PLC and SCADA basics

Electrical and Electronics Engineering (B.E./B.Tech) · Control and measurement · free study notes for exams, placements and interviews

In short

A programmable logic controller (PLC) is a ruggedised industrial computer that reads field inputs (switches, sensors, transmitters), executes a stored user program cyclically and drives outputs (contactors, valves, drives) in real time. SCADA (Supervisory Control And Data Acquisition) is the software and communication layer above it that visualises the plant, logs data, raises alarms and lets an operator change setpoints from a control room. Together they replaced hard-wired relay panels and now run almost every Indian power station, substation, water utility, cement plant, refinery, metro and packaging line. The topic is examined in Control and Instrumentation papers, in GATE-adjacent industrial-automation electives, and it is the single most asked practical area in interviews for Siemens, ABB, Rockwell, L&T, BHEL, NTPC, Tata Steel, Honeywell and system integrators — expect ladder-logic writing on paper and scan-time questions.

Explained

PLC hardware architecture

CPU module: microprocessor plus memory; executes the user program, performs self-diagnostics, maintains the watchdog timer. Memory holds the system program (firmware, ROM), user program (flash/EEPROM) and data memory (RAM for I/O image, timers, counters, registers).
Power supply module: converts 230 V AC or 24 V DC plant supply into +5 V logic and 24 V field power; sized from the backplane current drawn by all modules.
I/O modules: the only parts that touch the field. Digital input (DI) — 24 V DC or 110/230 V AC contacts; digital output (DO) — relay (slow, any load, ~2 A), transistor/MOSFET (fast, DC only), triac (AC only); analog input (AI) — 4-20 mA, 0-10 V, RTD/thermocouple; analog output (AO) — 4-20 mA to valve positioners and drives.
Optical isolation on every I/O channel separates field voltages from the logic bus; inputs also have RC/debounce filtering (typically 1-20 ms), which is why a contact bounce is usually not seen as several pulses.
Sinking and sourcing: a sourcing output supplies positive current to the load (PNP); a sinking output returns load current to 0 V (NPN). A sourcing field device must pair with a sinking input card and vice versa — a classic wiring error.
Backplane / rack, communication modules (Ethernet, serial, fieldbus), special modules (high-speed counter, motion, PID, weighing), and programming device (PC with vendor software: TIA Portal, Studio 5000, Unity Pro, CX-Programmer).
Classification by build: compact/fixed (CPU + fixed I/O in one brick, e.g. S7-1200, Micro850 — small machines); modular (rack-based, expandable — plant control); distributed/remote I/O (I/O racks in the field, linked by a bus). By size: nano/micro (under ~32 I/O), small/medium (up to a few hundred), large (thousands of I/O, redundant CPUs).
Redundancy: hot-standby CPU pairs, dual power supplies, ring networks — mandatory in practice for power plants and refineries.

The scan cycle and program execution

Internal housekeeping / self-test: memory and battery checks, watchdog reset.
Input scan: all physical input states are copied at once into the input image table (PII). The program never reads the terminal directly.
Program scan: rungs/instructions execute top to bottom, left to right, once per cycle, writing results into the output image table (PIQ).
Output scan / update: the output image is written to the physical output terminals.
Communication and diagnostics servicing, then the cycle repeats.
Scan time (cycle time) is the time for one complete pass, typically 1-20 ms; it depends on program length, instruction mix and I/O count. Throughput/response time ≈ input filter delay + up to 2 scans + output delay.
Consequence of the image-table model: a signal shorter than one scan can be missed — use latching, an interrupt/immediate I/O instruction or a high-speed counter for fast pulses.
Execution order matters: writing the same output coil on two rungs means the *last* rung wins ("double coil" fault).
Retentive vs non-retentive memory: retentive data survives a power cycle (battery/flash-backed); non-retentive clears on restart. Safety restarts must be designed, not assumed.

Programming languages (IEC 61131-3)

