PLC & SCADA for

Automation & Process

Control

Dr. Mohammad H. Salah

 Introduction to
Control Strategies

Outlines

Control Systems

Continuous Control Systems

Sequential (Logic) Control Systems

Synchronous Control Systems

Asynchronous Control Systems

Mixed Synchronous/Asynchronous Control Systems

Implementation of Synchronous Control Systems

Relay Control systems

Dr. Mohammad H. Salah Page no. 1

 Control Systems

Any process contains the application (operative part) and control

system (active coordinator).

The best way to describe a control system is to use a block
diagram.

All control systems have, at least, three parts to them;
 An INPUT that takes information into the control system,
 A PROCESS that uses the input information to create the
output information,
 An OUTPUT that passes information out of the control system.

Control Systems - Inputs

Input signals are provided by transducers / detectors that convert

physical quantities into electrical signals.

Depending on transducer used, the information detected can be
discontinues (binary) or continuous (analog) representation of the
input quantity.
Transducers Measured Quantity Output Quantity
Switch Movement / Position Binary Voltage
Limit Switch Movement / Position Binary Voltage
Thermostat Temperature Varying Voltage
Thermocouple Temperature Varying Voltage
Thermistor Temperature Varying Resistance
Strain Gauge Pressure / Movement Varying Resistance
Photo Cell Light Varying Voltage
Proximity Cell Presence of Objects Varying Resistance

Dr. Mohammad H. Salah Page no. 2

 Control Systems - Outputs

Output devices (like relays, pumps, motors..) are tools used by a

control system to alter certain key element or quantities within the
process.they are also transducers but contrary signals from the
control system into other necessary. There are also discontinuous
(binary) or continuous (analog) devices
Output Device Quantity Produced Input
Motor Rational motion Electrical
Pump Rational motion + product Electrical
displacement
Piston Linear motion / pressure Hydraulic / pneumatic
Solenoid Linear motion / pressure Electrical
Heater Heat Electrical
Valve Orifice variation Electrical/Hydraulic/pneumatic
Relay Elec. Switching / limited Electrical
physical movement

Control Systems

The heater is an Open Loop control system.

In this system the information from the output is not sent back to the
input.

However the room gets hot, the heater keeps producing heat until
someone switches it off.

If the heater had a thermostat, it would switch off by itself when the
room reached a set temperature (the ‘input’ to the system).

In this case information from the output of the system (heat) has
been fed back to the input.

Dr. Mohammad H. Salah Page no. 3

 Control Systems

The control system is now a Closed Loop system.
Information from the output goes back to the input in a
Feedback loop.

The comparison block of the system is normally represented
by the special symbol:

This shows the place of the heater thermostat in the control

system.

It compares the set temperature with the actual
temperature.

Control Systems

A difference between these two temperatures is an error.

When the control system detects an error, it tries to make it
smaller by changing the output.

This system now has all the basic elements of any control
system:
 A demand - this is the set temperature shown above.
 A sensor to measure the output - a temperature sensor.
This is part of the thermostat
 A controller - the thermostat
 An actuator - the heater

Dr. Mohammad H. Salah Page no. 4

 Control Systems

Remember:

A sensor is a device that converts a physical signal (such as
heat, light, sound or movement) into an electrical signal.

An actuator is a device that converts an electrical signal into
a physical signal (such as heat, light, sound or movement).

Actuators and sensors are both devices that change one kind
of signal into a different kind of signal.

Control Systems

The controller should be designed with some objective in
mind.

Typical objectives are:
 fastest response - reach the setpoint as fast as possible
(e.g., hard drive speed)
 smooth response - reduce acceleration and jerks (e.g.,
elevators)
 energy efficient - minimize energy usage (e.g., industrial
oven)
 noise immunity - ignores disturbances in the system (e.g.,
variable wind gusts)

Dr. Mohammad H. Salah Page no. 5

 Continuous Control Systems

Continuous processes require continuous sensors and/or
actuators.

In continuous control systems the inputs are sending information
into the system all the time and the outputs of the system are
being controlled all the time.

A change to the input leads directly to a change in the output.

An example of this kind of system is a security floodlight that
comes on in the dark; the level of light reaching the light sensor is
continually controlling whether or not the lamp is on.

Continuous Control Systems

Another example is filling a washing machine with water uses a

continuous control system that monitors the water level and
controls the water input valves.

Continuous control systems typically need a target value, this is

called a setpoint

Dr. Mohammad H. Salah Page no. 6

 Continuous Control Systems

Water Tank Level Control

Sequential Control Systems

In a sequential control system a series of different events

takes place one after the other.

The finishing of one event in the sequence provides the
signal for the next event to start.

Examples of sequential systems are:
 the timers that control central heating systems.
 washing machines.
 traffic lights.
 lifts in buildings.

Dr. Mohammad H. Salah Page no. 7

 Sequential Control Systems

Sometimes one of the events in the sequence is itself a

continuous control system.

However this is only one event in the series of events that
makes up the complete sequential control system for the
washing machine

Synchronous Control

In a fully synchronous control system all of the events in the
sequence take place at set points in time, regardless of any
external change.

Synchronous control systems are used where the control of
a sequence of events must take place at pre-set time
intervals.

Such a system doesn’t take any account of events outside it,
only the time between events is important.

Therefore it doesn’t need any sensors; it is an open loop
control system.

Central heating timers are synchronous controllers; the
points at which the heating and hot water systems are
turned on and off are fixed in time.

Dr. Mohammad H. Salah Page no. 8

 Synchronous Control

Once the heating or hot water is turned on, that part of the
sequence is usually a continuous system; temperature is
continuously monitored to control the heating system.

Asynchronous Control

In an asynchronous control system all of the events in the

sequence take place as a result either due to an external
event or because the previous event has finished,
regardless of the time taken.

Asynchronous control systems are used where the time
taken for a sequence to occur is unimportant.

Each event happens as soon as the previous event is finished
or when something outside the system happens; such
systems require sensors to detect the completion of an
event or an outside event and so must be closed loop.

Dr. Mohammad H. Salah Page no. 9

 Asynchronous Control

The control system for a lift is asynchronous; the sequence

of events depends entirely on external events (people
pressing the call buttons outside the lift, and the floor
buttons inside it) or the completion of lift movements (the
lift stops moving, and the doors are opened, when a switch
detects that a floor has been reached).

Mixed Syn./Asyn. Control Systems

In most real sequential control systems there is a mixture of
synchronous and asynchronous control

Many modern traffic light sets have pedestrian crossing lights or
sensors in the road to detect the presence of cars. These affect
the timing of the sequence of lights making the mainly
synchronous system mixed.

In a lift automatic doors often stay open for a fixed time. This
makes a mainly asynchronous system mixed.

The following is a list of some devices that use sequential control
systems:
1. A security gate.
2. A dishwasher
3. A time lock on a bank’s safe.
4. A robot arm welding parts of a car together

Dr. Mohammad H. Salah Page no. 10

 Mixed Syn./Asyn. Control Systems

For each system;

Draw a block diagram showing the sequence of events in the
system.

Write down whether you think it is synchronous,
asynchronous or mixed.

Explain your answer.

If you think a system is asynchronous, explain how you think
each step in the sequence is triggered.

If you think it is a mixed system, describe which parts you
think are synchronous and which asynchronous.

Implementation of Syn. Control Sys.

The heart of a synchronous control system is some kind of
timer.

This can be mechanical or electronic.

The timer also needs:
 A sequencing element; this sets the times that outputs
are switched on and off. Remember that there are no
external inputs into a synchronous timer.
 An output stage that provides the start and stop signals.

Dr. Mohammad H. Salah Page no. 11

 Implementation of Syn. Control Sys.

Mechanical Systems

All mechanical timers are different kinds of cam timer.

Here a motor turning at a constant speed is used to turn lots
of cams.

As the cams turn they push on switches to turn them on or
off.

Central heating and washing machine timers always used to
be made from cam timers.

In industry too, cam timers have
been used widely - though they are
being rapidly replaced by electronic
timers these days.

Implementation of Syn. Control Sys.

Electronic Systems

There are a number of different electronic systems that can
be used.

A dedicated circuit uses an oscillator to give electronic clock
pulses.

Further circuitry, often involving the use of logic gates, is
then used to control a sequence of switching.

Programmable Logic Controllers (PLCs) are commonly used
in industry.

A PLC contains the same kind of microprocessor as a
computer.

However it is designed to be used in an industrial setting so
is very robust.

Dr. Mohammad H. Salah Page no. 12

 Implementation of Syn. Control Sys.

Electronic Systems

The timing sequence can be programmed either through a
computer or with a small, hand held, programmer.

PLCs are replacing cam timers in most places in industry.

Implementation of Syn. Control Sys.

Electronic Systems

An important thing to note about these electronic systems is
that they all use low voltages and currents.

They also need to be able switch powerful outputs.

So they will need some kind of output interface that protects
the circuit and provides power.

Relays are very often used for this.

Dr. Mohammad H. Salah Page no. 13

 Relay Control Systems

The relay based systems are control systems that use relays
or contactors or both to operate the system actuators
sequentially and they are usually electromechanical devices
(some are solid state relays).

Relay Control Systems

Contactor can handle higher load currents than relays.

The behavior of a relay or a

contactor (electromechanical
devices) exhibits nonlinearity in
operation

Dr. Mohammad H. Salah Page no. 14

 Relay Control Sys. - Features

Group of relays with large number of contacts

Space required

Fixed application

Simple control tasks

Difficult expansion and/ or modification

Slow action (except for solid state relays)

BUT
Relays continue to be used as output devices being ideal
for the conversion of small signals to higher current /
voltage driving signal.

Relay Ladder Logic Control

Logic control is used with relatively simple ON/OFF systems -
like pneumatics

Pneumatic System
Relay Ladder Logic
Control

Dr. Mohammad H. Salah Page no. 15

 Relay Ladder Logic Control

Relay Ladder Logic Control

Dr. Mohammad H. Salah Page no. 16

 Relay Ladder Logic Control
Normally Open Schematic

Normally Closed Schematic

Relay Ladder Logic Control

Output Schematic

Dr. Mohammad H. Salah Page no. 17

 Relay Ladder Logic Control
Why is it called “Logic Control”?

Relay Ladder Logic Control

Write the logic for this rung.

Dr. Mohammad H. Salah Page no. 18

 Relay Ladder Logic Control

Relay Ladder Logic Control

Dr. Mohammad H. Salah Page no. 19

 Relay Ladder Logic Control

Relay Ladder Logic Control

Dr. Mohammad H. Salah Page no. 20

 Relay Ladder Logic Control

Relay Ladder Logic Control

Dr. Mohammad H. Salah Page no. 21

 Relay Ladder Logic Control

Relay Ladder Logic Control

Dr. Mohammad H. Salah Page no. 22

 Relay Ladder Logic Control

Relay Ladder Logic Control

Dr. Mohammad H. Salah Page no. 23

 Transducer
A transducer is any device that converts energy from
one form to another.

