Talk Page



Programmable Logic Controllers (PLCs) have become an integral part of the industrial environment. As a technician involved with the processes controlled by PLCs, it is important to understand their basic functionalities and capabilities.

Menu Power Supply Software
4.2.1 Binary
4.3 Octal Chassis Group Rack Slot Elements Words Bit Bytes
5.3.3 Ethernet
5.3.5 PLC Terms ASCII ASCII Module Bus Topology CPU Daisy Chain I/O Kbps Mbps Node Protocol Ring Topology RS232 Serial Serial Port Star Topology Topology Transparent
6.5 Relays
6.6 Timers

What is a Programmable Logic Controller?

A programmable logic controller (PLC) is a digital computer used for automation of electromechanical processes, such as control of machinery on factory assembly lines, amusement rides, or lighting fixtures. PLCs are used in many industries and machines. Unlike general-purpose computers, the PLC is designed for multiple inputs and output arrangements, extended temperature ranges, immunity to electrical noise, and resistance to vibration and impact. Programs to control machine operation are typically stored in battery-backed or non-volatile memory. A PLC is an example of a real time system since output results must be produced in response to input conditions within a bounded time, otherwise unintended operation will result. Figure 1 shows a graphical depiction of typical PLCs.

Figure 1: Typical PLCs

Figure 2: Examples of Hardware PLCs Control

History of the PLC

PLC invention was in response to the needs of the American automotive manufacturing industry where software revision replaced the re-wiring of hard-wired relay based control panels when production models changed.

Before the PLC, control, sequencing, and safety interlock logic for manufacturing automobiles relied on hundreds or, in some instances, thousands of relays, cam timers, and drum sequencers and dedicated closed-loop controllers. The process for updating such facilities for the yearly model change-over was very time consuming and expensive, as electricians needed to individually and manually rewire each and every relay.

In 1968 GM Hydramatic issued a request for proposal for an electronic replacement for hard-wired relay systems. The winning proposal came from Bedford Associates of Bedford, Massachusetts. The first PLC, designated the 084 because it was Bedford Associateseighty-fourth project, was the result. Bedford Associates started a new company dedicated to developing, manufacturing, selling, and servicing this new product: MODICON, which stood for MOdular DIgital CONtroller. One of the people who worked on that project was Dick Morley, the "father" of the PLC.

In other industries, PLCs replaced relay systems used in manufacturing applications. This eliminated the high cost of maintaining these inflexible systems. In 1970, with the innovation of the microprocessor, the machine that was originally used as a relay replacement device only, evolved into the advanced PLC of today.

Advantages of PLCs

There are six major advantages of using PLCs over relay systems as follows:

  • Flexibility
  • Ease of troubleshooting
  • Space efficiency
  • Low cost
  • Testing
  • Visual operation

Flexibility: One single PLC can easily run many machines.

Ease of Troubleshooting: Back before PLCs, wired relay-type panels required time for rewiring of panels and devices. With PLC control any change in circuit design or sequence is as simple as retyping the logic. Correcting errors in PLC is both fast and cost effective.

Space Efficient: Fewer components are required in a PLC system than in a conventional hardware system. The PLC performs the functions of timers, counters, sequencers, and control relays, so these hardware devices are not required. The only field devices that are required are those that directly interface with the system such as switches and motor starters.

Low Cost: Prices of PLCs vary from few hundreds to few thousands. This is minimal compared to the prices of the contact, coils, and timers that companies pay to match the same things. Using PLCs also saves on installation cost and shipping.

Testing: A PLC program can be tested, evaluated, and validated in a lab prior to implementation in the field.

Visual observation: When running a PLC program a visual operation displays on a screen or module mounted status lamps assist in making troubleshooting a circuit quick, easy, and relatively simple.

Components of a PLC

All PLCs have the same basic components. These components work together to bring information into the PLC from the field, evaluate that information, and send information back out to various field. Without any of these major components, the PLC will fail to function properly.

The basic components include a power supply, central processing unit (CPU or processor), co-processor modules, input and output modules (I/O), and a peripheral device.

Figure 3: PLC Components

Input/Output Modules

The type of input modules used by a PLC depends on the type of input device. For example, some respond to digital inputs, which are eitheronoroffwhile others respond to analog signals. In this case, analog signals represent machine or process conditions as a range of voltage or current values. The PLC input circuitry converts signals into logic signals that the CPU can use. The CPU evaluates the status of inputs, outputs, and other variables as it executes a stored program. The CPU then sends signals to update the status of outputs.

Output modules convert control signals from the CPU into digital or analog values that can be used to control various output devices. The programming device is used to enter or change the PLCs program or to monitor or change stored values. Once entered, the program and associated variables are stored in the CPU. In addition to these basic elements, a PLC system may also incorporate an operator interface device to simplify monitoring of the machine or process.

Power Supply

The function of the power supply is to provide the DC power to operate the PLC. It is supplied by single-phase 120 or 240 VAC line power that powers the PLC system. See Figure x.

Figure 4:PLC Power Supply

The Power Supply is a module located in the PLC system module rack. The DC power (voltage and current) it provides power the other modules in the rack, such as the CPU, Co-processor Modules, and I/O Modules.

The line power provided to the PLC system also powers the I/O Field Devices. The PLC system is protected against PLC module or field device malfunctions. The Fuse in Figure 4 provides this protection.

Central Processing Unit CPU

The function of the CPU is to store and run the PLC software programs. It also interfaces with the Co-Processor Modules, the I/O Modules, the peripheral device, and runs diagnostics. It is essentially the "brains" of the PLC.

The CPU, shown in Figure X, contains a microprocessor, memory, and interface adapters.

Figure 5: CPU

The items shown inside the CPU and their basic functions are as follows:

  • The microprocessor codes, decodes, and computes data.
  • The memory (ROM, PROM/EEPROM/UVPROM, and RAM) stores both the control program and the data from the field devices.
  • The I/O Interface adapter connects the Co-Processor Modules, the I/O Modules and the Peripheral Device to the CPU.

Co-processor Modules

Co-Processor Modules are programmable general-purpose microcomputers that expand the capability and functionality of a PLC system. A Co-Processor Module is controlled by the CPU, and interfaces with the CPU as shown above.

Co-Processor Modules monitor and control peripheral systems such as the following:

  • Alphanumeric Displays
  • Video Graphics Displays
  • Communication Networks


The function of Software is to provide instructions to the CPU and Co-Processor Modules. Physically, software is a large group of logic ones and zeros stored in the memory of the CPU.

Peripheral Device

The function of the peripheral device is to input data and monitor the equipment operation. It may be a personal computer, handheld programmer, or an operator touch screen.

Basic Operation of a PLC

The operation of a PLC is very simple. The processor makes decisions based on a "ladder logic" program written by the user. In order to use the program properly, the PLC must communicate with the various field devices it monitors and controls. It then compares the actual conditions of the field devices with what the program instructs them to do, and updates the output devices accordingly.

  1. Input switch is pressed
  2. Input module places a "1" in the input data table
  3. The ladder logic program sees the "1" and caused a "1" to be put into the output data table
  4. The output data table causes the output module to energize associated point
  5. The output device energizes

Figure 6: PLC Operation

Ladder Logic of a Hardwired System

Ladder logic is a programming language that represents a program by a graphical diagram based on the circuit diagrams of relay-based logic hardware. It is primarily used to develop software PLCs used in industrial control applications. The name is based on the observation that programs in this language resemble ladders, with two vertical rails and a series of horizontal rungs between them.

