In this brief, we examine what happens to the Real-Time Clock and stored program data of the Crouzet Millenium Slim Programmable Logic Controller when the battery fails. The results show that the battery powers the RTC that lives inside the included STM32 microcontroller, and that the program data is likely stored in nonvolatile flash memory. This means that the program will not be erased due to a battery failure. This conclusion was based on removing the Crouzet Slim’s battery, leaving it out for 10 minutes, and reinstalling it.
Inside the PLC and Initial Predictions
Taking a look inside the Crouzet, the battery is easy to locate and relatively easy to remove. If a replacement battery is ever needed, the process of opening the Crouzet and taking the battery out should not require much effort and could be done with the help of a flathead screwdriver. While the PLC was open, I decided to take a closer look at the board’s supporting chips and their functionality. The full Crouzet teardown can be found here: PLC Teardown: Inside the Crouzet Millenium Slim PLC. For the purposes of this experiment, the main things I was interested in finding out by removing the battery were:
- Would the Crouzet lose its currently written program?
- Would the clock jump once the Crouzet is powered back on?
The loss of program check was the most important as a beginner with PLCs, since unintentionally losing a stored program would be a big issue to me. As for the clock, checking if the clock jumps back after the battery is taken out is a quick way to determine whether the clock is powered by the battery or not. This is generally the case for PLCs, so going into this test I assumed that the clock would likely jump and that the currently written program would be lost.
Figure 1: Top View of the Crouzet Slim’s Logic PCB
Results of a Battery Failure
Turning on the PLC after putting the battery back in gave two results. The first being that the clock reset to 00:00 as expected, which suggests that the clock is powered by the battery and then adjusted by the onboard STM32G071CBU6 Microcontroller. The second result was that the program that was loaded onto the Crouzet did not get erased, which was a pleasant surprise to me since it indicates that users would not have to worry about losing their program if anything were to happen to their battery.
This result then suggests that the program memory is held in some type of nonvolatile memory that retains data even when power is removed. At first, I thought that the program memory had to be held in the flash memory inside the STM32 Microcontroller, but taking a closer look at the logic board led me to discover the separate 25FU406C chip. After matching the markings of the chip to a datasheet close in name, I identified this chip to likely be the flash memory where the PLC stores its program data rather than relying on the microcontroller’s internal flash. I could not determine the exact size of the flash memory since the datasheet found may not be an exact match, and the Crouzet datasheet also does not give an exact number. Despite this, the Crouzet datasheet does specify a general data memory size of 2k octets (2 KB), so the user-accessible memory should be limited to that range.
Figure 2: HMI display of Crouzet once battery was reinstalled
Closer look at the Real-Time Clock
When I first opened the Crouzet, there were two main components that caught my attention while looking for which components supported the Real-Time Clock.
Figure 3: Bottom View of the Crouzet Slim’s Logic PCB
These components include the previously mentioned STM32 microcontroller and a 32C848-marked component. This chip was a little difficult to identify at first, since a specific datasheet did not appear when searching its chip markings. Instead, I chose to try and identify the chip’s functionality by tracing where the chip connects to the STM32 microcontroller’s pinout. This led to finding that the chip matches up to pins 3 and 4, which are the pins that act as the oscillator IN and OUT pins according to the STM32 microcontroller’s datasheet.
Figure 4: Schematic of the Real-Time Clock functionality
Finding this made it clear what the functionality of the 32C848 chip was. It is a 32 kHz crystal that acts as a timing reference for the Real-Time Clock, labeled RTC on the schematic. The schematic even shows that the clock is powered by VBAT, which would be the battery. This agrees with our previous findings as it would be why the clock reset after the battery is removed and reinstalled.