Amplifier

Input transducer Output transducer

(microphone) converts (speaker) converts
sound energy to electric electric energy to sound
energy energy

Sensors
Sensors are input transducers used for detecting and
often measuring the magnitude of something. They
convert mechanical, magnetic, thermal, optical, and
chemical variations into electric voltages and currents.

Photoelectric
sensor

Dr. Mohammad H. Salah Page no. 24

 Sensors
Sensors provide the equivalent of eyes, ears, nose,
and tongue to the microprocessor brain.
Microprocessor
Optical
sensor

Gas
sensor
Microphone

Probe

Proximity Sensor

Proximity sensors or switches detect the presence of

an object without making physical contact with it.

Dr. Mohammad H. Salah Page no. 25

 Proximity Sensor Applications
The object being detected is too small, lightweight, or
soft to operate a mechanical switch.

Rapid response and high switching rates are required.

An object has to be sensed through nonmetallic barriers

such as glass, plastic, and paper cartons.

Hostile environments conditions exist.

Long life and reliable service are required.

A fast electronic control system requires a bounce-free

input signal.

Inductive Proximity Sensor Operation

Barrel type
Block diagram

As the target
moves into the
sensing area,
the sensor
switches
the output ON

Dr. Mohammad H. Salah Page no. 26

 Proximity Sensor Connections
The method of connecting and exciting a proximity
sensor varies with the type of sensor and its
application.

Target
L1 L2

Load

Two-wire sensor connection

Proximity Sensor Connections

Current-sourcing output (PNP)
Sensor

Control
output

Load Load is connected

between the
sensor and ground

Dr. Mohammad H. Salah Page no. 27

 Proximity Sensor Connections
Sensor
Current-sinking output (NPN)

Load is connected
Load between the positive
supply and sensor

Control
output

Proximity Sensor Connection To Input Module

A proximity sensor should
L1 be powered continuously L2

Input
module
The use of a bleeder
resistor allows enough
Proximity current for the sensor
sensor to operate but not
enough to turn on the
input of the PLC

Bleeder resistor

Dr. Mohammad H. Salah Page no. 28

 Capacitive Proximity Sensor
A capacitive proximity sensor can be actuated by both
conductive and nonconductive material such as wood,
plastics, liquids, sugar flour and wheat.

Operation is similar to that of inductive

proximity sensor. Instead of a coil, the
active face of the sensor is formed by
two metallic electrodes – rather like an
"opened capacitor".

Magnetic Switch (Reed Switch)

A magnetic switch (also called
a reed switch) is composed of
flat contact tabs that are
hermetically sealed (air-tight).

Magnet
N S
NO The switch is
NC actuated by a
Common
magnet.

Dr. Mohammad H. Salah Page no. 29

 Reed Switch Activation
Reed switch
Proximity motion – movement
of the switch or magnet will
activate the switch
Magnet

Rotary motion – switch is

actuated twice for every
complete revolution

Shielding – the shield

short circuits the magnetic
field; switch is activated
by removal of the shield

Photovoltaic Or Solar Cell

The photovoltaic cell, or solar cell, is a
common light-sensor device that
converts light energy directly into
electric energy.

Solar cell

The solar cell converts light

impulses directly into electrical
charges which can easily be
amplified to provide an input
signal to a PLC.

Dr. Mohammad H. Salah Page no. 30

 Photoconductive Or Photoresistive Cell
The photoconductive cell, or
photoresistive cell, is is another
popular type of light transducer.
Light energy falling on this device
will cause a change in the
resistance of the cell.

Ohms
20 Ohms Light resistance
5,000 Ohms Dark resistance

Photoelectric Sensor Operation

Most industrial photoelectric sensors use a light-emitting
diode (LED) for the light source and a phototransistor to
sense the presence or absence of light.

Light from the LED falls

Light detector
on the input of the
phototransistor and the
amount of conduction
Object through the transistor
to be changes. Analog
sensed
outputs provide an
output proportional to
the quantity of light
Light source seen by the
photodetector.

Dr. Mohammad H. Salah Page no. 31

 Reflective Photoelectric Sensor
Emits a light beam (visible,
infrared, or laser) from its light
emitting element and detects
the light being reflected.

Diffused-reflective
Retro-reflective typetype
Operating
Operating
Emitter/receiver range
range

Target
Reflector

Through-Beam Type Photoelectric Sensor

A through-beam photoelectric
sensor is used to measure the
change in light quantity caused
by the target's crossing the
optical axis.

Operating
Emitter Receiver
range

Target

Dr. Mohammad H. Salah Page no. 32

 Bar Code Systems
Bar code systems can be used to
enter data much more quickly
than manual methods, and are
highly accurate.

The decoder receives the

Diverter signal from the scanner
and converts these data
Decoder into the character data
Scanner representation of the
symbol's code.

PLC

Ultrasonic Sensor
An ultrasonic sensor operates by
sending sound waves towards the
target and measuring the time it
takes for the pulses to bounce back.

The returning echo signal

is electronically converted
to a 4 mA to 20 mA output,
which supplies flow rate to
external control devices.

Dr. Mohammad H. Salah Page no. 33

 Strain/Weight Sensors
A strain gauge transducer converts
a mechanical strain into an electric
signal.

Hopper
Wire type Force Controller
The force applied to the gauge causes the
The load cell provides gauge to bend. This bending action also
ON/OFF
Chute
sensor input to the distorts the physical size of the gauge,
Control
controller, which which in turn changes its resistance.
displays the weight
and controls the
hopper chute.

Load cell

Temperature Sensors
Temperature sensors convert heat into an electric
signal. There are four basic types used: thermocouple,
resistance temperature detector (RTD), thermistor, and
IC sensor.
The thermocouple consists of a pair
of dissimilar conductors fused
together at one end to form the
"hot" or measuring junction, with the
free ends available for connection to
the "cold" reference junction. A
temperature difference between the
measuring and reference junction
generates a small DC signal voltage.

Dr. Mohammad H. Salah Page no. 34

 Temperature Sensors
Temperature sensors convert heat into an electric
signal. There are four basic types used: thermocouple,
resistance temperature detector (RTD), thermistor, and
IC sensor.

The resistance temperature

detector (RTD) varies in resistance
value with changes in temperature.

RTD

Temperature Sensors
Temperature sensors convert heat into an electric
signal. There are four basic types used: thermocouple,
resistance temperature detector (RTD), thermistor, and
IC sensor.

The thermistor varies in

resistance value with
changes in temperature

Dr. Mohammad H. Salah Page no. 35

 Temperature Sensors
Temperature sensors convert heat into an electric
signal. There are four basic types used: thermocouple,
resistance temperature detector (RTD), thermistor, and
IC sensor.

The Integrated Circuit (IC) temperature

sensor produces changes in voltage or
current with changes in temperature.

Flow Measurement
The usual approach used in
measuring fluid flow is to
convert the kinetic energy that
the fluid has into some other
measurable form.
Turbine Flow Meter
Coil
The turbine blades turn at
Flow a rate proportional to the
Magnet fluid velocity and are
Turbine magnetized to induce
voltage pulses coil.

Dr. Mohammad H. Salah Page no. 36

 Flow Measurement
The usual approach used in
measuring fluid flow is to
convert the kinetic energy that
the fluid has into some other
measurable form.
Electronic Magnetic Can be used with electrically
Flow Meter conducting fluids and offers no
restriction to flow. A coil in the
unit sets up a magnetic field. If
a conductive liquid flows
through this magnetic field, a
voltage is induced and sensed
by two electrodes.

Velocity/RPM Sensors
A tachometer is a small permanent
magnet DC generator which when
rotated produces a voltage that is
directly proportional to the speed at
which it is driven.

Tachometers coupled
Controller
to motors are
commonly used in
M motor speed control
Motor applications to provide
a feedback voltage to
Tach the controller that is
proportional to motor
speed.

Dr. Mohammad H. Salah Page no. 37

 Velocity/RPM Sensors
The rotating speed of a
shaft is often measured
using a magnetic (inductive)
pickup sensor.

Pickup coil Pole piece

A magnet is attached to the shaft. A
small coil of wire held near the
magnet receives a pulse each time
N S the magnet passes. By measuring
Sensor Magnet the frequency of the pulses, the
output shaft speed can be determined.
0V

Output Control Devices

A variety of output control devices can be operated by the
controller output module to control traditional processes.
These include:

Solenoid Solenoid
Control Alarm
Pilot light relay valve

Heater Small motor

Motor starter

Dr. Mohammad H. Salah Page no. 38

 Actuators
An actuator is any device that converts an electrical
signal into mechanical movement. The principle types
of actuators are relays, solenoids, and motors.

Solenoid Symbol The solenoid converts

electric current into
Plunger
linear motion.

AIR
Coil

Solenoid Valve
A solenoid valve is a combination of:

a solenoid with its core or plunger

a valve body containing an orifice
in which a disc or plug is positioned
to restrict or allow flow
Forward motion of piston When SOL A is energized, the valve
spool is shifted to redirect the fluid
and move the cylinder forward
Directional
solenoid
valve
CR
FWD
SOL A
SOL A

CR

Dr. Mohammad H. Salah Page no. 39

 Stepper Motor
A stepper motor converts electrical
pulses applied to it into discrete
rotor movements called steps. They
are used to provide precise position
control of movement.
Stepper motor control system

Stepper-motor Step
Module translator motor
Communicates
with the PLC and Enables control
responds with of the stepper motor The motor will move
pulse trains one step for each pulse
received

PLC Control of a Large Motor Load

When a PLC needs to

control a large motor, it
must work in
conjunction with a
starter.

Motor starters are

available in various
standard National Electric
manufacturers (NEMA)
sizes and ratings.

Dr. Mohammad H. Salah Page no. 40

 Programmable Logic
Controller

Outlines

Introduction

Advantages of PLC Control Systems

PLC Versus Other Types of Control

Typical Areas of PLC Applications

PLC Product Application Ranges

Structure and Hardware

PLC Scan Process

PLC Programming

Modes of Operation

PLC and Networks

Dr. Mohammad H. Salah Page no. 41

 Introduction

A programmable logic controller (PLC) is a specialized
computer used to control machines and process.

PLC uses a programmable memory to store instructions and
execute specific functions that include On/Off control,
timing, counting, sequencing, arithmetic, and data handling.