Ladder logic is widely used to program PLCs, where sequential control of a process or manufacturing operation is required. Ladder logic is useful for simple but critical control systems, or for reworking old hardwired relay circuits. As PLCs became more sophisticated, it has also been used in very complex automation systems. Often the ladder logic program is used in conjunction with a HMI program operating on a computer workstation.

Manufacturers of programmable logic controllers generally also provide associated ladder logic programming systems. Typically, the ladder logic languages from two manufacturers will not be completely compatible; ladder logic is better thought of as a set of closely related programming languages rather than one language (the IEC 61131-3 standard has helped to reduce unnecessary differences, but translating programs between systems still requires significant work). Even different models of PLCs within the same family may have different ladder notation such that programs cannot be seamlessly interchanged between models.

Ladder logic is a rule-based language rather than a procedural language. A "rung" in the ladder represents a rule. When implemented with relays and other electromechanical devices, the various rules "execute" simultaneously and immediately. When implemented in PLC, the rules execute sequentially by software in a continuous loop (scan). By executing the loop fast enough, the effect of simultaneous and immediate execution is achieved to within the tolerance of the time required to execute every rung in the "loop" (the "scan time").

Simple Ladder Diagram of a Hardwired Circuit

The language itself is a set of connections between logical checkers (contacts) and actuators (coils). If a path traced between the left side of the rung and the output, through asserted (true or closed) contacts, the rung is true and the output coil storage bit is asserted 1. If no path is traced, then the output is false (0) and the coil by analogy to electromechanical relays is considered de-energized.

Ladder logic has contacts that make or break circuits to control coils. Each coil or contact corresponds to the status of a single bit in the PLCs memory. Unlike electromechanical relays, a ladder program can refer any number of times to the status of a single bit, equivalent to a relay with an indefinitely large number of contacts.

Contacts may refer to physical or hard inputs to the PLC from devices such as pushbuttons and limit switches via an integrated or external input module, or may represent the status of internal storage bits, which may be generated elsewhere in the program.

Each rung of ladder language typically has one coil at the far right. Some manufacturers may allow more than one output coil on a rung.

  • ( ) - Regular coil. It is energized whenever its rung is closed.
  • (\\) - "Not" coil. It is energized whenever its rung is open.
  • [ ] - Regular contact. It is closed whenever its corresponding coil or an input which controls it is energized.
  • [\\] - "Not" contact. It is open whenever its corresponding coil or an input which controls it is energized.

The coil or output of a rung, may represent a physical output, which operates some device connected to the PLC, or may represent an internal storage bit for use elsewhere in the program.

Figure 7: Simple Ladder Diagram

Ladder logic is typically read left to right and top to bottom. As each of the lines or rungs are evaluated, the output coil of a rung may feed into the next stage of the ladder as an input. In a complex system there will be many rungs on a ladder, which are numbered in order of evaluation.

Basic Operation

The operation of a PLC is very simple. The processor makes decisions based on a ladder logic program written by the user (see Topic I). In order to use the program properly, the PLC must communicate with the various field devices it is tasked with monitoring and controlling. It then compares the actual conditions of the field devices with what the program instructs them to do, and updates the output devices accordingly.

Operational Sequence

The operational sequence shown in Figure 6 is as follows:

  1. Input switch is pressed
  2. Input module places a "1" in the input data table
  3. The ladder logic program sees the "1" and caused a "1" to be put into the output data table
  4. The output data table causes the output module to energize associated point
  5. The output device energizes

Figure 8: PLC Operational Sequence

The Scan Cycle

PLCs operate by continually scanning programs and repeat this process many times per second. When a PLC starts, it runs checks on the hardware and software for faults, also called a self-test. If there are no problems, then the PLC will start the scan cycle. The scan cycle consists of three steps: input scan, executing program(s), and output scan. Figure 7 shows the three steps.

Input Scan: A simple way of looking at this is the PLC takes a snapshot of the inputs and solves the logic. The PLC looks at each input card to determine if it isonoroffand saves this information in a data table for use in the next step. This makes the process faster and avoids cases where an input changes from the start to the end of the program.

Execute Program (or Logic Execution): The PLC executes a program one instruction at a time using only the memory copy of the inputs the ladder logic program. For example, the program has the first input ason, since the PLC knows which inputs are on/off from the previous step it will be able to decide whether the first output should be turned on.

Output Scan: When the ladder scan completes, the outputs are updated using the temporary values in memory. The PLC updates the status of the outputs based on which inputs were on during the first step and the results of executing a program during the second step. The PLC now restarts the process by starting a self-check for faults.

Figure 9: PLC Scan Cycle

Logic Scan

Ladder logic programs are modeled after relay logic. In relay logic, each element in the ladder will switch as quickly as possible. Program elements can only be examined one at a time in a fixed sequence. The ladder logic graphic in Figure 8 is interpreted left-to-right, top-to-bottom. The ladder logic scan begins at the top rung. At the end of the rung, it interprets the top output first, then the output branched below it. On the second rung, it solves branches, before moving along the ladder logic rung.

Figure 10: PLC Logic Scan

PLC Components

PLCs have grown throughout industrial control applications because of the ease they bring to creating a controller: ease of programming, ease of wiring, ease of installation, and ease of changing. All PLCs have the same basic components. These components work together to bring information into the PLC from the field, evaluate that information, and send information back out to various field. Without any of these major components, the PLC will fail to function properly. PLCs span a wide range of sizes, but all contain six basic components as shown in Figure 9 and Figure 10:

  1. Power supply
  2. Input module
  3. Output module
  4. Processor (CPU)
  5. Rack or mounting assembly
  6. Programming unit (software)

Figure 11: PLC Rack

Figure 12: PLC Components

Power Supply

The power supply, as shown in Figure 13, provides power for the PLC system. The power supply provides internal DC current to operate the processor logic circuitry and input/output assemblies. Common power levels used are 24V DC or 120 VAC.

Figure 13: Power Supply

Input/Output Modules

Many types of inputs and outputs can be connected to a PLC, and they can all be divided into two large groups analog (discrete) and digital. Digital inputs and outputs are those that operate due to a discrete or binary change - on/off, yes/no. Analog inputs and outputs change continuously over a variable range - pressure, temperature, potentiometer. AC modules are always discrete. DC modules can be either discrete or analog.

The standard PLC module types and their descriptions are as follows:

  • AC Input - Uses AC voltage for input field device status.
  • DC Input (Discrete) - Uses DC voltage for input field device status.
  • DC Input (Analog) - The input is a variable DC signal level.
  • AC Output - Controls the ON/OFF state of AC output field devices such as relays, coils, and solenoids.
  • DC Output (Discrete) - Discrete DC output modules control the ON/OFF states of DC output field devices.
  • DC Output (Analog) - Provides a variable DC level.

I/O modules are available with various numbers of field device points, such as 4, 8, 16 and 32 point. Optocouplers in the modules are used to electrically isolate the module from the CPU.

Input Modules

Input modules provide the electrical connection between field devices (pushbuttons, limit switches, photoeyes) and internal process of the PLC. They differ in voltages and types of signals produced such ason,offor a variable voltage. Figure 14 shows an example of a generic input module.

Figure 14: PLC Input Module

Input Module Wiring

During normal PLC operation, different methods of connecting the field device wires to the I/O Modules offer no significant advantages over each other. Field devices can be wired differently to provide safety and protection in the event of failures in field devices, or faults in their electrical circuits.

"Backups" are field devices required to operate properly to provide safety in the event of a failure of another device or fault in a circuit. If the circuit for a backup is not affected, the backup should operate properly and continue to provide safety.

