Plc scada for automation process control

PLC & SCADA for

Automation & Process

Control

Dr. Mohammad H. Salah

Introduction to

Control Strategies

Outlines

� Control Systems

� Continuous Control Systems

� Sequential (Logic) Control Systems

� Synchronous Control Systems

� Asynchronous Control Systems

� Mixed Synchronous/Asynchronous Control Systems

� Implementation of Synchronous Control Systems

� Relay Control systems

Dr. Mohammad H. Salah Page no. 1

Control Systems

� Any process contains the application (operative part) and control

system (active coordinator).

� The best way to describe a control system is to use a block

diagram.

� All control systems have, at least, three parts to them;

� An INPUT that takes information into the control system,

� A PROCESS that uses the input information to create the

output information,

� An OUTPUT that passes information out of the control system.

Control Systems - Inputs

� Input signals are provided by transducers / detectors that convert

physical quantities into electrical signals.

� Depending on transducer used, the information detected can be

discontinues (binary) or continuous (analog) representation of the

input quantity.Transducers Measured Quantity Output Quantity

Switch

Limit Switch

Thermostat

Thermistor

Strain Gauge

Photo Cell

Proximity Cell

Thermocouple

Movement / Position

Temperature

Pressure / Movement

Light

Presence of Objects

Movement / Position

Temperature

Temperature

Binary Voltage

Binary Voltage

Varying Voltage

Varying Voltage

Varying Voltage

Varying Resistance

Varying Resistance

Varying Resistance


Control Systems - Outputs

� Output devices (like relays, pumps, motors..) are tools used by a

control system to alter certain key element or quantities within the

process.they are also transducers but contrary signals from the

control system into other necessary. There are also discontinuous

(binary) or continuous (analog) devices

Motor

Pump

Solenoid

Heater

Valve

Relay

Piston

Rational motion

Heat

Orifice variation

Elec. Switching / limited physical movement

Rational motion + product displacement

Linear motion / pressure

Linear motion / pressure

Electrical

Electrical

Electrical/Hydraulic/pneumatic

Hydraulic / pneumatic

Electrical

Electrical

Electrical

Output Device Quantity Produced Input

Control Systems

� The heater is an Open Loop control system.

� In this system the information from the output is not sent back to the

input.

� However the room gets hot, the heater keeps producing heat until

someone switches it off.

� If the heater had a thermostat, it would switch off by itself when the

room reached a set temperature (the ‘input’ to the system).

� In this case information from the output of the system (heat) has

been fed back to the input.


Control Systems

� The control system is now a Closed Loop system.

Information from the output goes back to the input in a

Feedback loop.

� The comparison block of the system is normally represented

by the special symbol:

� This shows the place of the heater thermostat in the control

system.

� It compares the set temperature with the actual

temperature.

Control Systems

� A difference between these two temperatures is an error.

� When the control system detects an error, it tries to make itsmaller by changing the output.

� This system now has all the basic elements of any controlsystem:

� A demand - this is the set temperature shown above.

� A sensor to measure the output - a temperature sensor.This is part of the thermostat

� A controller - the thermostat

� An actuator - the heater


Control Systems

Remember:

� A sensor is a device that converts a physical signal (such asheat, light, sound or movement) into an electrical signal.

� An actuator is a device that converts an electrical signal intoa physical signal (such as heat, light, sound or movement).

� Actuators and sensors are both devices that change one kindof signal into a different kind of signal.

Control Systems

� The controller should be designed with some objective inmind.

� Typical objectives are:

� fastest response - reach the setpoint as fast as possible(e.g., hard drive speed)

� smooth response - reduce acceleration and jerks (e.g.,elevators)

� energy efficient - minimize energy usage (e.g., industrialoven)

� noise immunity - ignores disturbances in the system (e.g.,variable wind gusts)


Continuous Control Systems

� Continuous processes require continuous sensors and/or

actuators.

� In continuous control systems the inputs are sending information

into the system all the time and the outputs of the system are

being controlled all the time.

� A change to the input leads directly to a change in the output.

� An example of this kind of system is a security floodlight that

comes on in the dark; the level of light reaching the light sensor is

continually controlling whether or not the lamp is on.


� Another example is filling a washing machine with water uses acontinuous control system that monitors the water level andcontrols the water input valves.

� Continuous control systems typically need a target value, this iscalled a setpoint



� Water Tank Level Control

Sequential Control Systems

� In a sequential control system a series of different events

takes place one after the other.

� The finishing of one event in the sequence provides the

signal for the next event to start.

� Examples of sequential systems are:

� the timers that control central heating systems.

�washing machines.

� traffic lights.

� lifts in buildings.


Sequential Control Systems

� Sometimes one of the events in the sequence is itself a

continuous control system.

� However this is only one event in the series of events that

makes up the complete sequential control system for the

washing machine

Synchronous Control

� In a fully synchronous control system all of the events in thesequence take place at set points in time, regardless of anyexternal change.

� Synchronous control systems are used where the control ofa sequence of events must take place at pre-set timeintervals.

� Such a system doesn’t take any account of events outside it,only the time between events is important.

� Therefore it doesn’t need any sensors; it is an open loopcontrol system.

� Central heating timers are synchronous controllers; thepoints at which the heating and hot water systems areturned on and off are fixed in time.


Synchronous Control

� Once the heating or hot water is turned on, that part of thesequence is usually a continuous system; temperature iscontinuouslymonitored to control the heating system.

Asynchronous Control

� In an asynchronous control system all of the events in thesequence take place as a result either due to an externalevent or because the previous event has finished,regardless of the time taken.

� Asynchronous control systems are used where the timetaken for a sequence to occur is unimportant.

� Each event happens as soon as the previous event is finishedor when something outside the system happens; suchsystems require sensors to detect the completion of anevent or an outside event and so must be closed loop.


Asynchronous Control

� The control system for a lift is asynchronous; the sequenceof events depends entirely on external events (peoplepressing the call buttons outside the lift, and the floorbuttons inside it) or the completion of lift movements (thelift stops moving, and the doors are opened, when a switchdetects that a floor has been reached).

Mixed Syn./Asyn. Control Systems

� In most real sequential control systems there is a mixture ofsynchronous and asynchronous control

� Many modern traffic light sets have pedestrian crossing lights orsensors in the road to detect the presence of cars. These affectthe timing of the sequence of lights making the mainlysynchronous system mixed.

� In a lift automatic doors often stay open for a fixed time. Thismakes a mainly asynchronous system mixed.

� The following is a list of some devices that use sequential controlsystems:

1. A security gate.

2. A dishwasher

3. A time lock on a bank’s safe.

4. A robot arm welding parts of a car together


Mixed Syn./Asyn. Control Systems

For each system;

� Draw a block diagram showing the sequence of events in thesystem.

� Write down whether you think it is synchronous,asynchronous or mixed.

� Explain your answer.

� If you think a system is asynchronous, explain how you thinkeach step in the sequence is triggered.

� If you think it is a mixed system, describe which parts youthink are synchronous and which asynchronous.

Implementation of Syn. Control Sys.

� The heart of a synchronous control system is some kind oftimer.

� This can be mechanical or electronic.

� The timer also needs:

� A sequencing element; this sets the times that outputsare switched on and off. Remember that there are noexternal inputs into a synchronous timer.

� An output stage that provides the start and stop signals.



Mechanical Systems

� All mechanical timers are different kinds of cam timer.

� Here a motor turning at a constant speed is used to turn lotsof cams.

� As the cams turn they push on switches to turn them on oroff.

� Central heating and washing machine timers always used tobe made from cam timers.

� In industry too, cam timers havebeen used widely - though they arebeing rapidly replaced by electronictimers these days.


Electronic Systems

� There are a number of different electronic systems that canbe used.

� A dedicated circuit uses an oscillator to give electronic clockpulses.

� Further circuitry, often involving the use of logic gates, isthen used to control a sequence of switching.

� Programmable Logic Controllers (PLCs) are commonly usedin industry.

� A PLC contains the same kind of microprocessor as acomputer.

� However it is designed to be used in an industrial setting sois very robust.



Electronic Systems

� The timing sequence can be programmed either through acomputer or with a small, hand held, programmer.

� PLCs are replacing cam timers in most places in industry.


Electronic Systems

� An important thing to note about these electronic systems isthat they all use low voltages and currents.

� They also need to be able switch powerful outputs.

� So they will need some kind of output interface that protectsthe circuit and provides power.

� Relays are very often used for this.


Relay Control Systems

� The relay based systems are control systems that use relays

or contactors or both to operate the system actuators

sequentially and they are usually electromechanical devices

(some are solid state relays).

Relay Control Systems

� Contactor can handle higher load currents than relays.

� The behavior of a relay or a

contactor (electromechanical

devices) exhibits nonlinearity in

operation


Relay Control Sys. - Features

� Group of relays with large number of contacts

� Space required

� Fixed application

� Simple control tasks

� Difficult expansion and/ or modification

� Slow action (except for solid state relays)

BUT

Relays continue to be used as output devices being ideal

for the conversion of small signals to higher current /

voltage driving signal.

