I would love to see a teardown of an industrial PLC

[mechtonia]

I deal with industrial automation on a regular basis and often wonder what makes industrial PLC's tick. It would be great to see Dave tear one down. Even though most people probably don't encounter PLCs on a regular basis, enough people do tinker with Arduino's and similar µCs that a tear down might be interesting.

[Stonent]

I had one guy tell me that a lot of current PLCs are using 286 processors. Don't know if that is true or not.

[gocemk]

From what i was taught in my class, most modern PLC's are using 32-bit CPU's. Are they using microcontrollers or stand alone CPU's? It would be interesting to see what actually drives them. Also, it would be interesting to compare what are the differences in the CPU's among Siemens, Allen Bradley and Omron for example.

[ajb]

I cracked open a couple of the inexpensive CLICK PLCs a while ago; they use a Renesas H8S/2360 running at 8.192MHz plus a 512Kx16bit flash and 32Kx8bit SRAM.  Still have them sitting at home, I can see about cracking them open again and posting some pics.  I expect it's built down to a price, but it would be interesting to compare against a much more expensive line in terms of hardware, performance, and durability.

[rollatorwieltje]

I may be able to take a look inside a low-end Schneider PLC. Although low-end is about the feature set, not the price. These things are quite expensive. It can be programmed with some Schneider specific version of Codesys.
I don't think it will be that interesting to be honest. It would be nice if someone could pop open one that is suitable for high SIL applications.

Codesys also has some SoftPLC implementations for Windows and Linux, I think there's also one for the Raspberry Pi. So if you want to look at how to program these things, you can try it. The Codesys editor itself is free.

[mechtonia]

I may be able to take a look inside a low-end Schneider PLC. Although low-end is about the feature set, not the price. These things are quite expensive. It can be programmed with some Schneider specific version of Codesys.
I don't think it will be that interesting to be honest. It would be nice if someone could pop open one that is suitable for high SIL applications.

Codesys also has some SoftPLC implementations for Windows and Linux, I think there's also one for the Raspberry Pi. So if you want to look at how to program these things, you can try it. The Codesys editor itself is free.

I work for an industrial automation firm so there are probably tens of thousands of dollars of these things (that's right, 2 of them :-) ) just sitting around the offices. I suppose I am most curious about the source of the high cost of these versus similarly powerful µCs? In other words, is the cost due to better hardware, or is it due to the extensive testing, certifications, etc?

[arcom]

I took apart a Siemens PLC once (S7-319 PN/DP) and much to my surprise, most of it was a huge heat sink, covering the main CPU. There were 3 boards inside - PSU, ethernet/SD card (ETH controller + ETH connector, SD card connector, some LEDs and other misc. components, one of which was a supercap) and main CPU with a whole bunch of tiny passives (0402 most likely). Couldn't see the CPU board very well because I didn't have time to dig around the PLC but from what I understand, all S7 PLCs have same basic layout/construction. I really doubt that the parts inside cost more than 20% of the retail price.

There are some pictures of Simatic hardware at http://s7detali.narod.ru/

[rollatorwieltje]

That's quite a lot more than the one I may have access to, it's in the order of €600
I think the price is in the convenience. Want more inputs? Slap another I/O module on it. Want I/O 200 meters away? Slap a remote I/O module on it and it works. Same goes for sensors, motor controllers etc. No dicking around with drivers, everything is handled by the PLC itself.
_{This also means you're absolutely screwed to death when something you want to do is not (properly) supported by that PLC.}

[AlfBaz]

I may be able to take a look inside a low-end Schneider PLC.

Here's some pictures of one. I believe they were called Zelio logic plc's at one stage. I think Schneider bought them out. The software to program them use to be for free and had a built in simulator (not something you saw in higher end packages at that time)

[nowlan]

I was interested in the IO portion.

4-20ma < transceivers (by analog, ti, maxim)
10v pwm < 10v zener? I struggle to comprehend the 10v side of things, since they are 12-24v supplies.
input < opto isolators
output < relay & transistors.

I have seen diy freq to voltage adapters made.

The 10v pwm dimming on led drivers, I just nailed up with 9v.

[DutchGert]

U should have asked two months ago, I worked at Omron then as a contractor in there IA devision  .

Basically there PLC's use 32bit ARM micro-controllers from ST. The actual hardware isn't that special or high-tech. It is just VERY well engineered and very extensively verified and QC tested.
And they use ASICs for DeviceNET, Ethercat and that sort of busses which are relatively expensive.

I worked for over a year on there new NA series HMI's as a HW Engineer and was also involved in QC testing. They have lots of design rules and everything is getting reviewed very extensively when doing circuit design and layout. Every manufacturer needs to be Omron approved before u can use parts and there are very strict rules about using new components.
Design verification is uses a lot of predefined tests so nothing gets overseen and the same goes for QC testing (EMC etc).
They do there production in house so they can assure a very high quality of the product.

All the above ensures there products are stable, reliable and have a very long lifetime. And it makes them expensive of course .

