a millisecond mistiming can mean a multimillion-dollar loss or personnel

casualties. The mean time between failure of most PLCs is measured in years whereas the
mean time between failure of a Windows NT-based PC is on the order of a few days (in the
author's experience). The PLC also does not have any inherently less-reliable mechanical
components (e.g., disk drives).
A PLC is easily maintained by plant technicians. The hardware interfaces are
standardized apd are easily connected. The interface circuitry is modular and
self-diagnosing to pinpoint malfunctions and allow easy replacement. The PLC is
programmed using ladder logic, which was already established as the standard
documentation tool for relay systems. In addition, ladder logic is easily learned.
The PLC executes a single program in an orderly and sequential fashion. However,
most medium to large PLCs have instructions that allow subroutine calling, interrupt
routines, and bypass of certain instructions. Also, many PLCs can have modules that
implement higher-level languages (e.g., BASIC or C).
The PLC recovers quickly from a power failure. There are no boot-up procedures or
a need to load programs on power-up. If the PLC is running when the power fails, when
power is restored, it quickly runs some diagnostic self-tests and resumes running the
program without operator intervention.
Currently, PC-based control (sometimes called "soft" PLC) is working to address these
weaknesses. Typically, the I/O modules are the same as used by PLCs. So, the
environmental, reliability, and maintenance aspects of these modules are retained. The
reliability'ofthe PC is partly addressed by using a proprietary operating system that is more
 1.6 BASIC PLC ARCHITECTURE 15

reliable than Windows NT and does not access the disk drives after boot-up (Murray, 1998).
According to Murray (1998) PC-based control systems must:
• Provide detenninistic operation. Control must be the highest priority and ensure a
predictable, repeatable process.
• Survive a Windows crash and continue to operate in a safe manner.
• Be isolated from poorly behaved Windows applications and drivers.
• Survive a hard disk crash.
• Be based on a proven, real-time engine. The control engine must have a proven
track record in mission-critical applications.
The main advantages of PC-based control are the ability to use other programming
languages when implementing sophisticated control and to include the operator interface
with the control program. When PC-based control was first introduced in the mid-1980's,
the demise of the PLC was predicted. This demise has not happened and probably will not
happen. Both PC-based control and PLCs will coexist and find their application niches.

1.6 BASIC PLC ARCHlTECTURE

The basic architecture of a PLC is shown in Figure 1. I 1. The main components are the
processor module, the power supply and the input/output (I/O) modules. The processor
module consists of the central processing unit (CPU) and memory. In addition to a

r~-----_·_------·

~ Programming ;
: Device :

.~~~~~~~~ ~~~~~~~:.~.~.~~~~~ .. ..•, _

,,
Power
Supply
CPU Memory: ·
,
•,,
,,
~---_.--.- -----.-- ------_. __ .. _-_. __ ._~

Co=unication
Interface

._.-------_._.- ---_._-----_._- ._---._--,,

I/O Modules ,
·,
Discrete Analog Special ··•
I/O
Devices
I/O
Devices
I/O
Devices ·•••
._----- e. . -._'·•
FT

Figure 1.11. Basic PLC architecture.

16 Introduction to PLCs

Figure 1.12. Allen-Bradley PLC-3 processor unit.

microprocessor, the CPU also contains at least an interface to a programming device and
may contain interfaces to remote va
and other communication networks. The power supply
is usually a separate module and the va
modules are separate from the processor. The types
of vamodules include discrete (on/oft), analog (continuous variable), and special modules
like motion control or high-speed counters. The field devices are connected to the va
modules.
Depending on the amount of vaand the particular PLC processor, the va modules
may be in the same chassis as the processor and/or in one or more other chassis. Up until the
late 1980's, the va
modules in a typical PLC system were in chassis separate from the PLC
processor. For example, the Allen-Bradley PLC-3 processor unit (Figure 1.12) contained a
power supply module, a processor module, at least one memory module, and at least one
communication module. The va modules were placed in chassis separate from the
processor unit (Figure 1.13). In the more typical present-day PLC, some of the va modules
are present in the chassis that contains the processor (Figures 1.14 - 1.18). Note that the
Allen-Bradley Control Logix system (Figure 1.l6) allows more than one processor in the
same chassis. Smal1er PLCs (Figures 1.19 - 1.21) are often mounted on a DIN rail. The

lIa Modules

Figure 1.13. Remote va chassis.' .

 1.6 BASIC PLC ARCHITECTURE 17

Processor , '. I/O Modules Power Supply

A'- ~

II

Figure 1.14. Allen-Bradley PLC-5 chassis.

Figure 1.15. Allen-Bradley SLC-500 chassis.

Processor Processor Comm. Interface

Power Supply
t~ule~ J

Figure 1.16. Allen-Bradley Control Logix chassis.

18 Introduction to PLCs

Corom. Interface
Power Supply Proc~ssor" ~ ~
~
•

Figure 1.17. Modicon Quantum chassis.

Power Supply I/O Modules

Figure 1.18. Siemens S7-300 chassis.

Comm. Power Comm.

Processor Interface Supply I/O Modules Interface

Figure 1.19. Allen-Bradley CompactLogix PLC.

 1.6 BASIC PLC ARCHITECTURE 19

Power Comm.
Supply Interface
I/O Modules

Figure 1.20. OE Fanuc VersaMax.

Discrete Inputs Expansion I/O Modules

,...._---./A'--...... ,...._---~A'------_____..

'---y---/
~
Power Discrete Outputs
Connection

Figure 1.21. Allen-Bradley MicroLogix 1200 PLC.

Programming
Connection

Power
Connection

Figure 1.22. Allen-Bradley MicroLogix 1000 unit.

smallest PLCs (often called micro-PLCs or nano-PLCs) include the power supply,
processor, and all of the I/O in one package (Figures 1.22 - 1.23). However, for many
micro-PLCs, the amount of I/O is limited and not expandable.
20 Introduction to PLCs

Processor - -......

Discrete Inputs
Discrete Outputs'" , Power
Connection

Figure 1.23. Modicon Momentum unit.

Within the context of an automation system, the PLC appears as shown in Figure 1.24.
In this system, the I/O modules are in the same chassis as the processor. A typical
medium-size PLC installation is shown in Figure 1.25. This figure shows the placement of
the PLC processor, I/O modules, power supplies, and wiring terminal blocks within a
cabinet. There are also fuses or circuit breakers, one or more per input or output module for
protection ofthe I/O module circuitry. The I/O modules are wired to one side ofthe terminal
blocks instead ofbeing wired directly to the field devices. A cabinet is typically assembled
and wired at a location away from the process. When ready to install, the cabinet is brought
to the plant location and only the plant power and field devices need to be connected to the
other side of the terminal blocks.

1.7 CHAPTER SUMMARY

This chapter introduced the programmable logic controller and placed it in the context
ofmanufacturing automation. The evolution ofthe PLC was outlined and compared to other
automation technologies, especially personal computers. With this basic PLC knowledge,
one is ready to learn its unique language, ladder logic.

REFERENCES
Amos, Kenna, 2000. "TEC's 61158 fieldbus standard now a new spec," InTech
Magazine, April.
Cleaveland, Peter, 1999. "PLC manufacturers make their solutions a lot more open,"
Instrumentation and Control Systems Magazine, pp. 53-62, April.
Garber, Joseph R., 2001. ''The PLC versus the PC,"
http://www.barn.orgIFILESIPLCvsPC.htm.
TEC, 1993. IEC 1131-3: Programmable Logic Controllers - Part 3: Programming
Languages, International Electrotechnical Commission, Geneva, Switzerland.
ISA, 1995. ISA-S88.01, Batch Control, Part 1: Models and Terminology, Instrument
Society of America, Research Triangle Park, NC.
ISA, 1996. ISA-S84.01, Application of Safety Instrumented Systems for the Process
Industries - 1996, Instrument Society of America, Research Triangle Park, NC.
Mayr, Otto, 1971. Feedback Mechanisms in the Historical Collections ofthe National
Museum ofHistory and Technology, Smithsonian Institution Press, Washington, D.C.
 REFERENCES 21

Plant
Power
Source

...
.,.,o
<>
Input/Output
u Modules
£

Inputs: Outputs:
Limit switches Solenoids
Proximity Motors

.. .. .. ..........
.
, '

.. ' .'
'
' .

8J
......... ~
.
··.
Robot biR, \...
• arm
, , .
'.
••·
•
•
,,
,, ... ~

•• . .
··•
·• CNC
· Conveyor
·
\\.8 ·
drill

Ip~~~-/, L -_ _----'
.
...
.......... ~#####
'. "The Process" . ... .'
..... .......
......... __ .- .... . .....
...... _##

Figure 1.24. PLC within automation system.

Merritt, Rich, 1999. "The electronic age," Control Magazine, Dec.

Morley, Richard, 200 I. "History of the PLC," R. Morley Incorporated.
Murray, Charles J., 1998. "PC ys. PLC: The lines blur", Special Supplement: Motion'
Control, Design News, March 23.
Stone, William S., David C. Emmett, Edward J. O'Connell, Leonard RadionofI,
William Wegryn, and Clifford H. Wilford, "Standard Machine Controller," General
Motors, June 6, 1968.
22 Introduction to PLCs

Remote I/O
Adapters F
r- Panel
'"c: breaker
".,0

""c:c: r--
0
t-
If l-
I-- F
~ "c: t-
[,;' ~
/ 00
t-

Power
1/r- F
F
F
E:
"r::
"~

"""il<.::
t-
t-
I-
t-
t-
fl
"
.;./
ol

J:: ~
Suppli es-'

\'-;:;~ ~ F
F
I-- '"
<2
0-

.;./
t-
I-
f-
f- "~
-
~

"5

:.: F :E"0 t- u
t- O!
-;;; I--
f-- \
c: f-
t- ~
"'"
"§ t-
~ I--
I--
f-
'-
jl I--
'--
/
Remote ""T' \
I/O PLC :+ Input/Output
N etwork Processor Modules
•

Figure 1.25. Typical PLC system cabinet installation"

2 Basic Ladder Logic Programming

Chapter Topics:

• Basic ladder logic symbols

• Ladder logic diagram
• Ladder logic evaluation
• Converting relay logic to ladder logic

OBJECTIVES

Upon completion of this chapter, you will be able to:

• Understand basic ladder logic symbols

• Write ladder logic for simple applications
• Translate relay ladder logic into PLC ladder logic

Scenario: A program with a long scan time may not detect short-duration events.
A manufacturer of small gasoline engines had an intermittent problem on the final
assembly line. Sometimes, a defective engine would not be automatically removed from the
line for repair at a "kick-out" station. If an operator noticed a problem with an engine, he/she
inserted a bolt into a certain hole in the engine carrier. A proximity sensor before the
kick-out station sensed the presence of the bolt, and the PLC activated a hydraulic solenoid
to push the carrier (and engine) off the main conveyor and into the repair area. A view ofthis
station is shown in Figure 2.1. Further investigation revealed that the duration of the on
pulse ofthe proximity sensor was approximately 3/4 seconds. One PLC controlled all of the
stations on the assembly line and its ladder logic program was quite large. As indicated in
the PLC status, the time to scan the ladder logic program was slightly less than I second.
Hence, it was very likely that a pulse from the proximity sensor could be undetected by the
PLC processor. The proximity sensor could be off at the start of the ladder scan, generate an
on pulse from a passing bolt in the carrier, and be off at the start of the next ladder scan.
Solution: Logic to examine the proximity sensor is placed in a ladder logic routine that is
executed every ~ second. If the proximity sensor is detected to be on, an internal coil is
turned on for at least 1.5 seconds. The main PLC program is changed to examine this
internal coil to determine when to activate the hydraulic solenoid and push a carrier off the
mam conveyor.

23
24 Basic Ladder Logic Programming

! Bolt

Repair Area I rl-j Hydraulic Ram I

oooooooooobo~~~~~~ .
. , U+-
Main conveyor belts
Proximity sensor

Note: Main conveyor is

moving out of page

Figure 2.1. Kick-out station.

2.1 INTRODUCTION
Now that the PLC has been introduced, let us move on to programming the PLC. The
first, and still most popular programming language, is ladder logic. Using examples, the
language is developed from the electromechanical relay system-wiring diagram. After
describing the basic symbols for the various processors covered by this text, they are
combined into a ladder diagram. The subsequent section details the process of scanning a
program and accessing the physical inputs and outputs. Programming with the normally
closed contact is given particular attention because it is often misapplied by novice
programmers. To solidify these concepts, the start/stop of a physical device is considered.
Start/stop is a very common PLC application and occurs in many other contexts. An
optional section on relay to PLC ladder logic conversion concludes the chapter.

2.2 SIMPLE LADDER LOGIC

Ladder logic is the primary programmiIig language ofprogrammable logic controllers.
Since the PLC was developed to replace relay logic control systems, it was only natural that
the initial language closely resembles the diagrams used to document the relay logic. By
using this approach, the engineers and technicians using the early PLCs did not need
retraining to understand the progiam. To introduce ladder logic programming simple switch
circuits are converted to relay logic and then to PLC ladder logic.
In all of the ladder logic examples used in this chapter, tags (symbols) are used for all
inputs, outputs, and internal memory in the examples to avoid having to deal with
input/output addressing. This addressing, treated in Chapter 3, is generally different for
each PLC manufacturer.
Example 2.1. OR Circuit. Two switches labeled A and B are wired in parallel controlling a
lamp as shown in Figure 2.2a. Implement this function as PLC ladder logic where the two
switches are separate inputs.
Solution. The switch circuit action is described as, 'The lamp is on when switch A is on
(closed) or switch B is on (closed)." All possible combinations of the two switches and the
consequent lamp action is shown as a truth table in Figure 2.2b.
To implement this function using relays, the switches A and 13 are not connected to the
lamp directly, but are connected to relay coils labeled AR and BR whose normally-open
 2.2 SIMPLE LADDER LOGIC 2S

A I B Lamp
off off off
Lamp off on on
B on off on
Neutral - - - - - - - - - - - ' on on on

(a) (b)

Figure 2.2. Parallel switch circuit: (a) switch circuit; (b) truth table.

(NO) contacts control a relay coil, LR, whose contacts control the lamp, Figure 2.3a. The
switches, A and B, are the inputs to the circuit. When either switch A or B is closed, the
corresponding relay coil AR or BR is energized, closing a contact and supplying power to
the LR relay coil. The LR coil is energized, closing its contact and supplying power to the
lamp.
The output (lamp in this case) is driven by the LR relay to provide voltage isolation
from the relays implementing the logic. The switches, A and B, control relay coils (AR and
BR) to isolate the inputs from the logic. Also, with this arrangement, the one switch
connection to an input relay can be used multiple times in the logic. A typical industrial
control relay can have up to 12 poles, or sets of contacts, per coil. For example, if the AR
relay has six poles (only one shown in Figure 2.3a), then the other five poles are available
for use in the relay logic without requiring five other connections to switch A.
Before the PLC was developed, engineers had already developed a graphical electrical
circuit shorthand notation for the relay circuit of Figure 2.3a. This notation was called a
relay ladder logic diagram, shown in Figure 2.3b. The switches are shown as their usual
symbol, the circles indicate the relay coils, and the NO relay contacts are shown as the
vertical parallel bars.
ThePLC ladder logic notation (Figure 2.3c) is shortened from the relay wiring diagram
to show only the third line, the relay contactS and the coil of the output relay. The PLC
ladder logic notation assumes that the inputs (switches in this example) are connected to
discrete input channels (equivalent to the relay coils AR and BR in Figure 2.3b). Also, the
actual output (lamp) is connected to a discrete output channel (equivalent to the normally
open contacts ofLR in Figure 2.3b) controlled by the coil. The label shown above a contact
symbol is not the contact label, but the control for the coil that drives the contact. Also, the
output for the rung occurs on the extreme right side of the rung and power is assumed to
flow from left to right. The PLC ladder logic rung is interpreted as: "When input (switch) A
is on OR input (switch) B is on then the lamp is on," which is the same as the statement
describing the switch circuit in Figure 2.2a.
Notice that the original description of the switch circuit in Figure 2.2a,
The lamp is on when switch A is on or switch B is on.
translates into a relay circuit described as
A parallel connection of normally-open contacts,
which describes the PLC ladder logic in Figure 2.3c.
 26 Basic Ladder Logic Programming

lr---
120 V

12~
1
o---~
Lamp

AR
Neutral

(a)

l20v Neutral
A AR

B BR

AR LR

(c)

Figure 2.3. Parallel switch relay and ladder logic circuits: (a) equivalent relay
circuit; (b) equivalent relay ladder logic circuit; (c) equivalent PLC ladder logic.

Example 2.2. AND Circuit. Two switches labeled A and B are wired in series controlling a
lamp as shown in Figure 2.4a. Implement this function as PLC ladder logic where the two
switches are separate inputs.
 2.2 SIMPLE LADDER LOGIC 27

A I B Lamp
120 V ~ .,/;, off off off

~UmP
A B off on off
on off off
Neutral on on on
(a) (b)

Figure 2.4. Series switch circuit: (a) switch circuit; (b) truth table.

Solution. The switch circuit action is described as, 'The lamp is on when switch A is on
(closed) and switch B is on (closed)." All possible combinations ofthe two switches and the
consequent lamp action is shown as a truth table in Figure 2.4b. To implement this function
using relays, the only change from Example 2.1 is to wire the normally-open contacts of
control relays AR and BR in series to control the light, Figure 2.5a. The wiring of switches
A and B and the wiring of the lamp do not change. The relay circuit diagram, shown in
Figure 2.5b is different from Figure 2.3b only in the third line. As for example 2.1, the PLC
ladder logic notation (Figure 2.5c) is shortened from the relay wiring diagram to show only
the third line, the relay contacts and the coil ofthe output relay. The PLC ladder logic rung is
interpreted as: "When input (switch) A is on AND input (switch) B is on then the lamp is
on."
Notice that the original description of the switch circuit in Figure 2.4a,
The lamp is on when switch A is on and switch B is on.
translates into a relay circuit described as
A series connection of normally-open contacts,
which describes the PLC ladder logic in Figure 2.5c.
Example 2.3. As a third example, consider the implementation of a logical NOT function.
Suppose a lamp needs to be turned on whenswitch A is on (closed) and switch B is off
(open). Implement this function as PLC ladder logic where the two switches are separate
inputs.
Solution. Figure 2.6 shows the truth table, relay implementation and ladder logic for this
example. The only difference between the relay implementation in Figure 2.6b and Figure
2.5a is the wiring of the relay BR contacts. The logical NOT for switch B is accomplished
with the normally closed (NC) contact of relay BR. The PLC ladder logic rung in Figure
2.6c is different from Figure 2.5c only in the second contact symbol. The PLC ladder logic
is interpreted as: "When input (switch) A is on (closed) and input (switch) B is off (open)
then the lamp is on." This particular example is impossible to implement with a
combination of only two normally open switches and no relays.
Notice that the original description of the Example 2.3,
The lamp is on when switch A is on and switch B is off.
translates into a relay circuit described as
A series connection of a normally-open contact and a normally-closed contact,
which describes the PLC ladder logic in Figure 2.6c.
Summarizing these three examples, one should notice that key words in the description
of the operation translate into certain aspects of the solution:
28 Basic Ladder Logic Programming

120 v -I ~ 12~
~ I~
A B Lamp

AR BR

Neutral
(a)

120v Neutral

A AR

B BR

AR BR LR
1 - -I
Lamp
LR
"'- /'
w
/ "'-
(b)

Neutral
B Lamp

I I 0
(c)

Figure 2.5. Series switch relay and ladder logic circuits: (a) equivalent relay circuit; (b)
equivalent relay ladder logic circuit; (c) equivalent PLC ladder logic.

and -7 series connection of contacts

or -7 parallel connection of contacts
on -7 normalLy-open contact
off -7 normally-closed contact
These concepts are key to being able to understand and write ladder logic. To many
people these concepts appear strange and foreign at first. However, they will become more
natural as one works problems. Ladder logic is a very visual and graphical language. It is
very different from textual languages like C++, Fortran, Basic, and Java. In contrast, one
can become proficient at ladder logic much quicker than with textual languages.
 2.3 BASIC LADDER LOGIC SYMBOLS 29

A I B Lamp
off off off
off on off
on off on
on on off

(a)

120 V lL_.. .....-;.O-_---J:-1-20-V-.,......;-:~~~::L...0 12~

A B Lamp

AR BR
Neutral -6. -6. e-_....:...._----l

(b)

120v Neutral

~ A 11-__111------<LOl--P_
(c)

Figure 2.6. NOT function ladder logic circuits; (a) truth table; (b) equivalent relay
circuit; (c) equivalent PLC ladder logic.

NAND and NOR logic functions are left as exercises for the interested reader. More
infonnation about the conversion between relay ladder logic and PLC ladder logic appears
in section 2.8.

2.3 BASIC LADDER LOGIC SYMBOLS

At this point, one should start interpreting ladder logic directly and not think of its
implementation with relays. As introduced by the examples in the previous section, the
basic ladder logic symbols are

Normally open (NO) contact. Passes power (on) if coil driving the
contact is on (closed).

Normally closed (NC) contact. Passes power (on) if coil driving the
contact is off (open).
30 Basic Ladder Logic Programming

Output or coil. If any left-to-right path of contacts passes power, the

-0- output is energized. If there is no continuous left-to-right path of
contacts passing power, the output is de-energized.

These symbols are ladder logic instructions that are scanned (executed) by the PLC.
In order to avoid confusion, the contact symbols should be equated with certain concepts
as follows:

-j f- = on = Closed = True = I

-j/f- =olT=Open=FaIse=O

This crucial point will be repeated later when the use of the NC contact is clarified.
Figure 2.7 is an example ladder logic diagram with the basic instructions. The first line
(also called a rung) that determines output labeled Outl is interpreted as follows: Outl is
on if inputs A, B, and C are all on, or if inputs A and C are on and input D is off. Notice
that for Outl to be on there must be a continuous electrical path through the contacts.
Every PLC manufacturer uses the instruction symbols shown in the previous
paragraph. There are other contact and coil instruction symbols, but there is no universal
graphic representation for these other instructions among PLC vendors. The IEC 61131-3
standard has the most contact and coil instructions and many manufacturers do not
implement the full set of instructions.
The industry trend is toward using the IEC 61131-3 (formerly IEC 1131-3) standard,
and so it will be the primary language of this text. Since IEC 61131-3 is only a voluntary
standard, individual manufacturers have some freedom in the implementation. Therefore,
the Allen-Bradley ControlLogix, Modicon, and Siemens S7 implementations of the
61131-3 standard are covered. Because of their widespread use, Allen-Bradley
PLC-5/SLC-500 and GE Fanuc PLC languages are also covered.

Out I

0ut2

Figure 2.7. Ladder logic diagram with basic instructions.

 2.3 BASIC LADDER LOGIC SYMBOLS 31

For the remainder ofthe book, the languages will be presented in the following order:
IEC 61131-3 standard
Modicon Concept (IEC compliant)
Allen-Bradley ControlLogix (IEC compliant)
Allen-Bradley PLC-5/SLC-500 (not IEC compliant)
Siemens S7 (IEC compliant)
GE Fanuc (not IEC compliant)
The Modicon Concept ladder logic is presented first because it is closest to the IEC 61131-3
standard. The Allen-Bradley processors are presented next because of their widespread use
in North America.

2.3.1 lEe 61131-3

The basic ladder logic contact symbols are

Normally open (NO) contact. Passes power (on) if coil driving the
contact is on (closed).

Normally closed (Ne) contact. Passes power (on) if coil driving the
-iff-- contact is off (open).

Positive transition sensing contact. If conditions before this instruction

change from off to on, this instruction passes power for only one scan
(until rung is scanned again). -
Negative transition sensing contact. If conditions before this instruction
change from on to off, this instruction passes power for only one scan
(until rung is scanned again).

The basic ladder logic coil (output) symbols are

Output or coil. If any left-to-right path of instructions passes power, the

output is energized. If there is no continuous left-to-right path of
instructions passing power, the output is de-energized.
Negated coil. If any left-to-right path of inputs passes power, the output
is de-energized. If there is no continuous left-to-right path of instructions
passing power, the output is energized.

-{s~ Set coil. If any rung path passes power, output is energized and remains
energized, even when no rung path passes power.

Reset coil. If any rung path passes power, output is de-energized and
remains de-energized, even when no rung path passes power.
32 Basic Ladder Logic Programming

-{p)- Positive transition sensing coil. If conditions before this instruction

change from off to on, coil is turned on for one scan.

-{N)- Negative transition sensing coil. If conditions before this instruction

change from on to off, coil is turned on for one scan.

-{M)- Retentive memory coil. Like the ordinary coil, except the value of the
output is retained even when the PLC is stopped or power fails.

-{SM}- Set retentive memory coil. Like the set coil, except the value ofthe output
is retained even when the PLC is stopped or power fails.

-{RM}- Reset retentive memory coil. Like the reset coil, except the value of the
output is retained even when the PLC is stopped or power fails.

Comments about the basic instructions'

1. The transition sensing contacts and coils are useful for initialization and detecting
input transitions, for example, a push button press.
2. The set and reset coils are used in conjunction with each other. Figure 2.8 is a short
example using these two coils in conjunction to control a lamp.
3. The retentive memory coil instructions are used in a situation where the state of the
output must be retained when the PLC is stopped or power fails. Normally, PLC
outputs are turned off when the PLC is stopped or power fails. Depending on the
system, it may be important that the state of an output be retained in order for the
system to operate safely through a power failure of the PLC processor or when the
PLC is stopped. For certain PLC manufacturers, this function is provided as part of
the discrete output module. .
4. The author discourages use of the negated coil for the following reason. In most
systems the safe position is one in which the output from the PLC is off. Generally,
contacts. (often called permissives) are placed in series with the coil, indicating
multiple conditions must be satisfied before the output is allowed to be energized.
With the negated coil the rung conditions must be satisfied to tum off the output
which is opposite to most safety concepts.

A Lamp
I (s
A turns on Lamp

B Lamp B turns off Lamp

I (R
Figure 2.8. Set and reset coil example.
 2.3 BASIC LADDER LOGIC SYMBOLS 33

2.3.2 Modicon QuantumIMomentum

Using the Concept programming software, the Modicon Quantum and Momentum
PLC processors may be programmed in ladder logic compatible with the older 984-series
processors, or with IEC 61131-3 compliant ladder logic. The IEC 61131-3 compliant ladder
logic instructions are described here. The Modicon IEC basic ladder logic contact symbols
are the same as described in section 2.3.1.
The Modicon IEC basic ladder logic coil symbols are similar to those described in
section 2.3.1, except that Modicon does not support the following:
Retentive memory coil
Set retentive memory coil
Reset retentive memory coil
The instructions are:

Output or coil. If any left-to-right path of instructions passes power, the

output is energized. If there is no continuous left-to-right path of
instructions passing power, the output is de-energized.

Negated coil. If any left-to-right path of inputs passes power, the output
is de-energized. If there is no continuous left-to-rightpath of instructions
passing power, the output is energized.

Set coil. If any rung path passes power, output is energized and remains
energized, even when no rung path passes power.

Reset coil. If any rung path passes power, output is de-energized and
--®- remains de-energized, even when no rung path passes power.

Positive transition sensing coil. If conditions before this instruction

-®- c.hange from off to on, coil is turned on for one scan.

-®- Negative transition sensing coil. If conditions before this instruction

change from on to off, coil is turned on for one scan.

2.3.3 Allen-Bradley ControlLogix and PLC-5/SLC-500

The Allen-Bradley PLC basic instructions are not as numerous as for the IEC 61131-3·
basic instructions. In addition, for many of the instructions, a different symbol is used,
though the function is the same as an IEC 61131-3 instruction. The Allen-Bradley basic
ladder logic contact symbols are
34 Basic Ladder Logic Programming

--3E-- Normally open (NO) contact. Passes power (on) if coil driving the
contact is on (closed). Allen-Bradley calls it XIC (eXamine If Closed).

Normally closed (NC) contact. Passes power (on) if coil driving the
contact is off (open). Allen-Bradley cal1s it XIO (eXamine If Open).

One-shot contact. If conditions before this instruction change from off to

-{ONS} on, this instruction passes power for only one scan (ControlLogix and
PLC-5 only). It is analogous to the IEC positive transition sensing
contact except that this instruction follows the contact(s) whose
transition is being sensed.

One-shot rising contact. If conditions before this instruction change

-{OSR} from off to on, this instruction passes power for only one scan (SLC-500
only). Must immediately precede an output coil. It is analogous to the
IEC positive transition sensing contact except that this instruction
follows the contact(s) whose transition is being sensed.

For the Allen-Bradley PLCs, the basic ladder logic coil (output) symbols are

Output or coil. If any left-to-right path of instructions passes power, the

--()- output is energized. If there is no continuous left-to-right path of
instructions passing power, the output is de-energized. Allen-Bradley
calls it OTE (OuTput Energize).

Latch coil. If any rung path passes power, output is energized and
remains energized, even when no rung path passes power. It is analogous
to the IEC set coil instruction. Allen-Bradley calls it OTL (OuTput
Latch).

Unlatch coil. If any rung path passes power, output is de-energized and
--(u)- remains de-energized, even when no rung path passes power. It is
analogous to the IEC reset coil instruction. Allen-Bradley calls it OTU
(OuTput Unlatch).

os.
OM Sboc aisina: OB)
One shot rising output. If conditions before this instruction change from
Bit AddlaI 83125 SB)- off to on, the specified bit is turned on for one scan (ControlLogix and
Source Bit 2
~ 0:11 enhanced PLC-5 only). This is more appropriately a function block.
instruction because of its appearance. It is analogous to the IEC positive
transition sensing coil instruction.
 2.3 BASIC LADDER LOGIC SYMBOLS 35

os, One shotfalling output. If conditions before this instruction change from
One Sllot F~linll OS}
Bil Adc!las 8112 SS)- on to off, the specified bit is turned on for one scan (ControlLogix and
Source Bil 12
On! 0:20 enhanced PLC-5 only). This is more appropriately a function block
instruction because of its appearance. It is analogous to the IEC negative
transition sensing coil instruction.

There are no retentive memory coil instructions. The retentive function is handled in
the discrete output modules.

2.3.4 Siemens S7

The three types of S7 processors (S7-200, S7-300, and S7-400) have the same basic
instructions. The only exception is the midline output coil that is not valid for the S7-200
processors. The basic ladder logic contact symbols are

Normally open (NO) contact. Passes power (on) if coil driving the
contact is on (closed).

Normally closed (NC) contact. Passes power (on) if coil driving the
contact is off (open).

Positive transition sensing contact. If conditions before this instruction

-{p}- change from off to on, this instruction passes power for only one scan
(until rung is scanned again). For the S7-200 processors, this contact
uses vertical bars, rather than parentheses.

Negative transition sensing contact. If conditions before this instruction

-{N}- change from on to off, this instruction passes power for only one scan
(until rung is scanned again). For the S7-200 processors, this contact
uses vertical bars, rather than parentheses.

Invert power flow. If any left-to-right path of inputs before this contact
-jNOT~ passes power, the power flow to succeeding elements is interrupted
(turned olI)o If no left-to-right path of inputs before this contact passes
power, the power flow to succeeding elements is turned on.

The basic ladder logic coil (output) symbols are

Output or coil. If any left-to-right path of instructions passes power, the

-{H output is energized. If there is no continuous left-to-right path of
instructions passing power, the output is de-energized.

Midline output coil. Output coil in middle of rung. Other logic can occur
to the right of this coil. Not valid for the S7-200 processors.
36 Basic Ladder Logic Programming

Set coil. If any rung path passes power, output is energized and remains
-{sH energized, even when no rung path passes power.

Reset coil. If any rung path passes power, output is de-energized and
remains de-energized, even when no rung path passes power.

2.3.5 GE Fanuc

For the GE Fanuc PLCs, the basic ladder logic contact symbols are

Normally open (NO) contact. Passes power (on) if coil driving the
contact is on (closed).

Normally closed (NC) contact. Passes power (on) if coil driving the
contact is off (open).

Positive transition sensing contact. If conditions before this contact

change from off to on, power is passed for one scan (until rung is
scanned again). Valid for 90-70 processors only.

Negative transition sensing contact. If conditions before this contact

change from on to off, power is passed for one scan (until rung is
scanned again). Valid for 90-70 processors only.

The basic ladder logic coil (output) symbols are

Output or coil. If any left-to-right path of instructions passes power, the

-{H output is energized. If there is no continuous left-to-right path of
instructions passing power, the output is de-energized.

Negated coil. If any left-to-right path of inputs passes power, the output
-{/H is de-energized. If there is no continuous left-to-right path ofinstructions
passing power, the output is energized.

Set coil. If any rung path passes power, output is energized and remains
"-(sH energized, even when no rung path passes power.

Reset coil. If any rung path passes power, output is de-energized and
remains de-energized, even when no rung path passes power.
 2.4 LADDER LOGIC DIAGRAM 37

-(iH Positive transition sensing coil. If conditions before this instruction

change from off to on, coil is turned on for one scan.

Negative transition sensing coil. If conditions before this instruction

change from on to off, coil is turned on for one scan.

Retentive memory coil. Like the ordinary coil, except the value of the
output is retained even when the PLC is stopped or power fails.

Negated retentive memory coil. Like the negated coil, except the value of
the output is retained even when the PLC is stopped or power fails.

Set retentive memory coil. Like the set coil, except the value ofthe output
--{SM)-1 is retained even when the PLC is stopped or power fails.

Reset retentive memory coil. Like the reset coil, except the value of the
--{RM)-1 output is retained even when the PLC is stopped or power fails.

A continuation coil and contact are used to handle ladder rungs with more than 10
columns:

Continuation coil. If any left-to-right path of instructions passes power,

the next continuation contact is turned on. If there is no continuous
left-to-right path of instructions passing power, the next continuation
contact is turned off.

Continuation contact. Passes power (on) if preceding continuation coil

is on.

2.4 LADDER LOGIC DIAGRAM

An example PLC ladder logic diagram appears in Figure 2.9. The vertical lines on the
left and right are called the power rails. The contacts are arranged horizontally between the
power rails, hence the tenn rung. The ladder diagram in Figure 2.9 has three rungs. The
arrangement is similar to a ladder one uses to climb onto a roof. In addition, Figure 2.9
shows an example diagram like one would see if monitoring the running program in the
PLC. The thick lines indicate continuity and the state (on/off) of the inputs and outputs is
shown next to the tag. Regardless of the contact symbol, if the contact is closed (continuity
through it), it is shown as thick lines. If the contact is open, it is shown as thin lines. In a
relay ladder diagram, power flows from left to right. In PLC ladder logic, there is no real
power flow, but there still must be a continuous path through closed contacts in order to
energize an output. In Figure 2.9·the output on the first rung is off because the contact for C
is open, blocking continuity through the D and E contacts. Also notice that the E input is off,
38 Basic Ladder Logic Programming

Input (condition) Output

Instructions Instructions
, A , ,~ _ _.JA,-_ _~,

A off B 00 C off Outl ff

_ _ _ _~( a

I~
I I
D on
t/
off

I
F on E olf K 1-
on (OutZ on

rcH~
I

E off OutJ off

H on Out4 off
/
Function Function
Block Block
Instruction Instruction

------------------------------------------~
Continuous path for logic continuity

Power flows

Figure 2.9. Sample ladder logic diagram.

which means the NC contact in the first rung is closed and the NO contact in the second rung
is open.
Figure 2.9 also introduces the concept offunction block instructions. Any instruction
that is not a contact or a coil is called a function block instruction because of its appearance
in the ladder diagram. The most common function block instructions are timer, counter,
comparison, and computation operations. More advanced function block instructions
include sequencer, shift register, and first-~ first-out operations.
Some manufacturers group the instructions into two classes: input instructions and
output instructions. This distinction was made because in relay ladder logic, outputs were
never connected in series and always occurred on the extreme right hand side of the rung.
Contacts always appeared on the left side of coils and never on the right side. To turn on
multiple outputs simultaneously, coils are connected in parallel. This restriction was
relaxed in IEC 61131-3 and outputs may be connected in series. Also, contacts can occur on
the right side of a coil as long as a coil is the last element in the rung. Of the ladder logic
 2.4 LADDER LOGIC DIAGRAM 39

languages covered by this text, only the IEC 61131-3, Modicon Concept, and
Allen-Bradley ControlLogix allow coil instructions to be connected in series.
This text avoids using a series connection of coils for two reasons:
I. most PLCs do not allow it, and
2. it is counterintuitive to maintenance personnel who often interpret ladder logic in
the context of an electrical diagram.
Also, in IEC 61131-3, all function block instructions are input instructions because the
only output instructions are the coils. The Allen-Bradley PLC-5 and SLC-500 have function
block output instructions (e.g., timer, counter, and computation) which must be
remembered when constructing ladder logic programs for these PLCs.
Example 2.4. Draw a ladder diagram that will cause the output, pilot light PL2, to be on
when selector switch SS2 is closed, push-button PB4 is closed and limit switch LS3 is
open. (Note: no I/O addresses yet.)
Solution. The first question to answer is "What is the output?" The output is PL2, so the coil
labeled as PL2 is put on the right side ofthe rung. Secondly, consider the type ofconnection
of contacts to use. Since all three switches must be in a certain position to turn on the pilot
light, a series connection is needed. Thirdly, the type of contact is detennined by the switch
position to turn on the pilot light:

SS2 closed

PB4 closed

LS3 open

Putting all the pieces together, only one rung ofladder logic is needed, as shown in Figure
2.10.

Design Tip
The concept of placing the output on the rung first and then "looking back" to
determine the input conditions is very important. Because ofthe way the diagram is
configured, one has a tendency to consider the input conditrons first and then
position the output coil as the last step. As will be shown later, the coil or negated
coil instruction referring to a particular output must only occur once in a ladder
program. Considering the output coil first and the conditions for which it is active
(on) will avoid repeating coils.

Example 2.5. Draw a ladder diagram that is equivalent to the digital logic diagram in Figure .
2.11, which is the same as the following descriptions.

I ~s21 PB4 LS3 PL2, 1

!1 --I 11------11/1--1( ' I
Figure 2.10. Solution to Example 2.4.
40 Basic Ladder Logic Programming

A---r--""
B--------1
C

D --,--,-----1 >---- Y
E

Figure 2.11. Digital logic for Example 2.5.

In words:
Y is on when (A is on and B is on and C is oil) or D is on or E is off.
Boolean logic equation:
- -
y= ABC+D+E
Solution. First, answer, "What is the output?" The output is Y, so the coil labeled as Y is put
on the right side of the rung. Secondly, consider the type of connection of contacts to use.
For this problem, there is more than one type of connection. The three inputs within the
parentheses (the AND gate in Figure 2.11) are connected with "and," so a series connection
is required for these three contacts. The other two inputs (D and E) are connected with the
three series contacts by "or" (the OR gate inputs), so a parallel connection is required.
Thirdly, the type of contact is determined by the input state that turns on the output, Y:

Aon -7 -J ~ Don -7 -J ~

Bon -7 -J ~ Eoff -7 -J/~

C off -7 -J/~
Putting all the parts together, only one rung of ladder logic is needed, as shown in Figure
2.12.
Suppose one changes the D contact in Figure 2.12 to refer to Y, the output (shown as
Figure 2.13). Is this legitimate? Yes, it is legitimate, though probably not something one

ABC y
1--1 I--I/~----l
D

E
/1----------'
Figure 2.12. Solution to Example 2.5.
 2.4 LADDER LOGIC DIAGRAM 41

ABC Y
1--1 11----1/1---.--4
Y

E
/~ ---J

Figure 2.13. Output that appears as an input.

would want to do for this example. Even in relay ladder logic, it is legal and there is no
wiring short because the coil for r:elay Y and its NO contact are not connected. This concept
is called sealing or latching an output without using the set (or latch) coil instruction. In this
example, it is not a good idea because once Y is sealed on, there is no provision to turn it off.
Why?
There are some precautions to observe when programming in ladder logic:
I. DO NOT repeat normal output coils or negated coils that refer to the same tag. To
illustrate what happens when this is done, consider the ladder logic diagram in
Figure 2.14. This is the ladder of Figure 2.9, modified for this illustration. Note
that the coils for both the first and second rung refer to Outl. When the first rung of
the 1adder is scanned, Out! is turned on. However, when the second rung is
scanned, Outl is turned of(, overriding the logic in the first rung. If all of these
conditions are needed to turn on Outl, then they all should be placed in parallel, as
in Figure 2.15. In this illustration, it was obvious there is a problem. Normally,

E on OutJ off

H on Out4 off
/
Figure 2.14. Ladder with repeated output.
42 Basic Ladder Logic Programming

A on B on C on Outl on

I
D on

I lilT
F on E on K off

~Htr
E on Out3 off

H on Out4 off
/
Figure 2.15. Repeated output corrected.

when this problem occurs, the rungs are not adjacent, and it is not so obvious.
Compounding the problem, not all PLC programming software checks for this
situation. Therefore, the best way to prevent this problem is to consider the output
coil first and then consider all of the conditions that drive that output.
2. Use the set (latch) coil and reset (unlatch) coil instructions together. If a set coil
refers to an output, there should also. be a reset coil for that output. Also, for the
same reason that output coil and negated coil instructions should not be repeated,
do not mix the set/reset coils with the output coil and negated coil instructions that
refer to the same output.
3. Be careful when using the set/reset coil instructions to reference PLC physical
outputs. If the system involves safety and a set coil is used for a PLC physical
output, simply interrupting the condition on the set coil rung will not turn off the
physical output. All of the conditions that prevent the device from being turned on
must also appear on a rung with a reset coil output. For this reason, some
companies forbid the use of the set/reset coil instructions.
4. Reverse power flow in the contact matrix is not allowed. When electromechanical
relays are used to irnplementladder logic, power can flow either way through the
contacts. For example, consider the ladder logic in Figure 2.16. If implemented .
with electromechanical relays, power is allowed to flow right-to-Ieft through the
contact for SS2. When solid state relays replaced electromechanical relays for
ladder logic, power can flow only one way (left-to-right) through the contacts.
This restriction was carried to PLC ladder logic. If the reverse power flow path is
truly needed, then insert it as a separate path, where the power flows from left to
right. The reverse power flow path in Figure 2.16 is added as a separate path in
Figure 2.17.
 2.5 PLC PROCCESSOR SCAN 43

LSI SSI PSI PLi

If---II f-r-------4
--------------- ----------~
I
I

•,
"
'-
I
LS2 -'
Reverse
Power Flow

Figure 2.16. Reverse power flow in ladder logic.

LSI SSI PSI PLi

1:ss~I
II
PS2
I
LS2 SS2 SSI PSI
I II II II
LS2 PS2
I I
Figure 2.17. Reverse power flow in ladder logic corrected.

2.5 PLC PROCCESSOR SCAN

Previously, the process that the PLC uses to scan the ladder logic has only been
implied. Now it will be discussed in detail. In addition to scanning the ladder logic, the PLC
processor must also read the state of its physical inputs and set the state of the physical
outputs. J'hese three major tasks in a PLC processor scan are executed in the following
order:
Read the physical inputs
Scan the ladder logic program
Write the physical outputs
The processor repeats these tasks as long as it is running, as shown pictorially in Figure
2.18. The time required to complete these three tasks is defined as the scan time and is
typically I - 200 milliseconds, depending on the length of the ladder logic program. For
very large ladder logic programs, the scan time can be more than one second. When this
happens, the PLC program may miss transient events, especially if they are shorter than one
second. In this situation, the possible solutions are:
44 Basic Ladder Logic Programming

Start

Update Read
Outputs Inputs

Program
(ladder logic)
Execution

Figure 2.18. PLC processor scan.

1. Break: ladder logic into subroutines that are executed at a slower rate and execute
the logic to detect the transient event on every scan.
2. Lengthen the time of the transient event so that it is at least twice the maximum
scan time.
3. Place the logic examining the transient in a ladder logic routine that is executed at a
fixed time interval, smaller than one-half the length of the transient event.
Depending on the PLC processor, one or more of these solutions may be unavailable.
Normally, duriI).g the ladder logic program scan, changes in physical inputs cannot be
sensed, nor can physical outputs be changed at the output module terminals. However, some
PLC processors have an instruction that can read the current state of a physical input and
another instruction that can immediately set the current state of a physical output, as shown
in Figure 2.19. However, using the immediate input/output instruction incurs a severe time
penalty on the program scan. For example, to scan one contact in the ladder logic typically
requires less than one microsecond. The time to execute an immediate input/output
instruction typically requires 200 to 300 microseconds. Consequently, these instructions are
used sparingly.
Another way to view the processor scan is shown in Figure 2.20. In this figure the state
ofthe actual physical inputs is copied to a portion of the PLC memory, commonly called the
input image table. When the ladder logic is scanned, it examines the input image table to
read the state of a physical input. When the ladder logic determines the state of a physical
output, it writes to a portion of the PLC memory commonly called the output image table.
The output image may also be examined during the ladder logic scan. To update the
physical outputs, the output image table contents are copied to the physical outputs after the
ladder logic is scanned.
 2.5 PLC PROCCESSOR SCAN 4S

Start

Update Read
Outputs Inputs

Program
Immediate ~ (ladder
logic) Immediate
..
Input (Read) Execution Output (Update)

'--------~
Figure 2.19. PLC processor scan with immediate input/output.

An actual PLC processor executes other tasks than the three listed above. At a
minimum, it communicates with other devices and checks its own hardware for faults.
These other tasks occur in the background and have some influence on the scan time but are
generally not considered part of the scan time.
Most PLC processors have a watchdog timer that monitors the scan time. If the
processor scan time exceeds the watchdog timer time-out value, the processor halts ladder
program execution and signals a fault. This type of fault usually indicates the presence ofan
infinite loop in the ladder program or too many interrupts to the ladder scan.
In the Allen-Bradley ControlLogix, the PLC processor scan is not synchronized to the
reading ofthe inp!!ts and the update ofthe outputs. More details are contained in Chapter 3.
The overall execution of the PLC processor scan is controlled by the processor mode.
When the PLC processor is in the run mode, the physical inputs, physical outputs, and

State of Input Ladder Output State of

Actual Image Logic Image Actual
Input (pLC Program (pLC Output
Device Memory) Runs Memory) Device

Figure 2.20. Alternate view o(PLC processor scan.

46 Basic Ladder Logic Programming

ladder logic are scanned as described previously. When the processor is in program mode
(sometimes called stoppecl), the ladder logic is not scanned. Depending on the particular
PLC processor the physical inputs may be copied into the input image, but the physical
outputs are disabled. Some processors have a test mode, where the physical inputs and
ladder logic are scanned. The output image table is updated, but the physical outputs remain
disabled.
The ladder logic program can be evaluated in one of two ways. Most PLC processors
scan in rung order, also called top-to-bottom scan or "scan from the top". Some PLC
processors scan the ladder logic in column order, also called left-to-right scan or "scan from
the left." Both of these scan methods are described and then illustrated with examples.