Relay Ladder Logic Control

� Logic control is used with relatively simple ON/OFF systems -

like pneumatics

Pneumatic System

Relay Ladder Logic

Control



Normally Open Schematic

Normally Closed Schematic


Output Schematic



Why is it called “Logic Control”?


Write the logic for this rung.


Transducer

A transducer is any device that converts energy from

one form to another.

Input transducer

(microphone) converts

sound energy to electric

energy

Output transducer

(speaker) converts

electric energy to sound

energy

Amplifier

Sensors

Sensors are input transducers used for detecting and

often measuring the magnitude of something. They

convert mechanical, magnetic, thermal, optical, and

chemical variations into electric voltages and currents.

Photoelectric

sensor


Sensors

Sensors provide the equivalent of eyes, ears, nose,

and tongue to the microprocessor brain.

Microprocessor

Optical

sensor

Gas

sensor

Microphone

Probe

Proximity Sensor

Proximity sensors or switches detect the presence of

an object without making physical contact with it.


Proximity Sensor Applications

The object being detected is too small, lightweight, or

soft to operate a mechanical switch.

Rapid response and high switching rates are required.

An object has to be sensed through nonmetallic barriers

such as glass, plastic, and paper cartons.

Hostile environments conditions exist.

Long life and reliable service are required.

A fast electronic control system requires a bounce-free

input signal.

Inductive Proximity Sensor Operation

Barrel type

Block diagram

As the target

moves into the

sensing area,

the sensor

switches

the output ON


Proximity Sensor Connections

The method of connecting and exciting a proximity

sensor varies with the type of sensor and its

application.

TargetL1 L2

Load

Two-wire sensor connection


Load is connected

between the

sensor and ground

Current-sourcing output (PNP)

Load

Sensor

Control

output



Load is connected

between the positive

supply and sensor

Current-sinking output (NPN)

Load

Sensor

Control

output

Proximity Sensor Connection To Input Module

Proximity

sensor

Input

module

L1 L2

Bleeder resistor

The use of a bleeder

resistor allows enough

current for the sensor

to operate but not

enough to turn on the

input of the PLC

A proximity sensor should

be powered continuously


Capacitive Proximity Sensor

A capacitive proximity sensor can be actuated by both

conductive and nonconductive material such as wood,

plastics, liquids, sugar flour and wheat.

Operation is similar to that of inductive

proximity sensor. Instead of a coil, the

active face of the sensor is formed by

two metallic electrodes – rather like an

"opened capacitor".

Magnetic Switch (Reed Switch)

A magnetic switch (also called

a reed switch) is composed of

flat contact tabs that are

hermetically sealed (air-tight).

Common

NO

NC

The switch is

actuated by a

magnet.

Magnet

N S


Reed Switch Activation

Magnet

Reed switch

Proximity motion – movement

of the switch or magnet will

activate the switch

Rotary motion – switch is

actuated twice for every

complete revolution

Shielding – the shield

short circuits the magnetic

field; switch is activated

by removal of the shield

Photovoltaic Or Solar Cell

The photovoltaic cell, or solar cell, is a

common light-sensor device that

converts light energy directly into

electric energy.

Solar cell

The solar cell converts light

impulses directly into electrical

charges which can easily be

amplified to provide an input

signal to a PLC.


Photoconductive Or Photoresistive Cell

The photoconductive cell, or

photoresistive cell, is is another

popular type of light transducer.

Light energy falling on this device

will cause a change in the

resistance of the cell.

20 Ohms Light resistance

5,000 Ohms Dark resistance

Ohms

Photoelectric Sensor Operation

Most industrial photoelectric sensors use a light-emitting

diode (LED) for the light source and a phototransistor to

sense the presence or absence of light.

Object

to be

sensed

Light detector

Light source

Light from the LED falls

on the input of the

phototransistor and the

amount of conduction

through the transistor

changes. Analog

outputs provide an

output proportional to

the quantity of light

seen by the

photodetector.


Reflective Photoelectric Sensor

Emits a light beam (visible,

infrared, or laser) from its light

emitting element and detects

the light being reflected.

Retro-reflective type

Operating

range

Reflector

Operating

range

Diffused-reflective type

Emitter/receiver

Target

Through-Beam Type Photoelectric Sensor

A through-beam photoelectric

sensor is used to measure the

change in light quantity caused

by the target's crossing the

optical axis.

Operating

range

Target

Emitter Receiver


Bar Code Systems

Bar code systems can be used to

enter data much more quickly

than manual methods, and are

highly accurate.

Scanner

Decoder

PLC

Diverter

The decoder receives the

signal from the scanner

and converts these data

into the character data

representation of the

symbol's code.

Ultrasonic Sensor

An ultrasonic sensor operates by

sending sound waves towards the

target and measuring the time it

takes for the pulses to bounce back.

The returning echo signal

is electronically converted

to a 4 mA to 20 mA output,

which supplies flow rate to

external control devices.


Strain/Weight Sensors

A strain gauge transducer converts

a mechanical strain into an electric

signal.

ForceWire type The force applied to the gauge causes the

gauge to bend. This bending action also

distorts the physical size of the gauge,

which in turn changes its resistance.

The load cell provides

sensor input to the

controller, which

displays the weight

and controls the

hopper chute.

Load cell

Controller

Hopper

ChuteON/OFF

Control

Temperature Sensors

Temperature sensors convert heat into an electric

signal. There are four basic types used: thermocouple,

resistance temperature detector (RTD), thermistor, and

IC sensor.

The thermocouple consists of a pair

of dissimilar conductors fused

together at one end to form the

"hot" or measuring junction, with the

free ends available for connection to

the "cold" reference junction. A

temperature difference between the

measuring and reference junction

generates a small DC signal voltage.


Temperature Sensors




IC sensor.

The resistance temperature

detector (RTD) varies in resistance

value with changes in temperature.

RTD

Temperature Sensors




IC sensor.

The thermistor varies in

resistance value with

changes in temperature


Temperature Sensors




IC sensor.

The Integrated Circuit (IC) temperature

sensor produces changes in voltage or

current with changes in temperature.

Flow Measurement

The usual approach used in

measuring fluid flow is to

convert the kinetic energy that

the fluid has into some other

measurable form.

Flow Magnet

Turbine

Turbine Flow Meter

Coil

The turbine blades turn at

a rate proportional to the

fluid velocity and are

magnetized to induce

voltage pulses coil.


Flow Measurement

The usual approach used in

measuring fluid flow is to

convert the kinetic energy that

the fluid has into some other

measurable form.

Electronic Magnetic

Flow MeterCan be used with electrically

conducting fluids and offers no

restriction to flow. A coil in the

unit sets up a magnetic field. If

a conductive liquid flows

through this magnetic field, a

voltage is induced and sensed

by two electrodes.

Velocity/RPM Sensors

A tachometer is a small permanent

magnet DC generator which when

rotated produces a voltage that is

directly proportional to the speed at

which it is driven.

Controller

Tach

Motor

M

Tachometers coupled

to motors are

commonly used in

motor speed control

applications to provide

a feedback voltage to

the controller that is

proportional to motor

speed.


Velocity/RPM Sensors

The rotating speed of a

shaft is often measured

using a magnetic (inductive)

pickup sensor.

0 V

Pickup coil Pole piece

N S

MagnetSensor

output

A magnet is attached to the shaft. A

small coil of wire held near the

magnet receives a pulse each time

the magnet passes. By measuring

the frequency of the pulses, the

shaft speed can be determined.

Output Control Devices

A variety of output control devices can be operated by the

controller output module to control traditional processes.

These include:

Pilot light

Solenoid Solenoid

valveControl

relay

Alarm

HeaterMotor starter Small motor


Actuators

An actuator is any device that converts an electrical

signal into mechanical movement. The principle types

of actuators are relays, solenoids, and motors.

AIR

Coil

Plunger

Solenoid Symbol The solenoid converts

electric current into

linear motion.

Solenoid Valve

A solenoid valve is a combination of:

� a solenoid with its core or plunger

� a valve body containing an orifice

in which a disc or plug is positioned

to restrict or allow flow

SOL A

Forward motion of piston

Directional

solenoid

valve

FWD

CR

CR

SOL A

When SOL A is energized, the valve

spool is shifted to redirect the fluid

and move the cylinder forward


Stepper Motor

A stepper motor converts electrical

pulses applied to it into discrete

rotor movements called steps. They

are used to provide precise position

control of movement.

ModuleStepper-motor

translator

Step

motor

Stepper motor control system

Communicates

with the PLC and

responds with

pulse trains

Enables control

of the stepper motor The motor will move

one step for each pulse

received

PLC Control of a Large Motor Load

When a PLC needs to

control a large motor, it

must work in

conjunction with a

starter.

Motor starters are

available in various

standard National Electric

manufacturers (NEMA)

sizes and ratings.


Programmable Logic

Controller

Outlines

� Introduction

� Advantages of PLC Control Systems

� PLC Versus Other Types of Control

� Typical Areas of PLC Applications

� PLC Product Application Ranges

� Structure and Hardware

� PLC Scan Process

� PLC Programming

� Modes of Operation

� PLC and Networks


Introduction

� A programmable logic controller (PLC) is a specialized

computer used to control machines and process.

