IO

What is I/O (Input/Output)?

I/O (Input/Output) is the set of inputs and outputs through which a controller such as a PLC or DCS receives signals from sensors and switches (input) and sends commands to actuators such as valves, motors and lamps (output). In industrial automation, I/O is the physical boundary between software and process: a voltage, current or digital message becomes a variable inside the controller, and a variable becomes a switching output again. The number of I/O points is therefore also the usual measure of the size of an installation, from a machine with 50 points to a refinery with tens of thousands.

I/O is the bridge between the logic in the controller and the physical world.

🔌 What types of I/O are there?

Every I/O channel is a digital or analogue input or output. In addition, controllers have internal signals that behave like I/O.

The input card converts an analogue value of 4-20 mA into a number. On a 16-bit Siemens card, for example, the nominal range corresponds to 0 to 27,648, which the program scales back to, say, 0–10 bar. Under NAMUR NE 43, a measurement between 3.8 and 20.5 mA is valid, while a current of 3.6 mA or lower, or 21 mA or higher, signals a transmitter fault.

🧠 How does a PLC process its I/O?

A PLC does not read and write its I/O continuously but in a fixed cycle:

1. Read inputs - the state of all inputs is copied into the process image of the inputs (PII).
2. Execute the program - the logic works on that frozen image, even if an input changes halfway through.
3. Write outputs - the results go from the process image of the outputs (PIQ) to the physical cards.
4. Communication and diagnostics - network traffic, self-test and watchdog.

The response time from input to output is therefore the sum of the input filter, up to two program cycles and the switching time of the output. The input filter of a digital card is often adjustable; on the Siemens ET 200SP, for example, from 0.05 ms to 20 ms. A short filter reacts quickly, a longer filter suppresses contact bounce and interference on long cables.

The electrical connection of digital signals follows IEC 61131-2. That standard distinguishes three types of 24 V DC input: type 1 for mechanical contacts, type 2 for two-wire sensors with a higher quiescent current, and type 3 as a low-power variant for both contacts and two- and three-wire sensors, which is now the standard on modern cards. Whether a sensor matches the card also depends on PNP and NPN: in Europe, PNP is the standard.

📦 What is the difference between centralised and distributed I/O?

With centralised I/O, the cards sit in the rack next to the CPU and every wire runs from the field to that single control cabinet. With distributed I/O, also called O, the modules are located close to the machine or process and communicate with the controller over a network. In ProfiNET, the controller is then called the IO-Controller and the remote station the IO-Device.

Fast networks make distributed I/O suitable for real-time tasks: PROFINET IRT reaches cycle times down to 31.25 µs, and EtherCAT is widely used for motion control.

🔄 How does classic I/O compare with smart I/O?

A classic input delivers a single value. Smart variants add diagnostics and configuration:

• HART - modulates a digital signal (1200 and 2200 Hz, 1200 bit/s) onto the 4-20 mA loop, so that status and settings are available alongside the measured value.
• IO-Link - a point-to-point connection under IEC 61131-9 between an IO-Link master and a single sensor or actuator, over an unshielded three-core cable of up to 20 metres. It is therefore not a network, although the master itself is connected to a fieldbus.
• Ethernet-APL - two-wire Ethernet (10BASE-T1L) all the way to the field instruments, with trunks up to 1000 metres and spurs up to 200 metres, also in Ex zones thanks to intrinsic safety.
• Universal I/O - channels that are individually configured as AI, AO, DI or DO: in software on Honeywell Universal Process I/O and Yokogawa N-IO, or with a plug-in characterisation module per channel on Emerson DeltaV CHARMs (electronic marshalling). This saves marshalling cabinets and late changes to the wiring.

For safety functions there are dedicated safety I/O modules that communicate with a safety PLC over protocols such as PROFIsafe. These modules test their own channels and are certified up to SIL 3, so that an interlock or emergency stop keeps working reliably.

🏭 How do you approach I/O in a project?

