HPR4728: Programmable Logic Controls - Episode 3

Por Whiskeyjack16/09/2026 às 00:00215 visualizações
Foto: CC BY-SA / Hacker Public Radio
🎙 Whiskeyjack · Hacker Public Radio

This show has been flagged as Clean by the host.

--------------------

01 Introduction

This is the third episode in an 8 part series.

02

In the previous episode we covered

* The early history of computers in industrial control

* The early history of PLCs, including how they got their name

* Who the major brands are

* What they look like physically

* A basic description of the abstract machine architecture

* A very brief look at what a PLC program is like

* The scan concept

* The main PLC programming languages

* The minor PLC programming languages

* The relative popularity of each of the programming languages

03

In this episode we will begin by taking a look at one of the early PLCs from the era when they first began seeing widespread use.

I will not even attempt to try to be comprehensive, I will just give a broad overview in the limited time I have available here.

I have started with an older model because its simplicity and limited features allow for an easier introduction to the topic.

--------------------

04 Allen Bradley PLC/2

The Allen Bradley PLC/2 was introduced to the market in 1977.

It was not their first foray into this field, but it was their first really successful one.

I am not aware of a comprehensive history of their early product line, but one of their early major selling models was the PLC2/30.

This is also known as their 1771 series.

--------------------

05 Physical Layout

The CPU module was a large metal box which sat beside the I/O rack and connected to it with a cable.

The I/O rack was a box with an open front and an series of slots into which tall narrow boxes containing the I/O could be slotted.

06

A backplane ran across the back, connecting the I/O to the CPU.

Multiple racks could be connected together by cables.

For the PLC2/30, you could have a maximum of 896 digital I/O points.

07

Racks were 315mm high, and between 247mm to 610mm wide, with racks coming in 4, 8, 12, and 16 slot varieties.

The CPU was the same height as the rack and roughly square in outline.

08

As micro electronics advanced, the CPU module was able to be shrunk down in size such that it would fit into a slot in the rack, which became the norm for PLCs.

--------------------

09 The Electronics Inside

Early model PLC/2s used some sort of 8 bit processor, some sources say an Intel 8080.

10

They also used four AMD 2900 bit slice processors as a logic co-processor.

If you are not familiar with bit slice processors, these are chips which are like a 4 bit vertical slice through a processor, and can be joined together with logic chips to form a complete CPU.

These are what were used to construct minicomputers.

11

They were used as coprocessors in early PLCs because microprocessors on their own were simply too slow to handle running the user program rapidly enough to allow a useful size program.

One or more microprocessors were used as well in order to coordinate the overall operation and system management.

12

As microprocessors grew faster and more powerful, the need for logic coprocessors declined and they were eventually dropped.

Early versions used magnetic core memory.

Later ones switched to some sort of solid state RAM, probably static RAM of some sort.

13

Details of what sort of processors are inside any PLC are actually very hard to come by as manufacturers don't generally talk about that sort of thing.

They wish the user to see it as just a black box.

--------------------

14 The Data Table

From a programmer's perspective, the most important thing to understand first is the data table.

The data table is the PLC's data memory.

15

For a PLC2, this is an array of 16 bit words.

Each word consists of two 8 bit bytes.

Addressing for both bits and words is in octal.

16

For those not familiar with them, octal numbers follow a counting system that goes from 0 to 7.

The next number after 7 is 10.

Counting then proceeds from 11, 12, 13, etc. going to 17, 20, 21, etc.

Each octal digit takes exactly 3 bits.

17

Individual bits in PLC2 notation may be addressed by specifying the word followed by a slash, and then the bit.

For example, 030/12 is the 12 bit in word 030. Remember that this is octal, so 12 is not the 12th bit if you are counting in decimal.

18 Memory Organization

On the PLC2/30, the data table has the following organization.

19

Word addresses 000 to 007 are Processor Work Area number 1.

This is not accessible by the user.

20

Word addresses 010 up to, but not including, 100 are the Output Image Table.

This is a memory mapped image of the I/O outputs.

010 to 077 is for Rack 1.

020 to 027 is for Rack 2.

This pattern continues up to Rack 7, which is 070 to 077.

21

Word addresses 100 to 107 are Processor Work Area number 2.

This is also not accessible by the user.