2.5.1 Ladder scan in rung order

For mostPLC processors, the ladder scan starts at the top of the ladder and proceeds to
the bottom of the ladder, examining each rung from left to right. Once a rung is examined, it
is not examined again until the next ladder scan. The rungs are not examined in reverse
order. However, most processors have ajump instruction that one could use to jump back up
the ladder and execute previous rungs. However, that use of the instruction is not
recommended, because the PLC could be caught in an infinite loop. Even if the processor is
caught in an infinite loop, the watchdog timer will cause a processor halt so the problem can
be corrected.
Example 2.6. Show the scan timing for the ladder diagram in Figure 2.21 when it is scanned
by rungs. The only physical input is PB, a push button. The physical outputs are PLl, PL2,
PL3, and PIA.
Solution. When constructing a diagram showing scan timing, remember that the ladder scan
uses the input and output image tables, the input image is updated before the ladder is
scanned and the physical outputs are updated after the ladder is scanned. The timing
diagram is shown in Figure 2.22. The widely spaced dashed vertical lines indicate the start
of the processor scans. The solid lines indicate the state ofthe physical input or output at the
module terminal. The dashed lines indicate the state of the PLC image memory
corresponding to the physical input or output. Assume everything starts off (a value of 0).

PIA PLl
f----i: I-----i(
PL3 PL2
2 f----i: 1------1(

PB PL3
3 f----i: I-----i(

PL2 PIA
4 f----i: I-----i(

Figure 2.21. Ladder logic for Example 2.6.

 2.5 PLC PROCCESSOR SCAN 47

Scan
Number .
5
.
10

PB ~_......U
PLi
O - "';--;"-i--';"....
' --
r-].
, :!.-l
PL2 ~ : .l.r_-I
. I
i
• I
, I
i __ .....
~

PL3 ~ . . .r_] u.-__-

PIA ~ -.,.......,-...,........n-...;.-..;..-.:..._;".."'!J.. .--:-
--------.... Time
At I/O Tenninal In Image Memory --------

Figure 2.22. Timing diagram for Figure 2.21.

The on state is indicated by a value of I. The ladder logic rungs are scanned in this order: I,
2,3, and 4. The actions happening during each scan are as follows:
Scan I: Nothing happens even though physical input PB changes during the ladder
scan. The new state of PB is not copied into the PLC input image until the start of
the next scan.
Scan 2: The new state of PB is copied into the PLC input image before the ladder
logic is scanned. When rungs I and 2 are scanned, the values ofPLI and PL2 in the
output image remain at 0 (011) because the values of PIA and PL3 are 0 in the
output image. When rung 3 is scanned, the value ofPB in the input image is now I
(on), so there is continuity through the contact and the value of PL3 in the output
image changes to I (on). When rung 4 is scanned, the value of PIA in the output
image remains at O. At the end of scan 2, the output image is copied to the physical
outputs, and the physical output PL3 turns on.
Scan 3: When rung I is scanned, the value of PIA in the output image is 0, so the
value ofPLl in the output image remains at O. When rung 2 is scanned, the value of
PL3 in the output image is now I so there is continuity through the contact and the
value of PL2 in the output image changes to I. When rung 3 is scanned, the value
ofPB in the input image is still I, so the value ofPL3 in the output image remains
at I. When rung 4 is scanned, the value of PL2 in the output image is now 1, so
there is continuity through the contact and the value of PIA in the output image
changes to I. At the end of scan 3, the output image is copied to the physical
outputs and physical outputs PL2 and PIA turn on simultaneously. So, even
48 Basic Ladder Logic Programming

though the output image copy of PL2 and PL4 were not rurned on simultaneously,
they are rurned on simultaneously at the physical terminal.
Scan 4: When rung 1 is scanned, the value of PL4 in the output image is now I, so
there is continuity through the contact and the value of PL 1 in the output image
changes to 1. When rung 2 is scanned, the value ofPL3 in the output image is still I
so the value of PL2 in the output image remains at 1. When rung 3 is scanned, the
value of PB in the input image is still I so the value of PL3 in the output image
remains at I. When rung 4 is scanned, the value ofPL2 in the output image is still I
so the value of PL4 in the output image remains at 1. At the end of scan 3, the
output image is copied to the physical outputs and physical output PLl turns on.
Scans 5 and 6: Nothing changes.
Scans 7 - 9: Similar to scans 2 - 4, except that states change from I (on) to 0 (oft).
Notice that the arrangement of the rungs has forced it to operate in the manner shown in
Figure 2.22. How would one change the program so that the physical outputs turned on and
off simultaneously? Answer: arrange the rungs so the output coils appear in the following
order: PL3, PL2, PL4, PL1.
This example, though trivial, serves to illustrate two concepts: the way ladder logic is
scanned and the difference between image memory and physical input/output. The next
example is a little more complicated and introduces the concept of internal coils.
Example 2.7. Show the scan timing for the ladder diagram in Figure 2.23 when it is scanned
by rungs. The only physical input is PB 1, a push button. The only physical output is PL I, a
pilot lamp. IntI, Int2, and Int3 are internal one-bit memory locations, often called internal
coils. They are not attached to any physical outputs. What does this ladder logic program
do?
Solution. The scan timing diagram is shown in Figure 2.24 and has the same representation
as in the previous example. Assume everything starts off (a value of 0). The ladder logic
rungs are scanned in this order: 1,2,3, and 4. The actions happening during each scan are as
follows:

PBI Int3 Int2 Inti

I 1/1 I I (
PBI Int3 Inti Int2
2 I I/~/I (
Int2
I
PBI Int3
3 I (
Int2 PLi
4 I (
/
Figure 2.23. Ladder logic for Example 2.7.
 2.5 PLC PROCCESSOR SCAN 49

Scan
8o
Number
·I 2. 4o 6. 10 12 14

...JTI----..,r_i
o

PBI ~ ll [1
· .
°r-
•I
...
'I
Inti • , • • I I II • I • •I • • 0

O --~--~--"':'--~.-"':'--~--"':--~---:.-"":. ,I __ ,._-.---~-_.

1 ·a--~--~--~--~--~--~--~·-~I
,. I
Int2 • •I I ,
1--,---,._.,---,----
I I • I

o --,,:,--,,:,'
1 : ~----:---:--.:-~ ••••• -----"'\ •
I I • I' , • I I
Int3 I • • I' • , ,I I •
0- ••• -,.- .
• 1
. -"'-- ........-- ... 1 10.,. __ -

PLl
~ -,. . . . .,. .n
.
----------;~~ Time
At I/O Terminal In PLC Memory --------

Figure 2.24. Scan timing diagram for Figure 2.23 (scan in rung order).

Scan I: Nothing happens even though physical input PB I changes during the ladder
scan. The new state ofPB I is not copied into the PLC input image until the start of
the next scan.
Scan 2: The new state ofPBI is copied into the PLC input image before the ladder
logic is scanned. When rung I is scanned, PB I is on, and Int3 is off, so the first two
contacts pass power, but Int2 is off. So, Int I remains off. When rung 2 is scanned,
there is continuity along the top path, so Int2 is turned on. When rung 3 is scanned,
the value of PB I in the input image is now on, so there is continuity through the
contact aild the Int3 changes to on. Note that this change in Int3 will not be sensed
by the first two rungs until the next scan. When rung 4 is scanned, the value ofInt2
in the PLC memory is on, so PLl is turned on in the output image. At the end of
scan 2, the output image is copied to the physical outputs and the physical output
PLl turns on.
Scan 3: There is no change in the rung output coils, though some of the contacts in the
first two rungs have changed since last scanned. When rung I is scanned, there is
now continuity through the first and third contact, but not through the second (Int3 .
is off). When rung 2 is scanned, there is no continuity through the top branch, but
there is continuity through the bottom branch, and so Int2 remains on.
Scans 4-5: There is no change in the rung output coils because there is no change in
any of the contacts.
Scan 6: The new state ofPBI is copied into the PLC input image before the ladder
logic is scanned. When rungs I and 2 are scanned, there is no change in the output
coils even though PB I has changed. When rung 3 is scanned, the value of PB I in
50 Basic Ladder Logic Programming

the input image is now off so there is no continuity through the contact and the Int3
changes to off. Since the value ofInt2 has not changed, PLl remains on.
Scans 7-9: There is no change in the rung output coils because there is no change in
any of the contacts.
Scan 10: The new state ofPBI is copied into the PLC input image before the ladder
logic is scanned. When rung I is scanned, PB I is on, Int3 is off, and Int2 is on so
Intl is turned on. Because Inti is on, when rung 2 is scanned, there is no continuity
through the last contact and so Int2 is turned off. When rung 3 is scanned, the value
ofPB I in the input image is now on so there is continuity through the contact and
the Int3 changes to on. When rung 4 is scanned, the value of Int2 in the PLC
memory is off, so PLl is turned off in the output image. At the end of scan 10, the
output image is copied to the physical outputs and the physical output PLl turns
off.
Scan II: When rung I is scanned, the second contact is open since Int3 is now on, and
so Intl is turned off. Because Int3 is on and Int2 is off when rung 2 is scanned,
there is no continuous path to the output coil and Int2 remains off. When rungs 3
and 4 are scanned, the output coils do not change since the contacts have not
changed since the last scan.
Scan 12: There is no change in the rung output coils because there is no change in any
of the contacts.
Scan 13: The new state of PB I is copied into the PLC input image before the ladder
logic is scanned. When rungs I and 2 are scanned, there is no change in the output
coils even though PBI has changed. When rung 3 is scanned, the value ofPBI in
the input image is now off so there is no continuity through the contact and the Int3
changes to off. Since the value of Int2 has not changed, PLl remains off.
What does this ladder program do? This is called a "toggle" or "push-to-start,
push-to-stop" circuit. Every time the push button PB I is pushed (turned on), PLl changes
its state.

2.5.2 Ladder scan by columns

Some PLC processors, most notable the Modicon x84 PLCs, scan the ladder by
columns. A pictori'al representation of this method ofladder scan is shown in Figure 2.25.
Rather than scan all of the columns in the entire ladder, the ladder is divided into networks
of7 rows and 11 columns. The first 10 columns may have contacts or coils; the last column
may only have coils. The first (leftmost) column of contacts is scanned from top to bottom
and then the next column to the right is scanned in the same way. When a coil is
encountered, its value is based on the value of the logic in the cell immediately left of the
coil. Each column is examined and lastly the column of outputs is scanned, setting or
resetting them.
Example 2.8. Show the scan timing for the ladder diagram in Figure 2.23 when it is scanned
by columns. The only physical input is PB 1, a push button. The only physical output is PLl,
a pilot lamp. As for Example 2.7, Int!, Int2, and Int3 are internal one-bit memory locations.
Solution. The scan timing diagram is shown in Figure 2.26 and has the same representation
as in the previous example. Assume everything starts off (a value of 0). The entire ladder
logic is contained in one network using 5 rows (the second rung occupies 2 rows) and 4
 2.5 PLC PROCCESSOR SCAN 51

Start

Network I

Network 2

Network 3

Figure 2.25. Scanning ladder by columns.

columns numbered from the left as 1,2,3, and 4. The actions happening during each scan
are as follows:
Scan 1: Nothing happens even though physical input PBl changes during the ladder
scan. The new state ofPB 1 is not copied into the PLC input image until the start of
the next scan.
Scan 2: The new state of PB 1 is copied into the PLC input image before the ladder
logic is scanned. When a column is scanned, the current status (off or on) of the
row element is the combination of the current contact and the status of the row
elements to the immediate left. A horizontal wire row element is interpreted as an
always-closed contact. When column 1 is scanned, the row statuses (from the top)
are determined by the current contact continuity: on, on, off, on, off. When
column 2 is scanned, the row statuses (from the top) are detennined by the status of
the previous column and the contact continuity: on, on, off, on, off. When column
3 is scanned, the row statuses are: off, on, - , on, off. When column 4 is scanned, .
the coils are set to the row statuses from the previous column: off, on, - , on, off.
So, as a result of this scan, Int2 and Int3 are turned on.
Scan 3: When column 1 is scanned, the row statuses (from the top) are determined by
the current contact continuity: on, on, on, on, on. When column 2 is scanned, the
row statuses are: off (lnt3 is on), off, on, on, on. When column 3 is scanned, the
row statuses are: off, on, - , 'on, on. When column 4 is scanned, the coils are set to
the row statuses from the previous column: off, on, - , on, on. So, as a result of
52 Basic Ladder Logic Programming

Scan
Number 2, .
4 .
6
.
8 10
, 12 .
14

PBI l--l'.
o
,I
,
,
I
I
(.;.i -'U [1
Intl • • • • •
_ _________________________
1
•I • , •
.......
I'
II .
I'
'
• .
I , • ••
O • , • • • • I I , • • , I •

I ..... . . . _ _ . . _ _ ... _ _ ... _ _ ... _ _ ... j.

• •• . , . . , . I'
Int2 I' • ,
o-_":, __ ,,:,_1
• •• I

. .-:---:---:--_.
• .- .... • I

• I' • • I I I :. I I I'
Int3 I. I I. I •
o--._.... .
• I
.",,-- .. -- ..--.... .
I • • •
1-.- __ -

PLl
~ _.,.......,..~~n-.....:._.:......:.-~..:..--:_..:........:.'"'Tu_-:-_

--------l~~ Time
At I/O Terminal In PLC Memory --------

Figure 2.26. Scan timing diagram for Figure 2.23 (scan in column order).

this scan, PLl is turned on in the output image. At the end of scan 3, the output
image is copied to the physical outputs, and the physical output PLl turns on.
Scans 4-5: There is no change in the rung output coils because there is no change in
any of the contacts. .
Scan 6: When column 1 is scanned, the row statuses (from the top) are: off, off, on,
off, on. When column 2 is scanned, the row statuses are: off, off, on, off, on. When
column 3 is scanned, the row statuses are: off, on, - , off, on. When column 4 is
scanned, the coils are set to the row statuses from the previous column: off, on, - ,
off, on. So, as a result of this scan Int3 is turned off.
Scans 7-9: There is no change in the rung output coils because there is no change in
any of the contacts.
Scan 10: The new state ofPB I is copied into the PLC input image before the ladder
logic is scanned. When column 1 is scanned, the row statuses (from the top) are:
on, on, on, on, on. When column 2 is scanned, the row statuses are: on, on, on, on,
on. When column 3 is scanned, the row statuses are: on, on, - , on, on. When
column 4 is scanned, the coils are set to the row statuses from the previous column:
on, on, - , on, on. So, as a result of this scan, Intl and Int3 are turned on.
Scan 11: When column 1 is scanned, the row statuses (from the top) are: on, on, on,
on, on. When column 2 is scanned, the row statuses are: off, off, on, on, on. When
column 3 is scanned, the row statuses are: off, off, - , on, on. When column 4 is
scanned, the coils are set to the row statuses from the previous column: off, off, - ,
on, on. So, as a result of this scan, IntI and Int2 are turned off.
 2.6 PROGRAMMING WITH NC CONTACT 53

Scan 12: When column I is scanned, the row statuses (from the top) are: on, on, off,
on, off. When column 2 is scanned, the row statuses are: off, off, off, on, off. When
column 3 is scanned, the row statuses are: off, off, - , on, off. When column 4 is
scanned, the coils are set to the row statuses from the previous column: off, off,-,
on, off. So, as a result ofthis scan, PL I is turned off in the output image. At the end
of this scan, the output image is copied to the physical outputs, and the physical
output PLi turns off.
Scan 13: The new state of PB I is copied into the PLC input image before the ladder
logic is scanned. As a result of this scan, Int3 changes to off when the fourth
column is scanned.
If the scan timing diagram in Figure 2.26 (scan by column) is compared with the scan
timing diagram of Figure 2.24 (scan by rung), the only major difference is that one or two
extra scans are required to resolve the logic after PB I changes state. However, PB I does not
need to be on for at least two scans in order for the logic to resolve correctly. Why?
If it is important that the logic be resolved on the scan after PB I is pressed, the ladder
logic of Figure 2.22 can be modified in one of two ways:
1. Move the contact for Int2 on the fifth row (last rung) from the first column to the
fourth column and move the coil for PLi to the fifth column of the fifth row. This
change guarantees that PLi is set to the same value as Int2 on the same scan.
2. Delete the fifth row and move the coil for PLi to be in parallel with the coil for Int2.

2.6 PROGRAMMING WITH NC CONTACT

Many novice PLC ladder logic programmers tend to use the same type of contact (NO
or NC) in the ladder that corresponds to the type of field switch (or sensor) wired to the
discrete input channel. While this is true in many cases, this is not the best way to think of
the concept.

A NO switch does not require a -1 f- in the ladder logic.

A NC switch does not require a -1/f- in the ladder logic.

The PLC only knows one thing about the discrete input: whether it is on (closed) or off
(open). The PLC knows nothing about how the switch is wired in the field; whether it is NO
held open, NO held closed, NC held open, or any other combination.
For example, safety switches are generally NC switches, but the contact in the ladder
logic that refers to the safety switch is generally a NO contact. The reason for this type of
safety switch will be explained in the next section.

Regardless of the type of switch in the field, the principle to remember is

If one wants "action" (tum ON) when the switch is closed, use -1 f-
If one wants "action" (turn ON) when the switch is open, use -1/f--
As explained earlier in this chapter, think of the contact as a symbol
54 Basic Ladder Logic Programming

-1 f- = on = Closed = True = I

-1/f- = off= Open = False = 0

An alternative view ofthis concept is to consider the contact symbol in the ladder as the
unenergized state of the discrete input:
has no continuity (off, or false) when the discrete input is off. Consequently, when the
discrete input is on, the contact has continuity (on, or true).
has continuity (on, or tru.e) when the discrete input is off. Consequently, when the
discrete input is on, the contact has no continuity (off, or false).
To illustrate this concept, consider the system in Figure 2.27a that is a simple water
level control system. 8 I is a NC safety switch and F8 I is a NO float switch. The water inlet
valve VI should be on (fill tank) when 81 is closed and F8l is open. The ladder logic rung
to accomplish this operation is shown in Figure 2.27 b. Notice that for both switches, the
contact used in the ladder is the opposite of the type offield switch. The type offield switch
is irrelevant to the PLC ladder logic. The type of contact in the PLC ladder logic is
determined by the operation description
VI is on when 81 is closed and F81 is open.

81 closed -7-1f-
F81 open -7 -1/f-

Design Tip
The type of contact (NO, NC) in the field is determined by safety or fail-safe
factors, but these factors are not relevant to the PLC ladder logic. The PLC is
concerned only about the current state of the discrete input (open or closed).

2.7 START/STOP
The concept described in the previous section will be reinforced when we consider the
problem of starting and stopping a motor with momentary switches. The motor is
representative of any device that must run continuously but started and stopped with
momentary switches.
This problem is handled in two parts: starting and stopping. How do I start a motor and
keep it running with a momentary normally open push button switch? The switch closes to
start the motor and when it is released (opened) the motor should continue to run.
Obviously, one needs to add a contact in parallel with the start switch contact that maintains
continuity when the start switch is opened. One way is to use the PLC output that drives the
motor to seal around the start switch contact, as shown in Figure 2.28. Note that the
MOTOR output does not directly control the motor (the PLC output cannot handle high
currents) but represents the input to a motor contactor or motor controller.
The second part of the problem is to add a stop switch. The stop switch is a normally
closed push button switch, (push) open to stop, closed to run. A contact for this stop switch
needs to be added in series with the motor coil, as shown in Figure 2.29. Notice that the
 2.7 START/STOP 55

Water ----i~

FromPLC
Disc. Output------i
'------>01

Neutra[-----'
120 V--------+----...,
ToPLC
Disc. I n p u t - - - - - - - - - - - - - - t - D
FSI
ToPLC W/////////////fiW////////////////fi
Disc. Input W/////////////////////////////////fi
W//////////////////fiW///////////fi

(a)

(b)

Figure 2.27. Example showing differences in field switch and ladder logic contact:
(a) simple level control system; (b) PLC ladder logic.

contact in the ladder logic is a NO contact, which is not the same as the NC push button stop
switch. This is a common situation where the novice PLC programmer makes a mistake.
Many people do not resolve the issue for themselves until they actually program it the
wrong way (use aNC contact for the stop switch) and then understand the correct concept.

Design TiP.
In PLC ladder logic, use the NO contact instruction for physical stop switches. This
is not universal, but any physical stop switch that is not closed to run probably
should be replaced for safety reasons.

-L START PB MOTOR
-0 0-

L.-_M~'_~__
START PB (

Figure 2.28. Ladder logic to start motor with momentary switch.

56 Basic Ladder Logic Programming

--L STOP PB MOTOR

-0 0-
START PB f------i(
MOTOR

STOP PB

Figure 2.29. Ladder logic to start and stop motor.

The operation ofthe start/stop ladder logic is detailed in Figure 2.30. Assume one starts
with the motor stopped and both push buttons not pressed (Figure 2.30a). In this situation,
the contact for STOP- PB has continuity because the STOP- PB is closed. Now when the
START]B is pressed, the switch is closed, and the START]B contact in the ladder has
continuity. Therefore, a continuous path exists through the START_PB and STOP_PB
contacts, and the MOTOR output (coil) is energized (Figure 2.30b). When this rung is next
scanned, the path through the MOTOR contact has continuity (Figure 2.30c). This situation
exists as long as START]B is held down. When START]B is released, the switch is
opened, and the START]B contact in the ladder does not have continuity (Figure 2.30d).
However, a continuous path exists through the MOTOR contact and the STOP_PB contact.
Hence, the MOTOR output remains energized. This situation exists until STOP]B is
pressed. When STOP]B is pressed, the switch is opened, and the STOP]B contact in the
ladder does not have continuity (Figure 2.30e). Thus, there is no continuous path to the
MOTOR output, and it is de-energized, which stops the motor. Now the system is in the
same state as when the description of its operation commenced.
The questions arise: "Why are the switches wired this way?"; "Why not use normally
open push button switches for the start switch and the stop switch?"; "Why not use normally
closed switches for both?" The switches are wired this way for safety reasons. If any part of
the system fails (switch or wiring), the motor will go to a safe state. If the start switch wiring
is faulty (open wire), then the motor cannot be started because the PLC will not sense a
closed start switch. If the stop switch wiring is faulty (open wire), then the motor will
immediately stop if it is running. Also, the motor cannot be started with an open wire to the
stop switch. Since the operator has lost control over stopping the motor, the safe state is one
in which the motor is stopped.
However, these types of switches do not automatically handle all failures. If the start
switch fails so that its contact is always closed, the stop push button must be held in to
prevent the motor from starting. In this case, the circuit breaker at the motor controller must
be opened to stop the motor. Ifthe stop push button fails so that the contact is always closed,
the ladder logic cannot de-energize the motor. To handle this situation, many systems have
another stop switch contact in series with the stop switch on the PLC rung. Also, most
systems have an emergency-stop wired external to the PLC that will cut power to all control
devices. It should be noted that a switch failing closed is extremely rare. An open wire or
switch failing open is much more common.
The ladder logic circuit in Figure 2.29 is also called a seal circuit, and it will appear in
other contexts. In many real systems, the start and stop of a device, like a motor, have more
conditions that must be satisfied in order for the motor to run. These conditions are referred
to as permissives, permits, lockouts, inhibits, or restrictions. These conditions appear on the
 2.7 STARTISTOP 57

-L START]B STOP]B MOTOR

-0 0-
START PB I--~(

~
MOTOR

STOP PB
(a)

Jo-
START PB
START PB STOP PB
I~-~(
MOTOR

~
MOTOR

STOP PB
(b)

Jo-
START PB
START]B STOP]B
I~-~(
MOTOR

~
MOTOR

STOP PB
(c)

-L START]B STOP]B MOTOR

-0 0-
START]B I~-~(
MOTOR

STOP PB
(d)

-L START]B STOP PB MOTOR

-0 0-
START PB r (
-oto-
STOP PB
MOTOR

(e)

Figure 2.30. Operation of motor start/stop: (a) initial conditions; (b) start switch pressed;
(c) scan after start switch pressed; (d) start switch released; (e) stop switch pressed.
58 Basic Ladder Logic Programming

start/stop rung as shown in Figure 2.31. Permissives allow the motor to start, and lockouts
will stop the motor, as well as prevent it from being started.
An alternate way of starting/stopping the motor is shown in Figure 2.32 with the set and
reset coils. However, this way of controlling the motor is not recommended. Any lockout
logic will need to be in series with START_PB contact and the logical inverse of the
lockout logic will need to be placed in parallel with the STOP]B contact. This task is not
impossible, but error-prone, especially if someone other than the original programmer must
make a change to the lockout logic.

Design Tip
Design the logic so that a change to lockouts, permissives, and so on, affects only
one rung. If a change to a lockout forces one to change multiple rungs, it is almost
guaranteed that the changes will be wrong because (I) someone other than the
original programmer will be making the change and (2) he/she will be under time
pressure to make the change.

There is a slight problem with the ladder logic of Figure 2.29. Motor overload contacts
are always located on the wires leading directly to the motor and external to the PLC. If the
motor stops because of an overload, the seal circuit of Figure 2.29 will continue to energize
the rung output (input to the motor controller). When the overload contacts cool and reclose,
the motor will start automatically, with possible injury to personnel. To solve this problem,
the sealing contact (in parallel with START]B) is provided by a motor auxiliary contact
that closes when the motor has power, or by a motor speed sensor that is on when the motor
or the equipment it is driving is running. If the motor stops because of an overload, the seal
contact in the ladder loses continuity and the MOTOR output from the PLC is de-energized.
Thus, the start push button must be pressed after the overload has been cleared to restart the
motor. If the speed sensor on the driven equipment is used as the seal contact, then a broken
shaft will automatically stop the motor. .
Note that the stop switch has priority in the ladder logic of Figure 2.29. If the stop
switch is pressed, no amount of pushing the start switch will start the motor. What if one
wanted the start condition to have priority over the stop condition? Obviously, this is not
wanted for a device like a motor, but is extremely useful for alarms. For alarms, the alarm
condition (start condition) should have priority over the alarm turn-off condition (stop
condition). As long as the alarm condition is still happening, the alarm cannot be turned off.

Permissives Lockouts
~ ,,-_.-JA ' - - - - . . ,
START PB STOP PB MOTOR
H H/jH/HH
MOTOR
I
Figure 2.31. Start/stop with permissives and lockouts.
 2.7 START/STOP 59

-L START_PB MOTOR
-0 0-
START PB I (s
STOP PB MOTOR

--uk-
STOP PB
/1 (R

Figure 2.32. Start/stop with set and reset coils (not recommended).

This type of start/stop ladder is shown in Figure 2.33. Note that Alann_Offis on to turn off
the alann (as long as Alann_Condition is off).
Example 2.9. Add a jog switch to the motor start/stop ladder logic ofFigure 2.29. The jog
switch is a normally open push button switch that when pressed (closed) runs the motor as
long as it is held in. If the stop push button switch is pressed, the motor should immediately
stop ifthejog or start switches are closed. The jog switch should have no effect if the motor
is already mnning.
Solution. One may be tempted to just place the JOG]B contact in parallel with the
START_PB contact, but then the jog switch functions as another start switch. When it is
released, the motor will still be running. So the seal circuit will need to drive an internal coil
!NT_MOTOR instead ofthe motor coil directly. The !NT_MOTOR internal coil, in parallel
with the jog and stop switches, drives the motor coil. This ladder logic is shown in Figure
2.34.

Alarm Condition ALARM

AL~~
(
Alarm_Off
'----i i III.
Figure 2.33. Start/stop with start priority.

--L
--0 0- ,
I-r----i,
START PB
-
t--,...---i
STOP PB
I~--;(
INT MOTOR

JOG PB
INT MOTOR
"I

:-;---1
I

JOG PB STOP]B MOTOR

\f------i(
INT MOTOR
"I
1...-----1, --------
STOP]B

Figure 2.34. Start/stop/jog motor control.

60 Basic Ladder Logic Programming

-L START]B STOP]B MOTOR

-Q 0-
JOG PB I------f(
MOTOR JOG]B
-L 1-...-,1 / t-----!
-Q 0-
START]B JOG]B

STOP]B

Figure 2.35. Incorrect start/stop/jog motor control.

Figure 2.35 shows one incorrect solution to this problem. At first glance, it seems
correct because the motor is not sealed when the JOG_PB contact is pressed. However,
when the JOG_PB is released, there is continuity through the middle branch because at that
instant MOTOR is on and JOG]B is off, and so MOTOR remains on.

2.8 CONVERTING RELAY LOGIC TO LADDER LOGIC

Even though relay logic systems are largely obsolete, one occasionally needs to replace
a relay system with a PLC. Hence, this subject is examined in a little more detail. When
converting relay logic to PLC ladder logic there are two basic steps:
1. Identify the physical inputs and outputs.
2. Translate the contacts and coils in the relay ladder diagram to PLC contacts and
coils.
The second step is generally trivial. The example considered here does not consider any
emergency switches controlling power to the physical equipment. This installation issue is
treated in Chapter 4. Also, the particular example in this section has no delays or timers,
which are treated in Chapter 5.
Example 2.10. A diverter gate, Gate 4, for a power plant coal-handling system is shown in
Figure 2.36. Depending on the position of the gate, coal from Conveyor 2 is either diverted
to Bunker 2 or to Conveyor 3. The relay ladder part of the control for Gate 4 is shown in
Figure 2.37. This is simplified from an actual drawing. The cross-reference information for
the relays and contacts has been omitted.
The GC3RR and GB2RR relays each have a contact that closes when the relay coil is
on, activating a pneumatic cylinder. The cylinder controlled by GC3RR moves the diverter
to direct the coal to Conveyor 3. The cylinder controlled by GB2RR moves the diverter to
direct the coal to Bunker 2. The Jog-Off-Rem switch is a three-position two-pole selector
switch on a panel positioned close to the diverter gate. In the "Off' position neither contact
is closed and the diverter gate position cannot be changed. In the "Jog" position, the C3 and
B2 pushbutton switches are used to move the diverter to the Conveyor 3 and Bunker 2
positions, respectively. The C3 and B2 pushbutton switches are on the same panel as the
Jog-Off-Rem switch. When the Jog-Off-Rem switch is in the "Rem" position, the diverter
 2.8 CONVERTING RELAY LOGIC TO LADDER LOGIC 61

( Conveyor 2 ) Gate 4

( Conveyor 3 )
'----'---~

Bunker 2

Figure 2.36. Coal handling diverter, Gate 4.

is controlled by the B2-C3 selector switch, mounted on a panel in the control room, some
distance from the diverter. There is safety switch, G4SS, which must be closed for the
diverter to operate. There are also limit switches, G4C3 and G4B2, that indicate when the
diverter is in proper position to divert coal to Conveyor 3 or Bunker 2. Convert this relay
ladder to PLC ladder logic.
Solution. The first step is to identify the physical inputs and outputs. Dashed circles in
Figure 2.38 show the physical inputs that must be retained. The outputs that must be
retained are shown by dashed rectangles. The two outputs driving the pneumatic cylinder
valves must be relay contacts to be compatible with the existing equipment. Also, power
must be supplied to both poles of the B2-C3 selector switch so that their closure can be
detected by the PLC. The input and output wiring is shown in Figure 2.39. Note that a
connection from L1 (line) to both poles of the B2-C3 selector switch has been added. An
exact translation to ladder logic is shown in Figure 2.40. However, notice that the internal
relays G4RSR, G4SSR, G4B2R, and G4C3R are merely copies of physical inputs, so they
can be replaced by references to the physical inputs. Also, since the GC3RR and GB2RR
relays only drive the G4C3_SOL and G4B2_SOL physical outputs, they can be replaced by
the physical outputs. This PLC ladder is shown in Figure 2.41. However, in this application
the GC3RR, GB2RR, G4RSR, G4B2R, and G4C3R internal coils are referenced in other
parts ofthe ladder logic. Consequently, any reference to these coils must be replaced by the
appropriate reference in other parts of the ladder. For a large project, it may be deemed
simpler to utilize the exact translation and not worry about removing the duplicates,
especially if the relay logic drawings do not cross-reference the coils with the their use as
contacts.
62 Basic Ladder Logic Programming

LI L2
01
OIVERTER GATE 4 (0415)

JO~;-:~-':"'37I--'- ? ~-~-:f1
02

03 033 G4S.~S,:RQl:,:G4C.J~.~"R='i5-{:9£illD--j
I Ol4 •• 035 GC3RR GATE 41
C01'oi'VEYOR J
RUN RELAY

os I
I rino"''':-: !
l+"iJ
OOX
06
I !!
-~ Ii.
B2 ESR2 G4SSR G482R GATE 41
mi I~ 1-1-;;072;;:;--i1 i=iim1j3':-~~:If:-Y=-"mi44~(]G!B21iRR[:>l =~~Y
08
ixnoi
09 ~f-R"--_ , -
10

II
III
12
13

14 G4SS

IS .........-----m-----------------(::!G4S!Ei§jsRU-j GATE 4 SAFETY

lSi SW!TCHRELAY
16

17

18

19 t - - G4B21• ------i9i-------------r---<JG4E1!82R~>-1
191 GATE4IBUNKER 2
RELAY
20

2\

22

23 t-- .--------,rn-------------r---{]!§!D
G4C3'. 231 G4C3R J"" GATE4ICONV-
EYOR 3 RELAY
24

')?5;-/
2S

26
'----1a--(
/ , IN POSmoN

27 G4C3 SOL
GC3RR GATE4I
.Jy- CONVEYOR)
SOl.E.),j'OID
29

~
GATE"
30 BUNlCER2
30\
SOLENOID

Figure 2.37. Relay ladder control for Gate 4.

 2.8 CONVERTING RELAY LOGIC TO LADDER LOGIC 63

LI u
01
DIVEinR GATE' (G4JS)
02 J~v;,....,
OFF').a\{ /,'''~'''''\
Ii :-1-: ~R2 ~,SR G4,9R GATE"
L.l.~.J -11 Ir
OJ
....
• XOO i l/
, V OJI ,
..J'iSd.. .
'- .' "-'0
.. 032 OJ3 034 . .r OJ, GORR CONVEYORJ
RUN RELAY
04
"["1
, • • I ,

-.w-
'J I
• I I •

0'
! / 0"
' i
oo~
..0, "0"'/
06
! ~ "( ': i ESR2 G4SSR G4B2R GATE 41
rn I rn2 I. 073 r' rn. GB2RR "}- BUNKER 2

I '-.0.-1.1 rn, RUN RELAY

0'
~R .1xoo!-+
.......
_.......I'
09
\ ........-/
10
I·oo.xit\•
II ~" G4RSR
GATE 4 REMOTE
III SEUCTED RELAY
12 "'-...../
13

.. "'00-,
G4SS
,
I GATE 4 SAFETY
" ....___..~l '"
G4SSR
SWITCH RELAY
16

17

18 "'0"",
G482 .. GATE 4/BUNKER 2
.9 , 191
G4B2R
RELAY
/ r·..---------- ...._--...
.o j
20
: '\. /:
21 .:~ ~
/W,:
INPOSmON

'"
22 :"".____
LI.. ________ J:

2J
G4C3 .. G4C3R
GATS 4ICONV-

/
• 2JI EYOR J RELAY
24
0"/ r--_.. ----_..----_......
2S

26
:
,I.!~/
M. '\.!
.. ____._..._':" __ •• ___ .I
INPOSmON

........ __ ........

·:•i~.
27
GO',RR GATE 41
'
28 r CONVEYOR 3
281
• SOLENOID
~--------"004
29
GB2RR
'! ·::~.. GATE.,
30
301 · .
!.-........_.. _... -f
BUNXER2
SOLENOID

Figure 2.38. Physical inputs and outputs identified.

64 Basic Ladder Logic Programming

Ll L2
01 G4 JOG
DlVERTER GATE 4 (G4JS) M~ule 1
02 IDG OFF REM C3 Channel I

OJ ~~;;---t-4-'-~.~-=,..,
XOO i : - 031 - 032
04 B2f':::::t::JCl
'"
04 C3 SEt
0' 1--4---.-+-",.,.....,.' . ~',........-< Modulel

06 I o~ I COX
Channell

07 I -'-Oi!>-f-=,
071 I

08 ! I !
09 I ,-__..i XOOj
..... -..1-< G4 82 SEL
MOdulcl
Channell
10 I I

II
!oox~._ !.....,.".....o G4 REMI
Module
I[I Channel 4
12

13

14
G4B2
Module 1
O1anncl S
16

17

18
G41l2 G41l2
19 • 191 0 Module I

20
Channc(6

G4B2]L
, /
21

22
Module 11
Channell
+u- /
w
, GATE 4IBillI1<ER 2
rNPOSmON

G4C3 G4C3
23

24
• 231 0 Module I
Channel 7

G4C3]L
GATB4ICONV J
Module 11
IN POSITION
Channel 2
26

27 G4C3 SOL
G4C3 SOL GATE4J
28 ModUle (I CONVEYORJ
Channel J SOLENOID
29 G4B2SOL
G482 SOL OATEN
30 Module II BUNKER 2
Channel 4 SOLENOID

Figure 2.39. PLC input and output wiring for Gate 4 control.

2.9 CHAPTER SUMMARY

This chapter introduced the basics of PLC ladder logic: the contacts, coils, and their
assemblage-into a ladder logic program. The process of scanning a program and the use of the
NC contact received special attention. For those interested, the chapter concludes with more
information on the relay to PLC ladder logic conversion. For the most part, this chapter has
used the IEC 61131-3 ladder logic language to take a generic approach to ladder logic and
 REFERENCES 65

G4_JOG G4 C3 SEL ESOl G4SSR G4CJR GCJRR

-~; G4_CJ~1
I II H (
G4_RE..\f
I I

2
G4_JOG
I
G4 REM
I
-I;If
G4 82 SEL

I
ESOl

G4_B2~1
G45SR
II
G482R
if
GB2RR
(

G4_REM G4RSR
J I (
G4SS G4SSR
• I (
G4B2
S I

G4CJ
6 I---Ifl-- - - - - - - - - - - - - - - - - - ,

GCJRR G4C3 SOL

7 f-----lf-I- - - - - - - - - - - - - - - < C
GB2RR G4B2 SOL
8 I------if-I- - - - - - - - - - - - - - - - < C

Figure 2.40. PLC ladder logic exactly translated.

G4_JOG G4 C3 SEL ESOl G4SS G4CJ G4C3_SOL

G4JlEM -~~ G4-0dJ'

I II Jf (

I II I
04_100 G4 82 SEL ESR2 G4SS G4B2 G4B2_SOL

-~;
2 I II H (
G4_REM G4-B2dJl
I I
G4B2 G4B2]L
J I (
G4CJ G4CJJL
• I (

Figure 2.41. Simplified PLC ladder logic for Gate 4 control.

avoided treating the memory addressing details specific to each PLC vendor or PLC model.
This topic cannot be ignored any further and is the subject of the next chapter, before timer'
and counter instructions are examined.

REFERENCES
GE Fanuc Automation, 1999. Series 90™_30/20/Micro PLC CPU Instruction Set:
Reference Manual, pub. GFK-0467L, GE Fanuc Automation North America, Inc.,
Charlottesville, VA.
66 Basic Ladder Logic Programming

GE Fanuc Automation, 2000. Series 90™_70 PLC CPU Instruction Set: Reference
Manual, pub. GFK-0265J, GE Fanuc Automation North America, Inc., Charlottesville,
VA.
IEC, 1993. IEC 1131-3: Programmable Logic Controllers - Part 3: Programming
Languages, International Electrotechnical Commission, Geneva, Switzerland.
Rockwell Automation, 1998a. PLC-5 Family Instruction Set Reference Manual, pub.
1785-6.1, Rockwell Automation, Milwaukee, WI.
Rockwell Automation, 1998b. SLC Modular Processors Instruction Set Reference
Manual, pub. 1747-6.15, Rockwell Automation, Milwaukee, WI.
Rockwell Automation, 2002. Logix5000™ Controllers General Instructions, pub.
1756-RM003F-EN-P, Rockwell Automation, Milwaukee, WI, May.
Schneider Automation, 1998. Concept User Manual, vol. I, ver. 2.1, pub. 840 USE461
00, Schneider Automation, Inc., North Andover, MA.
Siemens, 2000. S7-200 Programmable Controller: System Manual, pub.
A5E00066097-02, Siemens AG, Nuernberg, Germany.
Siemens, 2002a. Ladder Logic (LAD) for S7-300 and S7-400 Programming: Reference-
Manual, Edition 1112002, pub. A5EOO 171231-0 I, Siemens AG, Nuernberg, Germany.
Siemens, 2002b. System Software for S7-300/400 System and Standard Functions:
Reference Manual, Edition 12/2002, pub. A5EOOI71234-01, Siemens AG, Nuernberg,
Germany.
 PROBLEMS 67

PROBLEMS
P2-1. Implement the digital logic diagram in Figure P2.1 in PLC ladder logic. The symbols
starting with "In" are physical inputs. Do not use any internal coils. The equations of the
outputs are:
Dutl = Inl + In2 + In3
Qut2= Dutl- In4- InS
Outl
Inl - - {
In2 - - - i
In3--L__ In4 Qut2
In5
Figure P2.t. Digital logic for exercise P2-3.

P2-2. Implement the digital logic gate circuit in Figure P2.2 in PLC ladder logic. The
symbols starting with "In" are physical inputs. You may use a maximum of one internal
coil.

In2
In3
Inl In4 In5--{] }-.J..- Out!
In6 ---L_/
Figure P2.2. Digital logic for exercise P2-4.

P2-3. Implement the digital logic gate circuit in Figure P2.3 in PLC ladder logic. The
symbols starting with "In" are physical inputs. Do not use any internal coils.

Out!

Figure P2.3. Digital logic for exercise P2-5.

P2-4. Implement the digital logic gate circuit in Figure P2.4 in PLC ladder logic. The
symbols starting with "In" are physical inputs. Use a maximum of one internal coil. Note
that the rightmost gate is an exclusive-or gate.
68 Basic Ladder Logic Programming

Inl
Outl
L..-_ _ InS

Figure P2.4. Digital logic for exercise P2-6.

P2-5. Draw the timing diagram for the ladder logic diagram in Figure P2.5a. A chart is
provided in Figure P2.5b. Assume the external input is read at the beginning'of a scan and
any change in the external input has no effect until the start of the next scan. The only
external input is PBI, a normally open. pushbutton switch. Inti, Int2, and Int3 are internal
coils. The timing of PB I is shown in Figure P2.5b.
On the chart, the widely spaced dashed vertical lines indicate the start of the processor
scans. The solid line indicates the state of the physical input or output at the module
terminal. Use dashed lines to indicate the state of the PLC irnage or internal memory.
Assume everything starts off (a value of 0). The on state is indicated by a value of I.

P2-6. Draw the timing diagram for the ladder logic diagram in Figure P2.6a. A chart is
provided in Figure P2.6b. Assume the external input is read at the beginning of a scan and
any change in the external input has no effect until the start of the next scan. The only
external input is PB I, a normally open pushbutton switch. Inti, Int2, and Int3 are internal
coils. The timing of PB I is shown in Figure P2.6b.
On the chart, the widely spaced dashed vertical lines indicate the start of the processor
scans. The solid line indicates the state of the physical input or output at the module
terminal. Use dashed lines to indicate the state of the PLC image or internal memory.
Assume everythirig starts off (a value of 0). The on state is indicated by a value of I.