The word Programmable differentiates it from the
conventional hard-wired relay logic.

Introduction
PLCs are used in both SCADA and DCS systems as the control
components of an overall hierarchical system to provide local
management of processes through feedback control

Dr. Mohammad H. Salah Page no. 42

 Introduction

Using a PLC requires

setting up the hardware
and software

The hardware installation
consists of wiring the PLC
to all switches and
sensors of the system
and to such output
devices as relay coils,
indicator lamps, or small
motors

Introduction

The control program is usually developed on a PC, using

software provided by the PLC manufacturer

This software allows the user to develop the control
program on the monitor screen

Once the program is complete, it is automatically
converted into instructions for the PLC processor

The completed program is then downloaded into the PLC

Once the program is in the PLC’s memory, the
programming terminal can be disconnected, and the PLC
will continue to function on its own

Dr. Mohammad H. Salah Page no. 43

 Advantages of PLC Control Sys.

Eliminates much of the hard wiring that was associated
with conventional relay control circuits: The PLC also
surpassed the hazard of changing the wiring.

The program takes the place of

the external wiring that would be
required to control the process

Advantages of PLC Control Sys.

Increased Reliability: Once a program has been written and
tested, it can be downloaded to other PLCs.

Since all the

logic is contained
in the PLC’s
memory, there is
no chance of
making a logic
wiring error.

Dr. Mohammad H. Salah Page no. 44

 Advantages of PLC Control Sys.

Faster Response Time: PLCs operate in real-time which
means that an event taking place in the field will result in an
operation or output taking place.

Machines that
process thousands of
items per second and
objects that spend only a
fraction of a second in
front of a sensor require
the PLC’s quick response
capability.

Advantages of PLC Control Sys.

More Flexibility: Original equipment manufacturers (OEMs)
can provide system updates for a process by simply sending
out a new program.

It is easier to
create and change a
program in a PLC than
to wire and rewire a
circuit. End-users can
modify the program in
the field.

Dr. Mohammad H. Salah Page no. 45

 Advantages of PLC Control Sys.

Lower Cost: Originally PLCs were designed to replace relay
logic control. The cost savings using PLCs have been so
significant that relay control is becoming obsolete, except
for power applications.

Generally, if an
application requires
more than about 6
control relays, it will
usually be less
expensive to install a
PLC.

Advantages of PLC Control Sys.

Communication Capabilities: PLC can communicate with
other controllers or computer equipment.

They can be
networked to perform
such functions as:
supervisory control, data
gathering, monitoring
devices and process
parameters, and
downloading and
uploading of programs.

Dr. Mohammad H. Salah Page no. 46

 Advantages of PLC Control Sys.

Easier to Troubleshoot: PLCs have resident diagnostic and
override functions that allows users to easily trace and
correct software and hardware problems.

The
control program
can be watched
in real-time as it
executes to find
and fix problems

Advantages of PLC Control Sys.

PLCs can work with the help of the HMI (Human-Machine
Interface) computer

HMI

Dr. Mohammad H. Salah Page no. 47

 PLC Versus Other Types of Control
PLCs Versus Relay Control

Today’s demand for high quality and productivity can hardly
be fulfilled economically without electronic control
equipment.

With rapid technology developments and increasing
competition, the cost of programmable controls has been
driven down to the point where a PLC-versus-relay cost
study is no longer necessary or valid.

When deciding whether to use a PLC-based system or a
hardwired relay system, the designer must ask several
questions. Some of these questions are:

PLC Versus Other Types of Control

PLCs Versus Relay Control

Is there a need for flexibility in control logic changes?

Is there a need for high reliability?

Are space requirements important?

Are increased capability and output required?

Are there data collection requirements?

Will there be frequent control logic changes?

Will there be a need for rapid modification?

Must similar control logic be used on different machines?

Is there a need for future growth?

What are the overall costs?

Dr. Mohammad H. Salah Page no. 48

 PLC Versus Other Types of Control
PLCs Versus Relay Control

Even in a case where no flexibility or future expansion is
required, a large system can benefit tremendously from the
troubleshooting and maintenance aids provided by a PLC.

The extremely short cycle (scan) time of a PLC allows the
productivity of machines that were previously under
electromechanical control to increase considerably.

Also, although relay control may cost less initially, this
advantage is lost if production downtime due to failures is
high.

PLC Versus Other Types of Control

PLCs Versus Relay Control

Dr. Mohammad H. Salah Page no. 49

 PLC Versus Other Types of Control
PLCs Versus Computer Control

Unlike computers, PLCs are specifically designed to survive
the harsh conditions of the industrial environment.

A well-designed PLC can be placed in an area with
substantial amounts of electrical noise, electromagnetic
interference, mechanical vibration, and non-condensing
humidity.

PLC’s hardware and software are designed for easy use by
plant electricians and technicians.

the software programming uses conventional relay ladder
symbols, or other easily learned languages, which are
familiar to plant personnel.

PLC Versus Other Types of Control

Dr. Mohammad H. Salah Page no. 50

 Typical Areas of PLC Applications

PLC Product Application Ranges

The PLC market can be segmented into five groups:
1. Micro PLCs
2. Small PLCs
3. Medium PLCs
4. Large PLCs
5. Very large PLCs

The A, B, and C
overlapping areas
reflect enhancements,
by adding options, of
the standard features
of the PLCs within a
particular segment.

Dr. Mohammad H. Salah Page no. 51

 PLC Control of a Large Motor Load

When a PLC needs

to control a large
motor, it must work
in conjunction with a
starter.

Motor starters are

available in various
standard National
Electric manufacturers
(NEMA) sizes and
ratings.

Structure and Hardware

Power Supply

Processor (CPU)

Memories

Input/output modules

Programming Port

PLC Bus

Expansion Models

Dr. Mohammad H. Salah Page no. 52

 Structure and Hardware

The PLC bus are the wires which contains the data
bus, address bus, and control signals. The processor
uses the bus to communicate with the modules

Structure and Hardware

Dr. Mohammad H. Salah Page no. 53

 Structure and Hardware

Power Supply

PLCs are usually powered directly from 120 or 240Vac

The power supply converts the AC into DC voltages for the
internal microprocessor components

It may also provide the user with a source of reduced
voltage to drive switches, small relays, indicator lamps, and
the like

Structure and Hardware

Processor (CPU)

The processor is the brain of the
PLC

The processor is a
microprocessor-based CPU and
is the part of the PLC that is
capable of reading and executing
the program instructions, one-
by-one (such as the rungs of a Processor
Module
ladder logic program)

Dr. Mohammad H. Salah Page no. 54

 Structure and Hardware

Processor (CPU)

A special program called the operating system controls
the actions of the CPU and consequently the execution
of the user’s program

The operating system is supplied by the PLC
manufacturer and is permanently held in memory.

A PLC operating system is designed to scan image
memory and the main memory which stores the ladder
diagram program

Structure and Hardware

Memories

The program memory receives and holds the downloaded
program instructions from the programming device

This memory is usually an EEPROM (electrically erasable
programmable ROM) or a battery-backup RAM, both of
which are capable of retaining data

Data memory is RAM memory used as a “scratch pad” by
the processor to temporarily store internal and external
program-generated data

For example, it would store the

present status of all switches
connected to the input terminals and
the value of internal counters and
timers.

Dr. Mohammad H. Salah Page no. 55

 Structure and Hardware

Memories

Structure and Hardware

Input/Output Modules

The I/O modules are interfaces to the outside world

These control ports may be built into the PLC unit or, more
typically, are packaged as separate plug-in modules, where each
module contains a set of ports

The most common type of I/O is called discrete I/O and deals
with on-off devices

Analog I/O modules allow the PLC to handle analog signals

Dr. Mohammad H. Salah Page no. 56

 Structure and Hardware

Input/Output Modules

Fixed I/O configuration

Is typical of small PLCs

Comes in one package, with
no separate removable units.

The processor and I/O are
packaged together.

Lower in cost – but lacks
flexibility.

Structure and Hardware

Input/Output Modules

Modular I/O configuration

When a module slides into

the rack, it makes an
electrical connection with a
series of contacts called
the “backplane”.

The backplane is located at
the rear of the rack.

Dr. Mohammad H. Salah Page no. 57

 Structure and Hardware

Discrete Input Modules (DIM)

DIM connect real-world
switches to the PLC and
are available for either
AC or DC voltages
(typically, 240 Vac, 120
Vac, 24 Vdc, and 5 Vdc)

circuitry within the
module converts the
switched voltage into a
logic voltage for the
processor

Structure and Hardware

Discrete Output Modules (DOM)

DOM provide on-off signals to
drive lamps, relays, small
motors, motor starters, and
other devices

Several types of output

ports are available: Triac
outputs control AC devices,
transistor switches control DC
devices, and relays control AC
or DC devices (and provide
isolation as well)

Dr. Mohammad H. Salah Page no. 58

 Structure and Hardware

Analog Input Modules (AIM)

An analog input module has one or more ADCs (analog-to-
digital converters), allowing analog sensors, such as
temperature, to be connected directly to the PLC

Depending on the module, the analog voltage or current is
converted into an 8-, 12-, or 16-bit digital word

Structure and Hardware

Analog Output Modules (AOM)

An analog output module contains one or more
DACs (digital-to-analog converters), allowing the PLC
to provide an analog output—for example, to drive a
DC motor at various voltage levels

Dr. Mohammad H. Salah Page no. 59

 Structure and Hardware

Input/Output Modules
Specialized modules that perform particular functions are
available for many PLCs. Examples include:

Thermocouple module — Interfaces a thermocouple to the
PLC.

Motion-control module — Runs independently to control
muti-axis motion in a device such as a robot

Communication module — Connects the PLC to a
network

High-speed counter module — Counts the number of
input pulses for a fixed period of time

PID module — An independently running PID self-
contained controller (PID control can also be implemented
with software, as described later in this chapter)

Structure and Hardware

Input/Output Modules

Dr. Mohammad H. Salah Page no. 60

 Structure and Hardware

Interpreting I/O Specificaions

Electrical:

I/O Voltage Rating.

I/O Current Rating.

Input Threshold Voltage.

Input Delay.

Off-State Leakage Current.

Output Power Rating.

Surge Current (Max).

Output On-Delay.

Output Off-Delay.

Digital Resolution.

Structure and Hardware

Interpreting I/O Specificaions

Mechanical:

Points Per Module.

Wire Size.

Environmental:

Ambient Temperature Rating.

Humidity.