The international standard IEC 61131 defines PLCs; Part 3 standardises five languages: LD (ladder diagram), FBD (function block diagram), IL/STL (instruction list), ST (structured text) and SFC (sequential function chart, from Grafcet). It also defines data types (BOOL, INT, REAL, TIME), POUs (program, function, function block) and tasks. Part 2 covers equipment requirements and testing.
Ladder diagram mimics relay schematics: two power rails, rungs with contacts (conditions) and coils (actions). NO contact (--| |--) passes when the bit is 1; NC contact (--|/|--) passes when the bit is 0; output coil (--( )--), set/latch (S), reset/unlatch (R), positive/negative edge detectors.
Timers: TON (on-delay — output turns on after the preset while input stays on), TOF (off-delay), TP (pulse), and the Allen-Bradley RTO (retentive on-delay, keeps accumulated value). Each has a preset (PT), elapsed/accumulated (ET/ACC) and a time base.
Counters: CTU (up), CTD (down), CTUD (up/down), with preset, current value and reset; used for batch counts, stroke counts, bottle counts.
Other instruction groups: arithmetic (ADD, SUB, MUL, DIV), comparison (EQ, GT, LT), data move (MOV, BLOCK MOVE), logical (AND, OR, XOR), shift/rotate, jump/subroutine, SCALE/NORM-SCALE for analog conversion, and ready-made PID blocks.
Design conventions: latching (seal-in) circuit for start/stop, interlocks for mutually exclusive outputs, NC wiring for stop and emergency-stop so a broken wire stops the machine (fail-safe), and one-shot bits for edge actions.

Relay logic vs PLC vs DCS vs microcontroller

A PLC replaces relay panels with software: changes are made by editing the program, not rewiring; contact wear, coil burnout and panel size disappear; diagnostics, data logging and networking are built in. Relay logic still wins only in very small, fixed, cheap circuits and in hard-wired safety trip chains.
PLC vs DCS: PLC is machine/discrete-oriented, fast scan, logic-heavy, cheaper, programmed per controller; DCS (distributed control system — Yokogawa Centum, Honeywell Experion, ABB 800xA, Siemens PCS 7) is process-oriented, with an engineering database, many analog loops, integrated operator stations and redundancy by design, used in refineries, fertiliser and large power plants. The two have converged — modern PACs blur the line.
PLC vs microcontroller: same silicon family, but the PLC adds rugged I/O conditioning, isolation, standard languages, hot programming, EMI/vibration/temperature qualification (typically 0-55 °C, often -25 to 60 °C) and field serviceability.
Safety PLC: separate dual-channel architecture certified to IEC 61508 / IEC 61511 SIL 2-3 for emergency shutdown; a standard PLC must never be the only protection layer.

SCADA: architecture and functions

Purpose: supervise and acquire data — it does not do the fast closed-loop control; the PLC/RTU does. SCADA monitors, archives, alarms, reports and lets operators adjust setpoints.
Levels (Purdue / ISA-95 model): Level 0 field devices → Level 1 PLC/RTU control → Level 2 SCADA/HMI supervisory → Level 3 MES/plant operations → Level 4 enterprise ERP. A DMZ (Level 3.5) sits between Level 4 enterprise IT and the OT levels below it.
Components: field instruments; PLC or RTU (remote terminal unit — rugged, low-power, wide-area, often solar-powered with GSM/radio link); communication network; SCADA/MTU server (master terminal unit) running the data acquisition and historian; HMI (human-machine interface — operator graphics, trends, alarms); engineering workstation; historian database and report/dashboard clients.
Core functions: polling/data acquisition, tag database, graphic mimic displays, real-time and historical trending, alarm and event management (priority, acknowledge, time-stamp, audible), setpoint and command output, security with user roles and audit trail, report generation, redundancy and time synchronisation (NTP/GPS).
Architectures: monolithic (first generation, single mainframe) → distributed (LAN-based, second) → networked (WAN/Ethernet/open protocols, third) → IoT/cloud-based (fourth generation) with OPC UA and MQTT.
Tag types: real/physical tags (from a device), memory tags (computed), system tags; each with address, scaling, engineering unit, alarm limits and deadband.
Popular packages in India: Siemens WinCC, Rockwell FactoryTalk View, Wonderware/AVEVA InTouch, GE iFIX/CIMPLICITY, Schneider Citect, Ignition, and open-source SCADA for utilities.