The safety of sequentially controlled systems, industrial facilities, and even personnel frequently depends on field devices (especially the backups) operating properly.

Sink and Source connections at a DC Input Module are defined by whether or not the field device DC power comes from a power supply external to the PLC (see Figure 14). Neither connection has any fault protection advantage

Input Indicators

Indicator lights are located on the digital input modules. These lights indicate the status of the input point on the module. The active light indicates whether or not the module is active and communicating with the processor.

The indicator lights are numbered in two rows, 00-7 and 10-17 (I/O addressing will be discussed later). These numbers represent each of the input points on the module. If an input point has power applied to it, the associated light illuminates. The lights are very useful in verifying that field devices, such as switches and photoeyes, are properly operating.

Figure 15 shows the common layout for indicator lights on an input module. Note that these lights ONLY show the user that power is getting to this point on the module. They do NOT indicate whether or not the processor is actually receiving that indication.

Figure 15: Input Indicators

Output Module

Outputs are the devices that the PLC uses to send changes out to the world. These are the actuator the PLC can change to adjust or control the process - motors, lights, relays, pumps, etc. Figure 16 shows an example of an output module.

Figure 16: PLC Output Module

Output Module Wiring

DC Modules use "Sink" and "Source" connections. The connections are determined by the configuration of the module being used. DC Modules are configured differently because of the DC polarity differences required of the two connections.

Discrete Modules

The term refers to an Off switching output. One type of PLC module that produces discrete signals is a relay module. It has physical relay that opens (Figure 17) or closes (Figure 18) to make or break a circuit connected to its terminals. Relay modules have several pairs; each of which are connected to internal relay contacts.

Figure 17: Relay Module Open Contact

Figure 18: Relay Module Closed Contact

Another type of discrete module is the sinking output module so named because conventional current flows into its terminal when a specific output is turned on. Conventional current flows from a positive to negative potential.

Figure 19: Sinking Output Module

Figure 20 and Figure 21 show the sequence sinking output module activated and not activated.

Figure 20: Output Module Activated

Figure 21: Output Module NOt Activated

Figure 22 shows a graphical depiction of events when the output is activated:

  1. An NPN transistor turns on
  2. The output terminal goes to LOW
  3. Conventional current flows from the positive of the power supply through the field device into the sinking terminal of the output module through the transistor to the negative of the power supply.

Figure 22: Output Activated

Discrete Module Wiring

The DC Output (Discrete) Module field device DC power always comes from a power supply external to the PLC (see Figure X). For certain fault conditions, the source output connection offers additional safety and protection.

Numerical Data Modules

With the integration of the microprocessor into PLC architecture in the early 1970s arrived new capabilities for arithmetic operation and data manipulation. This expanded processing capability led to a new class of I/O interfaces known as numerical data I/O. Numerical input interfaces allowed measured quantities to be input from instruments and other devices that provided numerical data, while numerical output interfaces allowed control of devices that required numerical data.

In general, numerical data I/O interfaces can be categorized into two groups: those that provide interface-to-multi-bit digital devices and those that provide interface-to-analog devices. The multi-bit interfaces are like the discrete I/O in that the processed signals are discrete. The difference, however, is that with the discrete I/O, only a single bit is required to read an input or control an output. Multi-bit interfaces allow a group of bits to be input or output as a unit to accommodate devices that require the bits to be handled in parallel form or in serial form. The numerical data I/O allows monitoring and control of analog voltages and currents, which are compatible with many sensors, motors drives, and process instruments. With the use of multi-bit or analog I/O, most process variables can be measured or controlled with appropriate interfacing.

AC Input Modules

AC input modules detect the presence or absence of AC voltage, and convert that voltage to a low level for input to the CPU. The AC voltage indicates the field device status. The voltage level is commonly 24, 115 or 220 VAC. Modules are available for up to 1,000 VAC. An AC Input module schematic diagram is shown in Figure X. When the field device completes the input circuit, a path for AC exists. An LED on the front of the module, indicates the input is present.

Figure 23: AC Input Module Schematic

A rectifier converts the AC to DC. The optocoupler isolates the input module from the CPU and effectively drops the DC voltage level to a level safe for CPU operations.

Most AC input modules use an external AC power supply for "interrogation" of the field devices. On-board AC power supplies increase the size of the module and require additional heat dissipation considerations.

AC inputs may use a common neutral connection for several points or there may be an "isolated" neutral for each point for additional fault protection. The input module shown in Figure 7 uses neutral C1 for points 00-07 and neutral C2 for points 10-17. Analog AC input modules are not commonly used because there are no standardized analog AC voltage or current signals.

DC Input Discrete Modules

Discrete DC input modules detect the presence or absence of DC voltage, and convert that voltage to a low level for input to the CPU. The DC voltage is used to indicate the field device status. Figure X shows a DC Input module schematic diagram.

Figure 24: DC Input Module (Discrete)

The DC voltage may be supplied by the input module (sink input) or it may be supplied by an external power supply (source input). Detailed explanations of "sinked" and "sourced" connections are given in this module later under "Field Device Wiring Connections."

As with AC input modules, the input is optocoupled to the CPU for isolation and CPU protection. An LED provides indication when the input is present (true).

DC Input Analog Modules

Analog DC input modules detect a DC voltage or current level, convert that variable into a proportional digital signal and transmit that data to the CPU for processing. The modules can be configured to operate on standard instrumentation signal ranges such as 4-20 mA, 10-50 mA, 15V, 0-1 0V.

A schematic diagram of an analog DC input module is shown in Figure 9.

Figure 25: DC Input Module (Analog)

After the module converts the analog value to digital, the PLC can turn control functions on and off at preset analog values. For example, when the input analog value reaches 70 percent, an alarm sounds.

In special applications, an analog input can be combined with an analog output module. Through programming, the PLC can then perform like a conventional single loop controller.

AC Output Modules

AC output modules control the ON/OFF states of AC output field devices such as relays, coils, and solenoids. They do not normally supply power to the field devices. Figure X is a schematic diagram of the module.

Figure 26: AC Output Module

The CPU uses a low-voltage DC signal to activate an opto-coupler in the output module. The opto-coupler gates a TRIAC or SCR that in turn completes the current path for the external power supply and field device. As with most PLC modules, the voltage rating and the number of points are selectable and the outputs may have common or isolated neutrals.

DC Output Modules Discrete

Discrete DC output modules control the on/off states of DC output field devices. Power is supplied by an external power supply. A schematic diagram of the module is shown in Figure 27.

Figure 27: DC Output Module (Discrete)

The CPU sends a low-level DC signal to an opto-coupler that completes the external DC current path that energizes the output field device. Field device connections may either be "sinked" or "sourced".

DC Output Modules Analog

Analog DC output modules convert digital data from the CPU to analog data for field device use. A Digital to Analog (D/A) converter in the module performs the conversion. See Figure 28 for a schematic diagram of the module.

Figure 28: DC Output Module (Analog)

Analog outputs conform to standard instrumentation signals (4-20 mA, 10-50 mA, 1-5V, 0-1 0V). An external DC power supply is used to power the output field device and the optocoupler in the module.

Analog outputs and inputs require more computing time than discrete modules. The additional time is needed to perform A/D and D/A conversions and to "block transfer" the additional information to and from the CPU.

For this reason, most PLC applications use on/off control with only a small amount of analog I/O. If a large amount of analog data requires processing, other systems (loop controllers, Digital Control Systems) are usually used.

Proportional Integral and Derivative PID Processor Module

A PID module combines analog input, analog output, and a control program of a typical single loop controller. A PID module is a smart module. This means that it has an on-board microprocessor and program.

