Industrial Automation Engineering: Practical Guide to PLC, Controls and Factory Systems

Key Takeaway

Industrial automation engineering works only when each layer has a single clear job: the field level senses and actuates, the control level decides in real time, the supervisory level shows and records, and the enterprise level plans. Blending two layers is the usual root cause of a machine that cannot be diagnosed.

1. The Four Layers of an Industrial Automation System

Most automation problems are not really control problems. They are layer problems: a task that belongs in the control layer has been pushed up into SCADA, or a safety function has been implemented in software where it cannot be trusted. Getting the layers right first makes every other decision easier.

Field level: sensing and actuating

The field level is the physical interface between the machine and the control system. Sensors convert a physical quantity into an electrical signal, and actuators convert an electrical signal back into a physical action. Limit switches, inductive proximity sensors, thermocouples, pressure transmitters, contactors, solenoid valves and variable frequency drives all live here.

The design rule for the field level is that it must work with the control system entirely de-energised. A field device that needs power to report a fault is a field device that will not report the fault that matters. This is why normally-open safety contacts and normally-closed fault contacts exist, and why a good 24 V DC diagnostic bus is worth the cost.

Control level: deciding in real time

The control level is where the machine makes its decisions. A PLC, a motion controller or an industrial PC runs a cyclic scan: read all inputs, execute the program from top to bottom, write all outputs, repeat. Everything about industrial automation engineering at this layer follows from that one fact. The scan time is the maximum time before the machine reacts, and the I/O response time is the scan time plus the output settling time.

For a machine that must react within 20 ms, a PLC with a 20 ms nominal scan and a 5 ms input filter is already too slow, and the fix is not a faster PLC, it is a different architecture.

Supervisory level: showing and recording

The supervisory level is the HMI and the SCADA server. Its job is to show the operator what is happening, record what happened, and let a human change setpoints and recipes. It explicitly is not the place for real-time decisions. A SCADA that has to poll a PLC every 100 ms to detect a jam is a design error, because the jam will have produced scrap before the SCADA notices.

Enterprise level: planning

The enterprise level is MES, ERP, and the data historian. It answers questions about output, quality and cost over days and weeks. It reads from the supervisory layer, never from the control layer directly, because a planning query has no business sharing a cycle with a servo move.

The one-way discipline

Data flows down quickly and information flows up slowly. Commands go from the top to the bottom at the speed of the slowest layer that must react. Status comes back up. When a designer mixes this, the result is either a control loop that has a 1 second delay in it, or a SCADA that cannot survive a network glitch.

Layer	Typical cycle	Failure consequence	Correct owner
Field	Continuous	Machine damage or no detection	Wiring and commissioning engineer
Control	1 to 20 ms	Missed move, unsafe condition	Controls engineer
Supervisory	0.1 to 10 s	Operator blind, no records	Automation engineer
Enterprise	Minutes to days	Bad planning decisions	IT and management

2. PLC Architecture and the Scan Cycle

The PLC scan cycle is the single most important number in industrial automation engineering, and it is the number most often ignored. Everything the PLC decides is at least one scan old.

What happens in one scan

The PLC reads the physical input modules into an input image, copies them into the program’s input variables, executes the program logic in order, computes the new output values, and then writes those to the physical output modules. The output modules usually hold their last commanded state for the duration of the next scan, which is why an output that is switched off in the program may take up to one scan plus the module’s own update time to actually switch off in the field.

For a 10 ms scan, the worst-case reaction to a physical input is therefore 10 ms of scan plus the input filter time. With the default 10 ms filter on most modules, a limit switch is not seen for up to 20 ms. If the safety requirement is 20 ms, the input filter alone has consumed the whole budget.

Scan time is not constant

Nominal scan time is measured on an idle program. Add a large loop, a string operation, a communication block or a dozen more analog scaling routines and the scan grows. On a machine that has run for a decade, the program has usually grown, and the scan time has usually grown with it. This is why the scan time should be monitored in production rather than measured once at commissioning.

