PLC Architecture, Hardware and Operation

Introduction

A programmable logic controller (PLC) is an industrial computer designed to monitor field devices, execute a stored control program, and command actuators. Unlike a general-purpose computer, a PLC is optimized for deterministic operation, electrical noise immunity, simple maintenance, modular expansion, and continuous operation in industrial environments.

A PLC system connects sensors and switches to input modules, processes their signals in a central processing unit (CPU), and produces commands through output modules. Modern PLCs may also exchange data with drives, robots, supervisory control and data acquisition (SCADA) systems, distributed control systems, safety controllers, and cloud or enterprise applications.

The reliability of an automation system depends not only on the control program but also on correct hardware selection, signal conditioning, grounding, protection, addressing, timing, and maintenance. This chapter examines the architecture and operation of PLC systems from a practical engineering perspective.

Learning Objectives

After studying this chapter, a student should be able to:

• describe the functions of a PLC CPU, memory, power supply, rack, and I/O modules;
• distinguish digital, analog, local, and remote I/O;
• explain the PLC scan cycle and process image;
• interpret common addressing systems and data types;
• select modules for voltage, current, resolution, isolation, and environmental requirements;
• explain redundancy and its limitations;
• apply sound electrical installation and commissioning practices; and
• analyze a PLC architecture for a practical industrial application.

1. General PLC Architecture

A conventional PLC consists of five principal elements:

1. Power supply: Converts incoming electrical power into regulated DC power for the CPU and modules.
2. CPU: Executes the user program, performs diagnostics, manages communication, and coordinates the system.
3. Memory: Stores the operating system, user program, configuration, and process data.
4. Input/output system: Interfaces the controller with sensors, switches, valves, contactors, drives, and instruments.
5. Rack, backplane, and communication network: Mechanically supports modules and electrically or optically transfers power and data.

Figure: Functional architecture of a PLC system.

The CPU and I/O modules communicate through a backplane bus in a local rack. In larger installations, remote I/O stations communicate with the CPU through an industrial network. The direction of control information is not always one-way: diagnostic data, feedback signals, and network messages also travel from field devices and modules toward the CPU.

2. CPU, Operating System, and Memory

2.1 CPU functions

The CPU performs the following tasks:

• reads input data;
• executes the application program;
• updates output data;
• handles timers, counters, arithmetic, and logic;
• manages communication protocols;
• detects hardware and software faults;
• maintains diagnostic records; and
• transitions the controller among operating states such as stop, run, fault, and maintenance modes.

PLC performance is characterized less by clock frequency alone than by deterministic execution time, instruction set, memory capacity, communication capability, interrupt response, and diagnostic behavior.

2.2 Memory types

PLC memory is commonly divided into several logical categories:

Retentive memory preserves selected values after power loss, whereas non-retentive memory returns to a defined startup state. Retention should be used deliberately. Retaining a batch counter may be appropriate; retaining an unsafe actuator command may not be.

A memory backup battery or capacitor may protect a real-time clock or volatile data, but it does not eliminate the need for a documented power-loss strategy. Engineers should specify what happens after cold restart, warm restart, communication failure, and program download.

2.3 CPU operating states

In a run state, the CPU executes the application program and updates I/O. In a stop or program state, outputs may be de-energized or placed in configured safe states. A fault state indicates that the CPU or a module has detected a condition requiring intervention. The exact behavior is vendor-dependent and must be verified from the hardware manual.

3. Power Supplies, Racks, and Backplanes

3.1 Power supply design

A PLC power supply may accept AC mains or DC input and produce regulated 5 V, 12 V, 24 V, or other internal rails. It must be distinguished from the field supply used to power sensors and actuators. Some systems use a common 24 V DC supply; others use separate supplies for control electronics, inputs, and outputs.

Power-supply selection should consider:

• nominal voltage and allowable tolerance;
• continuous and inrush current;
• short-circuit protection;
• hold-up time during brief voltage dips;
• heat dissipation;
• grounding arrangement;
• electromagnetic compatibility; and
• separation of critical and noncritical loads.