� PLC uses a programmable memory to store instructions and

execute specific functions that include On/Off control,

timing, counting, sequencing, arithmetic, and data handling.

� The word Programmable differentiates it from the

conventional hard-wired relay logic.

Introduction

PLCs are used in both SCADA and DCS systems as the control

components of an overall hierarchical system to provide local

management of processes through feedback control


Introduction

� Using a PLC requiressetting up the hardwareand software

� The hardware installationconsists of wiring the PLCto all switches andsensors of the systemand to such outputdevices as relay coils,indicator lamps, or smallmotors

Introduction

� The control program is usually developed on a PC, usingsoftware provided by the PLC manufacturer

� This software allows the user to develop the controlprogram on the monitor screen

� Once the program is complete, it is automaticallyconverted into instructions for the PLC processor

� The completed program is then downloaded into the PLC

� Once the program is in the PLC’s memory, theprogramming terminal can be disconnected, and the PLCwill continue to function on its own


Advantages of PLC Control Sys.

� Eliminates much of the hard wiring that was associatedwith conventional relay control circuits: The PLC alsosurpassed the hazard of changing the wiring.

The program takes the place ofthe external wiring that would berequired to control the process


� Increased Reliability: Once a program has been written and

tested, it can be downloaded to other PLCs.

Since all thelogic is contained

in the PLC’smemory, there is

no chance ofmaking a logic

wiring error.



� Faster Response Time: PLCs operate in real-time which

means that an event taking place in the field will result in an

operation or output taking place.

Machines thatprocess thousands ofitems per second andobjects that spend only afraction of a second infront of a sensor requirethe PLC’s quick responsecapability.


� More Flexibility: Original equipment manufacturers (OEMs)

can provide system updates for a process by simply sending

out a new program.

It is easier tocreate and change aprogram in a PLC thanto wire and rewire acircuit. End-users canmodify the program inthe field.



� Lower Cost: Originally PLCs were designed to replace relay

logic control. The cost savings using PLCs have been so

significant that relay control is becoming obsolete, except

for power applications.

Generally, if anapplication requiresmore than about 6control relays, it willusually be lessexpensive to install aPLC.


� Communication Capabilities: PLC can communicate with

other controllers or computer equipment.

They can benetworked to performsuch functions as:supervisory control, datagathering, monitoringdevices and processparameters, anddownloading anduploading of programs.



� Easier to Troubleshoot: PLCs have resident diagnostic and

override functions that allows users to easily trace and

correct software and hardware problems.

Thecontrol programcan be watchedin real-time as itexecutes to findand fix problems


� PLCs can work with the help of the HMI (Human-Machine

Interface) computer

HMI


PLC Versus Other Types of Control

PLCs Versus Relay Control

� Today’s demand for high quality and productivity can hardly

be fulfilled economically without electronic control

equipment.

� With rapid technology developments and increasing

competition, the cost of programmable controls has been

driven down to the point where a PLC-versus-relay cost

study is no longer necessary or valid.

� When deciding whether to use a PLC-based system or a

hardwired relay system, the designer must ask several

questions. Some of these questions are:



� Is there a need for flexibility in control logic changes?

� Is there a need for high reliability?

� Are space requirements important?

� Are increased capability and output required?

� Are there data collection requirements?

� Will there be frequent control logic changes?

� Will there be a need for rapid modification?

� Must similar control logic be used on different machines?

� Is there a need for future growth?

� What are the overall costs?




� Even in a case where no flexibility or future expansion is

required, a large system can benefit tremendously from the

troubleshooting and maintenance aids provided by a PLC.

� The extremely short cycle (scan) time of a PLC allows the

productivity of machines that were previously under

electromechanical control to increase considerably.

� Also, although relay control may cost less initially, this

advantage is lost if production downtime due to failures is

high.





PLCs Versus Computer Control

� Unlike computers, PLCs are specifically designed to survive

the harsh conditions of the industrial environment.

� A well-designed PLC can be placed in an area with

substantial amounts of electrical noise, electromagnetic

interference, mechanical vibration, and non-condensing

humidity.

� PLC’s hardware and software are designed for easy use by

plant electricians and technicians.

� the software programming uses conventional relay ladder

symbols, or other easily learned languages, which are

familiar to plant personnel.



Typical Areas of PLC Applications

PLC Product Application Ranges

� The PLC market can be segmented into five groups:

1. Micro PLCs

2. Small PLCs

3. Medium PLCs

4. Large PLCs

5. Very large PLCs

The A, B, and Coverlapping areasreflect enhancements,by adding options, ofthe standard featuresof the PLCs within aparticular segment.


PLC Control of a Large Motor Load

When a PLC needs

to control a large

motor, it must work

in conjunction with a

starter.

Motor starters are

available in various

standard National

Electric manufacturers

(NEMA) sizes and

ratings.

Structure and Hardware

� Power Supply

� Processor (CPU)

� Memories

� Input/output modules

� Programming Port

� PLC Bus

� Expansion Models



� The PLC bus are the wires which contains the databus, address bus, and control signals. The processoruses the bus to communicate with the modules



Power Supply

� PLCs are usually powered directly from 120 or 240Vac

� The power supply converts the AC into DC voltages for the internal microprocessor components

� It may also provide the user with a source of reduced voltage to drive switches, small relays, indicator lamps, and the like


Processor (CPU)

� The processor is the brain of the

PLC

� The processor is a

microprocessor-based CPU and

is the part of the PLC that is

capable of reading and executing

the program instructions, one-

by-one (such as the rungs of a

ladder logic program)


ProcessorModule


Processor (CPU)

� A special program called the operating system controls

the actions of the CPU and consequently the execution

of the user’s program

� The operating system is supplied by the PLC

manufacturer and is permanently held in memory.

� A PLC operating system is designed to scan image

memory and the main memory which stores the ladder

diagram program


Memories

� The program memory receives and holds the downloadedprogram instructions from the programming device

� This memory is usually an EEPROM (electrically erasableprogrammable ROM) or a battery-backup RAM, both ofwhich are capable of retaining data

� Data memory is RAM memory used as a “scratch pad” bythe processor to temporarily store internal and externalprogram-generated data


� For example, it would store thepresent status of all switchesconnected to the input terminals andthe value of internal counters andtimers.


Memories


Input/Output Modules


� The I/O modules are interfaces to the outside world

� These control ports may be built into the PLC unit or, moretypically, are packaged as separate plug-in modules, where eachmodule contains a set of ports

� The most common type of I/O is called discrete I/O and dealswith on-off devices

� Analog I/O modules allow the PLC to handle analog signals




Fixed I/O configuration

� Is typical of small PLCs

� Comes in one package, withno separate removable units.

� The processor and I/O arepackaged together.

� Lower in cost – but lacksflexibility.



Modular I/O configuration

� When a module slides intothe rack, it makes anelectrical connection with aseries of contacts calledthe “backplane”.

� The backplane is located atthe rear of the rack.


Discrete Input Modules (DIM)


� DIM connect real-world

switches to the PLC and

are available for either

AC or DC voltages

(typically, 240 Vac, 120

Vac, 24 Vdc, and 5 Vdc)

� circuitry within the

module converts the

switched voltage into a

logic voltage for the

processor

Discrete Output Modules (DOM)


� DOM provide on-off signals to

drive lamps, relays, small

motors, motor starters, and

other devices

� Several types of output

� ports are available: Triac

outputs control AC devices,

transistor switches control DC

devices, and relays control AC

or DC devices (and provide

isolation as well)


Analog Input Modules (AIM)


� An analog input module has one or more ADCs (analog-to-

digital converters), allowing analog sensors, such as

temperature, to be connected directly to the PLC

� Depending on the module, the analog voltage or current is

converted into an 8-, 12-, or 16-bit digital word

Analog Output Modules (AOM)


� An analog output module contains one or more

DACs (digital-to-analog converters), allowing the PLC

to provide an analog output—for example, to drive a

DC motor at various voltage levels




Specialized modules that perform particular functions areavailable for many PLCs. Examples include:

� Thermocouple module — Interfaces a thermocouple to thePLC.

� Motion-control module — Runs independently to controlmuti-axis motion in a device such as a robot

� Communication module — Connects the PLC to anetwork

� High-speed counter module — Counts the number ofinput pulses for a fixed period of time

� PID module — An independently running PID self-contained controller (PID control can also be implementedwith software, as described later in this chapter)




Interpreting I/O Specificaions


Electrical:

� I/O Voltage Rating.

� I/O Current Rating.

� Input Threshold Voltage.

� Input Delay.

� Off-State Leakage Current.

� Output Power Rating.

� Surge Current (Max).

� Output On-Delay.

� Output Off-Delay.

� Digital Resolution.

Interpreting I/O Specificaions


Mechanical:

� Points Per Module.

� Wire Size.

Environmental:

� Ambient Temperature Rating.

� Humidity.


