The emergence of PLC revolutionized the landscape of industrial automation. It replaced a plethora of components in relay control systems with software programming. Designers only need to consider the system's inputs and outputs, while the intermediate logic operations are implemented by software. This simplifies the design, installation, and wiring of control cabinets, thereby advancing industrial automation.
Today's PLC functionalities extend beyond logic operations to include analog data acquisition, motion control, communication, and self-diagnosis. PLCs exhibit high reliability, capable of functioning normally in harsh environments, reducing downtime, lowering the workload of maintenance personnel, and enhancing production efficiency.
The myriad advantages of PLCs make them indispensable in modern industrial control. Industrial automation manufacturers worldwide introduce their own PLC products, aiming to carve out their niche in this field.
Major PLC manufacturers worldwide include Siemens from Germany, Rockwell from the United States, Schneider from France, Mitsubishi, and Omron from Japan.
While PLCs from different companies share similar working principles, here we'll elucidate the working process (principle) of Siemens' SIMATIC PLC products as an example:
Inside the CPU of a PLC are two types of programs: the operating system and user programs. The operating system, written by the PLC manufacturer and embedded in the CPU chip, cannot be modified by users but can be updated through firmware upgrades. It manages the PLC's storage resources, calls user programs, refreshes input/output memory areas, detects interrupts, executes interrupt handling functions, detects and handles errors, and performs hot restarts of the PLC. User programs, which fulfill the project's actual requirements, are written by programmers and downloaded into the CPU for execution. Various functions within user programs rely on support from the operating system.
The CPU operates in two modes: RUN mode and STOP mode.
In STOP mode, the CPU does not execute user programs or refresh input/output process image areas but handles communication requests, executes diagnostic functions, and allows program downloads. For safety reasons, there are two options for output module values: maintaining the last value or using a substitute value. These options can be modified through hardware configuration, as shown in the diagram below:
In general, when the CPU stops, we prefer the output module values to be
0. In this case, you can select "Substitute a value" under "Reaction to
CPU STOP" and ensure that "Apply substitute value 1" is not checked.
However, if you indeed need to activate a specific output channel when
the CPU stops, then you should check "Apply substitute value 1," as
shown in the diagram below:

In the RUN mode, the CPU operates in a cyclic scanning manner, following these steps:
- Writes the values from the output process image area to the physical addresses of the peripherals.
- Reads the input values from the peripherals into the input process image area.
- Executes the main program organization block (OB1).
- Handles communication requests and performs self-diagnosis.
- Handles interrupts if any event occurs.
The time taken by the PLC to complete one cycle of scanning is known as the scan cycle. During each scan cycle, the values of peripherals (inputs/outputs) are updated only once, ensuring that the PLC's execution of programs remains unaffected by changes in external signals.
In summary, this article introduced the birth of PLCs and their internal programs (operating system and user programs), explaining the two operating modes (RUN and STOP) and how PLCs operate in these modes.
For further reading on CPU expansion, you may refer to the article "Understanding CPU in S7-1200 Hardware."