For a DC load, the minimum nominal supply current is estimated by:

Here, I_supply is the selected supply current rating in amperes and I_continuous is the expected continuous load current in amperes. The factor 1.25 is a common engineering margin, not a universal rule; the manufacturer, local code, ambient temperature, duty cycle, and inrush requirements may require a different margin. Loads such as solenoid valves and contactors can have substantially higher inrush current than their holding current.

3.2 Racks and backplanes

A rack provides mechanical mounting and a backplane that distributes power and data. Some compact PLCs integrate the CPU, power supply, and I/O in one body. Modular PLCs permit expansion by adding signal, communication, motion, technology, or specialty modules.

The rack imposes limits on:

• number and type of modules;
• allowable current on each backplane segment;
• module order or slot restrictions;
• maximum expansion distance;
• temperature rise; and
• network topology.

A module should never be installed solely because it physically fits. The configuration software and hardware manual must confirm electrical and firmware compatibility.

4. Digital and Analog I/O

4.1 Digital inputs

Digital inputs represent discrete states, usually 0 or 1. Examples include pushbuttons, proximity switches, limit switches, pressure switches, and auxiliary contacts. Common industrial levels are 24 V DC, 120 V AC, and 230 V AC, although the exact voltage range varies by module.

Important input characteristics include threshold voltage, input current, isolation, response time, debounce behavior, and wiring type. A two-wire sensor may require a minimum leakage current; an input module must be compatible with that leakage current to avoid false activation.

Sourcing and sinking terminology describes current direction. A sourcing device supplies positive voltage to the load, while a sinking device provides a path toward 0 V. The sensor, input module, and power supply must use compatible conventions.

4.2 Digital outputs

Digital outputs may be implemented using relay contacts, transistor switches, or triacs.

Output selection must consider voltage, current, inrush, switching frequency, inductive energy, and required fail state. Coils should normally include suppression, such as a flyback diode for suitable DC coils or an RC snubber/varistor for appropriate AC loads. Suppression must be compatible with the device and switching speed.

4.3 Analog inputs

Analog inputs measure a continuously varying signal. Common standards include 0–10 V, ±10 V, 0–20 mA, and 4–20 mA. Current loops are widely used because they tolerate voltage drop and are less sensitive to electromagnetic interference than low-level voltage signals. A live-zero 4–20 mA signal also allows 0% process value to be distinguished from an open circuit in many applications.

The module converts the analog signal using an analog-to-digital converter (ADC). If an ideal ADC has N quantization levels over a unipolar range from x_min to x_max, its nominal resolution is:

Here, Δx is the input increment represented by one count, in volts, amperes, or the relevant engineering unit. Real accuracy is poorer than nominal resolution because of gain error, offset error, noise, temperature drift, and linearity error.

For a linear current transmitter ranging from I_min to I_max, the process value is commonly scaled as:

Here, I is the measured current, y is the engineering-unit value, and the minimum and maximum quantities define the calibrated ranges. This equation assumes a linear transmitter and correctly configured range. A 4–20 mA pressure transmitter configured for 0–10 bar gives 0 bar at 4 mA and 10 bar at 20 mA.

4.4 Analog outputs

Analog outputs command variables such as valve position, speed reference, heater demand, or pressure setpoint. The output range, load impedance, update rate, isolation, and fault behavior must be checked. A current output may require an external loop supply, while a voltage output may require a minimum or maximum load resistance.

Analog signals should be shielded and routed separately from motor power and switching conductors. Shield termination practices depend on the manufacturer and grounding design; indiscriminate connection at both ends can create unwanted ground-loop currents, while poor termination can reduce noise immunity.

5. Remote I/O and Industrial Networks

Remote I/O places input and output modules close to the machinery rather than bringing every field cable to the main control cabinet. A remote station generally contains a network adapter, I/O modules, a power supply, and terminal assemblies.

Advantages include reduced copper cabling, shorter field runs, easier machine modularity, and distributed diagnostics. Limitations include network dependence, communication latency, configuration complexity, and the need for appropriate environmental protection.