Programming Port and Device


� The programming port receives the downloaded program

from the programming device (usually a PC)



� The PLC does not have a front panel or a monitor; thus, to

“see” what the PLC is doing (for debugging or

troubleshooting), you must connect it to a PC




� A personal computer (PC) is the most commonly used

programming device.

� The computer monitor is used to display the logic on the

screen.

� The personal computer communicates with the PLC

processor via a serial or parallel data communications link.

� The software allows users to create, edit, document, store

and troubleshoot programs. If the programming unit is not

in use, it may be unplugged and removed. Removing the

programming unit will not affect the operation of the user

program.



� Hand-held programming devices are sometimes used to program

small PLCs.

� They are compact, inexpensive, and easy to use, but are not able

to display as much logic on screen as a computer monitor.

� Hand-held units are often used on the factory floor for

troubleshooting, modifying programs, and transferring programs

to multiple machines.


Expansion Modules


� Most PLCs are expandable

� Expansion modules contain additional inputs and outputs

� These are connected to the base unit using a ribbon

connector

BIG PICTURE


PLC Scan Process

PLC Scan Process


PLC Scan Process

PLC Scan Process

� The scan time is dependent on the clock frequency of the processor.

� Misunderstanding the way the PLC scans can cause programming

bugs!


PLC Scan Process

Data Flow Overview

PLC Scan Process


PLC Scan Process

PLC Programming

� The term PLC programming language refers to the method by

which the user communicates information to the PLC.

� A PLC program is not actually a wiring diagram but a way to

describe the logical relationship between inputs and outputs

� The PLC programming languages are:

– Sequential Control and State Graph (Graph)

– Sequential Function Chart (SFC)

– Structured Text (ST)

– Instruction List (IL)

– Function Block Diagram (FBD)

– Ladder Diagram (LD)

The most common is LD, FBD, and IL but the most use is the LD.


Sequential Functional Chart

PLC Programming

� Sequential functional chart, or SFC, is a graphical “language” that

provides a diagrammatic representation of control sequences in a

program.

� Basically, sequential function chart is a flowchart-like framework

that can organize the subprograms or subroutines (programmed

in LD, FBD, IL, and/or ST) that form the control program.

� SFC is particularly useful for sequential control operations, where

a program flows from one step to another once a condition has

been satisfied (TRUE or FALSE).

� The SFC programming framework contains three main elements

that organize the control program: steps, transitions, and

actions.


PLC Programming



PLC Programming

Structured Text

PLC Programming


Instruction List

PLC Programming

Function Block Diagram

PLC Programming


Ladder Diagram

PLC Programming

Ladder Diagram

PLC Programming

� A LAD (special kind of wiring diagram) was developed to

document electromechanical control circuits.

� Ladder diagram programs are highly symbolic and are the

result of years of evolution of industrial control circuit

diagrams

� This type of diagram has two vertical wires (rails) on either

side of the drawing to supply the power

� Each rung of the ladder diagram connects from one rail to

the other and is a separate circuit, which typically consists

of some combination of switches, relay contacts, relay coils,

and motors

� It is common for the coil of a relay to be in one rung and the

contacts to be in another


Ladder Diagram

PLC Programming

Ladder Diagram

PLC Programming

Control scheme is drawn

between two vertical

supply lines.

Ladder rungLadder rail


Ladder Diagram - Comparison

PLC Programming

Ladder Diagram - Comparison

PLC Programming


Relay-Type Instructions

PLC Programming

Examine if Closed (XIC) Instruction

PLC Programming



PLC Programming


PLC Programming



PLC Programming

Examine if Open (XIO) Instruction

PLC Programming



PLC Programming


PLC Programming


Output Energize (OTE) Instruction

PLC Programming


PLC Programming



PLC Programming

Status Bit Example

PLC Programming


Status Bit Example

PLC Programming

Ladder Rung

PLC Programming


Rung Continuity

PLC Programming

Rung Continuity

PLC Programming


Example

PLC Programming

Parallel Input Branch Instruction

PLC Programming


Parallel Output Branching

PLC Programming

Nested Input and Output Branches

PLC Programming


Nested Contact Program

PLC Programming

PLC Matrix Limitation Diagram

PLC Programming


Programming of Vertical Contacts

PLC Programming

Programming for Different Scan

Patterns

PLC Programming


Internal (Auxiliary) Control Relay

PLC Programming

Internal (Auxiliary) Control Relay

PLC Programming


Operation of XIC/XIO Instruction

PLC Programming

Operation of XIC/XIO Instruction

PLC Programming


Ladder Diagram - Timers

PLC Programming

� The Timer instruction provides a time delay, performing the

function of a time-delay relay (e.g., controlling the time for

a mixing operation or the duration of a warning beep)

� The length of time delay is determined by specifying a

preset value

� The timer is enabled when the rung conditions become

TRUE

� Once enabled, it automatically counts up until it reaches the

Preset value and then goes TRUE (and stays TRUE)

� There are two types of time delay (On and Off)


PLC Programming



PLC Programming

Off-Delay Timer

On-Delay Timer


PLC Programming



PLC Programming


PLC Programming



PLC Programming

Ladder Diagram - Counters

PLC Programming

� A Counter instruction keeps track of the number of timessome event occurs (e.g., the count could represent thenumber of parts to be loaded into a box)

� Counters may be either count-up or count-down types. TheCounter will increment (or decrement) every time the rungmakes a FALSE-to-TRUE transition

� The count is retained until a RESET instruction (with thesame address as the Counter) is enabled

� The Counter has a Preset value associated with it. When thecount gets up to the Preset value, the output goes TRUE.This allows the program to initiate some action based on acertain count


PLC Programming


PLC Programming



PLC Programming



PLC Programming


Ladder Diagram - Sequencers

PLC Programming

� The Sequencer instruction is used when a repeating

sequence of outputs is required

� Traditionally, electromechanical sequencers (Figure 12.10)

were used in this type of application (where a drum rotates

slowly, and cams on the drum activate switches)

� The Sequencer instructionallows the PLC to implementthis common control strategy


PLC Programming



PLC Programming


PLC Programming


Ladder Diagram - Comparators

PLC Programming

The temperature in an electric oven

is to be maintained by a 16-bit PLCat approximately 100°C, using two-

point control (actual range: 98-102°). An oven with an electric

heating element driven by acontactor (high-current relay), an

LM35 temperature sensor (produces10 mV/°C), an operator on-off

switch, and the PLC. The PLC has aprocessor and three I/O modules: a

discrete input module (slot 1), a 16-bit analog input module (slot 2), and

a discrete output module (slot 3).Draw the ladder diagram for this

system

Ladder Diagram - Comparators

PLC Programming


Equivalent Ladder / Logic Symbols

PLC Programming


PLC Programming



PLC Programming


PLC Programming



PLC Programming

Ladder Diagram – Programming Comments

PLC Programming

Arranging Instructions for Optimum Performance

There is more than one way to correctly implement the ladder logic. Insome cases one arrangement may be more efficient in terms of theamount of memory used and the time required to scan the program.

Instruction MOST

likely to be FALSE

Instruction LEAST

likely to be FALSE

Once a processor sees a FALSE input instruction in series, it

executes the remaining instructions FALSE, even if they are

TRUE

Sequence series instructions from the most likely to be FALSE

(far left) to least likely to be FALSE (far right)


Ladder Diagram – Programming Comments

PLC Programming

Arranging Instructions for Optimum Performance

If your rung contains parallel branches, place the path that

is most often TRUE on the top. The processor will not look

at the others unless the top path is FALSE.

Path most likely to be TRUE

LESS likely

LEAST likely

Modes of Operation


Modes of Operation

PLC and Networks

� Physically, a network is a wire acting as an “electronic

highway” that can pass messages between nodes (PCs and

other electronic devices)

� Each node on the network has a unique address, and each

message called a data packet (includes the address of

where it’s going and where it came from)

� All data on the network is sent serially (one bit at a time) on

one wire

� The most common type of network uses the bus topology,

which means that all the nodes tap into a single cable


PLC and Networks

PLC and Networks

� There are three good reasons for using a network:

� A device network simplifies wiring. Clearly the network is a

simpler system that uses less wire. This reduces the amount

of wiring needed

� With a network, the sensor data arrives in better shape. In

the traditional system, a low-level analog voltage may have

to travel many feet. The signal is subject to attenuation and

noise and other losses

� Network devices tend to be more intelligent. For example,

a photo cell could send a message saying the light level has

diminished, (indicating that the lens may be getting dirty or

that someone has bumped it out of position)


PLC and Networks

PLC and Networks

Three levels

of networks


PLC and Networks


PLC ExercisesLadder Diagram

Programming

Steps for Building a Ladder Diagram

1. Determine the No. of digital I/O

2. Determine the No. of analog I/O (if needed)

3. Determine if there are special functions in the process

4. Estimate program capacity depending on the process

5. Choose a suitable PLC series

6. Prepare the wiring diagram

7. Draw flowchart or control diagram (Optional)

8. Program the PLC using the ladder diagram


Exercise #1: Moving a Pneumatic Piston

Control ProblemThe PLC task is to move thepiston in and out. Whenswitch SW1 is momentarilyturned on, piston A is tomove out of the cylinder inA+ direction. When switchSW2 is momentarily turnedon, piston A is to move intothe cylinder in A- direction.




