Reuse PLC clones for use with Arduino

Reuse PLC clones for use with Arduino

It is fairly common to find advertisements on online shopping pages such as: “Industrial Control Panel compatible with FX1N, FX2N, FX3U and programmable with GX software”. The price is tempting, however, the documentation is lacking, and there is no mention of how to program it with other tools like Arduino in other operating systems other than Windows. This article will introduce some basic concepts to help solve this problem.

Industrial control board compatible with factory specific PLC programming software

Main component: FX1N compatible industrial control board

Attack of the clones

These boards mention compatibility with the GX software, which is made by a Japanese company that manufactures PLCs as well as cars. At first glance, the compatibility is not official, as no trademark is printed. Their origin is unknown, perhaps they were simplified versions based on the original schematics and source code, or somehow the original binary format of the PLC was reverse engineered and an interpreter was created and run in the microcontroller to translate the code. Most cards are based on STM32 microcontrollers, and according to some articles and videos, the original programming software actually recognizes them as a genuine PLC!

Plastic container, DIN rail fitting

Because of their low cost (about US$25), isolated outputs, optically isolated inputs, RS232 serial port and regulated power supplies are great candidates for small projects as long as they can be programmed with a free cross-platform tool such as an Arduino or STM kit. Additionally, a diagram is needed to see which I/O of the microcontroller goes to which terminal on the board!

bill of materials

Component Data Sheet

Binaute Industrial Control Panels – Warehouse

Optional component data sheet

reprogramming

The above board contains an STM32F103 microcontroller, so you must instinctively look for a fingerprint of the SWD programming header.

Possible fingerprint of the programming head in the lower right

After following the paths of this header one pin was found connected to 3.3V, another to GND, but the other pins were not connected to the SWD pins on the microcontroller but to the PC10 and PC11 pins. Start searching from microcontroller, no paths from SWD or USB pins, so only alternative available for reprogramming is through UART1 using bootloader stored in ROM

Serial port related components

Following the paths that come out of the DB9 connector, it ends up in an unmarked chip, however, given the nearby capacitors, it’s probably MAX232 or equivalent. After the paths that come out of this chip, they end with the PA9 and PA10 pins of the microcontroller which are the UART1 pins.

Fortunately on this board, the resistor connected to pin BOOT0 is clearly marked on the silk screen. To start with the bootloader position, a male header is soldered to the 3.3V board and, using Dupont wire harness, a temporary connection is made between BOOT0 and 3.3V while the board is running

The method used to activate the bootloader

Once the bootloader was launched, the STM32CubeProg was launched and the connection to the microcontroller was verified. The chip was in read sandbox so there is no way to backup the firmware to mirror the board to its original state. All FLASH memory has been erased.

Using the Arduino IDE, the basic STM32duino installation went on and a small test application was created that sends data through the serial port to the PC. The application has been downloaded and the data received has been verified. Now the adventure begins!

USB to RS232 converter and connectors used to check the connection between the computer and the board

Define the I/O pins

Since there is no schematic diagram, or marks in the silkscreen showing which microcontroller I/O pins go to which terminal, this work has to be done manually, with a lot of patience to follow the paths. Fortunately, the board only has two layers, so it’s only possible to start with a double-eye jewelry magnifier and a multimeter.

LED and switch

The board has two LEDs, one labeled RUN and one labeled ERR. In addition, there is a switch that was used by the old firmware PLC to stop program execution. Since there are quite a few items between these peripherals and the microcontroller, it is very easy to get started with.

The I/O pins of the microcontroller connected to the LEDs and the switch are specified

Pins are found striped as follows:

an item

pin

LED operation

PB12

LED ERR . indicator

PB13

On/off switch

PC9

digital entries

The digital inputs were relatively easy to find, because the tracks leaving the amplifiers went directly to the microcontroller. Few of them were deceitful because they jumped into the opposite layer or moved under a large component.

Pins are found striped as follows:

an item

pin

X0

PA0

X1

PA1

X2

PB9

X3

PA6

X4

PA7

X5

PB5

X6

PB4

X7

PD2

digital output

The digital output took the most effort, because the tracks first went to the UL2003 chip, and from there to each relay, they moved under the components or jumped to the corresponding layer. The multimeter was crucial to keeping track.

Pins are found striped as follows:

an item

pin

Y0

PB8

Y1

PB1

Y2

PB10

Y3

PB0

Y4

PC5

Y5

PC 4

analog input

The analog inputs were relatively easy to find, as they are only 3 and are only connected to a resistive voltage divider (15K/30K) between them and the microcontroller.

Follow analog input paths

Pins are found striped as follows:

an item

pin

AD1

pc 1

AD2

PC2

AD3

PC0

final touches

At this point, all the peripherals are mapped to the controller’s I/O pins, however, whenever the board needs reprogramming, BOOT0 must be set to 3.3V using a time wired jumper, which means the case is open. A quick solution would be to connect a wire from pin BOOT0 to the RUN/STOP switch used by the old firmware PLC, this way the ROM bootloader can be started externally without opening the case for reprogramming

External switch now wired with pin BOOT0

Summarization

At this point, you have a low-cost board with enough peripherals to run small experiments without the need for additional hardware and can be programmed using the Arduino IDE or an STM kit. To repeat this experiment with a different board (as long as the CPU is selected), follow these steps:

  • Find the SWD header footprint on the PCB (4 pads) and follow the paths to the microcontroller to make sure the pins are the correct ones.
  • If the previous step fails, follow the paths from the UART1 pins on the microcontroller and add the additional devices (level converter and connectors) to connect to the PC
  • Find pin BOOT0, usually connected to ground through a resistor, and it will act as a “test point”
  • Using STM32CubeProg clears the FLASH memory of the microcontroller, if UART1 is used as a communication medium, the ROM bootloader should be running, with BOOT0 set to 3.3 V while booting on the board.
  • Using the Arduino IDE or an STM kit, run a test applet, which sends the characters to the serial port, to see if the board can be programmed
  • Follow the paths from the peripherals to the microcontroller, to make the I/O pin mapping
  • Make a wired connection from BOOT0 to the RUN/STOP switch for easy board programming

Possible improvements

Create a skeleton application as a boiler board for each program of the board, this application should have some kind of mechanism that checks the state of the RUN / STOP key to decide if you want to go to the ROM bootloader or start executing the program stored in FLASH, this eliminates the need for tethering The electrode is between BOOT0 and the switch.

Another option, if the skeleton application is not desirable, is to create a bootloader stored in FLASH that uses UART1 to connect, similar to that stored in ROM, but this option checks the state of the RUN/STOP key to determine if you want to download a new program or Execution of the program stored in FLASH

loading
. . . comments & more!

#Reuse #PLC #clones #Arduino

Leave a Comment

Your email address will not be published. Required fields are marked *