Corpus sync: neutrality remakes, note hygiene, datasheet relocation, transformer-split cross-refs
---
title: Programmable Logic Controllers
…174 unchanged lines
## Operating Environment {toc}
−### Controllers and I/O shall be rated for the temperature, humidity, vibration, and airborne-contaminant conditions at the installation location. {note}
+### Controllers and I/O shall be rated for the temperature, humidity, vibration, and airborne-contaminant conditions at the installation location.
### Treatment-plant and outdoor field environments are materially harsher than a clean control room: hydrogen sulfide and chlorine atmospheres, condensing humidity, and wide temperature swings degrade unprotected electronics. {note}
+### The controller temperature rating shall equal or exceed the worst-case internal enclosure temperature determined for the housing panel in [[sync/industrial-control-panels]], not the room ambient.
+
```datasheet
label: Controller Operating Temperature Range
…6 unchanged lines
```
−### The controller temperature rating shall equal or exceed the worst-case internal enclosure temperature determined for the housing panel in [[sync/industrial-control-panels]], not the room ambient.
−
### A controller in a sealed outdoor enclosure under solar load can see internal temperatures well above the rated maximum; the panel thermal calculation, not the nameplate room temperature, governs the controller rating. {note}
…2 unchanged lines
### Airborne corrosive gases (notably H2S at headworks and in collection systems, and chlorine at disinfection) attack copper and silver on circuit boards and connectors, causing intermittent and progressive failures. {note}
+### Where the installation is classified G3 (Harsh) or more severe per ANSI/ISA-71.04, conformal-coated modules shall be furnished and the housing enclosure shall provide additional gas protection (sealed enclosure, purge, or pressurization) as established in [[sync/industrial-control-panels]].
+
```datasheet
label: Corrosive-Gas Severity Class (ISA-71.04)
…7 unchanged lines
```
−### Where the installation is classified G3 (Harsh) or more severe per ANSI/ISA-71.04, conformal-coated modules shall be furnished and the housing enclosure shall provide additional gas protection (sealed enclosure, purge, or pressurization) as established in [[sync/industrial-control-panels]].
−
### Specifying conformal coating for treatment-plant and lift-station controllers is the single most effective defense against the premature electronics failure that plagues uncoated PLCs in H2S service. {note}
…3 unchanged lines
### The preferred practice is to locate the controller in a non-classified area and bring field signals out of the classified area through intrinsically safe barriers or isolators, rather than placing the controller itself in the classified location. {note}
+### Field signals entering a Class I, Division 1 location shall be protected by intrinsically safe barriers or isolators rated for the gas group, with the entity parameters of the barrier and field device verified for the loop.
+
```datasheet
label: Hazardous-Area Interface Method
…8 unchanged lines
```
−### Field signals entering a Class I, Division 1 location shall be protected by intrinsically safe barriers or isolators rated for the gas group, with the entity parameters of the barrier and field device verified for the loop.
−
### Equipment placed in a Class I, Division 2 location shall be nonincendive-rated per UL 121201 or otherwise listed for the location.
…7 unchanged lines
### A programmable automation controller (PAC) is a high-performance PLC with a larger instruction set, floating-point math, and richer communications, suited to analog-intensive process control; a conventional PLC is well suited to discrete and sequencing logic. {note}
+### The controller class shall be selected for the point count, the proportion of analog and continuous control, and the redundancy and safety requirements of the application.
+
```datasheet
label: Controller Class
…7 unchanged lines
```
−### The controller class shall be selected for the point count, the proportion of analog and continuous control, and the redundancy and safety requirements of the application.
−
## Memory and Spare Capacity {toc}
…20 unchanged lines
### A deterministic, bounded scan is the defining property of a PLC and is what makes it suitable for real-time control where a general-purpose computer is not. {note}
+### The worst-case scan time for the application program shall not exceed the specified maximum, verified by the manufacturer's scan-time estimate and confirmed in commissioning.