Dr. Mohammad H. Salah Page no. 61

 Structure and Hardware

Programming Port and Device

The programming port receives the downloaded program
from the programming device (usually a PC)

Structure and Hardware

Programming Port and Device

The PLC does not have a front panel or a monitor; thus, to
“see” what the PLC is doing (for debugging or
troubleshooting), you must connect it to a PC

Dr. Mohammad H. Salah Page no. 62

 Structure and Hardware

Programming Port and Device

A personal computer (PC) is the most commonly used
programming device.

The computer monitor is used to display the logic on the
screen.

The personal computer communicates with the PLC
processor via a serial or parallel data communications link.

The software allows users to create, edit, document, store
and troubleshoot programs. If the programming unit is not
in use, it may be unplugged and removed. Removing the
programming unit will not affect the operation of the user
program.

Structure and Hardware

Programming Port and Device

Hand-held programming devices are sometimes used to program
small PLCs.

They are compact, inexpensive, and easy to use, but are not able
to display as much logic on screen as a computer monitor.

Hand-held units are often used on the factory floor for
troubleshooting, modifying programs, and transferring programs
to multiple machines.

Dr. Mohammad H. Salah Page no. 63

 Structure and Hardware

Expansion Modules

Most PLCs are expandable

Expansion modules contain additional inputs and outputs

These are connected to the base unit using a ribbon
connector

BIG PICTURE

Dr. Mohammad H. Salah Page no. 64

 PLC Scan Process

PLC Scan Process

Dr. Mohammad H. Salah Page no. 65

 PLC Scan Process

PLC Scan Process

The scan time is dependent on the clock frequency of the processor.

Misunderstanding the way the PLC scans can cause programming
bugs!

Dr. Mohammad H. Salah Page no. 66

 PLC Scan Process

PLC Scan Process

Data Flow Overview

Dr. Mohammad H. Salah Page no. 67

 PLC Scan Process

PLC Programming

The term PLC programming language refers to the method by
which the user communicates information to the PLC.

A PLC program is not actually a wiring diagram but a way to
describe the logical relationship between inputs and outputs

The PLC programming languages are:
– Sequential Control and State Graph (Graph)
– Sequential Function Chart (SFC)
– Structured Text (ST)
– Instruction List (IL)
– Function Block Diagram (FBD)
– Ladder Diagram (LD)
The most common is LD, FBD, and IL but the most use is the LD.

Dr. Mohammad H. Salah Page no. 68

 PLC Programming

Sequential Functional Chart

Sequential functional chart, or SFC, is a graphical “language” that
provides a diagrammatic representation of control sequences in a
program.

Basically, sequential function chart is a flowchart-like framework
that can organize the subprograms or subroutines (programmed
in LD, FBD, IL, and/or ST) that form the control program.

SFC is particularly useful for sequential control operations, where
a program flows from one step to another once a condition has
been satisfied (TRUE or FALSE).

The SFC programming framework contains three main elements
that organize the control program: steps, transitions, and
actions.

PLC Programming

Sequential Functional Chart

Dr. Mohammad H. Salah Page no. 69

 PLC Programming

Sequential Functional Chart

PLC Programming

Structured Text

Dr. Mohammad H. Salah Page no. 70

 PLC Programming

Instruction List

PLC Programming

Function Block Diagram

Dr. Mohammad H. Salah Page no. 71

 PLC Programming

Ladder Diagram

PLC Programming

Ladder Diagram

A LAD (special kind of wiring diagram) was developed to
document electromechanical control circuits.

Ladder diagram programs are highly symbolic and are the
result of years of evolution of industrial control circuit
diagrams

This type of diagram has two vertical wires (rails) on either
side of the drawing to supply the power

Each rung of the ladder diagram connects from one rail to
the other and is a separate circuit, which typically consists
of some combination of switches, relay contacts, relay coils,
and motors

It is common for the coil of a relay to be in one rung and the
contacts to be in another

Dr. Mohammad H. Salah Page no. 72

 PLC Programming

Ladder Diagram

PLC Programming

Ladder Diagram

Ladder rung
Ladder rail
Control scheme is drawn
between two vertical
supply lines.

Dr. Mohammad H. Salah Page no. 73

 PLC Programming

Ladder Diagram - Comparison

PLC Programming

Ladder Diagram - Comparison

Dr. Mohammad H. Salah Page no. 74

 PLC Programming

Relay-Type Instructions

PLC Programming

Examine if Closed (XIC) Instruction

Dr. Mohammad H. Salah Page no. 75

 PLC Programming

Examine if Closed (XIC) Instruction

PLC Programming

Examine if Closed (XIC) Instruction

Dr. Mohammad H. Salah Page no. 76

 PLC Programming

Examine if Closed (XIC) Instruction

PLC Programming

Examine if Open (XIO) Instruction

Dr. Mohammad H. Salah Page no. 77

 PLC Programming

Examine if Open (XIO) Instruction

PLC Programming

Examine if Open (XIO) Instruction

Dr. Mohammad H. Salah Page no. 78

 PLC Programming

Output Energize (OTE) Instruction

PLC Programming

Output Energize (OTE) Instruction

Dr. Mohammad H. Salah Page no. 79

 PLC Programming

Output Energize (OTE) Instruction

PLC Programming

Status Bit Example

Dr. Mohammad H. Salah Page no. 80

 PLC Programming

Status Bit Example

PLC Programming

Ladder Rung

Dr. Mohammad H. Salah Page no. 81

 PLC Programming

Rung Continuity

PLC Programming

Rung Continuity

Dr. Mohammad H. Salah Page no. 82

 PLC Programming

Example

PLC Programming

Parallel Input Branch Instruction

Dr. Mohammad H. Salah Page no. 83

 PLC Programming

Parallel Output Branching

PLC Programming

Nested Input and Output Branches

Dr. Mohammad H. Salah Page no. 84

 PLC Programming

Nested Contact Program

PLC Programming

PLC Matrix Limitation Diagram

Dr. Mohammad H. Salah Page no. 85

 PLC Programming

Programming of Vertical Contacts

PLC Programming
Programming for Different Scan
Patterns

Dr. Mohammad H. Salah Page no. 86

 PLC Programming

Internal (Auxiliary) Control Relay

PLC Programming

Internal (Auxiliary) Control Relay

Dr. Mohammad H. Salah Page no. 87

 PLC Programming

Operation of XIC/XIO Instruction

PLC Programming

Operation of XIC/XIO Instruction

Dr. Mohammad H. Salah Page no. 88

 PLC Programming

Ladder Diagram - Timers

The Timer instruction provides a time delay, performing the
function of a time-delay relay (e.g., controlling the time for
a mixing operation or the duration of a warning beep)

The length of time delay is determined by specifying a
preset value

The timer is enabled when the rung conditions become
TRUE

Once enabled, it automatically counts up until it reaches the
Preset value and then goes TRUE (and stays TRUE)

There are two types of time delay (On and Off)

PLC Programming

Ladder Diagram - Timers

Dr. Mohammad H. Salah Page no. 89

 PLC Programming

Ladder Diagram - Timers

On-Delay Timer

Off-Delay Timer

PLC Programming

Ladder Diagram - Timers

Dr. Mohammad H. Salah Page no. 90

 PLC Programming

Ladder Diagram - Timers

PLC Programming

Ladder Diagram - Timers

Dr. Mohammad H. Salah Page no. 91

 PLC Programming

Ladder Diagram - Timers

PLC Programming

Ladder Diagram - Counters

A Counter instruction keeps track of the number of times
some event occurs (e.g., the count could represent the
number of parts to be loaded into a box)

Counters may be either count-up or count-down types. The
Counter will increment (or decrement) every time the rung
makes a FALSE-to-TRUE transition

The count is retained until a RESET instruction (with the
same address as the Counter) is enabled

The Counter has a Preset value associated with it. When the
count gets up to the Preset value, the output goes TRUE.
This allows the program to initiate some action based on a
certain count

Dr. Mohammad H. Salah Page no. 92

 PLC Programming

Ladder Diagram - Counters

PLC Programming

Ladder Diagram - Counters

Dr. Mohammad H. Salah Page no. 93

 PLC Programming

Ladder Diagram - Counters

PLC Programming

Ladder Diagram - Counters

Dr. Mohammad H. Salah Page no. 94

 PLC Programming

Ladder Diagram - Sequencers

The Sequencer instruction is used when a repeating
sequence of outputs is required

Traditionally, electromechanical sequencers (Figure 12.10)
were used in this type of application (where a drum rotates
slowly, and cams on the drum activate switches)

The Sequencer instruction

allows the PLC to implement
this common control strategy

PLC Programming

Ladder Diagram - Sequencers

Dr. Mohammad H. Salah Page no. 95

 PLC Programming

Ladder Diagram - Sequencers

PLC Programming

Ladder Diagram - Sequencers

Dr. Mohammad H. Salah Page no. 96

 PLC Programming

Ladder Diagram - Comparators

The temperature in an electric oven
is to be maintained by a 16-bit PLC
at approximately 100°C, using two-
point control (actual range: 98-
102°). An oven with an electric
heating element driven by a
contactor (high-current relay), an
LM35 temperature sensor (produces
10 mV/°C), an operator on-off
switch, and the PLC. The PLC has a
processor and three I/O modules: a
discrete input module (slot 1), a 16-
bit analog input module (slot 2), and
a discrete output module (slot 3).
Draw the ladder diagram for this
system

PLC Programming

Ladder Diagram - Comparators

Dr. Mohammad H. Salah Page no. 97

 PLC Programming

Equivalent Ladder / Logic Symbols

PLC Programming

Equivalent Ladder / Logic Symbols

Dr. Mohammad H. Salah Page no. 98

 PLC Programming

Equivalent Ladder / Logic Symbols

PLC Programming

Equivalent Ladder / Logic Symbols

Dr. Mohammad H. Salah Page no. 99

 PLC Programming

Equivalent Ladder / Logic Symbols

PLC Programming

Equivalent Ladder / Logic Symbols

Dr. Mohammad H. Salah Page no. 100

 PLC Programming

Equivalent Ladder / Logic Symbols

PLC Programming

Equivalent Ladder / Logic Symbols

Dr. Mohammad H. Salah Page no. 101

 PLC Programming

Equivalent Ladder / Logic Symbols

PLC Programming

Equivalent Ladder / Logic Symbols

Dr. Mohammad H. Salah Page no. 102

 PLC Programming

Equivalent Ladder / Logic Symbols

PLC Programming

Ladder Diagram – Programming Comments

Arranging Instructions for Optimum Performance

There is more than one way to correctly implement the ladder logic. In
some cases one arrangement may be more efficient in terms of the
amount of memory used and the time required to scan the program.
Sequence series instructions from the most likely to be FALSE
(far left) to least likely to be FALSE (far right)
Instruction MOST Instruction LEAST
likely to be FALSE likely to be FALSE

