Training PLC Architecture & Scan-Cycle Theory PLC Internals — CPU, Memory, I/O & Scan-Cycle Determinism
1 / 2

PLC Internals — CPU, Memory, I/O & Scan-Cycle Determinism

60 min PLC Architecture & Scan-Cycle Theory

PLC Internals — CPU, Memory, I/O & Scan-Cycle Determinism

A PLC is a ruggedised industrial computer whose defining characteristic is deterministic execution: the application program is run in a repeating, fixed-period scan cycle rather than an event-driven OS. Understanding the internal architecture is prerequisite to specifying scan time, diagnosing timing faults, and sizing the system for the required control bandwidth.

1. Hardware Architecture

A PLC comprises five functional blocks connected via a system bus:

  • CPU module — executes the application program, manages the scan cycle, and runs the real-time OS (RTOS). Modern PLCs use 32/64-bit RISC processors (ARM Cortex-A/R) at 400 MHz–1.5 GHz.
  • Program memory — flash or EEPROM holds the compiled ladder/ST/FBD application; typically 1–32 MB.
  • Data memory (image tables) — SRAM holds the input image (II), output image (OI), and internal coils; accessed atomically per scan.
  • I/O modules — digital I/O at 24 VDC or 120/240 VAC; analog I/O with 12–16-bit ADC/DAC at 0–10 V or 4–20 mA; specialised modules (high-speed counter, motion, safety).
  • Communication modules — PROFIBUS-DP, EtherNet/IP, PROFINET, Modbus TCP.

2. The Scan Cycle

Every scan executes four sequential phases:

$$T_{scan} = T_{IO} + T_{exec} + T_{HK} + T_{comm}$$

where $T_{IO}$ = I/O update time, $T_{exec}$ = program execution time, $T_{HK}$ = housekeeping (diagnostics, memory check), $T_{comm}$ = communication servicing. Typical values for a mid-range PLC: $T_{scan} \approx 1{-}20$ ms.

The input image update latches all physical inputs into SRAM at the start of each scan, and the output image update drives physical outputs from SRAM at the end — creating a consistent, glitch-free snapshot of the process state during logic execution. This guarantees read-consistency at the cost of one-scan latency.

3. Worst-Case Response Latency

If an input changes just after the I/O update phase, it will not be seen until the next scan. The worst-case input-to-output latency is:

$$\tau_{max} = 2 T_{scan} + T_{output\_settle}$$

The factor of 2 accounts for: (a) the input arriving just after the image update — costing one full scan before it is read — and (b) the output being driven at the end of that second scan.

4. Execution Time Analysis

Execution time per scan scales with program size and instruction type. Typical instruction timing:

  • Simple Boolean (XIC, XIO, OTE): 0.05–0.2 μs/rung
  • Arithmetic (ADD, MUL): 0.1–0.5 μs/instruction
  • PID function block: 5–20 μs
  • Structured text loop over 100 elements: ~50–200 μs

If total execution time exceeds the watchdog timer (typically 1.5–2× the nominal scan time), the PLC faults. Proper capacity planning requires profiling the worst-case execution path.

Worked Example — Sizing a Scan for a Flow Control Loop

A liquid flow control loop has a process bandwidth $f_p = 2$ Hz. The Nyquist sampling criterion requires $f_s > 2 f_p = 4$ Hz, so $T_{scan} < 250$ ms. In practice, the rule of thumb for acceptable ZOH-induced phase lag ($<10°$ at $f_p$) is:

$$T_{scan} < \frac{1}{10 f_p} = \frac{1}{20} = 50\text{ ms}$$

The selected PLC has: $T_{IO} = 0.8$ ms (64 I/O points × 0.0125 ms/point), $T_{exec} = 6$ ms (profiled application), $T_{HK} = 0.5$ ms, $T_{comm} = 2$ ms. Total: $T_{scan} = 9.3$ ms — well within the 50 ms limit. ✓

PLC Scan Cycle Timing Analyser
Sampling freq f_s =?Hz
Nyquist limit =?Hz
Total scan =?ms

Practice Problems

1. A PLC has $T_{IO}=1.2$ ms, $T_{exec}=8$ ms, $T_{HK}=0.6$ ms, $T_{comm}=3$ ms. What is the achievable control bandwidth (using the 1/10-of-scan rule)?
2. Explain why the output image update occurs at the end of the scan rather than after each rung evaluation. What would change if outputs were updated rung-by-rung?
3. A high-speed counter module bypasses the scan cycle image tables. Why is this necessary for encoder-based position feedback at 100 kHz pulse rates?
Zero-Order Hold Sampling — Frequency Response & Phase Lag