+
```datasheet
label: Maximum Application Scan Time
…7 unchanged lines
```
−### The worst-case scan time for the application program shall not exceed the specified maximum, verified by the manufacturer's scan-time estimate and confirmed in commissioning.
−
### Fast interlocks and protection logic that must respond faster than the main scan shall be implemented in a dedicated high-priority task or in hardware, not in the main program scan.
…5 unchanged lines
### The I/O subsystem connects the controller to the field: discrete inputs (DI) read on/off field contacts; discrete outputs (DO) command on/off field devices; analog inputs (AI) read continuous measurements; analog outputs (AO) command continuous final elements. {note}
−### The signal type of each point is set by the field device specified in [[sync/process-instrumentation]] and [[sync/control-valves-and-actuators]], and the I/O module must match it. {note}
+### The signal type of each point is set by the field device specified in [[sync/process-instrumentation]] and [[sync/control-valves-and-actuators]], and the I/O module must match it.
```datasheet
…26 unchanged lines
### The 4-20 mA current loop is the dominant analog signal in process control because it is immune to voltage drop over long runs and a 0 mA reading distinguishes a broken wire from a live zero. {note}
+### Analog inputs and outputs shall default to 4-20 mA unless the connected device requires another signal.
+
```datasheet
label: Analog Input Signal Type
…18 unchanged lines
```
−### Analog inputs and outputs shall default to 4-20 mA unless the connected device requires another signal.
−
### Where HART-capable field devices are used, HART-pass-through analog modules should be provided so that device diagnostics and configuration are available to the asset-management system without separate wiring.
…20 unchanged lines
### Channel-to-channel and field-to-logic isolation prevents a ground loop or a fault on one field circuit from corrupting other channels or damaging the controller. {note}
+### Analog channels connected to field devices with independent or floating grounds, or routed through electrically noisy areas, shall be individually channel-isolated.
+
```datasheet
label: Analog Channel Isolation
…5 unchanged lines
```
−### Analog channels connected to field devices with independent or floating grounds, or routed through electrically noisy areas, shall be individually channel-isolated.
−
### Field signals shall be wired and grounded per [[sync/conductors-and-cables]] and [[sync/grounding-and-bonding]], with shields grounded at a single point.
…2 unchanged lines
### Plants grow and field changes are constant; spare points and slots installed at construction are an order of magnitude cheaper than adding them later. {note}
+### A minimum of 20% installed and wired-to-terminal spare points of each signal type (DI, DO, AI, AO) shall be provided.
+
```datasheet
label: Minimum Installed Spare I/O per Type
…7 unchanged lines
```
−### A minimum of 20% installed and wired-to-terminal spare points of each signal type (DI, DO, AI, AO) shall be provided.
−
### A minimum of one spare chassis/rack slot, or capacity for one additional remote I/O drop, shall be provided for future module addition.
…5 unchanged lines
### In a treatment plant, distributing I/O to area panels at each process unit cuts long home-run wiring, shrinks the central panel, and localizes troubleshooting. {note}
+### The I/O distribution architecture shall be specified, selected to suit the plant layout and minimize home-run wiring.
+
```datasheet
label: I/O Distribution
…22 unchanged lines
### Redundancy is warranted where an unplanned stop has safety, regulatory, or major-cost consequences — primary effluent pumping, disinfection, and plant-critical processes — and is unnecessary cost on non-critical loads. {note}
+### The controller redundancy level shall be specified, based on the safety, regulatory, and cost consequence of an unplanned stop for the served process.
+
```datasheet
label: Controller Redundancy
…21 unchanged lines
### The switchover from primary to standby CPU shall complete within the specified maximum time without loss of I/O state or interruption of control.
−### A failover that exceeds the process's tolerance for an uncontrolled interval is no better than no redundancy; the switchover time, not merely the presence of a standby, must meet the loop requirement. {note}
+### A failover that exceeds the process's tolerance for an uncontrolled interval is no better than no redundancy; the switchover time, not merely the presence of a standby, must meet the loop requirement.
