Issue 140 March 2002
Replacing Relays with Ladder Logic
Part 1: Getting Ready for the Climb

 

---

Inside the Hardware

The first thing I wanted to do with my new T100MD888+ was make it turn stuff on and off. Before I start controlling the world, it might be a good idea to provide the T100MD888+ with some power to help me with my conquests. The T100MD888+ requires between 12 and 24 VDC (preferably 24 VDC) for a power source. There’s a 12-VDC jumper that must be set if you choose to use a 12-VDC supply.

I hooked up my bench supply and cranked 24 VDC into the removable power connector of the T100MD888+, knowing that was the wrong thing to do. The engineers working at Triangle Research International didn’t design-in the removable power connectors just for me. In fact, the T100MD888+ works in hostile factory environments other than the Florida room. And, just in case something (or someone in the Florida room) takes out a T100MD888+, the removable I/O and power connectors make it easier to replace the dead or wounded T100MD888+. I am happy to report that the T100MD888+ draws 160 mA at rest.

The T100MD888+ comes standard with eight digital inputs and eight digital outputs all on removable screw-down connectors. These I/Os are multiplexed with other functions like PWM output and high-speed counter input. Each input pin has a green status LED that illuminates when the input is active. Active inputs are input voltages on the input pins between 0 and 5 VDC (preferably 0 VDC). The inactive voltage level is 24 VDC using a 24-VDC supply. The power supply and unused inputs are pulled to the inactive voltage level.

A 74HCT14 Schmitt trigger is strategically placed behind a ton of resistor networks, which are located directly behind the removable input connector. I did some probing, and sure enough, the first six inputs flow through the Schmitt trigger. That makes sense because all of the special inputs, like the high-speed counters, quadrature encoder inputs, interrupt inputs, and pulse measurement inputs are all grouped within the first six inputs. Inputs 7 and 8 are missing in action and assumed connected somehow to the processor module of the T100MD888+.

I bought a little IC-removal crowbar from Trinity Works and since then, I’ve damaged very few of the ICs I’ve removed from embedded circuit boards. So, I took the liberty to remove the 74HCT14, a 74HC595, and a 74HCT165 from the vicinity of the input connector. I applied power to the T100MD888+ and noted that my test program didn’t respond to its input but the input LEDs still illuminated when I took each of them to ground. That told me that the resistor network uses the incoming ground signal to illuminate the input status LEDs. The result also proved my theory that the 74HC595 is being used as a serial-to-parallel converter for the expansion port in conjunction with the 74HCT165 performing the expansion port parallel-to-serial conversion duty. Using a ribbon cable, you can add 40 analog and 40 digital outputs to the T100MD888+ through the expansion connector.

One last mystery in the input area is the monolithic presence of a lone 7805 voltage regulator sans external heat sink. Inspecting the circuit traces, I found the output of this regulator directly tied to the 74HCT14 Vcc pin. Well, that made sense, but what are those other two regulators doing on the other side of the board?

Using the silk screen legend I could easily make out that one of the regulators was a 7818 and its input tied directly to the incoming 24-VDC supply. Its output made a beeline to the input of the second regulator, which is surrounded by a heat sink and a couple of filter capacitors. After a surgically accurate component removal procedure, I managed to get a glimpse of the heat sink-laden voltage regulator’s markings. It’s a 7810. So, the incoming 24 VDC is passed through the 7818 and then dropped again through the 7810, which passes the 10 VDC to the 7805 in the input area of the T100MD888+. Remember the 12-VDC jumper? Now, it looks like it bypasses the 7818 input and puts the 12-VDC supply voltage directly on the input of the 7810.

I measured the voltage at the ULN2003 and ULN2803 and their supply inputs were at 24-VDC. I didn’t search out other uses of the 10 VDC because the options were obvious. The only possible places left to use it would be in the RS-232 area or to drive the two output MOSFETs.

The documentation for the PLC defines the RS-232 circuitry as a 5- to 0-VDC implementation designed to eliminate the relatively expensive integrated RS-232 IC. With the presence of ULN parts in the output area and the absence of any switching components around the MOSFETs, I discounted the use of the 10 VDC for those purposes.

The T100MD888+ output circuitry is based on a ULN2003, ULN2803, and two IRL530 MOSFETS. These devices are high-voltage, high-current, inverting current sinks that operate on TTL-level inputs. After locating the IRL530 data-sheet, I read that these are logic-level gate drive MOSFETS, which eliminates any doubt concerning the 10-VDC drive assumption I made previously.

The IRL530 MOSFETs are heavy-duty units rated to handle 10 A at 24-VDC peak and 2 A continuous each in PWM mode. The MOSFETs are located on outputs 7 and 8. Outputs 1 through 6 are composed of paralleled ULN2003 and ULN2803 gates, can provide peak currents of 1 A, and run all day at 350 mA. A 20-A removable ground terminal rounds out the power circuitry. Red LEDs provide status for the eight outputs. A 74HC595 takes care of the output status LEDs one, two, three, four, and eight as well as the RTC error, pause, and run error indicators. There’s no visible support for the remaining output status LEDs, but I’ll bet they are tied back to the engine of the T100MD888+.

The last 74H595 on the T100MD888+ circuit board supports a 2 × 16 LCD. The LCD interface is a standard 14-pin layout that can drive displays from simple 1 × 16 to 4 × 20 LCDs. There’s also a potentiometer included to adjust the LCD contrast.

In addition to being able to communicate using RS-232 and IP, the T100MD888+ uses a standard 75176 RS-485 driver IC to allow peer-to-peer networking of multiple T100MD888+ devices. The combination of the RS-232 and RS-485 ports coupled with the ability to work on the Internet or an Intranet makes for a useable PLC. Oddly though, the RS-485 connector is not removable.

Now, all that’s left to describe are a couple of memory ICs, a four-bank DIP switch, and the T100MD888+ analog interface. I/Os, timers, counters, and internal variables including DAC and PWM data are stored in an industry standard 62256 256-KB static RAM. Of course, all of this data is lost when the T100MD888+ loses power. If your application requires retention of the aforementioned data, you can purchase a piggyback module for the 62256 that adds a lithium battery and real-time clock to the T100MD888+.

I noticed that when loaded, my programs didn’t disappear when I powered down the T100MD888+ to put on one of its ICs. That’s because the actual ladder logic program is stored in nonvolatile EEPROM. The four-position DIP switch allows recovery from run-away or drop-dead programs and turns off static nonvolatile RAM if the battery/RTC option is installed.

A 15-pin female D shell connector provides the interface for six or eight ADC channels and two DAC channels. An LM317 and its sidekick potentiometer provide an adjustable voltage output on one of the D shell pins that’s referenced to analog ground.

The ADC and DAC channels are normalized for 12 bits of resolution. The actual ADC resolution is 10 bits and the DAC resolution is 8 bits. The analog hardware does its thing as normal and the ADC and DAC firmware functions perform the normalization against the data generated by the analog subsystems. The normalization is intended to prevent the ladder logic coder from having to change existing code to match higher resolution parts if they exist on the target PLC.