22

Word addresses 110 up to, but not including, 200 are the Input Image Table.

This is a memory mapped image of the I/O inputs.

This is laid out in the same way as the output image table, and goes from 110 to 177.

110 to 117 is for Rack 1.

120 to 127 is for Rack 2.

This pattern continues up to Rack 7, which is 170 to 177.

23

You will notice that the output image table and input image table appear to address the same rack slots.

They do in fact do this.

As to which address a specific slot in a specific rack maps to depends on whether there is an input card or an output card in that slot.

24

Addresses 200 to 277 are for Timer/Counter accumulated values.

An accumulated value is the current time or count.

25

Addresses 300 to 377 are for Timer/Counter preset values.

A preset value is the target time or count which when reached causes the timer or counter to indicate that it has reached the desired value.

26

The memory above 400 can be configured to split it into a data storage area and user program area.

The data storage area is where you would store data that your program needs to use which is not part of the I/O or times and counters.

You need to strike the correct balance between user data and program size.

27

There are various things that can be changed and configured with respect to the above, but I am not going to cover that in any depth as this is not a tutorial on the PLC2.

=

You should however have a pretty good idea of the memory of an early model PLC.

The things to understand are that I/O are mapped to memory addresses, and

different memory ranges are used for different purposes.

28

All memory management was manual.

It was up to the user to keep track of which memory addresses were to be used for what purposes.

Allen Bradley helpfully provided paper forms which you could photocopy which you could use to plan out and document what each address would be used for.

Part of the programmer's job was to make efficient and logical use of memory, while also leaving space for future changes.

--------------------

29 The User Program

The user program is made up of instructions.

Each instruction typically takes one word of memory.

However, complex instructions can take up to 8 words of memory.

30

There is a main program.

You can think of this as like the "main" function in C.

If you don't find that analogy helpful, then just think of it as this is where your program starts.

The main program continues with one rung after another until it reaches the END statement.

31

There is also a subroutine area.

The main program calls a subroutine by using a Jump to Subroutine, or JSR instruction.

32 The T3 Programming Terminal

When the PLC2 came out, things like laptops were still far in the future.

Even the first Compaq Portable suitcase style PC was still some years away.

Indeed, the first PLC/2 came out not long after the first Altair PC kit.

33

Programming initially therefore was done using a special programming terminal known as a T3.

The T3 was a suitcase size box with a small CRT in the end of it, and a keyboard attached to it below the screen.

If this sounds like the early portable PCs, keep in mind that this in fact predated them by a number of years.

34

The keyboard was not a typewriter or QWERTY style.

It had a membrane keypad with graphical symbols.

Recall the previous episode on control diagrams using relays and how these were documented using schematic symbols on drawings.

The T3 terminal keypad had symbols corresponding to a simplified and modified version of the symbols used in those schematic drawings.

35

When a programmer pressed one of those symbols on the keypad, the corresponding symbol appeared on the screen in the current cursor location.

The programmer could then enter the data address that the symbol was to correspond to using the numeric part of the keypad.

36

An engineer, technician, or electrician could therefore create and enter programs using a fully graphical environment that used his existing knowledge of control using hardware components.

They did not see this as programming a computer, they saw it as something else entirely which was unrelated to computers.

37

Programming took place with the T3 connected to the PLC while the PLC was in program mode.

The instructions were entered directly from the terminal into the PLC memory.

Programs could be saved or restored to cassette tape.

The program would run when the PLC was set to run mode.

38

What is more, the T3 terminal allowed on line debugging of programs.

When the T3 was connected in run mode, the ladder diagram would update live.

When a logic condition was true, it would be highlighted.

When the logic condition was false, it would be shown in an non highlighted state.

39

By observing a specific rung, you could see if the expected series of graphical instructions were all highlighted in a pattern which would result in the final output of the rung to be true or false as expected.

This was an invaluable troubleshooting aid in finding both software bugs and hardware faults.

Programming terminals became an indispensable part of an industrial maintenance electrician's essential equipment.

40

Eventually as portable PCs and later laptops became available, the T3 became obsolete and these functions were transferred to software that ran on standard PCs.

However, they still work essentially the same way.

Additional capabilities were added, such as the ability to write programs while not attached to the PLC.