Remote I/O is not automatically equivalent to local I/O. Network update time, watchdog behavior, module fault response, and output reaction to communication loss must be specified. Critical emergency functions should use a properly designed safety system rather than relying only on ordinary remote I/O.

Network architecture may use line, star, ring, or redundant arrangements. Selection depends on distance, bandwidth, environmental conditions, determinism, maintainability, and required availability. Examples of industrial communication technologies include EtherNet/IP, PROFINET, Modbus TCP, EtherCAT, CAN-based systems, and vendor-specific buses. Protocol choice should follow system requirements rather than popularity alone.

6. Scan Cycle and Process Image

A typical PLC scan consists of these conceptual stages:

1. input acquisition;
2. execution of the user program;
3. output update;
4. communication and diagnostic services; and
5. repetition.

The exact order varies by manufacturer and may include interrupts, motion tasks, network updates, and operating-system services. The scan time is not necessarily constant. It depends on program size, instruction complexity, communication traffic, diagnostics, and interrupt activity.

The process image is a memory representation of input and output states. In a simple model, the CPU copies physical inputs into an input image, executes logic using that image, and transfers output-image values to physical output modules. This creates consistent data during program execution, but it also means that a physical input change may not be visible until the next acquisition phase.

If a program requires immediate reaction, a hardware interrupt, high-speed counter, pulse-capture input, or specialized task may be necessary. A normal scan is unsuitable for measuring very short pulses that occur entirely between two input-update events.

For a repetitive scan with scan time T_scan, the approximate scan frequency is:

where T_scan is in seconds and f_scan is in hertz. This relationship describes the repetition rate only; it does not guarantee that an input event will be detected, because task scheduling and input filtering also matter.

Timers and watchdogs are essential for detecting excessive scan time. A watchdog timeout usually places the CPU or outputs into a defined fault condition. A control engineer must analyze whether the defined state is de-energized, frozen, substituted, or application-specific.

7. Addressing and Data Types

7.1 Addressing

An address identifies a physical channel or a memory variable. Address formats differ among vendors. A typical address may encode rack, slot, byte, and bit, such as an input byte and bit position. Symbolic addressing uses meaningful names such as Tank_Level, Pump_Run_Command, or High_Pressure_Alarm.

Symbolic addressing improves readability and reduces errors during hardware changes. Physical addresses remain important during commissioning, troubleshooting, and documentation. A professional project maintains an I/O list linking tag name, terminal number, module channel, signal type, field device, normal state, and engineering range.

7.2 Common data types

• BOOL: one logical state, true or false.
• BYTE: 8-bit unsigned collection of bits.
• WORD/DWORD: 16-bit or 32-bit bit-oriented values, depending on convention.
• SINT, INT, DINT: signed integer types.
• USINT, UINT, UDINT: unsigned integer types.
• REAL/LREAL: floating-point values.
• TIME: duration used by timers and scheduling functions.
• DATE_AND_TIME: calendar date and time.
• STRING: character sequence.
• Structured or user-defined types: grouped variables representing equipment or records.

Data type selection affects memory use, range, arithmetic behavior, and communication compatibility. An analog count should not be treated as a Boolean, and a signed temperature value should not be stored in an unsigned variable without deliberate conversion.

Integer overflow, truncation during division, scaling errors, and inconsistent byte order are common sources of faults. Engineering values should include documented units and range checks. A raw analog count should be converted once in a clearly identified function or program block rather than repeatedly throughout the control logic.

8. Redundancy, Availability, and Fail-Safe Design

Redundancy uses additional components so that one failure does not immediately stop the function. It may be applied to CPUs, power supplies, communication networks, I/O modules, sensors, or servers.

Examples include:

• dual power supplies with diode isolation;
• hot-standby CPUs;
• redundant network rings;
• duplicated critical transmitters; and
• redundant I/O channels.

Redundancy improves availability but increases cost, configuration complexity, testing requirements, and the possibility of common-cause failure. Two controllers installed in the same overheated cabinet are not independent in a meaningful sense.