Asynchronous and interrupt-driven design

The answer to a scan time that has grown too large is not always a faster CPU. Three techniques recover most of the time:

• Move slow work out of the fast loop. Recipe handling, reporting and historical logging belong in a slow task, a background job, or a separate server.
• Use high-speed inputs and counters. A high-speed counter or a high-speed input module responds in microseconds and bypasses the scan entirely. This is the correct solution for a pulse train, a high-speed counter, and a precise position capture.
• Use interrupts or a task scheduler. A time-triggered task that runs every 2 ms alongside a 20 ms cyclic task is how modern controllers handle a fast axis alongside a slow machine.

Distributed I/O changes the arithmetic

Putting the I/O modules next to the sensors and back to the control level over a fieldbus changes the timing model completely. The bus cycle becomes part of the response time, and the bus has to be designed so that the worst-case cycle time plus the controller processing time still fits the requirement. It also means the field wiring is no longer in the cabinet, which shortens the cable runs and reduces the EMC problems that plague long analogue signal paths.

3. I/O Modules and Signal Types

Choosing I/O modules is where the real cost of an automation system is set, because the modules are the interface between the ideal digital world of the program and the messy physical world of the shop floor.

Digital inputs

A digital input module reads a voltage and decides on/off. The important questions are the input voltage, the current it can source, whether the input is sinking or sourcing, and the input filter time. For a 24 V DC control system, a sinking input is the normal choice. Filter time is the setting that decides how fast a signal is seen, and it is the setting that decides whether the machine reacts in time.

Use a 0.5 ms filter on safety-relevant and high-speed signals and the 10 ms or longer default on slow signals. Setting every filter to the minimum is not a fix, it is a way of putting more noise into the controller.

Digital outputs

An output module switches a load. Solid-state outputs switch faster and need no maintenance, but they leak a small standby current and they fail shorted more often. Relay outputs switch anything and are immune to inductive kick, but they are slow, they wear, and they are the first thing to suspect when a solenoid valve works intermittently.

The sizing rule that gets broken most often: a relay output rated 2 A is not a 2 A DC load at all voltages. Most relay output modules are rated 0.5 A or 1 A for inductive loads, and a solenoid valve coil is an inductive load. Check the resistive and the inductive rating separately, and use a suppression diode or an RC snubber across every coil.

Analogue inputs

An analogue input is a measurement with a stated accuracy, and the accuracy of the whole loop is the accuracy of the weakest part in it. A 16-bit module has a resolution of 0.0015 percent of full scale, but if the transmitter is only accurate to 0.5 percent, then the loop is accurate to 0.5 percent, and no amount of resolution recovers it.

Three things ruin analogue accuracy in practice: a shared ground path with a motor circuit, unshielded cable run next to a VFD output, and a transmitter that is not galvanically isolated. Use 4 to 20 mA rather than 0 to 10 V whenever the distance exceeds a few metres, because the current signal is immune to voltage drop and is far less susceptible to induced noise. The scaling and conditioning detail is in the analogue I/O scaling guide.

Analogue outputs and positioners

An analogue output driving a control valve needs to be checked for load: the output must be able to source the current the positioner needs, and a 0 to 10 V input positioner needs a resistive load, not a current output. Getting this wrong shows up as a valve that drifts or a positioner that fails to calibrate.

Counters, encoders and high-speed modules

Pulse inputs, encoder counters and high-speed capture modules are a separate class of module with their own timing behaviour, and they are the right answer whenever the requirement is tighter than the scan cycle. A quadrature encoder counter running on the module can count at 1 MHz while the program runs at 10 ms, and the position it holds is always the true position, not a position that is one scan old.

4. Panel Design and Wiring

The control panel is the physical embodiment of the design, and a badly built panel is the reason a perfectly good automation system is unreliable.

Layout follows the signal

Divide the cabinet into vertical zones by signal type and voltage level. The top zone takes the incoming power, main isolator, main breaker, contactors and the drives. The middle zone takes the controller, I/O modules, power supply and the safety relay. The bottom zone takes field terminals, relays, cable glands and the earth bar. Keep the high current and the signal wiring in physically separate trunking, and never route a signal trunking directly above a VFD output cable, because the capacitive coupling from a VFD output into an unscreened signal cable is a reliable source of mystery faults.