Descriptive labels and comments could be added to memory addresses to document them and aid in reading the program,

Cross referencing functions would make it easier to find which addresses were used for what,

etc.

--------------------

41 Instructions

I will now turn to listing the sorts of instructions which were available to use.

I won't try to explain everything, but it should at least give you a vague idea of how these were programmed.

I will use Allen Bradley's names for these, which I should emphasize do not correspond to what other manufacturers call them.

42 Relay Type Instructions

These are boolean instructions and consist of the following.

43 Input instructions

These examine bits in memory and yield a logic state depending on the value of the bit they address.

Input instructions start at the left of the rung and work their way right as more are added.

Examine on - This is true when the addressed bit is set to 1.

Examine off - This is true when the addressed bit is set to 0.

44 Output Instructions

These turn bits on or off depending on the sum of the boolean logic conditions leading up to them.

Output instructions are on the right of the rung.

There must always be at least one output instruction.

Output Energize -When the logic conditions leading up to it are true, it sets a bit to 1.

When the logic conditions leading up to it are false, it sets a bit to 0.

45

Output Latch - When true, the bit is turned on.

When false, it does nothing.

Output Unlatch - When true, the bit is turned off.

When false, it does nothing.

46 Branch Instructions

These do nothing themselves, but they make wiring connections on the diagram.

These are important to allow the instructions listed above to be placed in parallel in the same rung so that they can do things like specify OR conditions.

You can think of them as essentially turning an examine on or examine off into an OR or OR NOT instruction.

--------------------

47 Timer and Counter Instructions

Timers and counters are as the name implies, instructions which do timing and counting operations.

They have separate preset and accumulated values.

They are a type of output instruction in that they reside on the right side of the ladder rung and their operation depends on the state of the rung logic to their left.

48

Timers and counters work in Binary Coded Decimal, or BCD values.

BCD values each take 4 bits of memory.

However, unlike hexadecimal, only values from 0 to 9 are valid.

What would be values from A to F in hexadecimal are not valid values in BCD.

49

The preset and accumulated values are stored in 16 bit words. The first 12 bits are used to store up to 3 BCD digits.

The remaining uppermost 4 bits are used to store instruction status bits such as whether the timer or counter is done and various other features.

50 Timers

The timer time base corresponds to the timer resolution.

The time bases are 1.0 second, 0.1 seconds, and 0.01 seconds.

So a timer with a 1 second time base can time from 0 to 999 seconds to one second of resolution.

A timer with a 0.1 second time base can time from 0 to 99.9 seconds to 0.1 seconds of resolution.

51

There are three types of timer,

Timer On Delay (or TON),

Timer Off Delay (or TOF),

Retentive Timer (or RTO).

52

On delay timers time while the rung condition is true and reset when it goes false.

Off delay timers time after the rung condition goes false and reset when it goes true.

Retentive timers are like on delay timers but retain their accumulated value until reset by the Retentive Timer Reset (or RTR) instruction.

Generally, you start a timer and then monitor its "done" bit somewhere else in your logic.

53 Counters

Counters count events.

These come in the following varieties.

54

Up-counter (or CTU).

Down-counter (or CTD)

Counter Reset (or CTR)

Scan Counter (or SCT)

55

Up counters count upwards from zero, and down counters count downwards from the preset.

The scan counter counts the number of program scans.

This is not something you would typically find a use for, although you can use it to for example calculate the scan time.

--------------------

56 Data Manipulation Instructions

Data manipulation instructions are used to read, write, and compare byte and word data.

Operations take place when the rung goes true.

57

GET reads a 16 bit word from a memory location.

PUT writes a 16 bit word to a memory location.

LES resolves to true if the value read by the GET instruction is less than a specified value.

EQU resolves to true if the value read by the GET instruction is equal to a specified value.

58

The LES and EQU instructions can be combined in various ways with each other and with GET to give all the possible comparison permutations such as greater than, less than or equal to, etc.

59

GET BYTE reads a 8 bit byte from a memory location.

LIMIT TEST resolves to true if a byte value is between the limits stored in the upper and lower bytes of a word.

LIMIT TEST is used in combination with GET BYTE.

--------------------

60 Arithmetic Instructions

Arithmetic instructions also operate on BCD word values.

