Skip to content

PLC and Industrial Automation

Abstract

The programmable logic controller (PLC) replaced the cabinets of relays that ran factory machines with a small, rugged computer that electricians could program in a notation that looked like their old wiring diagrams. It came out of a 1968 General Motors request and a New Year’s Day memo by Dick Morley, whose Modicon 084 went to GM in November 1969; Allen-Bradley under Odo Struger and Siemens with its SIMATIC line built the industry that followed. Half a century later the same controllers run assembly lines, water works, and power plants, and in 2010 a Siemens PLC became the target of Stuxnet.

Simatic S5-100U
A Siemens SIMATIC S5-100U controller with a CPU 103. Image: Alxcor, CC BY-SA 4.0, via Wikimedia Commons.

Relay Panels

Until the late 1960s the logic of a factory machine lived in its wiring. A cabinet of electromechanical relays, timers, and counters decided which motor started when which switch closed. Changing the sequence meant rewiring the cabinet, and at a car plant the sequence changed with every model year. General Motors’ Hydra-Matic transmission division wanted something that could be reprogrammed instead of rewired.

In 1968 GM Hydra-Matic issued a request for proposals for a solid-state replacement for relay control. Dick Morley later credited a paper by GM engineer Bill Stone at a 1968 conference with stating the need; other accounts name a white paper by Edward R. Clark. GM’s engineers had already looked at minicomputers and found them a poor fit: Digital Equipment’s machine was rejected, with its memory among the objections. What they wanted had to be rugged enough for the shop floor and simple enough for plant electricians to maintain.

Morley’s Memo

Richard “Dick” Morley (1932–2017) was a consulting engineer who had co-founded Bedford Associates in Bedford, Massachusetts, with George Schwenk. By his own account, which he told many times, he spent New Year’s Day 1968 hungover and two weeks late with a proposal for another system, and instead wrote a memo describing a controller: “I wrote down – honest to God, in that day – the entire programmable controller.” His list of requirements was short. No interrupts: the machine would scan its inputs, solve its logic, and set its outputs in a fixed cycle. Inputs and outputs mapped directly into memory. No software for repetitive chores. A rugged design. Slow speed, which he later called a mistake. The programming language came a few months later.

The team that built it included Mike Greenberg, Jonas Landau, and Tom Boissevain. The unit was numbered 084 because it was Bedford Associates’ 84th project. In October 1968 the founders set up a company to sell it, Modicon, for modular digital controller. GM took delivery of its first controllers in November 1969 and bought about a million dollars’ worth; General Electric bought another million dollars’ worth and sold them under its own label. Morley declined to call himself the inventor. He preferred “father of the PLC”, and said the device had been “really invented by 50 people, each of whom invented half of it”. Modicon was sold to Gould Electronics in 1977 and later passed to Schneider Electric, which still uses the brand. Modicon also created Modbus, a protocol for connecting its controllers that is still in use.

Ladder Logic

Ladder Logic Diagram
A minimal ladder diagram: a normally open contact X1 drives coil Y1, a normally closed contact X2 drives coil Y2. Image: Mithilrkadam, CC BY-SA 4.0, via Wikimedia Commons.

The language that made the PLC usable was borrowed from the people it was meant for. Electricians documented relay circuits as ladder diagrams: two vertical power rails, with horizontal rungs between them, each rung a chain of contacts ending in a coil. Ladder logic kept that picture. A rung reads “if these contacts are closed, energise this output”, and the controller evaluates all rungs on every scan. Early PLCs had also offered Boolean expressions, but ladder diagrams became the common notation because they looked like the relay schematics that plant staff already knew.

Allen-Bradley and the Name

The second company in the field became the largest in the United States. At Allen-Bradley in Milwaukee, Odo Struger reworked an existing Allen-Bradley product, the Programmable Matrix Controller, into a programmable controller and led the company’s PLC development as vice president of technology. He is credited with the acronym PLC, which distinguished the device from what was later called the personal computer. Modicon led the market into the early 1980s; Allen-Bradley overtook it in the middle of the decade, and its PLC-5 family became the standard modular design. Rockwell International bought Allen-Bradley in 1985. Struger, who also took a leading part in the IEC work on PLC programming languages, died on 8 December 1998, aged 67. Accounts still disagree on whether he or Morley should be called the inventor of the PLC.

SIMATIC

In Germany the line ran through Siemens. The trademark SIMATIC, from Siemens and Automatik, was registered in 1958. The first generation, SIMATIC G of 1959, replaced relays with transistor modules, but the logic was still defined by how the modules were wired. The SIMATIC S3 of 1973 was the first Siemens system whose logic was programmed rather than wired. The S5 followed in 1979, programmed with the STEP 5 software on a separate programming device. Its successor, the S7, arrived in 1994 in three classes (S7-200, S7-300, S7-400), together with the Profibus field network, and from 1996 Siemens sold it as part of “Totally Integrated Automation”. The S5’s product life ended on 30 September 2020, more than forty years after its launch, with many units still running in plants. The S7-1200 (2009) and S7-1500 (2013) carried the line on.

In March 1993 the International Electrotechnical Commission published IEC 61131-3, which standardised five PLC programming languages: ladder diagram, function block diagram, sequential function chart, structured text, and instruction list.

Stuxnet’s Target Layer

Before 2010 PLC security received little attention. In June 2010 the worm Stuxnet was discovered (see Stuxnet: The Cyberweapon That Used Four Zero-Days). It spread through Windows machines and USB sticks until it found a computer running Siemens’ STEP 7 engineering software. There it replaced the library STEP 7 uses to talk to the controller, s7otbxdx.dll, with its own version. Through that library it wrote malicious code blocks into specific S7-300 CPUs (type 6ES7-315-2 with a particular configuration) and hid them from anyone reading the controller’s program back. Symantec’s analysts called it the first PLC rootkit. A third attack sequence, aimed at the larger S7-417, appeared unfinished. At the Natanz enrichment plant the code varied the speed of centrifuge drives while the operators’ screens showed normal values (see The History of Cyberwar).

The weaknesses outlasted Stuxnet: in February 2021 Rockwell Automation disclosed that its Logix controllers used a hard-coded cryptographic key to verify communications with the engineering software, a flaw rated 10 out of 10 for severity.

📚 Sources