1. Introduction Generators are an important component of power systems, and their reliable operation is crucial for ensuring the stability of the power system. The data recorded by generator fault recording devices provides reliable evidence for personnel to correctly analyze the causes of generator faults, study accident countermeasures, and handle accidents in a timely manner. Furthermore, based on the fault recording data, it is also possible to analyze the system's fault parameters, the changing patterns of various electrical quantities, and perform fault location, all of which play a vital role in ensuring the safe and reliable operation of the power system. Programmable Logic Controllers (PLCs), as computers dedicated to industrial control, are increasingly widely used in industrial control fields in industries such as machinery, chemical engineering, rubber, and power due to their simple structure, excellent performance, good anti-interference performance, and high reliability. They have become the most important control device for real-time control in industrial control fields. This paper introduces a method for implementing generator fault recording using a programmable logic controller and extended analog modules. 2. System Composition and Working Principle The system composition diagram is shown in Figure 1, consisting of a host computer and a PLC measurement and control system. The PLC is connected to the generator set via external transmitters and transformers. The generator terminal voltage U and stator current I are three-phase AC, which are converted into three-phase 100V and 5A secondary signals by voltage transformers (PT) and current transformers (CT), respectively. The generator rotor excitation current is converted into a 75mV signal by a shunt transformer RS, and then converted into a proportional 0-10V voltage signal by a three-phase power (including active and reactive power) transmitter, a three-phase voltage transmitter, and a DC current transmitter before being input to the PLC's analog input module. The analog signal is converted to digital signal by an A/D converter, and then the generator terminal voltage U, rotor current If, active power P, and reactive power Q are calculated based on the conversion ratios of the transformers and transmitters. The PLC samples the data every 20 milliseconds and saves the sampled data to the fault data area every 40 milliseconds. When a fault occurs, the PLC records the data for 13 seconds after the fault occurs, and the fault data recording process ends. When the PLC receives the transmission command from the host computer, it transmits the recorded fault data to the host computer via serial communication. The host computer receives the complete data, processes it, and displays the waveform curves of the unit's operating quantities U, If, P, Q, and Ug (voltage setpoint) 7 seconds before and 13 seconds after the fault. This allows for generator fault analysis. In this system, the PLC used is SIMATIC S7-226; the analog module used is the EM235, which is compatible with S7-226; the PLC and computer communicate serially via a PC/PPI cable. Figure 1 shows the block diagram of the generator fault recording system. 3. Lower-level program design The PLC is the lower-level program, and its program is divided into three modules: initialization subroutine, waveform recording subroutine, and communication subroutine. The design ideas of each module will be explained below. 3.1 Initialization subroutine The initialization subroutine includes initializing the free port communication parameters, setting the start and end conditions of the receive command RCV, assigning an initial value to the data pointer, and connecting 20ms sampling, receiving, and transmitting interrupts. 3.2 Waveform Recording Subroutine The waveform recording subroutine is called during the 20ms sampling interrupt and is responsible for recording the unit's operating parameters U, If, P, Q, and Ug data for 7 seconds before and 13 seconds after a fault. A continuous data area VW4000～VW8998 is defined in the PLC to store fault data. Each operating parameter occupies a 1000-byte data block, with the following address allocation: U: VW4000～VW4998; If: VW5000～VW5998; P: VW6000～VW6998; Q: VW7000～VW7998; Ug: VW8000～VW8998. The waveform recording subroutine sends the sampled data to its respective data block every 40 milliseconds. A data pointer is defined for each data block, with its initial value pointing to the starting address of the respective data block. Each time data is transmitted, each pointer moves down 2 bytes. The data for the 7 seconds before the fault (350 bytes) is recorded cyclically. If the data is full before the fault occurs, the data pointers will re-point to the beginning of the data block. A pointer `index` is defined to record the starting position of the 20-second fault data. When the fault occurs, the data pointer points to the data for the 13 seconds after the fault (the last 650 bytes). At this time, the pointer `index` divides the data from the first 7 seconds into two parts; the correct order is to swap the two parts. After the last 13 seconds of data are recorded, the waveform recording subroutine ends. The program flowchart is shown in Figure 2. 