In an attempt to see how the battery inside a Crouzet Millenium Slim Programmable Logic Controller affects the PLC’s operation, I opened the PLC to inspect its components. As an EE student, this teardown is useful because a PLC contains many of the same blocks taught in a typical microcontroller course: a microcontroller, nonvolatile memory, communication hardware, GPIO expansion, output drivers, and protection devices. After disassembling the PLC, the figures below detail my most important findings.
Top View of the Logic PCB
Figure 1: Top View of the Crouzet Slim’s Logic PCB
As shown in Figure 1, five parts of the PCB stand out. The first was the Bluetooth Transceiver chip, which enables the PLC to connect to your computer or phone via Bluetooth. Connecting via Bluetooth allows you to interact with the Crouzet for things such as running the current program, writing program updates through Crouzet Soft, and viewing the HMI display of the Crouzet remotely. The transceiver confirms that wireless connectivity is implemented through separate communication hardware and not directly through the PLC’s main microcontroller. The second highlighted part in Figure 1 is the onboard battery. Further details about the battery and its function can be found in a separate article: What happens when the battery fails on a Crouzet Slim?, but the Crouzet datasheet guarantees a battery life of around 10 years.
Figure 2: HMI display via Bluetooth
Chip Identification Challenges
The third feature is the 25FU406C chip, which I identified as the Crouzet’s likely flash memory. At this point in the teardown, I began to see inconsistencies between the physical chip markings and what the part is called on its datasheet. From this point onward, component identities were determined mainly by comparing chip markings, determining what the components were connected to, and looking at publicly available datasheets. Sometimes an exact match couldn’t be found, so the specifications of certain components may not be fully accurate, but their functionality should remain the same. Regarding the flash memory, its presence on the board is a strong indication that the program memory is likely not dependent on the PLC’s battery for retention. This also supports Crouzet’s datasheet stating that user programs can be backed up to nonvolatile storage after at least 10 seconds of runtime.
The fourth highlighted feature is the VNI4140K-32 chip, which is a high-side solid-state relay and acts as a pin driver for the PLC’s output channels. This allows the microcontroller to control the PLC’s outputs without being directly connected to them. This reduces the risk of overcurrent damage or direct load stress on the microcontroller. Lastly, the fifth group of components highlighted in Figure 1 is a BFK and BEK chip. These components were also difficult to identify because the physical chip markings did not match to a general datasheet, but comparing the BEK and BFK markings to other components led me to identify them as TVS diodes. These components act as a voltage clamp to protect the board from a power surge. The only difference between the two is the voltage level on which it clamps.
Bottom View of the Logic PCB
Figure 3: Bottom View of the Crouzet Slim’s Logic PCB
On the reverse side of the PCB, there are two more components that stood out. The first was the STM32G071CBU6 Microcontroller, which executes the PLC’s stored program and coordinates communication between the system’s memory, communication hardware, and output circuitry. By extension, it is also responsible for communicating with external software, such as the previously mentioned Crouzet Soft program used to read and write programs to PLC. It is also related to our last component, a 32 kHz crystal oscillator which likely provides the timing reference for the PLC’s real-time clock functionality. Once connected to the STM32 microcontroller, you have a real-time clock that can also be adjusted. Overall, this teardown helped me understand which PLC functions depend on the onboard battery, and which are supported by dedicated nonvolatile hardware.