P2-7. Draw the timing diagram for the ladder logic diagram in Figure P2.7a. A chart is
provided in Figure P2.7b. Assume the external input is read at the beginning of a scan and
any change in the external input has no effect until the start of the next scan. The only
external input is PBl, a normally open pushbutton switch. Inti, Int2, and Int3 are internal
coils. The timing ofPBI is shown in Figure P2.7b.
On the chart, the widely spaced dashed vertical lines indicate the start of the processor
scans. The solid line indicates the state of the physical input or output at the module
terminal. Use dashed lines to indicate the state of the PLC image or internal memory.
Assume everything starts off (a value of 0). The on state is indicated by a value of I.
 PROBLEMS 69

(b)
Figure P2.S. Ladder logic and timing diagram for exercise P2-5: (a) ladder logic; (b)timing
diagram.
70 Basic Ladder Logic Programming

PBI Int2 Int3 Inti

I 1---.-11 1------,,....-----1/ I-~(
Inti

PBI Int3 Int2

2 ~-r-------1/I-~(
Int2

PB I Inti Int3 Int3

3 1--1 I~-I/I-~(
(a)

Scan
Number I 2 4 6 8 10 12 14

I
PBI
o--..J

I
Inti
0--

I
Int2
0--

I
Int3
0--
--------I~~ Time

At I/O Terminal - - - - In PLC Memory --------

(b)
Figure P2.6. Ladder logic and timing diagram for exercise P2-6: (a) ladder logic;
(b) timing diagram.
 PROBLEMS 71

PBl Int2 Int3 Inti

1 :pl II I I (
PBl Int2 Int3 lnll Int2
2 :p.' I/J I II (
Int2
I
I

PBl Int2 Int3 lnll Int3

3 :p! III II II (
Int3
I
I

(a)

Scan
Number 1 2 4 6 8 10 12 14

l~,
PBl
o
, ,

. : L
1
Inti
0-- :

1
Int2
0·· :

1
Int3
0-- , I

- - - - - -•• Time

At I/O Terminal - - - - In PLC Memory --------

(b)
Figure P2.7. Ladder logic and timing diagram for exercise P2-7: (a) ladder logic; (b)timing
diagram.
72 Basic Ladder Logic Programming

P2-8. Use ladder logic to implement a simple high level indicator and alarm for a tarue
A panel implements a simple interface showing the tank level. The panel has
three lamps: green, yellow, and red. The panel also has an alarm hom and an alarm
acknowledge button that turns off the alarm hom. No more than one light is on at
any time:
Green lamp on when 5 inches ::; tank level < 50 inches
Yellow lamp on when 50 inches::; tank level < 60 inches
Red lamp on when 60 inches::; tank level
In addition, when the level is greater than or equal to 60 inches, the alarm hom
is turned on, and remains on until the level becomes less than 60 inches and the
alarm acknowledge (ALM_ACK]B) button is pressed. Ifthe level is greater than
or equal to 60 inches, pressing the alarm acknowledge button should not silence
the alarm hom, even momentarily.
There are 3 level sensors, each corresponding to one of the "boundary" levels
listed above:
LS-l is on when the tank level ~ 5 inches
LS-2 is on when the tank level ~ 50 inches
LS-3 is on when the tank level ~ 60 inches
Assume the following physical inputs and outputs. Only symbols are used to avoid any
PLC-specific addressing. DO NOT assign any more inputs!!
Physical Inputs:
Symbol (Tag) Description
ALM ACK PB Alarm acknowledge pushbutton switch, N. 0., on when
acknowledging (resetting) alarm hom
LS-I On when the tank level ~ 5 inches
LS-2 On when the tank level ~ 50 inches
LS-3 On when the tank level ~ 60 inches
Physical Outputs:
Symbol (Tag) Description
GRN LA On to light green indicator lamp
YEL LA On to light yellow indicator lamp
RED LA On to light red indicator lamp
ALARM On to sound alarm hom

P2-9. Use ladder logic to implement a simple low level indicator and alarm for a tank.
A panel implements a simple interface showing the tank level. The panel has
three lamps: green, yellow, and red. The panel also has an alarm hom and an alarm
acknowledge button that turns off the alarm hom. No more than one light is on at
any time:
Green lamp on when 7 inches ::; tank level < 50 inches
Yellow lamp on when 5 inches::; tank level < 7 inches
 PROBLEMS 73

Red lamp on when tank level < 5 inches

In addition, when the level is less than 5 inches, the alann hom is turned on, and
remains on until the level becomes greater than or equal to 5 inches and the alann
acknowledge (ALM_ACK]B) button is pressed. If the level is less than 5 inches,
pressing the alann acknowledge button should not silence the alann hom, even
momentarily.
There are 3 level sensors, each corresponding to one of the "boundary" levels
listed above:
LS-l is on when the tank level ~ 5 inches
LS-2 is on when the tank level ~ 7 inches
LS-3 is on when the tank level ~ 50 inches
Assume the following physical inputs and outputs. Only symbols are used to avoid any
PLC-specific addressing. DO NOT assign any more inputs!!
Physical Inputs:
Symbol (Tag) Description
ALM_ACK.-PB Alarm acknowledge pushbutton switch, N. 0., on when
acknowledging (resetting) alarm hom
LS-l On when the tank level ~ 5 inches
LS-2 On when the tank level ~ 7 inches
LS-3 On when the tank level ~ 50 inches
Physical Outputs:
Symbol (Tag) Description
GRN LA On to light green indicator lamp
YEL LA On to light yellow indicator lamp
RED_LA On to light red indicator lamp
ALARM On to sound alarm· hom

P2-10. Use ladder logic to implement afirstfailure annunciator for the tank shown in
Figure P2.1O. .
A first failure annunciator is a circuit that informs system operators which
input device(s) gave a warning signal that resulted in the alann. The tank has 3
monitoring devices: liquid level, pressure, and temperature. If an unsafe condition
should occur, certain combinations of these devices should cause an alarm. The
three conditions that are considered to be unsafe and thus activate an alarm are:
High level with high temperature
High level with high pressure
High level with high temperature and high pressure
In addition, once the alarm occurs, lights will indicate the condition(s) that
cause the alarm to sound. Once an alarm condition is detected, the alarm sounds
until the ALM_ACK]B button is pressed (and the condition that caused the
alarm must also return to nonnal). Also, when the alarm is acknowledged (and the
condition that caused the alann returns to nonnal), any lights that are on should be
74 Basic Ladder Logic Programming

Pressure
detector

Level
detector

Temperature
detector

Figure P2.10. Tank sensors for problem P2-12.

turned off. The ALM_ACK]B should not turn off any lights for an alarm
condition if the condition still persists. For example, if a high level and high
pressure triggered the alarm, the lights should remain on if the level and pressure
are high when the ALM_ACK]B is pressed.
The three monitoring devices produce an on signal when the physical quantity
is in the high state and an off signal when the physical quantity is in the low
(normal) state.
Only when the alarm sounds does the ladder logic turn on any of the three
lights that indicate the problem that caused the alarm. For example, the
HIGH- LEVEL- LA is off when the high level detect input is on and the alarm is
off (because a high level, by itself, does not trigger an alarm).
Assume the following physical inputs and outputs. Only symbols are used to avoid any
PLC-specific addressing. DO NOT assign any more inputs!!
Physical Inputs:
Symbol crag) Description
ALM ACK PB Alarm acknowledge pushbutton switch, N. 0., on when
acknowledging (resetting) alarrn hom
LVL_HIGH_SENS On when high level is detected
PRS_HIGH_SENS On when high pressure is detected
TMP_HIGH_SENS On when high temperature is detected
Physical Outputs:
Symbol crag) Description
ALARM On to sound alarm
LEVEL_LA On when high level is one of conditions that triggered alarm
PRESS_LA On when high pressure is one ofconditions that triggered alarm
TEMPER_LA On when high temperature is one of conditions that triggered
alarm

P2-11. Design a ladder logic program to provide the intrusion interlock for a machine work
cell shown in Figure P2.lla.
 PROBLEMS 75

Light Curtain B

r-----;~;~--------2
.i
Light . ..." ,., Light
Curtain Ti . , Curtain
A ~ ,....."'":'-.- - , t C

C<jnveyor Con-teyor
~ Pick-un. • • • •
_ -......;.. CNC CNC· ••••• _ Drop-off :
..'~
pOInt L- Machine .J L _
Machine
_---J • " 'point :. ---I~~
1...-_+----
~ ~ ~
Light Curtain D

Ca)
................... ~ .
................... ~ .
... ~ .
................... ~ .
................... ~ .
................... ~ .
................... ~ ..
................... ~ .
................... ~ ..
................... ~ ..
................... ~ ..
................... ~ .
................... ~ ..
................... ~ .
................... ~ .
................... ~ .
Sender Receiver

(b)

Figure P2.11. Work cell: (a) boundaries; (b) light curtain.

The work cell is bounded by an array of four light curtains to detect the
presence of people or objects entering the work area. When any light curtain
sensor is tripped, the motion of all machines in the work cell must stop and an
alarm must be sounded. This action ensures that no injury or damage to the
"intruder" occurs. To allow the process to continue all sensors must signal "no
intrusion" and a reset button must be pressed.
A light curtain sensor detects the presence of an intruder by using a series of
light beams (Figure P2.ll b) where any broken beam = intrusion. The sensors are
self-diagnosing and detect when they are not functioning properly. Therefore, the
process must be halted whenever any light curtain malfunctions or when any light
curtain senses an intrusion. Design the PLC control program so that the machines
will be halted if any light curtain malfunctions or senses an "intrusion".
The machine start and stop push buttons are used to start and stop the work
cell operation. If an intrusion or curtain malfunction occurs, the machine is
76 Basic Ladder Logic Programming

stopped and cannot be restarted until the reset button is pressed. The start button
does need to be pressed for the machine to restart after an intrusion alarm has been
reset. The reset button should have no effect if the intrusion or curtain is still
occumng.
Assume the following physical I/O and internal coils. Only symbols are used to avoid
any PLC-specific addressing. DO OT assign any more inpua!!
Physical Inputs:
Symbol (Tag) Description
START PB Start NO pushbutton, on when starting
STOP]B Stop NC pushbutton, 01I when stopping
ALM- RST- PB Alarm reset pushbutton switch, N. 0., on when resetting alarm
hom
CUR_OK_A On when light curtain A is functioning properly
CUR- !NT- A 01I when light curtain A senses intrusion
CUR OK B On when light curtain B is functioning properly
CUR- !NT- B 01I when light curtain B senses intrusion
CUR OK C On when light curtain C is functioning properly
CUR- !NT- C 01I when light curtain C senses intrusion
CUR OK D On when light curtain D is functioning properly
CUR- !NT- D 01I when light curtain D senses intrusion
Physical Outputs:
Symbol (Tag) Description
ALARM On to sound alarm when any curtain fails or any curtain detects
intrusion
PLC Internal Coils:
Symbol (Tag) Description .
MACHINE EN Internal coil that is on when machines can operate. This coil is to
be controlled by your ladder logic. It is used by other parts
of the ladder logic.
3 Memory Organization and Addressing

Chapter Topics:

• PLC memory organization

• PLC memory addressing

OBJECTIVES

Upon completion of this chapter, you will be able to understand how the memory is
organized and addressed for the following PLCs:

• IEC6l131-3
• Modicon QuantumlMomentlim
• Allen-Bradley ControlLogix
• Allen-Bradley PLC-5/SLC-500
• Siemens S7
• GEFanuc

Scenario: Every control engineer's nightmare.

The phone call came at 2 a.m. The shift supervisor is on the line. "We're having trouble
with the A2438 agitator. It keeps faulting out. The maintenance electrician has traced it to a
faulty vibration sensor. It is occasionally turning on, even when there isn't any noticeable
vibration, causing the batch procedure to go to hold. This problem started occurring this
afternoon, but now it seems to happen every 10 minutes. We do not have a spare sensor in
stock. The earliest we can get one is in two days." You then remember the particular batch
system was recently commissioned and the contractor who installed it left a week ago. The
operator breaks into your thoughts. "Is there anything you can do in the PLC? I don't have a
spare operator who can restart the batch procedure every 10 minutes." In your half-awake
state you cannot recall exactly what the supervisor says next. Something about losing
SIO,OOO if the batch procedure does not run to completion in 3 hours. You mumble'
something in reply and then hang up the phone to hurriedly dress and drive to the plant.
While driving to the plant, you think of some possible temporary solutions. You could
force the vibration sensor discrete input off, but then if a vibration is truly occurring
equipment could be damaged, forcing costly downtime and repairs. The best solution would
be to add a 2-second time delay to the sensor signal. The vibration sensor signal would have
to remain on for 2 seconds before it would cause a fault and put the batch procedure in hold.

77
78 Memory Organization and Addressing

"At least it's a PLC-5," you think to yourself. "I can make online changes to the ladder logic
while the PLC is in run mode." When you arrive at the control room, you discuss these
solutions with the shift supervisor and he okays the additional delay on the sensor. "The
contractor should have added this delay for the sensor anyway," you add. The supervisor
agrees.
With the engineering workstation you connect to the PLC and find the discrete input
address. You check the cross-reference and find that the discrete input is used in only two
places in the program. "This will be easy," you think to yourself. "I need to find a spare
timer, replace the references to the sensor with the timer done bit, drive the timer with the
sensor, and I can go home."
When you check the data files, the only file of timers is the default, T4. You check the
usage table and discover that every timer is being used. There are no spare timers. You must
put the PLC in program mode in order to expand the timer data file. However, the plant rules
dictate that you obtain the shift supervisor's permission since operations could be disrupted
when the PLC is put in program mode. When you ask the supervisor for permission to take
the PLC to program mode for I minute in order to add a few timers, he asks, "Will it turn
anything off?" "I don't know," you reply. "It depends on the jumper position on the discrete
output modules." The supervisor responds, "Then you may not. The PLC also controls your
steam generator unit. If the PLC causes the steam generator to shut down, it takes a
minimum of an hour to get it back on-line and so your batch will certainly be ruined." You
sigh, tell him that you will force the vibration sensor off and request a radio so that you can
inform the operator if the agitator starts vibrating. You get a radio and a chair and post
yourself by the agitator, ready to radio the control room if a vibration occurs. It is a long
night.
Solution: The programmer should have left spare timers in the data files to handle these
situations. As a rule, one should ALWAYS put spare timers, counters, internal coils, and so
on, to allow code corrections without requiring the PLC to be taken out of run mode. In this
situation, there was another mistake made by the programmer who originally programmed
the PLC. Every sensor that can cause a fault should be delayed in the PLC. In other words,
the sensor signal should persist for at least a second 'before the PLC turns on an alarm and
causes some other action. Frequently, fault sensors are plagued with intermittent false
readings. The addition of the timer will prevent false alarms.

3.1 INTRODUCTION
This chapter summarizes the organization and addressing of the memory for the PLCs
covered by this text. Each of the sections is written as stand-alone. That is, only the
section(s) pertaining to the PLC(s) of interest need to be studied. Since the Modicon
QuantwnlMomenturn and the Allen-Bradley ControlLogix PLCs are IEC-compliant, the
IEC 61131-3 memory model is introduced. Since IEC 61131-3 is a voluntary standard, only
the overall memory and program model is described and the details are described within the
Modicon and Allen-Bradley implementations of the standard.

3.2 IEC 61131-3 MEMORY MODEL

The IEC 61131-3 standard defines a memory and program model that is very much like
modern software engineering concepts. This model incorporates such features as top-down
 3.2 IEC 61131-3 MEMORY MODEL 79

design, structured programming, hierarchical organization, formal software interfaoes, and

program encapsulation. If fully implemented, the model is reasonably complicated.
Currently, no one has fully implemented the model. The downside of the model is that it is
reasonably complicated and is not fully appreciated by the novice programmer. One of the
reasons that PLCs have become well established is because of their simplicity. One does not
require extensive training in software engineering techniques in order to become a
proficient programmer.
Since IEC 61131-3 is a voluntary standard that no vendor implements entirely, only the
overall memory and program model is described. The details are described within the
various implementations of the standard.
The lEC 61131-3 memory model (what the standard calls the software model) is
presented in Figure 3.1. The model is layered; that is, each layer hides many of the features
of the layers beneath. Each of the main elements is now described.
The configuration is the entire body of software (program and data) that corresponds
to a PLC system. Generally, a configuration equates with the program and data for one PLC.
In large complex systems that require multiple cooperating PLCs, each PLC has a separate
configuration. Unfortunatel):', the choice of the term configuration conflicts with the
historic use of this term in the controls industry. Generally, configuration refers to the
process of specifying items such as the PLC processor model, communication interfaces,
remote vaconnections, memory allocation, and so on. Therefore, the vendors producing

Configuration
~
Resource Resource ,

I II I
Task Task ~

/- '\
Program Program . Program Program

~. B
Func- Func-
tion tion
Block Block
.
• Func-
•
•
• Block
•- ...
tion
··•
·· ·•• ~: ··· ..
.. . ·
··
..··
It£ll~brl' I~11~~1 I IGIb~r-···
I:cl ·
·
..• .., ..• ..
•
Global and directly represented variables

Access Paths

Figure 3.1. mc 61131-3 memory model.

80 Memory Organization and Addressing

IEC-compliant PLCs that use the term configuration in the historic sense refer to the entire
body of software with some other term.
A resource provides the support functions for the execution of programs. A
configuration is composed of one or more resources. Normally a resource exists within a
PLC, but it may exist within a personal computer to support program testing. One of the
main functions of a resource is to provide an interface between a program and the physical
I/O of the PLC.
A program generally consists of an interconnection offunction blocks, each of which
may be written in any of the IEC languages. A function block or program is also called a
program organization unit (POU). In addition to the function blocks, the program contains
declarations of physical inputs/outputs and any variables local to the program. A program
can read and write to I/O channels, global variables, and communicate with other programs.
A mechanism called access paths provides the means to transfer information between
configurations. Tasks control the execution of the program or parts of a program.
A task is set up to control one or more programs and/or function blocks to execute
periodically or to execute upon the occurrence of a specified trigger. The execution of a
program implies that all of the function blocks in the program are processed once. The
execution of a function block implies that all of the software elements of the function block
are processed once. There are no implied mechanisms for program execution. In order for a
program to be executed, it must be assigned to a task and the task must be configured to
execute periodically or with a trigger.
Variables are declared within the different software elements of the model. A local
variable is defined at the software element and can only be accessed by the software
element. Local variables can be defined for the function block, program, resource, or
configuration. A global variable defined for a configuration, resource, or program is
accessible to all elements contained in it. For example, a global configuration variable is
accessible to all software elements in the configuration. A global program variable is
accessible to all function blocks in the program.
Directly represented variables are memory and I/O locations in the PLC. IEC
61131-3 defines formats for references to such data, for example %IX2I, %04, and
%MW24. However, many implementers of the standard use their own formats, which are
not consistent with the IEC standard.

3.3 MODICON QUANTUMIMOMENTUM MEMORY

3.3.1 Memory organization

The Modicon Quantum and Momentum processors are programmed with the Concept
programming software. Newer Quantum processors are programmed with the Unity
software. This text uses the Concept software. Processor memory is organized as shown in
Figure 3.2. Like IEC 61131-3 the model is layered; that is, each layer hides many of the
features of the layers beneath. However, it is somewhat simpler than IEC 61131-3. Each of
the main elements is now described.
The project is the entire body of software (program and data) that corresponds to one
PLC. The project corresponds to the combination of the configuration, resource and
program of IEC 61131-3. Basically, Concept only supports one single cyclically running
program inside one single resource inside the configuration.
 3.3 MOmCON QUANTUMIMOMENTUM MEMORY 81

'Project ~

Program Icon~tionl
Section State RAM
Group ISection I "

ISection I ISection I ...... 1 I/O I Global

ISection I Located Program
Variables
.~ """hi.
ISection I Section I'
..... ~ Unl~ated
Group FB
I· ~ Vanlibles I
~ FBLocai
I
,I : ........,

. 'Variables

Figure 3.2. Modicon QuanturnlMomentum memory model.

In Concept, the configuration data contains such items as the PLC processor model,
I/O map, communication interfaces, remote I/O connections, and data memory allocation.
Configuration data is not accessible to the program.
A program generally consists of sections, each of which may be written in anyone of
the following languages:
Ladder Diagram (LD)
Sequential Function Chart (SFC)
Function Block Diagram (FBD)
Structured Text (ST)
Instruction List (lL)
984 Ladder Logic (LL984)
Note that the LL984 section allows legacy software to be incorporated into the new
processors. Pre-Quantum processors (e.g., 984, 884, 584) can only be programmed in
ladder logic that is not necessarily backward compatible among the models. The
Momentum processors do not allow 984 ladder logic to co-exist with the other IEC
languages. The processor can be configured to execute 984 ladder logic sections or to
execute IEC sections, but not both.
Sections can be combined into a section group. All sections of a program can read and
write to the state RAM (which includes I/O) and communicate with other programs.
Communication-related function blocks provide the means to transfer data (state RAM) .
between PLCs. A section or section group is roughly equivalent to the IEC function block.
The state RAM is the location for all directly represented variables. The state RAM is
formatted like the 984 (and previous Modicon PLCs) and its specific structure and format of
the addresses are shown later in this book section. A LL984 section can only access state
RAM. Any program located variables are mapped to locations in the state RAM that
82 Memory Organization and Addressing

includes any I/O and data that is externally transmitted or received. An unlocated variable
is any variable not mapped to a location in state RAM.
All program variables are global variables and any program section can access them.
A program section cannot have local variables. Local variables are permitted only in
function blocks. Users can program function bloc.ks (called Derived Function Blocks,
DFBs) in any of the IEC languages. The DFBs and the function blocks provided by
Modicon are allowed to have local variables.

3.3.2 Program scan

There are no tasks, as in lEC 61131-3, that control program execution. The user can
control execution by setting the order of section (and section group) execution and specific
sections can have their execution disabled. The sections are normally enabled, but each
section has a boolean variable that when set to on, disables execution for that section. Any
programmatic logic that controls the section execution must be in a section that is executed
before the section being controlled.
Pictorially, a QuantumlMomentum program is executed as shown in Figure 3.3. The
execution is basically the same as introduced in Chapter 2. The physical inputs are read, the
program is scanned, and the physical outputs are written. Within the program, any LL984
sections are scanned first and scanned in the manner that the 984 PLC scans its program.
The LL984 section is organized into segments; each local or remote I/O network is assigned

Start

.1
Segment 1

".
Read input signals
into State RAM
Write
drop 2
outputs

1 Read
Execute LL984 drop 2
sectibns as specified inputs
by Segment Scheduler

1
Execute lEC sections
Read
as specified in drop 1
"Section Execution inputs
Order"

1
Write State RAM
to output modules

I
Figure 3.3. Modicon QuantumlMomentum program scan.
 3.3 MODICON QUANTUMIMOMENTUM MEMORY 83

a segment. Each segment consists of ladder logic networks where each network' has a
maximum of7 rows and II columns. Within a segment, the networks are examined from
first to last. Within a network, the ladder logic is scanned by columns (section 2.5.2). At the
start of a segment scan, the physical outputs from the previously executed segment are
written, and at the end of a segment scan, the physical inputs for the next segment are read.
After any LL984 sections are scanned, then the other sections (and section groups) are
scanned in the specified order.

3.3.3 Variables and data types

The symbolic name (identifier) of a variable can be any string of letters, digits, and
underlines up to 32 characters long provided that:
1. The first character is not a digit.
2. There are not two or more consecutive underlines.
These rules comply with the IEC 61131-3 naming convention. However, Modicon
does allow the first rule to be relaxed by specifying that identifiers can have leading digits in
the IEC extensions part ofthe options menu. The symbolic name must be unique throughout
the entire project; there is no distinction between upper and lower case. A symbolic name
must exist only once as a variable, step name or instance name.
When a variable is declared, it must be assigned a data type. The elementary data
types are as follows:
Name Description Range of values
BaaL I-bit Boolean O=cleared, I=set
BYTE 8-bit 0 to FF hexadecimal
WORD 16-bit 0 to FFFF hexadecimal
INT 2-byte integer -32,768 to 32,767
DINT 2-byte integer 0 to 65,535
31 31
DINT 4-byte integer _2 to 2 . _1 (-2,147,483,648 to 2,147,483,647)
32
UDINT 4-byte integer 0 to 2 _1
38
REAL 4-byte float. pt. ±8.43xI0 37 to ±3.36xI0+
32
TIME 4-byte 0 to 2 _1 milliseconds (>49 days)
The ability to examine a bit in an integer variable is provided by a function block and only
for the BYTE and WORD data types. Though the WORD and INT data types are both 16
bits, the WORD data type is generally used for logical operations (for example, OR) and the
INT data type is used for arithmetic operations (for example, addition). .
Literals are used to directly provide values for inputs of function blocks, transition
conditions, and so on. These values cannot be overwritten by the program logic. Literals are .
also used to assign a value to a constant or an initial value to a variable.
The BaaL (Boolean) data type has the literals FALSE (or 0) and TRUE (or 1). Literals
for the integer data types (including BYTE and WORD) can be expressed as an integer
literal, base 2 literal (binary), base 8 literal (octal), or base 16 (hexadecimal) literal. The
formats are as follows:
84 Memory Organization and Addressing

Literal type Examples

integer -12,0,+23,14_639
base-2 2# III (7 decimal)
2#1011_0011 (179 decimal)
base-8 8#177 (127 decimal)
8#2001 (1025 decimal)
base-16 16#FFFF (65,535 decimal)
16#AA (170 decimal)
The underline character may be inserted into numeric literals to aid readability; otherwise it
has no significance. Literals for the REAL type may be expressed as normal decimal
numbers,
5.341, +14_639.7, -0.0041
or with "E" or "e" indicating the tens' exponential value,
7.45e-12, 1.27E+4, 1.27E4.
Literals for the TIME type (called duration literals) are specified in days (D), hours (H),
minutes (M), seconds (S), and milliseconds (MS), or combinations thereof. The duration
must be identified by the prefix t#, T#, time# or TIME#. The "overflow" of the most
significant unit is allowed; e.g. the entry T#25H15M is allowed. Also, the last field of a
duration literal may be given in the decimal format. Some examples are:
T# IOMS 10 milliseconds
T#3.5s 3 seconds, 500 milliseconds
Time#18m 18 minutes
TIME#5d14h12m 5 days, 14 hours, 12 minutes
For the Quantum processors, one may define a table of ASCII messages for
communication with certain message display modules. The configuration ofthese messages
is not part of the normal variable definitions. In addition, these messages can only be
accessed in a LL984 section. .
Concept also allows one to define new data types from the elementary data types. lEC
61131-3 allows one to alias, or redefine a data type, for example, all position values could be
placed in variables whose data type called POSITION which is based on the REAL data
type. Concept does not allow this kind of derived data type. Concept allows one to define
structured data types and array data types. A structured data type is a collection of data
elements, generally with different data types (elementary data types and/or other derived
data types) framed by STRUCT and END_STRUCT. For example, one could define the
following MACHINE_INFO data type:
TYPE MACHINE INFO:
STRUCT
Serial_Num: UDINT;
Location: LOC_TYPE;
Oper_Time: TIME;
Shift]aults: UINT;
Last Fault: INT;
END_STRUCT;
END TYPE'
 3.3 MOmCON QUANTUMIMOMENTUM MEMORY 8S

If variable Mach23'·is defined as type MACHINE_INFO, then to access its serial

number, the reference is Mach23.Serial_Num. There are predefined structured data types
that are parameters for function blocks, for example, the Para_PID data type is the structure
of the parameters for the PID function block.
Array data types are defined in a similar manner, except that the keyword is ARRAY.
For example, the definition of an array of position information could be defined as
TYPE Position_Array:
ARRAY [1..20] OF REAL;
END TYPE
Only one dimension can be defined in the square brackets. To get more than one dimension,
the type ofthe array elements needs to be an array. As an example, a two-dimension array of
part position data could be defined as
TYPE Position Data:
ARRAY [1..20] OF REAL;
END TYPE
TYPE Position- Data- 2D:
ARRAY [1 ..20] OF Position_Data;
END TYPE
If the variable Part76 is defined as data type Positionpata_2D, then one element is
referenced as Part76[14][3]. It is also possible to define an array of a structured data type.
There are some predefined arrays, for example, IntArrayl2 and WordArrayl28.
In Concept, all derived data types must be defined within a *.DTY file. The Data Type
editor is used to edit and check a *.DTY file.

3.3.4 State RAM

The state RAM is the location for all I/O addresses and other directly represented
variables. The state RAM is formatted like the 984 (and previous Modicon x84 PLCs) and
its addresses are all numbers where the prefix is most important. Figure 3.4 shows the valid
nd
addresses. For example, the memory address 40202 refers to the 202 word in the 4x
register memory. An address can be referenced/displayed one of three ways:
Standard: 400010
Separator: 4:00010
Compact: 4: 10
The maximum amount of available of Ox, lx, 3x, 4x, and 6x memory depends on the
processor model. In addition, the specific amount of these memory types is part of the
project configuration. Those that are astute will notice that 2x and 5x are missing from .
Figure 3.4. The 2x memory type was used for sequencer instructions in the Modicon 484
and 884 processors. For the 884 processor, 5x memory referred to double-precision
arithmetic registers. In the 184 and 384 processors, 5x memory was privileged registers and
accessed like the 6x memory. The 2x and 5x memory types are not valid for Quantum and
Momentum processors.
When shown on a program listing, the state RAM addresses are prefixed with a "%" in
accordance with IEC 61131-3. When programmed with the graphical (LD, SFC, or FED)
86 Memory Organization and Addressing

Address Tvpe Meaning

000001 Discrete Output Drives a real output if mapped to
Ox or Internal Coil a discrete output module. Other-
Onnnnn wise, it is an internal coil
100001 Discrete Input Mapped to discrete input modules
Ix
lnnnnn
300001 Input Register Mapped to word input modules
3x (e.g., analog input, high-speed
3nnnnn counter)
400001 Output Register Drives a word output if mapped to
4x or Word Storage a word output module (e.g., analog
4nnnnn output) otherwise it is an internal word..
600001 Extended Memory Only available for PLC's with
6x Register 24-bit CPU, e.g., Quantum
6nnnnn

Figure 3.4. Modicon state RAM address types.

languages, the user can type the address with or without the "%" prefix. For the remainder
of the text the state RAM addresses are referenced in the text without the "%" prefix, but the
ladder logic listings properly show the prefix. Except for the addressing examples in this
chapter, the remainder of the text shows the symbolic representation of a variable in the
graphical listings.
The lh: memory holds the value of physical discrete outputs (Booleans). The specific
addresses are mapped to discrete output modules and this rnapping is demonstrated in the
next book section. Any Ox addresses not mapped to a discrete output module may be used as
internal coils or to locate variables (information to/from HMI or other PLCs). Note that the
leading "0" must be entered in order to be a valid Ox address. An address of "113" is
interpreted as "100013" and not as "000113."
The Ix memory holds the value of the physical discrete inputs. All of the Ix addresses
are mapped to di~crete input modules. Any Ix address not mapped to a discrete input
module is not accessible.
The 3x memory holds the values of any I/O modules that generate register or
integer-type data. For example, analog input modules and high-speed counter modules
generate register data. The actual number of 3x words and the format of the data will vary
with the specific module. All of the 3x addresses are mapped to register I/O modules. Any
3x address not mapped to a register I/O module is not accessible.
The 4x memory holds the values of any I/O modules that receive register or
integer-type data. For example, analog output modules receive register data. The actual.
number of 4x words and the format of the data will vary with the specific module. Any 4x
addresses not mapped to register I/O modules may be used to locate variables (information
to/from HMI or other PLCs) and can be any of the lEC data types. However, most current
HMI packages only recognize INT and UINT data types.
The 6x memory holds tables of integer-type data. This type of memory is only
available for certain Quantum processors and only accessible from a LL984 section. The 6x
memory is referenced only by instructions that move blocks of data between 4x and 6x
 3.3 MODICON QUANTUMlMOMENTUM MEMORY 87

memory. The 6x memory is primarily usee! to save tabular data, for example, a set ofmotion
commands to produce a part, and then copy this table to 4x memory when needed. This
method of data storage frees up 4x memory for frequently accessed data.
The structure of state RAM is shown in Figure 3.5 and it shows some of the other
information stored in state RAM. The Ox and Ix history table stores the values ofthe discrete
VO at the end of the last scan and is used to detect transitions for the transitional contacts.
The up/down counter history table stores the value of each counter count input at the end of
the last scan to detect transitions on the count input. This table is used only for LL984
sections. The counter function.blocks for the IEC sections have an internal variable to detect
these transitions. The Ox DISABLE bits are used to override the logic that drives the discrete
output or internal coil (Chapter 15). The Ix DISABLE bits are used to override the status of
the field input devices (Chapter 15).

3.3.5 I/O Addressing

For Modicon PLCs the physical VO channels are associated with a state RAM address
through the I/O map. This VO map is part of the configuration data and includes
information for the VO modules in the same chassis as the processor and for VO modules on
the remote VO network. Information exchanged on other networks (e.g., Modbus+,
Ethernet) is configured to use 3x and 4x memory only.
To illustrate the process for discrete VO, a sample hardwired circuit is shown in Figure
3.6. A Modicon PLC implementation of the previous circuit might appear as in Figure 3.7.
The switches are connected to channels I through 4 of a discrete input module and the
lights, solenoid, and motor are connected to channels I through 4 of a discrete output
module. The address ofthe input channel is shown with the contact in the ladder. Normally,
one would use located variables for the VO and the address would not appear on the listing.
However, for the purpose of this example the addresses are shown. The address %I 000 19
means the contact is controlled by (discrete input) address 100019, which is channel 3 on
the module in slot4 (where channell has been mapped to address 100017). The mapping of
the physical VO to the Ix number is specified as part of the VO map. The user specifies

Ox memory
Ix memory
3xmemory
4xmemory
6xmemory
Ox and Ix
history
UplDown counter
history (LL984 only)
Discrete DISABLE
(Ox and Ix)

Figure 3.5. Structure of Modicon state RAM.

88 Memory Organization and Addressing

120 v Com
PBI PLi
-.L
" /

PB2 PL2
-.L " /

SOLI
FSI

LSI

Figure 3.6. Sample hard-wired circuit.

which number maps to the starting number on the I/O module. The numbers are in decimal.
Similarly, address %000036 means the discrete output (coil) is channel 4 on the module in
slot 9 (where channel I has been mapped to address 000033).
When configuring the I/O Map, one specifies the type ofmodule in a slot and specifies
the starting address ofthe input reference (Ix or 3x) and/or the starting address ofthe output
reference (Or or4x). A discrete input module needs only the starting Ix address. Similarly, a

120 v Com
PBI
%100017 . %000033
-.L I

PB2
-
'"o
Cii
/

%100018 %000034 .5
-.L
" 2
oilo
/
::E
FSI %100019 %000035 ~:l 3
SOLI
0r--:.-.f
~u
LSI %100020 %000036 6'" Pump 1
4 4

~""'----"vr----/ ~~---....v,..--_-J/ ~""""'-"""v'-_..J/

Input Wiring Ladder Logic Output Wiring

Figure 3.7. Modicon PLC implementation for Figure 3.6 showing I/O addressing.
 3.3 MOmCON QUANTUMIMOMENTUM MEMORY 89

discrete output module requires only the starting Ox address. A module that has both discrete
input and discrete output channels requires a starting Ix and a starting Ox address. An analog
input module needs only the starting 3x address. An analog output module requires only the
starting 4x address. A module having both analog input and analog output channels or an
intelligent module, such as a high-speed counter or a motion module, needs a starting 3x and
a starting 4x address.
For discrete and analog modules, the address for a particular channel is related to the
channel number as:
(Address for channel #) = (Channel #) - I + (Channel I address)
Figure 3.8 illustrates the VO addressing in one chassis.
Analog VO and intelligent modules generally use more 3x and/or 4x memory than is
required for just the data. For example, the VO map for a PLC chassis could appear as
follows:

Slot Module Type In Rer. In End Out Rer. Out End

1 Power supply
2 CPU
3 32 Ch. Disc. In. 100001 100032
4 32 Ch. Disc. Out 000001 000032
5 Din/Dout 16/8 100033 100048 000033 000040
6 Ana In/Out 4/2 300001 300005 400001 400002
7 HS Ctr, 5 ch. 300006 300017 400003 400015
8 RTD in, 8 ch. 300018 300026
9 32 Ch. Disc. In. 100049 100080
10 32 Ch. Disc. Out 000041 000072
Note that the analog input module in slot 8 needs 9 words of3x memory even though there
are only 8 analog input channels. The other word contains status information about the
module channels, such as open circuit or range violation indications.

b
0"""" ~
0
~
~
'5
""
.9
'5
.9-
0
0
-""
0

.9
'5
.9-
0
0
B
'""~ ug"
~
eu B
eu
00
0 00

...
0
... ~

is
~
OJ
-<"
]
0

is -<
Module
SIllrtMrl.- 100001 000033 3‫סס‬oo9 400017
Chan.l 100001 ‫סס‬oo33 300009 400017
Chan. 2 100002 000034 300010 400018
Chan. 3 100003 000035 300011 400019
Chan. l6 100016 000048 300024 400032

Figure 3.8. Example Modicon VO addressing.

90 Memory Organization and Addressing

I I
% 002_9_3_0/<_0I00409
1
% 100216
I/I-I/f--O-
%000128

Figure 3.9. Solution to Example 3.1.

Example 3.1. Draw a Modicon ladder diagram that will cause the output, pilot light PL2, to
be on when selector switch SS I is closed, push button switch PBS is open, and limit switch
LS7 is open. Show the I/O addressing in the logic. The input/output devices are wired to the
following locations:
PL2: Output module, local rack, I/O slot 8, channel 16
channel I is output address 000113
SS 1: Input module, remote drop I, I/O slot 3, channel S
channell is input address 100289
PB5: Input module, remote drop 2, I/O slot 2, channel 9
channel I is input address 10040 I
LS7: Input module, local rack, I/O slot 6, channel 8
channell is input address 100209
Solution. First, determine the addresses of the devices. Applying the formula above,
Address for PL2 (channel 16) = 16 - I + 000113 = 000128
Address for SSI (channelS) = 5 - 1+ 100289 = 100293
Address for PB5 (channel 9) = 9 - 1 + 10040 I = 100409
Address for LS7 (channel 8) = 8 - 1 + 100209 = 100216
The ladder logic is shown in Figure 3.9. The addresses are shown above the contact and
coil symbols.

3.4 A-B CONTROLLOGIX MEMORY

3.4.1 Memory Organization

The Allen-Bradley ControlLogix PLC memory model is presented in Figure 3.10. The
model is similar in many respects to the IEC 61131-3 memory model, but is somewhat
simpler. Each of the main elements is now described.
The project is the entire body of software (program and data) that corresponds to one
PLC. The project corresponds to the combination of the configuration and resource ofIEC
61131-3. Basically, the ControlLogix PLC supports a single resource inside the
configuration.
A task is configured to control the execution of one or more programs, similar to lEG
61131-3. There is a maximum of 32 tasks. No more than one task can be continuously
executed. The other tasks are periodic, executed at a fixed time interval. Priority may be
assigned to the periodic tasks and so a periodic task may be interrupted by a higher-priority
periodic task. A task can contain up to 32 programs, executed in the specified order. Each
task also contains status information and a watchdog timer to detect if the task does not
finish execution within a specified interval.
 3.4 A-B CONTROLLOGIX MEMORY 91

Project

Task I
I Program32
I config·1
EJ
I Program
Program I

Main
Program
(local) Tags I Status ~,
EJ
•
•
Routine "

IWatchdogl
Fault
Routine I Other
Routines
.l'J _IF
f-

.. A
. ''; !Ii! .
A

• S;ystem-sbared
I/O Data
, Data

I Controller Fault Handler I Power Up Handler

Figure 3.10. ControlLogix memory model.

A program consists of routines, The main routine, called "MainRoutine" is always

executed first and must call the other routines (with a Jump to Subroutine instruction). The
"FaultRoutine" is executed if a program fault is encountered when executing any of the
routines in the program. Currently, the main' and fault routines must be written in ladder
logic. The other routines may be written in either ladder logic, function block diagram,
sequential function chart, or structured text. Each routine can be coded in a single
progranuning language. Each program has an area of local memory called program tags.
Only the program for which they are defmed can access program tags. Every routine in the
program can access the program tags.
The controller tags are the global controller memory. The I/O data is considered part
of the controller tags,

3.4.2 Program scan

In the ControlLogix PLC, the program execution is not coordinated with the scan ofthe '
I/O modules, as described in section 2.5. The programs in the continuous task are
continuously scanned and data is transferred to/from the I/O modules any time during the
logic scan. In order to duplicate the historic PLC scan process, a copy of the input data must
be made at the beginning of the first program and used throughout the scan. Additionally,
any writes to physical outputs are made to a copy of the output data and the copy is
transferred to the physical outputs at the end of the scan. These two changes ensure the input
92 Memory Organization and Addressing

data remains constant throughout a program scan and that the physical outputs are updated
nearly simultaneously.
The ControlLogix PLC uses a producer/consumer model ofI/O updates. Input modules
produce data. Output modules, controllers, and intelligent modules produce and consume
data. In this model, the transfer of information between I/O modules and the processor(s) is
not coordinated with program execution. A discrete input in the local chassis (same chassis
as processor) is sent whenever it changes, called change-of-state (COS). Discrete outputs in
the local chassis are set/cleared whenever set/cleared by the program. Analog input/output
modules in the local chassis send/receive their information at a fixed rate, called the real
time sample (RTS) period. For I/O modules in a remote chassis, I/O data is sent/received at
the requested packet interval (RPI).

3.4.3 Tags and data types

In the ControlLogix PLC, the tag is the same as the IEC 61131-3 identifier and the
Modicon variable. The symbolic name of a tag can be any string of letters, digits, and
underlines up to 40 characters long provided that:
I. The first character is not a digit.
2. There are not two or more consecutive underlines.
3. The last character is not an underline.
These rules comply with the IEC 61131-3 naming convention. In accordance with IEC,
there is no distinction between upper and lower case characters. Ifa particular tag is defined
as a program tag and a controller tag, the program uses the program tag, and not the
controller tag. In order to avoid potential problems, there should not be a controller tag with
the same name as any program tag.
When a tag is declared, it must be assigned a data type. The simple data types are as
follows:

Name Description Range of values

BOOL I-bit Boolean O=cleared, I=set
SINT l-byte integer -128 to 127
INT 2-byte integer -32,768 to 32,767
31 31
DINT 4-byte integer _2 to 2 _1 (-2,147,483,648 to 2,147,483,647)
REAL 4-byte float. pt. 8.43x10 37 to 3J6x10+38
To identify a bit in an integer tag use "." between the tag name and the bit number, for
example,
"MyInt.2" identifies bit 2 in "MyInt"(MyInt can be SINT, INT, DINT)
Some useful predefined controller tags that represent control status information are:
S:FS First scan of program
S:C Carry
S:N Negative sign
S:V Overflow
S:Z Zero
 3.4 A-B CONTROLLOGIX MEMORY 93

Literals are used to directly provide values for inputs 'of function blocks, transition
conditions, and so on. These values cannot be ovetwritten by the probam logic. Literals are
also used to assign a value to a constant or an initial value to a variable.
The BOOL (Boolean) data type has the literals 0 and I. Literals for the integer data
types can be expressed as an integer literal, base 2 literal (binary), base 8 literal (octal), or
base 16 (hexadecimal) literal. The formats are as follows:
Literal type Examples
integer -12,0, +23, 14_639
base-2 2#111 (7 decimal)
2#1011_0011 (179 decimal)
base-8 8#177 (127 decimal)
8#2001 (1025 decimal)
base-16 16#FFFF (65,535 decimal)
16#AA (170 decimal)
The underline character may be inserted into numeric literals to aid readability; otherwise it
has no significance. Literals for the REAL type may be expressed as normal decimal
numbers,
5.341, +14_639.7, -0.0041
or with "En or "en indicating the tens' exponential value,
7.45e-12, 1.27E+4, 1.27E4.
One can define new data types from the simple data types. IEC 61131-3 allows one to
alias, or redefine a data type, for example, all position values could be placed in variables
whose data type called POSmON which is based on the REAL data type. This kind of
derived data type is allowed in the ControlLogix PLC. In addition, one can define structured
data types and array data types. A structured data type is generally a collection of data
elements. Some of the more common predefined structured data types are the following:
Data Type Use
AXIS axis in motion instructions
CONTROL" bit shift, sequencer, array (file) instructions
COUNTER counter instructions
MESSAGE MSG instruction
MOTION_GROUP one per controller (if doing motion)
MOTION_INSTRUCTION motion instructions
PID PID instruction
TIMER timer instructions
The CONTROL, COUNTER and TIMER data types are constructed from 3 DINT's and are
shown in Figure 3.11.
A user-defined data type allows one to define a new structured data type from the
elementary and complex data types. After creating the user-defined data type, one can use it
multiple times. For example, one could define the following Machine_Info data type:
94 Memory Organization and Addressing

31 30 29 28 27 26 25 24 o Individual CONTROL fields:

Name.LEN Length value
Length value (DINT) Name.POS Position value
Name.EN Enable bit
Position value (DINT) Name.DN Done bit

(a)

o Individual COUNTER fields:

Name.PRE Preset value
Preset value (DINT) Name.ACC Accumulated value
Name.CU Count-up bit
Accumulated value (DINT) Name.CD Count-down bit
Name.DN Counter-done bit
Name.OV Counter overflow bit
Name.UN Counter underflow bit
(b)

31 30 29 o Individual TIMER fields:

Name.PRE Preset value
Preset value (DINT) Name.ACC Accumulated value
Name.EN Timer-enabled bit
Accumulated value (DINT) Name.TT Timer-timing bit
Name.DN Timer-done bit
(c)

Figure 3.11. ControlLogix data type structures: (a) CONTROL; (b) COUNTER;
(c) TIMER.

Data type ~ame: MACHINE_INFO

Member Name Data Type
Serial Num
Location
Oper_Time
Shift Faults
Last Fault

Array data types are defined in a manner similar to the structured data types. Up to three
dimensions can be defined. For example,
one dimension arraLname[subscript_O]
two dimensions array_name[subscript_O, subscript_I]
three dimensions - array_name[subscript_O, subscript_I, subscript_2]
 3.4 A-B CONTROLLOGIX MEMORY 95

120 v Com
PBI
Local:4:I.Data.0 Local:9:0.Data.0
--L.. 0
[ (
PB2
v
a
r;;
-
'"
..e
en
.S Local:4:I.Data.1 Local:9:0.Data.1 .S
--L..
"
:; [ ( "
:;
"0
"0 0
0

FSI
-""'"
~
Local:4:I.Data.2 Local:9:0.Data.2
-'"
~

E-
SOLI
2
--"
c::

~
[ ( 0
.s
'"
.,OJ ~
.,U
LSI 0 Local:4:I.Data.3 Local:9:0.Data.3 0
3
[ (
,
v
, , v
, , v
,
Input Wiring Ladder Logic Output Wiring

Figure 3.12. ControlLogix. PLC implementation for Figure 3.6 showing I/O tags.

When used in instructions, the subscript can be a constant, tag, or expression (the latter 2 are
similar to PLC-5 indirect addressing). One can make arrays of structures, except for the
AXIS, MESSAGE, and MOTION_GROUP data types.

3.4.4 Input/Output Tags

For the ControlLogix PLC the physical I/O channels are addressed directly and have
pre-defined tags. There is no need to construct an I/O map, as in the Modicon PLCs. The
user does need to specify the location and type of each I/O module that will be used by the
processor.
A ControlLogix PLC implementation of the hardwired circuit of Figure 3.6 might
appear as in Figure 3.12. The switches are connected to channels 0 through 3 of a discrete
input module and the lights, solenoid, and motor are connected to channels 0 through 3 of a
discrete output module. The tag ofthe input channel is shown with the contact in the ladder.
Normally, one would define a symbolic tag that refers to the I/O tag (called an alias tag) and
the I/O tag would not appear on the listing. However, for the purpose of this example the
addresses are shown. The tag "Local:4:I.Data.2" means the contact is controlled by the
discrete input point (channel) 2, in slot 4 ofthe local chassis. In general, the tag for a discrete
input channel is
CN- Device:Chassis- Slot:I.Data.x
where CN_Device is the name ofthe chassis, which is "Local" for inputs in the same chassis
as the processor, Chassis_Slot is the chassis slot in which the module resides, and x is
replaced by the channel number. Similarly, the tag "Local:9:0.Data.3" means the output
(coil) is connected to output channel 3, in slot 9 of the local chassis. The most common I/O
tags are:
96 Memory Organization and Addressing

Local MACHINE 1 MACHINE 2

~ 0IIllffiij 0IIllffiij
~J: 110 ~

Note: Names of remote chassis set by project configuration.

Figure 3.13. Example ControlLogix system with remote chassis.

SSI PB5 LS7 PL2

I REM_I{ELDataA REM 2:I:LData.8
-----]/[----]l[--~.
REM 2:5:LData.7 Local: 7:o)ata.l31
C
Figure 3.14. Solution to Example 3.2.

Type of Channel General Tag Name

Discrete Input CN_Device: Chassis_Slot:LData.x
Discrete Output CN_Device:Chassis _Slol:O.Data.x
Analog Input CN_Device: Chassis _Sial: LChxData
Analog Output CN_Device:Chassis _SIOI:O.ChxData
where
CN_Device is the name of the chassis, which is "Local" for inputs in the same chassis
as the processor,
Chassis_Sial is the chassis slot in which the module resides, and
x is replaced by the channel number.
The chassis slots and module channels are numbered in decimal. An example ControlLogix
system with two remote chassis is shown in FigUre 3.13. Each I/O module has information
other than just the channel data (e.g., channel errors). Consult the module documentation for
information about the other pre-defined tags for that module.
Example 3.2. Draw' a ControlLogix ladder diagram that will cause the output, pilot light
PL2, to be on when selector switch SS I is closed, push button switch PB5 is open, and limit
switch LS7 is open. Show the I/O tags in the logic. The input/output devices are wired to the
following locations:
PL2: Output module, local chassis, slot 7, channel 13
SSI: Input module, chassis 'REM_I', slot 2, channel 4
PB5: Input module, chassis 'REM_2', slot I, channel 8
LS7: Input module, chassis 'REM_2', slot 5, channel 7
Solution. The tags are predefined, so there is no need to map channels to addresses. The tags
are,
PL2: Local:7:0.Data.13
SSI: REM 1:2:I.Data.4
PB5: REM 2:1:I.Data.8
LS7: REM 2:5:I.Data.7
 3.5 A-B PLC-5 AND SLC-500 MEMORY 97

The ladder logic is shown in Figure 3.14. The tags are shown above the contact and coil
instructions.

3.5 A-B PLC-5 AND SLC-500 MEMORY

The memory organization of the PLC-5 and the SLC-500 are very similar. The only
major differences are:

• different I/O addressing, and

• the SLC-500 does not support as many program and data files, and
• the SLC-500 does not support the A and D data file types.
The majority of the material is presented from the standpoint of the PLC-5 and the
limitations of the SLC-500 are mentioned in the appropriate places. The I/O addressing of
the PLC-5 and the SLC-500 are described separately.

