My question is how and what surge protection should I use. My thoughts are to use a surge protector for teh incoming 120v power for the plc and power supply. I was also going to add a surge protector for the peripheral devices to protect from incoming surges...does this seem extreme or necessary?
First, eliminate the idea that any protector does protection. Did you really think a protector would somehow block or absorb a destructive surges? Anything that might do that must already be inside electronics.
Second, a destructive surge does damage if that PLC is the best connection to earth. If a surge can blow through a PLC, then it easily blows through 'blocking' or 'energy absorbing' protectors. But if connected low impedance to single point ground, then nobody even knows a surge existed. That energy dissipates harmlessly in earth.
In most facilities, single point ground means wires inside every incoming cable connect low impedance (ie 'less than 10 foot') to the single point ground. All wires enter at the common (service entrance) location. All connect low impedance to one ground. Make that connection either directly or via a protector.
The term low impedance is critical. If a ground wire is inside metallic conduit, has splices, sharp bends, or bundled with other non-grounding wires, then protection is compromised. Also says why a wall receptacle safety ground is not earth ground.
That connection is either a direct wire connection (ie coax cable). Or via a protector (ie ethernet, RS-485, etc). Best protection is as close to earth ground as possible. And as much distance as possible between the protector and PLC.
Destructive surges can be hundreds of thousands of joules. Protection means you know where that energy dissipates. Again, no protector does protection. A protector only makes the connection. Protection is defined by low impedance to and quality of earth ground.
If this is a large factory, then more and careful considerations must be included. Some better facilities make the entire earth beneath a building into one big single point ground. Others have virtually no consideration because concepts are unknown. Such as impedance mistakenly assumed to be resistance.
If a surge need not find earth destructively via the PLC, then superior protection already in the PLC is more than sufficient.
Same rules apply to sensors in another building. Each building must have its own single point earth ground. Any wire that enters (or leaves) either building must make that low impedance connection to earth.
If these concepts are ignored, then a lightning strike anywhere to one building can become a direct strike to connected electronics in that other building. We are talking about transients that occur maybe once every seven years. A number that can vary significantly even with geology or how a building is constructed.
Protection is never defined by a protector. Protection is defined by what a protector connects to. A protector is only as effective as its earth ground.