Operations take place when the rung goes true.

The uppermost byte is used to indicate things like arithmetic overflow or underflow.

These include

61

Add

Subtract

Multiply

Divide

Convert BCD to Binary

Convert Binary to BCD

--------------------

62 Block Transfer Instructions

Block Transfer Instructions are output instructions that are used to transfer up to 64 16 bit words of data between the data table and I/O modules.

These are used with intelligent I/O that worked with words rather than individual bits.

63

Examples of these are things like

Analogue I/O that read and write varying voltages rather than just on or off.

PID that handle closed loop control of things like temperature.

Thermocouples that read temperatures.

Servo motor control that command positions of servo motors.

Stepper motor control.

Position encoders.

64

I won't go into details on block transfers, but this should be enough to give you a general idea of how the PLC could handle that sort of equipment as opposed to the simple on/off states of digital modules.

Obviously these can be used in combination with GET, PUT, and other data manipulation instructions which can read and write memory locations.

--------------------

65 Jump Instructions and Subroutine Programming

These include the following instructions.

66

Jump (or JMP)

Label (or LBL)

Jump to Subroutine ( or JSR)

Return (or RET)

67

Jump will jump execution to a label position.

You can think of it like a GOTO instruction.

68

Labels are numeric and can be from 00 to 77 in octal.

Jump instructions are rung outputs, and when the rung goes true, execution jumps to the label number specified in the instruction.

Labels are input instructions and appear at the start of the rung where execution resumes.

69

Normal jumps cannot jump into a subroutine, and they can only jump forward, not backwards.

This means that loops are not possible using jump.

This would be a deliberate design decision to prevent programs from getting stuck in a loop and preventing the scan from proceeding.

70

Subroutines appear after the end of the main program.

They are defined by numerical octal labels using the label instruction.

Subroutines are called using the Jump to Subroutine (or JSR) instruction.

At the end of the subroutine, the Return (or RET) instruction returns execution to the next rung following the JSR which called it.

You can nest calls to subroutines up to 8 deep.

--------------------

71 Data Transfer File Instructions

Despite what you may think from the name, there are no disk files in the PLC2.

A "file" instruction rather moves blocks of words from one data memory location to another.

=

These include source and destination addresses, and various other parameters which control the operation.

There is actually quite a bit involved in these, but I'm not going to bother going into the details.

You just need to know that it is possible to move blocks of data memory around.

--------------------

72 Shift Register Instructions

These operate on entire series of words and include

=

Shift File Up

Shift File Down

FIFO Load

FIFO Unload

73

These can operate on 1 to 999 words.

A typical use for this sort of instruction would be to track a part as it moves through the various stations of a machine.

--------------------

74 Bit Shifts

These operate on individual bits and include the following.

75

Bit Shift Left

Bit Shift Right

Examine Off Shift Bit

Examine On Shift Bit

Set Shift Bit

Reset Shift Bit

76

These do pretty much as you would expect in terms of shifting bits left or right.

However, the shift register can be defined to be anywhere from 1 to 999 bits long, so it is not confined to the size of a word.

--------------------

77 Sequencer Instructions

Sequencer instructions are a software emulation of electromechanical drum controllers.

Drum controllers allowed a long sequence of operations to be performed.

These used a rotating drum which had a regular series of parallel holes in the outer surface.

Above one row of these holes was a row of limit switches.

By inserting pegs into some of these holes which made contact with the limit switches, the drum controller could turn on patterns of relays or valves.

78

Some of the limit switches could be connected to sensors on the moving elements of the machine.

When the parts of the machine were in the correct position for that step in the sequence, the pattern of pegs would cause an electrical path to complete through the limit switches and energize a solenoid which would ratchet the drum to the next step.

79

This is often compared to a music box or to an old style of washing machine control.

However in the case of the drum controller, the pegs would program the input match conditions as well as the desired output.

The PLC/2 drum controller would emulate this sequencer.

This feature came to be very widely used in equipment used in the automotive industry and other assembly oriented manufacturing processes and often formed the heart of the PLC/2 program.

80

I won't go into details of the sequencer instructions, but there are separate input and output sequence instructions.

The input sequence instruction would try to match the states of the sensors, and the output sequence instruction would turn the various outputs on or off, controlling things like solenoid valves.