Reliability and availability are related but distinct. Availability is commonly expressed as:

Here, A is steady-state availability, MTBF is mean time between failures, and MTTR is mean time to repair; all time quantities must use the same units. The simplified relationship assumes statistically stable failure and repair behavior and does not fully model preventive maintenance, common-cause failures, or complex repair logistics.

Ordinary redundancy is not the same as functional safety. Safety-related systems require hazard analysis, safety integrity requirements, validated architecture, diagnostic coverage, and compliance with applicable standards such as IEC 61508, IEC 61511, or machinery-safety standards relevant to the application. Emergency-stop circuits should not be implemented solely as ordinary software logic in a standard PLC.

9. Module Selection and Electrical Installation

9.1 A systematic selection method

A practical module-selection sequence is:

1. prepare the complete I/O list;
2. classify each signal as digital, analog, pulse, motion, safety, or communication;
3. identify voltage, current, frequency, range, and isolation requirements;
4. determine channel density and spare capacity;
5. verify environmental ratings and hazardous-area requirements;
6. check diagnostic, interrupt, and update-time requirements;
7. confirm power and heat-load calculations;
8. verify software, firmware, and network compatibility; and
9. document terminal wiring, address assignment, and commissioning tests.

Include spare channels where the cost and consequences of future expansion justify them. Spares should not be counted as usable capacity unless they are wired, fused, addressed, and documented.

9.2 Installation practices

Good installation practice includes:

• isolate electrical power before work and apply lockout/tagout;
• use correctly rated protective devices and terminal blocks;
• separate power, control, analog, and communication wiring;
• use ferrules, labels, strain relief, and secure cable routing;
• maintain the manufacturer’s bend radius and spacing requirements;
• bond cabinet doors and metallic parts appropriately;
• provide protective earth and functional earth as specified;
• avoid sharing noisy return paths with sensitive analog circuits;
• protect inductive loads with suitable suppression;
• control cabinet temperature and condensation; and
• preserve access for testing and replacement.

Electrical installation must comply with applicable national codes, machinery requirements, electromagnetic-compatibility requirements, and hazardous-location rules. The correct standard depends on the jurisdiction and application; therefore, a design should identify the governing regulations rather than assume that a generic wiring practice is sufficient.

Before energization, inspect torque, polarity, insulation, shield termination, fuse ratings, module orientation, and protective-earth continuity. Commissioning should proceed from point-to-point checks to I/O simulation, controlled actuator tests, sequence tests, fault tests, and documented restoration of automatic operation.

10. Illustrative Case: Distributed Pumping Station

Background

Consider an illustrative municipal water-pumping station with three pumps, two level transmitters, motorized isolation valves, flow measurement, and a remote operator station. The pumps are controlled by variable-frequency drives (VFDs), and the station must continue operating if one ordinary communication path fails.

Problem

The original design routed all field signals to a central cabinet. The cable distance caused high installation cost, analog noise, and difficult maintenance. The plant also lacked a clear response to loss of communication with a remote I/O island.

Analysis

The I/O list contains digital valve-limit switches and motor status contacts, analog level and flow signals, VFD speed references, and communication data. The level transmitters use 4–20 mA signals. Pump permissives include low-level protection, valve-open confirmation, and drive-ready status. The control function is not safety-rated, but an independent hardwired or safety-rated shutdown is required for identified hazards.

Approach and solution

A modular CPU is installed in the main cabinet with a local digital I/O rack. A remote I/O station is located near the pumps. Analog input modules are selected for 4–20 mA signals with channel isolation and open-circuit diagnostics. Analog output channels provide speed references to the VFDs, while drive status and faults are exchanged over an industrial network.

The program uses symbolic tags and a structured pump-control block. Each pump has an operating state: stopped, starting, running, stopping, faulted, or unavailable. The logic checks permissives before starting and applies a minimum run time to reduce excessive cycling. The remote I/O watchdog is configured so that loss of communication removes run commands and generates an alarm. The final response is verified against the process hazard analysis.

The level signal is scaled using the linear transmitter equation. For a 4–20 mA, 0–6 m level transmitter, a measured 12 mA corresponds to:

The units are consistent because the current ratio is dimensionless and the result is in metres.

