Industrial Automation — PLC, SCADA, Modbus and OPC UA

In short: A PLC is a rugged industrial controller that reads inputs, runs a control program in a deterministic scan cycle and drives outputs.

• Compared to a PC it is built for harsh environments, real-time deterministic timing, direct industrial I/O and decades of 24/7 operation, programmed in IEC 61131-3 languages.
• A microcontroller is a chip that needs custom boards, protection and certification to do the same job.

In short: Read all inputs into the input image table → execute the program top to bottom using that image → write the output image to the physical outputs → do communication and diagnostics → repeat.

• Scan time is usually milliseconds.
• Because inputs are sampled once per scan, very short pulses need high-speed inputs or interrupts.

In short: Ladder Diagram (relay-style graphics), Function Block Diagram (blocks connected by signals), Structured Text (high-level text like Pascal), Sequential Function Chart (steps and transitions for sequences), and Instruction List (assembly-like, deprecated since the 2013 edition).

• Ladder for discrete logic, ST for maths and data, SFC for sequences, FBD for process control.

In short: HMI is the operator interface for a machine or line.

• SCADA supervises many controllers over a plant or wide area — data acquisition, control, alarms, trends and reporting.
• A DCS is an integrated control system (controllers + HMI + engineering) for continuous processes like refineries and power plants, where control is distributed across controllers on a common platform.

In short: Current signals are not affected by voltage drop over long cables and are less sensitive to electrical noise.

• The "live zero" at 4 mA lets you detect a broken wire (current near 0 mA) as a fault rather than reading it as 0 %, and the 4 mA can power two-wire loop-powered transmitters.

In short: Start (NO) in parallel with a contact of the motor output, in series with Stop (NC in the field) and overload.

• Pressing Start energises the motor coil; the motor's own contact keeps the rung true after Start is released (seal-in); pressing Stop or an overload breaks the rung.
• In ST: Motor := (Start OR Motor) AND NOT Stop AND NOT Overload;.

In short: TON (on-delay): output becomes true when the input has stayed true for the preset — e.g. start a conveyor 5 s after a horn.

• TOF (off-delay): output stays true for the preset after the input turns false — e.g. keep a cooling fan running 2 minutes after the motor stops.
• CTU counts rising edges to a preset — e.g. 100 parts fill a box, then reset.

In short: A simple open request/response protocol (RTU over RS-485 serial, TCP over Ethernet on port 502).

• Data tables: coils (read/write bits — FC01/05/15), discrete inputs (read-only bits — FC02), input registers (read-only 16-bit — FC04) and holding registers (read/write 16-bit — FC03/06/16).
• 32-bit values span two registers with device-specific word order.
• It has no security, so it belongs on segmented networks.

In short: A vendor- and platform-independent standard (IEC 62541) for secure industrial data exchange.

• It provides a rich information model (typed objects, not just addresses), services for read/write/subscribe/methods/history/alarms, built-in security with certificates and encryption, and transports from client/server to PubSub over MQTT.
• It lets MES, cloud and analytics systems read machine data the same way from any vendor.

In short: Use a gateway/OPC UA layer to normalise protocols (built-in OPC UA servers, or Kepware/Ignition for S7, EtherNet/IP, Modbus), then a .NET edge service (Worker Service) that subscribes to OPC UA monitored items or polls Modbus, adds source timestamps and quality, buffers locally (store-and-forward) and publishes to MQTT/Azure IoT Hub or writes to a time-series/SQL database.

• Use a tag configuration table, a consistent naming model (ISA-95 hierarchy), and keep OT and IT networks separated by a DMZ.

Defence in depth per IEC 62443: asset inventory, segmentation into zones and conduits with firewalls and an industrial DMZ, no direct internet access to controllers, secure protocols (OPC UA with signing/encryption), strict remote access (jump host, MFA, recording), least-privilege accounts, change control and backups of PLC programs, patching in maintenance windows, OT-aware monitoring, and incident response plans that consider safety.

In short: Check the PLC online: is the HMI command bit reaching the PLC (HMI write and tag address), is the command a momentary pulse shorter than the scan or overwritten elsewhere (duplicate coil, another rung/routine), are permissives/interlocks true (stop, overload, guard, upstream conditions), any faults on the drive/VFD, the output module and contactor (output LED, fuse, wiring).

• Use cross-references and a trend of the involved bits; check the alarm log for the time of failure.

In short: Wrong register address (0- vs 1-based offset: 40001 is register 0), wrong function code (holding vs input registers), wrong data type or word/byte order for 32-bit floats, missing scaling factor (value ×10), wrong slave/unit id, or reading stale data after a communication error without checking quality.

• Compare with a tool like Modbus Poll and the device manual.