3.3 Communication Subroutine The communication subroutine is responsible for communicating with the host computer, transmitting the fault data stored in the data area to the host computer in batches via the serial port. Each time the host computer sends a transmission command (represented by the integer 255), the PLC determines in the receive interrupt routine whether the received character is a transmission command. If so, it sets the transmission command flag M6.0 and calls the communication subroutine in the main program. A pointer `tran_pointer` is defined to point to the beginning address of the data to be transmitted, with an initial value of &VW4000, i.e., pointing to the beginning address of the data area. A variable `count` is defined to record the number of transmissions. In the communication subroutine, the free port reception is first stopped. Then, 200 bytes of data, starting at the address of pointer `tran_pointer`, are transferred to the transmit buffer and sent via the serial port using a transmit command. Each time data is transmitted, the pointer `tran_pointer` is moved down 200 bytes, the variable `count` is incremented by 1, and M6.0 is reset. When the host computer finishes sending the 26th transmit command, 5000 bytes of data in the PLC's data area VW4000～VW8998 have been transmitted. Then, the rated voltage, rated current, rated active power, rated reactive power, and pointer `index` are sent. The `count` value is cleared to zero, the pointer `tran_pointer` is reinitialized, and M6.0 is reset. This completes one fault data transmission process. [align=center]Figure 2. Waveform Recording Subroutine Flowchart[/align] 4. Host Computer Programming The host computer programming uses Visual Basic 6.0 as the platform and utilizes the MS Comm control to achieve serial communication between the computer and the PLC in an event-driven manner, completing the exchange of data. The host computer program includes user interface design, communication and data processing programs, and display programs. 4.1 User Interface Design This system designs two forms (Form1 and Form2). Form1 is the main interface, and Form2 is the waveform display interface. Form1 contains an MSComm control, a timer control (Timer1), and two button controls (Command1 and Command2). Command1 is the start button; when pressed, it initiates communication with the PLC and reads data. Command2 is the display button; when pressed, it calls Form2 to display the waveform curve of each operation. Form2 contains a picture box control (Picture1) to display graphics. 4.2 Communication and Data Processing Program Design: Set the Interval property of Timer1 to 500, the InputMode property of MSComm to binary mode, and the RThreshold property to 5010. The timer sends a transmission command every 500 milliseconds. When the 26th command is sent, the timer is turned off. At this time, the receive buffer will receive 5010 bytes of data and trigger the OnComm event of MSComm. In the OnComm event subroutine, the data in the receive buffer is sequentially distributed into the global arrays U_data, If_data, P_data, Q_data, and Ug_data, and then the percentage value is calculated according to the rated value of each operation. The first 350 bytes of each array need to be adjusted according to the pointer Index. Specifically, the data in the array index range Index~349 is moved to the front, and the data in the index range 1~Index-1 is moved to the back. 4.3 Display Program Design: Write the graphics display program in the Form_Load event of the Form2 form. First, set a custom coordinate system in the Picture1 control. Set the ScaleMode property value to 3, meaning the unit of measurement is pixels. Then, plot the coordinate axes in this coordinate system. The X-axis is in seconds, with a time interval of 40 milliseconds between two points on the curve, equivalent to 1.47 pixels. The Y-axis is in percentages, with each unit scale equivalent to 2.1 pixels. Finally, plot the waveforms of the corresponding execution quantities based on the arrays U_data, If_data, P_data, Q_data, and Ug_data. Taking the terminal voltage waveform as an example, the program is as follows: Picture1.DrawWidth = 1 'Line width is 1 Picture1.CurrentX = 0 'Specify the current coordinate position Picture1.CurrentY = U_data（0） ＊ 2.1 For i= 1 To 499 'Draw the curve Picture1.Line -（1.47 ＊ i, U_data（i） ＊ 2.1）, vbBlue Next i 5. System Operation and Experimental Results Before the system runs, the communication parameters of the PLC need to be set, including baud rate, parity method, data bits and stop bits, etc. This setting must be consistent with the host computer. When using the free port mode in S7-226 to communicate with the host computer via serial port, it can be set through the special register SMB30 (port 0) or SMB130 (port 1). The following uses the generator no-load shutdown experiment as an example to illustrate the system operation process. When the generator stops under normal no-load conditions, the PLC detects the stop signal, sets the fault flag, and records the data for 13 seconds after the stop. Running the host computer program, after pressing the "Transfer" button on the main interface, the host computer begins reading the data from the PLC. After the program prompts "Data transfer complete," pressing the "Display" button will pop up the "Waveform Display" window as shown in Figure 3. As can be seen from the figure, the curve effectively reflects the changes in generator terminal voltage and excitation current before and after the generator stops. [align=center] Figure 3 Waveform Display Window[/align] 6. Conclusion This system has been successfully applied to the excitation systems of medium and small synchronous generators. Through dynamic simulation experiments of the generator and practical applications, the system demonstrates reliable performance, convenient operation, and a user-friendly interface, effectively meeting the needs of power systems for fault recording and analysis. Generally, microcomputer control or industrial embedded generator excitation regulators with microprocessor cores can more easily achieve fault recording of generator operating parameters. Using PLC as the hardware platform for generator excitation regulators has the characteristics of low application cost and high operational reliability, but the programming is difficult. Successfully embedding fault recording of important generator operating parameters within it has great practical value, especially suitable for the hydro-turbine generator sets of the large number of small and medium-sized hydropower stations currently being developed. It is of great significance for ensuring the safe, stable and reliable operation of generator sets.