The two solenoid valves will be tuned off

If SW1 and SW2 arepressed together,what would happen?

Use the contacts of the main relays instead of the input contacts

How can we make an electrical interlock?

Exercise #2: Sequencing of Pneumatic Pistons

Control ProblemThe PLC task is to operate piston A followed bypiston B followed by piston C. The sequence is A+,A-, B+, B-, C+, C- is to be repeated when switchSW1 is turned on




• Solenoid valves do not work• The wiring of solenoid valves is not correct or not in

the correct order (wiring problem)• The ladder diagram is not properly written (sequence

in not correct)

If the system does not work or sequence in notcorrect, what would be the possible reasons?


Exercise #3: Batching Machine

Control ProblemThe PLC task is to control a simplemachine which counts and batchescomponents moving along a conveyor. Itis required that ten components bechanneled down route A and twentycomponents down route B. A reset facilityis required





• The reset switch is always on• The microswitch does not work• The flap solenoid does not work• The ladder diagram is not properly

written

If the system does not batch and/orcount, what would be the possiblereasons?


Exercise #4: Reject Machine

Control ProblemThe PLC task is to detect and reject faulty components. Components aretransported on a conveyor past a retro-reflective type photoelectric switch. Thephotoelectric switch is positioned at a height (H) above the conveyor where (H)represents a tolerance value for component height. Good components passunderneath the photoelectric switch and no signal is generated. Faultycomponents break the light beam twice as they pass the photoelectric switch.





• The photoelectric switch is too high (H is too big)• The photoelectric switch does not work• The pneumatic blower does not work• The ladder diagram is not properly written• The faulty components is not as described in the drawing

If the system does not reject faulty components, what would be thepossible reasons?


Exercise #5: Pick and Place Unit

Control ProblemThe PLC task is to:a) move the gripper to X+ positionb) close the gripper so that it takes hold of a componentc) rotate the gripper through 180o to the Θ+ positiond) Release the componente) Rotate the gripper back to the Θ- position so that the pick and place

operation may be repeated




• Wiring problem• Some solenoid valves do

not work• Timing is not correct• The ladder diagram is not

properly written(sequence in not correct)

If the system does notwork or sequence is notcorrect, what would bethe possible reasons?

Use position sensors for feedback but that would be expensive compared tousing timers but more accurate and reliable in case the mechanical systemstarts to have some problems

How can we get rid of the timers in the ladder diagram/program?

Exercise #6: Production Line

Control ProblemThe PLC task is to organize the production process. Cans filled with fluid andcapped before passing into a conveyor. The photoelectric switches P1 and P2 areused to check that each can has a cap. Photoelectric switch P3 provides a triggerfor the ink jet printer which prints a batch number on each can. Photoelectricswitch P4 is used to count three cans into the palletizing machine that transportsthree cans through a machine which heat shrinks a plastic wrapping over them.All photoelectric switches on the production line are of the retro reflective type.



• The height of the photoelectric switch needs to be readjusted• The photoelectric switch does not work (transmitter or receiver)• The photoelectric transmitter is not aligned with the receiver• The ladder diagram is not properly written (or timer is not set properly)

If the system allows uncapped cans to pass, what would be thepossible reasons?

Exercise #7: Star-Delta Connection




PLC system layout – Wiring diagram



Exercise #8: Drilling Process

A simple drilling operation requires

the drill press to turn on only if

there is a part present and the

operator has one hand on each of

the start switches. This precaution

will ensure that the operator's

hands are not in the way of the

drill.

PB1 PB2Drill

motor

Part sensor

Switches


A simple drilling operation requires the drill press to turn on only if there is a

part present and the operator has one hand on each of the start switches. This

precaution will ensure that the operator's hands are not in the way of the drill.

Exercise #8: Drilling Process

A motorized overhead garage door is to be operatedautomatically to preset open and closed positions.

Exercise #9: Motorized Door


Exercise #9: Motorized Door

Continuous filling operation requires boxes moving on a conveyor to be

automatically positioned and filled.

HooperPL

PL

PL

Run

Standby

FullSolenoid

Level

switch

MotorPhoto

switch

START

STOP

Exercise #10: Continuous Filling Machine


Exercise #10: Continuous Filling Machine

Exercise #11: Transporting Process 1

Need to do the PLC hardware layout + ladder diagram




Need to automate the system using a PLC(hardware layout +

ladder diagram)


Industrial Control

Systems

Outlines

� Introduction

� ICS Operation

� ICS Key Components

� SCADA Systems

� DCS Systems

� RTU

� Telemetry

� Modems

� SCADA Systems Examples


Introduction

� Industrial Control Systems is a general term that includesseveral types of control systems:

�Supervisory Control And Data Acquisition (SCADA) systems.

�Distributed Control Systems (DCS).

�Other control system configurations such as ProgrammableLogic Controllers (PLC).

� ICS are typically used in industries such as electrical, waterand wastewater, oil and natural gas, chemical,transportation, pharmaceutical, food and beverage, anddiscrete manufacturing (e.g., automotive).

� These control systems are used for critical infrastructuresthat are often highly interconnected and mutuallydependent systems

Introduction

� SCADA systems are highly distributed systems used to

control geographically dispersed assets, often scattered

over thousands of square kilometers, where centralized

data acquisition and control are critical to system operation.

� They are used in distribution systems such as water

distribution and wastewater collection systems, oil and

natural gas pipelines, electrical power grids, and railway

transportation systems.

� A SCADA control center performs centralized monitoring

and control for field sites over long-distance

communications networks, including monitoring alarms and

processing status data.


Introduction

� Based on information received from remote stations,

automated or operator-driven supervisory commands can

be pushed to remote station control devices, which are

often referred to as field devices.

� Field devices control local operations such as opening and

closing valves and breakers, collecting data from sensor

systems, and monitoring the local environment for alarm

conditions.

Introduction

� DCS are used to control industrial processes such as electric

power generation, oil refineries, water and wastewater

treatment, and chemical, food, and automotive production.

� DCS are integrated as a control architecture containing a

supervisory level of control overseeing multiple, integrated

sub-systems that are responsible for controlling the details

of a localized process.

� Product and process control are usually achieved by

deploying feedback or feedforward control loops whereby

key product and/or process conditions are automatically

maintained around a desired set point.


Introduction

� To accomplish the desired product and/or process tolerance

around a specified set point, specific PLCs are employed in

the field and proportional, integral, and/or derivative

settings on the PLC are tuned to provide the desired

tolerance as well as the rate of self-correction during

process upsets.

� DCS are used extensively in process-based industries.

Introduction

� PLCs are computer-based solid-state devices that control

industrial equipment and processes.

� While PLCs are control system components used throughout

SCADA and DCS systems, they are often the primary

components in smaller control system configurations used

to provide operational control of discrete processes such as

automobile assembly lines and power plant soot blower

controls.

� PLCs are used extensively in almost all industrial processes.


Introduction

� While control systems used in distribution and

manufacturing industries are very similar in operation, they

are different in some aspects.

� One of the primary differences is that DCS or PLC-controlled

sub-systems are usually located within a more confined

factory or plant-centric area, when compared to

geographically dispersed SCADA field sites.

� DCS and PLC communications are usually performed using

local area network (LAN) technologies that are typically

more reliable and high speed compared to the long-distance

communication systems used by SCADA systems.

Introduction

� In fact, SCADA systems are specifically designed to handle

long-distance communication challenges such as delays and

data loss posed by the various communication media used.

� DCS and PLC systems usually employ greater degrees of

closed loop control than SCADA systems because the

control of industrial processes is typically more complicated

than the supervisory control of distribution processes.


Introduction

� SCADA systems are generally used to control dispersed

assets using centralized data acquisition and supervisory

control.

� DCS are generally used to control production systems within

a local area such as a factory using supervisory and

regulatory control.

� PLCs are generally used for discrete control for specific

applications and generally provide regulatory control.

Introduction

� ICS have unique performance and reliability requirementsand often use operating systems and applications that maybe considered unconventional to typical IT personnel.Furthermore, the goals of safety and efficiency sometimesconflict with security in the design and operation of controlsystems.

� ICS implementations were susceptible primarily to localthreats because many of their components were inphysically secured areas and the components were notconnected to IT networks or systems.

� However, the trend toward integrating ICS systems with ITnetworks provides significantly less isolation for ICS from theoutside world than predecessor systems, creating a greaterneed to secure these systems from remote, external threats.


Introduction

� The increasing use of wireless networking places ICS

implementations at greater risk from adversaries who are in

relatively close physical proximity but do not have direct

physical access to the equipment.

� Threats to control systems can come from numerous

sources, including hostile governments, terrorist groups,

disgruntled employees, malicious intruders, complexities,

accidents, natural disasters as well as malicious or

accidental actions by insiders.

� ICS security objectives typically follow the priority of

availability, integrity and confidentiality, in that order.