Once a processor sees a FALSE input instruction in series, it

executes the remaining instructions FALSE, even if they are
TRUE

Dr. Mohammad H. Salah Page no. 103

 PLC Programming

Ladder Diagram – Programming Comments

Arranging Instructions for Optimum Performance

If your rung contains parallel branches, place the path that
is most often TRUE on the top. The processor will not look
at the others unless the top path is FALSE.
Path most likely to be TRUE

LESS likely

LEAST likely

Modes of Operation

Dr. Mohammad H. Salah Page no. 104

 Modes of Operation

PLC and Networks

Physically, a network is a wire acting as an “electronic
highway” that can pass messages between nodes (PCs and
other electronic devices)

Each node on the network has a unique address, and each
message called a data packet (includes the address of
where it’s going and where it came from)

All data on the network is sent serially (one bit at a time) on
one wire

The most common type of network uses the bus topology,
which means that all the nodes tap into a single cable

Dr. Mohammad H. Salah Page no. 105

 PLC and Networks

PLC and Networks

There are three good reasons for using a network:

A device network simplifies wiring. Clearly the network is a
simpler system that uses less wire. This reduces the amount
of wiring needed

With a network, the sensor data arrives in better shape. In
the traditional system, a low-level analog voltage may have
to travel many feet. The signal is subject to attenuation and
noise and other losses

Network devices tend to be more intelligent. For example,
a photo cell could send a message saying the light level has
diminished, (indicating that the lens may be getting dirty or
that someone has bumped it out of position)

Dr. Mohammad H. Salah Page no. 106

 PLC and Networks

PLC and Networks

Three levels
of networks

Dr. Mohammad H. Salah Page no. 107

 PLC and Networks

Dr. Mohammad H. Salah Page no. 108

 PLC Exercises
Ladder Diagram
Programming

Steps for Building a Ladder Diagram

1. Determine the No. of digital I/O

2. Determine the No. of analog I/O (if needed)
3. Determine if there are special functions in the process
4. Estimate program capacity depending on the process
5. Choose a suitable PLC series
6. Prepare the wiring diagram
7. Draw flowchart or control diagram (Optional)
8. Program the PLC using the ladder diagram

Dr. Mohammad H. Salah Page no. 109

 Exercise #1: Moving a Pneumatic Piston

Control Problem
The PLC task is to move the
piston in and out. When
switch SW1 is momentarily
turned on, piston A is to
move out of the cylinder in
A+ direction. When switch
SW2 is momentarily turned
on, piston A is to move into
the cylinder in A- direction.

Exercise #1: Moving a Pneumatic Piston

Dr. Mohammad H. Salah Page no. 110

 Exercise #1: Moving a Pneumatic Piston

If SW1 and SW2 are

pressed together,
what would happen?

The two solenoid

valves will be tuned off

How can we make

an electrical
interlock?

Use the contacts of the

main relays instead of
the input contacts

Exercise #2: Sequencing of Pneumatic Pistons

Control Problem
The PLC task is to operate piston A followed by
piston B followed by piston C. The sequence is A+,
A-, B+, B-, C+, C- is to be repeated when switch
SW1 is turned on

Dr. Mohammad H. Salah Page no. 111

 Exercise #2: Sequencing of Pneumatic Pistons

Exercise #2: Sequencing of Pneumatic Pistons

If the system does not work or sequence in not

correct, what would be the possible reasons?
• Solenoid valves do not work
• The wiring of solenoid valves is not correct or not in
the correct order (wiring problem)
• The ladder diagram is not properly written (sequence
in not correct)

Dr. Mohammad H. Salah Page no. 112

 Exercise #3: Batching Machine

Control Problem
The PLC task is to control a simple
machine which counts and batches
components moving along a conveyor. It
is required that ten components be
channeled down route A and twenty
components down route B. A reset facility
is required

Exercise #3: Batching Machine

Dr. Mohammad H. Salah Page no. 113

 Exercise #3: Batching Machine

Exercise #3: Batching Machine

If the system does not batch and/or

count, what would be the possible
reasons?

• The reset switch is always on

• The microswitch does not work
• The flap solenoid does not work
• The ladder diagram is not properly
written

Dr. Mohammad H. Salah Page no. 114

 Exercise #4: Reject Machine

Control Problem
The PLC task is to detect and reject faulty components. Components are
transported on a conveyor past a retro-reflective type photoelectric switch. The
photoelectric switch is positioned at a height (H) above the conveyor where (H)
represents a tolerance value for component height. Good components pass
underneath the photoelectric switch and no signal is generated. Faulty
components break the light beam twice as they pass the photoelectric switch.

Exercise #4: Reject Machine

Dr. Mohammad H. Salah Page no. 115

 Exercise #4: Reject Machine

Exercise #4: Reject Machine

If the system does not reject faulty components, what would be the
possible reasons?
• The photoelectric switch is too high (H is too big)
• The photoelectric switch does not work
• The pneumatic blower does not work
• The ladder diagram is not properly written
• The faulty components is not as described in the drawing

Dr. Mohammad H. Salah Page no. 116

 Exercise #5: Pick and Place Unit

Control Problem
The PLC task is to:
a) move the gripper to X+ position
b) close the gripper so that it takes hold of a component
c) rotate the gripper through 180o to the Θ+ position
d) Release the component
e) Rotate the gripper back to the Θ- position so that the pick and place
operation may be repeated

Exercise #5: Pick and Place Unit

Dr. Mohammad H. Salah Page no. 117

 Exercise #5: Pick and Place Unit

If the system does not

work or sequence is not
correct, what would be
the possible reasons?
• Wiring problem
• Some solenoid valves do
not work
• Timing is not correct
• The ladder diagram is not
properly written
(sequence in not correct)

How can we get rid of the timers in the ladder diagram/program?

Use position sensors for feedback but that would be expensive compared to
using timers but more accurate and reliable in case the mechanical system
starts to have some problems

Exercise #6: Production Line

Control Problem
The PLC task is to organize the production process. Cans filled with fluid and
capped before passing into a conveyor. The photoelectric switches P1 and P2 are
used to check that each can has a cap. Photoelectric switch P3 provides a trigger
for the ink jet printer which prints a batch number on each can. Photoelectric
switch P4 is used to count three cans into the palletizing machine that transports
three cans through a machine which heat shrinks a plastic wrapping over them.
All photoelectric switches on the production line are of the retro reflective type.

Dr. Mohammad H. Salah Page no. 118

 Exercise #6: Production Line

Exercise #6: Production Line

Dr. Mohammad H. Salah Page no. 119

 Exercise #6: Production Line

If the system allows uncapped cans to pass, what would be the

possible reasons?
• The height of the photoelectric switch needs to be readjusted
• The photoelectric switch does not work (transmitter or receiver)
• The photoelectric transmitter is not aligned with the receiver
• The ladder diagram is not properly written (or timer is not set properly)

Exercise #7: Star-Delta Connection

Dr. Mohammad H. Salah Page no. 120

 Exercise #7: Star-Delta Connection

Exercise #7: Star-Delta Connection

PLC system layout – Wiring diagram

Dr. Mohammad H. Salah Page no. 121

 Exercise #7: Star-Delta Connection

Exercise #8: Drilling Process

PB1 PB2
Drill
A simple drilling operation requires motor
the drill press to turn on only if Switches
there is a part present and the
operator has one hand on each of
the start switches. This precaution
will ensure that the operator's
hands are not in the way of the
drill.

Part sensor

Dr. Mohammad H. Salah Page no. 122

 Exercise #8: Drilling Process

A simple drilling operation requires the drill press to turn on only if there is a
part present and the operator has one hand on each of the start switches. This
precaution will ensure that the operator's hands are not in the way of the drill.

Exercise #9: Motorized Door

A motorized overhead garage door is to be operated
automatically to preset open and closed positions.

Dr. Mohammad H. Salah Page no. 123

 Exercise #9: Motorized Door

Exercise #10: Continuous Filling Machine

Continuous filling operation requires boxes moving on a conveyor to be

automatically positioned and filled.
Hooper
PL Run

PL Standby
Solenoid
Level PL Full
switch

Photo
Motor
switch

START
STOP

Dr. Mohammad H. Salah Page no. 124

 Exercise #10: Continuous Filling Machine

Exercise #11: Transporting Process 1

Need to do the PLC

hardware layout +
ladder diagram

Dr. Mohammad H. Salah Page no. 125

 Exercise #11: Transporting Process 1

Exercise #12: Transporting Process 2

Need to automate the
system using a PLC
(hardware layout +
ladder diagram)

Dr. Mohammad H. Salah Page no. 126

 Industrial Control
Systems

Outlines

Introduction

ICS Operation

ICS Key Components

SCADA Systems

DCS Systems

RTU

Telemetry

Modems

SCADA Systems Examples

Dr. Mohammad H. Salah Page no. 127

 Introduction

Industrial Control Systems is a general term that includes
several types of control systems:
 Supervisory Control And Data Acquisition (SCADA) systems.
 Distributed Control Systems (DCS).
 Other control system configurations such as Programmable
Logic Controllers (PLC).

ICS are typically used in industries such as electrical, water
and wastewater, oil and natural gas, chemical,
transportation, pharmaceutical, food and beverage, and
discrete manufacturing (e.g., automotive).

These control systems are used for critical infrastructures
that are often highly interconnected and mutually
dependent systems

Introduction

SCADA systems are highly distributed systems used to
control geographically dispersed assets, often scattered
over thousands of square kilometers, where centralized
data acquisition and control are critical to system operation.

They are used in distribution systems such as water
distribution and wastewater collection systems, oil and
natural gas pipelines, electrical power grids, and railway
transportation systems.

A SCADA control center performs centralized monitoring
and control for field sites over long-distance
communications networks, including monitoring alarms and
processing status data.

Dr. Mohammad H. Salah Page no. 128

 Introduction

Based on information received from remote stations,
automated or operator-driven supervisory commands can
be pushed to remote station control devices, which are
often referred to as field devices.

Field devices control local operations such as opening and
closing valves and breakers, collecting data from sensor
systems, and monitoring the local environment for alarm
conditions.

Introduction

DCS are used to control industrial processes such as electric
power generation, oil refineries, water and wastewater
treatment, and chemical, food, and automotive production.

DCS are integrated as a control architecture containing a
supervisory level of control overseeing multiple, integrated
sub-systems that are responsible for controlling the details
of a localized process.

Product and process control are usually achieved by
deploying feedback or feedforward control loops whereby
key product and/or process conditions are automatically
maintained around a desired set point.