The sequence itself would be defined by a series of words in memory, with each bit corresponding to an individual input or output.

--------------------

81 File Logic Instructions

File Logic instructions amounted to array operations on words, although the term "file" is used for what in computer terminology would be an "array".

These instructions included

AND

OR

EXCLUSIVE OR

Complement

--------------------

82 Special Programming Techniques

These are miscellaneous instructions.

These consist of the following.

One Shot Leading Edge

One Shot Trailing Edge

83

A one shot is an output instruction that causes the addressed bit to turn on for one scan upon a change of state in the rung logic condition.

One shots could be triggered on a false to true change or a true to false change, depending on which of the two instructions were used.

--------------------

84 Why Did the PLC2 Use BCD?

You are probably wondering why the PLC2 used BCD numbers instead of normal integers.

This reflects the operating environment that an early PLC would have to work in.

Early operator panels using mechanical numerical input devices and simple electronic output displays which typically worked in BCD.

85

Thumbwheel switches were small drum like rotating devices with numbers 0 to 9 printed on the periphery.

Several wheels would be stacked beside one another.

They looked somewhat like the mechanical odometer that you would find in an older car.

The operator could however move each digit wheel separately.

Each digit would be read by wiring 4 wires back to 4 inputs on the PLC.

Thus each digit was inherently BCD due to how the thumbwheel hardware worked.

86

By turning the individual wheels separately, the operator could adjust things like temperatures, speeds, time delays, etc., and so modify process parameters.

Output operator displays were typically 7 segment LED, neon, or vacuum fluorescent displays.

These displays or devices similar to them preceded PLCs and so were common industrial devices that had to be handled.

Each numeric digit had 4 inputs that would be wired to 4 outputs on the PLC.

Seven segment displays can use hexadecimal, but that wasn't very useful if you are trying to display a temperature in Celsius to an operator.

Thus again, BCD was the most practical sort of number to work with.

87

As PLCs and their user programs grew more capable and more sophisticated, they began working with normal integers and even floating point numbers.

However, many if not most PLCs were to retain instructions to translate to and from BCD.

--------------------

88 The Influence of the PLC2

The PLC2 was a hugely successful product for Allen Bradley and firmly established them as one of the leading PLC vendors, with a number one position in the North American market, and in the top 5 world wide.

However, it had a number of weaknesses, particularly the very primitive memory and subroutine architecture and the focus on octal and BCD numbers.

It was focused on replacing control relays and it did this fairly well.

89

The next really successful successor to the PLC2 for Allen Bradley was the PLC5.

This took the basic PLC2 instruction set and married it to a new memory system with new data types, separate name spaces, and parameterized functions.

90

It was like switching from programming in Basic with line numbers and jumps to Pascal.

However, it could still use PLC2 I/O racks and modules, an important consideration given that the bulk of the cost of a PLC was in the I/O system.

91

The PLC 5 was in turn succeeded by the Contrologix series which modernized things still further, while being in a smaller form factor.

Allen Bradley remain one of the major PLC vendors today, operating under the Rockwell name.

--------------------

92 Conclusion

In this episode we focused on one specific but very widely used early PLC, the Allen Bradley PLC2.

We covered the following subjects.

The internal electronics.

The data table.

The user program.

The T3 programming terminal.

And a very brief overview of the instruction set.

93

This was a fairly simple and in some ways primitive PLC, but you should have a very rough idea of the concepts behind a PLC, including the data table and scan concept and the relay-like instruction set.

94

In the next episode we will take a look at a PLC from the largest vendor word wide, Siemens.

In this example we will look at a model from slightly later than the PLC2, the S5 series.

This could be seen as a second generation PLC.

Since we won't need to repeat the basic concepts covered already, we can focus more on what is new and different about the S5 compared to the PLC2.

95

This has been the third episode in an 8 part series.

--------------------

Provide feedback on this episode.

Fonte
Hacker Public Radio
Abrir original ↗
Esta notícia foi útil?

Debates 0

Seja o primeiro a contribuir com o debate.

Difunda suas informações e promova seu argumento

Não se acanhe de publicar alguma informação ou dado que possa ser positivo ou útil.

Para participar do debate, entre com sua conta ou crie uma gratuita.