Introduction

� It is essential for a cross-functional cyber (internet) security

team to share their varied domain knowledge and

experience to evaluate and mitigate risk to the ICS.

� The cyber security team should consist of a member of the

organization’s IT staff, control engineer, control system

operator, network and system security expert, a member of

the management staff, and a member of the physical

security department at a minimum.

� For continuity and completeness, the cyber security team

should consult with the control system vendor and/or

system integrator as well.


Introduction

� The cyber security team should report directly to site

management (e.g., facility superintendent) or the company’s

CIO/CSO, who in turn, accepts complete responsibility and

accountability for the cyber security of the ICS. An effective

cyber security program for an ICS should apply a strategy

known as “defense-in-depth”, layering security mechanisms

such that the impact of a failure in any one mechanism is

minimized.

CIO = Chief Information Officer or IT Director

CSO = Chief Security Officer

ICS Operation


ICS Operation

1. Control Loop. A control loop consists of sensors for

measurement, controller hardware such as PLCs, actuators

such as control valves, breakers, switches and motors, and

the communication of variables.

� Controlled variables are transmitted to the controller from

the sensors.

� The controller interprets the signals and generates

corresponding manipulated variables, based on set points,

which it transmits to the actuators.

� Process changes from disturbances result in new sensor

signals, identifying the state of the process, to again be

transmitted to the controller.

ICS Operation

2. Human-Machine Interface (HMI). Operators and engineers

use HMIs to monitor and configure set points, control

algorithms, and adjust and establish parameters in the

controller.

� The HMI also displays process status information and

historical information.

3. Remote Diagnostics and Maintenance Utilities. Diagnostics

and maintenance utilities are used to prevent, identify and

recover from abnormal operation or failures.

A typical ICS contains a propagation of control loops, HMIs, and remote

diagnostics and maintenance tools built using an array of network

protocols on layered network architectures


ICS Key Components

1. Control Components

�Control Server: hosts the DCS or PLC supervisory control

software that is designed to communicate with lower-

level control devices. The control server accesses

subordinate control modules over an ICS network.

�SCADA Server or Master Terminal Unit (MTU): The

SCADA Server is the device that acts as the master in a

SCADA system. Remote terminal units (RTUs) and PLC

devices located at remote field sites usually act as slaves.

ICS Key Components


�Remote Terminal Unit (RTU): It is also called a remote

telemetry unit. It is a special purpose data acquisition and

control unit designed to support SCADA remote stations.

RTUs are field devices often equipped with wireless radio

interfaces to support remote situations where wire-

based communications are unavailable. Sometimes PLCs

are implemented as field devices to serve as RTUs; in this

case, the PLC is often referred to as an RTU.


ICS Key Components


�Programmable Logic Controller (PLC): The PLC is a small

industrial computer originally designed to perform the

logic functions executed by electrical hardware. Other

controllers used at the field level are process controllers

and RTUs; they provide the same control as PLCs but are

designed for specific control applications. In SCADA

environments, PLCs are often used as field devices

because they are more economical, multipurpose,

flexible, and configurable than special-purpose RTUs.

ICS Key Components


�Programmable Logic Controller (PLC): PLCs are used in

both SCADA and DCS systems as the control components

of an overall hierarchical system to provide local

management of processes through feedback control. In

the case of SCADA systems, they provide the same

functionality of RTUs. When used in DCS, PLCs are

implemented as local controllers within a supervisory

control scheme.


ICS Key Components


�Programmable Logic Controller (PLC): PLCs are also

implemented as the primary components in smaller

control system configurations. PLCs have a user-

programmable memory for storing instructions for the

purpose of implementing specific functions such as I/O

control, logic, timing, counting, three mode proportional-

integral-derivative (PID) control, communication,

arithmetic, and data and file processing.

ICS Key Components


�Intelligent Electronic Devices (IED): An IED is a “smart”

sensor/actuator containing the intelligence required to

acquire data, communicate to other devices, and

perform local processing and control. An IED could

combine an analog input sensor, analog output, low-level

control capabilities, a communication system, and

program memory in one device. The use of IEDs in

SCADA and DCS systems allows for automatic control at

the local level.


ICS Key Components


�Human-Machine Interface (HMI): The HMI is softwareand hardware that allows human operators to monitorthe state of a process under control, modify controlsettings to change the control objective, and manuallyoverride automatic control operations in the event of anemergency. The HMI also allows a control engineer oroperator to configure set points or control algorithmsand parameters in the controller. The HMI also displaysprocess status information, historical information,reports, and other information to operators,administrators, managers, business partners, and otherauthorized users.

ICS Key Components


�Data Historian: The data historian is a centralizeddatabase for logging all process information within anICS. Information stored in this database can be accessedto support various analyses, from statistical processcontrol to enterprise level planning.

�Input/Output (IO) server: The IO server is a controlcomponent responsible for collecting, buffering andproviding access to process information from control sub-components such as PLCs, RTUs and IEDs. An IO servercan reside on the control server or on a separatecomputer platform. IO servers are also used forinterfacing third-party control components, such as anHMI and a control server.


ICS Key Components

2. Network Components

�Fieldbus Network: It links sensors and other devices to a

PLC or other controller. Use of fieldbus technologies

eliminates the need for point-to-point wiring between

the controller and each device. The sensors communicate

with the fieldbus controller using a specific protocol. The

messages sent between the sensors and the controller

uniquely identify each of the sensors.

�Control Network: The control network connects the

supervisory control level to lower-level control modules.

ICS Key Components


�Communications Routers: A router is a communications

device that transfers messages between two networks.

Common uses for routers include connecting a LAN to a WAN,

and connecting MTUs and RTUs to a long-distance network

medium for SCADA communication.

�Remote Access Points: Remote access points are distinct

devices, areas and locations of a control network for remotely

configuring control systems and accessing process data.

Examples include using a personal digital assistant (PDA) to

access data over a LAN through a wireless access point, and

using a laptop and modem connection to remotely access an

ICS system.


ICS Key Components


� Firewall: A firewall protects devices on a network by monitoring

and controlling communication packets using predefined filtering

policies. Firewalls are also useful in managing ICS network

isolation strategies.

�Modems: A modem is a device used to convert between serial

digital data and a signal suitable for transmission over a

telephone line to allow devices to communicate. Modems are

often used in SCADA systems to enable long-distance serial

communications between MTUs and remote field devices. They

are also used in SCADA systems, DCS and PLCs for gaining remote

access for operational and maintenance functions such as

entering commands or modifying parameters, and diagnostic

purposes.

SCADA Systems

� SCADA is not a full control system, but rather focuses on thesupervisory level.

� SCADA is used for gathering, analyzing and to storage realtime data.

� SCADA systems consist of both hardware and software.

� Typical hardware includes an MTU placed at a controlcenter, communications equipment (e.g., radio, telephoneline, cable, or satellite), and one or more geographicallydistributed field sites consisting of either an RTU or a PLC,which controls actuators and/or monitors sensors.

� The MTU stores and processes the information from RTUinputs and outputs, while the RTU or PLC controls the localprocess


SCADA Systems

� The communications hardware allows the transfer ofinformation and data back and forth between the MTU andthe RTUs or PLCs.

� The software is programmed to tell the system what andwhen to monitor, what parameter ranges are acceptable,and what response to initiate when parameters changeoutside acceptable values.

� An IED, such as a protective relay, may communicate directlyto the SCADA Server, or a local RTU may poll the IEDs tocollect the data and pass it to the SCADA Server.

� IEDs provide a direct interface to control and monitorequipment and sensors.

SCADA Systems

� IEDs may be directly polled and controlled by the SCADA Server and inmost cases have local programming that allows for the IED to actwithout direct instructions from the SCADA control center.

� SCADA systems are usually designed to be fault-tolerant systems withsignificant redundancy built into the system architecture.

SCADA System General Layout (Components and General Configuration)


SCADA Systems

� The control center houses a SCADA Server (MTU) and thecommunications routers.

� Other control center components include the HMI,engineering workstations, and the data historian, which areall connected by a LAN.

� The control center collects and logs information gathered bythe field sites, displays information to the HMI, and maygenerate actions based upon detected events.

� The control center is also responsible for centralizedalarming, trend analyses, and reporting.

� The field site performs local control of actuators andmonitors sensors.

SCADA Systems

� Field sites are often equipped with a remote accesscapability to allow field operators to perform remotediagnostics and repairs usually over a separate dial upmodem or WAN connection.

� Standard and proprietary communication protocols runningover serial communications are used to transportinformation between the control center and field sites usingtelemetry techniques such as telephone line, cable, fiber,and radio frequency such as broadcast, microwave andsatellite.


SCADA Systems

� MTU-RTU communication architectures vary amongimplementations. The various architectures used, includingpoint-to-point, series, series-star, and multi-drop.

� Point-to-point is functionally the simplest type; however, itis expensive because of the individual channels needed foreach connection.

� In a series configuration, the number of channels used isreduced; however, channel sharing has an impact on theefficiency and complexity of SCADA operations.

� Similarly, the series-star and multi-drop configurations’ useof one channel per device results in decreased efficiency andincreased system complexity.