3.5.1 Memory Organization

The memory model of the Allen-Bradley PLC-5 and SLC-500 PLC processors is
presented in Figure 3.15. The model is simpler than the lEC 61131-3 memory model, and
represents the most structured form ofpre-IEC 61131-3 PLCs. When the PLC-5 memory
model was developed and later adopted by the SLC-500, it was the most sophisticated
memory model and is suited to projects with large programs and large amounts of data.
Each of the main elements of the memory is now described.

~ject
Program Files
, p ..
Data Files
0 0(0)
1 I (1)
2 S (2)
,-
. 3 B3
4 T4 ~
5 C5
" R6

.. 1-999-J l' N7
F8

Communication ,~
/9
Channel Configura~on 1--/9-9-9-....:j
Note: For SLC processors, the last program
and data file number is 255

Figure 3.15. PLC-5/SLC-500 memory model.

 98 Memory Organization and Addressing

The project memory is divided into 4 major parts: program files, data files,
communication channel configuration, and unused memory. Technically, the project is
more than the program, data files, and configuration that reside in the PLC. The project also
includes program documentation that resides in the programming device only.
The program files contain controller information, the main program(s), and any
subroutine programs. With some restrictions, a program file can contain ladder logic, a
sequential function chart, or structured text. The purpose of the program files is as follows:
File
Number Use
o Password and program identification
I Sequential function chart, SFC (if supported by processor)
2 Main ladder logic program
3-999 Subroutine files
2-999 Ladder logic programs for SFC (if used)
The original PLC-5 processors (5/10, 5/12, 5/15, 5/25, 5NME) have only one main ladder
file and no more than one SFC (in file I). The processor starts executing the first program
file that is defined as a ladder file and ignores the other program files, unless those files are
called by ladder logic in the first ladder file (such as a subroutine call). For enhanced PLC-5
processors (5/11, 5120, 5/30 and above), one can define more than one main ladder file and
more than one SFC file. Later revisions of the enhanced processors also allow more than
1000 program files. For the SLC-500, the maximum file number is 255 and program file I
cannot be used because the SLC-500 does not support the SFC language.
The PLG-5 processors and the SLC-5102 and later processors also support the
defmition ofa selectable timed interrupt (STI) program file and a fault program file. An STI
program file is executed on a fixed periodic time interval, which should be longer than the
main program scan time. A fault program file is executed when the processor detects a
major fault. The fault file allows one to record the fault and restart the processor without
operator intervention. The number of the STI and fault file are specified as part of the status
data file. Program files 0 - 2 cannot be a STI or fault file.
The communication channel configuration contains information specific to the
processor communication channels: serial channel baud rates, remote VO addresses, and
channel protocols.
The PLC-5 can have up to 1000 data fIles (numbered 0 - 999). The address format of
these files is explained in section 3.5.3. The data files support both global and local access.
Data files 0 - 8 are always global data. Data files greater than 8 can be configured to be local
data for one program file. Also, for the PLC-5 one can assign privilege classes and use them
to restrict access to individual data files. The SLC-500 is restricted to 256 data files
(numbered 0 - 255).

3.5.2 Program scan

The program execution is basically the same as introduced in section 2.5. For the
PLC-5, the physical discrete inputs are read, the program is scanned from top to bottom, and
the physical discrete outputs are written. The PLG-5 does not address analog VO directly,
. which is explained in section 3.5.7.2. In contrast, the SLC-500 addresses analog VO directly
 3.5 A-B PLC-5 AND SLC-500 MEMORY 99

Number of File File Words per Addressed

Elements Data File Type Number Element As
Discrete
32 - 192 0 0 O:rrg/cc
Output Image
Discrete
32 - 192 Input Image I 1 1 I:rrg/cc

S:n or
32 or 128 Status S 2
S:n/m

1-1000 B 3
B3/n or
Bit 1
B3:n/m

1-1000 Timer T 4 3 T4:n

1-1000 Counter C 5 3 C5:n

1-1000 (File) Control R 6 3 R6:n

1-1000 Integer N 7 1 N7:n

1-1000 Floating Point F 8 2 F8:n

Binary Coded
1-1000 Decimal (BCD) D 9-999 1 Dx:n

ASCII
1-1000 Message A 9-999 1 Ax:n

Any Type any .

1-1000 (except 0, I, S) (not 0, I, S) 9-999 vanes

.Figure 3.16. PLC-5/SLC-500 data file organization.

and in other regards scans the program and I/O like the PLC-5. For both the PLC-5 and
SLC-500, immediate input and output instructions are supported.

3.5.3 Data files

The organization of the data files is shown in Figure 3.16. Except for the first three.
files, every data file is designated by a letter and a number. Within a project, the
letter/number combination is unique. For example, once data file 12 is designated as a timer
file (T 12), then an instruction cannot reference it as an integer file (N 12). The first three data
files are only designated by their letter (0, I, or S) since these types cannot be assigned to
any other data files.
Data files 0 - 8 are the default data files that are defined for a new project. The type for
data files 0 - 2 cannot be changed and their length depends on the processor model. It is
100 Memory Organization and Addressing

possible to redefine the ftle types for files 3 - 8, but it is not recommended since those are the
file types most people expect to find on any PLC-5. Data files 9 - 999 can be defmed as any
of the possible types and can be created as needed.
Except for the 0, I, and S files, the length of a data file can be from I to 1000 elements
(addressed as 0 - 999), subject to the available processor memory. When programming
offline, the lengths of the data files are increased as needed. For example, if the counter file
C5 contains 24 elements (last address is C5:23) and a counter instruction is programmed to
refer to C5:24, the C5 file length is increased by one. Typically, one does not size the data
files in this manner. Normally, the data files are manually created and sized before the
program is entered. After the programming is complete, the data file sizes should be
increased to accommodate online editing changes.
Data files 9-999 may be assigned any file type (except 0, I, or S), as needed by the
program. These data files are often used to organize the data files by process area or
function. For example,
Separate bitltimer/counter/integer files for each process section or machine.
Integer file for PID controller storage.
Integer file for analog input block transfers.
The format of each data file type is now explained. The format of the output and input
image files are explained in section 3.5.7 (PLC-5) and section 3.5.8 (SLC-500).
The status file contains detailed information regarding the processor status and the
specific information varies by the processor. Some of the status file addresses that are
common to many of the PLC-5 processors:
Address Description
S:O arithmetic flags, such as carry, sign, and zero
S: I processor mode and force flags
S:1I15 "first pass" flag, set if processor is executing ladder for first time
S:2 other processor status, such as the data highway station number, type of
slot addressing, etc.
S:3-S:6 table of bits indicating which stations on the data highway are active
A bit data file is internal one-bit memory used for internal coils and bit-shift
instructions. For the default bit file, individual bits (coils) are addressed as
B3/n
where n is the bit number, 0-15999. A bit file can be addressed as words
B3:n
where n is the word number, 0-999. One can address individual bits in a word as
B3:n/m
where n is the word number and m is the bit number, 0-15. The bits within a word are
numbered as shown in Figure 3.17. Other data files (>8) can also be bit files. For example, if
data file 9 is a bit file, each coil in that file is addressed as B9/n.
The relationship between the two ways to address bits in a bit file is shown in Figure
3.18. For example, B3:2/5 addresses the same bit as B3/37 and B3:10/ll and B3/171
 3.5 A-B PLC-5 AND SLC-500 MEMORY 101

15 14 13 12 11 10 9 8 7 6

Mos' Least
Significant Significant

Figure 3.17. Bit numbering within bit file word or integer.

Bit number in word

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 B3:0
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 B3:1
47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 B3:2
..
159 158 157 156 ISS 154 153 152 151 150 149 148 147 146 145 144 B3:9
175 174 173 172 17l 170 169 168 167 166 165 164 163 162 161 160 B3:l0

Figure 3.18. Relationship between bit and word addressing in bit file type.

address the same bit. The programming software can be configured to display bit addresses
in either fonnat.
A timer file consists of timer elements whose structure appears in Figure 3.l9a. For the
default timer file, each individual timer is addressed as
T4:n
where n is the timer number, 0-999. The individual parts of each timer element can be
addressed as shown in Figure 3.l9a. The "/" can be used in place ofthe "." For example, the
addresses T4:14.DN and T4:14/DN are equivalent. Other data files (>8) can also be timer
files. For example, ifdata file 10 is a timer file, each timer in that file is addressed as TlO:n.
A counter file consists of counter elemepts whose structure is shown in Figure 3.19b.
For the default counter file, each individual counter is addressed as
C5:n
where n is the counter number, 0-999. The individual parts of each counter element can be
addressed as shown in Figure 3.l9b. The "/" can be used in place of the "." Other data mes
(>8) can also be counter files. For example, if data file 14 is a counter file, each counter in
that file is addressed as C14:n.
A file control data file element (Figure 3.l9c) is used to store infonnation for block
transfers and various other instructions, such as file arithmetic, shift register, and sequencer.
For the default control file, each individual element is addressed as
R6:n
where n is the element number, 0-999. The individual parts of each file control element can
be addressed as shown in Figure 3.19c. Other data files (>8) can also be file control data
files.
An integer data file stores integer data values, with a range from -32,768 through
32,767. Individual integers are addressed as
N7:n
102 Memory Organization and Addressing

r-1;.:;5..,..:-14"-r'1;.:;3,-- ....:,0 Individual timer parts addressed as:

ENlnlnN! T4:n.PRE Preset value (integer)
Preset value (0 to 32,767) T4:n.ACC Accumulated value (integer)
T4:n.EN Timer-enabled bit
Accumulated value (0 to 32,767) T4:n.TT Timer-timing bit
T4:n.DN Timer-done bit
(a)

15 14 13 12 11 0 Individual counter parts addressed as:

culcDIDNjoVlUN1 CS:n.PRE Preset value (integer)
Preset value (-32,768 to 32,767) CS:n.ACC Accumulated value (integer)
CS:n.CU Count-up bit
Accumulated value (-32,768 to 32,767) CS:n.CD Count-down bit
CS:n.DN Counter-done bit
CS:n.OY Counter overflow bit
CS:n.UN Counter underflow bit

(b)

15 14 13 12 11 10 9 8 o Individual file control parts addressed as:

ENIEU ERIULIIN IFDI R6:n.LEN Length value (integer)
Length value R6:n.POS Position value (integer)
R6:n.DN Done bit
Position value

(c)

Figure 3.19. PLC-S/SLG-SOO element structures: (a) timer; (b) counter; (c) file control.

where n is the element number, 0-999. One can add.ress individual bits within the integer as
N7:n/m
where n is the word number and m is the bit number, O-IS. The bits within a word are
numbered in the same manner as for the words in a bit file (Figure 3.17). Other data files
(>8) can also be integer files. For example, if data file 21 is an integer file, each integer in
that file is addressed as N2l :n.
A floating-point data file stores floating-point values, with a range from
38 38
±1.l7SSx 10- through ±6.80S6x 10+ . Individual floating-point numbers are addressed as
F8:n
where n is the element number, 0-999. Each floating-point number occupies 2 words, but
individual words or bits cannot be addressed within the floating-point file. To access the
individual words or bits, the COP instruction must be used to copy the floating-point
number to a bit or integer file.
A BCD (binary coded decimal) data file is used mainly for display of numbers and for
certain types of inputs (e.g., thumbwheel switches). Individual BCD numbers are addressed
as
 3.5 A-B PLC-5 AND SLC-500 MEMORY 103

D9:2

Figure 3.20. Example storage of BCD number.

Dx:n
where x is the file number (9-999) and n is word number, 0-999. In a BCD number, each
group of 4 bits in the word is the binary representation of a decimal digit. For example,
Figure 3.20 shows the binary pattern of decimal 1729. Note that each group of 4 bits
represents one of the decimal digits. If this word is moved to an integer location, the bit
pattern is interpreted as 5929 (decimal). The SLC-500 does not support the BCD data file
type and stores BCD numbers in integer addresses.
An ASCII data file is used rnainly for the storage of messages. Each word in an ASCII
data file contains two ASCII characters, but only words can be addressed as
Ax:n
where x is the file number (9-999) and n is the word number, 0-999. Figure 3.21 shows how
the message "PLC" is stored starting at address AI5:10. This data file type can be used to
store messages for communication with certain display modules. Message-type data can be
received from certain devices (for example, bar-code readers) and stored in this file type.
The SLC-500 does not support this data file type.
The enhanced PLC-5 processors have some additional files types, which can be used
for data files 9-999:
Letter Meaning Use Max. element!
BT Block transfer BTRJBTW instructions 1000
MG Message MSG instruction 585
PD PID PID instruction 399
SC SFC status SFC files 1000
ST ASCII string Data for ASCII instr. 780
In addition, the ControlNet PLC-5 processors have an additional data file type, CT, used for
the ControlNet messages.

AI5:IO
, " ,
v v
P L

A15:11
, v " v
,
C null

Figure 3.21. Representation of "PLC" in ASCII data file.

104 Memory Organization and Addressing

Design Tip
Use the data files to organize your program data. For example, a PLC-5 that
controls multiple assembly machines could have data files organized in blocks of
10 files as:
B I0 Machine I bits
T II Machine I timers
C12 Machine 1 counters
RI3 Machine I file control
N 14 Machine 1 integers
F 15 Machine 1 floating-point
A 16 Machine 1 messages
B20 Machine 2 bits
T21 Machine 2 timers
C22 Machine 2 counters
and so on.

3.5.4 Indirect and Indexed Addressing

In order to aid in structuring and accessing large amounts of data, the PLC-5 and
SLC-500 support indirect and indexed addressing.
In indirect addressing, an address may substitute for the numerical part of an address.
Indirect addressing is identified by square brackets around the address supplying the
number. Indirect addressing is useful for accessing arrays of elements (bits, integers, etc.).
For example, in the address B3/[N7:3], the N7:3 address determines the bit number in B3
that will be accessed. The programmer must ensure that the value ofN?:3 does not cause a
reference beyond the number of words in B3, or the processor will fault.
As another application of indirect addressing, the data file number can be supplied by
an integer address. For example, in the address N[N7:4]:10, the value in N7:4 determines
which integer file is accessed to get the word 10 value. This type of indirect addressing
could be used in a batch control application where there are a series of integer files, each
holding a separate batch recipe. An integer location specifies the particular integer file, and
thus the current recipe.
In indexed addressing, the value of the index register (S:24) is added to the address to
obtain a new address. Indexed addressing is identified by a "#" character in front of an
address reference. For example, an address of#N30:4 means the actual address is obtained
by the index register as an offset to N30:4. If the value of8:24 is 9, then the actual address is
N30: 13 (N30:4+9).

3.5.5 Constants

Constants are used to directly provide values for instructions. These values cannot be
overwritten by the program logic.
Integer constants may be expressed in decimal, octal or hexadecimal notation. The
formats are as follows:
 3.5 A-B PLC-5 AND SLC-500 MEMORY 105

~ Examples
integer -12,0, 23D, 14639
octal 1770 (127 decimal)
20010 (1025 decimal)
hexadecimal FFFFH (65,535 decimal)
AAH (170 decimal)
Floating-point constants may be expressed as normal decimal numbers,
5.341, +1439.7, -0.0041
or with "E" indicating the tens' exponential value,
7.45E-12, 1.27E+4, 1.27E4.

3.5.6 Symbols

The variables in a PLC-5 and SLe-500 program are basically address-based. In other
words, only addresses are needed to construct a program, though a program constructed in
such a manner would be difficult to understand. Therefore, symbols are associated with
each address used in a program. The database of symbols and descriptions for each address
is maintained separately on the programming device and it does not reside in the controller.
Therefore, when connecting to a PLC-5/SLC-500 in order to examine the online operation
of the program, the connecting computer must also have the project file in order to display
the symbols with the program addresses.
The symbol associated with an address can be any string of letters, digits, and
underlines up to 20 characters long. The symbol must have at least one letter and must not
end in one or more digits followed by the single letter D. 0, H, or E, because it is interpreted
as a value.

3.5.7 PL~5 Input/Output Addressing

In the PLC-5, the discrete I/O is handled differently from the analog I/O. The discrete
I/O appears as part ofthe data files. Analog I/O must use block transfer instructions to move
data between the modules and the processor memory.

3.5.7.1 Discrete Input/Output

In the PLC-5, the 0 data file contains the discrete output image, which is transferred to
the physical output modules at the end of a program scan. The I data file contains the
discrete input image, which is read from the physical input modules at the beginning of a
scan.
A PLe-5 implementation of the hardwired circuit of Figure 3.6 might appear as in'
Figure 3.22. The switches are connected to channels 0 through 3 of a discrete input module
and the lights, solenoid, and motor are connected to channels 0 through 3 of a discrete
output module. The address of the input channel is shown with the contact in the ladder.
Normally, one defines a symbol that refers to the I/O address and both the address and its
symbol appears on the listing. However, for the purpose of this example only the addresses
are shown. The address format shown in Figure 3.22 is called the "single line" format. The
106 Memory Organization and Addressing

120 v Com
PBl
1:005iOO 0:007/00
--L 00
on [ ( t-
0.
o. :l
:l
PB2 0
.... ....
0

--L 01 .5 " 1:005/01 0:007/01 ".5 PL2

01 "- /
OJ
:;
[ ( :;
OJ

"0
"0
0 /
0
::E
FSI -
::E
:l 1:005/02 0:007/02 :;
.&
SOLI
02
- 02
0.
c [ ( 0
:l

B
~
"'"
-"
OJ

~
Pump 1
LSI Q 1:005/03 0:007/03 '"
Q
03 03
[ (
,
v
, , v
, ,
v
,
Input WIring Ladder Logic Output WIring

Figure 3.22. PLC-5 implementation for Figure 3.6 showing I/O addressing.

address "1:005/02" means the contact is controlled by the discrete input channel 02, in group
5 of the local chassis. In gcneral, the address for a discrete input channel is
I:rrg/cc
where rr is the rack number, g is the group number in which the module resides, and cc is the
channel number. The PLC-5 processor resides in rack 0, also called the local chassis.
Similarly, the address "0:007/01" means the output (coil) is connected to output channel
01, in group 7 of the local chassis. All of the numbers in an I/O address are octal.
The alternate format ofthe discrete I/O address display is called the "split line" format.
In this format, the bit (discrete channel) is shown below the contact or coil instruction.

Summarizing, the PLC-5 discrete I/O addresses are:

Type of Channel General Address
Discrete Input I:rrg/cc
Discrete Output O:rrg/cc
where
rr is the rack number (octal),
g is the group number (0 - 7, octal), and
cc is the channel number (0 - 17, octal).
The allowable maximum number of racks depends on the particular PLC-5 processor. In
contrast to all ofthe other address formats of the PLC-5 data, the discrete I/O is numbered in
octal. Therefore, addresses like 1:025/08 and 0:195/12 are ILLEGAL.
 3.5 A-B PLC-5 AND SLC-500 MEMORY 107

The terms rack and group have a definite meaning for the PLC-5. They are defined as
follows:
I/O Group - addressing unit corresponding to an input-image word and an
output-image word. An I/O group can contain up to 16 input channels and 16
output channels and can occupy two, one, or one-half slots in the chassis.
I/O Rack - 8 I/O groups. Depending on I/O chassis size and I/O group size (2, 1, or 1/2
slots), an I/O rack can occupy a fraction of an I/O chassis, a full I/O chassis, or
multiple I/O chassis.
In order to accommodate legacy I/O modules, fit them into the definition of no more
than 16 channels in a group, and to use the I/O address space efficiently, the addressing
scheme for the PLC-5 is rather complicated. There are 3 addressing schemes: two-slot,
one-slot, and half-slot, which corresponds to the number of slots assigned to a group. In
simple terms, two-slot addressing allows two 8-point discrete modules to occupy one group,
one-slot addressing allows one 16-point discrete module to occupy one group, and half-slot
addressing allows one 32-point discrete module to occupy two groups. However, each
addressing scheme allows more complicated configurations and permits efficient use of the
available addresses. Additionally, a concept called complementary I/O can be used for even
greater efficiency.

Slot" a I 2 3 4 5 6 7 Slot· a 1 2 3 4 5 6 7
P G P
r G G G G G G G r $ $ $ $
0 r r r r r r r r 0 r r r r
c 0 0 0 0 0 0 0 0 c 9 9 9 9
e u u u u u u u u e a a a a
s p p p p p p p p s ~ ~ ~
s
0 a
s
0
iii 1
f
r I 2 3 4 5 6 7 r T ~
, , ,
v v-
Rack a Rack a

(a) (b)

S~t· 1 a 2 3 4 5 6 7
G G G G G G G G
P r r r r r r r r
r p p p p p p p p
0
c a 2
e 1. 6 a 2 4 6
s G G G G G G G G
s r r r r r r r r
0 p p p p p p p p
r
I 3 5 7 1 3 5 7
~~
Rack a Rack I

(c)

Figure 3.23. Comparison of slot addressing methods: (a) one-slot addressing; (b) two-slot
addressing; (c) half-slot addressing.
108 Memory Organization and Addressing

I-slot addressing I-slot addressing 2-s1ot addressing

lIO Modules VO Modules

~
Rack 0 Rack 1 Rack 2 Rack 3 Rack4

Figure 3.24. PLC-5 racks for system with remote I/O.

The number of slots actually occupied by a rack depends on the number of slots per
group. Figure 3.23 shows the number of racks in an 8-slot chassis when the various
addressing schemes are used. When two-slot addressing is used with an 8-slot chassis, the
other halfofthe rack must reside in another chassis. Rack assignment for an example PLC-5
system with remote I/O and differing chassis slot addressing schemes is shown in Figure
3.24.
One-$lot Addressing. One-slot addressing is the easiest to understand because the slot
numbers correspond to group numbers. An 8-slot chassis is exactly one rack and a 16-slot
chassis is exactly two racks. Also, one-slot addressing accommodates all types of I/O
modules, as long as certain rules are met with 32-point modules. Figure 3.25 shows two
slots of the local chassis with one-slot addressing and 16-point modules. With one-slot
addressing, each slot in the chassis can have up to 16 discrete inputs or 16 discrete outputs.
Because of the input module in slot (and group) 2, the output image word corresponding to
group 2 is unused. If 8-point modules are used in place of the l6-point modules, then only
bits 00-07 in the image words are used. In this case, bits 10-17 are unused.
Technically, any unused bits in the I/O image tables can be used as internal coils by the
PLC program. In fact, this technique was practiced frequently on the PLC-2 processor
because its data address space was small. However, this practice adds to the complication of

Slot 2 Slot 3
Input Output
Module Module
00 00
01 01
02 02
03 03
04 04
05 05
06 06
07 07
10 10
II 11
12 12
13 13
14 14
15 15
16 16
17 17

Note: Image words 0:002 and 1:003 are unused.

Figure 3.25. One-slot addressing with 16-point modules.

 3.5 A-B PLC-5 AND SLC-500 MEMORY 109

Slot 2 Slot 3
~ I?
Input (Z Output
Module ~ Module
Output image table words
~ -. - •• - -. - - - - - - - - -; 0:002
10:003

Input image table words

~, 11:002
, : .•• . : 1:003

Figure 3.26. One-slot addressing with 32-point modules.

Input Slot 2 Slot 3 Input

Module Module
00 10
01 11
02 12
03 13
04 14
05 15
06 16
07 17

Input image table word

17 1615 L4 13 12 11 1007 06 05 ll'I jl3 01 01 00 1:00 I

Figure 3.27. Two-slot addressing with 8-point modules.

converting the PLC-2 code to PLC-5 code. The practice of assigning unused I/O bits as
internal coils is not necessary on the PLC-5 since its memory space is not as limited.
When using 32-point discrete I/O modules with one-slot addressing, a 32-point input
module and a 32-point output module must be in adjacent slots (Figure 3.26). This is the
most efficient way to use one-slot addressing.
Two-Slot Addressing. In two-slot addressing, two I/O slots in the chassis make up a
group of 16 discrete channels. Figure 3.27 shows two slots of the local chassis with two-slot
addressing and 8-point modules. Together, slots 2 and 3 compose group I. If an output
module is in slot 3 of Figure 3.27, then bits 10-17 in input image word I (1:001) would be
always 0, and bits 10-17 for the output module would come from bits 10-17 in output image
word I (0:001).
When using 16-point discrete I/O modules with two-slot addressing, a 16-point input
module and a 16-point output module must be in adjacent slots (Figure 3.28). This is the
110 Memory Organization and Addressing

Slot 2 Slot 3
Input Output
Module Module
00 00
01 01
02 02
03 03
04 04
05 05
06 06
07 07
10 10
11 11
12 12
13 13
14 14
15 15
16 16
17 17

Figure 3.28. Two-slot addressing with 16-point modules.

SIot2
Input
00
Module 01 02
03 04
05 06 Half-slot
07 Output image table words (unused)
10 I/O group 4
11
13
15
17
12
14
16 I Ig:~~
Ol 00
03 02
05 04
07 06 Half-slot
Input image table words
11 10 I/O group 5
13 12 _ 1:004
15 14
16 . . '" 1:005
17

Figure 3.29. Half-slot addressing with 32-point modules.

most efficient way to use two-slot addressing because both input and output image words
are used.
Half-Slot Addressing. In half-slot addressing, each chassis slot is assigned two groups.
This method of addressing is primarily for 32-point I/O modules. Figure 3.29 shows how
the group numbers relate to slot 2 in the local chassis. Since an input module is in this slot,
the output image words are unused. With half-slot addressing 8-, 16- and 32-point modules
can be installed in any order in the chassis, but many ofthe bits in the input and output image
words, especially for those I/O groups having 8- and 16-point modules, will be wasted. This
approach could be a problem with the PLC-5 processors that do not have much I/O space.
 3.5 A-B PLC-5 AND SLC-500 MEMORY 111

SSI PB5 LS7 PL2

I I:O 2I04 1:031/10 1:035/07 0:01~
J [ M M (
(a)

SSI PB5 LS7 PL2

~022 1:031 1:035 O:O:W

04
[ M
10
M
07
(
15
(b)

Figure 3.30. Solution to Example 3.3: (a) single line address format; (b) split line address
format.

Complementary I/O. In a complementary I/O configuration, two chassis are assigned

the same rack number, but the discrete modules are complements of each other. That is, if
one rack has all input modules, then the complement rack has all output modules. This
scheme is similar to two-slot addressing with 16-channel modules (Figure 3.28) in that all
words of the input and output image can be used with the proper selection of modules. All
three slot-addressing schemes may be used with complementary I/O, except that
32-channel modules cannot be used with one-slot addressing and 16-channel modules
cannot be used with two-slot addressing.
Example 3.3. Draw a PLC-51adder diagram that will cause the output, pilot light PL2, to be
on when selector switch SS I is closed, push button switch PB5 is open, and limit switch
LS7 is open. Show the I/O tags in the logic. The input/output devices are wired to the
following locations (rack, group, and channel numbers in octal):
PL2: Output module, rack 01, I/O group 7, channel 15
SS 1: Input module, rack 02, I/O group 2, channel 04
PB5: Input module, rack 03, I/O group I, channel 10
LS7: Input module, rack 03, I/O group 5, channel 07
Solution. The addresses are predefined, so there is no need to map channels to addresses.
The addresses are,
PL2: 0:017/15
SSI: 1:022/04
PB5: 1:031/10
LS7: 1:035/07
The ladder logic is shown in Figure 3.30. The addresses are shown above the contact and.
coil instructions and the symbols are shown above the addresses. The addresses are shown
in the single line format in Figure 3.30a and in the split line format in Figure 3.30b.
112 Memory Organization and Addressing

f--
N-file BTW f--
(37 words) • f--
Set data format, f--
range, # channels f--
1771 f--
f--
IFE f--
Anal og
N-file BTR lopu IS
(20 words) Channel values,
statuses

(a)

NIO:0/15 NIO:5/15 , . . . . - - B T W - - - - - - - - - - - ,
I If---I I Block Transfer Write
Module Type 1771-IFE 12 Bit Analog Input
Rack 000
Group 3
Module . o
Control Block NI0:0
Data File Nll:O
Length 37
Continuous No
Setup Screen

NI0:0/15 NI0:5/15 ,....--BTR - - - - - - - - - - - - - ,

II-II Block Transfer Read
Module Type. 1771-IFE 12 Bit Analog Input
Rack 000
Group 3
Module 0
Control Block NIO:5
Data File N12:0
Length 20
Continuous No
Setup Screen

(b)

Figure 3.31. Example PLC-5 block transfers for analog input module: (a) transfers;
(b) ladder logic.

3.5.7.2 Analog Input/Output

In a PLC-5 system, the analog I/O channel values do not appear in the I/O image data
files. Block transfer instructions move data between the modules and the processor
memory, usually integer data files.
Figure 3.31 shows the block transfers required to interface with a 1771-IFE 16-channel
analog input module. Figure 3.31a conceptually shows the transfers that must occur. A
 3.5 A-B PLC-5 AND SLC-500 MEMORY 113

block transfer write (BTW) is needed to configure the module with the number of channels
to read, the data format, and other configuration information. A block transfer read (BTR) is
required to read the channel values and status information.
The ladder logic code to implement these two transfers is shown in Figure 3.3lb. The
two block transfers are set up to alternate. The control blocks are set up in an integer file,
which is required when using the BTRlBTW in an original PLC-5. The NIO:0/15 bit is on
when the write-transfer is enabled and in progress. The NIO:5/l5 bit is on when the
read-transfer is enabled and in progress. When these two rungs are scanned for the first
time, both NIO:0/15 and NIO:5/15 bits are off, which means the BTW is started. The BTRis
not started until the NIO:0/15 bit is turned off at the conclusion of the write-transfer. The
BTW is not started until the NIO:5/l5 bit is turned off at the end of the read-transfer. The
actual analog channel values are in the 20-word integer block starting with N 12:0 and the
value of the first channel is in NI2:4. When the program is scanned for the first time, the
BTW is always executed first in order to configure the module. One could setup the BTW to
only execute once, on the first scan of the program. However, if the BTW is set up to only
execute once, then if the module is ever replaced due to a faulty channel, the hew module
will not be properly configured. Forcing the processor into program mode and then back to
run mode in order to configure the new analog input module is generally not acceptable in
most systems. Alternating the block transfers solves this potential problem.
Figure 3.32 shows the block transfers required to interface with a 1771-0FE 4-channel
analog output module. Figure 3.32a conceptually shows the transfers that must take place.
A block transfer write (BTW) is needed to configure the module and to write the channel
values. A block transfer read (BTR) is required to read the channel status information. The
ladder logic code to implement these two transfers is shown in Figure 3.32b. As for the
analog input transfers, the two block transfers are set up to alternate. This example uses the
BT file type for the control block. The BTI5:nIEN bit is on when the transfer is enabled and
in progress. The actual analog channel values are part of the 13-word integer block starting
with N13:0. The value of the first channel is in N13:0.
The parameters of the BTRlBTW instructions are as follows. The rack, group, and
module specify the module address. The module parameter is only applicable if two-slot
addressing is being used; module 0 is the left slot in the group and module I is the right slot
in the group. The control block is the starting address of a 5-word integer block or a BT file
element. The data.file is the starting address of the integer data to be transferred to or from
the module. The value of the length parameter depends on the particular module. If
continuous operation is enabled, then when the rung condition changes to true, the block
transfer happens every scan until an error is encountered. If an error occurs, the block
transfer halts and will not restart until the processor is either forced into program mode and
back into run mode, or the instruction is edited online to disable continuous operation. For
this reason, the continuous operation is rarely used. If non-continuous operation is enabled,
then when the rung condition transitions from off to on, the block transfer happens only
once.
In operation, the BTRlBTW does not happen as soon as the rung condition turns on. It
is placed into a queue and each block transfer is executed, in order. Block transfers happen
in the background while the other ladder rungs are scanned. One must examine the "done"
or "enable" bits to determine when the block transfer is finished. The block transfer "done"
bit is bit 13 ofthe first word in an integer control block, or addressed as BTx:n/DN ifusing a
BT data file for the control block.
114 Memory Organization and Addressing

N-file
(13 words)
BTW
Channel values,
data format 1771
gAnal og
OUtputs
OFE

N-file BTR
(5 words) Channel statuses

(a)

BT15:0IEN BT15:1IEN . - - - - B T W - - - - - - - - - - - - - - .
/I 1/ Block Transfer Write
Module Type 1771-0FE 12 Bit Analog Ouput
Rack
Group
000
4
D0-
Module 0 EIY-
Control Block BT15:0
Data File N13:0
Length 13
Continuous No
Setup Screen

BT15:0IEN BT15:1IEN .--- BTR - - - - ---,

/I I/ Block Transfer Read EN
Module Type 1771-0FE 12 Bit Analog Output
Rack 000
Group 4
Module 0
Control Block BT15: 1
Data File N14:0
Length 5
Continuous No
Setup Screen

(b)

Figure 3.32. Example PLC-5 block transfers for analog output module: (a) transfers;
(b) ladder logic.

3.5.8 SLC-500 Input/Output Addressing

In the SLC-500, the discrete I/O and the analog I/O are part of the I/O image. The 0
data file contains the image for all output channels, which is transferred to the physical
 3.6 SIEMENS S7 MEMORY 115

Slot o I 9 10 19 20 29

'""- "-~
I I IJ I I I I

Y9 - '"
"-
I PI ..-.. '""- IlIPI
' ' - - - - - - -.......v , - - - - - - - ' "
Up to two expansion chassis

Figure 3.33. Local and expansion I/O for SLC-SOO processors.

output modules at the end of a program scan. The I data file contains the image of all input
channels, which is read from the physical input modules at the beginning of a scan.
The fonnat is very similar to the format for PLC-S discrete I/O addresses. The only real
differences are that the rack and group is replaced by the slot number and the channels are
numbered in decimal instead of octal. Summarizing, the SLC-S I/O addresses are:
Type of Channel General Address
Discrete Input I:ss/cc
Discrete Output O:ss/cc
Analog Input I:ss.cc
Analog Output O:ss.cc
where
ss is the slot number (1 - 30),
cc is the channel number (0 - 16).
The allowable maximum number ofslots depends on the particular SLC-SOO processor. The
numbering of slots for an example SLC-SOO system with expansion chassis is shown in
Figure 3.33.

3.6 SIEMENS S7 MEMORY

There are three types ofS7 processors: (1) S7-200, (2) S7-300, and (3) S7-400. From a
programming viewpoint, the S7-300 and S7-400 differ only in the default I/O module slot
addresses. The S7-200 processors differ significantly from the S7-300/400 processors.
However, the memory model is basically a restricted version of the S7-300/400 processors.
Therefore, this section presents the memory organization of the S7-300/400 processors and
the restrictions and differences ofthe S7-200 processors are noted in the appropriate places.

3.6.1 Memory Organization

The Siemens S7 processors are programmed with the STEP 7 programming software
and the S7-300/400 processor memory is organized as shown in Figure 3.34. Like IEC .
61131-3 the model is layered and structured. However, it is somewhat different than IEC
61131-3. Each of the main elements is now described.
The project is the entire body of software (program and data) that corresponds to a
PLC system that has one or more PLC processors. Each station is a PLC processor. The
project corresponds to the configuration of IEC 61131-3 and the station corresponds to a
resource.
116 Memory Organization and Addressing

Project

Station Station
User Program User
Program
Organization
Block 1
Function
Block (FB) Is~~1
(OBI) Ins~ce
I I
• ~ _B'''''
Other Global IOBll
Meroory
lOBi I.... Function
" (FC) §]
IOBjl .. '\ ~ •••. ~ ~
IOBk Ir , . ', . ffi\. ",: ,.'
,'c::;::]. , ' •
...... ~

IDa~ I 1:8: I
ISDBI
System Shared Shared
Blocks Btloclc Data Block

Process VO Image Table : Peripheral va Data

.

'"•
y
"!y
I Global Data Table I
Figure 3.34. Siemens S7-300/400 memory model.

The system data blocks (SDBs) contain such items as the PLC processor model, VO
map, communication interfaces, remote VO connections, and data memory allocation. This
data is not accessible to the program.
A station consists of one user program which has organization blocks (OBs) as the
main program entities. An organization block is basically a combination of one lEC
61131-3 task and program. The program in organization block OB 1 executes once for each
program scan. Organization blocks OB 10 to OB 122 are provided for non-cyclic types of
program execution such as:
Fixed periodic interval
Process interrupt occurrence
Diagnostic interrupt occurrence
Synchronous and asynchronous error processing
Different types of startup processing
Multicomputing interrupt occurrence
Background program
The available organization blocks are specific to a particular processor. More detailed
information is in Siemens (1996).
 3.6 SIEMENS S7 MEMORY 117

Each organization block, function, and function block (called logic blocks) has access
to some temporary memory, called local stack data memory. Whenever a logic block is
first executed, temporary data is allocated from the local data stack. This temporary data is
released when the logic block finishes execution.
The program in an organization block can call function blocks or functions. A function
block (FB) has local variables contained in an instance data block. A function (FC) does
not have any local storage. A shared data block can be accessed by any of the program
units (OB, FB, or FC). Built-in functions and function blocks are called system functions
(SFC) and system function blocks (SFB).The process I/O image table contains the image
of the physical input and output modules. The peripheral I/O data contains the same
information as the process I/O image table, but it resides in the input and output modules.
The global data table is data that is shared between processors. Once configured, the
transfer of information between processors is transparent to the user program.
An organization block may be written in anyone of the following languages:

Ladder Diagram (LAD)

Function Block Diagram (FBD)
Statement List (STL, like IEC instruction list)
Structured Control Language (SCL, like IEC structured text)
A function block or function may be written in the three languages listed above, plus the
. following languages:
S7-Graph (like IEC sequential function chart)
S7-HiGraph (a state-transition language)
Continuous Function Chart (CFC)
The continuous function chart and S7-HiGraph languages are not covered by this text.
The S7-300/400 processors divide the processor memory into the load memory and
the work memory. The load memory contains the complete user program (OBs, PCs, FBs,
SDBs, etc.) without the symbol table and comments. Depending on the processor, the load
memory can be RAM (random-access memory), EPROM, (erasable programmable
read-only memory), or EEPROM (electrically erasable programmable read-only memory).
The work memory is RAM, optimized for high~speed access. At startup, the parts of the
program relevant for program execution are copied from the load memory to the work
memory. The program is executed from the work memory.'
The memory model of the S7-200 processors differs from the S7-300/400 model in the
following aspects:
• Only one organization block (OBI).
• Subroutines instead of user-defined functions and function blocks.
• No shared data blocks.
In addition, the S7-200 processors only support the LAD, FBD, and STL languages.
118 Memory Organization and Addressing

3.6.2 Program Scan

Each organization block is a task. The program in organization block OB I executes

once for each program scan. Except for the background organization block (OB90), the
main program OB I has the lowest priority. While OB I is executing, it can be interrupted by
a higher-priority organization block. There are up to 28 priority levels in the S7 processor.
The background organization block OB90 is executed if the actual program scan time is
shorter than the specified minimum scan time. In this text, OB I is assumed to contain the
entire program or to call function blocks.
The OB I program execution is basically the same as introduced in section 2.5. The
physical inputs are read, the program is scanned from top to bottom, and the physical
outputs are written. The current values in the I/O modules can be directly accessed as
peripheral I/O data. With some S7-300/400 processors, one can create and update up to
eight sections of the I/O image tables, independent of the cyclic updating of the I/O image.
The UPOAT_PI or UPOAT]O system function blocks (SFBs) are used to
programmatically update a section of the input or output image, respectively. The SET and
RSET SFBs set or clear, respectively, individual bits in the output image.

3.6.3 Addressable data memory

In the S7 processor, data may be addressed as a symbol or as an absolute address.

Though only absolute addresses are required to construct a program, it is not recommended.
Therefore, a symbol is associated with each absolute address in a program. The format of
the absolute addresses is explained after first describing the symbols and the various data
types.
The symbolic name of an absolute address can be any string of letters, digits, and
underlines up to 24 characters long provided that there are not two or more consecutive
underlines. STEP 7 relaxes the IEC61131-3 naming convention by allowing leading digits
in the name. There is no distinction between upper and lower case (though STEP 7 versions
prior to 4.02 allowed a distinction between upper and lower case symbols). Generally, a
symbolic name should exist only once as a ·memory, function block or instance name.
However, a symbol local to an organization block can be identical to a shared symbol.
Shared and local symbols are distinguished in a program in the following manner:
• Shared symbols (in the symbol table) are enclosed in quotation marks " ..".
• Local symbols (in the block variable declaration table) are preceded by the u#"
character.
The quotation marks or the u#" are normally added by STEP 7 when entering the program.
However, if the symbol name is defined as a shared symbol and a local symbol exists, then
the local symbol name is assumed. The quotation marks must be added ifthe shared symbol
is desired.
The symbol and description for each address is maintained separately on the
programming device and this symbol table does not reside in the controller. Therefore,
when connecting to a S7 processor in order to examine the online operation of the program,
the connecting computer must also have the project file in order to display the symbols with
the program addresses.
 3.6 SIEMENS S7 MEMORY 119

When a symbol is declared, it must be assigned a data type. The elementary data types
are as follows:
Name Description Range of values
BOOL I-bit Boolean O=cleared, I=set
BYTE 8-bit 0 to FF hexadecimal
WORD 16-bit 0 to FFFF hexadecimal or -999 to 999 BCD
DWORD 32-bit 0 to FFFFFFFF hexadecimal
INT 2-byte integer -32,768 to 32,767
31 31
DINT 4-byte integer _2 to 2 _1 (-2,147,483,648 to 2,147,483,647)
REAL 4-byte float. pt. 1.17510 38 to 3A031 0+38
31 31
TIME 4-byte _2 to 2 _1 milliseconds (<-24 to >24 days)
DATE 2-byte Jan. I, 1990 to Dec. 31, 2168
TIME_Of_DAY 4-byte 0:0:0.0 to 23:59:59.999
CHAR 8-bit ASCII characters
S5TIME 2-byte 0 to 999 BCD format
with 0.01-, 0.1-,1.0-, or 10-sec units
The TIME_OF_DAY and S5TIME data types are extensions to the IEC-61131-3 standard
data types. The TIME, DATE, TIME_OF_DAY, CHAR, and SSTIME data types are not
valid for the S7-200 processors.
Constants are used to directly provide values for inputs of function blocks, transition
conditions, and so on. These values cannot be oveiwritten by the program logic. Constants
are also used to assign a value to a constant or an initial value to a variable.
The BOOL (boolean) data type has the constants FALSE (or 0) and TRUE (or I).
Constants for the BYTE, WORD, and DWORD data types can be expressed in various
formats:
Data Type Format Example
BYTE Hex: B#16#O (0 decimal)
Hex: B# 16#4C (76 decimal)
WORD ·Binary: 2#111 (7 decimal)
Binary: 2#1011_0011 (179 decimal)
Hex: W#16#7F (127 decimal)
BCD: C#271 (271 BCD)
Decimal-byte: B#(23,255) (17FF hexadecimal)
DWORD Binary: 2#0000_1111_0111 (247 decimal)
Hex: DW#16#7F (127 decimal)
Decimal-byte: B#(0,0,23,255) (17FF hexadecimal)
Constants for the BYTE data type can only be expressed as hexadecimal numbers,
identified by the B#16# prefix. The WORD data constants can be expressed in the binary,
hexadecimal, BCD, or decimal-byte formats and each format has its separate prefix. In the
decimal-byte format, each 8-bit byte is specified as a decimal number, starting with the
most significant byte and finishing with the least significant byte. Constants for the
DWORD data type can be expressed in the binary, hexadecimal, or decimal-byte formats.
120 Memory Organization and Addressing

The underline character may be inserted into binary constants to aid readability; otherwise it
has no significance. Constants for the !NT data type are expressed as normal integers
without commas,
23, 18929, -32000
The DINT data types are expressed as a normal integer, prefixed by "L#" without commas,
L#23,L#645100,L#-2147483600
Constants for the REAL type may be expressed as normal decimal numbers,
5.341, +14_639.7, -0.0041
or with "E" or "e" indicating the tens' exponential value,
7.45e-12, 1.27E+4, 1.27E4.
Constants for the TIME type (called duration constants) are specified in days (D), hours
(R), minutes (M), seconds (S), and milliseconds (MS), or combinations thereof. The
duration must be identified by the prefix T# or TIME#. The "overflow:' of the most
significant unit is not allowed; e.g. the entry T#25H15M is changed into T#IDIHI5M.
Also, any decimal part ofthe duration constant is converted to its integer representation. For
example, if one typed T#2.5S, it is converted into T#2S500MS. Some examples are:

T#1OMS 10 milliseconds
T#3.5s 3 seconds, 500 milliseconds
TIME#18M 18 minutes
TIME#5D_14H_12M 5 days, 14 hours, 12 minutes
Constants for the DATE type are specified as the 4-digit year, month, and day ofmonth
prefixed by D# or DATE#. Some examples are:
D#1996-4-5 April 5, 1996
DATE#2005-12-4 December 4, 2005
Constants for the TIME_OF_DAY type are specified as the time in hours, minutes,
seconds and thousandths of a second. The time must be identified by the prefix TOD# or
TIME_OF_DAY#.Some examples are:
TOD#8:1:1.2 1.2 seconds past 8:01 AM
TOD#16: 12:45.572 45.572 seconds past 4:12 PM
The S5TIME type is provided for backward compatibility with S5 processors and is not
lEC-compliant. Constants for the S5TIME type follow the same format as for the TIME
type except that days are not possible and the prefix is S5T# or S5TIME#. The value must be
consistent with the timer resolution (0.01-,0.1-, 1.0-, or 10-sec units) and be no more than
999 resolution units. Some examples are:
S5t#IOMS 10 milliseconds
S5TIME#18M 18 minutes
S5TIME#IH_2M 1 hour, 2 minutes (372 lO-sec units)
Constants for the CHAR type are single ASCII characters (letters, numbers, and
symbols) enclosed in single quote marks. Some examples are:
A
I 1 Letter "A"
'x' Letter ,~n
 3.6 SIEMENS S7 MEMORY 121

The S7-300/400 processors also allow complex data types. Complex data types define
groups of data larger than 32 bits or consisting of other data types. The complex data types
are as follows:
Name Description
DATE_AND_TIME 8-byte BCD
STRING I to 254 bytes of ASCII characters
ARRAY multi-dimensional group of one data type
STRUCT user-defined structured data group
POINTER 6-byte identification of a memory location
ANY undefined data type for function block parameter
UDT user-defined data type
The DATE_AND_TIME data type is an 8-byte structure that contains the year, month,
day, hour, minute, seconds, milliseconds, and weekday stored as a set of BCD values. A
DATE_AND_TIME constant is preceded by DT#. Some examples are
DT#200 1-2-15-8-12-50-300-5
DT#1999-11-2-14-1-43-0-3
A STRING data type is an array of CHAR elements. The array consists of a two-byte
header followed by the CHAR data (Figure 3.35). The first byte in the header contains the
number of memory bytes reserved for the string (including the header) and the second byte
holds the string length, the number of bytes actually containing data. The default and
maximum size of a STRING is 256 bytes, though shorter strings can be specified, for
example,
STRlNG[12]
which can contain a maximum of 10 characters (2 bytes reserved for the header). A string
constant is a series of ASCII characters enclosed in single-quotation marks, for example,
•Sample'
An ARRAY data type is a multi-dimensio)lal grouping of one data type (elementary or
complex). One can define up to six dimensions. For example,
one dimension ARRAY[I ..31] OF TIME
two dimensions ARRAY[-3 ..3, 0..25] OF INT
three dimenSions ARRAY[1..IO, 1..10, 1..10] OF REAL
To access an element an array, the indices are enclosed in square brackets, for example,
"[4,5]."
A structure is a collection of data elements, generally with different data types
(elementary data types and/or complex data types) framed by STRUCT and
END_STRUCT. For example, one could define the following structure (and symbols):

I I I I I· • ·1 I
'--y----J '--y----J '--y----J '--y----J '--y----J
Max.length Number First Second Last
of string of characters character character string byte
in string

Figure 3.35. Structure of S7 STRING data type.