I/O drives a large share of engineering, cabling and testing costs. A proven approach:

1. Draw up the I/O list - derive every signal from the P&ID and record the tag, type, range, unit and any safety function for each point.
2. Plan spare capacity - keep 10–20% spare channels and rack space for extensions and changes during construction.
3. Choose centralised or distributed - weigh cable length, environment (temperature, Ex zone) and maintenance.
4. Safeguard signal quality - use shielded cable for analogue signals, separate them from power cables and choose galvanically isolated cards where potential differences exist.
5. Test - verify every loop in a loop check: first during the FAT at the supplier, then during the SAT on site, from field instrument to screen.
6. Document - keep the I/O list, drawings and PLC configuration in sync; discrepancies are a well-known source of faults after maintenance.

🔐 Why does I/O matter for OT security?

I/O modules sit on the boundary between level 0 (field instruments) and level 1 (controllers) of the Purdue Model, where the digital world becomes physical. Classic remote I/O stations and fieldbus protocols usually lack authentication or encryption: anyone with access to the network can switch outputs or falsify measurements. MITRE ATT&CK for ICS therefore lists reading the process image as a separate technique (T0877, I/O Image): an attacker who knows which values the PLC sees can then replace values in a targeted way.

Stuxnet showed what that means: through the PLCs, the malware manipulated the frequency converters and valves of the centrifuge cascades, and during the valve attack it played back previously recorded, normal sensor values to the control room, a classic replay attack. Countermeasures include network segmentation of the I/O network, physical security of cabinets, configuration management of the PLC, and I/O components that meet IEC 62443-4-2.

❓ Frequently asked questions

What is the difference between a digital and an analogue input?

A digital input has only two states, on or off, for example 24 V or 0 V from a limit switch. An analogue input measures a continuous value, usually as 4-20 mA or 0–10 V, and converts it into a number with a resolution of 12 to 16 bits. You use digital I/O for switches and status signals, and analogue I/O for measurements such as pressure, temperature and level.

Why does analogue I/O often use 4-20 mA instead of 0-20 mA?

With 4-20 mA, 4 mA marks the start of the measuring range, so a current of 0 mA is recognisable as a broken cable or failed transmitter. In addition, a two-wire transmitter can draw its power from those first 4 mA. A current signal is also less sensitive to cable resistance and interference than a voltage signal.

What is remote I/O?

Remote I/O is distributed I/O: modules located close to the machine or process that communicate with the PLC over a network such as PROFINET or EtherNet/IP. It saves a great deal of cabling, because each station needs only a network and a power cable. Remote I/O is common on long production lines and in large process plants.

How much I/O does a PLC need?

The I/O count follows from the I/O list: every signal from a sensor or actuator counts as one point. A small machine has a few dozen points, a production line hundreds and a large process plant tens of thousands. In practice, engineers keep 10 to 20 percent spare capacity for extensions.

Is IO-Link a fieldbus?

No, IO-Link is a point-to-point connection between an IO-Link master and a single sensor or actuator, defined in IEC 61131-9. The master itself is connected to the PLC via a fieldbus or industrial Ethernet. IO-Link adds diagnostics and parameterisation to ordinary 24 V I/O over a standard three-wire cable.

How do you protect I/O against cyberattacks?

I/O networks usually have no authentication, so security starts with shielding the network on which remote I/O and the PLC communicate. Network segmentation, physical access control to cabinets and monitoring of PLC configurations form the basis. For new components, IEC 62443-4-2 sets requirements for the security of individual devices.

📌 In summary

I/O (Input/Output) forms the basis of automation by turning signals from sensors into data and data back into actions by actuators. Without reliable I/O there is no control, monitoring or automation in a production or process environment.

I/O consists of digital and analogue inputs and outputs, either centralised in the rack or distributed in the field. Smart technologies such as HART, IO-Link and Ethernet-APL add diagnostics, and safety I/O safeguards safety functions. Good I/O lists, spare capacity and loop checks keep a project manageable, and because I/O is where an attack becomes physical, it deserves a place in every OT security approach for SCADA, DCS and MES environments.