SCADA Systems

Basic SCADACommunication Topologies


SCADA Systems

� The four basic architectures can be further augmented usingdedicated communication devices to managecommunication exchange as well as message switching andbuffering.

� Large SCADA systems, containing hundreds of RTUs, oftenemploy sub-MTUs to alleviate the burden on the primaryMTU. This type of topology is shown in the following figure.

SCADA Systems

Large SCADACommunication Topology


SCADA Systems

SCADA System

Implementation

Example

(Distribution

Monitoring And

Control)

SCADA Systems

� This particular SCADA system consists of a primary controlcenter and three field sites.

� A second backup control center provides redundancy in theevent of a primary control center malfunction.

� Point-to-point connections are used for all control center tofield site communications, with two connections using radiotelemetry.

� The third field site is local to the control center and uses thewide area network (WAN) for communications.

� A regional control center resides above the primary controlcenter for a higher level of supervisory control.


SCADA Systems

� The corporate network has access to all control centersthrough the WAN, and field sites can be accessed remotelyfor troubleshooting and maintenance operations.

� The primary control center polls field devices for data atdefined intervals (e.g., 5 seconds, 60 seconds) and can sendnew set points to a field device as required.

� In addition to polling and issuing high-level commands, theSCADA server also watches for priority interrupts comingfrom field site alarm systems.

SCADA Systems

SCADA System ImplementationExample(Rail Monitoring and Control)


SCADA Systems

� The previous example includes a rail control center thathouses the SCADA system and three sections of a railsystem.

� The SCADA system polls the rail sections for informationsuch as the status of the trains, signal systems, tractionelectrification systems, and ticket vending machines.

� This information is also fed to operator consoles at the HMIstation within the rail control center.

� The SCADA system also monitors operator inputs at the railcontrol center and disperses high-level operator commandsto the rail section components.

SCADA Systems

� In addition, the SCADA system monitors conditions at theindividual rail sections and issues commands based on theseconditions (e.g., shut down a train to prevent it fromentering an area that has been determined to be flooded oroccupied by another train based on condition monitoring).


SCADA Systems

� There are several common media of communication:- Fiber optics

- Electrical cable.

- Leased lines from a telephone utility.

- Satellite telecommunications.

� The communications method used by most SCADA systemsis called “master–slave”, where only one of the machines (inthis case the MTU) is capable of initiating communication.

� The MTU talks to each RTU then returns to the first. This iscalled "scanning".

� The time required for the MTU to scan ALL its RTUs is calledthe MTU Scan Time (Scan Interval).

� Factors that determine scan interval are: number of RTUs,amount of data, data rate, and communications efficiency.

SCADA Systems

Calculate a scan interval for a SCADA system that:

- Has 20 RTUs

- Every RTU has a point count of 180 status points, 30 alarmpoints, 10 meters (at 16 bits each), and 10 analog points (at16 bits each).

- The MTU sends information to the RTU of 150 discretecontrol signals to valves and motors, 6 stepping motors (16bits each), and 10 valve controller set points (16 bits each)

- Data rate for communication is 1200bps.

- Communication efficiency is 40%.

Solution

Total Points is 920, therefore the total amount of data is 20 x920 = 18,400bits and the data rate is 18,400b/1200bps =~15sec at 100% efficiency but at 40% efficiency, the scaninterval is 15sec/0.4 =~ 38sec.

Example


DCS

� In a DCS, the data acquisition and control functions are

performed by a number of distributed microprocessor-based

units, situated near to the devices being controlled or, the

instrument from which data is being gathered.

� DCS systems have evolved into providing very sophisticated

analogue (e.g. loop) control capability. A closely integrated

set of operator interfaces (or man machine interfaces) is

provided to allow for easy system configurations and

operator control. The data highway is normally capable of

high speeds - typically 1 Mbps up to 10 Mbps.

DCS


DCS

The PLC is still one of themost widely used controlsystems in industry. Asneeds grew to monitorand control more devicesin the plant, the PLCswere distributed and thesystems became moreintelligent and smaller insize. PLCs and DCS areused as shown

Remote Terminal Units (RTUs)

� RTU (sometimes referred to as a remote telemetry unit) asthe title implies, is a microprocessor controlled electronicdevice which interfaces objects in the physical world to adistributed control system (DCS) or SCADA system bytransmitting telemetry data to the system and/or alteringthe state of connected objects based on control messagesreceived from the system

� RTU is a standalone data acquisition and control unit,generally microprocessor based, which monitors andcontrols equipment at some remote location from thecentral station.

� Its primary task is to control and acquire data from processequipment at the remote location and to transfer this databack to a central station.



� It generally also has the facility for having its configuration

and control programs dynamically downloaded from some

central station.

� There is also a facility to be configured locally by some RTU

programming unit.


� Although traditionally the RTU communicates back to some

central station, it is also possible to communicate on a peer-

to-peer basis with other RTUs.

� The RTU can also act as a relay station (sometimes referred

to as a store and forward station) to another RTU, which

may not be accessible from the central station.

� Small sized RTUs generally have less than 10 to 20 analog

and digital signals, medium sized RTUs have 100 digital and

30 to 40 analog inputs.

� RTUs, having a capacity greater than this can be classified as

large.



� RTU is a device installed at a remote location that:

1. Collects data

2. Codes data into a format that is transmittable

3. Transmits the data back to a central station (master)

4. Collects information from the master device andimplements processes that are directed by the master

� RTU is equipped with input channels for sensing and outputchannels for control or alarms and communications port.

RTU - Types

� There are two basic types of RTU

1. The “single board RTU” which is compact, and contains allI/O on a single board

2. The “modular RTU” which has a separate CPU module, andcan have other modules added, normally by plugging into acommon “backplane” (a bit like a PC motherboard and plug inperipheral cards).

� The single board RTU normally has fixed I/O (e.g., 16 digitalinputs, 8 digital outputs, 8 analogue inputs, and say 4 analogueoutputs). It is normally not possible to expand its capability.

� The modular RTU is designed to be expanded by addingadditional modules. Typical modules may be a 8 analog inmodule, a 8 digital out module. Some specialized modules suchas a GPS time stamp module may be available.


RTU - Sizes

� Tiny stand-alone systems that run off batteries for an entireyear or more. These systems log data into EPROM or FLASHROM and download data when physically accessed by anoperator. Often these systems use single chip processors withminimal memory and might not be able to handle asophisticated communications protocol.

� Small stand-alone systems that can power up periodically andapply power to sensors (or radios) to measure and/or report.Usually run off batteries that are maintained by solar energy.The batteries are large enough to maintain operation for atleast 4 months during the darkness of the winter in the farnorthern hemisphere. These systems generally have enoughcapability for a much more complex communications scheme.

RTU - Sizes

� Medium Systems that are dedicated single board industrialcomputers, including IBM-PC or compatible computerseither in desk-top enclosures or industrial configurationssuch as VME, MultiBus, STD bus, PC104, etc….

� Large Systems for complete Plant control with all the bellsand whistles. These are usually in Distributed ControlSystems (DCSs) in Plants, and often communicate over highspeed LANs. Timing may be very critical.


RTU – Architecture and Communications

The SCADA RTU has the following hardware features:

1. CPU and volatile memory

2. Non volatile memory for storing programs and data

3. Communications capability either through serial port(s)

or sometimes with an on board modem

4. Secure Power supply (with battery backup)

5. Watchdog timer (to ensure the RTU restarts if something

fails)

6. Electrical protection against "spikes"

7. I/O interfaces to DI/DO/AI/AO's

8. Real time clock




� RTU monitors the field digital and analog parameters and

transmits all the data to the Central Monitoring Station.

� RTU can be interfaced with the Central Station with

different communication media (usually serial (RS232,

RS485, RS422) or Ethernet)

� RTU can support standard protocols (Modbus, DNP3,

ICCP…etc.) to interface any third party software.

� In some control application, RTU drives high current

capacity relays to a digital output board to switch power on

and off the devices in the field


� RTU can monitor Analog inputs that can be of different

types like (4 to 20mA), (0 to 10V), (-2.5 to 2.5V), (1 to

5V)…etc

� RTU then translates this raw data into the appropriate units

(e.g., gallons of water or temperature) before presenting

the data to the user via the Human Computer Interface (HCI)

or Man-Machine Interface (MMI)


RTU – Applications

� Oil and Gas remote instrumentation monitoring, (offshoreplatforms, onshore oilwells)

� Networks of remote pump stations

� Hydro-graphic monitoring and control, (water supply,reservoirs, sewerage systems).

� Environmental monitoring systems (pollution, air quality,emissions monitoring).

� Minesite monitoring applications.

� Protection supervision and data logging of Powertransmission network

� Air traffic equipments such as navigation aids.

RTU – Comparison

� A PLC is a small industrial computer which originally replacedrelay logic. It had inputs and outputs similar to those an RTUhas.

� It contained a program which executed a loop, scanning theinputs and taking actions based on these inputs.

� Originally the PLC had no communications capability, but theybegan to be used in situations where communications was adesirable feature.