Dr. Mohammad H. Salah Page no. 129

 Introduction

To accomplish the desired product and/or process tolerance
around a specified set point, specific PLCs are employed in
the field and proportional, integral, and/or derivative
settings on the PLC are tuned to provide the desired
tolerance as well as the rate of self-correction during
process upsets.

DCS are used extensively in process-based industries.

Introduction

PLCs are computer-based solid-state devices that control
industrial equipment and processes.

While PLCs are control system components used throughout
SCADA and DCS systems, they are often the primary
components in smaller control system configurations used
to provide operational control of discrete processes such as
automobile assembly lines and power plant soot blower
controls.

PLCs are used extensively in almost all industrial processes.

Dr. Mohammad H. Salah Page no. 130

 Introduction

While control systems used in distribution and
manufacturing industries are very similar in operation, they
are different in some aspects.

One of the primary differences is that DCS or PLC-controlled
sub-systems are usually located within a more confined
factory or plant-centric area, when compared to
geographically dispersed SCADA field sites.

DCS and PLC communications are usually performed using
local area network (LAN) technologies that are typically
more reliable and high speed compared to the long-distance
communication systems used by SCADA systems.

Introduction

In fact, SCADA systems are specifically designed to handle
long-distance communication challenges such as delays and
data loss posed by the various communication media used.

DCS and PLC systems usually employ greater degrees of
closed loop control than SCADA systems because the
control of industrial processes is typically more complicated
than the supervisory control of distribution processes.

Dr. Mohammad H. Salah Page no. 131

 Introduction

SCADA systems are generally used to control dispersed

assets using centralized data acquisition and supervisory
control.

DCS are generally used to control production systems within
a local area such as a factory using supervisory and
regulatory control.

PLCs are generally used for discrete control for specific
applications and generally provide regulatory control.

Introduction

ICS have unique performance and reliability requirements
and often use operating systems and applications that may
be considered unconventional to typical IT personnel.
Furthermore, the goals of safety and efficiency sometimes
conflict with security in the design and operation of control
systems.

ICS implementations were susceptible primarily to local
threats because many of their components were in
physically secured areas and the components were not
connected to IT networks or systems.

However, the trend toward integrating ICS systems with IT
networks provides significantly less isolation for ICS from the
outside world than predecessor systems, creating a greater
need to secure these systems from remote, external threats.

Dr. Mohammad H. Salah Page no. 132

 Introduction

The increasing use of wireless networking places ICS
implementations at greater risk from adversaries who are in
relatively close physical proximity but do not have direct
physical access to the equipment.

Threats to control systems can come from numerous
sources, including hostile governments, terrorist groups,
disgruntled employees, malicious intruders, complexities,
accidents, natural disasters as well as malicious or
accidental actions by insiders.

ICS security objectives typically follow the priority of
availability, integrity and confidentiality, in that order.

Introduction

It is essential for a cross-functional cyber (internet) security
team to share their varied domain knowledge and
experience to evaluate and mitigate risk to the ICS.

The cyber security team should consist of a member of the
organization’s IT staff, control engineer, control system
operator, network and system security expert, a member of
the management staff, and a member of the physical
security department at a minimum.

For continuity and completeness, the cyber security team
should consult with the control system vendor and/or
system integrator as well.

Dr. Mohammad H. Salah Page no. 133

 Introduction

The cyber security team should report directly to site
management (e.g., facility superintendent) or the company’s
CIO/CSO, who in turn, accepts complete responsibility and
accountability for the cyber security of the ICS. An effective
cyber security program for an ICS should apply a strategy
known as “defense-in-depth”, layering security mechanisms
such that the impact of a failure in any one mechanism is
minimized.

CIO = Chief Information Officer or IT Director

CSO = Chief Security Officer

ICS Operation

Dr. Mohammad H. Salah Page no. 134

 ICS Operation
1. Control Loop. A control loop consists of sensors for
measurement, controller hardware such as PLCs, actuators
such as control valves, breakers, switches and motors, and
the communication of variables.

Controlled variables are transmitted to the controller from
the sensors.

The controller interprets the signals and generates
corresponding manipulated variables, based on set points,
which it transmits to the actuators.

Process changes from disturbances result in new sensor
signals, identifying the state of the process, to again be
transmitted to the controller.

ICS Operation
2. Human-Machine Interface (HMI). Operators and engineers
use HMIs to monitor and configure set points, control
algorithms, and adjust and establish parameters in the
controller.

The HMI also displays process status information and
historical information.
3. Remote Diagnostics and Maintenance Utilities. Diagnostics
and maintenance utilities are used to prevent, identify and
recover from abnormal operation or failures.
A typical ICS contains a propagation of control loops, HMIs, and remote
diagnostics and maintenance tools built using an array of network
protocols on layered network architectures

Dr. Mohammad H. Salah Page no. 135

 ICS Key Components
1. Control Components
Control Server: hosts the DCS or PLC supervisory control
software that is designed to communicate with lower-
level control devices. The control server accesses
subordinate control modules over an ICS network.
SCADA Server or Master Terminal Unit (MTU): The
SCADA Server is the device that acts as the master in a
SCADA system. Remote terminal units (RTUs) and PLC
devices located at remote field sites usually act as slaves.

ICS Key Components

1. Control Components
Remote Terminal Unit (RTU): It is also called a remote
telemetry unit. It is a special purpose data acquisition and
control unit designed to support SCADA remote stations.
RTUs are field devices often equipped with wireless radio
interfaces to support remote situations where wire-
based communications are unavailable. Sometimes PLCs
are implemented as field devices to serve as RTUs; in this
case, the PLC is often referred to as an RTU.

Dr. Mohammad H. Salah Page no. 136

 ICS Key Components
1. Control Components
Programmable Logic Controller (PLC): The PLC is a small
industrial computer originally designed to perform the
logic functions executed by electrical hardware. Other
controllers used at the field level are process controllers
and RTUs; they provide the same control as PLCs but are
designed for specific control applications. In SCADA
environments, PLCs are often used as field devices
because they are more economical, multipurpose,
flexible, and configurable than special-purpose RTUs.

ICS Key Components

1. Control Components
Programmable Logic Controller (PLC): PLCs are used in
both SCADA and DCS systems as the control components
of an overall hierarchical system to provide local
management of processes through feedback control. In
the case of SCADA systems, they provide the same
functionality of RTUs. When used in DCS, PLCs are
implemented as local controllers within a supervisory
control scheme.

Dr. Mohammad H. Salah Page no. 137

 ICS Key Components
1. Control Components
Programmable Logic Controller (PLC): PLCs are also
implemented as the primary components in smaller
control system configurations. PLCs have a user-
programmable memory for storing instructions for the
purpose of implementing specific functions such as I/O
control, logic, timing, counting, three mode proportional-
integral-derivative (PID) control, communication,
arithmetic, and data and file processing.

ICS Key Components

1. Control Components
Intelligent Electronic Devices (IED): An IED is a “smart”
sensor/actuator containing the intelligence required to
acquire data, communicate to other devices, and
perform local processing and control. An IED could
combine an analog input sensor, analog output, low-level
control capabilities, a communication system, and
program memory in one device. The use of IEDs in
SCADA and DCS systems allows for automatic control at
the local level.

Dr. Mohammad H. Salah Page no. 138

 ICS Key Components
1. Control Components
Human-Machine Interface (HMI): The HMI is software
and hardware that allows human operators to monitor
the state of a process under control, modify control
settings to change the control objective, and manually
override automatic control operations in the event of an
emergency. The HMI also allows a control engineer or
operator to configure set points or control algorithms
and parameters in the controller. The HMI also displays
process status information, historical information,
reports, and other information to operators,
administrators, managers, business partners, and other
authorized users.

ICS Key Components

1. Control Components
Data Historian: The data historian is a centralized
database for logging all process information within an
ICS. Information stored in this database can be accessed
to support various analyses, from statistical process
control to enterprise level planning.
Input/Output (IO) server: The IO server is a control
component responsible for collecting, buffering and
providing access to process information from control sub-
components such as PLCs, RTUs and IEDs. An IO server
can reside on the control server or on a separate
computer platform. IO servers are also used for
interfacing third-party control components, such as an
HMI and a control server.

Dr. Mohammad H. Salah Page no. 139

 ICS Key Components
2. Network Components
Fieldbus Network: It links sensors and other devices to a
PLC or other controller. Use of fieldbus technologies
eliminates the need for point-to-point wiring between
the controller and each device. The sensors communicate
with the fieldbus controller using a specific protocol. The
messages sent between the sensors and the controller
uniquely identify each of the sensors.
Control Network: The control network connects the
supervisory control level to lower-level control modules.

ICS Key Components

2. Network Components
 Communications Routers: A router is a communications
device that transfers messages between two networks.
Common uses for routers include connecting a LAN to a WAN,
and connecting MTUs and RTUs to a long-distance network
medium for SCADA communication.
 Remote Access Points: Remote access points are distinct
devices, areas and locations of a control network for remotely
configuring control systems and accessing process data.
Examples include using a personal digital assistant (PDA) to
access data over a LAN through a wireless access point, and
using a laptop and modem connection to remotely access an
ICS system.

Dr. Mohammad H. Salah Page no. 140

 ICS Key Components
2. Network Components
 Firewall: A firewall protects devices on a network by monitoring
and controlling communication packets using predefined filtering
policies. Firewalls are also useful in managing ICS network
isolation strategies.
 Modems: A modem is a device used to convert between serial
digital data and a signal suitable for transmission over a
telephone line to allow devices to communicate. Modems are
often used in SCADA systems to enable long-distance serial
communications between MTUs and remote field devices. They
are also used in SCADA systems, DCS and PLCs for gaining remote
access for operational and maintenance functions such as
entering commands or modifying parameters, and diagnostic
purposes.

SCADA Systems

SCADA is not a full control system, but rather focuses on the
supervisory level.

SCADA is used for gathering, analyzing and to storage real
time data.

SCADA systems consist of both hardware and software.

Typical hardware includes an MTU placed at a control
center, communications equipment (e.g., radio, telephone
line, cable, or satellite), and one or more geographically
distributed field sites consisting of either an RTU or a PLC,
which controls actuators and/or monitors sensors.

The MTU stores and processes the information from RTU
inputs and outputs, while the RTU or PLC controls the local
process

Dr. Mohammad H. Salah Page no. 141

 SCADA Systems

The communications hardware allows the transfer of
information and data back and forth between the MTU and
the RTUs or PLCs.

The software is programmed to tell the system what and
when to monitor, what parameter ranges are acceptable,
and what response to initiate when parameters change
outside acceptable values.

An IED, such as a protective relay, may communicate directly
to the SCADA Server, or a local RTU may poll the IEDs to
collect the data and pass it to the SCADA Server.