The module carries out loop control without the use of the CPU in the PLC. These modules do communicate with the CPU for non-routine functions such as alarm reporting and programming changes.

Controls and Indicators

Most processor modules have front panel lights or indications to provide the user with status indications of PLC operation. These lights are very useful in troubleshooting. Also provided on most processor modules is a switch used to change the module mode of operation from RUN to PROGRAM. Additional connections are also usually provided to allow the connection of a terminal for programming the PLC and a port for connections to external I/O.


The processor module controls the PLC by executing the software program. During program execution, the processor reads all the inputs and uses the values, in accordance with the control logic, to energize or de-energize the outputs, thus solving the ladder network. Once all the logic is solved, the processor updates all outputs. The process of reading the inputs, executing the program, and updating the outputs is known as a scan. The time required to make a single scan varies from 1 msec to 100 msec.

The scan is normally a continuous and sequential process of reading the status of inputs, evaluating the control logic, and updating outputs. The common scan method of monitoring the inputs at the end of each scan is inadequate for reading certain rapid inputs. Some PLCs provide software instructions that will allow the interruption of the continuous program scan to immediately receive an input or update an output. These immediate instructions are very useful when the PLC must instantaneously react to a critical input or output.

User Program

The user program memory is an area reserved in the application memory for the storage of the control logic. All the PLC instructions that control the machine or process are stored here. The addresses of inputs and outputs, whether real or internal, are specified in this section of memory.

When the processor is in the run mode and the program is executed, the processor interprets the user program memory locations and controls the bits of the data table that correspond to real or internal outputs. The interpretation of the user program is accomplished by the processors execution of the executive program.

The maximum amount of available user program memory is normally a function of the processor size (i.e., I/O capacity). In medium and large controllers, the user program area is normally flexible by altering the size of the data table so that it meets the minimum data storage requirements. In small processors, however, the user program area is normally fixed.

Number Systems

The earliest number or counting system known to man was developed to help determine a quantity for a collection of possessions. As daily activities became more complex, numbers became more important in trade, time, distance, and all other aspects of human life.

Numbers are extremely important in everyday life. As such, a more complex system was required than counting everything on ones fingers and toes.

Ever since the necessity to count objects was discovered, man has been looking for easier ways to count them. The abacus, developed by the Chinese, is one of the earliest known methods for counting. The simple system of beads and wires arranged within a frame provided an early means for calculation. The apparatus proved helpful and is still used in some parts of the world today.

As time, technology, and need progressed, so did the means and methods required for accurate calculation. The first adding machine was invented by Blaise Pascal in 1642. Twenty years later, an Englishman, Sir Samuel Morland, developed a more compact device that could multiply, add, and subtract. Then, Wilhelm Liebnitz perfected a machine in 1671 that could perform all the basic operations including addition, subtraction, multiplication, and division, as well as the extraction of the square root. The principles pioneered by Liebnitz are still used today by modern electronic digital computers.

Computers are used wherever repeated calculations or the processing of large amounts of data is necessary. Some of the greatest applications are found in the military, scientific, and commercial fields. These fields have applications ranging from manufacturing processes to engineering design, to the identification and destruction of enemy targets. The advantages of digital computers include speed, accuracy, and labor savings. Often, computers are used to manage routine jobs, allowing personnel to perform other tasks, which may require a human touch.

People and computers normally do not speak the same language. However, methods of translating information into forms that are understood and used by both are necessary. Humans generally speak in words and numbers expressed in the decimal number system, while computers only understand coded electronic pulses that represent digital information.

In this section, you will learn about number systems, in general, and specifically learn about binary, octal, and hexadecimal number systems. The methods for converting numbers in the binary, octal, and hexadecimal systems to equivalent numbers in the decimal system, and vice versa, will also be discussed. This training module will discuss the different types of number systems that can be converted easily to the electronic pulses necessary for digital equipment and industrial communications.

Types of Number Systems

The decimal system is the most commonly used number system. The Roman numeral system, though seldom used, is another well-known number system. Other number systems include binary, octal, and hexadecimal. All number systems have a base and a number value.


The simplest possible number system is the binary, or base 2, system. Since the binary number system is a base 2 system, only two symbols, 0 and 1, are used.

The binary system is also a positional notation system. While the decimal system uses powers of 10 to determine the value of a position, the binary system uses powers of 2 to determine the value of a position. A bar graph showing the positions and the powers of the base is shown below:

Table 1 provides a comparison of decimal and binary numbers. Notice each time the total number of binary symbol positions increases, the binary number indicates the next higher power of 2. The table also shows that more symbol positions are necessary in the binary system to represent equivalent values in the decimal system.


The octal, or base 8, number system is a common system used with computers. Because of its relationship with the binary system, it is useful in programming some types of computers. As with the other systems, the base, or radix, is the number of symbols used in the system. The octal system uses eight symbols, 0 through 7. The base is indicated by the subscript 8. Table 2 compares the binary, octal, and decimal number systems and shows that one octal digit is the equivalent value of three binary digits.

Similar to the decimal and binary systems, the octal system is a positional notation system. The octal system uses powers of 8. The following bar graph shows the positions and the power of the base:

Here the power, orexponent, indicates the number of times the base is multiplied by itself. The value of thismultiplicationis expressed in base 10 as shown below:

Decimal to Octal/Octal to Decimal Conversion

In decimal systems, each decimal place is a base of 10. For example:

In octal, numerals each place is a power with base 8. For example:

By performing the calculation above in the familiar decimal system we see why 112 in octal is equal to 64 + 8 + 2 = 74 in decimal.

Binary to Octal/Octal to Binary Conversion

The following example further illustrates this comparison and shows the conversion of octal 2258to binary and back to octal:


The hexadecimal, or hex, number system is a more complex system in use with computers. The name is derived from the fact that the system uses 16 symbols. It is beneficial in computer programming because of its relationship to the binary system. Since 16 in the decimal system is the 2 to the fourth power (or 24), one hex digit has a value equal to four binary digits. Table 2 compares the binary and hexadecimal number systems.

As in each of the previous number systems, a unit stands for a single object. A number in the hex system is the symbol used to represent a unit or quantity. The Arabic numerals 0 through 9 are used with the first six letters of the alphabet. Letters are sometimes used in math problems to represent unknown quantities but in the hex system, A, B, C, D, E, and F each have a definite value as shown below:

The base, or radix, of the hex system is 16, which represents the number of symbols used in the system. A quantity expressed in hex is annotated by the subscript 16, as shown below:

Like the binary, octal, and decimal systems, the hex system is a positional notation system. Powers of 16 are used for the positional values of a number. The following bar graph shows the positions:

Multiplying the base times itself the number of times indicated by the exponent will show the equivalent decimal value:

As seen by the positional values, usually fewer symbol positions are required to express a number in hex than in decimal. The following example shows this comparison:

Binary Coded Decimal

Computers and microprocessors both operate on a series of electrical pulses called words. A word can be represented by a binary number such as 101100112. The word length is described by the number of digits or BITS in the series. A series of four digits would be called a 4-bit word and so forth. The most common are 4-, 8-, and 16-bit words. Quite often, these words must use binary-coded decimal inputs.

Binary-coded decimal, or BCD, is a method of using binary digits to represent the decimal digits 0 through 9. A decimal digit is represented by four binary digits, as shown below:

You should note in the table above that the BCD coding is the binary equivalent of the decimal digit.

Since many devices use BCD, knowing how to handle this system is important. You must realize that BCD and binary are not the same. For example, 4910in binary is 1100012, but 4910in BCD is 01001001BCD. Each decimal digit is converted to its binary equivalent.