Outcome

The distributed architecture reduces field cabling and improves diagnostics. The documented communication-loss response prevents uncontrolled pump operation, while the independent protective functions address hazards that ordinary PLC logic cannot safely replace.

Learning points

The case demonstrates that architecture should be derived from signal type, distance, availability, safety, maintainability, and failure response. Remote I/O is valuable, but it introduces network and watchdog considerations. Correct scaling and explicit state design are as important as selecting the CPU.

11. Contemporary Developments and Professional Practice

Modern PLC platforms increasingly support high-speed Ethernet, integrated motion, OPC UA, virtualization, web diagnostics, cybersecurity functions, and edge data processing. These capabilities improve integration but enlarge the attack surface and the consequences of poor configuration.

Industrial cybersecurity practices include role-based access, unique credentials, network segmentation, controlled remote access, backup verification, patch management, change control, and incident-response planning. A PLC should not be connected directly to an untrusted network. Security measures must preserve deterministic control and safety functions.

Artificial intelligence may assist with predictive maintenance, anomaly detection, and energy optimization, but it should not be allowed to alter safety-critical control without a validated engineering basis. Training data, false alarms, explainability, cybersecurity, and human authorization remain important. AI is an analytical aid, not a substitute for a properly designed interlock or safety function.

Challenges and Limitations

PLC systems are highly reliable, but they have limitations. Scan-based logic can miss short events; analog measurements contain uncertainty; networked I/O introduces communication dependence; vendor-specific addressing can complicate migration; and redundancy can conceal common-cause failures. Poor grounding, undocumented modifications, inadequate backups, and uncontrolled access frequently cause more operational difficulty than CPU capacity.

Engineers must therefore treat the PLC as part of a complete socio-technical system that includes electrical infrastructure, field instrumentation, operators, maintenance personnel, safety functions, documentation, and governance.

Chapter Summary

A PLC combines a CPU, memory, power supply, backplane or rack, communication facilities, and I/O modules to perform deterministic industrial control. The CPU executes the user program, manages diagnostics, and exchanges data with local or remote I/O. Memory may contain firmware, program data, process images, and retentive variables, each with different protection and restart behavior.

Digital I/O handles discrete states, whereas analog I/O represents measured or commanded continuous quantities. Module selection requires attention to voltage, current, isolation, resolution, accuracy, update time, environmental conditions, and fault response. Remote I/O reduces cabling but creates network and communication-loss requirements.

The scan cycle generally samples inputs, executes logic, updates outputs, and performs communication and diagnostics. Process-image operation provides consistency but may require interrupts or high-speed modules for short events. Correct addressing, symbolic tags, data types, scaling, range checking, and unit documentation are essential for reliable programs.

Redundancy can improve availability, but it is not equivalent to functional safety and must be evaluated for common-cause failures. Sound installation requires separation of noisy and sensitive circuits, correct grounding, surge suppression, protective devices, environmental control, lockout/tagout, and systematic commissioning. Contemporary PLC systems also require cybersecurity, controlled change management, and careful evaluation of networked and AI-assisted functions.

Key Terms

PLC: Industrial computer that executes a stored control program and interfaces with field devices.

CPU: Central processing unit that executes logic and manages PLC operations.

Backplane: Internal bus providing module communication and, where applicable, power distribution.

Rack: Mechanical structure that houses modular PLC components.

Process image: Memory representation of sampled inputs and commanded outputs.

Scan cycle: Repeated sequence of input acquisition, program execution, output update, and system services.

Digital input: Input representing discrete states such as on/off.

Digital output: Output that switches an actuator between discrete states.

Analog input: Input representing a continuously varying electrical signal.

Analog output: Output producing a continuously varying command signal.

Remote I/O: I/O located away from the main CPU and connected through a communication network.

Retentive memory: Memory whose selected values survive a power interruption.

Sourcing: Supplying current toward a load or input.

Sinking: Providing a current path toward the reference or 0 V.