Communication protocols and standards

Serial/fieldbus: Modbus RTU/ASCII over RS-485 (simple, open, master-slave, function codes 01/02/03/04/05/06/15/16), Profibus DP, DeviceNet, CANopen, HART (digital data over the 4-20 mA loop), Foundation Fieldbus.
Industrial Ethernet: Modbus TCP (port 502), PROFINET, EtherNet/IP, EtherCAT, Powerlink. IEC 61850 is the standard for substation automation (GOOSE messaging, MMS) and IEC 60870-5-101/104 and DNP3 for utility SCADA telemetry — all three are what Indian power-sector interviews probe.
OPC / OPC UA (IEC 62541): vendor-neutral data exchange between PLCs, SCADA and IT systems; OPC UA is platform-independent and secure, and underpins Industry 4.0 integration. MQTT/Sparkplug B is used for cloud telemetry.
Topologies: star, bus, ring (RSTP or vendor ring protocols for fast reconfiguration, PRP/HSR for zero-loss redundancy) — ring is standard for substation and plant backbones.
Cyber security: IEC 62443 (ISA-99) is the OT security standard — zones and conduits, defence in depth, no direct internet exposure. In India, CEA's cyber-security regulations and the CERT-In directions apply to power utilities; power-sector control systems are notified Critical Information Infrastructure under NCIIPC (Section 70A, IT Act 2000). Exact compliance timelines are revised periodically — check the current CEA/CERT-In circular rather than quoting a date.
Other relevant Indian practice: panels built as assemblies to IS/IEC 61439, with devices to IS/IEC 60947 and enclosure IS/IEC 60529 IP ratings; electrical safety under the Central Electricity Authority (Measures relating to Safety and Electric Supply) Regulations and the Electricity Act 2003; factory machinery guarding under the Occupational Safety, Health and Working Conditions Code, 2020 (OSH Code, in force 21 November 2025, which repealed the Factories Act, 1948); metering accuracy classes per IS 13779 / IEC 62053 with IS 15707 testing practice.

Key points

PLC - rugged industrial computer with isolated I/O that runs a cyclic user program for real-time control.
Scan cycle - housekeeping → input scan → program scan → output scan → communication; the program reads the input *image*, not the terminal.
Scan time - typically 1-20 ms; a pulse shorter than one scan can be missed unless latched or caught by a high-speed counter.
IEC 61131-3 - standard defining LD, FBD, IL, ST and SFC plus data types and POUs.
Ladder logic - rungs read left to right; NO contact passes on logic 1, NC contact passes on logic 0.
Fail-safe wiring - stop and E-stop buttons use NC contacts so a broken wire stops the plant.
Latching circuit - start contact OR output contact, in series with NC stop — the standard motor start/stop rung.
Sinking vs sourcing - sourcing (PNP) supplies current, sinking (NPN) returns it; mismatched pairs never work.
Output types - relay (any load, slow), transistor (fast, DC), triac (AC only).
Timers - TON delays ON, TOF delays OFF, RTO retains accumulated time through an input break.
SCADA - supervisory monitoring, alarms, trending, logging and setpoint change; it does not close the fast loop.
RTU vs PLC - RTU suits widely dispersed, low-power telemetry sites; PLC suits dense, fast local I/O.
PLC vs DCS - PLC is discrete and fast per controller; DCS is analog-loop-rich, database-driven and integrated for continuous process plants.
Purdue levels - 0 field, 1 control, 2 supervisory, 3 MES, 4 enterprise, with a DMZ between IT and OT.
Protocols - Modbus (open, simple), PROFINET/EtherNet/IP (plant Ethernet), IEC 61850 (substations), DNP3 / IEC 60870-5-104 (utility SCADA), OPC UA (interoperability).
Safety PLC - certified to IEC 61508/61511 SIL levels; a standard PLC is not a safety system.
IEC 62443 - the OT cyber-security standard; Indian power control systems are Critical Information Infrastructure under NCIIPC.
Analog resolution - an n-bit card splits the span into 2ⁿ counts; 4-20 mA is preferred because 0 mA signals a broken wire.

Formulas and examples

Scan time T_scan ≈ T_housekeeping + T_input + T_program + T_output + T_comm (ms)
Worst-case response time ≈ T_input filter + 2 × T_scan + T_output delay
Analog resolution = Full-scale span / (2ⁿ − 1); n = ADC bits
Counts → engineering value: V = V_min + (Counts/Counts_FS) × (V_max − V_min)
4-20 mA scaling: I = 4 + 16 × (V − V_min)/(V_max − V_min) mA
Discrete PID (PLC block): u_k = K_p·e_k + (K_p·T_s/T_i)·Σe_k + (K_p·T_d/T_s)·(e_k − e_{k−1}); T_s = loop sample (scan) time
Timer output: ON when accumulated time ACC ≥ preset PT
Power supply sizing: I_backplane = Σ(module current) × 1.25 (25% margin)
Max devices on an RS-485 Modbus segment = 32 standard loads (more with repeaters); max 1,200 m at low baud

Example 1 - Analog input scaling (very common exam question). A pressure transmitter outputs 4-20 mA for 0-10 bar into a 12-bit analog card spanning 0-20 mA, giving 0-4095 counts.