IEDs provide a direct interface to control and monitor
equipment and sensors.

SCADA Systems

IEDs may be directly polled and controlled by the SCADA Server and in
most cases have local programming that allows for the IED to act
without direct instructions from the SCADA control center.

SCADA systems are usually designed to be fault-tolerant systems with
significant redundancy built into the system architecture.

SCADA System General Layout (Components and General Configuration)

Dr. Mohammad H. Salah Page no. 142

 SCADA Systems

The control center houses a SCADA Server (MTU) and the
communications routers.

Other control center components include the HMI,
engineering workstations, and the data historian, which are
all connected by a LAN.

The control center collects and logs information gathered by
the field sites, displays information to the HMI, and may
generate actions based upon detected events.

The control center is also responsible for centralized
alarming, trend analyses, and reporting.

The field site performs local control of actuators and
monitors sensors.

SCADA Systems

Field sites are often equipped with a remote access
capability to allow field operators to perform remote
diagnostics and repairs usually over a separate dial up
modem or WAN connection.

Standard and proprietary communication protocols running
over serial communications are used to transport
information between the control center and field sites using
telemetry techniques such as telephone line, cable, fiber,
and radio frequency such as broadcast, microwave and
satellite.

Dr. Mohammad H. Salah Page no. 143

 SCADA Systems

MTU-RTU communication architectures vary among
implementations. The various architectures used, including
point-to-point, series, series-star, and multi-drop.

Point-to-point is functionally the simplest type; however, it
is expensive because of the individual channels needed for
each connection.

In a series configuration, the number of channels used is
reduced; however, channel sharing has an impact on the
efficiency and complexity of SCADA operations.

Similarly, the series-star and multi-drop configurations’ use
of one channel per device results in decreased efficiency and
increased system complexity.

SCADA Systems

Basic SCADA
Communication Topologies

Dr. Mohammad H. Salah Page no. 144

 SCADA Systems

The four basic architectures can be further augmented using
dedicated communication devices to manage
communication exchange as well as message switching and
buffering.

Large SCADA systems, containing hundreds of RTUs, often
employ sub-MTUs to alleviate the burden on the primary
MTU. This type of topology is shown in the following figure.

SCADA Systems

Large SCADA
Communication Topology

Dr. Mohammad H. Salah Page no. 145

 SCADA Systems

SCADA System
Implementation
Example
(Distribution
Monitoring And
Control)

SCADA Systems

This particular SCADA system consists of a primary control
center and three field sites.

A second backup control center provides redundancy in the
event of a primary control center malfunction.

Point-to-point connections are used for all control center to
field site communications, with two connections using radio
telemetry.

The third field site is local to the control center and uses the
wide area network (WAN) for communications.

A regional control center resides above the primary control
center for a higher level of supervisory control.

Dr. Mohammad H. Salah Page no. 146

 SCADA Systems

The corporate network has access to all control centers
through the WAN, and field sites can be accessed remotely
for troubleshooting and maintenance operations.

The primary control center polls field devices for data at
defined intervals (e.g., 5 seconds, 60 seconds) and can send
new set points to a field device as required.

In addition to polling and issuing high-level commands, the
SCADA server also watches for priority interrupts coming
from field site alarm systems.

SCADA Systems

SCADA System Implementation

Example
(Rail Monitoring and Control)

Dr. Mohammad H. Salah Page no. 147

 SCADA Systems

The previous example includes a rail control center that
houses the SCADA system and three sections of a rail
system.

The SCADA system polls the rail sections for information
such as the status of the trains, signal systems, traction
electrification systems, and ticket vending machines.

This information is also fed to operator consoles at the HMI
station within the rail control center.

The SCADA system also monitors operator inputs at the rail
control center and disperses high-level operator commands
to the rail section components.

SCADA Systems

In addition, the SCADA system monitors conditions at the
individual rail sections and issues commands based on these
conditions (e.g., shut down a train to prevent it from
entering an area that has been determined to be flooded or
occupied by another train based on condition monitoring).

Dr. Mohammad H. Salah Page no. 148

 SCADA Systems

There are several common media of communication:
- Fiber optics
- Electrical cable.
- Leased lines from a telephone utility.
- Satellite telecommunications.

The communications method used by most SCADA systems
is called “master–slave”, where only one of the machines (in
this case the MTU) is capable of initiating communication.

The MTU talks to each RTU then returns to the first. This is
called "scanning".

The time required for the MTU to scan ALL its RTUs is called
the MTU Scan Time (Scan Interval).

Factors that determine scan interval are: number of RTUs,
amount of data, data rate, and communications efficiency.

Example

SCADA Systems
Calculate a scan interval for a SCADA system that:
- Has 20 RTUs
- Every RTU has a point count of 180 status points, 30 alarm
points, 10 meters (at 16 bits each), and 10 analog points (at
16 bits each).
- The MTU sends information to the RTU of 150 discrete
control signals to valves and motors, 6 stepping motors (16
bits each), and 10 valve controller set points (16 bits each)
- Data rate for communication is 1200bps.
- Communication efficiency is 40%.
Solution
Total Points is 920, therefore the total amount of data is 20 x
920 = 18,400bits and the data rate is 18,400b/1200bps =~
15sec at 100% efficiency but at 40% efficiency, the scan
interval is 15sec/0.4 =~ 38sec.

Dr. Mohammad H. Salah Page no. 149

 DCS

In a DCS, the data acquisition and control functions are
performed by a number of distributed microprocessor-based
units, situated near to the devices being controlled or, the
instrument from which data is being gathered.

DCS systems have evolved into providing very sophisticated
analogue (e.g. loop) control capability. A closely integrated
set of operator interfaces (or man machine interfaces) is
provided to allow for easy system configurations and
operator control. The data highway is normally capable of
high speeds - typically 1 Mbps up to 10 Mbps.

DCS

Dr. Mohammad H. Salah Page no. 150

 DCS

The PLC is still one of the

most widely used control
systems in industry. As
needs grew to monitor
and control more devices
in the plant, the PLCs
were distributed and the
systems became more
intelligent and smaller in
size. PLCs and DCS are
used as shown

Remote Terminal Units (RTUs)

RTU (sometimes referred to as a remote telemetry unit) as
the title implies, is a microprocessor controlled electronic
device which interfaces objects in the physical world to a
distributed control system (DCS) or SCADA system by
transmitting telemetry data to the system and/or altering
the state of connected objects based on control messages
received from the system

RTU is a standalone data acquisition and control unit,
generally microprocessor based, which monitors and
controls equipment at some remote location from the
central station.

Its primary task is to control and acquire data from process
equipment at the remote location and to transfer this data
back to a central station.

Dr. Mohammad H. Salah Page no. 151

 Remote Terminal Units (RTUs)

It generally also has the facility for having its configuration
and control programs dynamically downloaded from some
central station.

There is also a facility to be configured locally by some RTU
programming unit.

Remote Terminal Units (RTUs)

Although traditionally the RTU communicates back to some
central station, it is also possible to communicate on a peer-
to-peer basis with other RTUs.

The RTU can also act as a relay station (sometimes referred
to as a store and forward station) to another RTU, which
may not be accessible from the central station.

Small sized RTUs generally have less than 10 to 20 analog
and digital signals, medium sized RTUs have 100 digital and
30 to 40 analog inputs.

RTUs, having a capacity greater than this can be classified as
large.

Dr. Mohammad H. Salah Page no. 152

 Remote Terminal Units (RTUs)

RTU is a device installed at a remote location that:
1. Collects data
2. Codes data into a format that is transmittable
3. Transmits the data back to a central station (master)
4. Collects information from the master device and
implements processes that are directed by the master

RTU is equipped with input channels for sensing and output
channels for control or alarms and communications port.

RTU - Types

There are two basic types of RTU
1. The “single board RTU” which is compact, and contains all
I/O on a single board
2. The “modular RTU” which has a separate CPU module, and
can have other modules added, normally by plugging into a
common “backplane” (a bit like a PC motherboard and plug in
peripheral cards).

The single board RTU normally has fixed I/O (e.g., 16 digital
inputs, 8 digital outputs, 8 analogue inputs, and say 4 analogue
outputs). It is normally not possible to expand its capability.

The modular RTU is designed to be expanded by adding
additional modules. Typical modules may be a 8 analog in
module, a 8 digital out module. Some specialized modules such
as a GPS time stamp module may be available.

Dr. Mohammad H. Salah Page no. 153

 RTU - Sizes

Tiny stand-alone systems that run off batteries for an entire
year or more. These systems log data into EPROM or FLASH
ROM and download data when physically accessed by an
operator. Often these systems use single chip processors with
minimal memory and might not be able to handle a
sophisticated communications protocol.

Small stand-alone systems that can power up periodically and
apply power to sensors (or radios) to measure and/or report.
Usually run off batteries that are maintained by solar energy.
The batteries are large enough to maintain operation for at
least 4 months during the darkness of the winter in the far
northern hemisphere. These systems generally have enough
capability for a much more complex communications scheme.

RTU - Sizes

Medium Systems that are dedicated single board industrial
computers, including IBM-PC or compatible computers
either in desk-top enclosures or industrial configurations
such as VME, MultiBus, STD bus, PC104, etc….

Large Systems for complete Plant control with all the bells
and whistles. These are usually in Distributed Control
Systems (DCSs) in Plants, and often communicate over high
speed LANs. Timing may be very critical.

Dr. Mohammad H. Salah Page no. 154

 RTU – Architecture and Communications

The SCADA RTU has the following hardware features:

1. CPU and volatile memory
2. Non volatile memory for storing programs and data
3. Communications capability either through serial port(s)
or sometimes with an on board modem
4. Secure Power supply (with battery backup)
5. Watchdog timer (to ensure the RTU restarts if something
fails)
6. Electrical protection against "spikes"
7. I/O interfaces to DI/DO/AI/AO's
8. Real time clock

RTU – Architecture and Communications

Dr. Mohammad H. Salah Page no. 155

 RTU – Architecture and Communications

RTU monitors the field digital and analog parameters and
transmits all the data to the Central Monitoring Station.

RTU can be interfaced with the Central Station with
different communication media (usually serial (RS232,
RS485, RS422) or Ethernet)

RTU can support standard protocols (Modbus, DNP3,
ICCP…etc.) to interface any third party software.