122 Memory Organization and Addressing

STRUCT
Serial Num DINT
Name STRlNG[50]
Oper_Time TIME
Shift Faults !NT
Last Fault !NT
In_Service BaaL
In_Repair BaaL
END STRUCT
A POINTER identifies the address of a memory location, rather than its value. It is
often used to pass the address of a complex data structure to a function block rather than
pass the contents of the structure. Often, a pointer is identified with a "P#" preceding the
bit-level memory address. However, all parameters passed to a FC (function) are all
pointers, even if "P#" does not precede the address. The POINTER data type occupies 6
bytes of memory. Since a pointer may only be modified and used within an OB, FB, or FC
written in the instruction list language, it is described in Chapter 13.
The ANY data type is used for function block parameters when the data type of the
parameter is unknown or when any date type is permitted. The data type of the parameter is
declared as ANY when the block parameters are defined. This data type occupies 10 bytes
of memory. More information about the use of the ANY data type is contained in Chapter
12, when structured control language programming is discussed.
A user-defined data type (UDT) allows one to define a new data type from the
elementary and complex data types. After creating the UDT and assigning a name to it, one
can use it multiple times. Figure 3.36 illustrates the structure of a DDT named
Machine_Info consisting of a double integer, a string, a time, two integers and two
booleans. The address column shows the offset from the start of the structure, as a byte and
the starting bit number.
The memory of the S7 processors is divided into address areas identified by one or
more letters followed by a number (Table 3.1). Note that the possible types vary with the
processor type. For the S7-300/400 processors, the general memory, counter, and timer
address areas are accessible by all logic blocks and are intended for temporary program
storage. Most ofthe program data should be contained in shared data blocks or instance data

Address Name Type Init. Value Comment

0.0 STRUCT
+0.0 Serial Num DINT L#O
+4.0 Nam STRING[50] "
+56.0 Oper Time TIME T#OMS
+60.0 Shift Faults INT 0
+62.0 Last Fault INT 0
+64.0 In Service BaaL FALSE
+64.1 In Repair BaaL FALSE
=66.0 END STRUCT

Figure 3.36. Examplc "Machine_Info" user-defmed data type.

 3.6 SIEMENS S7 MEMORY 123

Table 3.1 S7 Addressable Data Types.

Bit Byte Word Db!. Word
Memory Type Address Address Address Address
Common To All 87 Processors
General Memory Mn.m MBn MWn MDn
Timer Tn Tn
Counter Cn Cn
Local (stack) data Ln.m LBn LWn LDn
Input Image In.m IBn IWn IDn
Output Image Qn.m QBn QWn QDn
87-300/400 Processors Only
Status STW
Shared Data Block (DBn) DBXn.m DBBn DBWn DBDn
Instance Data Block (DBn) DIXn.m DIBn DIWn DIDn
Peripheral Input Data PIBn PIWn PIDn
Peripheral Output Data PQBn PQWn PQDn
87-200 Processors Only
Variable Vn.m VBn VWn VDn
Special SMn.m 5MBn SMWn SMDn
Sequence Sn.m SBn SWn SDn
Accumulator ACn ACn ACn
High Speed Counter HCn
Analog In AIWn
Analog Out AQWn

blocks. For the S7~200 processors, most of the data should be contained in the variable
memory. For all processors, the available amount of any type of memory depends on the
specific processor.
For the S7-300/400 processors, one can declare a certain number of general memory,
timers, counters, and shared data blocks as retentive, that is, the values are retained when the
program is restarted. The values of data contained in instance data blocks are retained when
the program is restarted. The amount of default and available retentive memory depends on
the particular processor. Within limits, the amount of default retentive memory can be
changed. For the S7-200 processors, one can define up to six ranges of M, C, T, and V
memory to be retentive.
The format ofeach type ofaddress is now explained. The format ofthe input and output
data addresses are explained in section 3.6.4.
The general memory area may be accessed as bits, bytes, words, or double words.
Individual bits (coils) are addressed as
Mn.m
124 Memory Organization and Addressing

7
,MO.l

+0 7
[I:I:I~I~I~I~I~I~IIIIII
~ II
o7 r M2.5

0 7
I I I II I I I I I I I II I I !
II II
j
070
I ! I II ! ! I I I ! I I
II
MBO MBI MB2 MB3 MB4
'-:'=-__-:-=-:- ~' ....
' ----:-::::-::---_...1
MSB MW 1 LSB MW3

MSB LSB
MDO

Figure 3.37. Relationship between general memory addressing.

where n is the byte number and m is the bit number, 0-7. The general memory area can be
addressed as bytes, words, or double words as follows
MBn Byten
MWn Word starting at byte n
MDn Double word starting at byte n
The relationship between the ways to address the general memory area is shown in Figure
3.37. Note that the MWl address overlaps bothMB 1 and MB2. The least-significantbitofa
byte, word, or double word is the right-most bit. In the same manner, MB2 is the
least-significant byte ofMWI.
The timer area contains the data for the timer function blocks. Though addressed the
same, the S7-300/400 timers and S7-200 timers have different formats. For the S7-300/400
processors, the value of the S5-compatible 10-bit timer remaining time is addressed as
Tn
where n is the timer number. For the S7-200 processors, the 16-bit integer value of the
accumulator (elapsed time) is addressed in the same manner. For all S7 processors, the timer
status bit (on when timer running) is addressed in the same way. The program determines
which value to use (integer or Boolean) by the type of the instruction that uses the address.
For the S7-300/400 processors, the IEC 61131-3 timer function blocks do not use the timer
area, but store the values in an instance data block.
The counter area contains the data for the counter function blocks. As for the timers,
the S7-300/400 counters and S7-200 counters have different formats. For the S7-300/400
processors, the value of the S5-compatible 10-bit accumulator is addressed as
Cn
where n is the counter number. For the S7-200 processors, the 16-bit integer value of the
accuml,l1ator is addressed in the same manner. For all processors, the counter status bit is
addressed in the same way. The program determines which value to use by the type of the
instruction that uses the address. For the S7-300/400 processors, the IEC 61131-3 counter
function blocks do not use the counter area, but store the values in an instance data block.
The local (stack) data stores temporary program data. Each program unit (OB, FB, and
FC, subroutine) is allocated some space on the stack that is used as long as the unit is
executing. When programming a program unit one declares the temporary variables that are
allocated on the local stack. The size of the local data stack is dependent on the particular
processor and is generally not very large. Some S7-200 processors do not support L
 3.6 SIEMENS S7 MEMORY 125

memory. For the S7-300/400 processors, the space in the local data stack is normally
divided up equally among the priority classes. Thus every priority class has its own local
data area, ensuring that the higher priority classes and their organization blocks have some
local data space.
Normally, the local data is defined symbolically, though when addressed as an absolute
memory location; it may be accessed as bits, bytes, words, or double words similarly to M
memory except with an "L" prefix. If a symbol is defined for a particular local data element,
the progtarnrning software will not display the absolute address, but will always use the
symbol prefixed with a "#."
For S7-300/400 processors, the status word contains the status information about
logical and arithmetic operations. The entire word can be addressed as STW (but only by an
instruction list program). The more important individual bits in the status word are:
RLO Result of previous logic operation
OV Overflow
CCO Negative result
CC I Positive result
BR Binary result (built-in block executed correctly)

For S7-300/400 processors, shared data blocks are the preferred way of storing data
values that must be accessed by various program function blocks. An instance data block
is associated with a progtarnrned function block and is introduced in Chapter 5 as part of the
IEC timers and counters. Chapter 11 (function block programming) provides more detailed
information. When a shared or instance data block is created, it is given an address "DBn"
where n is a number. A symbolic name can also be associated with the data block. A shared
data block may be opened with the OPN coil or instruction (Figure 3.38). Only one shared
data block can be open, so opening a shared data block automatically closes any currently
open shared data block. Opening a shared data block is not required to access the data block,
it only shortens the address.
A sample data block declaration is shown in Figure 3.39. It appears similar to a
user-defined data type. When addressing the individual elements, the information in the
"Address" column shows the offset from the start ofthe data blo~k, as a byte and the starting
bit number. IfFigure 3.39 defines DB I, then absolute addresses for some ofthe elementary
data types are: .
DB1.DBXO.O Run
DB1.DBX1.0 Step_6
DB1.DBW2 Des_Torque
IfDB 1 was opened as a shared data block (with OPN), the "DB 1." in the above addresses is
not necessary. The individual elements of the Machine_Info data type (defined as in Figure
3.36) can be accessed symbolically by specifying the symbol of the structure instance

Glob_Data
---{(9PN)-
(a) (b)

Figure 3.38. Opening a S7 shared data block: (a) ladder logic; (b) instruction list.
126 Memory Organization and Addressing

Address Name Type Init. Value Comment

0.0 STRUCT
+0.0 Run BaaL FALSE
+0.1 First Start BaaL FALSE
+0.2 Int Reset BOOL FALSE
+0.3 Step I BOOL FALSE
+0.4 Step 2 BOOL FALSE
+0.5 Step 3 BOOL FALSE
+0.6 Step 4 BOOL FALSE
+0.7 Step 5 BOOL FALSE
+1.0 Step 6 BOOL FALSE
+1.1 Step 7 BOOL FALSE
+2.0 Des Torque REAL 10.5
+6.0 Machine "Machine Info"
=70.0 END STRUCT

Figure 3.39. Example shared data block definition.

(Machine in this example) followed by a decimal point and then the symbol of the structure
element. For example, ifthe symbolic name ofDB I is "Mach423," the following are valid:
"Mach423".Machine.Serial_Nurn
"Mach423".Machine.Shift_Faults
"Mach423".Machine.1n_Repair
To absolutely address the individual elements of the Machine structure in Figure 3.39, the
element offset must be added to the starting structure address to obtain the absolute address.
For example,
DB I.DBD6 Machine.Serial_Nurn
DB I .DBW64 Machine.Shift]aults
DBI.DBX68.1 Machine.In_Repair
For S7-200 processors, the variable memory area is larger than the general (M)
memory area. It may be accessed as bits, bytes, words, or double words similarly to M
memory except with a "V" prefix. The special memory area contains detailed information
about the processor status (Siemens, 2000). Some of the common status addresses are:
Address Description
SMO.O always on
SMO.I "first scan" flag, set if processor is executing ladder for first time
SMO.S 1.0 sec. timer contact
SMS.O on when any I/O fault
The sequence memory area is used by the sequence control relay instructions. The
accumulators are 4 addresses (ACO to AC3) that can be used to pass parameters to and
from subroutines and to store temporary calculation results. A high-speed counter is
addressed only as a double word and is read-only.
 3.6 SIEMENS S7 MEMORY 127

Term. Term.
120 v No.
Com
No.
PBI
10.0 Q20.0
--L 2 2
0-
'<t

PB2
--L
"
iZi
.S 10.1 Q20.1
"
iZi
.S PL2
3
" "3 " 3 "- /
"3 .",
.",
a a

FSI
::E
:; 10.2 Q20.2
~
-
;:l
B-
SOLI
4 .5 '" 0
;:l
4
B B
~ ~
u u

LSI is'" 10.3 Q20.3 is'" Pump I

5 5

, f , f • , f
V V v
Input Wiring Ladder Logic Output Wiring

Figure 3.40. S7-300/400 implementation of Figure 3.6 showing VO addressing.

3.6A Input/Output Addressing

For the S7-300/400 PLC, the physical VO channels have default addresses based on the
module placement. The default addresses can be changed by the user. The input image may
be accessed as bits, bytes, words, or double words, depending on the particular module. In
contrast, the S7-200 processors have a certain amount of discrete VO built-in to the
processor. In this case, the input and output image addresses are fixed. Certain S7-200
processors support expansion VO modules. In this case, the addresses of the physical VO
channels depend on the module placement and' on the types of modules installed to the left
of a given module.
A S7-300/400 implementation of the hardwired circuit of Figure 3.6 might appear as in
Figure 3.40. The switches are connected to channels 0 through 3 of a discrete input module
and the lights, solenoid, and motor are connected to channels 0 through 3 of a discrete
output module. The address of the input channel is shown with the contact in the ladder.
Normally, one defines a symbol that refers to the VO address and its symbol appears
enclosed in quotation marks on the listing. However, for the purpose of this example the
addresses are shown. The address "ID.2" means the contact is controlled by the discrete
input channel 2, in the module whose byte address is zero. In general, discrete input
channels are addressed as
!n.m
where n is the module byte address and m is the bit number, 0-7. Similarly, the address
"Q20.1" means the output (coil) is connected to output channell, in the module whose byte
address is 20. In general, discrete output channels are addressed as
Qn.m
where n is the module byte address and m is the bit number, 0-7.
 ,
128 Memory Organization and Addressing

Slot· 234 5 6 7 8 9 10 11
~

~>. 0 Uu
u_
u- '"'"u ~::I 0 4 8 12 16 20 24 28 Discrete
~c.. ~~
Rack 0 oc.. u uo
p-bl 0
~
.52 256 272 288 304 320 336 352 368 Analog
P-

I
~>.
Uu
u_
u- <l"!;l 32 36 40 44 48 52 56 60 Discrete
~c.. ~~
Rack I oc..
p-bl ]~ 384 400 416 432 448 464 480 496 Analog

I
~>.
Uu
u_
u- <l"!;l 64 68 72 76 80 84 88 92 Discrete
~c.. ~~
Rack 2 oc.. uo
-
p.,bl c::'1: 512 528 544 560 576 592 608 624 Analog

I
~>.
Uu
u_
u- <l"!;l 96 100 104 108 112 116 120 124 Discrete
~c.. ~~
Rack 3 00. uO

-
p.,bl c::'1: 640 656 672 688 704 720 736 752
.
Analog

Notes: Rack 0 only valid rack for CPU 312 IFM and CPU 313
Rack 3, slot 11 note valid for CPU 314 IFM

Figure 3.41. S7-300 default VO addressing.

Slot· 234 5 6 7 8 16 17 18
~>.
~
0 Uu
u_
Central u-
'" 0 4 8 40 44
~.g
Discrete
~o.
00.
'"
u
u BO
Rack p.,bl 0
p.,
~
512 544
-I
<:::'1: Analog

~>. 0 Uu
Expansion u-
il:o. '"'"u ~:g Discrete
ogo u
Rack p.,,,, e
p., 576 608 640 672 704
-
~~ Analog

Figure 3.42. Example S7-400 VO addressing.

The module starting byte address is allocated depending on its position in the chassis
(Figures 3.41 and 3.42). The number ofvalid addresses for a module depends on the number
ofchannels on the module. For example, an 8-channel discrete input module in slot 8 ofrack
oofa S7-300 system is addressed with I 16.0 to 116.7. A 32-channel discrete input module in
slot 6 of rack 2 is addressed with 172.0 to 175.7.
For S7-300/400 processors, analog (and other non-discrete) input modules may be
addressed as bytes, words, or double words as follows
 3.6 SIEMENS S7 MEMORY 129

IBn Byte n
IWn Word starting at address n
IOn Double word starting at address n
As for the discrete input modules, the analog module starting address depends on its
position in the chassis (Figure 3.41). Actually, discrete input modules can also be addressed
as bytes, words, or double words (depending on the number of discrete channels). For
S7-200 processors, analog input module channels are addressed as words with the format
"AIWn" where n is the starting byte number.
For S7-300/400 processors, analog and other types ofnon-discrete output modules may
be addressed as bytes, words, or double words as follows
QBn Byten
QWn Word starting at address n
QDn Double word starting at address n
For S7-200 processors, analog output module channels are addressed as words with the
format "AQWn" where n is the starting byte number.
For S7-300/400 processors, the information in the input and output modules can be
directly accessed as peripheral I/O data. Peripheral input data may be addressed as bytes,
words, or double words as follows
PIBn Byte n
PIWn Word starting at address n
PIOn Double word starting at address n
The module starting address is determined in the same manner as for the I/O image data.
Peripheral input data reflects the current input status and not the status as it was at the
beginning of the program scan cycle. Peripheral output data may be addressed as bytes,
words, or double words as follows
PQBn Byten
PQWn Word starting at address n
PQDn Double word starting at address n
Addressing outputs as peripheral data allows one to immediately change the current output
state instead of walting until the end of the program scan cycle.
The S7-300 and S7-400 processors have slightly different default slot addresses. For
the S7-300 processors, the default address extends to the expansion chassis (Figure 3.41).
For the S7-400 processors, there is no default addressing. Each discrete module is allocated
four bytes and the first discrete module is assigned a starting address of zero. Each analog
module is allocated 32 bytes and the first analog module is assigned a starting address of
512. An example addressing scheme for S7-400 processor with an expansion chassis is
shown in Figure 3.42.
Discrete input and discrete output module channels are addressed in groups of 8
channels. Each group is the offset from the module start address. For example, a discrete
output module having 16 channels has two groups of 8 channels (Figure 3.43a). If the
module starting address is 32, group 0 channels are addressed as Q32.0 through Q32.7. The
group I channels are addressed as Q33.0 through Q33.7. As another example, a discrete
input module having 32 channels has four groups of8 channels (Figures 3.43b and 3.42c). If
130 Memory Organization and Addressing

Bit

~"
~ 0
Byte n -
E
7

~
o

Byte n+l ~
Bit " 7 Bit Bit

~
o
Byten ~0
~7
Byten+2 ~
" 7
By". ~: O~ 7 "
~ Byten+2

~
o

~
o

~
o

Byte n+l ~ Byten+3 ~ Byten+1 ~ O~~ Byten+3

" 7 " 7 " 7 7 "

(a) (b) (c)

Figure 3.43. Discrete module bytes: (a) 16 channels; (b) 87-400 32 channels; (c) 87-300
32 channels.

the module starting address is 36, group 0 channels are addressed as 136.0 through 136.7.
The group 3 channels are addressed as 139.0 through 139.7.
Analog input and analog output module channels are addressed as words. The address
for a particular channel is related to the channel number as:
(Address for channel #) = 2 x (Channel #) + (Module start address)
For example, if the module start address for an analog input module is 288, ihe value for
channel 0 is addressed as IW288 and the value for channel 7 is addressed as"IW302.
Example 3.4. Draw a 87 ladder diagram that will cause the output, pilot light PL2, to be on
when selector switch 88 I is closed, push button switch PB5 is open, and limit switch L87 is
open. 8how the VO addresses in the logic. The input/output devices are wired to the
following locations:
PL2: Output module, central rack slot 8, group I, channel 7
module start address is 16
881: Input module, expansion rack slot 7, group 0, channel 5
module start address is 44
PB5: Input module, expansion rack slot 5, group 1, channell
module start address is 68
L87: Input module, local rack slot 6, group 1, channel 0
module start address is 8
Solution. The addresses are,
 3.7 GE FANUC MEMORY 131

Figure 3.44. Solution to Example 3.4.

PL2: Q17.7 Byte addr. = 16 + (group) 1=17

SSI: 144.5 Byte addr. = 44 + (group) 0 = 44
PB5: 169.1 Byte addr. = 68 + (group) I = 69
LS7: 19.0 Byte addr. = 8 + (group) I = 9

The ladder logic is shown in Figure 3.44. The addresses are shown above the contact
and coil instructions.

3.7 GE FANUC MEMORY

3.7.1 Memory Organization

The memory ofGE Fanuc Series 90 (90-70, 90-30, Micro) and VersaMax processors is
organized as shown in Figure 3.45. The model is much simpler than the IEC 61131-3
memory model. Each of the main elements is now described.
The project is the entire body of software (program and data) that corresponds to one
PLC. The project corresponds to the combination of the configuration, resource and
program ofIEC 61131-3. Basically, GE Fanuc PLCs support one single cyclically running
program inside one single resource inside the configuration.

Project

. Program Configuration
Data
Main Block
MAIN User Data
I/O

Internal
Variables

Global ~+-.... Other

~=:D:a=ta==J Processors

Figure 3.45. GE Fanuc memory model.

132 Memory Organization and Addressing

The configuration data contains such items as the PLC processor model, VO map,
communication interfaces, remote I/O connections, and data memory allocation.
Configuration data is not accessible to the program.
A program generally consists of one main block (named _MAIN). The main block can
call other program blocks, which are subroutines. Each block (including _MAIN) may be
written in anyone of the following languages:
Ladder Diagram (LD)
Instruction List (IL)
The state transition and C programming languages may also be used, but are not covered by
this text.
The user data is the location for all variables and can be accessed by any program
block. For the 90-70 processors, one can define local registers that are accessible only to a
subroutine block. Global data references are used to access data in other processors.

3.7.2 Program scan

The _MAIN block program execution is basically the same as introduced in section
2.5. The physical inputs are read, the program is scanned from top to bottom, and the
physical outputs are written. Normally, the program scan executes as quickly as possible,
which means it typically varies. The processor can be configured to initiate the scan at a
constant time interval, but this interval should be longer than the maximum program scan
time to prevent a processor oversweep fault.

3.7.3 User data memory

In the OE Fanuc processor, data may be addressed as a symbolic variable or as an

absolute address. Though only absolute addresses are required to construct a program, it is
not recommended. Therefore, a variable symbol is associated with each absolute address in
a program. The format of the absolute addresses is explained after first describing the
variables and the various data types.
In OE Fanuc PLCs, the variable is the same as the lEC 61131-3 identifier. The
symbolic name of a variable can be any string of letters, digits, and underlines up to 32
characters long provided that:
I. The first character is not a digit.
2. There are not two or more consecutive underlines.
These rules comply with the lEC 61131-3 naming convention. In accordance with IEC,
there is no distinction between upper and lower case characters.
The symbolic name and description for each address is maintained separately on the
programming device and this variable table does not reside in the controller. Therefore,
when connecting to a OE Fanuc processor in order to examine the online operation of the
program, the connecting computer must also have the project file in order to display the
symbols with the program addresses.
When a symbol is declared, it must be assigned a data type. The simple data types are
as follows:
 3.7 GE FANUC MEMORY 133

Description Range of values

BOOL I-bit Boolean O=cleared, I=set
BYTE 8-bit 0 to FF hexadecimal
WORD 16-bit 0 to FFFF hexadecimal or -999 to 999 BCD
DWORD 32-bit 0 to FFFFFFFF hexadecimal
INT 16-bit integer -32,768 to 32,767
31 31
DINT 32-bit integer -2 to 2 -I (-2,147,483,648 to 2,147,483,647)
DINT 16-bit integer 0 to 65,535
38 38
REAL 32-bitfloat.pt. 1.17510 to 3.40310+
STRING ASCII text up to 82 characters
BCD-4 4-digit BCD 0 to 9999
BCD-8 8-digit BCD 0 to 99,999,999
The REAL data type is valid only for processors that support floating-point operations.The
BCD-8 data type is valid only for the 90-70 processor. The ability to examine a bit in an
integer is provided as a standard function block.
Constants are used to directly provide values for inputs of function blocks, transition
conditions, and so on. These values cannot be overwritten by the program logic. Constants
are also used to assign an initial value to a variable.
The BOOL (boolean) data type has the constants 0 (false) and I (true). Constants for
the integer data types can be expressed as an integer constant, base 2 constant (binary),
base 8 constant (octal), or base 16 (hexadecimal) constant. The formats are as follows:
Constant Examples
integer -12,0, +23,14_639
base-2 2# III (7 decimal)
2#IOll_00ll (179 decimal)
base-8 8#177 (127 decimal)
8#2001 (1025 decimal)
base-16 16#FFFF (65,535 decimal)
16#AA (170 decimal)
Constants for the REAL type may be expressed as normal decimal numbers,
5.341, +14_639.7, -0.0041
or with "E" indicating the tens' exponential value,
7.45£-12, 1.27E+04, 1.27E04.
A STRING data type is an array of ASCII characters. A string is stored in 16-bit
registers, two characters in each register (Figure 3.46). The maximum size of a STRING is
82 characters. In the GE Fanuc processors, strings are merely stored for use by an HMI since
there are no ladder logic instructions that manipulate string variables.
The memory of the GE Fanuc processors is divided into address areas identified by one
or more letters followed by a number (Table 3.2). All areas except for the local areas are
accessible by all program blocks. The amount of available memory areas depends on the
specific processor.
134 Memory Organization and Addressing

1'''-----,------\' 1'''--- ----',1 1",'_ _- - - - - ' , 1

LI --:-:-::,.----'---:----,1 • .. I I I~~ ----:::---,1
Null Last Second Third Second First
character character clw'acter character character character
''-----,vr----..J' ''-----,vr----..J'
%Rn+x %Rn+/ %Rn

Figure 3.46. Structure ofGE Fanuc STRING data type.

Table 3.2 GE Fanuc Addresses.

Letter Addressed
Memory Type Notation As
General Bit M %Mn
Memory Temporary bit T %Tn
Register (word) R %Rn
Program Register (word) p* %Pn
Local Register (word) L* %Ln
Global G %Gn
GA* %GAn
GB* %GBn
GC* %GCn
GD* %GDn
GE* %GEn
Status S %Sn
SA %SAn
SB %SBn
SC %SCn
Input Image Bit I %In
Analog (word) AI %AIn
Output Image Bit Q %Qn
Analog (word) AQ %AQn

*.Only available for 90-70 processors

The format of each type of address is now explained. The format ofthe input and output
data addresses are explained in section 3.7.5.
Individual bits (coils) in general memory are addressed as
%Mn
where n is the bit number. Temporary bits (coils) are addressed as
%Tn
where n is the bit number. Temporary bits are never checked for repeated coil references
and thus can be used many times in the same program. These bits are useful when cutting
and pasting groups of rungs so that repeated coil conflicts are not a problem. However,
temporary bits make troubleshooting more difficult. Temporary bits are never retained
 3.7 GE FANUC MEMORY 135

3~2 ..!.117 1~6 ....;1 Data type bit number

I
16
II
1 16
I
I Register bit number
Second word First word
%Rn+l %Rn
''- ~V-----------JI

DINT, DWORD, REAL, or BCD-8

(a)

987654321

(b)

Figure 3A7. GE Fanuc register storage: (aJ 32-bit data types; (bJ BCD-4 number.

through power loss or Run-to-Stop-to-Run transitions and cannot be used with retentive
coils.
The register (word) memory area is addressed as
%Rn
where n is the word number. The maximum word number depends on the processor. The
32-bit DINT, DWORD, REAL and BCD-8 data types occupy two consecutive register
addresses as shown in Figure 3.47a. For these data types, only the first register address is
specified. The second register address is assumed. For this reason, one needs to ensure that
32-bit values do not overlap. For example, if a REAL value has address %R234, then
%R235 should not be used by any other variable. A BCD-4 binary-coded decimal number is
stored in a register as shown in Figure 3.47b..
Program registers store program data from the _MAIN block and are addressed as
%Pn
where n is the word number. Program registers can be accessed from all program blocks.
Program register addresses are valid only for the 90-70 processors.
Local registers store program data unique to a block and are addressed as
%Ln
where n is the register (word) number. Local registers are accessible only from within the
program block where they are defined. Local register addresses are valid only for the 90-70
processors.
Global data references are used to access data shared among several processors and are
accessed as %G, %GA, %GB, %GC, %GD, or %GE. For the 90-70 processors, the global
data is 7680 bits in length. This space is subdivided into six 1280-bit arrays (Table 3.3), with
each space designated by a separate letter designation. For the other GE Fanuc processors,
only %G1 through %G 1280 are valid global data addresses. Other address types may also
be shared among processors.
136 Memory Organization and Addressing

Table 3.3 GE Fanuc Global Data Addresses.

Global
Data Address %G %GA* %GB* %Ge* %GD* %GE*
References %G! %GAl %GB! %GCl %GDl %GE1
used by to to to to to to
programming %G1280 %GAl280 %GB1280 %GC1280 %GD1280 %GE1280
software
Memory %G1 %G1281 %G2561 %03841 %G512l %G6401
locations to to to to to to
used in %G1280 %G2560 %G3840 %G5120 %G6400 %G7680
processor

*Only available for certain 90-70 processors

The status addresses contain detailed information about the processor status and the
specific information varies by the processor. Some of the common status addresses are:
Address Symbol Description
%SOOO1 FST SCN "first scan" flag, set ifprocessor is executing ladder for
first time
%S0005 T SEe 1.0 sec. timer contact
%S0007 ALW ON always on
%SOOO8 ALW OFF always off
%SAOOll LOW BAT low battery fault
%SeOOll 10 FLT on when any VO fault
The %S addresses may only be addressed as contacts. The %SA, %SB, and %Se addresses
may be referenced by set or reset coils.
Retentive data is saved by the processor when it is stopped. In the GE Fanuc processors
the following data is retentive:
Register data (%R, %P, %L, %A!, %AQ),
Bit dati (%1, %Se, %G), and
%Q and %M addresses when used with retentive coils
When used with non-retentive coils, %Q and %M addresses are non-retentive and are
cleared when the processor switches from the stop mode to the run mode. Temporary (%T)
addresses are also non-retentive. The retentive and non-retentive coils are described in
section 2.3.5.
The 8-bit, 16-bit, and 32-bit data types can also be assigned to bit memory (%G, %M,
%Q, and %T). In order to treat bit memory as a register, the bit number must be on 8-blt
boundaries, that is, the bit number must be one plus a multiple of eight (at 0000 I, 00009,
00017,00025,00033, etc.), as illustrated in Figure 3.48. Though the ability to examine a bit
in an integer is provided as a standard function block, none of the GE Fanuc processors
support addressing of individual register bits for the contact symbols. Many users find it
useful to store the result ofan integer operation in bit memory and then access the individual
 3.7 GE FANUC MEMORY 137

49 17 9 1 %M bit number

'~-
:::OIIIIIIII: ::J....J...J....J~ . . . . . . . ..l...J....l...L~
v,...--.J' ''-----,,,,------',
WORD starting at %M49 WORD starting at %M 1

WORD starting at %M9

Figure 3.48. Addressing bit memory as words.

bits using contacts. In like manner, individual bits in the integer can be set or reset with
coils.

3.7.4 Indirect References

In indirect referencing, the address for a particular location is contained in a register.

Indirect referencing is valid for all register addresses (%R, %AI, %AQ, %P, and %L) on
90-70 processors. Indirect addressing is identified by u@" in place of the U%" character.
Indirect referencing is useful for accessing arrays of registers. For example, in the indirect
address reference @ROOI02, the contents ofregister %RI 02 is the offset in the %R memory
that will be actually referenced. If%RI 02 contains 2010, then a data reference of@ROOI02
will direct the processor to use the register %R20 IO. The programmer must ensure that the
content of %RI 02 does not cause a reference beyond the number of valid registers, or the
processor will record this fault in the fault table.

3.7.S Input/Output Addressing

For GE Fanuc PLCs the physical I/O channels are associated with an address through
the I/O map. This I/O map is part of the configuration data and includes information for the
I/O modules in the same chassis as the processor and for I/O modules on the remote I/O or
other network.
AGE Fanuc PLC implementation of the hardwired circuit of Figure 3.6 might appear
as in Figure 3.49. The switches are connected to channels I through 4 of a discrete input
module and the lights, solenoid, and motor are connected to channels I through 4 of a
discrete output module. The address of the input channel is shown with the contact in the
ladder. Normally, one would use symbols for the I/O and the address would not appear on
the listing. However, for the purpose of this example the addresses are shown. The address
%100019 means the contact is controlled by (discrete input) address 00019, which is
channel 3 on the module in slot 4 (where channel I has been mapped to address %100017).
The mapping of the physical I/O to the %Ix number is specified as part of the I/O map. The
user specifies which number maps to the starting number on the I/O module. The numbers
are in decimal. Similarly, address %Q00036 means the discrete output (coil) is channel 4 on .
the module in slot 9 (where channel I has been mapped to address %Q00033).
When configuring the I/O Map, one specifies the type ofmodule in a slot and specifies
the starting address of the input reference (%Ix or %AIx) and/or the starting address of the
output reference (%Qx or %AQx). A discrete input module needs only the starting Ix
address. Similarly, a discrete output module requires only the starting Qx address. A module
that has both discrete input and discrete output channels requires a starting Ix and a starting
Qx address. An analog input module needs only the starting AIx address. An analog output
138 Memory Organization and Addressing

120 v Com
PBI
-----L %IOOOI7 %QOO033
I (
PB2
"<t

"
U5
-
'"
0
U5
-----L .5 %IOOOI8 %QOO034 .5
2 2
-a" I ( -a"
""
0 ""
0

-"
~
--"
~
SOLi
FSI
3
-"
0.

.B
!:!
u
%IOOOI9
I
%QOO035
( 0
0.

"
-""
!:!
3

LSI 6"' %IOO020 %QOO036 6"' Pump I

4 4
I (
, , , , , ,
v v v
Input Wiring Ladder Logic Output Wiring

Figure 3.49. GE Fanuc implementation for Figure 3.6 showing I/O addressing.

module requires only the starling AQx address. A module having both analog input and
analog output channels or an intelligent module, such as a high-speed counter or a motion
module, needs a starting AIx and a starting AQx address.
For inputlouput modules, the address for a particular channel is related to the channel
number as:
(Address for channel #) = (Channel #) - I + (Channel I address)
Figure 3.50 illustrates the I/O addressing in one chassis. Analog I/O and intelligent
modules generally use more AI and/or AQ memory than is required for just the data. For
example, the I/O map for a PLC chassis could appear as follows:
Slot Module Type Disc. In Disc. Out Ana. In Ana. Out
Power supply
I CPU
2 32 Ch. Disc. In. %100001
3 32 Ch. Disc. In. %IO0033
4 32 Ch. Disc. Out %QOOOOI
5 32 Ch. Disc. Out %Q00033
6 Din/Dout 16/8 %IO0065 %Q00065
7 Ana In/Out 4/2 %IO0081 %AIOOOOI %AQOOOOI
8 HS Ctr, 4 ch. %100089 %Q00073 %AIO0005
9 Ana In, 16 ch. %IOO105 %AIO0020
10 Ana In, 16 ch. %IO0145 %AI00036
 3.7 GE FANUC MEMORY 139

,., :; :;
:; :;
c. ~ e. B- e. B-
e.
::I
0
'"
.= 0
::I
.= ::I
0
CIl
"'" B B
""
~

"~ "e ~
" !:!
0
C;;
c
""
0
C;;
~
0'" " « c
0'"
0
~
-<
Module
SlllIt Address %100001 %QOOO33 %A100009 %Aoooo17
Chan. 1 %1‫סס‬oo1 %Q00033 'YoAI00009 %Aooool7
Chan. 2 %1‫סס‬oo2 %QOO034 %A100010 %AQOOOI8
Chan. 3 %100003 %QOO035 'YoAIOooll %AQOOOI9

Chan. 16 %100016 %000048 %A100024 %AQ00032

Figure 3.50. Example GE Fanuc I/O addressing.

Note that the analog input modules in slots 9 and 10 need 40 bits of %1 memory for status
information. The status information contains the status of the module and channel range
violation indications.
Example 3.5. Draw a GE Fanuc ladder diagram that will cause the output, pilot light
PL2, to be on when selector switch SS I is closed, push button switch PB5 is open, and limit
switch LS7 is open. Show the I/O addressing in the logic. The input/output devices are
wired to the following locations:
PL2: Output module, CPU baseplate, I/O slot 8, channel 16
channel I is reference address %QOO 113
SS I: Input module, expansion baseplate I, I/O slot 3, channel 5
channel I is reference address %I00289
PB5: Input module, expansion baseplate 2, I/O slot 2, channel 9
channel I is reference address %10040 I
LS7: Input module, CPU baseplate, I/O slot 6, channel 8
channel I is reference addri:ss %100209
Solution. First, determine the addresses of the devices. Applying the formula above,
Address for PL2 (channel 16) = 16 - I + %QOOI13 = %QOOI28
Address for SSI (channel 5) = 5 - I + 0/0100289 = %I00293
Address for PB5 (channel 9) = 9 - I + %100401 = %100409
Address for LS7 (channel 8) = 8 - I + %100209 = %100216
The ladder logic is shown in Figure 3.51. The addresses are shown above the contact and
coil symbols.

I %100293 %100409 %100216 %QOO128 I

H f---1 / f------l / l-----l( H
Figure 3.51. Solution to Example 3.5.
140 Memory Organization and Addressing

3.8 CHAPTER SUMMARY

This chapter summarized the organization and addressing of the memory and I/O for
the PLCs covered by this text. With the basic PLC knowledge from Chapter 2 and the
knowledge about the internal organization of the PLC, one is ready to tackle timers and
counters, the most common block instructions.

REFERENCES
Allen-Bradley, 1995. Classic 1785 PLC-5 Family Programmable Controllers:
Hardware Installation Manual, pub. 1785-6.6.1, Allen-Bradley, Milwaukee, WI.
Allen-Bradley, 1998. Classic SLC 500™ Modular Hardware Style: Installation and
Operation Manual, pub. 1747-6.2, Allen-Bradley, Milwaukee, WI.
GE Fanuc Automation, 1999. Series 90™_301201Micro PLC CPU Instruction Set:
Reference Manual, pub. GFK-0467L, GE Fanuc Automation North America, Inc.,
Charlottesville, VA.
GE Fanuc Automation, 2000. Series 90™_70 PLC CPU Instruction Set: Reference
Manual, pub. GFK-0265J, GE Fanuc Automation North America, Inc, Charlottesville, VA.
IEC, 1993. IEC 1131-3: Programmable Logic Controllers - Part 3: Programming
Languages, International Electrotechnical Commission, Geneva, Switzerland.
Rockwell Automation, 1998a. Enhanced and Ethernet PLC-5 Programmable
Controllers: User Manual, pub. 1785-6.5.12, Rockwell Automation, Milwaukee, WI.
Rockwell Automation, 1998b. Logix5550 Controller: User Manual, pub. 1756-6.5.12,
Rockwell Automation, Milwaukee, WI.
Rockwell Automation, 1998c. PLC-5 Family Instruction Set Reference Manual, pub.
1785-6.1, Rockwell Automation, Milwaukee, WI.
Schneider Automation, 1998. Concept User Manual, vol. 1, ver. 2.1, pub. 840 USE 461
00, Schneider Automation, Inc., North Andoxer, MA.
Siemens, 1996. System Software for S7-300 and S7-400 Program Design:
Programming Manual, pub. C79000-G7076-C506-01, Siemens AG, Niirnberg, Germany.
Siemens, 1998. S7-300 Programmable Controller Hardware and Installation:
Manual, Edition 2, 10/99, pub. EWA 4NEB 710 6084-02 01, Siemens AG, Niirnberg,
Germany.
Siemens, 1999. S7-400 and M7-400 Programmable Controllers Hardware and
Installation: Manual, Release 01, 7/99, pub. C79000-G7076-C424, Siemens AG,
Niirnberg, Germany.
Siemens, 2000. S7-200 Programmable Controller: System Manual, pub.
A5E00066097-02, Siemens AG, Nuemberg, Germany.
Siemens, 2002a. Configuring Hardware and Communication Connections STEP 7-
V5.2: Manual, Edition 1212002, pub. A5E00171229-01, Siemens AG, Nuernberg,
Germany.
Siemens, 2002b Programming with STEP 7 V5.2: Manual, Edition 1212002, pub.
A5EOOI71230-01, Siemens AG, Nuemberg, Germany.
Siemens, 2002c Working with STEP 7 V5.2: Getting Started, Edition 1212002, pub.
A5E00171228-03, Siemens AG, Nuernberg, Germany.
 PROBLEMS 141

PROBLEMS
P3-1. Draw a ladder diagram that will cause the output, solenoid SOL2, to be ON when push
button switch PB 1 is closed (pushed), and either limit switch LS2 or limit switch LS3 is
closed. Do this problem for the Modicon Quantum, ControlLogix, PLC-5, SLC-500, S7,
and/or GE Fanuc PLCs. Show only the VO address with the ladder contacts/coils.
a) For a Modicon Quantum, the input/output devices are wired to the following
locations:
SOL2: Output module, rack 1, VO slot 7, channel 11,
channel 1 is address 000113
PB 1: Input module, rack 2, VO slot 2, channell
channel 1 is address 100065
LS2: Input module, drop 1, VO slot2, channel 9
channell is address 100257
LS3: Input module, drop 1, VO slot 2, channell0
channel 1 is address 100257
b) For an Allen-Bradley ControlLogix, the input/output devices are wired to the
following locations:
PSOL2: Output module, chassis 'REM_2', slot 6, channel 10
PB 1: Input module, local chassis, slot 0, channel 0
LS2: Input module, chassis 'REM_I', slot 2, channel 8
LS3: Input module, chassis 'REM_I', slot 2, channel 9
c) For an Allen-Bradley PLC-5, the input/output devices are wired to the
following locations (use the single-line format). All numbers are octal.
SOL2: Output module, rack 2, VO group 6, channel 12
PBl: Input module, rack 0, VO group 1, channel 01
LS2: Input module, rack 1, VO group 2, channel 10
LS3: Input module, rack 1, VO group 2, channel 11
d) For an Allen-Bradley SLC-500, the input/output devices are wired to the
following locations (use the single-line format):
PSOL2: 'Output module, slot 27, channel 10
PB 1: Input module, slot 2, channel 0
LS2: Input module, slot 13, channel 8
LS3: Input module, slot 13, channel 9
e) For a S7-300/400 system, the input/output devices are wired to the following
locations:
SOL2: Output module, central rack slot 7, channel 11,
channel 1 is address 112
PBl: Input module, expansion rack slot 2, channel 1
channel 1 is address 64
LS2: Input module, central rack slot 2, channel 9
channel 1 is address 256
LS3: Input module, central rack slot 2, channell 0
channell is address 256
142 Memory Organization and Addressing

f) For a GE Fanuc system, the input/output devices are wired to the following
locations:
SOL2: Output module, CPU baseplate slot 7, channel II,
channel I is address 113
PBI: Input module, expansion baseplate slot 2, channel I
channel I is address 65
LS2: Input module, CPU baseplate slot 2, channel 9
channel I is address 257
LS3: Input module, CPU baseplate slot 2, channel 10
channel I is address 257

P3-2. Draw a ladder diagram that will cause the output, pneumatic solenoid PS4250, to be
ON when both push button switches PB425 I is open and PB4252 is closed, and either limit
switch LS4112 is open or limit switch LS4479 is closed. Do this problem for the Modicon
Quantum, ControlLogix, PLC-5, SLC-500, S7, and/or GE Fanuc PLCs. Show only the VO
address with the ladder contacts/coils.
a) For a Modicon Quantum, the input/output devices are wired to the following
locations:
PS4250: Output module, drop 2, VO slot 5, channel 13,
channel I is address 000097
PB425 I: Input module, drop I, VO slot 6, channel 3
channel I is address 100081
PB4252: Input module, drop I, VO slot 6, channel 4
channel I is address 100081
LS4112: Input module, drop 5, VO slot 8, channel 3
channel I is address 100369
LS4479: Input module, drop 3, VO slot I, channel 9
channel I is address 100129
b) For an Allen-Bradley ControlLogix, the input/output devices are wired to the
following locations:
PS4250: Output module, chassis 'REM_I', slot 5, channel 12
PB425 I : Input module, local chassis, slot 6, channel 2
PB4252: Input module, local chassis, slot 6, channel 3
LS4112: Input module, chassis 'REM_4', slot 8, channel 2
LS4479: Input module, chassis 'REM_2', slot I, channel 8
c) For an Allen-Bradley PLC-5, the input/output devices are wired to the
following locations (use the single-line format). All numbers are octal.
PS4250: Output module, rack I, VO group 5, channel 14
PB425 I: Input module, rack 0, VO group 6, channel 02
PB4252: Input module, rack 0, VO group 6, channel 03
LS4112: Input module, rack 4, VO group 8, channel 02
LS4479: Input module, rack 2, VO group I, channel 10
d) For an Allen-Bradley SLC-500, the input/output devices are wired to the
following locations (use the single-line format):
 PROBLEMS 143

PS4250: Output module, slot 14, channel 12 '

PB425I: Input module, slot 7, channel 2
PB4252: Input module, slot 7, channel 3
LS4112: Input module, slot 28, channel 2
LS4479: Input module, slot 17, channel 8
e) For a S7-300/400 system, the input/output devices are wired to the following
locations:
PS4250: Output module, expansion rack slot 5, channel 13,
channel 1 is address 96
PB425 1: Input module, central rack slot 6, channel 3
channel 1 is address 80
PB4252: Input module, central rack slot 6, channel 4
channel 1 is address 80
LS4112: Input module, expansion rack slot 8, channel 3
channell is address 368
LS4479: Input module, expansion rack slot I, channel 9
channel 1 is address 128
f) For a GE Fanuc system, the input/output devices are wired to the following
locations:
PS4250: Output module, expansion baseplate slot 5, channel 13,
channel 1 is address 97
PB425 1: Input module, CPU baseplate slot 6, channel 3
channel 1 is address 81
PB4252: Input module, CPU baseplate slot 6, channel 4
channel 1 is address 81
LS4112: Input module, expansion baseplate slot 8, channel 3
channel 1 is address 369
LS4479: Input module, expansion baseplate slot 1, channel 9
channel 1 is address 129

P3-3. Draw a ladder diagram that will cause the output, pneumatic solenoid PS6124, to be
ON when both push button switches PB6121 and PB6122 are closed (pushed), and either
limit switch LS6123 is open or limit switch LS6125 is closed. Do this problem for the
Modicon Quantum, ControlLogix, PLC-5, SLC-500, S7, and/or GE Fanuc PLCs. Show
only the I/O address with the ladder contacts/coils.
a) For a Modicon Quantum, the input/output devices are wired to the following
locations:
PS6124: Output module, drop 3, I/O slot 6, channel 12
channell is address 000081
PB6121: Input module, drop 2, I/O slot I, channel 8
channell is address 100033
PB6122: Input module, drop 2, I/O slot I, channel 9
channel 1 is address 100033
LS6123: Input module, drop 3, I/O slot 3, channel 6
144 Memory Organization and Addressing

channel I is address 100289

LS6125: Input module, drop 4, VO slot 6, channel 3
channell is address 100369
b) For an Allen-Bradley ControlLogix, the input/output devices are wired to the
following locations:
PS6124: Output module, chassis 'REM_2', slot 5, channel 12
PB612l: Input module, local chassis, slot 0, channel 7
PB6122: Input module, local chassis, slot 0, channel 8
LS6123: Input module, chassis 'REM_2', slot 4, channel 5
LS6125: Input module, chassis 'REM_3', slot 7, channel 0
c) For an Allen-Bradley PLC-5, the input/output devices are wired to the
following locations (use the single-line format). All numbers are octal.
PS6l24: Output module, rack 2, VO group 5, channel 14
PB6121: Input module, rack 1, VO group 0, channel 07
PB6122: Input module, rack 1, VO group 0, channel 10
LS6123: Input module, rack 2, VO group 4, channel 05
LS6125: Input module, rack 3, VO group 7, channel 00
d) For an Allen-Bradley SLC-500, the input/output devices are wired to the
following locations (use the single-line format):
PS6124: Output module, slot 26, channel 15
PB6121: Input module, slot II, channel 7
PB6122: Input module, slot 11, channel 8
LS6123: Input module, slot 23, channel 12
LS6125: Input module, slot 30, channel 0
e) For a S7-300/400 system, the input/output devices are wired to the following
locations:
PS6l24: Output module, expansion rack slot 6, channel 12
channel I is address 80
PB6121: Input module, expansion rack slot I, channel 8
channel 1 is address 32
PB6122: Input module, expansion rack slot I, channel 9
channel 1 is address 32
LS6123: Input module, expansion rack slot 3, channel 6
channel 1 is address 288
LS6125: Input module, expansion rack slot 6, channel 3
channel 1 is address 368
f) For a GE Fanuc system, the input/output devices are wired to the following
locations:
PS6124: Output module, expansion baseplate slot 6, channel 12
channel I is address 81
PB6l21: Input module, expansion baseplate slot I, channel 8
channel I is address 33
PB6122: Input module, expansion baseplate slot 1, channel 9
channel I is address 33
 PROBLEMS 145

LS6123: Input module, expansion baseplate slot 3, channel 6

channel I is address 289
LS6125: Input module, expansion baseplate slot 6, channel 3
channel I is address 369

P3-4. Draw a ladder diagram that will cause the output, pneumatic solenoid PSOL2, to be
ON when both push button switches PB I and PB2 are closed (pushed), and either limit
switch LS20 is closed or limit switch LSIOI is open. Do this problem for the Modicon
Quantum, ControlLogix, PLC-5, SLC-500, S7, and/or GE Fanuc PLCs. Show only the VO
address with the ladder contacts/coils.
a) For a Modicon Quantum, the input/output devices are wired to the following
locations:
PSOL2: Output module, drop 2, I/O slot 7, channel 11,
channell
. . is address 000129
PBI: Input module, drop I, I/O slot 4, channel 7
channel I is address 100065
PB2: Input module, drop I, I/O slot 4, channel 8
channel I is address 100065
LS20: Input module, drop 2, I/O slot 2, channel 2
channel I is address 100225
LS 101: Input module, drop 3, I/O slot 5, channel 16
channel I is address 100497
b) For an Allen-Bradley ControlLogix, the input/output devices are wired to the
following locations:
PSOL2: Output module, chassis 'REM_I', slot 5, channel 10
PB I: Input module, local chassis, slot 4, channel 6
PB2: Input module, local chassis, slot 4, channel 7
LS20: Input module, chassis 'REM_I', slot 2, channel 2
LSIOI: Input module, chassis 'REM_2', slot 5, channel 15
c) For an Allen-Bradley PLC-5, the input/output devices are wired to the
following 10catiOlis (use the single-line format). All nwnbers are octal.
PSOL2: Output module, rack 3, I/O group 5, channel 12
PB I: Input module, rack 2, I/O group 0, channel 07
PB2: Input module, rack 2, I/O group 0, channel 10
LS20: Input module, rack 3, I/O group 4, channel 01
LSIOI: Input module, rack 4, I/O group 7, channel 17
d) For an Allen-Bradley SLC-500, the input/output devices are wired to the
following locations (use the single-line format):
PSOL2: Output module, slot 7, channel 10
PB I: Input module, slot 21, channel 7
PB2: Input module, slot 21, channel 8
LS20: Input module, slot 14, channel I
LS 10 I: Input module, slot 17, channel 15
146 Memory Organization and Addressing

e) For a S7-300/400 system, the input/output devices are wired to the following
locations:
PSOL2: Output module, expansion rack slot 7, channel II,
channell is address 128
PBI: Input module, central rack slot 4, channel 7
channel I is address 64
PB2: Input module, central rack slot 4, channel 8
channel I is address 64
LS20: Input module, expansion rack slot 2, channel 2
channel I is address 224
LS 101: Input module, expansion rack slot 5, channel 16
channel I is address 496
f) For a GE Fanuc system, the input/output devices are wired to the following
locations:
PSOL2: Output module, expansion baseplate slot 7, channel II,
channel I is address 129
PB I: Input module, CPU baseplate slot 4, channel 7
channel I is address 65
PB2: Input module, CPU baseplate slot 4, channel 8
channel I is address 65
LS20: Input module, expansion baseplate slot 2, channel 2
channel I is address 225
LSIOI: Input module, expansion baseplate slot 5, channel 16
channel 1 is address 497
4 Input/Output Modules and Installation

Chapter Topics:

• Discrete input and output modules

• Analog input and output modules
• Specialized modules
• Installation wiring

OBJECTIVES

Upon completion of this chapter, you will be able to understand:

• Wiring of typical sensors and actuators to PLC VO modules
• Surge protection for certain types of devices
• Typical control cabinet layout
• Typical installation wiring

Scenario: Plug-chute switch problem.