Addressing is the most important concept to understand when learning PLCs. Addressing is how we make a correlation between the field devices controlled by the PLC, and the data that is stored in the PLCs memory. If you cannot address a point or group of points in the PLCs memory, then you cannnot control the field device associated with that point.

The easiest way to approach understanding the addressing used in the Allen Bradley PLC-5 is to view all addresses from the processors point of view. By this, we mean that in order for a real device in the field, such as a relay, to be operated by the PLC, the PLC must first have a record of that point in its memory. That point can then be accessed by the PLC. The Allen Bradley PLC-5 stores the information regarding all of the points it can address in areas called Data Tables as shown in figure 29. The data tables are divided up by function.

Figure 29: Data Table Files

Addressing Terminology

There are seven terms one must know in order to understand addressing as defined below.


Hardware assembly (physical rack) that houses devices such as I/O modules, adapter modules, processor modules, and power supplies. Chassis are available in six sizes: 4-, 8-, 12-, and 16-slot.


An I/O addressing unit consisting of one input and one output word (16 bits each) of the data table. Depending on the density of the I/O module and the addressing mode used, some of the bits in a group may be unused. The group number is included in I/O addresses in the position represented with agin the format: I:rrg/xx.


An I/O addressing unit that corresponds to eight input image table words and eight output image table words (8 groups). A rack is a logical entity not to be confused with the physical chassis. 8 groups = 1 full rack, 6 groups = rack, 4 groups = rack, 2 groups = rack. The rack number is included in I/O addresses in the position represented with an "rr" in the format: I:rrg/xx.


A location in a chassis for installing a module. The number of physical slots per group determines the addressing mode.


Data files are made up of individual data blocks called "Elements" or "Structures". Each element is composed of "words", and each word is composed of "bits". Elements are comprised of from 1 to 56 words, depending on the instruction. Most instructions you will encounter will have from one to three words to an element.

An example of an element level address is T4:0

T4:0 indicates the first timer (0) in the default timer file (T4). Each timer is comprised of three (3) 16 bit words. When you say T4:0, you are referring to all three of these words as a group.

Figure 30: Elements

Another example, illustrated on the right, is the address N7:15. This identifies element 15 in the integer file N7. Since integer files have one word elements, the element number and word number will match in this case as shown in Figure X and Figure Y.

Figure 31: Element Address


Words are the next level of identification down from elements. Each "word" in the PLC is comprised of 16 bits as shown in Figure 32.

When an instruction is addressed to the word level, it is looking at all 16 bits of a particular word in an element. When an element is comprised of more than one word, the 0 word contains status data in bit form, and the other words contain data which must be stored in more than one bit.

A good example is a timer file. Timers elements are comprised of three words. The 0 word contains status information which can be stored in individual bits. For example, the 17 bit in the 0 word is the done bit, indicating that the timer has timed out.

The one and two words contain information which require a full word to contain. In the timer, the one word contains the value of the preset (PRE) of the timer, and the two word contains the information about the Accumulator (ACC). These words are addressed by their symbols, PRE and ACC. When accessing an element to the word level, the period (.) is used to delimit instead of the slash (/).

Figure 32: Word Address


The smallest unit of data in a PLC is the bit. Bits make up words, which in turn make up elements. Many instructions must be specified down to the bit level. For example, if you want to know the status of the Done bit on a timer, you must specify the address down to the bit level. The address would be:


T4:0 is the element we are addressing. Since we are addressing a single bit, we put the "/" sign as a bit delimiter, and then specify the bit. In this case the Done bit. Figure 33 shows the element B3:63 and the bit 15. Note that in this case, the individual bits are identified by numbers, not names (as in the done bit in the timer). This is true of bits in all files except those having more than one word in an element.

Figure 33: Bit Address


A group of bits forming a piece of data. Usually a subset of a word consisting of eight bits.

Rack Addressing Rules

Addressing to a rack is just assigning a physical slot in the chassis to a logical word in the processor. Rack addressing involves only data tables 0 and 1, the output and input data tables. The type of addressing shown in figure x is called single slot addressing, and is the most common type of addressing used in Allen Bradley PLCs. To review the rules for rack addressing, use the following while referring to the previous figure on PLC 5 Racks.:

  • A rack is a logical term that defines 8 words in the processor input data table and 8 words in the processor output data table.
  • These words are numbered 0-7.
  • Each logical rack can store 128 bits of information in its input rack and 128 bits in its output rack. (8 words per rack x 16 bits per word=128 bits of data storage)
  • In single slot addressing, each physical slot is addressed to one input word and also to one output word. This makes it possible to put either an input module or an output module in any slot.
  • The number of logical racks determines how many points a particular model of PLC can address. This number is fixed for any particular processor and cannot be changed.
  • Rack addressing is always in the format shown in Figure 34 below.

Figure 34: Rack Addressing Format

Addressing Examples

Each type of device has its own table in which to store data. In order to specify exactly which piece of data is to be accessed, an addressing format is used which makes use of this data structure.

In Figure 35, addresses for input and output addresses are shown. Reading from the left to the right, the addresses tell the following:

  • Which data table a point exist in
  • Which rack of data the point is in
  • Which group the point is in
  • The exact point

Note that a colon separates the file identifier from the rest of the address. This is constant for ALL addresses.

Figure 35: Rack Addressing Format

PLC Communication Description

PLCs communicate with other PLC stations on the Data Highway+and also communicate with their own remote racks via the remote I/O communications channel. Some guidelines for PLC communications are as follows:

  • The DH+provides communications between processors on the DH+
  • Each processor on the DH+MUST have its own unique address
  • A total of 64 (77 Octal) stations can be set up on one peer link.
  • If a processor has enough communications channels (like the 5/40), it can communicate on more than one DH+peer link at a time.
  • DH+is simply a method for communicating from one PLC to another. It DOES NOT allow one PLC to control another PLC. It just lets you talk from PLC to PLC. It also makes it possible to plug a terminal into ANY PLC on the peer link and talk to any other PLC on the peer link with the terminal.
  • Each chassis MUST have either an Adapter module or a Processor module installed in the left most slot.
  • In order for a processor to have remote chassis, one channel MUST be set up as a scanner channel.

PLC Communication Protocols

Today, most manufacturers of PLC systems have developed their own proprietary communication protocol, making it difficult to combine PLC components from different manufacturers. Communication protocols set the standards for data representation, signaling, authentication, and error detection required to send information over a communications channel. MODBUS is currently the most common protocol used by PLC manufacturers.

Device Net

Device Net is one of the most widely supported networks. It is an open standard, so components from a variety of manufacturers can be used together in the same control system. It is supported and promoted by the Open Device Net Vendors Association (ODVA). This group includes members from all of the major controls manufacturers. The network is noise-resistant and robust. One major change for the control engineer is that the PLC chassis can be eliminated and the network can be directly connected to the sensors and actuators. This reduces the total amount of system wiring by moving I/O points closer to the application point. Two-way communication inputs and outputs allow diagnosis of network problems from the main controller.