Resolution: Smallest nominal input or output increment represented by a device.

Watchdog: Timing or diagnostic function that detects excessive delay or loss of expected operation.

Redundancy: Use of additional components to maintain function after selected failures.

Availability: Probability that a system is operational when required.

Functional safety: Reduction of risk through safety-related control systems and validated processes.

Symbolic addressing: Use of meaningful variable names instead of relying only on physical addresses.

Review Questions

5 Short Answer Questions

1. What are the principal functions of a PLC CPU?
2. Distinguish retentive memory from non-retentive memory.
3. What is the purpose of a process image?
4. State two advantages and two limitations of remote I/O.
5. Why is suppression often required for inductive loads?

5 Long Answer Questions

1. Explain the architecture of a modular PLC, including the CPU, power supply, rack, backplane, memory, and I/O modules.
2. Compare relay, transistor, and triac digital output modules and identify suitable applications for each.
3. Describe the PLC scan cycle and explain why a high-speed counter or interrupt may be needed.
4. Develop a systematic procedure for selecting PLC modules for a new industrial machine.
5. Explain why redundancy does not automatically provide functional safety.

3 Analytical / Application Questions

1. A 4–20 mA transmitter measures 0–100 °C. Determine the process temperature at 16 mA and explain the assumptions behind the scaling.
2. Design a basic architecture for a remote pumping station with digital valve signals, 4–20 mA level transmitters, VFDs, and a required response to communication loss. Justify the I/O and network choices.
3. A machine intermittently misses a proximity-switch pulse. Analyze possible causes involving input filtering, scan time, process-image timing, wiring, and sensor compatibility, and recommend a commissioning plan.

Multiple Choice Questions with Answers

Question 1

Which PLC component executes the user control program?

A. Power supply

B. CPU

C. Terminal block

D. Output relay

Correct Answer: B. CPU

Question 2

What is the principal purpose of a process image?

A. To store cabinet drawings

B. To provide a memory representation of sampled inputs and commanded outputs

C. To increase motor torque

D. To replace protective earthing

Correct Answer: B. To provide a memory representation of sampled inputs and commanded outputs

Question 3

Which output technology is generally suited to fast switching of DC loads?

A. Transistor

B. Triac

C. Mechanical relay only

D. Transformer

Correct Answer: A. Transistor

Question 4

A 4–20 mA transmitter has a range of 0–10 bar. What pressure corresponds to 12 mA?

A. 2 bar

B. 4 bar

C. 5 bar

D. 8 bar

Correct Answer: C. 5 bar

Question 5

Which memory type preserves selected values after a power interruption?

A. Non-retentive memory

B. Retentive memory

C. Input filter memory only

D. Temporary diagnostic buffer only

Correct Answer: B. Retentive memory

Question 6

What is a major advantage of remote I/O?

A. It eliminates all network failures

B. It reduces the need for long field cable runs

C. It removes the need for power supplies

D. It guarantees functional safety

Correct Answer: B. It reduces the need for long field cable runs

Question 7

Which issue is especially important when selecting an analog input module?

A. Keyboard layout

B. Signal range, resolution, isolation, and accuracy

C. Printer speed

D. Monitor size

Correct Answer: B. Signal range, resolution, isolation, and accuracy

Question 8

If a PLC scan time is 20 ms, its approximate scan frequency is:

A. 5 Hz

B. 20 Hz

C. 50 Hz

D. 200 Hz

Correct Answer: C. 50 Hz

Question 9

Which statement about redundancy is correct?

A. Redundancy always eliminates common-cause failures

B. Redundancy and functional safety are identical

C. Redundancy can improve availability but requires careful failure analysis

D. Redundancy removes the need for diagnostics

Correct Answer: C. Redundancy can improve availability but requires careful failure analysis

Question 10

Which installation practice best protects sensitive analog signals?

A. Route them beside motor power cables

B. Use appropriate shielding and separate them from noisy power wiring

C. Leave cable screens floating without design consideration

D. Share their return conductor with switching coils

Correct Answer: B. Use appropriate shielding and separate them from noisy power wiring