Wire sizing is a voltage-drop calculation

Conductor size is chosen for voltage drop and thermal rating, and the calculation is short. For a single phase 24 V DC load, the drop is twice the one-way distance, because the return path has the same resistance. For a 10 A load running 50 m on a 1.5 mm^2 conductor with a resistivity of 0.0175 ohm mm^2/m, the loop resistance is 2 x 50 x 0.0175 / 1.5 = 1.167 ohm, and the drop is 10 x 1.167 = 11.67 V. A 24 V signal has lost half its voltage before it reaches the device. The answer is a bigger conductor, a higher supply voltage, or a distributed power supply near the load.

Terminals, ferrules and identification

Every conductor gets a ferrule crimped on the end, every terminal gets a wire number, and the wire number matches a schematic. An unfurled stranded conductor that has escaped its terminal block will cause an intermittent fault for months. It takes about twice as long to crimp a ferrule as to twist the wire in, and it is the only reason the terminal block is worth having.

Separation and segregation

Segregate power from signal, and segregate different power circuits from each other. A 24 V DC supply for sensors should be separate from the 24 V DC supply for the outputs, and both should be separate from the fieldbus. This is not tidiness: when a contactor picks up, the supply dips, and if the sensor supply and the PLC supply are the same one, the PLC sees the dip as an input change. The full panel detail is in the PLC panel design and wiring guide.

5. Industrial Networking

Industrial Ethernet is a shared medium, and the shared medium is where the timing arguments live.

Cycle time is the number that matters

Cycle time is the time for a frame to travel from the controller to every device and back. For a machine with 20 nodes, an EtherCAT system has a cycle time in the low hundreds of microseconds, while a Profinet IRT or EtherNet/IP system with comparable device counts sits in the low milliseconds. The cycle time determines how often the controller can refresh the axis setpoints, and therefore the update rate of the motion loop.

Three traffic classes

Industrial Ethernet protocols separate traffic into classes: cyclic real-time traffic (the axis setpoints), acyclic diagnostic traffic (a parameter read or a web page), and non-real-time traffic (a file transfer or a video stream). A network that carries all three without separation will show cyclic jitter when somebody opens a web browser, and the symptom looks exactly like a mechanical resonance. This is a network configuration problem, not a tuning problem.

Wiring and topology

Use shielded twisted pair cable with the shield bonded at the cabinet end only, and bond the cabinet to the plant earth through a single dedicated earth conductor. Running the network cable parallel to a VFD output cable for even a short distance will produce errors that look like a failing encoder. The protocol comparison is in the industrial Ethernet protocols guide.

When to use a fieldbus instead

Distributed I/O over a fieldbus earns its cost when the machine is large, when there are many sensors spread over long distances, or when the I/O count is in the hundreds. For a machine with 40 I/O points in one cabinet, a traditional wired I/O layout is simpler, cheaper, and more reliable than a network. The network is the answer to a wiring-distance problem, not a modernisation exercise.

6. Safety Systems

Safety is the one part of an automation system that must not depend on the software running correctly, and it is the part most often implemented in software anyway.

Two independent channels

A safety function needs two independent channels, so that a single failure does not defeat it. The two channels must not share a common cause, which means not sharing a cable, not sharing a connector, and not sharing a power supply. The monitoring detects a discrepancy between the two channels, and the discrepancy is a fault that stops the machine.

The safety relay and the safety PLC

A safety relay is the right answer for a machine with a handful of safety functions: an emergency stop, a guard door, a two-hand control, and a safe speed monitoring. A safety PLC is the right answer when the safety logic is complex, when there are many zones, or when the machine needs safe speed monitoring with a parameterised limit. The circuit design and the categories are in the machine safety circuits guide.