Device Net covers all seven layers of the Open Systems Interconnection (OSI) standard. The protocol has a limited number of network addresses with very small data packets. This helps limit network traffic and ensures responsiveness. The length of the network cables limits the maximum speed of the network. The basic features include:

  • A single bus cable that delivers data and power
  • Up to 64 nodes on the network
  • A data packet size of 0-8 bytes
  • Cable lengths of 500m/250m/100m for speeds of 125kbps/250kbps/500kbps, respectively
  • Devices can be added or removed while power is on
  • Based on the CANbus (Controller Area Network) protocol for OSI levels 1 and 2
  • Addressing includes peer-to-peer, multicast, master/slave, polling, or change of state

Control Net

Control Net is complimentary to Device Net. The standard is designed for communication among controllers and it permits more complex messages than Device Net. It is not suitable for communication with individual sensors and actuators, or with devices off the factory floor. Control Net is a more complicated protocol method than Device Net. Control Net features include:

  • Multiple controllers and I/O on one network
  • Deterministic
  • Data rates up to 5Mbps
  • Multiple topologies (bus, star, tree)
  • Multiple media (coax, fiber, etc.)
  • Up to 99 nodes with addresses; up to 48 without a repeater
  • Data packets up to 510 bytes
  • Unlimited I/O points
  • Maximum length examples:
    • 1000m with coax at 5Mbps - 2 nodes
    • 250m with coax at 5Mbps - 48 nodes
    • 5000m with coax at 5Mbps with repeaters
    • 3000m with fiber at 5Mbps
    • 30Km with fiber at 5Mbps and repeaters
    • Five repeaters in series, 48 parallel segments
  • Devices individually powered (no network power)
  • Devices can be removed while network is active

The network is unique because it supports a real-time messaging scheme called Concurrent Time Domain Multiple Access (CTDMA). The network has scheduled, high priority and unscheduled, low priority updates. When collisions are detected, the system waits at least 2ms for unscheduled messages. However, scheduled messages will be passed sooner, during a special time window.


Ethernet is the predominate networking format. The first version was released in 1980 by a consortium of companies, and various versions of Ethernet frames were released in the subsequent years. These include Version II and Novell Networking (IEEE 802.3). Most modern Ethernet cards support different types of frames.

The Ethernet frame is shown in Figure 36. The first six bytes make up the destination address for the message. If all of the bits in the bytes are set, then any computer that receives the message will read it. The first three bytes of the address are specific to the card manufacturer, and the remaining bytes specify the remote address. The address is common for all versions of Ethernet. The source address specifies the message sender. The Ethernet type identifies the frame as a Version II Ethernet packet if the value is greater than 05DChex. Other Ethernet types use these two bytes to indicate the data length. The data can be from 46 to 1,500 bytes in length. The frame concludes with a checksum that is used to verify data is correctly transmitted. When the end of the transmission is detected, the last four bytes are used to verify the frame is correctly received.

Data Highway Plus DH+

Allen-Bradley PLCs communicate with other PLC stations on the DH+protocol and also communicate with their own remote chassis via the remote I/O communications channel. Some guidelines for DH+communications include:

  • The DH+provides communication among DH+processors.
  • Each processor on the DH+must have its own unique address.
  • A total of 64 (77 Octal) stations can be set up on one peer link.
  • If a processor has enough communication channels (like the 5/40), it can communicate on more than one DH+peer link at a time.
  • DH+is simply a method for communicating from one PLC to another. It does not allow one PLC to control another PLC; it just lets you talk from PLC to PLC. It also makes it possible to plug a terminal into any PLC on the peer link and talk to any other PLC on the peer link with the terminal.
  • Each chassis must either have an adapter module or a processor module installed in the leftmost slot.
  • In order for a processor to have a remote chassis, one channel must be set up as a scanner channel.


Stands for "American Standard Code for Information Interchange." For example, when the letter "A" is transmitted it is automatically coded as "65" by the sending equipment. The receiving equipment translates the "65" back to the letter "A." Thus, different devices can communicate with each other as long as both use ASCII code.

ASCII Module

This intelligent PLC module is used for connecting PLCs to other devices also capable of communicating using ASCII code as a vehicle.

Bus Topology

This is a linear local area network (LAN) arrangement in which individual nodes are tapped into a main communications cable at a single point and broadcast messages. These messages travel in both directions on the bus from the point of connection until terminators at each end of the bus dissipate them.

Figure 36: Bus Network Topology


Stands for "central processing unit," which is that part of a computer, PLC, or other intelligent device where arithmetic and logical operations are performed and instructions are decoded and executed.

Daisy Chain

This is a description of the connection of individual devices in a PLC network, where each device is connected to the next and communications signals pass from one unit to the next in a sequential fashion.

Distributed Control

This is an automation concept in which portions of an automated system are controlled by separate controllers, which are located in close proximity to their area of direct control (control is decentralized and spread out over the system).

Host Computer

A computer used to transfer data to, or receive data from, a PLC in a PLC/computer network.

Intelligent Device

Any device equipped with its own CPU.


Abbreviation for Inputs and Outputs, which are modules that handle data to the PLC (inputs) or signals from the PLC (outputs) to an external device.


This stands for "kilobits (thousand) bits per second," a rate of measure for electronic data transfer.


Abbreviation for "million bits per second."


This term is applied to any one of the positions or stations in a network. Each node incorporates a device that can communicate with all other devices on the network.


Manner in which data is arranged and coded for transmission on a network.

Ring Topology

This is a LAN arrangement in which each node is connected to two other nodes, resulting in a continuous, closed, circular path or loop for messages to circulate, usually in one direction (Figure X). Some ring topologies have a special "loop back" feature that allows them to continue functioning even if the main cable is severed.

Figure 37: Ring Topology


An IEEE standard for serial communications that describes specific wiring connections, voltage levels, and other operating parameters for electronic data communications. There also are several other RS standards defined.


Electronic data transfer scheme in which information is transmitted one bit at a time.

Serial Port

Communication access point, shown in Figure 38, on a device that is set up for serial communications.

Figure 38: Serial Communications Port

Star Topology

A LAN arrangement in which nodes are connected to one another through a central hub, which can be active or passive (Figure 39). An active hub performs network duties such as message routing and maintenance. A passive central hub simply passes the message along to all the nodes connected to it.

Figure 39: Star Topology


This relates to a specific arrangement of nodes in a LAN in relation to one another. See Figure 40 for the most commonly used types topologies.

Figure 40: Topology


This term describes automatic events or processes built into a system that require no special programming or prompting from an operator.

Remote I/O Configurations

It is common in the industry to centralize PLCs in relation to the process being controlled. This cuts down on the number and length of cabling used to transmit information to and from the PLC. In some cases, this is not feasible or ideal because an industrial environment can be quite harsh on the sensitive electronics used in PLCs. For this reason, remote I/O modules have come into existence. There are many advantages to using remote I/O modules, including:

  • Remote I/Os eliminate expensive point-to-point wires by networking just a few, or thousands of, process signals onto one digital communication link.
  • For data acquisition, remote I/O modules send signals from field-mounted sensors, transmitters, transducers, and alarms directly to DCS, PLC, and PC-based systems.
  • Ability to send control signals long distances to remote valves, pumps, and motors with remote?I/O.
  • Unburdening of an overworked computer system by distributing signal conditioning and intelligence.
  • Can be used as expansion I/O to add points to a PLC system.
  • Convert weak sensor signals to immune digital signals to avoid damage during long-distance transmission through a noisy industrial environment.
  • Remote I/O allows signals to be transmitted any distance and over any terrain with twisted-pair wires, fiber optics, radio link, or modems.

Peer-to-Peer Configurations

Peer-to-peer networks, as shown in Figure 40, enhance reliability by decentralizing the control functions without sacrificing coordinated control. In this type of network, numerous PLCs are connected to one another in a daisy-chain fashion, and a common memory table is duplicated in the memory of each. In this way, when any PLC writes data to this memory area, the information is automatically transferred to all other PLCs in the network. They then can use this information in their own operating programs.