## Redundant Power and Network {toc}
### A redundant CPU protects against CPU failure but not against the loss of a single power supply or a single network path; full availability requires those paths to be redundant as well. {note}
+### Redundant controllers shall be furnished with redundant (1+1) power supplies arranged so that the failure of one supply does not interrupt the controller.
+
```datasheet
label: Power Supply Redundancy
…5 unchanged lines
```
−### Redundant controllers shall be furnished with redundant (1+1) power supplies arranged so that the failure of one supply does not interrupt the controller.
−
### Redundant controllers shall connect to the control network over redundant media paths per [[sync/process-control-networks]], so that a single network fault does not isolate the controller.
…2 unchanged lines
## Control Power Source {toc}
−### The control power source shall be conditioned and backed so that the controller rides through the power disturbances and short outages that are common at plant and remote sites. {note}
+### The control power source shall be conditioned and backed so that the controller rides through the power disturbances and short outages that are common at plant and remote sites.
```datasheet
…12 unchanged lines
### The power-supply load calculation shall demonstrate at least 25% spare capacity on each supply rail beyond the connected module and field-power load.
−### Sizing a control power supply to exactly the present load leaves no margin for the spare I/O the same specification requires to be installed; the supply must carry the spare modules' potential draw. {note}
+### Sizing a control power supply to exactly the present load leaves no margin for the spare I/O the same specification requires to be installed; the supply must carry the spare modules' potential draw.
# Time Synchronization {toc}
…4 unchanged lines
### Without synchronization each controller's clock drifts independently, and a multi-controller event sequence cannot be reconstructed because the timestamps do not agree. {note}
+### All controllers shall synchronize to a common plant time source so that timestamps across the system are consistent.
+
```datasheet
label: Time Synchronization Method
…7 unchanged lines
```
−### All controllers shall synchronize to a common plant time source so that timestamps across the system are consistent.
−
### Where sequence-of-events resolution finer than the network time accuracy is required, IEEE 1588 Precision Time Protocol shall be used and the SOE input modules shall be the time-tagging source.
…6 unchanged lines
### A safety instrumented system (SIS) is an independent layer of sensors, a safety-rated logic solver, and final elements that takes the process to a safe state when a hazardous condition is detected, designed to a target safety integrity level (SIL). {note}
### Functional safety applies only where a process hazard analysis identifies a hazard that an instrumented protection layer must mitigate — for example, overpressure, runaway chemical reaction, or a digester-gas hazard; routine water/wastewater control rarely requires a SIS. {note}
−### Where a SIS is required it shall be separate and independent from the basic process control PLC, so that a failure of the control system does not also disable the protection. {note}
+### Where a SIS is required it shall be separate and independent from the basic process control PLC, so that a failure of the control system does not also disable the protection.
```datasheet
…33 unchanged lines
### The controller's connection to peer controllers, remote I/O, and the supervisory layer shall be coordinated with and conform to [[sync/process-control-networks]]. {note}
+### The controller shall communicate with the operator and supervisory layer ([[sync/scada-and-hmi-systems]]) over the protocol coordinated for the project, exposing the tags and alarms required by the SCADA point list.
+
```datasheet
label: Primary Controller Network Protocol
…8 unchanged lines
```
−### The controller shall communicate with the operator and supervisory layer ([[sync/scada-and-hmi-systems]]) over the protocol coordinated for the project, exposing the tags and alarms required by the SCADA point list.
−
### The protocol, media, addressing, and any segmentation or security zoning shall be [[drawing: as indicated on the network architecture drawings]].
## Cybersecurity {toc}
−### Industrial controllers are network-connected and shall be hardened against unauthorized access, which is an availability and safety concern, not only a data concern. {note}
+### Industrial controllers are network-connected and shall be hardened against unauthorized access, which is an availability and safety concern, not only a data concern.
### The controller and its configuration shall follow the applicable provisions of IEC 62443 for the project's security zone, including disabling unused services and ports, changing default credentials, and controlling programming access.
…114 unchanged lines
### The spare-parts list with manufacturer part numbers shall be included in the closeout documentation.