In a power plant coal-handling system, a plug-chute switch is placed at the end of
conveyor belt and detects when coal is "piling up" and plugging the system. Obviously,
when a plug is detected, the conveyor should be immediately stopped.
A simplified diagram of the system is shown in Figure 4.1. The plug-chute switch is a
normally-closed Gontact that opens as the coal presses against a diaphragm. The switch wire
eventually reaches a terminal block in the control cabinet where it is wired to a PLC AC
discrete input module and to a time-delay relay. The PLC replaces a relay control system,
and the relay system is being dismantled but is still connected to many of the field sensors.
In the PLC program, the plug-chute switch is the input to a timer. The timer protects against
intermittent pieces of coal hitting the diaphragm and shutting down the system. The switch
must be open for 2 seconds before the conveyor is shut off.
Yesterday, one of the workers discovered a pile ofeoal around the end of the conveyor
and the chamber at the end of the conveyor was completely full of coal. Apparently, the
plug-chute switch had not stopped the conveyor.

Solution: After cleaning out.the coal, the conveyors are run without coal. The PLC properly
senses the closed plug-chute switch (or else the conveyor would not run). However, pushing
the diaphragm on the plug-chute switch does not stop the conveyor. The plug-chute switch
is replaced with a known good switch, and it still does not stop the conveyor when pressed.

147
148 VO Modules and Installation

Cabinet ___________ Plug Chute

Terminal : 1 Switch
_ _--,Ll Block PLC
AC Discrete : I
:~~OF
Plug-chute
switch R ~ Input Module : 2 sec.
Neu-M 1

j-----.
:~
~~
~
, ,
'---1-0c >,
•
H -......... :
8 "ii :
~~
Ncu N 0 1-' --_-
__"'_. J
I

Figure 4.1. Plug-chute switch wiring.

A broomstick is wedged in to constantly press the diaphragm. The PLC program operation
is then observed. The plug-chute input intermittently flashes offbut does not stay off longer
than 0.0 1 second. The intensity of the channel indicator lamp on the discrete input module is
about half of other discrete inputs that are on. At this point the problem is in one of three
places: the PLC module, the time-delay relay, or the wiring between the PLC and the
switch. Disconnecting the time-delay relay is the easiest thing to try, and so it is tried first.
When the time-delay relay is disconnected, the PLC correctly senses the open plug-chute
switch. Since the time-delay relay is no longer used, it is left disconnected.

4.1 INTRODUCTION
In order for a PLC to be functional, it must connect to the ''real world," involving
wiring to discrete, analog, and specialized field devices. This chapter describes these
connections and covers other installation issues such as power distribution and control
panel layout.
The input and output (VO) modules provide the physical interface between the PLC
processor and the field devices, such as switches, lamps, and valves. There are various types
of modules to handle the different types of sensors and actuators. Regardless of the type of
module, there are some common features: removable terminal blocks, isolation, and
diagnostic indicators.
All wiring to the VO module is connected to a removable terminal block, and the
terminal block is plugged onto the module. If the module must be replaced, the terminal
block is removed, the old module is removed, the new module is inserted, and the terminal
block is plugged onto the new module. This process of changing the module requires less
than a minute and does not involve rewiring the module, an important maintenance
consideration.
The VO modules provide isolation between the field wiring and PLC internal circuitry.
Figure 4.2 shows this isolation barrier in both the input and output module. Optical isolators
provide the isolation barrier, shown in the circuit diagrams in the succeeding sections. This
isolation is important since the field wiring is generally powered from a different circuit
and/or voltage level than the PLC processor. The PLC power supply provides low-voltage
powerto the right side of the input module and the left side of the output module. In addition
 4.1 INTRODUCTION 149

L1 (Line)
.r Isolation Barrier ~
Ll (Line)

~Neutral
PLC
Processor
Neutral
Power
Input Supply cn;tput
Module Module
L1 Neutral

Figure 4.2. Isolation between VO devices and PLC.

Active Active Active

o 8 o 8 o 8 FOFB
1 9 1 9 1 9 F1 F9
2 10 2 10 2 10 F2 F10
3 11 3 11 3 11 F3 F11
4 12 4 12 4 12 F4 F12
5 13
s 13 6 14 5 13 F5 F13
6 14 7 15 8 14 FB F14
7 15 Fuse 7 15 F7 F15

(a) (b) (c)

Figure 4.3. Example module indicators: (a) discrete input; (b) discrete output; (c) discrete
output with individual fuse indicators.

to providing the interface between the field and PLC voltage levels, the isolation prevents
ground loops and noisy electrical signals from interfering with the PLC operation.
Typically, there are also differences in the earth (ground) potential between the field wiring
circuits and the PLC power wiring. Also, during an abnormal event, such as a near lightning
strike, circuit commons that are normally at the same potential may have a short-tenn « I
second) potential difference. The isolation prevents damage to the PLC even if a surge
damages the module. For example, a wiring fault that causes 440-volt AC to be imposed on
a 24-volt DC input channel would only damage the input module. The PLC itself and the
other modules in the system will not be affected.
VO modules have indicators useful for troubleshooting. For example, discrete input
modules have one indicator for every channel that is on when its corresponding input
channel is on (Figure 4.3a). Similarly, discrete output modules have one indicator for each
channel that is on when the corresponding output channel is being commanded to turn on
(Figure 4.3b). A blown (open) fuse indicator on an output module may be turned on ifany
output fuse is open ("Fuse" in Figure 4.3b) or they may be an indication for each fuse ("Fx"
in Figure 4.3c). Modules may have indicators that turn on when the module is functioning
properly. For example, in Figure 4.3a, the "Active" indicator On a discrete input module
lights when the module is properly communicating with the processor. For a discrete output
module, the "Active" indicator may also indicate that the processor is in the run mode.
One aspect of PLC VO modules that is often confusing is the designation of a device
connection as being sinking or sourcing. Sinking and sourcing refer to the flow of current
(power) when the device is active. An output is called sourcing if current flows out when the
output is active. An output is called sinking if current flows in when the output is active. An
150 VO Modules and Installation

Sourcing Curre~ Sinking Sinking Surrent Sourcing

Field , PLC Field ....... PLC
Sensor Input Sensor Input

(a) (b)

Sourcing Curre~ Sinking Sinking .JCurrent Sourcing

PLC ,. Field PLC ..... Field
Output Device Output Device

(c) (d)

Figure 4.4. Sourcing and sinking connections: (a) sinking PLC input; (b) sourcing PLC
input; (c) sourcing PLC output; (d) sinking PLC output.

input is called sourcing if current flows out when ~e input is active. An input is called
sinking if current flows in when the input is active. Normally, a sourcing field sensor is
connected to a sinking PLC input (Figure 4.4a) and a sinking field sensor is connected to a
sourcing PLC input (Figure 4.4b). Similarly, a sourcing PLC output is connected to a
sinking field output device (Figure 4.4c) and a sinking PLC output is connected to a
sourcing field output device (Figure 4.4d). For DC devices, the arrows in Figure 4.4 indicate
the direction of current flow when the field sensor or PLC output is active (on). For AC
devices, the arrows indicate the direction of power flow.
Only the basic operation of the modules is described. Many older VO modules have
switches and/or jumpers that set up, or configure, the module to operate as desired. Most
newer va modules have an included microprocessor and so the configuration parameters
are set up with the PLC programming software. For discrete modules, the configuration
information consists of such items as channel filter time constants, on-to-off transition
delay times, and off-to-on transition delay times. For analog modules, the configuration
information consists of such items as number of channels, type of channel (single-ended or
differential, current or voltage), data format (binary or BCD), voltage/current range, and
integer range.
Also, the process of configuring the PLC processor for the actual VO modules is not
presented. Some processors require the user to set switches that determine the modules in
each chassis position. For other processors, the user configures the types ofmodules that are
expected in each chassis slot as part of the PLC software setup. In this case, when thePLC is
placed in run mode, the processor verifies that the expected modules are present and
functioning before commencing the program scan. Other processors automatically identify
the VO modules that are present and adjust the VO scan accordingly.
Finally, the connection diagrams in this chapter are typical and are not specific to a
particular manufacturer. One should always refer to the manufacturer's documentation for
details.

4.2 DISCRETE MODULES

Since PLCs were originally developed to solve discrete sequential control problems,
discrete modules remain the largest .number of modules in a PLC system. Even though
 4.2 DISCRETE MODULES 151

PLCs are capable ofperfonning continuous control functions, their mainstay is still discrete
control.
There is a limited set of standard discrete voltage levels handled by discrete input and
output modules:
120 volt AC or DC 10 - 30 volt DC
220 volt AC or DC 20 - 60 volt DC
10 - 30 volt AC or DC 5 v digital logic
Historically, most discrete input/output signals in non-chemical control applications were
nominally 120 volts. Due to safety considerations, most chemical control applications used
24-volt signals. However, recent safe electrical work practices (National Fire Protection
Association, 2000) require protective clothing for electricians working on exposed wiring
having voltages higher than 50 volts. Because of these regulations, newer systems use
24-volt control signals, and many older systems are being converted to 24-volt signals.

4.2.1 Discrete Input Modules

A discrete input module senses the status of a device that has only two states, on/off,
open/closed, running/stopped, and so on. The most common discrete devices sensed by a
PLC module are some kind of a switch, for example,
Pushbutton Level Starter auxiliary
Selector Pressure Relay contact
Limit Position Zero-speed
Proximity Thumbwheel
The block diagram of a typical discrete input is shown in Figure 4.5. The optical
isolator provides electrical isolation between the field wiring and the PLC internal circuitry.
The electronic circuitry to the left of the optical isolator is powered from the field, and the
circuitry to the right of the optical isolator is powered from the internal PLC voltage source.
Each discrete input module has a threshold detector that senses when the input device is
on. Threshold sensing is different for sinking and sourcing modules. For sinking input
modules, the device is sensed on when the voltage produced by the input device is above a
minimum voltage, commonly called the "minimum on-state voltage." If the input device
produces a voltag\: below the "maximum off-state voltage," then the device is sensed to be
off. The maximum off-state voltage is less than the minimum on-state voltage. For example,
a 120-volt ACIDC sinking input module may have a minimum on-state voltage of 80 volts
ACIDC and a maximum off-state voltage of45 volts ACIDC. A 24-volt DC sinking module
may have a minimum on-state voltage of 10 volts and a maximum off-state voltage of 6
volts. Obviously, module operation is not guaranteed if the device produces a voltage
between the maximum off-state and minimum on-state voltages. For sourcing input

Input - Bridge - Noise and f - Threshold - Optical f--

Signal - Rectifier
'-------y------
- Disturbance f - Detector
- PLC
Isolation f--
'----v-:-"
ACTypes Electncal
Only Isolation

Figure 4.5. Discrete input module block diagram.

152 va Modules and Installation

modules, the device is sensed on when the voltage produced by the input device is below a
maximum voltage, commonly called the "maximum on-state voltage." If the input device
produces a voltage above the "minimum off-state voltage", then the device is sensed to be
off. For example, a 24-volt DC sourcing module may have a maximum on-state voltage of
14 volts and a minimum off-state voltage of20 volts.
The circuitry of a typical AC discrete input module, along with connections to typical
input devices, is shown in Figure 4.6. The capacitor and resistors Rl and Rz form a simple
noise filter. The bridge rectifier converts the AC to full-wave rectified DC. The resistor R)
and the zener diode (OJ form the threshold detection. An optoisolator, consisting of a
light-emitting diode and a photoelectric transistor, provides electrical isolation between the
field wiring and the PLC internal circuitry. When a switch is closed, producing an input
voltage of sufficient magnitude, current flows through the light-emitting diode in the
optoisolator, generating light and triggering current flow through the photoelectric
transistor which is sensed by the PLC digital logic. For fault diagnosis, an input state
indication is on when the input switch is closed. This indicator may be on the field wiring
side of the optoisolator or may be on the PLC side of the optoisolator. Input modules that
handle AC signals are typically sinking modules, that is, power flows into the module when
the field device is on. This module can also handle DC voltages.
The module shown in Figure 4.6 has one common connection for all channels. This
common is the return path for all of the input devices. Some modules provide multiple
commons, for example, one common for every four input channels. Other modules provide
isolated channels, that is, the common of each channel is separated from the other channel
commons. Isolated channels or multiple commons are needed when
1. Mixing voltages on the same module.
2. Mixing different AC phases on the same module. This is especially needed when
the 3-phase plant wiring is in a delta configuration.
3. Mixing AC and DC circuits on the same module.
There may be a problem when connecting a solid-state sensor with a triac-type output
to an AC discrete input module. This sensor produces a small leakage current even when the
device is off. Unfortunately, this leakage current may be large enough to trigger the input

L1
(Line) Tenninal
Strip
Input
Fuse
Filter
Rectifier Indication
R1 ~ V+
Threshold ["0;;;;;:"1
C Detect i isolator
>-T--filt----'':-, ...L..--I-,
To other PLC
input devices Digital
Logic
Neutral
L.----l---..-.----+-J ,
ACCnmmon Common to all input channels
~ ''----------~v~---------~/
Field Wiring PLCModuie
~ Power flow when device on

Figure 4.6. Typical AC discrete input channel.

 4.2 DISCRETE MODULES 153

Solid-
Slllte
Sensor
L
AC Discrete Input
PLC Module
, ,,
,,,
N
,
,, ,,,
L------------A~C~C-omm--o~o~--------------------,

Figure 4.7. Using bleeder resistor with solid-state sensor.

module channel. In this case, a bleeder resistor is added as shown in Figure 4.7 to "bleed"
the leakage current to the AC common. The bleeder resistor assures that the PLC input
channel senses the on state of the device only when the device is truly on.
Figure 4.8 shows circuitry of a typical sinking DC discrete input module channel.
Connections to typical switches and a 3-wire sensor are also illustrated. The two resistors
fonn a simple threshold detector, and the capacitor is a simple noise filter. The diode D I
provides protection for the optoisolator in case the DC power supply polarity is accidentally
reversed. When a switch is closed, current flows through the optoisolator LED and is sensed
by the PLC digital logic. The 3-wire sensor (having a PNP transistor output) is a sourcing
device. When active, the PNP output transistor conducts, causing current to flow into the
discrete input channel and then be sensed by the PLC logic. The module shown in Figure 4.8
has one DC common connection for all channels. Some modules may provide one DC
common connection for a group of channels, for example, four or eight channels. lsolated
channels may also be used and are discussed below.

DC Power
Supply Input
Terminal Indication
+ Strip
Threshold v+
9
, Fuse Detect
~ .~l Filter
~I- .. 1 PLC
CF::::;'l---r->------o~ o----!lS1I ~R2 ~~Dl fC
+ -< 3-wire sensor
(pNP out)
Digital
Logic

---L--~Dut-------:~t"--li.-
- Ou' ~~::::
I~Sam~e~c~irc~u~it~as~abo~v~e:J1
~
DC Common o..ll....Jl: Common to all mput channels
''-------~vr------..J/ ''-----------------,vr----------------~/

Field Wiring PLC Module

- - . . Current flow when device on

Figure 4.8. Typical sinking DC discrete input channel.

154 va Modules and Installation

DC Power
Supply

+
··
r------
,
·~ Sinking DC
<. R Discrete
•, ~:~ eq
,,,
Module
,,
r-f1----<~_=~ __ __._: I
3·wire sensor
(NPN out)

Figure 4.9. Connect a sinking sensor to a sinking DC discrete input channel.

It is possible to connect a sinking field input to a sinking DC discrete input channel with
a pull-up resistor or interposing relay, as shown in Figure 4.9. The interposing relay is less
reliable and introduces an additional delay that may be unacceptable for a rapidly switching
discrete device. A pull-up resistor is less expensive, but may not be possible if there is no
resistor that satifies the criteria below. The pull-up resistor (RpJ in Figure 4.9 ensures the
voltage sensed by the input channel is sufficiently high when the device is ofT. When using
the pull-up resistor, the PLC state ofthe input is opposite to the input sensor state. When the
sensor is on, the PLC detects it as ofT since the voltage at the discrete input channel is below
the threshold for detection of the on state. When the sensor is off, the PLC detects it as on
since the pull-up resistor ensures the voltage at the input channel is above the threshold
voltage. When specifying the value of R pu , it must be selected so
I. The voltage at the PLC discrete input is above the minimum on voltage when the
device is off (inactive), and
2. The sinking current into the device is always below a maximum value.
These criteria specify the minimum and maximum value of Rpu . In equation form, the
first criterion means
Rrq v+ - v,;,
V
on
=v+ R +R >V/horR <R
P'"
(4.1)
P' rq

where V+ is the power supply voltage, Req is the equivalent i~put resistance of the input
channel, and Vlh is the minimum "on" state voltage of the input channel. In order to
accommodate situations when the power supply voltage is degraded, the minimum power
supply voltage should be used in (4.1). In equation form, the second criterion means

I = v+-v . out,nun <I R V+-VQut,mIn.

(4.2)
d R, d,max or pu > I
.... )1 d.max

where ld,max is the maximum device sink current and Vaul,min is the minimum output voltage
of the sensor when it is active. In order to accommodate a worst-case scenario, the
 4.2 DISCRETE MODULES ISS

maximum power supply voltage should be used in (4.2). Combining equations 4.1 and 4.2
to specify the acceptable range of the pull-up resistor,
v:+max - V
,"<nun
.
<R <R
v:+."'''' - v.:/h (4.3)
I
~~
P" "Iv.: ~

where v.:m and V"max are the minimum and maximum power supply voltages, respectively.
In general, the largest acceptable resistance will be the best since it will require the smallest
power rating.
Example 4.1. Specify an acceptable value and power rating of a pull-up resistor to be used
to connect a sinking sensor device to a PLC sinking discrete input channel. The power
supply is nominally 24 volts, but can range between 23 and 25 volts, depending on the
current draw. The minimum "on" state voltage of the discrete input channel is 10 volts, and
the equivalent input resistance is 2500 ohms. The maximum device sink current is 20 rnA,
and the minimum device output voltage is 0.3 volts.
Solution. The values to be used in equation 4.3 are:
v+max = 25 R"I = 2500 Id,max = 0.02
v.:m = 23 v.:/h-- 10 v,u<rnin = 0.3
Substituting into (4.3),
25- 0.3 < ~ < 2500 23-10
0.02 ''pu 10
1235 < ~ < 3250
If the standard 5% tolerance resistor of 3000 ohms is selected, its range of 2850 to 3150
ohms is acceptable. The required power rating is determined by squaring the maximum
voltage across the resistor and dividing it by the minimum possible resistance,

p = (25- 0.3)2
0.214 watts
". 2850
Therefore, a 3000 ohm resistor with a 1/4-watt power rating must be used.
The circuit for a typical sourcing DC discrete input channel is shown in Figure 4. i O.
Note that when a switch is closed, current flows out of the discrete input module. The two
resistors form a simple threshold detector, and the capacitor is a simple noise filter. The
diode Dl provides protection for the optoisoiator in case the DC power supply polarity is
accidentally reversed. When a switch is closed, current flows through the optoisolator LED
and is sensed by the PLC digital logic. The 3-wire sensor (having a NPN transistor output) is
a sinking device. When active, the NPN output transistor conducts, causing current to flow
into NPN collector (and out of the discrete input channel). The fuse shown internal to the
module mayor may not be present. If an internal fuse is not provided, one should be
provided external to the module. The module shown in Figure 4.10 has one DC power'
supply connection for all channels. Some modules may provide one power supply
connection for a group of channels, for example, four or eight channels. Isolated channels
may also be used and are discussed below.
It is possible to connect a sourcing field sensor to a sourcing DC discrete input channel.
In this case, an interposing NPN transistor or relay is added as shown in Figure 4.11. When
using a transistor, the NPN transistor Ql conducts when the device is on, causing current to
156 I/O Modules and Installation

Input
Indication
DC Power Terminal •......... __ ...., v+
Supply Strip
r--.:::;D",C':'+_~~,r<)-C_ornm..,.. on to all input channels ! Opto- !
+
'---1~~-~---+,
isolator i
PLC
C Digital
Logic
Threshold Detect Filter

+ r--:lt~o:ut;:~~~=ii---[s~am~e~c~irc;u~it~a~s~ab~o~ve~
3-wire sensor
(NPN out)

~,::=~~v~---'/ '~-----~v~----_.......-J/
Field Wiring PLC Module
~ Current flow when device on

Figure 4.10. Typical sourcing DC discrete input channel.

flow out ofthe discrete input channel. This approach is not recommended because (I) many
maintenance electricians will have trouble diagnosing device and/or PLC channel problems
and (2) a replacement transistor may not be readily available. An interposing relay is a better
approach from the maintenance standpoint. However, the interposing relay introduces an
additional delay that may be unacceptable if the output changes rapidly. An even better
approach is to use isolated discrete input modules ifboth sourcing and sinking input devices
must be connected to the same discrete input module.
Isolated discrete input modules are most useful when sourcing and sinking input
devices must be connected to the same discrete input module. As shown in Figure 4.12,
isolated DC discrete input channels may be wired for either sinking or sourcing operation.
The channels do not share either DC power or DC common.

DC+

3-wire sensor Sourcing DC

+ (PNP au')
Discrete Module
Out
R(

Figure 4.11. Connecting a sourcing sensor to sourcing DC discrete input channel.

 4.2 DISCRETE MODULES 157

r···············, v+
sourcing sensor Terminal i Opto- i
! isolator_Ji~--,----,
-<
(pNPout) Strip R1
,----,+ Fuse 'yA'v-··..,...-....,..--l~---.,,.,
V
» _ PLC
DC Power ..0... ~
L~Su!pp~ly~:---l
+
5>R2 u D 1 r C -
Digital
~-~
.---------,
+-~Ou~t~~'~-r~
Same circuit as above I
_
Logic

DC Pow + Fuse~ t+ ---.:/ Oul

Supply _ 'It,
sinking: sensor
(NPN out)

Figure 4.12. Isolated DC discrete input module for mixture of sinking and sourcing input
devices.

Thousands Hundreds Tens Units

~ ~ ~ ~
DCPowerd
Supply f -

DC
Common
1514'312 111091 1 6 S 4 ) 2 t 0 Channel Number

Figure 4.13. Thumbwheel switches connected to DC discrete input module.

Thumbwheel switches can be connected to multiple DC discrete input channels to

allow inexpensive operator input of numerical values. Figure 4.13 shows four thumbwheel
switches, each with four connections to a discrete input module. A sinking DC discrete
input module is -shown, but a sourcing module can be used by connecting the DC- power
supply connection as the common to the thumbwheel switches and connecting the DC+
power supply to thl: DC+ terminal of the module. In either case, the 16-bit discrete input is
read as a 4-digit binary-coded decimal (BCD) value. Some manufacturers have special
modules that have multiplexing and handle three or four groups of four thurnbwheel
switches. In this case, each group of four digits is handled in a manner similar to analog
input cards. That is, each group of digits is a BCD number.
Most PLC vendors also provide a discrete input module that handles 5-volt TIL
(transistor-transistor logic) devices. This type of module is generally used for discrete
sensors that produce 1TL-level signals. This module is often required to receive numerical
output from specialized equipment. For example, the thickness reading from a
high-precision thickness-measuring device could be presented as 32 TIL signals,
representing 8 BCD digits.

4.2.2 Discrete Output Modules

A discrete output module switches a device that has only two states, on/off,
open/closed, and so on. Common discrete devices controlled by a PLC are,
158 va Modules and Installation

Indicating lamps Motor starters Heater relay

Alarm lamps Electric valves Control relays
Alarm horns Solenoid valves
Annunciators Electric fans
The voltage ranges are basically the same as for the discrete input modules, except that
the AC discrete output modules can only handle AC signals and DC output modules can
only handle DC signals. Only relay output modules can handle either AC or DC signals.
The block diagram of a typical discrete output is shown in Figure 4.14. The optical
isolator provides electrical isolation between the PLC internal circuitry and the field wiring.
The electronic circuitry to the left of the optical isolator is powered from the internal PLC
voltage source and the circuitry to the right of the optical isolator is powered from the field.
In the case of a relay output module, the optical isolation is not needed since the isolation is
provided by the relay. Except for relay output modules, the switch on all other discrete
output modules is not perfect and introduces a voltage drop. Depending on the actual
circuitry, this voltage drop will range from 0.3 to 2 volts. This voltage drop reduces the
voltage available to drive the actuator connected to the discrete module.
The circuitry of a typical AC discrete output module, along with connections to typical
output devices, is shown in Figure 4.15. The capacitor and resistOr RI form a filtered DC
power source for the field side of the optoisolator and triac trigger. Resistors R2 and R) are
the trigger for the triac, which is a bilateral AC switch. The triac trigger often has a

P~ isolation
Opti~al ~ . h
SWlte ~ Output
Signal

~
Electrical
Isolation

Figure 4.14. Discrete output module block diagram.

Output
Indication
Y+ ~ ... _---:.- .. _- .... Switch Terminal
R 1 (Triac) Strip L 1 (L.me)

PLC
Digital MOY
Logic LNI---i Output
L-.._.r... = : Device

Triac
, ,
I \' I

Trigger
--~",\,--
L2
Bleeder (Load)
Resistor

'~------------.,vr--------~/ '~--~vr----'/

PLC Module Field Wiring

Power flow when output on - - . .

Figure 4.15. Typical AC discrete output channel.

 4.2 DISCRETE MODULES 159

zero-crossing detector so that the triac is switched on when the AC waveform is close to
zero. This feature prolongs the life of the triac. The MOV (metal-oxide varistor) suppresses
high-voltage transients from the AC source. When the PLC logic turns on the light-emitting
diode in the optoisolator, current flows through the photoelectric transistor and triggers the
triac. When the triac is triggered, it conducts AC current in either direction. After it is
triggered, the triac will continue to conduct current until the next zero crossing of the AC
source. A triac cannot be used to switch a DC signal since the triac continues to conduct
current until the DC power source is turned off. For fault diagnosis, an output state
indication is on when the PLC is commanding the output switch (triac) to conduct power to
the output channel. This indicator may be on the field wiring side of the optoisolator or may
be on the PLC side ofthe optoisolator. Output modules that handle AC signals are sourcing
modules, that is, power flows out of the module when the triac is on.
Figure 4.15 shows an optional bleeder resistor in parallel with the indicator lamp. A
triac-type output produces a srnallieakage current even when the triac is off. Unfortunately,
this leakage current may be large enough to trigger the output device. For example, this
leakage current causes neon indicator lamps to glow. The bleeder resistor "bleeds" the
leakage current to the AC common and assures that the output device S'enses the on state of
the output channel only when the PLC logic is turning it on.
If the load has a rectifying diode in series with a resistor or inductor (Figure 4.16a), a
shunt resistor should be added to allow proper operation of the PLC output channel. If the
shunt resistor is absent from Figure 4.16a, the circuit operation is described as follows.
When L 1 is positive with respect to L2, the capacitor is charged. When L2 is positive with
respect to L1, the diode prevents the capacitor from discharging. Therefore, the
zero-crossing detector will not detect a zero voltage due to the charged capacitor and the
triac will not be triggered when the PLC logic attempts to turn on the output. Reversing the
polarity of the load diode only changes the polarity of the charged capacitor voltage. The

PLC
Optoisolator Shunt Resis1Xlr
Digital
and triac trigger
Logic r-----------I
, L2
,
!._----------,
Load with
(a) rectifier

-------------------~

A~~Teut ~ ~~ L2
- -....., I

I
:

.!
~ Inductive load
--------------------jS&
(b)

Figure 4.16. AC discrete output channel suppression devices: (a) rectifier in load;
(b) driving contact in series with inductive load.
160 I/O Modules and Instal1ation

shunt resistor al10ws the capacitor voltage to bleed off, ensuring proper operation of the
zero-crossing detector.
If the output device is primarily inductive (for example, a relay coil or a pilot light with
step-down transformer) and is in series with or paral1el to a "hard contact" such as a push
button or selector switch, a suppression device (or snubber) should be added in paral1el with
the coil (Figure 4.l6b). The suppressor prevents arcing across the switch contact,
prolonging contact life.
The module may have a fuse for every output channel, or one fuse for a group of
channels. Even ifa fuse is provided for every channel, the maximum current that the module
can handle is generally less than the sum of the individual channel maximum currents. For
example, each channel of a certain l6-output module can handle a maximum of 2 amperes,
but the module can handle a maximum of 8 amperes. It is generally up to the user to ensure
the module current limits are met. The module may not have any built-in current limit
protection. In this case, violating the module current limit often causes the module to
overheat. Normal1y, the outputs will not each draw the maximum channel current, not will
all outputs be on simultaneously. Nevertheless, the user should consider the worst case
when choosing the output module.
There is a very definite reason why discrete outputs are typically sourcing: safety.
When the PLC is not in run mode or commanding the output to be off, there is no power at
the field device. This is the same reason that in residential or commercial wiring the switch
to control an overhead lamp is placed in the line (Ll) wire, not the neutral wire. When the
switch is in the off position, the lamp may be safely changed because the socket is
completely unpowered.
The circuit for a typical sourcing DC discrete output channel, including devices, is
shown in Figure 4.17. The optoisolator transistor switches a PNP power transistor to control
the output device. The diode D 1 provides protection for the circuit in case the DC power
supply polarity is accidentally reversed. When the PLC logic turns on the light-emitting
diode in the optoisolator, current flows through the photoelectric transistor and triggers a
PNP transistor. A field-effect transistor (FED may be used in place of the PNP transistor.
When the PNP output transistor conducts, current flows out of the discrete output channel.

Terminal
D1 Strip DC+
Output
Indication
V+

Switch
PLC : (Transistor)
Digital i .-
.-
Logic j

DC Common
''--------.,vr--------.J/ ''---~vr----'/

PLC Module Field Wiring

Current flow when output on - - .

Figure 4.17. Typical sourcing DC discrete output channel.

 4.2 DISCRETE MODULES 161

Diode D2 suppresses the negative voltage spike that inductive loads produce when they are
turned off. The fuse shown internal to the module may be common to all channels, or there
may be one fuse per channel. The module shown in Figure 4.17 has one DC power supply
connection for all channels. Some modules may provide one power supply connection for a
group of channels, for example, four or eight channels. Isolated channels may also be used
and are discussed below.
A sourcing DC discrete output module is normally used with sinking output devices.
However, a sourcing discrete output module can drive a sourcing output device by
interposing a transistor circuit or a relay, similar to that shown in Figure 4.11.
The circuit for a typical sinking DC discrete output channel and associated devices, is
shown in Figure 4.18. The only basic difference with the sourcing output module is that the
output switch is a NPN power transistor. A FET may be used in place ofthe NPN transistor.
Diode DI protects the circuit in case the DC power supply polarity is accidentally reversed.
When the NPN output transistor conducts, current flows into the discrete output channel.
Diode D2 suppresses the positive voltage spike that inductive loads produce when they are
turned off. As for the DC sourcing discrete output module, the fuse shown internal to the
module may be common to all channels, or there may be one fuse per channel.
A sinking DC discrete output module is normally used with sourcing output devices.
However, a sinking discrete output module can drive a sinking output device by using a
pull-up resistor or interposing relay, similar to that shown in Figure 4.9. The pull-up resistor
value is determined in the same manner as when connecting a sinking sensor device with a
sinking discrete input channel.
Isolated discrete output modules are most useful when sourcing and sinking output
devices must be connected to the same discrete output module. As shown in Figure 4.19,
isolated DC discrete output channels may be wired for either sinking or sourcing operation.
A transformer provides the isolation so that power can be transferred across the barrier to
provide a positive gate voltage to the FET and thus allow current to flow from the drain to
the source. The channels do not share either DC power or DC common. An alternate way to
provide an isolated output with either a sourcing or sinking discrete module is to use an
output channel to drive a relay. The relay contacts provide an isolated output.

Tennma
. I
D1 Strip DC Power
DC+
Output
Indication ...
~
"" Supply
v+ r···-·····
i Opto "E
nD 2 ~~ ,
I + -
c-'----"':"! :..isolator i Switch
PLC
Digital
Logic
i
!
i
(f (Transistor)
)
...
1 Output 1
Device I
'-/
....... >. "'-
~>R 1 ~~
~
~
~ ,."
Fuse DC Common
'~----- v--------,/ '~--,v~-_-J'/

PLC Module Field Wiring

Current flow when output on ~

Figure 4.18. Typical sinking DC discrete output channel.

162 VO Modules and Installation

v- Terminal
fi~·~i~······-:
Strip
non:
i
~.
r--'----, Xform er~ ~.l Ql 1104 Fuse
(Opl.) +
PLC : r' 1 > 'I- D{ "
Sourcing .A DCPower
Digital i CIT >R,
Output
- Supply
Logic ;
.......
Device
"1
Fuse
I Same circuit as above
1 (ope) +
~ Sinking •• ~~ DCPower
Output
~
, ':""
Device - Supply

Arrow indicates direction of

current flow when device is on.

Figure 4.19. Isolated DC discrete output module for mixture of sinking and sourcing
output devices.

The circuitry for a relay discrete output module is shown in Figure 4.20. In contrast to
the other types of discrete output modules, there is no optoisolator. The lackof an electrical
connection between the coil and contacts provides the electrical isolation. Relay outputs are
used for output devices that have a power source isolated from the PLC. A typical example
is a motor control center (MCC) where each motor starter has a separate 120-volt supply
derived from the 440-volt bus, shown in Figure 4.21. If the output device is an inductive
load, then a suppressor device should be placed in parallel with the inductive load to protect
the relay contacts. Figure 4.22 shows typical suppression devices for an inductive load
powered by AC and DC sources (GE Fanuc, 2000).
Most systems also provide some capability to manually operate a device in conjunction
with the PLC control. A typical device is called a Hand-Off-Auto (HOA) switch, illustrated
in Figure 4.23. The "HAND" and "OFF" positions override the state of the PLC output.
When the switch is in the "HAND" position, the P-IOI pump runs, regardless of the state of
the PLC output. In the "OFF" position, the pump stops, regardless of the state of the PLC
output. When the HOA switch is in the "AUTO" position, the PLC controls the pump. An
indication is also provided to the PLC that is on when the HOA Switch is in the "AUTO"
position. The PLC logic turns off the pump control whenever the switch is moved out of the
"AUTO" position.

Terminal
Output Strip
Indication Com 01
v+ r------ NCOI ACorDC
NOOI Power Source
V+ '
+-"';""--'-" :,
PLC ,:
__ :
Digitall--~~_:,:_:-::_:-::_~
Logic

''-----~v~----~/ '~-----~v~-----~/

PLC Module Field Wiring

Figure 4.20. Typical relay discrete output channel.

 4.2 DISCRETE MODULES 163

440V, 3 phase

A~B
C - '1' MS O.L. Disc.
i O..-------iII-----o-0J-o---B0:
T, 1-----o-0J-o---,, M
-'-- I-----o-0J-o---
H,
Fuse

'--~
~
: Relay I 120V 2

i Output O.L.
!!:'''',l•.....y _ MS "
Figure 4.21. Relay discrete output channel controlling a MCC.

0.0221'f lOon
600V 0.5W IA,200V
Relay Relay
Output Output
Module L2
Module j--------.,
, , +
I________ .! 1________2 Power
LI Supply

(a) (b)

Figure 4.22. Relay output suppression devices: (a) AC powered load; (b) DC powered
load.

.............rl
...... ~
P-IOI
i Relay~ Motor
i Output . '---++-r---; Starter
OFF
L'::.~~I~.....y
HAND

-u

(a) (b)

Figure 4.23. Hand-Off-Auto switch between PLC output and MCC: (a) HOA switch; (b)
switch wiring.

Multiple DC discrete output channels can be connected to LED 7-segment displays to

provide inexpensive operator display of numerical values. Figure 4.24 shows four LED
7-segment displays, each with four connections to a discrete output module. A sinking DC
discrete output module is shown since most of these modules have a TIL (sourcing) input.
In either case, the 16-bit discrete output must be formatted as a 4-digit BCD value.
164 va Modules and Installation

J _
IS 141 JI2 II 109 8 7 6 oS 4 ., I 0 Channel Number
Com~;~
I
Binary-tD.7-segment
DCPowe ~
Supply
+ 2 / 3 5 ~/driver

Thousands Hundreds Tens Units

Figure 4.24. LED displays conoected to DC discrete output module.

Most PLC vendors provide a discrete output module that interfaces to 5-volt TIL
devices. This module is often required to send numerical input to specialized equipment.
For example, the desired linear position for a hydraulic positioning controller could be sent
as 16 TIL signals, representing 4 BCD digits.

4.3 ANALOG MODULES

Even though PLCs were originally developed to handle discrete signals, there is often
the need to handle continuous, or analog, signals. An analog signal represents a physical
quantity that can have an infinite number of values. The typical analog signal ranges are:
I to 5 V 4 to 20 rnA
oto 5 V 0 to 20 rnA
oto 10 V -20 to 20 rnA
-5 to +5 V
-10 to +10 V
For reasons detailed later in this section, the 4 to 20 rnA range is the most popular signal
range.

4.3.1 Analog Input Modules

An analog input 'module receives the measured quantity (voltage or current) from
process transmitters and other devices that produce analog signals. Common physical
quantities measured by a PLC analog input module are:
Position Flow Distance
Speed Level . Analytic instruments
Acceleration Pressure Opacity
Weight Temperature
The block diagram of a typical analog input is shown in Figure 4.25. The optical
isolator provides electrical;solation between the field wiring and the PLC internal circuitry.
The electronic circuitry to the left of the optical isolator is typically powered from the
internal PLC, but through an isolated power supply to maintain isolation between the field
wiring and the PLC voltage source. The sensor may be powered by an external power
supply or by the PLC isolated power supply. The analog signal is filtered to remove noise.
The actual field signal may be a single-ended voltage, single-ended current, differential
 4.3 ANALOG MODULES 165

Isolated PLC
Power Supply Power

.......... Analog-
Dual-to- To-Digital
: Analog .
Filter single-ended PLC
: Sensor . converter Converter
(ADC)
~
Volt or
milliamp .
signal 10- to 16-blt
integer

Figure 4.25. Analog input module block diagram.

voltage, or differential current. In all cases, the analog signal is converted into a
single-ended voltage for the analog-to-digital converter (ADC). There is generally only one
ADC per module, regardless of the number of input channels. The individual channel
voltages are multiplexed into the ADC input. -
The ADC converts the analog voltage into an integer number, which has a finite
resolution. The most common ADC outputs a 12-bit integer, which means the output integer
ranges from 0 to 4095. The relationship between the analog input voltage and the ADC
output integer is illustrated in Figure 4.26. In this example, the output integer is assumed to
be 4 bits, which means the output integer value ranges from 0 to 15. If the conversion were
perfect for this example, the ADC output would be three times the input voltage. The actual
relationship between the input voltage and the output integer resembles "stair steps" (Figure
4.26b). For example, an input voltage between 0.833 volts and 1.166 volts is read as the
integer 3. The resolution of an analog input channel is the smallest change that can be
sensed and corresponds to the width of each step in Figure 4.26b. The resolution is
calculated as the maximum span of the signal divided by the integer range of the ADC
output. For example, a 12-bit ADC with a signal range of5 volts has a resolution of 5/4095
= 1.22mV.
The ADC requires a finite time to perform the analog-to-digital conversion, so the
analog signal is sampled repeatedly and the conversion is performed on each sample. Any

...g, 15
B
.s
"
Eo 10
::l
0
U
0
-< 5
Ol

'"
u
-<
o I 234 5 0 I 2 3 4 5
ADC Input Voltage ADC Input Voltage
(a) (b)

Figure 4.26. ADC input/output relationship: (a) theoretical outp\lt; (b) actual output
integer.
166 I/O Modules and Installation

change in the analog signal between samples is ignored. Since multiple signals are
multiplexed into one ADC, the time between successive samples ofone channel is the ADC
conversion time multiplied by the number of channels. The maximum frequency of the
measured signal must be considered when selecting the analog input module. The sampling
rate of the input module should be at least twice the highest frequency of the measured
signal.
The channels on an analog input module are sinking. Figure 4.27 shows the
connections of voltage sensors to analog input modules. Analog input channels are
generally configured as single-ended (Figure 4.27a) or differential (Figure 4.27b).
Single-ended channels share a common connection that may also be the common of the
sensor power supply. In contrast, differential channels do not share a common connection
and are isolated from each other and from the sensor power supply. In either case, the
signals are shielded to attenuate electromagnetic noise. The shield is connected to earth
ground on only one end of the cable, preferably close to the point where the measured signal
is connected to earth ground (Morrison, 1986) usually at the source (sensor) end. If the
shield cannot be grounded at the sensor, then it should be connected to an earth ground at the
PLC module.
There are two disadvantages to using voltage to represent the analog signal:
I. Even with careful shielding, the signals easily pick up electromagnetic noise.
2. The signal cannot be transmitted long distances. The wire resistance causes a
significant voltage drop for long cables. For example, the resistance of 18-gauge
wire is 0.0064 ohms per foot. If the cable length is 2000 feet, the combined
resistance of the signal and common is 12.8 ohms. If the current through the
differential signal loop is 0.1 rnA, the resulting voltage drop is 1.28 mY, which is
larger than the resolution of a 12-bit ADC when the maximum signal is 5 volts.
The solution to the disadvantages of voltage signals is to use current to transmit the signal,
as shown in Figure 4.28. As for the voltage sensors, the input channels are generally
connected as single-ended (Figure 4.28a) or differential (Figure 4.28b). Single-ended
channels share a common connection that is also the common of the loop (and sensor)
power supply. In contrast, differential channels do not share a common connection in the
analog input module. However, the power supply is still part of the loop, and if the same
power supply is u~ed for all sensors, the channels are not isolated from each other. The loop

Power Power
Supply Supply

:;[' Shield
+8 :.,...............
+ ,

Channel ~ I' Channel

Ls:e:n:s:or1H~~"'~"?"'~"~"~"';"=;:=i~}
+8
Sensor 00
00
- 01

I
"G' ~
'''':::::::::::::: J
02
. .. .... ,-;.;:.,.. \
.", " 03
: ' :
r-
I ~.:
} 01
. ..,....,,"y r' ~ ............. ,. ~

':"
{
.::'!:.
Common ~ = ~
(a) (b)

Figure 4.27. Connection of sensors to voltage-input analog input module: (a) single-
ended; (b) differential.
 4.3 ANALOG MODULES 167

Power Power
Supply Supply
+ - 4-20 rnA
.. : .