With peer-to-peer networks, each PLC in the network is responsible for its own control site and only needs to be programmed for its own area of responsibility. This aspect of the network significantly reduces programming and debugging complexity; because all communications occur transparently to the user, communications programming is reduced to simple read-and-write statements.

In a peer-to-peer system, theres no master PLC. However, its possible to designate one of the PLCs as a master for use as a type of group controller. This PLC then can be used to accept input information from an operator input terminal, for example, sending all the necessary parameters to other PLCs and coordinating the sequencing of various events.

Host Computer

PLCs also can be connected with computers or other intelligent devices. In fact, most PLCs, from the small to the very large, can be directly connected to a computer or part of a multi-drop host computer network via RS232C or RS422 ports. This combination of computer and controller maximizes the capabilities of the PLC, for control and data acquisition, as well as the computer, for data processing, documentation, and operator interface.

In a PLC/computer network, as shown in Fig. 4C, all communications are initiated by the host computer, which is connected to all the PLCs in a daisy-chain fashion. This computer individually addresses each of its networked PLCs and asks for specific information. The addressed PLC then sends this information to the computer for storage and further analysis. This cycle occurs hundreds of times per second.

Host computers also can aid in programming PLCs; powerful programming and documentation software is available for program development. Programs then can be written on the computer in relay ladder logic and downloaded into the PLC. In this way, you can create, modify, debug, and monitor PLC programs via a computer terminal.

In addition to host computers, PLCs often must interface with other devices, such as operator interface terminals for large security and building management systems. Although many intelligent devices can communicate directly with PLCs via conventional RS232C ports and serial ASCII code, some do not have the software ability to interface with individual PLC models. Instead, they typically send and receive data in fixed formats. It is the PLC programmers responsibility to provide the necessary software interface.

The easiest way to provide such an interface to fixed-format intelligent devices is to use an ASCII/BASIC module on the PLC. This module is essentially a small computer that plugs into the bus of the PLC. Equipped with RS232 ports and programmed in BASIC, the module easily can handle ASCII communications with peripheral devices, data acquisition functions, programming sequences, "number crunching," report and display generation, and other requirements.

Software vs. Firmware

The terms software and firmware both refer to digitally stored programs and data structures that are read and written by computers. In the PLC world, software is usually reserved for computer applications that allow the logical creation, monitoring, and troubleshooting of a PLC program. One example of PLC software is the RSLogix program developed by Allen-Bradley for use with their controllers. Firmware can be referred to as the actual program a PLC uses to execute logical instruction. Firmware is often stored in internal memory or on an Electrically Erasable Programmable Read-Only Memory (EEPROM). EEPROMs can be used to store program backups if there is a program fault or a sustained power loss to the PLC.

HMI Human Machine Interface

The basic purpose of an HMI is to allow convenient and intuitive graphical interface with a process and for control systems to be more interactive and user-friendly. HMIs provide a simple display that helps an operator determine machine conditions and make simple settings. The following are the most common uses of HMIs:

  • Display of machine and process faults and status
  • Simple operational commands such as stop/start
  • Monitor of production/process counts and values

Ladder Logic Diagrams

The ladder logic used in PLCs today was once referred to as relay logic due to the implementation of physical relay coils used to control processes. Relay logic is now known as ladder logic because when the logic circuit schematic is laid out with electrical notation, it resembles a ladder with separate rungs, perpendicular between rails, containing symbols used to represent Boolean logic expressions such as AND, OR, and NOT.

Figure 41: Ladder Logic

The example in Figure 41 shows two rungs containing a series of relays denoted as X, Y, and Z. These are inputs while the symbol for S is an output.

The logical expression for this circuit is S=X AND (Y OR Z). If normally open contacts X and Y are closed, there is an output at S. Likewise, because of the OR function of Y and Z, there also is an output at S if X and Z are closed, but Y remains open. Any combination of Boolean expressions can be used in ladder logic, including but not limited to AND, OR, NOT, NAND, NOR, and XOR. Figure 32 shows a ladder logic circuit with two normally closed contacts, X and Y, connected in an OR configuration with the output S. Their equivalent Boolean logic gate symbols are also shown. Table 5 is a logic chart showing the combination of inputs that create a logic high or low output from this circuit.

Figure 42: NAND Circuit

The two NOT gates leading into the OR gate in Figure 42(b) represent the normally closed contacts in Figure 42(a). The NOT gate function reverses the logic of any incoming signal, turning a HI into a LO and vice versa. When multiple rungs are connected to a single output on a ladder logic diagram, an OR function exists, as represented by the OR gate in Figure 42(b). The combination of these three logic gates can be shown as a single NAND gate, as in Figure 32(c). The NAND gate functions just like an AND gate, creating a logic HIGH output in the presence of logic HI inputs X and Y. The only difference is the addition of the NOT function, reversing the output from a logic HI to a logic LO so that two HI inputs equal a LO output. Understanding the logic of this circuit, you can see that to turn the lamp off, X and Y must be HI. It is common when examining logic circuits to refer to logic levels as true or false, with true representing logic HI and false representing logic LO.

Logic Instructions

In order to use the PLC and make simple edits, it is necessary to understand some basic commands. The commands are all entered in ladder logic format, and many of them are based on nomenclature used in relay logic. There are timers, counters, coils, and contacts, among other commands.

Examine If Closed XIC

This command functions as the input or storage bit (Figure 43). The command is addressed to the bit level. If the corresponding memory bit is 1 (true), the instruction allows rung continuity and outputs are energized (other factors may affect rung continuity). If the corresponding memory bit is 0 (false), the instruction does not allow rung continuity (it assumes its normally open state) and outputs on the rung are de-energized (other factors can influence rung continuity).

Figure 43: XIC Command

A simple way to look at this instruction is from the processors point of view. The processor is looking for power on that input point to make this statement a true statement. If a switch in the field is closed, the processor sees power on the point and makes the XIC true. This causes the rung to be true and enables any output that is present.

This command is similar to a normally open contact on a real world relay. If power is not on the relay, the contact is open and continuity through the rung is not allowed. If power is not on the PLC point, this command is false and does not allow continuity through the rung, just like the relay contact.

If power is applied to the relay, the contact is closed and allows continuity through the rung. In the case of the XIC, as shown in Figure 43, if power is applied to the field point, the instruction becomes true and allows continuity in the rung, just like the real world relay.

Examine If Open XIO

Figure 44: XIO Command

This command is similar to the XIC, except it works in reverse, as shown in Figure 34. If the corresponding memory bit is 0 (false), the instruction allows rung continuity and outputs are energized (other factors may affect rung continuity). If the corresponding memory bit is 1 (true), this instruction does not allow rung continuity and outputs on the rung are de-energized (other factors can influence rung continuity).

A simple way to look at this instruction is from the processors point of view. The processor is looking for no power on that input point to make this statement a true statement. If a switch in the field is opened, the processor sees no power on the point, and makes the XIO true. This causes the rung to be true, and enables any output that is present.

This command is similar to a normally closed contact on a real world relay. If power is not on the relay, the contact is closed and continuity through the rung is allowed. If power is not on the PLC point, this command is true, and allows continuity through the rung, just like the relay contact.

If power is applied to the relay, the contact is open, and does not allow continuity through the rung. In the case of the XIC, if power is applied to the field point, the instruction is false, and does not allow continuity in the rung, just like the real world relay.