� So communications modules were developed for PLC's,supporting ethernet (for use in DCSs) and the Modbuscommunications protocol for use over dedicated (wire) links.

� As time goes on we will see PLC's support more sophisticatedcommunications protocols.


RTU – Comparison

� RTU's have always been used in situations where thecommunications are more difficult, and the RTU's strengthwas its ability to handle difficult communications.

� RTU's originally had poor programmability in comparison toPLC's. As time has gone on, the programmability of the RTUhas increased.

� We are seeing the merging of RTU's and PLC's, but it will bea long time (if ever) before the distinction disappears..

� RTUs, PLCs and DCS are increasingly beginning to overlap inresponsibilities, and many vendors sell RTUs with PLC-likefeatures and vice versa. The industry has standardized forcreating programs to run on RTUs and PLCs

RTU – Comparison

� RTU differs from a PLC in that RTUs are more suitable forwide geographical telemetry, often using wirelesscommunications, while PLCs are more suitable for local areacontrol (plants, production lines, etc.) where the systemutilizes physical media for control

� Some vendors now supply RTUs with comprehensivefunctionality pre-defined, sometimes with PLC extensionsand/or interfaces for configuration

� Some suppliers of RTUs have created simple Graphical UserInterfaces (GUI) to enable customers to configure theirRTUs easily


Telemetry

� Telemetry refers to the transfer of remote measurement

data to a central control station over a communications link.

� This measurement data is normally collected in real-time

(but not necessarily transferred in real-time).

� The terms SCADA, DCS, PLC and smart instrument are all

applications of the telemetry concept.

Modems

� The telephone system, landline communication systems, and

radio systems cannot directly transport digital information

without some distortion in the signal due to the bandwidth

limitation inherent in the connecting medium.

� A conversion device, called a modem (modulator/demodulator),

is thus required to convert the digital signals into an analog form

suitable for transmission over a telephone network.

� This converts the digital signals generated by a computer into an

analog form suitable for long distance transmission over the

cable or radio system.

� The demodulation portion of the modem receives this analog

information and converts it back into the original digital

information generated by the transmitting computer.


Modems

Modems - Types

There are two types of modem available today:

� Dumb (or non-intelligent) modems depend on the

computer to which they are connected, to instruct the

modem when to perform most of the tasks such as

answering the telephone.

� Smart modems have an on-board microprocessor enabling

them to perform such functions as automatic dialing and

the method of modulation to use.


Modems – Communication Protocols

� Modems can be either synchronous or asynchronous.

� In asynchronous communications each character is

encoded with a start bit at the beginning of the character

bit stream and a parity and stop bit at the end of the

character bit stream.

� The receiver then synchronizes with each character

received by looking out for the start bit.

� Once the character has been received, the communications

link returns to the idle state and the receiver watches out

for the next start bit (indicating the arrival of the next

character).

Modems


Modems

� Synchronous communication relies on all characters being sent in

a continuous bit stream.

� The first few bytes in the message contain synchronization data

allowing the receiver to synchronize onto the incoming bit

stream.

� Hereafter synchronization is maintained by a timing signal or

clock.

� The receiver follows the incoming bit stream and maintains a

close synchronization between the transmitter clock and receiver

clock.

� Synchronous communications provides for far higher speeds of

transmission of data, but is avoided in many systems because of

the greater technical complexity of the communications

hardware.

Modems


Modems – Modes of Operation

Modems can operate in three modes:

� Simplex

� Half-Duplex

� Full-Duplex

A simplex system in data communications is one that is

designed for sending messages in one direction only and

has no provision for sending data in the reverse direction.

Modems – Modes of Operation

� A duplex system in data communications is one that is designed

for sending messages in both directions.

� Duplex systems are said to be half-duplex when messages and

data can flow in both directions but only in one direction at a

time.

� Duplex systems are said to be full-duplex when messages can

flow in both directions simultaneously.

� Full-duplex is more efficient, but requires a communication

capacity of at least twice that of half-duplex.


Modems – Interface Standards

� RS-232, RS-422 and RS-485 standards form the key element in

transferring digital information between the RTUs (or operator

terminals), and the modems, which convert the digital information

to the appropriate analog, form suitable for transmission over

greater distances.

� The RS-232 standard was initially designed to connect digital

computer equipment to a modem where the data would then be

converted into an analog form suitable for transmission over greater

distances.

� The RS-422 and RS-485 standards can perform the same function

but also have the ability of being able to transfer digital data over

distances of over 1200 m.

� The most popular (but probably technically the most inferior

(poorer)) of the RS standards is the RS-232C standard.

Modems – RS232C Interface Standard

� The RS-232 interface standard was developed to interface

between data terminal equipment (DTE) and data

communications equipment (DCE) employing serial binary

data interchange.

� The EIA-RS-232 standard consists of 3 major parts, which

define:

- Electrical signal characteristics

- Interface mechanical characteristics

- Functional description of the interchange circuits


Modems – RS232C Interface Standard

� Electrical signal characteristics: Electrical signals such as the

voltage levels and grounding characteristics of the interchange

signals and associated circuitry.

� Interface mechanical characteristics: It dictates that the

interface must consist of a ‘plug’ and Modems 183 ‘receptacle’

(socket) and that the receptacle will be on the DCE. In RS-232-

C, the pin number assignments are specified but, originally,

the type of connector was not.

� Functional description of the interchange circuits

This defines the function of the data, timing, and control

signals used at the interface between DTE and DCE.

Modems – RS232 Limitations

� The restriction of point-to-point communications is a drawback

when many devices have to be multi-dropped together.

� The distance limitation (typically 15 meters) is a limitation when

distances of 1000m are needed.

� The 20 kbps baud rate is too slow for many applications.

� The voltages of –3 to –25 volts and +3 to +25 volts are not

compatible with many modern power supplies (in computers) of

+5 and +12 volt.

� The standard is an example of an unbalanced standard with high

noise susceptibility.

Two approaches to deal with the limitations of RS-232 are the

RS-422 and RS-485 standards.


Modems – RS422 Interface Standard

� The RS-422 standard introduced in the early 70s defines a

differential data communications interface using two

separate wires for each signal

� This permits very high data rates and minimizes problems

with varying ground potential because the ground is not

used as a voltage reference (in contrast to RS-232) and

allows reliable serial data communication for:

- Distances of up to 1200 m

- Data rates of up to 10 Mbps

- Only one line driver is permitted on a line

- Up to 10 line receivers can be driven by one line driver


� The line voltages range between –2 V to –6 V for Logic 1 and +2 V to +6

V for Logic 0 (using terminals A and B as reference points). The line

driver for the RS-422 interface produces a ±5 V differential voltage on

two wires.

� The two signaling states of the line are defined as follows:

- When the ‘A’ terminal of the driver is negative with respect to the ‘B’

terminal, the line is in a binary 1 (Mark or Off) state.

- When the ‘A’ terminal of the driver is positive with respect to the ‘B’

terminal, the line is in a binary 0 (Space or On) state.



� The differential voltage signal is the major feature of the RS-

422 standard, which allows an increase in speed and

provides higher noise immunity.

� Each signal is transferred on one pair of wires and is the

voltage difference between them.

� A common ground wire is preferred to aid noise rejection.

� Consequently, for a full-duplex system, five wires are

required (with 3 wires for half-duplex systems).

� The RS-422 standard does not specify the mechanical

connections or assign pin numbers and leaves this aspect

optional.


� The RS-485 standard is the most adaptable and flexible.

� It is an expansion of RS-422 and allows the same distance

and data speed but increases the number of transmitters

and receivers permitted on the line.

� RS-485 permits multi-drop network connection on two

wires and provides for reliable serial data communication

for:

- Distances of up to 1200 m (same as RS-422)

- Data rates of up to 10 Mbps (same as RS-422)

- Up to 32 line drivers permitted on the same line

- Up to 32 line receivers permitted on the same line



� The line voltages are similar to RS-422 ranging between –1.5V to

–6V for logic ‘1’ and +1.5V to +6V for Logic ‘0’.

� As with RS-422, the line driver for the RS-485 interface produces

a 5 volt differential voltage on two wires. For full-duplex systems,

five wires are required.

� For a half-duplex system, only three wires are required.

� The major enhancement of RS-485 is that a line driver can

operate in three states (called tri-state operation) logic ‘0’, logic

‘1’ and ‘high-impedance’, where it draws virtually no current and

appears not to be present on the line.

� This latter state is known as the ‘disabled’ state and can be

initiated by a signal on a control pin on the line driver integrated

circuit.


� The RS-485 interface standard is useful where distance and

connection of multiple devices on the same pair of lines is

desirable.

� Special care must be taken with the software to coordinate which

devices on the network can become active.

� In most cases, a master terminal, such as a PLC or computer,

controls which transmitter/receiver will be active at any one

time.


SCADA Examples –Water Treatment

SCADA Examples –Wind Farms 1


SCADA Examples –Wind Farms 2

SCADA Examples – Cement Mill


SCADA Examples – Level Control


Plc scada for automation process control

Education

Transcript of Plc scada for automation process control