~~'-?'~"1~._.1.=-t-~..o/~~00r-:>c-.
~ ~ }~
Sensor
c::
o
'"
N

Common

(a) (b)

+ .., -.
Sensor c!" '. . .'
L+.......-r-_-l-Sl ......-
00

(c) (d)

Figure 4.28. Connection of sensors to current-input analog input module: (a) single-
ended; (b) differential; (c) separate sensor power supply; (d) module-supplied power.

power may be supplied by the sensor (Figure 4.28c) or may be provided by the analog
output module (Figure 4.28d). In all cases, the signals are shielded, and the shield is
grounded to attenuate electromagnetic noise.
The advantages to using current to transmit the signal are:
I. Current signals are less susceptible to electromagnetic interference.
2. The signal can be transmitted long distances (thousands of feet) limited only by
power supply voltage and wire resistance. For long wire runs, the power supply
voltage i~ increased to be at least 2 volts higher than the maximum voltage drop
(wire resistance times 20 rnA) plus the minimum sensor voltage drop plus the
5-volt drop at the analog input channel. For the circuit in Figure 4.28a, if the
minimum sensor voltage drop is 5 volts and the sensor wiring run is 5000 feet of
18-gauge wire, the minimum power supply voltage is
V min = 2 + (10000 ft.) X (0.0064 ohms/ft.) X (0.020 amps) + 5 + 5 = 13.28 volts
3. Power and signal are carried by two wires.
4. A broken loop (wire) is indicated by zero rnA, assuming the normal range of the .
signal is 4 to 20 rnA.
A current signal can easily be converted to a voltage signal by installing a resistor
across the voltage input terminals, as shown in Figure 4.29. This method is often used for
sensors that produce non-standard current signal ranges. For example, if a sensor outputs a 0
to I rnA signal, a resistor value of 5000 ohms in Figure 4.29 converts the current signal into
a 0 to 5 volt signal to be measured by the analog input module.
168 I/O Modules and Installation

~'j"x"'x"':"~::;--;:-;:::::ll~} ~~ptllugte
·1····_· "'

Figure 4.29. Conversion of current signal into voltage measurement.

The disadvantage of using a current loop to transmit the signal is that it is difficult to
diagnose problems with the current loop. The loop must be broken in order to check the
signal value and special equipment may be required to find the location of wire breaks. For
this reason, some installations place a 100 to 250 ohm resistor in the loop so measuring the
voltage drop across the resistor indirectly checks the current. Of course, the power supply
voltage must be large enough to accommodate the increased loop voltage drop due to the
additional resistor.
Current loops will not function properly if more than one point in the loop is connected
to the power supply common. For example, this problem occurs ifthe sensor in Figure 4.28a
receives its power from the loop power supply and the "5_" output is connected internally to
the power supply common. In this case, no current will flow into the analog input module. In
order to prevent this problem, sensors are either powered totally from the 5-volt drop across
the output terminals or from a power supply completely isolated from the loop power
supply.
A separate visual indicator may be part of the wiring of the sensor to the PLC (Figure
4.30). This indicator provides inexpensive local display of the sensor value and is often
useful for diagnostics. For a sensor that provides a voltage signal, this indicator is connected
in parallel to the PLC channel wiring, as shown in Figure 4.30a. For a current signal, the
indicator is placed in series with the current loop wiring, as in Figure 4.30b. Indicators that
measure current may be completely powered by the current loop and not require a separate
power supply. If a current indicator uses a separate power supply, one should verify that
there is no internal connection between the indicator power supply and the sensing inputs.
This internal connection may cause more than one point in the loop to be connected to the
common of the analog. input module.
Thermocouple and resistance temperature device (RID) sensors are generally
connected to specialized analog input modules. Figure 4.31 shows typical connections. A

- 4-20mA

l.--~~_.~:;t.~9·~'''11-'~/.V~}oo
....

= y
(a) (b)

Figure 4.30. Connection of indicator to analog input signal: (a) voltage sensor; (b) current
sensor.
 4.3 ANALOG MODULES 169

.
Shielded
Thennocouple Channel
=~ ~~~lQn.C;.~ltl.e.:
}oo
~"'?<"">c""~-"'<8"'8:""~"
~ ,
~}Ol

(a) (b)

Figure 4.31. Connection of temperature sensors: (a) thermocouples; (b) RTD sensors.

thermocouple generates a small voltage (-10 to 80 mV) and so requires a high-gain

amplifier. Proper voltage-to-temperature conversion requires cold-junction compensation
(CJC), provided by a separate sensor measuring the terminal block temperature: A RTD is
basically a temperature-sensitive resistor. The most common conversion ofRTD resistance
to temperature places the RTD in a Wheatstone bridge circuit before amplification. A
three-wire RTD provides compensation for the resistance of the cable wires. Chapter 16
contains more information about these temperature sensors.

4.3.2 Analog Output Modules

An analog output module generates a voltage or current signal that drives another
device to manipulate a physical quantity. Common devices controlled by a PLC analog
output module are:
Variable-speed motor drive (speed)
Current-to-pneumatic converter (pneumatic regulating valve position)
Electronic valve (valve position)
. Analog meter
Chart recorder
The block diagram of a typical analog output module is shown in Figure 4.32. A
digital-to-analog cpnverter (DAC) converts the integer number from the PLC into a
single-ended voltage. If the output signal is a current, then the DAC output voltage must be
converted into a current signal. Like the analog input modules, the actual field signal may be
a single-ended voltage, single-ended current, differential voltage, or differential current.
There is generally a separate DAC for each channel The optical isolator provides electrical
isolation between the field wiring and the PLC internal circuitry. The electronic circuitry to
the right of the optical isolator is typically powered from the internal PLC, but through an
isolated power supply to maintain isolation between the field wiring and the PLC voltage
source. The field device may be powered' by an external power supply or by the PLC .
isolated power supply.
The channels on an analog output module are sourcing. Figure 4.33 shows the
connections of voltage and current devices to analog output modules. Analog output
channels are generally configured as single-ended (Figure 4.33a,c) or differential (Figure
4.33b,d). Single-ended channels share a common connection. In contrast, differential
channels do not share a common connection and are isolated from each other. As for the
170 VO Modules and Installation

PLC Isolated
Power Power Supply

Digital- .---- .... ,

Voltage-to-
To-Analog current converter
I Analog :
PLC Converter , Device :
(current outpurs)
~ '
(DAC) Volt or
f .
10- to 16-blt
milliamp
signal
integer

Figure 4.32. Analog output module block diagram.

I ~~;~~ I
Channel Channel +1 1-
~~l=:;--;::~'.:?"~'-~"~- '=::1 00 {q=~;"X:"X"-~-'=+S~ Output
02
OJ
L-_---'
"'~~- ~ om..

(a) (b)

Power Power
Supply Supply
(if needed) (if needed)
+ +1 1-
Channel 4-20 rnA +S
oo~~~~~~·~-'-~--~--;--·~~ Output
Channel
oo{
~rru:-,----_ ... ~ Output
o'-K
02
Device
01 { :'i-~ Device
OJ
. ,

(c) (d)

Figure 4.33. Connection of devices to analog output module: (a) single-ended voltage;
(b) differential voltage; (c) single-ended current; (d) differential current.

analog inputs, the signals are shielded, and the shield is connected to earth ground at the
source (module) end.
Some systems also provide the capability to manually operate an analog output device
in conjunction with the PLC control. A typical device is called an auto/manual station,
illustrated in Figure 4.34. When the switch is in the "MAN" position, the P-IOI pump speed
is set by the potentiometer, regardless of the value of the PLC output. When the switch is in
the "AUTO" position, the PLC analog output controls the pump speed setting. The panel
also shows the pump speed. The actual pump speed setting and an indication of the switch
position is also provided to the PLC. When the selector switch is not in the "AUTO"
 4.4 SPECIALIZED MODULES 171

.............. _--_ _-._-

IBBBI
P-lOl Speed

~ OFF
MA~UTO

(a) (b)

Figure 4.34. Analog output bypass station: (a) panel; (b) wiring.

position, the PLC logic disables any automatic control of the pump and adjusts the PLC
analog output to match the operator setting.

4.4 SPECIALIZED MODULES

Many control systems need special-purpose I/O modules. For many systems, these
modules are a minority of the total number of modules in the system but are essential for
certain applications. Among specialized I/O modules, the high-speed counter and motion
control modules are probably the most popular.

4.4.1 High-speed counter

A high-speed counter module provides a means to count pulses and time events
independent of the program or I/O scan. A high-speed counter module is generally used as
an interface for position encoders and positive-displacement flow meters. If a normal
discrete input channel is used to count pulses, the highest pulse frequency is limited by the
program scan time. For example, if the maximum program scan time is I ms, the minimum
pulse width that can be reliably sensed is 2 ms (twice the maximum program scan time).
Thus the maximum frequency that can be reliably sensed is 250 Hz (the reciprocal of twice
the minimum pulse width). Many position encoder signals operate at 20 kHz and higher.
Therefore, a normal discrete input channel is inadequate to count position encoder pulses. In
addition, a high-speed counter module provides a differential input interface required by
many encoders.
Figure 4.35 shows the connections of typical devices to a high-speed counter module
used in simple counting applications. The connection to a single-ended device is similar to a
sourcing discrete input device (Figure 4.8). Whenever possible, differential devices are
preferred since the differential signal provides the best immunity to electrical noise. Many
high-speed counter modules provide options to set the signal voltage level and signal
filtering.
In most motion applications, a position encoder generates two-phase quadrature
signals, shown in Figure 4.36a connected to a high-speed counter module. The relative
172 I/O Modules and Installation

Single-Ended Terminal
Sourcing Device Strip
,...-----,..... Fuse
--------------------------.
DC Power....·~J'<O...­ _r---, :
PLC ,
Supply ..Jl..JL
Out "~""""'" :::: Digital:

-t - Logic :
,,,

..Jl..JL
r-~01!!ulL-,
DC Power'-'-<:>v'<>---l
~=9~~¢:JfO~~~~~;:J
.., .
,...-----,r.... Fuse

L:S~uP~p~ly~-:----Dlifferential
Device
£ . . .-. y Same circuit as above

_
Figure 4.35. Single-ended and differential connections to high-speed counter module.

phasing ofthe A and B signals indicate the direction of encoder rotation. Ifthe positive edge
of A leads the positive edge of B, the encoder is rotating clockwise (Figure 4.36b). For
counterclockwise rotation, the positive edge ofA lags the positive edge ofB (Figure 4.36c).
The Z signal is the index pulse, which pulses once for each encoder revolution.
Many high-speed counter modules can also be programmed for operations more
complex than simple counting. For example, many modules can calculate the frequency of

Differential
Quadrature
H------------
Encoder f ......·...., t'.
r::i A
A
High-Speed
B
lA- B
: : Counter
+ Fuse Module
DC Power
Supply
-
J.;.
~ Z
z -/. .......... -
~-----------_.
(a)

A JLSLS A Sl.....JL
A LSLJL A ~
B Sl.....JL B JLSLS
B ~ B LSLJL
Z n z n
z u z U
(b) (c)

Figure 4.36. Quadrature encoder connections: (a) wiring to high-speed counter module;
(b) timing for clockwise rotation; (c) timing for counterclockwise rotation.
 4.4 SPECIALIZED MODULES 173

the pulses by measuring the pulse period (averaged over a specified number of pulses) or by
counting the number of pulses during a fixed interval.

4.4.2 Motion control

Motion control modules meet the needs of accurate, high-speed machining, packaging,
and other types of production machinery. There are two types of motors used in motion
control systems: servomotors and stepper motors. Generally, servomotors are used in
applications that require high torque or power and stepper motors are used in low-torque,
low-power applications. Both types of motors require a drive, which contains the power
electronics that translate the signals from the PLC motion module into the signals required
by the motor. The drive for a stepper motor is usually less expensive than the drive for a
servomotor.
A servomotor is a specially-designed brushed DC motor or brushless AC motor. The
traditional servomotor is a brushed DC motor, where the coil is wound on the armature and
the stator is a permanent magnet. In this motor, accurate speed control is obtained by
manipulating the armature current while keeping the field current constant. By
manipulating the field current with a constant armature current, the torque of the
servomotor can be controlled. In a brushless AC motor, the rotor is a permanent magnet, and
the coils are wound on the stator. A brushless servomotor requires complicated stator drive
signals, and hence its drive is more complicated. Chapter 16 contains more details about the
differences between brushed and brushless servomotors. Regardless of the type of
servomotor, the speed and/or position is typically measured and fed back to the motion
module, and the motor speed is adjusted accordingly. Figure 4.37 shows typical
connections from the PLC servo motion module to the servo drive and to the servomotor
when the servo is used in positioning control. In the example shown, an encoder is used for
feedback, but a tachometer or a resolver could be used in place of the encoder. Also shown
is a brake, which prevents motion when the motor is not powered. A brake is especially
needed in certain vertical motion applications to hold a load at a certain position when
motor power is removed. The over-travel limit switches cut off the motor power when the
device moves too far in either direction.
The electrical connections in Figure 4.37 are sensitive to electrical noise and cannot be
located very far away (Rockwell Automation, 2DDle). In order to alleviate these electrical
problems in motion control systems, many recent systems use the SERCOS (SErial
Real-time COmmunication System) fiber optic communication medium (IEC, 1995), as

---------------~ AC Source

.---_ :-
III n
: Vclocit Command
_ -~.

Outputs Servo
.,.- .. -_ ...
_.- _. : Drive Er.ablc Motor
Servo <2 :
~-

: Drive Faull Servo

Control 8. .;; ::::::::: ':' Drive ~==~-IBrake
Module
< ::
..
A
-
~====rl Encoder
Module
Inputs ::
B -
ir]:=,.=.:.....l -±
""'\
z
24V \ \ Over-Travel
_________________ It: l~II============:::!..._.JI' LImit SWItches

Figure 4.37. Typical servo-motor control module wiring.

174 l/O Modules and Installation

,,,------------ AC Source

,,, Servo
,, SERCOS Motor
,, Multi-axis Servo
,, Motion Drive ~==~-IBrake
,,, Module
,,
L ~~~C~~Encoder
1- .
Over·Travel
Servo Limit Switches
Drive

Servo
Drive

Figure 4.38. Typical SERCOS multi-axis motion module connections.

shown in Figure 4.38. The fiber optic medium assures reliable high-speed data transmission
with excellent noise immunity and eliminates the interconnection wiring. A typical
SERCOS system has one master control module communicating with multiple drives. The
network is a ring topology, and any break in the fiber optic ring disables the entire network.
A stepper motor is a brushless permanent-magnet type motor that translates incoming
pulses into mechanical motion. Because the stepper motor makes a fixed angular motion in
response to the pulses, stepper motors are often used in an open-loop configuration. In this
case, the motion is controlled by generating the proper pulses to the motor, and encoders are
not used. Figure 4.39 shows typical connections from the PLC stepper control module to the
stepper drive and to the stepper motor. This figure also shows the optional encoder
connections. Note that a brake may not be needed, since the signals from the drive to the
stepper will hold the stepper motor shaft in a fixed position. However, when the power to
the drive is removed, the motor is free to spin. In vertical applications, a brake will hold a
load at a certain position when power to the stepper drive is lost.
Stepper motors have two disadvantages. First, if the stepper motor encounters a torque
load higher than its rating, the motor "cogs" and does not move. For this reason, encoders
are utilized in high-performance motion applications. Second, one must be careful when
using encoders in a stepper motor application. Because the motor is driven with pulses, the

:---------------~ ACIDC Sou",e

III n
Module { .::::::::::': PulE' Stepper Stepper
Outputs :.. ----.---.~- Direcliol'l. Driver Motor
Stepper ~::::::::::~"A""""""""""""""';;';;:""""" ....• LJEncoder
Control I .?-'············T
Module Module . B ::..--::;;:?-"'...... -

Inputs
{
[l;~'5I- . :. _~-· -· ;~i·I.=.=..·=..=z..=.=.=~=
...=..=.·=···=·'=====24=V=~_....J~ g:;~,:~~lhes
..=

,---_._----------~
Figure 4.39. Typical stepper motor control module wiring.
 4.4 SPECIALIZED MODULES 175

actual shaft rotational motion is also "pulsed" and not smooth as for a servomotor. If the
stepper motor is driving a flexible belt, the pulsed shaft motion is magnified and will cause
false encoder pulses to be generated. For this reason, servomotors are a better choice when
driving a flexible belt.

4.4.3 Other specialized devices

Other types of specialized I/O devices include bar code readers, vision systems,
message displays, and operator terminals. These types of devices generally do not have a
separate PLC I/O module, and the PLC provides communication interface modules to
handle these types of devices. The simplest type of connection is a RS-232 serial port.
Figure 4.40a shows a bar code reader, a vision system, and an operator terminal connected
to RS-232 serial ports provided by the PLC. These serial ports may be on the PLC processor
or may be provided by a separate module. Each specialized device generally requires a PLC
serial port, though for some vendors, a serial multiplexer, can multiplex multiple serial
connections into one PLC serial port, as shown for the bar code reader and the operator
terminal in Figure 4.40a. As an alternative to serial port connections to each device, a
multi-drop communication network may be used to connect \he devices to the PLC, as
shown in Figure 4.40b. Modbus and RS-485 are two popular simple multi-drop
communications networks. Communication networks are discussed in Chapter 17.

Vision Barcode Operator

a -a"
~ "C
System Reader Terminal
"
u
0
;::;:
~
L....J
g N *
Po.

RS
'"

~
•

[.8]c.m<n D
•••••
•••••
2J2 ~
'+r~r,~;--;~-~-~~~====TL~lrS-en-·al-'. f- RS-232 Cable
Il!:M~UX~----'===-..I

(a)

Vision Barcode Operator

...0 ;;" System Reader Terminal
'" "C

"'"ug 'L:::J
0

•
;::;:
Po. 6 <.~II~I~IIIt· -
. ..
60 .
U
D
•••••
•••••

Mulri-drop Communication Network

(b)

Figure 4.40. Connections to other intelligent devices: (a) serial communications;

(b) communication network.
176 I/O Modules and Installation

4.5 INSTALLATION WIRING

This section outlines general guidelines for the wiring required to install a PLC-based
control system. It covers power distribution, control cabinet and control panel layout.
Consult any vendor documentation and the appropriate standards (e.g., NFPA 70E and
NFPA 79) for specific information.

4.5.1 Power distribution

If the control system power supply source is 120 AC volts, a typical distribution of
power is shown in Figure 4.41. A step-down transformer decreases the higher voltage for
the motor starters (typically 440 volts) to the 120 volts for the controller power supplies and
DC power supplies. The power supplies for the PLC processor and all chassis that contain
I/O modules are powered directly from the l20-volt source, protected by a fuse (or circuit
breaker). The DC power supply in this configuration is used only to supply power to the I/O
circuitry. For a system where DC powers the PLC processor and I/O modules, a typical
power distribution is shown in Figure 4.42.
For safety and reliability in both AC and DC power distribution systems, all equipment
must be properly grounded. There are typically three types of circuit grounds:
I. Safety grounds for chassis, panels, and junction boxes
2. Dirty grounds for EMI-generating devices such as inductive relay coils
3. Clean grounds for low current signals.
All of these grounds should meet at a common ground bus bar mounted in the panel to
prevent ground loops. The panel ground bus bar is connected to an earth ground.
The master-control relay provides some of the personnel and equipment protection for
the system since it de-energizes the I/O devices when any of the emergency-stop switches
are pressed. The Start push-button is pressed to energize the master-control relay (MCR).
Pressing anyone ofthe emergency-stop switches de-energizes the master-control relay and
thus de-energizes the I/O devices. In general, the master-control relay does not control
power to the PLC processor. Depending on the s'ystem, a separate master-control relay may
be provided for each section of the process. For the AC-powered master-control relay
(Figure 4.41), note that a suppressor is needed across the line at the load side of the MCR
contacts. The suppressor is needed since the AC I/O circuits and the DC power supply form
an inductive load.
Protection for input and output devices is illustrated in Figure 4.43. For input devices, a
fuse is used to protect each group of input devices. The devices may be organized so that a
fuse protects all devices connected to one discrete input module. Alternatively, all of the
discrete devices in one area of the process may be protected by one fuse, even if the devices
are connected to different discrete input modules. For the discrete output devices, a separate
fuse protects each output module, though in some applications, each discrete output device
is fused separately. Fusing for the analog modules is treated in a manner similar to the DC
discrete devices. The fuses also allow one to de-energize certain inputs or outputs during
commissioning or troubleshooting.
Whether fuses or circuit breakers are used for circuit protection is often subject to
debate. Fuses offer low-cost protection, but that protection is compromised if it is replaced
with a higher-rated fuse when maintenance personnel tire of frequent blown fuses. Circuit
breakers are often more convenient since a trip does not necessitate a trip to the storeroom
 4.5 INSTALLATION WIRING 177

Disc. Suppressor
Ll---<J ,:~
L2---<J ,,
L3---<J -IT""Tl-
Ll}
L2
L3
To motor
starters
~H
3 phase AC
Step-down
~jH4
Panel
transformer
Fuse
,rr:::n- -f----'-'-,-'-----V LFoundBus
XI
120V
X2 TT ., I
I L
Cabinet Flourescent Lam

HElEl
Ll N - ...
Pwr_ Supply for Chassis -
Containing Processor Gnd Groun ding
Electrode
Ll N
Other Chassis
Power Supplies Gnd

'C'
Multiple E-Stops .9u
------ .....-------------- Start ~

~ ..~-L MC~ '"'"

c
0
u

:~ '~:----------------' M1iJ ~ Suppressor ~

'"c
~
0
~

Suppressor
Q.
~
~

.........
•
To cornman (Ll)
of 12()V AC
To neutral conn. :- Z
of 12()V AC •
~

,..,...!.... input devices input modules ~

~

H:cn- ToLl To neutral -;-

: of 120vAC of 12()V AC •
.........=--
~
output modules output devices .:..-

LI N
DC Power
Supply Gnd

v+ I I DC Common

~ToV+ofDC
•
To common -:-
cfDC input.
,..,...!.... input devices
~
modules .:.....
~
To common -;-
• ToV+ofDC
of DC output •
: output modules
devices .:.....
~

Figure 4.41. AC power distribution system with master-control relay.

178 va Modules and Installation

Disc. Suppressor

Ll-o N!>--frn-~==~- Ll} To motor

L2-o I L2
I starters
L3-o n-~------">---L3
3 phaseAC

Fuse

a met Fl~1 Lam

L_.l::L.!.!1~;:;P=;-J,N
DC Power .~---l
~
Grounding
Supply Gnd
Electrode
V+ DC Cornmon
c
o
:t ~__v!..+~Pwr. Supply for Chassis DC Comm. §
1:5 Containing Processor 8
u
Q

V+ Other Chassis DCComm.

Power Supplies

Multiple &Stops
............. ~~

----------------------.; ~CRo-,~:ggID
CRM

To common
•• To V+ofDC •
of DC input •
• input devices
modules •

..• To V+ofDC
To common
ofDC output ••
• output modules
devices •

Figure 4.42. DC power distribution system with master-control relay.

for a replacement. However, circuit breakers act somewhat slower that a fuse. If fuses are
used, indicating fuse holders allow one to quickly locate a blown fuse. Also, when possible
all fuses in a particular cabinet protecting PLC va
should be of the same physical size and
current rating. A panel with fuses ofvarying sizes or ratings in identical holders is confusing
to maintenance personnel.
 4.5INSTALLATIO WIRING 179

CB

DCV"- J:::->--------~ ~ A
(orACLl) A ~ ¥ ¥ ¥
To V-(LI) of module
input devices

DC Cornman
(or AC. eutral) - - - - - ' Discrete Input Modules

Figure 4.43. Protection of input and output devices.

4.5.2 Enclosure types

Even though PLCs are designed to operate in harsh industrial environments, most are
installed in a metal enclosure, also called a control panel. The panel protects the components
from atmospheric contaminants such as dust, moisture, oil and corrosive vapors. The panel
also deters tampering and protects operating personnel from dangerous voltages. Finally, a
panel reduces the effect of electromagnetic radiation generated by other electrical
equipment, especially welders.
All enclosures installed in industrial applications must meet certain standards. In the
United States, the types of enclosures are often described by the NEMA type number
(NEMA, 1997). Table 4.1 summarizes the definitions of the various EMA type numbers
and their common applications. The most common types for industrial applications are
types 12 and 4X. The lEC enclosure designation (lEC, 2001) consists of the letters "IP"
followed by two digits and is summarized in Table 4.2. The first digit indicates the degree of
protection against persons and solid objects entering the enclosure. The second digit
indicates the degree of protection against water ingress. Common ratings are IP II, IP2 I,
IP22, IP44, IP54, and IP55.
The lEC enclosure classifications (lEC, 200 I) specifY the degrees ofprotection against
solid bodies and liquids. The IEC classifications do not specifY protection against
mechanical damage, risk of explosion, condensation, or corrosive vapors. The NEMA
enclosure type numbers (NEMA, 1997) consider environmental conditions such as rust,
corrosion, icing, and oil. Because of these differences, the IEC and NEMA enclosure
classifications cannot be exactly equated. However, the replacement NEMA enclosure for
certain IEC IP classifications can be designated as in Table 4.3. In general, the NEMA type
numbers meet or exceed the associated IEC IP classification. For example, a NEMA type 12
enclosure can be used where an IEC IP52 classification is specified. However, an IEC IP52
enclosure cannot be used where a EMA J 2 enclosure is specified, since IP52 does not
specifY enclosure rust resistance.

4.5.3 Control Panel Design

A well-designed control panel interior and exterior is simple to understand and easily
installed and maintained. Example layouts are shown in Figure 4.44 - 4.46. A panel where
180 VO Modules and Installation

Table 4.1. NEMA Enclosure Types

NEMA
Enclosure
Type no. Abbreviated EMA Definition Application
Indoor use. Some protection to incidental General purpose indoors
personnel contact.
2 Type I plus drip-tight Cooling rooms
3 Outdoor use. Protection against weather General purpose outdoors
hazards such as rain and sleet. Ship docks, tunnels
3R Type 3 minus dust protection
3S Type 3 plus external mechanisms
remain operable when ice laden
4 Watertight. Protection against Food processing
wash-down
4X Type 4 plus corrosion protection Food processing
5 Indoor use. Dust-tight Cement, powder blending
6 Submersible Mines, quarries
6P Prolonged submersible Mines, quarries
7 Hazardous. Indoor use in NEC Class I, Petrochemical plants
Groups A, B, C, D (certain gases and
vapors which may be explosive)
8 Hazardous. Type 7 plus outdoors Petrochemical plants
9 Hazardous. Indoor/outdoor use in NEC Petrochemical plants
Class II, Groups E, F, G (combustible
dust
10 Meets requirements of the Mine Safety Mines
and Health Administration, 10 CFR,
Part.l8 (1978)
12 Type I plus dust-tight, drip-tight, Industrial indoors
protection against lint and fibers
12X Type 12 with knockouts
13 Type 12 plus protection against spraying Metal machining
water, oil, noncorrosive coolant

the field VO connections and high-volt AC enter from the top is shown in Figure 4.44. This
panel also includes a transformer and a disconnect. Figure 4.45 shows the layout of a panel
where the field I/O wiring enters from the bottom. A vertical mounting of a PLC chassis is
shown in Figure 4.46. The more important recommendations are outlined below and then
followed by a typical control panel specification.
 4.5 INSTALLATION WIRING 181

Table 4.2. IEC Ingress Protection (IP) Ratings

First. o. Protection against:

o 0 protection
I Solid objects more than 50 mm (e.g., hands)
2 Solid objects more than 12 mm (e.g., fingers)
3 Solid objects more than 2.5 mm (e.g., tools)
4 Solid objects more than I mm
5 Totally enclosed. Dust may enter but not in harmful quantities
6 Totally dust-tight
Second No. Protection against:
o No protection
I Vertically falling drops of water
2 Falling liquid up to 15° from vertical
3 Falling liquid up to 60° from vertical
4 Splashing from any direction. Limited ingress permitted
5 Strong jets of water. Limited ingress permitted
6 Occasional immersion. Water must not enter
7 Permanent submersion up to I meter
8 Permanent submersion up to specified depth and pressure

Table 4.3. Conversion of NEMA Enclosure Type Numbers to IEC Classification

Designations (NEMA, 1997).

EMA Enclosure Meets or Exceeds IEC

Type umber Enclosure Classification
I !PIO
2 !PII
3 !P54
3R IPI4
3S IP54
4 and4X !P56
5 IP52
6 and 6P IP67
12 and 12K IP52
13 IP54
182 VO Modules and Installation

Field Power
Wiring Source
Entry Entry
Tenninal blocks for
-
field wiring connec~-~
Control
E
-
] 1111111
~
~ \ Xformer

-r§:
,., EE I t/O
npu utput 00
,,~
1-1- 1\
I \.
~ ~ 0 Modules 'C~ .1- L

on -'j~~::::,II~I=I=:II~I=-.J ~ ~ gf ~ Panel
disconnect
- ,.., ~ ~ 'C ~
- r-.,':::;::;::;=;::n::;::;=;:,-, ~. ~ = L
]
E
1111111
Input/Output
19~~
B .... =
~

~ IlIlui"iI
- \.;;;f-;:===:::::::===::.J ~ ~ ~ ~
~ ~ ~~
-, . . F~=
- ~::-,t::;:::;::;::;=;=;::rT::;::;1 <E F= ==
~ 1111111 ~ ~ ~
E Input/Output ~ ~ ~
£ Modules .,. F ::::
to 1111111 §~~
v 1'-- ----'
W~&y ror IZOV source

Figure 4.44. Typical panel layout that includes transformer and disconnect.

General. Some general aspects of the physical particulars of a PLC enclosure are:
• The enclosure should be located so that the doors can be fully opened,
• The enclosure depth should provide adequate clearance between the enclosed
equipment; including cables and the closed door of the enclosure. If switches
and/or indicators are mounted on the door or the door contains a drawing pocket,
then these items should also factor into the depth requirements.
• The enclosure should contain lighting and convenience outlets to be used for
troubleshooting and maintenance.
• All components should be mounted on a removable back panel.
• An emergency disconnect switch should be provided. If the enclosure contains a
voltage greater than 120 volts, then the panel should have a through-the-door
disconnect switch.
Environmental. The effects of temperature, humidity, electrical noise, and vibration are
important when designing the panel layout. In particular:

• The temperature inside the enclosure must not exceed the maximum temperature
allowed by the electronic equipment (typically 55 - 60°C or 130 - 140 OF).
 4.5 INSTALLATION WIRING 183

3 ~in.
5~in. 5 Y.. in. 45/8 in.
,
~
~
--F;R..
I I
~
!!! .~
Power [Mfr model modular chassis
'"
N
~
Supply (process r, I/O slots 1-9)
,::
<0

I I I ~
T -r 'f

~ ~
3 x 3 wireway ,::
"'
k I
k I
i
I

.5 3x3 ~
~
~
Power [Mfr. mode modular chassis ,::
Supply (UO lots 1(}'19)

-
<0

I I I
"ltf-
I I I
~
3 x 3 wireway

10 in. 7 in.
-
f E
~{

9 in. "
.><
9 in. 3in
""
f 1 CD
s
~
'"
9
N
-t
.9
U
.""'"
~

~ <>
,...
a> ~ '"
<> "" <>
N f..-
O! "w w
'"
.""'"
"w "'"
~
iii Oi 'C
.9
E 1> ~
" ~"
u. ~
~ 9 "C ~ '"
iii
.9 a;
u w u:, 2 x 3 wireway E
..J
0..
>.
'~"
C >.
"3
~
.9
~ E u
~
'" .~
..."', ..J
0..
,
.~
'"...
~
N >.
M
~
B "3
a> E
N
'"~ .~

w '"
~

'""
.~
N

LJ ======================::::;IJ
~I..
l...J LJ l'
Field wiring
entry point

25 in.
J LJ l...J

~I

Figure 4.45. Typical panel where field wiring enters from bottom.
184 I/O Modules and Installation

Operator
Interface
(CRT screen)

PLC

Fuse

Panel
Ground
Bus

Figure 4.46. Panel with vertically-oriented PLC chassis.

• If convection cooling is inadequate to maintain that temperature, then a cooling

fan may be installed to help dissipate the heat. If the enclosure is dust-tight or
watertight, then a vortex cooler or refrigeration unit may be required. Many
control enclosure manufacturers provide information so that one can calculate the
temperature rise inside the enclosure, given the amount of electrical power
consumed by the devices in the enclosure.
• If condensatien is likely, then the enclosure should contain a
thermostatically-controlled heater.
• The panel should be located away from large motor starters, welders, and
inductive heaters. These devices generate excessive electromagnetic interference
or radio frequency interference.
Placement of Components. The size of the panel depends on the size and amount of
equipment to be installed in the enclosure. The layout of the equipment should conform to
the manufacturer's recommendations.

• The manufacturer generally specifies the minimum spacing allowed between a

PLC chassis and the enclosure walls, between multiple PLC chassis, between a
PLC chassis and a motor drive module, and so on. Most importantly, the
minimum spacing allows adequate cooling but also reduces electrical noise
coupling between the high-power signals and the low-voltage DC signals.
 4.5 INSTALLATIO WIRING 185

• System components should be mounted in a position that allows effective

convective cooling. For example, any cooling fins should be oriented vertically.
Even though the layout in Figure 4.46 is not optimal in this regard, the chassis is
oriented so the power supply is at the top.
o Incoming line devices, such as constant voltage transformers and local power
disconnects should be mounted close to the top of the enclosure, which is a
common entry point for power.
o Power supplies generate heat and so are mounted toward the top of the panel and
close to the incoming line devices.
o The PLC processor and I/O modules should be mounted close to eye level, either
adjacent to or below the power supply.
o Motor contactors, relays and other electromechanical components should be
mounted in an area well away from the PLC components, typically toward the top
of the cabinet.
o Motor drives should also be located well away from the PLC components. Large
drives should be in a separate cabinet.
o The I/O modules should be grouped according to the voltage level. Whenever

possible, the 120-volt AC discrete input or output modules should be segregated

from the DC discrete input or output modules. The analog modules should be
separated from the AC or DC discrete modules.
o If possible, all I/O modules in a chassis should be the same general type (AC
discrete, DC discrete, or analog). If general types must be mixed, then they should
be grouped together in the chassis, and any unused slots should be allocated
between the groups.
Wireway and Wiring Layout. Wires within a cabinet are routed in wireways that organize
the wiring and give a neat appearance to the panel. All wires should be organized into the
three categories in Table 4.4 (IEEE, 1982). In order to guard against coupling noise from

Table 4.4. Conductor categories (IEEE, 1982).

Category Description Examples

I Control and AC power AC power lines for I/O circuits and
power supplies
High-power digital AC I/O lines
High-power digital DC I/O lines
(typically connection to relays)
2 Signal and communication Analog I/O lines and DC power for
analog circuits
Low-power digital DC I/O lines
Communication cables (Ethernet,
ControlNet, remote I/O, etc.)
3 Intra-enclosure Low-voltage DC power wires (power
modules in cabinet)
Communication cables
186 I/O Modules and Installation

Table 4.5. Wire routing guidelines to reduce noise coupling (IEEE, 1982).

Category Routing Guidelines

Can be routed in the same cable tray or raceway with machine power
conductors of un to 600V AC (feedinQ: un to 100HP devices).
2 If it must cross power feed lines, it should do so at a right angle.
Route at least 5 ft. from high-voltage enclosures or sources of
RF/microwave radiation.
Properly shield (where applicable) and route in a wireway separate
from category-I conductors.
If not in a contiguous metallic wireway or conduit, route at least
0.15m (6 in.) from category-l conductors ofless than 20A; O.3m (I
ft.) from AC power lines of 20A or more, but only up to 100 kVA;
0.6m (2 ft.) from AC power lines of greater than 100 kVA.
If in a contiguous metallic wireway or conduit, route at least 0.08m
(3 in.) from category-I conductors of less than 20A; 0.15m (6 in.)
from AC power lines of20A or more, but only up to 100 kVA; O.3m
(l ft.) from AC nower lines of greater than 100 kVA.

3 Route conductors external to all wireways in the enclosure or in a

wireway separate from any category-1 conductors with the same
spacing listed from category-2 conductors, where possible.

one conductor to another, follow the routing guidelines in Table 4.5. Some other
considerations are:

• Analog I/O signals should be shielded and routed separate from the discrete
signals. A foil shield is preferable to a braided shield. When possible, the shield
on shielded cable should be grounded at the signal source. When a shielded cable
passes through intermediate junction boxes, shield continuity must be maintained.
• I/O rack interconnection cables (not the same as remote I/O cables) should be in a
wireway separate from other wiring. If this is not practical, then they should be
routed external to all wireways and fastened directly to the panel.
• The field devices are generally not wired directly to the I/O modules. Instead, the
field devices are wired to interposing terminal blocks. The connections between
the I/O module to the interposing terminal blocks can be done with individual
wires to terminal blocks (Figure 4.47a) or with a prewired cable between the I/O
module and a prefabricated termination module (Figure 4.47b).
• There should be at least I inch between wireways and terminals to allow for
wiring room and to show the wire labels.
• All wires should be clearly labeled with the same designation on both ends. Wire
labels should be easily matched to the control panel drawings. All labels in a
PLC-based system should be labeled in such a way that relates to the PLC
addressing, that is, the label should indicate the chassis, module, and channel.
• Color-code wires according to their function in order to aid troubleshooting.
NFPA 79 (NFPA, 2002) defines the following colors:
 4.5 INSTALLATIO WIRING 187

Green/yellow srripe Equipment grounding conductor.

Black Ungrounded line, load, control conductors at line
voltage.
Red Ungrounded AC control conductors at less than line
voltage.
Blue Ungrounded DC conrrol conductors.
Yellow Ungrounded conrrol circuit conductors that remain
energized when the main disconnect switch is in the
OFF position.
White or gray Grounded circuit conductor.
Whitelblue stripe Grounded (current-carrying) DC circuit conductor.
White/yellow stripe Grounded (current-carrying) AC control circuit
conductor that remains energized when the main
disconnect switch is in the OFF position.
Others define colors differently and add colors for analog signals.

Module
terminal
block Field wiring terminal blocks
mounted on DIN rail

(a) .

Pre-wired module terminal

block and ~cla~b~le:::::::::::::=::Z1"7r~~~~~

Field wiring terminal block

mounted on DIN rail

(b)

Figure 4.47. Interconnection between I/O module and field-wiring terminal blocks:
. (a) individual wires; (b) prefabricated termination module.
188 VO Modules and Installation

Operator Control Station Layout. If the panel door has operator controls or indications,
then it should be organized for ease of understanding and use. Considerations (Lawrence,
1998):

• Locate controls at a comfortable height for viewing and operating. Indicators,

alarm pilot lights, and meters should be at eye level, generally 62" to 67" from the
floor. Push-button and selector switches should be about 48" to 60" from the
floor.
• Group operator control devices into master, manual, and automatic functions.
Within these groups, arrange the controls into a logical order to initiate machine
functions in the proper sequence.
• Remember to check for the presence of a door stiffener or rib when placing the
indicators and controls, since they cannot be placed there.
• The legend plates should clearly describe the action to occur and the mechanism's
direction of movement.
• Do not abbreviate a word on the legend plate unless necessary.
Sample Panel Specification. A sample specification follows. Any reference to a
manufacturer and model number has been removed.

SECTION 1 - PRODUCTS
1.1 CONTROL ENCLOSURES
1.1.1 Control enclosures shall comply with the following
requirements:
a. Control enclosures located indoors in a protected
environment shall be EMA 12 steel with a gray
powder-coated finish.
b. Control enclosures located in harsh or wet indoor locations
shall be NEMA 4X fiberglass or stainless steel.
1.1.2 Control enclosures shall be [Mfr] or equal.
1.2 PLC PROCESSORS
1.2.1 PLC processors shall be furnished and installed per the model
numbers and quantities on the drawings.
1.2.2' Provide a 13-slot chassis minimum. Use slot fillers in unused
slots.
1.3 VO MODULES
1.3.1 The following VO modules shall be provided for [Mfr model]
processors as indicated on the drawings:
a. Digital Input Modules: [Mfr model], without exception.
b. Digital Output Modules: [Mfr model], without exception.
c. Analog Input Modules: [Mfr model], without exception.
d. Analog Output Modules: [Mfr model], without exception.
1.4 TERMINAL BLOCKS
1.4.1 Terminal blocks for power distribution and digital signals shall
comply with the following requirements:
a. Terminal blocks shall be UL rated for 600V, 30A
minImum.
 4.5 INSTALLATION WIRING 189

b. Terminal blocks shall have a compression-style screw

clamp connection.
c. Terminal blocks shall be capable of accepting two #12
AWG wires.
1.4.2 Terminal blocks for analog signals shall comply with the
following requirements:
a. Terminal blocks shall be UL rated for 300Y, 20A
minimum.
b. Terminal blocks shall have a compression-style screw
clamp connection.
c. Terminal blocks shall be capable of accepting two #16
AWGwires.
d. Terminal blocks shall be three level sensor blocks for
termination of signal positive, negative, and shield.
1.4.3 Fuse blocks shall comply with the following requirements:
a. Fuse blocks shall be UL rated for 600Y, lOA minimum.
b. Fuse blocks shall incorporate a hinged lever that accepts
5x20 mm fuses.
c. Fuse blocks shall have a compression-style screw clamp
connection.
d. Fuse blocks shall be capable of accepting two #12 AWG
wires.
e. Fuse blocks shall contain blown-fuse inditation through the
use of a neon lamp or an LED.
1.4.4 All terminal blocks and fuse blocks shall be designed for DIN
rail mounting. Extra deep 25 mrn DIN rail shall be used.
1.4.5 Contractor shall provide terminal block end sections and end
stops as necessary for a complete installation.
1.4.6 Terminal blocks and fuse blocks shall be provided with snap-on
label strips. Label shall be consistent with Contractor's control
panel drawings.
1.4.7 Terminal blocks and fuse blocks shall be [Mfr] or equal.
1.5 CIRCUIT BREAKERS
1.5.1 Circuit Breakers shall comply with the following requirements:
a. Single pole circuit breakers shall be [Mfr model] series or
approved equal.
b. Double and triple pole circuit breakers shall be [Mfr model]
series or approved equal.
1.6 RELAYS
1.6.1 Relays shall comply with the following requirements:
a. Relays shall be plug-in style with a DIN-rail mountable
base.
b. Relays shall have on/off indication.
c. Relays shall have a manual operator.
1.6.2. Relays shall be [Mfr model] or equal.
1.7 PUSHBUTTONS AND SELECTOR SWITCHES
1.7.1 Pushbuttons and selector switches shall comply with the
following requirements:
190 I/O Modules and Installation

a. Pushbuttons and selector switches shall be suitable for a

30.5 mm mounting hole.
b. Pushbuttons and selector switches shall be NEMA type
4/13.
c. Pushbuttons used for non-emergency service shall be black
flush-head.
d. Pushbuttons used for emergency stop service shall be red
mushroom-head.
e. Pushbuttons and selector switches shall be provided with
engraved legend plates indicating their function.
f. Pushbuttons and selector switches shall be provided with
normally-open and normally-closed contact blocks as
necessary. For pushbuttons, a minimum of I normally-open
contact block and I normally-closed contact block shall be
provided. For selector switches, a minimum of I
normally-open contact block and I normally-closed contact
block shall be provided in each position other than the "off"
position.
1.7.2 Pushbuttons and selector switches shall be [Mfr model] or
equal.
1.8 INDICATORS
1.8.1 Indicators shall comply with the following requirements:
a. Indicators shall be full-voltage incandescent.
b. Indicators shall be suitable for a 30.5 mm mounting hole.
c. Indicators shall be NEMA type 4/13.
d. Indicators shall be provided with engraved legend plates
indicating their meaning.
1.8.2. Indicators shall be [Mfr model] or equal.
1.9 CONTROL PANEL FUSED DISCONNECT SWITCHES
1.9.1 Fused disconnect switches for use in control panels shall
comply with the following requirements:
a. Disconnect switches shall be rated for 600V service.
b. Disconnect switches shall incorporate a blown fuse
indication.
c. Disconnect switches shall have an option for handles that
can be through-the-door mounted or direct mounted.
1.9.1 Control panels containing voltages in excess of 120V shall have
a through-the-door disconnect switch. Control panels
containing voltages of 120V or less shall have a disconnect
switch with a direct-mounted handle that does not penetrate the
enclosure.
1.9.2 Control panel disconnect switches shall be [Mfr model] or
equal.
1.10 INSTRUMENT POWER SUPPLIES
1.1 0.1 Instrument power supplies shall comply with the following
requirements:
 4.5 INSTALLATION WIRING 191

a. Power supplies that feed voltage to DC devices or PLC

inputs at DC voltage levels shall be either linear or
switching.
b. Power supplies that feed analog voltage inputs or analog
current loops shall be linear.
1.10.2 Instrument power supplies shall be [Mfr] or equal.

SECTION 2 - EXECUTION
2.1 CONTROL PANEL CONSTRUCTIO
2.1.1 The Contractor shall size the control panels to allow sufficient
space for all interior mounted equipment and wiring. Control
panels shall be sized for ease of maintenance.
2.1.2 All control panels shall have 10% spare terminal blocks and fuse
blocks, with a minimum of 10 spare terminal blocks and 2 spare
fuse blocks.
2.1.3 All VO including spare shall be wired out to terminal blocks.
2.1.4 All major panel equipment including PLC power supply, VO
chassis power supply, 24VDC power supply and power to each
VO module shall be sub-fused.
2.1.5 A minimum of two 120-VAC 60-Hz utility outlets should be
installed in the panel.
2.1.6 An internal fluorescent light with a conveniently located on/off
switch shall be installed in the panel.
2.2 VO MODULE WIRING
2.2.1 Connections from the control panel to field devices shall only be
made from interposing terminal blocks, not directly from the
PLC I/O modules. Provide the following interposing methods:
a. For digital input or digital output modules provide
prefabricated termination module, [Mfr model].
b. For analog input modules wire each channel to terminal
blocks per requirements of section 1.4.2. Provide minimum
of 4 terminal block connections per channel for (1) power,
(2) signal +, (3) signal-, and (4) shield. Distribute 24VDC
power for each channel. Tie all shield bloc.ks together and
wire to enclosure ground.
c. For analog output modules, wire each channel to terminal
blocks per requirements of section 1.4.2. Provide a
minimum of 3 terminal block connections per channel for
(I) signal +, (2) signal-, and (3) shield. Configure analog
output module to provide 24VDC power from the module.
Tie all shield blocks together and wire to enclosure ground.
2.3 CONTROL PANEL WIRING PRACTICES
2.3.1 All internal control panel wiring shall be a minimum of # 16
AWG. Power distribution wiring shall be stranded copper with
MTW insulation, rated 600V. Digital input/output wiring shall
be stranded copper UL 1061, rated 300V.
192 I/O Modules and Installation

2.3.2 As an exception to the previous paragraph, analog input/output

wiring shall be stranded copper, twisted, shielded pair, #24
AWG minimum, rated 300V, [Mfr model] or equal.
2.3.3 Every effort shall be made to segregate analog signals from
power distribution and digital signal wiring. Where analog
wiring must cross other wiring, it shall cross at right (90 degree)
angles.
2.3.4 Use the following wire colors:
Green Equipment grounding conductor.
White Neutral (grounded) 120 VAC circuit
conductor.
Black Line (120 VAC) control conductor.
Red AC Discrete output control conductor.
Orange AC Discrete input conductor.
Brown DC positive voltage control conductor
White/blue stripe DC negative (common) voltage control
conductor.
Blue DC Discrete output control conductor.
Violet DC Discrete input
2.3.5 All wiring shall be firmly supported inside the control panel. A
wireway system such as [Mfr model] shall be utilized in each
control panel. Wire ties shall be used as needed to support
cabling and to provide a clean installation. The Contractor shall
size the wireways to allow ample space for both internal control
panel wiring and field wiring.
2.3.6 All wiring in each control panel shall be clearly labeled with the
same designation on both ends. Wire labels shall be easily
matched to the control panel drawings. Wire labels shall be [Mfr
model] heat-shrink or equivalent.
2.3.7 All wiring shall be in compliance with the National Electrical
Code and other applicable state an.d local building codes.