Counts at 4 mA = (4/20) × 4095 = 819; at 20 mA = 4095. Usable counts = 4095 − 819 = 3276.
Resolution = 10 bar / 3276 = 0.00305 bar per count (about 3.05 millibar).
If the card reads 2457 counts: measured current = (2457/4095) × 20 = 12.0 mA.
Pressure = (12.0 − 4)/16 × 10 = 5.0 bar.

Example 2 - Worst-case response time. A PLC has 8 ms scan time, input filter delay 10 ms, relay output delay 10 ms.

Response = 10 + 2 × 8 + 10 = 36 ms.
A limit switch pulse of 5 ms is shorter than one scan (8 ms) and may be missed entirely → latch it with a set/reset or use an interrupt input.

Example 3 - Ladder logic: motor start/stop with overload and run timer.

I0.0 = START (NO push button)   I0.1 = STOP (NC push button, wired NC)
I0.2 = OVERLOAD relay contact (NC, wired so healthy = 1)
Q0.0 = Motor contactor          Q0.1 = Run lamp after 5 s

Rung 1:  |--[ I0.0 ]--+--[ I0.1 ]--[ I0.2 ]----------( Q0.0 )--|
         |            |
         |--[ Q0.0 ]--+                 (seal-in / latch)

Rung 2:  |--[ Q0.0 ]----[ TON  T1, PT = 5 s ]-------------------|

Rung 3:  |--[ T1.Q ]----------------------------------( Q0.1 )--|

Pressing START energises Q0.0; the Q0.0 contact holds it after the button is released. Pressing STOP or an overload trip breaks the rung and the motor drops out and stays out.
Why STOP is shown as a NO contact in the program though the button is NC in the field: the field contact is closed when untouched, so the input bit is 1 and the rung passes; a cut wire makes the bit 0 and stops the motor.

Example 4 - Counter and batch logic. A filling line must stop the conveyor after 24 bottles and restart on a reset.

CTU counts rising edges of the photo-sensor I0.3, preset 24. When CTU.Q = 1, a rung with [ CTU.Q ]----( RESET conveyor ) drops the conveyor output; operator push button I0.4 drives the counter's reset input (CV → 0).
At 2 bottles per second the sensor pulse width is about 100 ms — comfortably longer than a 10 ms scan, so a normal DI is acceptable. At 50 bottles per second (20 ms period, ~8 ms pulse), a high-speed counter module is required.

Example 5 - Memory and power-supply sizing. A rack has a CPU (0.8 A), two 16-channel DI cards (0.1 A each), two 16-channel DO relay cards (0.35 A each), one 8-channel AI (0.25 A) and an Ethernet module (0.2 A), all from the 5 V backplane.

Σ = 0.8 + 0.2 + 0.7 + 0.25 + 0.2 = 2.15 A; with 25% margin = 2.69 A → select a 3 A (or next standard) supply.
Separately, 32 DO relay channels driving 24 V DC solenoids of 5 W each: field current if all on = 32 × 5/24 = 6.67 A, needing its own 24 V, 8-10 A field supply — never taken from the backplane.

Feature	PLC	DCS	SCADA	RTU
Primary role	Fast discrete/sequential control	Large multi-loop process control	Supervision, logging, alarms	Remote telemetry and local control
Typical scan	1-20 ms	100-500 ms per loop	1-10 s polling	100 ms-seconds
Geographic spread	One machine/plant area	One plant	Plant to nationwide	Widely dispersed sites
Analog loops	Few to moderate	Hundreds to thousands	None (supervisory only)	Few
Typical Indian use	Packaging, rolling mill, lifts	Refinery, fertiliser, thermal unit	Discom feeders, water supply, metro	Pipeline, canal, remote substation

Instruction	Function	Key parameters
TON	On-delay timer	IN, PT, ET, Q
TOF	Off-delay timer	IN, PT, ET, Q
RTO	Retentive on-delay (AB)	Preset, ACC, DN, needs RES
CTU / CTD	Count up / down	CU or CD, PV, CV, Q, R or LD
MOV	Move data	Source, Destination
SCALE	Analog scaling	Raw min/max, Eng min/max
PID	Closed-loop control	PV, SP, Kp, Ti, Td, sample time