In some control application, RTU drives high current
capacity relays to a digital output board to switch power on
and off the devices in the field

RTU – Architecture and Communications

RTU can monitor Analog inputs that can be of different
types like (4 to 20mA), (0 to 10V), (-2.5 to 2.5V), (1 to
5V)…etc

RTU then translates this raw data into the appropriate units
(e.g., gallons of water or temperature) before presenting
the data to the user via the Human Computer Interface (HCI)
or Man-Machine Interface (MMI)

Dr. Mohammad H. Salah Page no. 156

 RTU – Applications

Oil and Gas remote instrumentation monitoring, (offshore
platforms, onshore oilwells)

Networks of remote pump stations

Hydro-graphic monitoring and control, (water supply,
reservoirs, sewerage systems).

Environmental monitoring systems (pollution, air quality,
emissions monitoring).

Minesite monitoring applications.

Protection supervision and data logging of Power
transmission network

Air traffic equipments such as navigation aids.

RTU – Comparison

A PLC is a small industrial computer which originally replaced
relay logic. It had inputs and outputs similar to those an RTU
has.

It contained a program which executed a loop, scanning the
inputs and taking actions based on these inputs.

Originally the PLC had no communications capability, but they
began to be used in situations where communications was a
desirable feature.

So communications modules were developed for PLC's,
supporting ethernet (for use in DCSs) and the Modbus
communications protocol for use over dedicated (wire) links.

As time goes on we will see PLC's support more sophisticated
communications protocols.

Dr. Mohammad H. Salah Page no. 157

 RTU – Comparison

RTU's have always been used in situations where the
communications are more difficult, and the RTU's strength
was its ability to handle difficult communications.

RTU's originally had poor programmability in comparison to
PLC's. As time has gone on, the programmability of the RTU
has increased.

We are seeing the merging of RTU's and PLC's, but it will be
a long time (if ever) before the distinction disappears..

RTUs, PLCs and DCS are increasingly beginning to overlap in
responsibilities, and many vendors sell RTUs with PLC-like
features and vice versa. The industry has standardized for
creating programs to run on RTUs and PLCs

RTU – Comparison

RTU differs from a PLC in that RTUs are more suitable for
wide geographical telemetry, often using wireless
communications, while PLCs are more suitable for local area
control (plants, production lines, etc.) where the system
utilizes physical media for control

Some vendors now supply RTUs with comprehensive

functionality pre-defined, sometimes with PLC extensions
and/or interfaces for configuration

Some suppliers of RTUs have created simple Graphical User

Interfaces (GUI) to enable customers to configure their
RTUs easily

Dr. Mohammad H. Salah Page no. 158

 Telemetry

Telemetry refers to the transfer of remote measurement
data to a central control station over a communications link.

This measurement data is normally collected in real-time

(but not necessarily transferred in real-time).

The terms SCADA, DCS, PLC and smart instrument are all
applications of the telemetry concept.

Modems

The telephone system, landline communication systems, and
radio systems cannot directly transport digital information
without some distortion in the signal due to the bandwidth
limitation inherent in the connecting medium.

A conversion device, called a modem (modulator/demodulator),
is thus required to convert the digital signals into an analog form
suitable for transmission over a telephone network.

This converts the digital signals generated by a computer into an
analog form suitable for long distance transmission over the
cable or radio system.

The demodulation portion of the modem receives this analog
information and converts it back into the original digital
information generated by the transmitting computer.

Dr. Mohammad H. Salah Page no. 159

 Modems

Modems - Types
There are two types of modem available today:

Dumb (or non-intelligent) modems depend on the

computer to which they are connected, to instruct the
modem when to perform most of the tasks such as
answering the telephone.

Smart modems have an on-board microprocessor enabling

them to perform such functions as automatic dialing and
the method of modulation to use.

Dr. Mohammad H. Salah Page no. 160

 Modems – Communication Protocols

Modems can be either synchronous or asynchronous.

In asynchronous communications each character is
encoded with a start bit at the beginning of the character
bit stream and a parity and stop bit at the end of the
character bit stream.

The receiver then synchronizes with each character
received by looking out for the start bit.

Once the character has been received, the communications
link returns to the idle state and the receiver watches out
for the next start bit (indicating the arrival of the next
character).

Modems

Dr. Mohammad H. Salah Page no. 161

 Modems

Synchronous communication relies on all characters being sent in
a continuous bit stream.

The first few bytes in the message contain synchronization data
allowing the receiver to synchronize onto the incoming bit
stream.

Hereafter synchronization is maintained by a timing signal or
clock.

The receiver follows the incoming bit stream and maintains a
close synchronization between the transmitter clock and receiver
clock.

Synchronous communications provides for far higher speeds of
transmission of data, but is avoided in many systems because of
the greater technical complexity of the communications
hardware.

Modems

Dr. Mohammad H. Salah Page no. 162

 Modems – Modes of Operation
Modems can operate in three modes:

Simplex

Half-Duplex

Full-Duplex

A simplex system in data communications is one that is

designed for sending messages in one direction only and
has no provision for sending data in the reverse direction.

Modems – Modes of Operation

A duplex system in data communications is one that is designed
for sending messages in both directions.

Duplex systems are said to be half-duplex when messages and
data can flow in both directions but only in one direction at a
time.

Duplex systems are said to be full-duplex when messages can
flow in both directions simultaneously.

Full-duplex is more efficient, but requires a communication
capacity of at least twice that of half-duplex.

Dr. Mohammad H. Salah Page no. 163

 Modems – Interface Standards

RS-232, RS-422 and RS-485 standards form the key element in
transferring digital information between the RTUs (or operator
terminals), and the modems, which convert the digital information
to the appropriate analog, form suitable for transmission over
greater distances.

The RS-232 standard was initially designed to connect digital
computer equipment to a modem where the data would then be
converted into an analog form suitable for transmission over greater
distances.

The RS-422 and RS-485 standards can perform the same function
but also have the ability of being able to transfer digital data over
distances of over 1200 m.

The most popular (but probably technically the most inferior
(poorer)) of the RS standards is the RS-232C standard.

Modems – RS232C Interface Standard

The RS-232 interface standard was developed to interface
between data terminal equipment (DTE) and data
communications equipment (DCE) employing serial binary
data interchange.

The EIA-RS-232 standard consists of 3 major parts, which
define:
- Electrical signal characteristics
- Interface mechanical characteristics
- Functional description of the interchange circuits

Dr. Mohammad H. Salah Page no. 164

 Modems – RS232C Interface Standard

Electrical signal characteristics: Electrical signals such as the
voltage levels and grounding characteristics of the interchange
signals and associated circuitry.

Interface mechanical characteristics: It dictates that the
interface must consist of a ‘plug’ and Modems 183 ‘receptacle’
(socket) and that the receptacle will be on the DCE. In RS-232-
C, the pin number assignments are specified but, originally,
the type of connector was not.

Functional description of the interchange circuits
This defines the function of the data, timing, and control
signals used at the interface between DTE and DCE.

Modems – RS232 Limitations

The restriction of point-to-point communications is a drawback
when many devices have to be multi-dropped together.

The distance limitation (typically 15 meters) is a limitation when
distances of 1000m are needed.

The 20 kbps baud rate is too slow for many applications.

The voltages of –3 to –25 volts and +3 to +25 volts are not
compatible with many modern power supplies (in computers) of
+5 and +12 volt.

The standard is an example of an unbalanced standard with high
noise susceptibility.

Two approaches to deal with the limitations of RS-232 are the

RS-422 and RS-485 standards.

Dr. Mohammad H. Salah Page no. 165

 Modems – RS422 Interface Standard

The RS-422 standard introduced in the early 70s defines a
differential data communications interface using two
separate wires for each signal

This permits very high data rates and minimizes problems
with varying ground potential because the ground is not
used as a voltage reference (in contrast to RS-232) and
allows reliable serial data communication for:
- Distances of up to 1200 m
- Data rates of up to 10 Mbps
- Only one line driver is permitted on a line
- Up to 10 line receivers can be driven by one line driver

Modems – RS422 Interface Standard

The line voltages range between –2 V to –6 V for Logic 1 and +2 V to +6
V for Logic 0 (using terminals A and B as reference points). The line
driver for the RS-422 interface produces a ±5 V differential voltage on
two wires.

The two signaling states of the line are defined as follows:
- When the ‘A’ terminal of the driver is negative with respect to the ‘B’
terminal, the line is in a binary 1 (Mark or Off) state.
- When the ‘A’ terminal of the driver is positive with respect to the ‘B’
terminal, the line is in a binary 0 (Space or On) state.

Dr. Mohammad H. Salah Page no. 166

 Modems – RS422 Interface Standard

The differential voltage signal is the major feature of the RS-
422 standard, which allows an increase in speed and
provides higher noise immunity.

Each signal is transferred on one pair of wires and is the
voltage difference between them.

A common ground wire is preferred to aid noise rejection.

Consequently, for a full-duplex system, five wires are
required (with 3 wires for half-duplex systems).

The RS-422 standard does not specify the mechanical
connections or assign pin numbers and leaves this aspect
optional.

Modems – RS485 Interface Standard

The RS-485 standard is the most adaptable and flexible.

It is an expansion of RS-422 and allows the same distance
and data speed but increases the number of transmitters
and receivers permitted on the line.

RS-485 permits multi-drop network connection on two
wires and provides for reliable serial data communication
for:
- Distances of up to 1200 m (same as RS-422)
- Data rates of up to 10 Mbps (same as RS-422)
- Up to 32 line drivers permitted on the same line
- Up to 32 line receivers permitted on the same line

Dr. Mohammad H. Salah Page no. 167

 Modems – RS485 Interface Standard

The line voltages are similar to RS-422 ranging between –1.5V to
–6V for logic ‘1’ and +1.5V to +6V for Logic ‘0’.

As with RS-422, the line driver for the RS-485 interface produces
a 5 volt differential voltage on two wires. For full-duplex systems,
five wires are required.

For a half-duplex system, only three wires are required.

The major enhancement of RS-485 is that a line driver can
operate in three states (called tri-state operation) logic ‘0’, logic
‘1’ and ‘high-impedance’, where it draws virtually no current and
appears not to be present on the line.

This latter state is known as the ‘disabled’ state and can be
initiated by a signal on a control pin on the line driver integrated
circuit.

Modems – RS485 Interface Standard

The RS-485 interface standard is useful where distance and
connection of multiple devices on the same pair of lines is
desirable.

Special care must be taken with the software to coordinate which
devices on the network can become active.

In most cases, a master terminal, such as a PLC or computer,
controls which transmitter/receiver will be active at any one
time.

Dr. Mohammad H. Salah Page no. 168

 SCADA Examples – Water Treatment

SCADA Examples – Wind Farms 1

Dr. Mohammad H. Salah Page no. 169

 SCADA Examples – Wind Farms 2

SCADA Examples – Cement Mill

Dr. Mohammad H. Salah Page no. 170

 SCADA Examples – Level Control

Dr. Mohammad H. Salah Page no. 171