Output Energized OTE

Figure 45: OTE Command

The OTE instruction, which is shown in Figure 45, is used to control a bit in memory. If the bit corresponds to an output module terminal, the device wired to the terminal is energized when the instruction is enabled and de-energized when the instruction is disabled. If the input conditions that precede the OTE instruction are true, the processor enables that instruction. If the input conditions are false, the processor disables that instruction. When rung conditions are false, the corresponding device de-energizes.

An OTE instruction is similar to a relay coil. The OTE instruction is controlled by preceding input instructions and the relay coil is controlled by contacts in its hardwired rung.

Output Latched OTL

Figure 46: OTL Command

The OTL instruction in Figure 46 functions much the same as the OTE, with the exception that once a bit is set with an OTL, it islatchedon. Once an OTL bit has been set on (1 in the memory), it remains on, even if the rung condition goes false. The bit must be reset with an OTU instruction.

When the processor changes from run to program mode, or when the processor loses power and there is battery backup, the last true OTL instruction continues to control the bit in memory. The latched output device is energized, even though the rung conditions that control the instruction may have gone false.

The OTL instruction is retentive. When the processor loses power, is switched to program mode or test mode, or detects a major fault causing outputs to go off. However, the states of retentive outputs are retained in memory. When the processor resumes operation in run mode, retentive outputs immediately return to their previous states. Non-retentive outputs, such as OTE outputs, are reset.

Output Unlatched OTU

Figure 47: OTU Command

Figure 47 displays an OTU command, which is a retentive output instruction that only turns off a bit (it cannot turn on a bit). This instruction usually is paired with OTL instruction, with both instructions addressing the same bit. The OTU instruction turns off the bit that was turned on (latched) by the OTL instruction.

When the processor changes from run to program mode, or when the processor loses power and there is battery backup, the bit is retained in the state set by the last rung of the latch/unlatch pair that was true.

The OTU instruction tells the processor to turn off the addressed bit based on the rung condition. Thereafter, the bit remains off, regardless of the rung condition, until it is turned on, typically by an OTL instruction in another rung.

Timer On Delay TON

Figure 48: TON Command

The TON instruction shown in Figure 48 is used to turn an output on or off after the timer has been on for a preset time interval. This instruction begins timing, at either 1 second or 1-hundredth of a second intervals, when its rung is true and continues until one of the following happens:

  • The accumulated value equals the pre-set value.
  • The rung goes false.

The processor resets the accumulated value when the rung conditions are false, regardless of whether or not the timer has timed out. When the rung conditions go True, the timer is on and the Enable (EN) bit is set. When the timer reaches its preset count and times out, the Done (DN) bit is set to true.

Timer Off Delay TOF

Figure 49: TOF Command

The output instruction in Figure 49 begins timing, at either 1 second or 1-hundredth of a second intervals, when its rung goesfalseand continues timing until one of the following conditions occur:

  • The accumulated value equals the pre-set value.
  • The rung goes true.

The processor resets the accumulated value when the rung conditions are true, regardless of whether or not the timer has timed out.

Retentive Timer On RTO

Figure 50: RTO command

The RTO instruction shown in Figure 50 is used to turn an output on or off after its timer has been on for a preset time interval. The RTO instruction lets the timer stop and start without resetting the accumulated value.

The RTO instruction begins timing when its rung goes true. As long as the rung remains true, the timer updates the accumulated value each program scan, until it reaches the pre-set value. The RTO instruction retains its accumulated value even if one of the following occurs:

  • The rung goes false.
  • There is a change to program mode.
  • The processor faults or loses power.

When the processor resumes operation or the rung goes true, timing continues from the retained accumulated value. By retaining its accumulated value, retentive timers measure the cumulative period during which its rung is true. The RTO command is reset using the RES command.

Count Up Counter CTU

Figure 51: CTU Command

The CTU instruction shown in Figure 51 counts upward over a range of -32,768 to+32,767. Each time the rung changes from false to true, the CTU instruction increases the accumulated value by one count. When the accumulated value equals or exceeds the pre-set value, the CTU sets a DN bit the ladder program can use to initiate an action, such as controlling a storage bit or an output device. CTU instructions are retentive and require an RES instruction to be reset. They also reset if the counter decreases below the pre-set value.

Count Up Counter CTD

Figure 52: CTD Command

Figure 52 shows CTD instruction, which counts downward over a range of+32,767 to -32,768. Each time the rung changes from false to true, the CTD instruction decreases the accumulated value by one count. The DN is set as long as the accumulated value is greater than or equal to the pre-set value. When the accumulated value is less than the pre-set value, the CTD resets a DN bit, which the ladder program can use to initiate an action, such as controlling a storage bit or an output device. CTD instructions are retentive and require RES instruction to be reset. They also reset if the counter increases above the pre-set value.

Reset Command RES

Figure 53: RES Command

The RES instruction shown in Figure 53 is an output instruction that resets a timer or counter. The RES executes when its rung is true. Reset commands normally are used for counters and retentive timers, but also may be used for TONs to reset the timers while their rungs are still true.

Data Transfer Instructions

Figure 54: Data Transfer Instructions

The Move (MOV) command shown in Figure 54 is an output instruction that copies a value from a source address to a destination. As long as the rung remains true, the instruction moves the data during each scan. This command makes a copy of the original and places the duplicate in a new location (Dest). The original value remains intact and unchanged in its source location.

Arithmetic Commands

Figure 55: ADD Command

PLCs have a wide variety of available mathematical commands. These commands simply perform the indicated math function on any valid instruction address data or any number.

In the example shown in Figure 55, the user is adding the contents of N7:21 to the contents of N7:22. The result is stored in file N7:19. Notice that the actual contents of the register being used is shown below the register. In this case, N7:21, containing the number 20 is added to N7:22, containing the number 5. The result is stored in N7:19 as the number 25 (20+5).

All math commands work in a similar manner.

Master Control Reset

Figure 56: MCR Command

Figure 56 shows output instruction, which is also known as zone control used to set up areas or zones of the ladder program where all non-retentive outputs may be simultaneously disabled for the same length of time. It is used in pairs: one MCR to define the start of the effected ladder area and one MCR to define the end of the area.

An input instruction is programmed on the rung of the first MCR to control rung logic continuity. When the rung is false, all non-retentive outputs within the controlled zone are disabled. When the rung is true, all rungs are scanned according to their normal rung conditions, disregarding the zone control instruction.

CAUTION: MCR-controlled areas must contain only two MCR instructions: one to define the start and one to define the end. Any additional MCR orgo-to" type instructions could produce unexpected program damage or machine operation results. DO NOT OVERLAP MCR ZONES! The MCR instruction is not a substitute for a hardwired master control relay that provides emergency stop capability. You still should install a hardwired master control relay to provide emergency I/O power shutdown.


Subroutines are an important part of a PLC program. By using them, the programmer can make a program much more logical and faster to execute.

Basically, a subroutine is a ladder that is only executed when it is called from the main program. File number 2 is always the first ladder in a program and, as such, is the main ladder. When the processor scans its ladder programs, it only scans ladder number 2 unless ladder number 2 commands it to go to another subroutine. If no other ladders are called by a JSR, then the ONLY ladder executed is file 2. When a JSR is encountered, the program jumps out of that ladder (in this case ladder 2), and goes to the ladder called for in the subroutine jump command. When the end of the file is reached, the program jumps back to the file that has the JSR, in this case file 2, and continues executing. It also returns if a Return (RET) command is encountered in the ladder.

In order to call a subroutine, a command, such as the one shown in Figure 57, is used. It is called a JSR (Jump To Subroutine) command. Notice that in this case, the subroutine being called is ladder file number U: 3. The "U" indicates the file is for a user. All ladder files are for users.