[Stonent]

Yeah we had an issue with an AB PLC5 at work recently getting a lot of Ethernet collisions, rather it came to IT as "We keep getting all these FactoryTalk errors popping up".  FactoryTalk said it was getting garbage every so often from the PLC.

The PLC itself has an old 15 pin AUI Ethernet port with a external MAU attached running at 10mbit/Half Duplex. We swapped the AUI and it still was getting lots of collisions. So they priced a replacement and that board was $30,000 to replace apparently. Luckily they found they had a spare.  The newer ControlLogix PLCs they have are much cheaper and faster. My suggestion was to get some of those since we had a few running a nearby system (same robot model rather) but they require a completely new backplane.

I think it ended up being they had to change the switch from auto negotiate to just permanently on 10/half and the problems went away for the most part.

[Galenbo]

I suppose I am most curious about the source of the high cost of these versus similarly powerful µCs? In other words, is the cost due to better hardware, or is it due to the extensive testing, certifications, etc?

-Good shielding, placed next to fluor lamps and motor controllers
-A good casing, to be placed by someone who treats it like a brick
-Good screws, input/output protection.
-the cost to maintain a product line In 8 years the customer wants to click module urp3215 onto plc erc5216
-the cost to maintain firmware and software series the new soft for unit A has to work together with the old of unit B
-component buying, certification, followup, tracability
-publicity, marketing, sales,...

[poorchava]

pretty much the same as automotive industry. Every hour of engineering work has another 20hrs of paperwork behind it.

[amyk]

Those pictures above show what I was expecting, an MCU driving some relays... not that many interesting things in them IMHO.

[rollatorwieltje]

Schneider (Telemecanique) Modicon LFDC24DT M238.

Notice there are no screws at all, the casing also feels quite cheaply made.

It has 2 big boards and a small board with the expansion connector. Extra I/O modules can be connected on the side. the top board contains all the business stuff, the bottom board is just a power supply board.

It can be programmed via USB, which is quite nice. No need for a crusty USB-RS232 converter.

Interestingly it actually has a user serviceable data retention battery and one that's soldered on board.

Board pictures in my next post.

[rollatorwieltje]

Top board, it has components on both sides.

[lapm]

Considering that PLC can be there somewhere controlling something for very long time, explains the vigorous testing these plc stuff goes throw before manufacturer releases them to field. I work at factory and line i usually operate has old PLC, its been there at least 13 years, based on marking in stickers electricians have left there..

So basically buy PLC and you are paying for quality and long term operation of said device.

Basically you let that PLC sit there doing its thing.. only time you change it is if its broken, out of spare parts, out of support. That sort of reliability is not cheap.

[kuku175]

PLC's are quite boring in HW side IMO, just protected i/o, processor, memory and bus interfaces. I've teared down meany PLC's at work, including a +10k€ Omron CJ2 top of the line unit and it's just the same as sub 100€ Simens Logo PLC (or actually a programmamble relay). There is meany great DIY PLC projects in the web but these all lack one of the most important aspects of PLC's that being the software.

The high cost of these units goes to eliminating the years of design work and for future developing, mostly to the SW development.
It's not just the custom RTOS that run's in the PLC but you have to also develop and maintain the hole programming environment.
It's quite remarkable how robust the PLC system is, it will execute the program exactly right every time and will also monitor the code execution real time,
if there is a execution error it will go imidiatly to safe stete and stop the program execution.

There is +20 years old units at the field working as new, main problem with these is that it's quite hard to find working 386 laptop with proper software.

So the hardware is not so interesting as the software as one would think.

[TerraHertz]

A couple of Allen Bradley SLC 500 systems.
No, I've never used them; don't have the software. Something to get a round tuit someday.

[SeanB]

I fixed a few, bad relays ( turns out Omron relays rated at 220V 5A are not going to do 1 million cycles with a 20VA inductive load, though they will do it with a resistive load) and they tend to be reliable, though easy to fix is not part of the design philosophy. they do have good isolation on switch inputs and outputs though, you can apply mains to them with different phases to adjacent outputs or inputs with no problems. Last one I was going to change the relay, then looked and went to borrow the programmer ( it costs around 5 times the price of the PLC itself) to do a change to use the spare output next to it instead. Was a lot faster to change the one line of ladder logic than undo the unit from the DIN rail, open it and change the relay and put it all back.

[128er]

Hi,
here are some pictures of a Siemens S7 315-2 DP. It runs with a 16-bit MCU from Infineon. The other big chip beside the MCU, is a ASIC that handle the communication for the Profibus-DP interface.

Profibus ASIC ASPC2:
http://www.industry.usa.siemens.com/automation/us/en/pic/development/profibus/profibus-asics/pages/aspc2.aspx

Infinieon 16-bit MCU:
http://www.alldatasheet.com/datasheet-pdf/pdf/79489/INFINEON/SAF-C165-L25M.html

[128er]

single PCB's