Where it is used

Power sector: NTPC and state generating stations (DCS plus PLC for BOP — ash handling, coal handling, water treatment), substation automation to IEC 61850, and discom SCADA/DMS control centres under RDSS-funded urban feeder monitoring; load despatch centres (NLDC/RLDC/SLDC) run large SCADA/EMS systems.
Process and metals: refineries and petrochemicals (IOCL, BPCL, Reliance), fertiliser plants, cement (UltraTech, ACC — kiln and raw-mill control), Tata Steel and JSW rolling mills and sinter plants.
Water, irrigation and city infrastructure: municipal water supply and sewage treatment plants with RTU telemetry under AMRUT/Jal Jeevan Mission, Delhi/Chennai/Bengaluru metro station SCADA and tunnel ventilation, smart-city command and control centres.
Manufacturing and OEM machines: pharma packaging lines (21 CFR-style audit trails and batch reports from SCADA), automotive body shops and paint shops, textile machinery, lifts and escalators, HVAC and building management.
Job roles: automation/PLC-SCADA engineer, C&I (control and instrumentation) engineer in power plants, commissioning engineer with system integrators (L&T Technology Services, Tata Elxsi, Godrej, Siemens, ABB, Rockwell, Honeywell, Yokogawa, Emerson), service engineer, OT cyber-security analyst.
Skilling route: vendor certifications (Siemens SITRAIN, Rockwell), NSDC/Capital Goods Skill Council automation qualifications and polytechnic PLC labs are the usual entry paths; a working ladder project on a resume matters more than theory in these interviews.

Interview questions

Q: What is a PLC scan cycle and why does it matter? A: It is the repeated sequence of self-test, input scan, program execution, output update and communication; it matters because inputs are frozen in an image table for the whole pass and a signal shorter than one scan can be missed.
Q: Why is the STOP push button wired as a normally-closed contact? A: For fail-safe operation — the input stays at logic 1 when healthy, so a cut wire or loose terminal has the same effect as pressing STOP and the machine shuts down rather than running uncontrolled.
Q: Explain a latching (seal-in) rung. A: The output's own contact is placed in parallel with the momentary START contact, with the NC STOP in series, so the output holds itself on after the button is released and drops out when STOP opens.
Q: Difference between SCADA and DCS? A: SCADA is a supervisory, data-acquisition and visualisation layer over geographically or logically separate controllers; a DCS is an integrated control system with its own engineering database and controllers designed for many analog loops in one process plant.
Q: What is the difference between a PLC and an RTU? A: A PLC handles dense, fast local I/O in a plant; an RTU is designed for remote, often unmanned sites — low power, wide temperature range, built-in telemetry over radio/GSM and store-and-forward buffering.
Q: Why is 4-20 mA preferred over 0-5 V for field signals? A: Current is immune to voltage drop and noise over long cables, and the 4 mA live zero lets the system distinguish a genuine zero reading from a broken wire or dead transmitter.
Q: Which languages does IEC 61131-3 define? A: Ladder diagram, function block diagram, instruction list, structured text and sequential function chart.
Q: What is a double-coil problem? A: The same output coil is written on two rungs; since the program executes top to bottom and only the output image is transferred at the end, the last rung overrides the earlier one and the logic behaves unpredictably.
Q: Can a standard PLC be used for emergency shutdown? A: No — safety functions need a safety-rated controller and architecture certified to IEC 61508/61511 for the required SIL, usually with a hard-wired E-stop chain as well.
Q: How do you choose between relay, transistor and triac outputs? A: Relay for mixed AC/DC loads and higher current but slow switching and finite contact life; transistor for fast, frequent DC switching such as pulse outputs to a drive; triac for AC-only loads.
Q: What is OPC UA and why is it used? A: A vendor-neutral, secure, platform-independent communication standard (IEC 62541) that lets SCADA, MES and cloud systems read and write PLC data without proprietary drivers.
Q: A motor runs but the SCADA screen shows it stopped — how do you troubleshoot? A: Check the PLC output bit and card LED, then the field feedback contact wiring and the DI bit, then the tag address and scaling in SCADA, then the communication status between PLC and SCADA server — the fault is usually a missing auxiliary contact or a wrong tag address, not the logic.

Common mistakes

Believing the program reads field terminals directly and writes outputs instantly, instead of working through the input/output image tables once per scan.
Drawing a NC contact in ladder for a physically NC stop button — the field contact being closed means the bit is 1, so the program uses a NO contact.
Writing the same output coil on more than one rung, or placing a coil in the middle of a rung with contacts after it.
Confusing sinking and sourcing, and powering 24 V field loads from the 5 V backplane supply instead of a separate field supply.
Scaling analog inputs over the full card range (0-20 mA, 0-4095 counts) and forgetting the 4 mA live zero offset of 819 counts.
Expecting a PLC to catch millisecond pulses or encoder trains on an ordinary digital input instead of a high-speed counter or interrupt input.
Calling SCADA a controller, or claiming SCADA closes the control loop — it supervises; the PLC/RTU/DCS controls.