Stop categories

Category 0 is an immediate removal of power, which lets the machine coast to a stop. Category 1 is a controlled stop with power removal afterwards, which is what most machine axes want because a controlled stop keeps the position. Category 2 is a controlled stop with power left on. A VFD that is supposed to stop the motor safely needs the stop function built into the drive, with the control command coming from the safety circuit.

Proving it works

The safety circuit has to be tested, not just commissioned. Every safety function should have a documented test procedure that the maintenance person can run, and the test should be run at the start of every shift if the machine is in a high-risk category. An emergency stop circuit that has never been tested is an assumption, not a safety function.

7. SCADA, HMI and Alarm Management

The supervisory layer is what the operator actually sees, and a bad HMI is a machine that gets run badly.

Design the HMI around the task

An HMI screen should show the state of the machine, the state of the process, and the one or two actions the operator may take right now. Showing a screen full of analog values and no indication of what the machine is doing is a common and expensive mistake. The status colours have to be unambiguous, the alarm list has to be at the top, and the screen has to be readable from the operator’s normal position with the machine running.

Alarm management is the discipline

An alarm system has a finite capacity. When the number of alarms per shift exceeds what an operator can absorb, roughly 10 to 20 per hour, the operator starts ignoring the alarm list, and at that point the alarm system is providing no protection at all. The rules that keep it useful are: one alarm per abnormal condition, an alarm that is actionable, an alarm that is specific enough to act on, and a clear priority scheme. Rationalisation is the process of removing the alarms that do not meet those rules. The method is in the SCADA alarm management guide.

Data, not just pictures

The historian is what turns a SCADA system into something that supports continuous improvement. A trend that shows spindle load against tool number identifies a dull tool. A trend that shows servo following error against axis position identifies a mechanical resonance. The historian should keep the process values at a resolution fine enough to see a single cycle, which usually means one to ten second sampling for a machine that runs a 30 second cycle.

8. Commissioning, Documentation and Maintenance

The system is not finished when the machine runs. It is finished when somebody who did not build it can diagnose a fault at 2 am.

Commissioning is a sequence

Commissioning in the correct order saves days. First the power and the earthing, with the drives disconnected. Then the field I/O, point by point, with a test that proves the sensor state and the actuator action match the drawing. Then the safety circuit, tested against the test procedure. Then the control logic, with the drives still disabled. Then the motion, at reduced speed and reduced acceleration. Then the process, with real parts. Then the performance numbers, recorded.

The documents that matter

Four documents are worth more than all the others together: the as-built electrical schematic, the I/O list with every address, the safety function test procedure, and the program backup with a version history. A machine handed over with a program on a USB stick and no version history will lose a week the first time somebody changes a timer value.

Supportability is a design decision

Decide at design time who will support the system. If the answer is a local service engineer, use protocols and brands that have a service network in that city, and accept a higher hardware cost. If the answer is your own maintenance team, use open protocols, document the program, and keep spares. Designing for a support model that does not exist in the shop is the most common way an automation project fails after it has been delivered.

Related Reading

• PLC Selection and I/O Sizing for New Machine or Retrofit
• PLC Panel Design and Wiring: Layout, DIN Rail and Documentation
• Industrial Ethernet Protocols: Profinet, EtherNet/IP and EtherCAT Compared

Sources

1. IEC 61131-3, Programmable controllers – Programming languages
2. ISA-18.2, Management of Alarm Systems for the Process Industries
3. IEC 62443, Security of industrial automation and control systems
4. PLC Open, OpenPLC Documentation and Industrial Communications

Key Takeaways

• Industrial automation engineering has four layers and each has one job: sense, decide, show, plan.
• The PLC scan cycle is the real-time budget of the control layer. A 20 ms scan on a machine that needs 5 ms response is a design error, not a tuning problem.
• Safety is a separate system with a separate current path, not a bit in the PLC program.
• Industrial Ethernet is a shared medium. Cycle time, jitter and network load decide whether the axis keeps up with the command.
• Commissioning is a documentation activity. A machine with no as-built drawings will fail at the next breakdown, not the first.