4.6 CHAPTER SUMMARY

This chapter describes the wiring of PLC VO modules to discrete, analog, and
specialized field devices. In addition, other installation issues such as power distribution
and control panel layout is covered.

REFERENCES
Allen-Bradley, 1986. DC (5V) Multiplexer Input Module: User Manual, pub.
1771-6.5.10, Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1992. 1771 Discrete I/O DC Input and Output Modules, pub.
1771-2.180, Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1993. Very High Speed Counter Module: User Manual, pub.
1771-6.5.74, Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1996a. 1771 Discrete 1/0 AC Input and Output Modules, pub.
1771-2.182, Allen-Bradley Company, Inc, Milwaukee, WI.
 REFERENCES 193

Allen-Bradley, 1996b. High Speed Counter Module: User Manual, pub. 1746-6.5,
Allen-Bradley Company, Inc, Milwaukee, WI.
TNt
Allen-Bradley, 1996c. SLC 500 Analog I/O Modules: User Manual, pub. 1746-6.4,
Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1996d. SLC 500 Til-{ Thermocoup Ie,m
.1
V Input Module: User Manual,
pub. 1746-6.6.1, Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1996e. Stepper Controller Module: User's Manual, pub.
1746-999-121, Allen-Bradley Company, Inc., Milwaukee, WI.
Allen-Bradley, 1998a. Analog Output Module: User Manual, pub. 1771-6.5.30,
Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1998b. Discrete Input and Output Modules: Product Data, pub.
1746-2.35, Allen-Bredley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1998c. SLC 500 ™ RTD/Resistance Input Module: User Manual, pub.
1746-6.7, Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1999a. Analog Input Module: User Manual, pub. 1771-6.5.115,
Allen-Bradley Company, Inc, Milwaukee, WI.
Allen-Bradley, 1999b. High Resolution Isolated Analog Modules: User Manual, pub.
1771-6.5.127, Allen-Bradley Company, Inc, Milwaukee, WI.
GE Fanuc Automation, 1999. Series 90™_70 Programmable Controller: Data Sheet
Manual, pub. GFK-0600F, GE Fanuc Automation North America, Inc., Charlottesville,
VA.
GE Fanuc Automation, 2000. Series 90™_30 PLC UO Module Sepcifications, pub.
GFK-0898F, GE Fanuc Automation North America, Inc., Charlottesville, VA.
GE Fanuc Automation, 2003. VersaMax® Modules, Power Supplies, Carriers: User
Manual, pub. GFK-1504K., GE Fanuc Automation North America, Inc., Charlottesville,
VA.
Institute of Electrical and Electronic Engineers, 1982. IEEE GuideJor the Installation
ojElectrical Equipment to Minimize Electrical Noise Inputs to Controllers Jrom External
Sources, OEEE Std. 518-1982), IEEE, New York, NY.
Institute of Elec):rical and Electronic Engineers, 2001. IEEE Recommended Practice
Jor Protection and Coordination ojIndustrial and Commercial Power Systems - IEEE Buff
TM
Book ,(IEEE Std. 242-2001), IEEE, New York, NY.
International Electrotechnical Commission, 1995. IEC 61491: Electrical Equipment
ojIndustrial Machines - Serial Data LinkJor Real-time Communication Between Controls
and Drives, International Electrotechnical Commission, Geneva, Switzerland.
International Electrotechnical Commission, 200 I. IEC 60529: Classification oj
Degrees ojProtection Provided by Enclosures (IP Code), International Electrotechnical
Commission, Geneva, Switzerland.
Lawrence, Ken, 1998. "Successful Control Panel Design", The Dynamic Engineer,
Dynamic Engineering, Inc.
Morrison, Ralph, 1986. Grounding and Shielding Techniques in Instrumentation, 3rd
Ed., John Wiley & Sons, 1986.
194 I/O Modules and Installation

National Fire Protection Association, 2000. NFPA 70E - Standardfor Electrical Safety
Requirements for Employee Workplaces, National Fire Protection Association, Quincy,
MA.
National Fire Protection Association, 2002. NFPA 79 - Electrical Standard for
Industrial Machinery, 2002 Edition, National Fire Protection Association, Quincy, MA.
EMA, 1997. Enclosures for Electrical Equipmem (l000 Volts Maximum), pub.
250-1997, ational Electrical Manufacturers Association, Rosslyn, VA.
Rockwell Automation, 1998a. Industrial Automation Wiring and Grounding
Guidelines, pub. 1770-4.1, Rockwell Automation, Inc., Milwaukee, WI.
Rockwell Automation, 1998b. Logix5550 Controller: User Manual, pub. 1756-6.5.12,
Rockwell Automation, Inc., Milwaukee, WI.
Rcckwell Automation, 1998c. ControlLogix Analog I/O Modules: User Manual, pub.
1756-6.5.9, Rockwell Automation, Inc., Milwaukee, WI.
Rockwell Automation, 2000. ControlLogix High Speed Counter Module: User
Manual, pub. 1756-UM007A-EN-P, Rockwell Automation, Inc., Milwaukee, WI.
Rockwell Automation, 2001a. 1394 SERCOS Interface Multi-Axis Motion Control
System: Integration Manual, pub. 1394-IN024A-EN-P, Rockwell Automation, Milwaukee,
WI.
Rockwell Automation, 2001b. 8 Axis SERCOS Interface Module: Installation
Instructions, pub. 1756-IN572B-EN-P, Rockwell Automation, Inc., Milwaukee, WI.
Rockwell Automation, 2001c. ControlLogix Configurable Flowmeter Module: User
Manual, pub. 1756-UMO1 OA-EN-P, Rockwell Automation, Inc., Milwaukee, WI.
Rockwell Automation, 2001d. ControlLogix Digital I/O Modules: User Manual, pub.
1756-UM058C-EN-P, Rockwell Automation, Inc., Milwaukee, WI.
Rockwell Automation, 2001e. System Design for Control of Electrical Noise, pub.
GMC-RM001A-E -P, Rockwell Automation, Inc., Milwaukee, WI.
Schneider Automation, 1998. Quantum SERCOS Multi-Axis Motion Controller User
Guide, pub. 890 USE 11600, Schneider Automation, Inc., North Andover, MA.
Siemens, 1998. S7-300 and M7-300 Programmable Controllers Module
Specifications: Reference manual, pub. EWA 4NEB 710 6067-02 01, Siemens AG,
Niirnberg, Gennany.
Siemens, 2000. S7-4OO and M7-400 Programmable Controllers Module
Specifications: Reference manual, July, 2000 edition, pub. A5E00069467-03, Siemens AG,
Niimberg, Germany.
 PROBLEMS 195

PROBLEMS
P4-1. Specify an acceptable value and power rating of a pull-up resistor, Rpl/' to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.1). The
power supply is nominally 24 volts but can range between 23 and 25 volts, depending on the
current draw. The minimum "on" state voltage of the discrete input channel is 10 volts, and
the equivalent input resistance is 2200 ohms. The maximum device sink current is 50 rnA,
and the minimum device output voltage is 2.0 volts.

DC Power
Supply
-I 1+ v·
$R pu ~ ----- ----------------j,
I Out Yin ,,
.... I d ~ :, Sinking DC ,,
+--< Discrete ,
,,,
<:
3-wire sensor < Module
- (NPN out)
j ,
_________________ I
,
DC Common ---- -

Figure P4.1. Sinking sensor connected to sinking DC discrete input channel.

P4-2. Specify an acceptable value and power rating of a pull-up resistor, Rpl/' to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.1). The
power supply is nominally 24 volts but can range between 22 and 25 volts, depending on the
current draw. The minimum "on" state voltage of the discrete input channel is 20 volts, and
the equivalent input resistance is 10,000 ohms. The maximum device sink current is 50 rnA,
and the minimum device output voltage is 0.7 volts.

P4-3. Specify an acc~ptable value and power rating of a pull-up resistor, Rpu , to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.1). The
power supply is nominally 24 volts but can range between 23 and 25 volts, depending on the
current draw. The minimum "on" state voltage of the discrete input channel is 10 volts, and
the equivalent input resistance is 1000 ohms. The maximum device sink current is 100 rnA,
and the minimum device output voltage is 2.0 volts.

P4-4. Specify an acceptable value and power rating of a pull-up resistor, Rpu , to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.1). The
power supply is nominally 24 volts but can range between 23 and 25 volts, depending on the
current draw. The minimum "on" state voltage of the discrete input channel is 13 volts, and
the equivalent input resistance is 2200 ohms. The maximum device sink current is 200 rnA,
and the minimum device output voltage is 2.0 volts.
196 I/O Modules and Installation

P4-5. Specify an acceptable value and power rating of a pull-up resistor, Rpu , to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.1). The
power supply is nominally 24 volts but can range between 23 and 25 volts, depending on the
current draw. The minimum "on" stale voltage ofthe discrete input channel is 20 volts, and
the equivalent input resistance is 10,000 ohms. The maximum device sink current is lOrnA,
and the minimum device output voltage is 2.0 volts.

P4-6. Specify an acceptable value and power rating of a pull-up resistor, Rpu , to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.I). The
power supply is nominally 12 volts but can range between 11 and 13 volts, depending on the
current draw. The minimum "on" state voltage of the discrete input channel is 10 volts, and
the equivalent input resistance is 2500 ohms. The maximum device sink current is 50 rnA,
and the minimum device output voltage is 2.0 volts.

P4-7. Specify an acceptable value and power rating of a pull-up resistor, Rpu , to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.I). The
power supply is nominally 12 volts but can range between 11 and 13 volts, depending on the
current draw. The minimum "on" state voltage of the discrete input channel is 10 volts, and
the equivalent input resistance is 2200 ohms. The maximum device sink current is 50 rnA,
and the minimum device output voltage is 2.0 volts.

P4-8. Specify an acceptable value and power rating of a pull-up resistor, , to be used to
connect a sinking sensor device to a PLC sinking discrete input channel (Figure P4.l). The
power supply is nominally 12 volts but can range between II and 13 volts, depending on the
current draw. The minimum "on" stale voltage of the discrete input channel is 10 volts, and
the equivalent input resistance is 2200 ohms. The maximum device sink current is 100 rnA,
and the minimum device output voltage is 2.0 volts.
5 Timers and Counters

Chapter Topics:

• PLC timers
• PLC counters
• Timing and counting applications

OBJECTIVES

Upon completion of this chapter, you will be able to:

• Describe the function of the timers and counters of the PLCs covered by this text
• Describe the major types of industrial timing and counting applications
• Apply PLC timers and counters to industrial situations

Scenario: Conversion of a Modicon 884 PLC to a 984 PLC on a freeze-drier control.

You are called in to help out on a project to convert a freeze drier control from a
Modicon 884 PLC to a 984 PLC. Beyond the replacement of the processor, there are no
significant hardware changes. All of the I/O modules and their wiring remain intact. The
software is a different story. The 884 PLC program cannot be simply copied to the 984. The
freeze drier control used many of the 884 sequencer instructions and the 984 does not have
the equivalent to the- 884 sequencer instruction and the freeze drier control uses many of
these sequencers. The Modicon distributor has an 884-to-984 conversion program and did
the initial conversion. Another engineer in the consulting firm for which you work has been
working on debugging the converted program. He has been working on it for three days and
thinks he has found all the problems. Unfortunately, he has been called to work on a more
urgent project and you have been assigned to monitor the system while they start it up and
do any further debugging. He explains how each 884 counter-based sequencer has been
converted to a counter-based index into a bit array, preserving the functionality. He also
reviews the changes he has made to the program. The conversion was only supposed to take
a week and the week is finished. The biological research firm needs the freeze drier working
because it is starting to impact their research schedule. The freeze drier starts up as usual and
goes through the operation steps normally. After about two hours, the operator informs you
that the operation appears to be "stuck" in one step and not advancing to the next one. You
find the particular counter that controls this sequence (for example, Figure 5.1 a) and one of
the parallel contacts connected to the counter input (top UCTR connection) is closed,

197
198 Timers and Counters

SIT7DN SIT7DN
00121 00121

S8Tl4DN S8Tl4DN
00122 00122

Sl5T23DN SI5T23DN [CTR5

00123 00123 00345

S24T25DN S24T25D [CTRS

00124 00124 00345
#00030 / #00030
RST26 UCTR RST26 UCTR
00127 00127
/ 40055 / 40055

(a) (b)

Figure 5.1. Counter scenario: (a) 884 code; (b) correct 984 code.

indicating that the counter should increment to the next step. Why did the counter not
increment?
Solution: Thinking that the behavior was a chance event, you manually change the counter
accumulator and the operation continues, as it should. However, about three hours later, the
same thing happens. This time, it is not the same counter as before, but the symptoms are the
same. One ofthe parallel conditions to advance the counter is on, indicating that the counter
should increment its accumulator, yet that is not happening. You manually change this
counter accumulator and now know it is not a fluke. You dig through the program operation
manuals, but find no clues. You strongly suspect the problem lies with the counter. On a
hunch, you locate a document describing the 884 ladder logic instructions and compare the
description of its UCTR with that of the 984 UCTR instruction. Aha! The 884 UCTR
instruction is level-sensitive, that is, the counter increments ifits input is on. The 984 UCTR
is edge-sensitive, that is, the counter increments if its input changes from off to on. If the
counter input does not turn off between steps then the counter does not increment. Upon
further investigation, you fmd that on the two times where you found a "stuck" counter, the
previous step had zero duration. The conditions to transition out of the step were already
satisfied when the step was initiated. Therefore, the counter input condition did not change
from one program scan to the next. The 884 UCTR would increment under this condition.
The 984 UCTR would not. The fix is to simply force the counter input condition off
whenever the counter input condition turns on. The change is shown in Figure 5.lb. The
addition of the NC contact and coil forces the counter input to be off during the next scan
after the counter input turns on. When you change all of the sequencer counters, the freeze
drier runs as it should and in fact, that is the last problem with the program and you spend the
next day just sitting while the process runs.
 5.2 IEC TIMERS AND COUNTERS 199

5.1 INTRODUCTION
After coils and contacts, timers and counters are the next most commonly used ladder
logic instruction. This chapter describes the timer and counter function blocks for the PLCs
covered by this text. As for Chapter 3, the timer and counter function blocks for a particular
PLC are described in separate sections. That is, only the section(s) pertaining to the PLCCs)
of interest need to be studied. Following these timer and counter descriptions, common
timer and counter situations are described and illustrated with industrial examples.
There are two basic types oftimers: on-delay and off-delay. The off-delay timer is often
confusing to PLC programmers. The on-delay timer basically delays the turn-on of a
discrete signal and the off-delay timer basically delays the turn-off of a discrete signal. This
difference is illustrated in Figure 5.2. The PROX_1 discrete input is the input to an on-delay
timer and an off-delay timer. The output of the on-delay timer delays the off-to-on transition
of PROX_1, but does not delay the on-to-off transition. The output of the off-delay timer
delays the on-to-off transition of PROX_l, but does not delay the off-to-on transition.
Which type is appropriate? It depends on the application. For example, if an action needs to
be initiated x seconds after PROX_l turns on, then an on-delay timer is appropriate. If an
action needs to be stopped x seconds after PROX_l turns off, then an off-delay timer is
appropriate.
There are three basic types of counters: up-counter, down-counter, and up/down
counter. The three types are largely self-explanatory and their operation is explained in the
following sections.

5.2 IEC TIMERS AND COUNTERS

The IEC 61131-3 timers and counters are function block instructions. The standard
defines three timer function blocks and three counter function blocks. As described in the
standard, the operation of each of these function blocks is identical to a Modicon function
block of the same name. The names and description of these function blocks are:
lEe
Function Block Description
TON On-delay timer
TOF Off-delay timer
TP Pulse timer
CTU Up counter
CTD Down counter
CTUD Up/down counter

PROX I On
(Input of timers) Off..-----J
I I _

On-delay On
timer output Off
1
I Delay
10(.
Ir--------,. 1

1------
Off-delay On ~r-----------'-;:~
IDeia
timer output Off '-- _

Figure 5.2. Comparison of on-delay and off-delay timers.

200 Timers and Counters

The next section details the opaation and use of these function blocks.

5.3 MODICON TIMERS AND COU TERS

The Modicon Concept programming software for the Quantum and Momentum
processors defines three basic timer function blocks and three basic counter function
blocks. The names and .description of these function blocks are as follows:
Modicon
Function Block Description
TO On-delay timer
TOF Off-delay timer
TP Pulse timer
CTU Up counter
CTD Down counter
CTUD Up/down counter
In addition, the three counter function block names can be suffixed with an integer data
type, an extension of the IEC 61131-3 standard. The operation of each of these function
blocks is described and illustrated. The section is concluded with an implementation of the
retentive timer function which is not a standard function block.

5.3.1 TON On-Delay Timer

The TON on-delay timer is shown in Figure 5.3. There are two versions of this function
block: without the ENIENO connections (Figure 5.3a) and with the ENIE 0 connections
(Figure 5.3b). If the ENIENO are configured for the block, the EN input must be on for the
block to execute. The ENO output echoes the EN input and is on if EN is on and the block
executes without error. If the ENIENO connections are not configured, the block executes
every scan.
The TON timer basically delays the tum-on of a signal and does not delay the turn-off.
When the IN input turns on, the internal time (ET) increases. When ET equals the preset
time (PT), the timer is "timed out" and the Q output turns on. If IN turns off during the
timing interval, Q remains off, ET is set to zero, and timing recommences when the IN turns
on. The ET output can lie connected to a variable (of type TIME) in order to monitor the
internal time. The instance name of the timer appears above the block.

TON
Enable - EN ENO - Enable Out
TON
Input - IN Q - Output Input - IN Q - Output

Preset time - PT ET - Internal time Preset time - PT ET!- Internal time

(a) (b)

Figure 5.3. Modicon TON timer: (a) without EN/ENO; (b) with ENIENO.
 5.3 MODICON TIMERS A D COUNTERS 201

LSI DelTmr
LS I TO LSI_Hold
IN Q

1'#15s PT ET

(a)

IN o n J l
(LS_I)
Off
I I
II L
I
On I I I
Q
(LSI_Hold) I I I I
Off
I I I I I
ET
O~
I I
:/: 115s

-+lk- I. .1
5 sec. 15 sec.

(b)

Figure 5.4. Example Modicon TON timer: (a) ladder logic; (b) timing diagram.

Preset time can be a variable, or a literal of type TIME:

t#2d4h45mI 2s450ms
The prefix must be TIME#, 1'#, time#, or t#. The time is specified in days (D), hours (H),
minutes (M), seconds (S), and milliseconds (MS). The accuracy is 1 millisecond.
An example application of the TO instruction is shown in Figure 5.4a and its
associated timing diagram is shown in Figure 5.4b. The LS_l discrete input must remain on
for at least 15 second~ before the LS I_Hold coil is turned on. When LS_I is turned off after
5 seconds, ET is set to zero time and the LS I_Hold coil remains off.
The Modicon TO function block is nearly identical to the 87 TO function block and
similar to the Allen-Bradley TON function block and the GE Fanuc TMR function block.

5.3.2 TOF Off-Delay Timer

The TOF off-delay timer is shown in Figure 5.5. As with the TON function block, the
ENIENO connections are optionally configured. In Figure 5.5, they are not configured.
Looking at the IN and Q connections, the TOF timer operates exactly opposite of the
TO timer. The TOF timer basically delays the turn-off of a signal and does not delay the
turn-on. When the IN input turns off, the internal time (ET) increases. When ET equals the
preset time (PT), the timer is "timed out" and the Qoutput turns off. IfIN turns on during the
timing interval, Q remains on, ET is set to zero, and timing recommences when the IN turns
off. The preset time is specified in the same manner as for TON. The ET output can be
connected to a variable (of type TIME) in order to monitor the internal time.
202 Timers and Counters

TOF
Input - IN Q f--- Output

Preset time - PT ET I-- Internal time

Figure 5.5. Modicon TOF timer.

Prox2 Tmr
TOF
f---j IN Q f---j

1'#20s PT ET

(a)

IN o n L J
(PROX_2) Off
I I
II I
I
On
Q I I I
(Prox2_Del) Off I I
I I
I
I I
II
2
:~I
I I 1 0S
ET
O~
~k- \ .. ~I
5 sec. 20 sec.

(b)

Figure 5.6. Example Modicon TOF timer: (a) ladder logic; (b) timing diagram.

An example application of the TOF instruction is shown in Figure 5.6a and its
associated timing' diagram is shown in Figure 5.6b. The PROX_2 discrete input must
remain off for at least 20 seconds before the Prox2_Del coil is turned off. When PROX_2 is
turned on after 5 seconds, ET is set to zero time and the Prox2_Del coil remains on.
The Modicon TOF function block is nearly identical to the S7 TOF function block and
similar to the Allen-Bradley TOF function block and the GE Fanuc OFDT function block.

5.3.3 TP Pulse Timer

The TP pulse timer function block is shown in Figure 5.7. As with the other timer
function blocks, the ENIENO connections are optionally configured.
The TP timer generates a pulse at the Q output with duration of the preset time (PT)
when the IN input transitions from off to on. When IN changes from off to on, Q is turned
on and ET starts increasing. When ET equals PT, Qturns off. The internal time is set to zero
only ifET equals PT and IN is off. While the ET is increasing toward PT, any transitions on
IN are ignored. The preset time is specified in the same manner as for TON or TOF.
 5.3 MOmCON TIMERS AND COUNTERS 203

U
Input IN Q Output

Preset time PT ET Internal time

Figure 5.7. Modicon TP timer.

Smpl_Tp
TRIG TP PULSE
IN Q

1#20s PT ET

(a)

IN On J
(TRIG)
Off
1
UUl
I I
Q onJ 1
(PULSE) Off
I
I
I
I
1
II I
120s
I I I
ET I I
a I
I.. ~I I.. ~I
20 sec. 20 sec.

(b)

Figure 5.8. Example Modicon TP timer: (a) ladder logic; (b) timing diagram.

An example application of the TP instruction is shown in Figure 5.8a and its associated
timing diagram is shown in Figure 5.8b. When the ET is zero, an ofT to on transition of
TRIG causes the PULSE output to be turned on for 20 seconds. Keeping TRIG on longer
than 20 seconds does not alter the duration ofPULSE, it only prevents ET from being set to
zero at the end of the 20-second duration. Changes in TRIG during the 20-second pulse
duration are ignored.
The Modicon TP function block is nearly identical to the S7 TP function block. There is
no equivalent for the Allen-Bradley and GE Fanuc PLCs.

5.3.4 CTU Up Counter

The CTU up counter function block is shown in Figure 5.9. As with the timer function
blocks, the EN/EN a connections are optionally configured (not shown in Figure 5.9).
The counter accumulator (CV) increments by one for every ofT-to-on transition of the
count up (CD) input. When the cv;e; PV, then the Qoutput is turned on. When the reset (R)
204 Timers and Counters

CTU
Up trigger - CU Q I- CV 2: preset

Reset - R

Preset value - PV CV I- Count value

Figure 5.9. Modicon CTU counter.

input is on, the CV is zeroed. The CV and PV data types are both INT. The counter can
count beyond the PV value.
As an extension to IEC 61131-3, other PV and CV data types can be handled by
suffixing the function block name in the following manner:
Function PV and CV
Block Name Data Type
CTU INT INT
CTU DINT DINT
CTU UNIT UINT
CTU UDINT UDINT
An example application of the CTU function block is shown in Figure 5. lOa and its
associated timing diagram is shown in Figure 5.1 Db. As long as All_Reset is on, CV is held
at zero. When All_Reset is off, at every off-to-on transition of PROX_2, CV increments by
one. When the CV is equal to or greater than 3 (the PV input value), the Advance_CyI coil is
turned on. When Advance_CyI is already on, any more positive transitions of PROX_2
cause the value of CV to change, and Advance_Cyl remains on.
The Modicon CTU function block is nearly identical to the 87 CTU function block and
similar to the Allen-Bradley CTU function block and the GE Fanuc UPCTR function block.

5.3.5 CTD Down Counter

The CTD up coun.ter function block is shown in Figure 5.11. The counter accumulator
(CV) decrements by one for every off-to-on transition of the count down (CD) input. When
the CV ::; 0, then the Q output is turned on. When the load (LD) input is on, the CV is set to
the PV value. The CV and PV data types are both INT. The counter can count below zero.
As an extension to IEC 61131-3, other PV and CV data types can be handled by
suffixing the function block name in the same manner as for the CTU function block.
An example application of the cm function block is shown in Figure 5.12a and its
associated timing diagram is shown in Figure 5.12b. When Prox3_CtLd is on, the CV is
loaded with the PV (4). When Prox3_CtLd is off, at every off-to-on transition ofPROX_3,
PV decrements by one. When the CV is equal to or less than 0, the Prox3 Zero coil is turned
on. When Prox3_Zero is already on, any more positive transitions of PROX_3 cause the
value ofCV to change, and Prox3_Zero remains on.
The Modicon CTD function block is nearly identical to the 87 cm function block and
similar to the Allen-Bradley CTD function block and the GE Fanuc DNCTR function block.
 5.3 MODICON TIMERS AND COUNTERS 205

Smpl_Ctu
PROX 2 CTU Advance_Cyl
CU Q
All Reset
R

3 PV CV

(a)

CU On
(PROX_2) Off
Jl n n rL
I I I
R onl
(All_Reset) Off I'
I
I
I
I
I
I
I
11
I
On
Q
(Advance_Cyl)
Off
I
I
I
I
I
I
I
I 4
L
I
I I 3 I
CV
o-l
I
I
2

(b)
I
L
Figure 5.10. Example Modicon CTU counter: (aj ladder logic; (bj timing diagram.

CTD
Down trigger - CD Q I- CV S zero

Load preset - LD

Preset value - PV CV I- Count value

Figure 5.11. Modicon CID counter.

5.3.6 CTUD UpIDown Counter

The CTUD up/down counter function block is shown in Figure 5.13. It is basically a
combination of the CTU and CTD function blocks. The counter accumulator (CV)
increments by one for every off-to-on transition of the count up (CU) input. The counter
accumulator (CV) decrements by one for every off-to-on transition of the count down (CD)
input. When the CV ~ PV, then the QU output is turned on. When the CV ;$; 0, then the QD
output is turned on. When the reset (R) input is on, the CV is zeroed. When the load (LD)
206 Timers and Counters

Figure 5.12. Example Modicon CTD counter: (a) ladder logic; (b) timing diagram.

CTIJD .
Up trigger - CU QU - CV ~ preset

"Down trigger - CD QD - CV ~ zero

Reset - R

Load preset - LD

Preset value - PV CV - Count value

Figure 5.13. Modicon CTIJD counter.

"

input is on, the CV is set to the PV value. If both R and LD are on simultaneously, the R
input has precedence and sets the CV to zero. The CV and PV data types are both INT. The
counter can count above the preset value and below zero. As an extension to IEC 61131-3,
 5.3 MOmCON TIMERS A D COUNTERS 207

other PV and CV data types can be handled by suffixing the function block name in the
same manner as for the CTU function block.
An example application of the CTun function block is shown in Figure 5.14a and its
associated timing diagram is shown in Figure 5.14b. When both All_Reset and Boxes_Ld
are off, at every off-to-on transition of Box_In, PV increments by one. When both
All- Reset and Boxes- Ld are off, at every off-to-on transition of Box- Out, PV decrements

Box Ctr
Box In CTUD Remove_Box
CU QU
Box_Out No_Box
CD QD
All_Reset
R
Boxes_Ld
LD

3 PV CV

(a)

cuon~
(Box_In) Off
I I I I
CD On
(Box_Out)
Off
I
I
I
I
I
I
I
I
I
I
I
I
./Ul
R On
(All_Reset)

LD On
Off
I
I
I
I
I I
I
I
I
I
I
I
I
n
I
I
(Boxes_Ld)
Off
I
I
I
I
I
I
I
I
IL
I
QU On I I I
(Remove_Box)
Off
I I
I
I
I
I
I
II
On I
QD I I
(No_Box) Off l I
I
I
I
I
II II
4

~
3 I I 3
CV 1 2 I
0 1 2
I 0 I
(b)

Figure 5.14. Example Modicon CTUD counter: (a) ladder logic; (b) timing diagram.
208 Timers and Counters

by one. When the CV is equal to or greater than 3 (the PV input value), the Remove_Box
coil is turned on. When the CV is equal to or less than 0, the 0 Box coil is turned on. When
All- Reset is on, CV is loaded with zero. When Boxes- ~n the CV is loaded with the
Ld is,
.PV (3).
The Modicon CToo function block is nearly identical to the S7 CToo function block
and similar to the combination of the Allen-Bradley CTU and CTD function blocks. It is
also similar to the combination of the GE Fanuc UPCTR and DNCTR blocks..

5.3.7 Retentive On-Delay Timer

There are situations where a retentive on-delay function is required. A retentive

on-delay works like a TO ,except that the timer accumulator (ET) is not set to zero every
time the IN signal is off. Since Modicon Concept does not define a retentive on-delay timer,
one must be constructed from a non-retentive TO and a counter (CTU). The non-retentive
TO timer generates a "tick" every preset time (PT) interval which is counted. The counter
provides the retentive function. The counter Q output is turned on when CV ~ PV. The
delay time is then (TON PT)x(CTU PV). Of course, a separate input must be provided in
order to reset the timer, that is, set the counter CV to zero.
One possible solution is shown in Figure 5.l5a. The timing diagram is shown in Figure
5.l5b. When TIME_IN is on the Tic_Tmr timer generates a "tick" every second which is
counted by the Tic_Ctr CTU block. When the counter CV equals the PV (3) the TOT_DN
coil is turned on. IfTIME_ IN turns off during the timing interval, the counter CV remains at
its current value and counting resumes one second after TIME_IN turns on. In order to reset
the retentive timing function, T_RESET must be turned on. In order to show the operation,
the value of the timer PT is relatively large. Normally, a timer PT ofO.l seconds, or smaller
would be used for this delay.
The problem with this approach lies in choosing the interval t. Every time the timer IN
signal is off, the value of the ET at this instant is lost and could be as high as t. Therefore, the
timer PT should be chosen to match the expected frequency that the IN signa] changes to
off. If the IN signal is expected to change freque.ntly, then the timer PT should be small.
This implementation of a retentive timer is similar to the Allen-Bradley RTO function
block, the S7 S_ODTS function block, and the GE Fanuc ONDTR function block.
 5.4 A-B CONTROLLOGIX TIMERS AND COUNTERS 209

T Tic

Tic Tmr Tic_Ctr

TIME IN T Tic TON CTU TOT DN

HI IN Q cu Q

T RESET t#ls PT ET R

3 PV CV

(a)

IN o n I l
(TIME_IN) Off
I
R On
(T_RESET)
Off
I
I
I
rL
I
On I
T Tic
Off
I
I
I
W
I I I
I
I
Q On I I I
(TOT_DN) Off I I I I I
I I I I

CV
o
I
I
I

-.l k- I..
~
~I
I'
1 sec. 2 sec.

(b)

Figure 5.15. Modicon retentive on-delay timer: (a) ladder logic; (b) timing diagram.

5.4 A-B CONTROLLOGIX TIMERS AND COUNTERS

The Allen-Bradley ControlLogix processor has three timer function blocks and two
counter function blocks. The names and description of these function blocks are as follows:
ControlLogix
Function Block Description
TON On-delay timer
TOF Off-delay timer
RTO Retentive on-delay timer
CTU Up counter
CTD Down counter
210 Timers and Counters

The CTV and CTD function blocks can be combined to construct an up/down counter. The
operation of each of these function blocks is described and illustrated.

5.4.1 TON On-Delay Timer

The TO on-delay timer is shown in Figure 5.16. The TON timer basically delays the
turn-on of a signal and does not delay the turn-off. The tag specified in the "Timer" field
must be a TIMER data type (Figure 3.11). For the tag defined in Figure 5.16, the individual
parts (fields) of the TIMER structure are addressed as follows:
Reference Description
Sampl_Ton.DN Done
Sampl_Ton.TT Timer timing bit
Sampl_Ton.EN Enable
Sampl_Ton.ACC Accumulator
Sampl_Ton.PRE Preset value
When the timer input is on, the accumulator is counted up once each millisecond.
When the accumulator equals the preset value, the timer is "timed out" and the .DN bit is set
to on. If the timer input turns off during the timing interval, the accumulator is set to zero
and timing recommences when the input turns on. The.TT bit is on while the accumulator is
counting, but not yet at the preset value. The .EN bit is identical to the timer input condition.
The maximum interval is 2,147,483 seconds (,,24.8 days). The value of the accumulator
(.ACC) or the preset value (.PRE) can be accessed as DINT.
An example application of the TON instruction is shown in Figure 5.17a and its
associated timing diagram is shown in Figure 5.17b. The preset time is 3 seconds (3000 ms).
The input, LS_I must remain on for at least 3 seconds before the LS 1_DeITrnr.DN bit and
the LS_I_hold coil are turned on. When LS_I is turned off after 2 seconds, the accumulator
is set to zero and the LS I DeITrnr.DN bit remains off.
The ControlLogix TO function block is nearly identical to the PLC-5, and SLC-500
TON function block and similar to the Modicon TON, the Siemens S7 TON, and the GE
Fanuc TMR function blocks. .

5.4.2 TOF Off-Delay Timer

The TOF off-delay timer is shown in Figure 5.18. Looking at the timer input and the
.DN bit, the TOF timer operates exactly opposite of the TON timer. The TOF timer
basically delays the turn-off of a signal and does not delay the turn-on. The descriptions of
the function block fields and the tag references are the same as for the TON function block.
When the timer input is off, the accumulator is counted up once each millisecond.
When the accumulator equals the preset value, the timer is "timed out" and the .DN bit is

,----TON - - - - - ,
Timer On Delay
Timer Sampl_Ton
Preset 2000
Accum o
Figure 5.16. ControlLogix TON timer.
 5.4 A-B CONTROLLOGIX TIMERS A D COUNTERS 211

LS 1 TON
Timer On Delay
Timer LSI DelTrnr
Preset 3000 DrV-
Accum 0

LSI DeITrnr.DN LS 1 hold

[ (
(a)

Timer Input On
(LS_l) Off
J I II I
Timer Enable Bit On
(LS1_DeITrnr.EN) Off
J 1 I

I I
I

I
Timer Timing Bit On
(LS 1_DelTrnr.TT) Off
J 1 1

I
1

I
I
I
I
I 1 1 I
Timer Done Bit On I 1 1
(LS 1_DeITrnr.DN) Off I 1 1 I
I I 1 1
Accum Value I 1 3000
'2000
(LS 1_DelTrnr.ACC)
0
I
I. .. ,
2 sec.
,.
1

3 sec.
"I

(b)

Figure 5.17. Example ControlLogix TON timer: (a) ladder logic; (b) timing diagram.

turned off. If the timer input turns on anytime, the accumulator is set to zero and timing
recommences when the input turns off. The operation of the .EN and.TT bits is the same as
for the TO timer instruction.
An example application of the TOF instruction is shown in Figure 5.l9a and its
associated timing diagram is shown in Figure 5.l9b. The preset time is 20 seconds (20,000
ms). The input, PROX_2 must remain off for at least 20 seconds before the Prox2_Tmr.DN

r---TOF - - - - - ,
Timer Off Delay
Timer Sample_Tof
Preset 500
Accum 0

Figure 5.18. ControlLogix TOF timer.

212 Timers and Counters

PROX 2 ...----TOF - - - - - ,
f------j Timer Off Delay EN
Timer Prox2 Tmr
Preset 20000
o
DrV-
Accum

Prox2_Tmr.DN Prox2 Del

f------j [------~C
(a)

Timer Input o n L J
(PROX_2) Off II II
o I I
Timer Enable Bit
(prox2_Tmr.EN) o ; L J II I
I
o I I
Timer Timing Bit I
(Prox2_Tmr.TT) o ; S l
I I
II I
I
Timer Done Bit On
(Prox2_Tmr.DN) Off
I
I
I
I
I
I I
I I I I
i
Accum Value
(Prox2Jmr.ACC)
o
~10000
~
:/:
\. ~I
20000

10 sec. 20 sec.

(b)

Figure 5.19. Example ControlLogix TOF timer: (a) ladder logic; (b) timing diagram.

bit and the Prox2_Del coil are turned off. When PROX-.2 is turned on after 10 seconds, the
accumulator is set to zero and the Prox2_Tmr.DN bit remains on.
The ControlLogix TOF function block is nearly identical to the PLC-5, and SLC-500
TOF function block and similar to the Modicon TOF, the Siemens S7 TOF, and GE Fanuc
OFDT function blocks.

5.4.3 RTO Retentive On-Delay Timer

The RTO retentive on-delay timer is shown in Figure 5.20a. The RTO timer is like the
TON timer except that the accumulator is not reset when the timer input turns off. When the
timer input is on, the accumulator is counted up once each millisecond. When the
accumulator equals the preset value, the .DN bit is set to on. If the timer input turns off
during the timing interval, the accumulator remains at its current value and timing resumes
when the input turns on. A reset instruction that refers to the timer (Figure 5.20b) may be
used to set the accumulator to zero and thus turn off the .DN bit. Alternatively, one can use a
 5.4 A-B CONTROLLOGIX TIMERS AND COUNTERS 213

r---RTO - - - - - ,
Retentive Timer On
Timer Sampl_Rto
Sampl-:~
Preset 10000
Accum a -{RESFl
(a) (b)

Figure 5.20. ControlLogix RTO timer: (a) RTO instruction; (b) RES coil to reset RTO.

LS 3 r---RTO - - - - - - - ,
f---j f---1 Retentive Timer On EN
Timer LS3_0nTmr
Preset 200000 D0-
Accum a
LS3 OnTmr.DN LS3_0n_Done
~--f [-------1(
All Reset LS3 OnTmr
f-----l [ - - - - - - - - « R E S

(a)

~;Jl
Timer Input
(LS_3)
1 1
I
1
Timer Enable Bit o n J l
(LS3_0nTmr.EN) Off I
Timer Timing Bit °
1 I
I

(LS3_0nTmr.TT) o ; J l
1 1
I
1
Reset Condition On
(All_Reset) Off
1
1
I
1
1
1
I
I
I
IL
I
Timer Done Bit On I I I
(LS3_0nTmr.DN) Off I 1 I I
i2~OO
I 1 I I
Accum Value
(LS3_OnTmr.ACC)
a
1
1
---.Y,
-..l 1+
1
1 50000 :/:,
I
I.- .1
50 sec. ISO sec.
(b)

Figure 5.21. Example ControlLogix RTO timer: (a) ladder logic; (b) timing diagram.
214 Timers and Counters

MOY instruction (Chapter 7) to copy a zero to the timer accumulator. The operation of the
.EN and .TT bits is the same as for the TO and TOF timer instructions.
An example application of the RTO instruction is shown in Figure 5.21a and its
associated timing diagram is shown in Figure 5.2Ib. The preset time is 200 seconds
(200,000 ms). The LS3_0nTmr.D r bit is turned on when the cumulative time that LS_3
has been on is at least 200 seconds. After the accumulator has reached 200 seconds, the
LS3_0nTmr.DNbit remains on even after LS_3 turns off. The All_Reset must be turned on
to reset the timer.
The ControlLogix RTO function block is nearly identical to the PLC-5, and SLC-500
RTO function block and similar to the GE Fanuc ONDTR and Siemens S7 S ODTS
function blocks.

5.4.4 CTU Up Counter

The CTU up counter function block is shown in Figure 5.22a. The tag specified in the
"Counter" field must be a COUNTER data type (Figure 3.10). For the tag defined in Figure
5.22, the individual parts (fields) of the COUNTER structure are addressed as follows:
Reference Description
SampLCtu.DN Done
Sampl_Ctu.CU Count-up bit
Sampl_Ctu.CD Count-down bit
Sampl_Ctu.OY Accumulator overflow
Sampl_Ctu.UN Accumulator underflow
Sampl_Ctu.ACC Accumulator
Sampl_Ctu.PRE Preset value
The .CU and .OY bits are modified only by the CTU function block. The .CD and.UN bits
are modified only by the CTO function block.
For the CTU, the counter accumulator increments by one for every off-to-on transition
of the counter input. When the accumulator ~ preset value, then the .DN bit is turned on. A
reset instruction that refers to the counter (Figure 5.22b) may be used to set the accumulator
to zero and thus turn off the .DN bit (if the preset value is greater than zero). The .CU bit is
the same as the counter input condition. The preset value and accumulator are both DINT
data types. The counter can count beyond the Preset value. The overflow bit (.OY) is turned
9
on if the accumulator exceeded the upper limit of DINT (approximately 2.15xI0 ) and
wrapped around to the lower limit of DINT.

...---- CTU - - - - - ,
---i Count Up
Counter
Preset DJ9-
Accum

(a) (b)

Figure 5.22. ControlLogix CTU counter: (a) CTU instruction; (b) RES coil to reset counter.
 5.4 A-B CO TROLLOGIX TIMERS AND CO TERS 215

An example application of the CTU function block is shown in Figure 5.23a and its
associated timing diagram is shown in Figure 5.23b. As long as All_Reset is on, the
accumulator is held at zero. When All_Reset is off, at every off-to-on transition of
. PROX_2, the accumulator, Prox2_Ctr.ACC, increases by one. When the accumulator is
equal to or greater than 3 (the preset value), the Prox2_Clr.O bit is turned on. When
Prox2_Ctr.ON is already on, any more positive transitions of PROX_2 cause the value of
Prox2_Ctr.ACC to change, and Prox2_Ctr.O remains on.
The ControlLogix CTU function block is nearly identical to the PLC-5, and SLC-500
CTU function block and similar to the Modicon CTU, the Siemens S7 CTU, and GE Fanuc
UPCTR function blocks.

PROX_2 CTU
Count Up CU
Counter Prox2 c!i-
Preset 3 ON)
Accum 0

Prox2_ Ctr.ON Advance_Cyl

[ (
All Reset Prox2 Ctr
[ (RES

(a)

Counter Input
(PROX_2) ~;JlI I· n n
I I
rL
I
Count-Up Bit
(Prox2_Ctr.CU) ~;JlI I n n
I I
rL
I
Reset Condition onl l
(All_Reset) Off I
I
I
I
I
I
I
11
I
Counter Done Bit On I
(Prox2_ Ctr.ON)
Off
I
I
I
I
I
I
I 4
L
I
I I 3 I
Accum. Value
(Prox2_Ctr.ACC)
0.-1
I
I

(b)
2 I
L
Figure 5.23. Example ControlLogix CTU counter: (a) ladder logic; (b) timing diagram.
 216 Timers and Counters

5.4.5 CTD Down Counter

The CTD down counter function block is shown in Figure 5.24. The descriptions of the
function block fields and the tag references are the same as described with the CTU function
. block.
For the CTD function block, the counter accumulator decrements by one for every
off-to-on transition of the counter input. When the accumulator ~ preset value, then the .D
bit is turned on, which is the same behavior as for CTU. A reset instruction that refers to the
counter (Figure 5.22b) may be used to set the accumulator to zero and thus turn off the .D
bit (if the preset value is greater than zero). A MOY instruction (Chapter 7) must be used to
set the accumulator to a nonzero value. The .CD bit is the same as the counter input
condition. The preset value and accumulator are both DINT data types. The counter can
count below zero. The underflow bit (.UN) is turned on if the accumulator went below the
9
lower limit of DINT (approximately -2.l5x10 ) and wrapped around to the upper limit of
DINT.
An example application of the CTD function block is shown in Figure 5.25a and its
associated timing diagram is shown in Figure 5.25b. When Prox3_ CtLd is on,
Prox_3_Ctr.ACC is loaded with the value of 4. When All_Reset is off, at every off-to-on
transition of PROX_3, the accumulator, Prox3_Ctr.ACC, decreases by one. When the
accumulator is less than 2 (the preset value), the Prox3_Ctr.DN bit is turned off. Regardless
of the value of Prox3_Ctr.DN, any positive transitions of PROX_3 cause the value of the
accumulator to change. To reset the accumulator to zero, All_Reset is turned on.
The ControlLogix CTD function block is nearly identical to the PLC-5, and SLC-500
CTD function block and similar to the Modicon CTD, the Siemens 57 CTD, and the GE
Fanuc DNCTR function blocks.

5.4.6 UplDown Counter

For the ControlLogix, an up/down counter is constructed by combining a CTU and a

em function block that operate on the same counter. Both the CTU and CTD function
blocks basically act on a counter element, incrementing or decrementing the accumulator
and setting or clearing the bits in the structure. There is no conflict ifthe CTU function block
and the CTD function block refer to the same counter structure. The CTU block provides the
condition that increases the accumulator and the CTD block provides the condition that
decreases the accumulator. Note that the condition that determines the value of the .D bit
(accumulator ~ preset value) is the same, regardless of the type of counter.
An example application of the combination the CTU and em function blocks is
shown in Figure 5.26a and its associated timing diagram is shown in Figure 5.26b. When
All_Reset is off, at every off-to-on transition of Box_ln, the accumulator increases by one.
At every off-to-on transition of Box_Out, the accumulator decreases by one. Whcn the

, - - - CrD-----.
CountDown CD:>1
Counter
Preset
Accum
DN} I
Figure 5.24. ControlLogix CTD counter.
 5.4 A-B CONTROLLOGIX TIMERS AND COUNTERS 217

PROX 3 r--- CTD - - - - - ,

t------i 1---""" Count Down CD
Counter Prox3 Ctr
Preset 2
Accum 4

Prox3 Crr.DN Next_Step_34

t------i [ - - - - - - - - { (

All Reset Prox3 Crr

1------1 [-------~(RES

Prox3_CtLd MOV------,
f------i 1-------......, Move
Source: 4
4
Dest: Prox3_Ctr.ACC
4

(a)

Counter Input On
(PROX_3) Off

Count-Down Bit On
(Prox3_Ctr.CD) Off
I I
Load Condition On J11 I
(Prox3_CtLd) Off I ·1
I I I
Reset Condition On 1 I
(All_Res.et) Off 1 I
I
I IL
Counter Done Bit On
(Prox3_Ctr.DN) Off
I 1
I
I
J I

II
I
I
I
41 I I
I I
Accum. Value I I
(prox3_Ctr.ACC) I
0 I 0

(b)

Figure 5.25. Example ControlLogix CTD counter: (a) ladder logic; (b) timing diagram.