04 · Control systems · Fault finding

Control system troubleshooting and PLC fault finding

Control system troubleshooting and PLC fault finding for process and power plants in the UAE, Saudi Arabia and across the GCC. We trace faults with a structured method, find the root cause and give you a clear report with corrective actions, so the same trip does not happen twice.

17+ yearsEngineering in the GCC
S7-400HRedundant systems commissioned
UK + DubaiOffices for call-out support
Half-split control system troubleshooting on a 4-20 mA loop Half-split: test the middle, discard the healthy half TransmitterHART / NE107 Junctionbox Marshallingbarrier/relay I/O moduleAI channel Controllerscaling, logic HMItag, alarm 1st test point 2nd if bad2nd if good Measure 12.0 mA at marshalling Loop calibrator in series agrees with transmitter: field side is healthy. Next: split I/O to HMI half Reading 3.4 mA or 0 mA Below NE43 limit of 3.6 mA: fault lies upstream, in field half. Next: split at junction box Six stages, three tests at most Each measurement halves the search area. Log every reading, then confirm the root cause before closing the work order.
Half-split fault finding on a 4 to 20 mA loop: each test point halves the search area until the fault is found.
Overview

What control system troubleshooting covers

Control system troubleshooting is the disciplined search for why a plant does not do what its design says it should. A trip, a frozen reading, a valve that hunts or a network that drops out are symptoms. Our job is to find the cause quickly, restore production safely and stop the fault coming back.

01

Fault finding

Locating the failed part of a loop, panel, network or program. We work from the symptom back to the cause with measurements, not guesswork, so parts are not swapped blind and spares are not wasted.

02

Root cause analysis

Asking why the part failed. A blown fuse is a fault. The wet cable gland that let water reach the terminals is the root cause. We document the chain so your team can fix the system, not just the symptom.

03

Call-out support

Remote first-line diagnosis and engineers on site across the UAE and the wider GCC. We support Siemens PCS 7 and S7-400H systems and work across Rockwell, Schneider, ABB, Emerson, Honeywell and Yokogawa platforms.

PLC fault finding and DCS diagnostics share one principle. Every signal has a path, and every point on that path can be measured. A 4 to 20 mA input travels from the transmitter through a junction box, a marshalling cabinet and a barrier or relay to an I/O channel, then through scaling and logic to an HMI tag. If you can read the value at each point, you can find where it goes wrong. The same logic applies to a digital output, a PROFINET device or a Modbus register.

Method

A structured method for PLC fault finding

Experienced engineers look fast because they follow a fixed sequence. The sequence keeps people safe, avoids making the fault worse and produces evidence for the root cause analysis afterwards.

  1. Make it safe. Obtain the permit to work, agree isolations and confirm whether the loop is part of a safety instrumented function under IEC 61511. Any bypass or force on a safety function needs authorisation, a time limit and a record.
  2. Define the symptom precisely. Which tag, since when, after what event, how often. "Level reads wrong" is not a symptom. "LT-101 reads 0 % on the HMI while the sight glass shows about half, since the shutdown on Tuesday" is.
  3. Collect the evidence first. Read the controller diagnostic buffer, alarm and event logs, historian trends and the sequence of events before anyone resets anything. A reset can erase the only record of an intermittent fault.
  4. Split the system in half. Pick a test point near the middle of the signal path and measure. If the signal is good there, the fault is downstream. If not, it is upstream. Repeat. Six stages need at most three tests.
  5. Trace the signal. Once the area is narrow, follow the signal terminal by terminal with drawings in hand: loop diagrams to ISA-5.4, wiring schedules and the IEC 81346 reference designations that tell you exactly which device is which.
  6. Prove the cause, then fix. Reproduce the fault or show that the measurement changes when the suspected cause is removed. Then repair, retest the full loop and return it to service under the permit.

Structured troubleshooting

  • Each measurement halves the search area
  • Evidence is captured before resets and power cycles
  • Faults are proved, so the same failure is not repeated
  • Readings and actions feed straight into the report

Swap and hope

  • Good cards and instruments are replaced and lost to stock
  • Intermittent faults return after the team leaves
  • Forces and bypasses get left in place
  • No record of what was changed or why
Fault classes

Common control system faults and how we find them

Most call-outs fall into ten fault classes. Knowing the typical failure for each class tells the engineer where to put the first test point.

Fault classTypical causesHow we diagnose it
Power and earthingLow or rippled 24 V DC, failed redundancy module, tripped electronic breaker, shared 0 V, earth loops between instrument and power earth.Measure under load at the far end. Check the redundancy module alarm contacts. Measure AC ripple and 0 V to earth. SITOP RED1200, E-T-A REX12D
I/O and wiringOpen circuit, short to screen, reversed polarity, loose or partly inserted push-in terminals, wrong channel configuration.Read mA and V at the terminals. Compare with channel diagnostics for wire break and short circuit. NAMUR NE43 limits
CommunicationsPROFIBUS reflections, missing termination, PROFINET device name or IP conflicts, fibre losses, ring or PRP redundancy faults.Bus analyser, oscilloscope, switch port statistics, fibre light meter, topology view. IEC 61158, IEC 62439-3
Firmware and configurationMismatched firmware after a spare is fitted, wrong GSD or device description, hardware configuration not downloaded.Compare online and offline projects. Read module identity data and revision levels. GSD, GSDML, EDD, FDI
Logic and sequencesInterlocks that block a start, wrong scaling, timers too short, latches never reset, unauthorised changes.Online monitoring, cross-references, version compare against the last approved backup. IEC 61131-3
InstrumentsDrift, plugged impulse lines, wet DP legs, coated level probes, sensor failure reported over HART.Loop calibrator, HART communicator, comparison with a second reading. NE107 status
Control valvesStiction, deadband, positioner calibration lost, air supply problems, actuator spring or diaphragm failure.Step tests, valve signature from a smart positioner, compare demand with travel feedback. Bump and step tests
Nuisance tripsTrips with no process cause: noisy transmitters, missing delay timers, setpoints too close to normal operation.Sequence of events records, first-out logic, historian at high resolution. ISA-18.2, IEC 62682
Intermittent faultsLoose connections, heat related failures, vibration, faults that clear on reset.Data logging over days, thermal imaging, tap testing with the loop monitored. Trend at 100 ms or faster
EMC and noiseSpikes on analogue inputs when drives or radios operate, comms errors near VSDs, poor screen termination.Oscilloscope, screen and earth checks, cable route survey against segregation rules. IEC 61000-6-2, NAMUR NE21

Intermittent faults need patience, not luck

A fault that clears on reset is the hardest to find and the most expensive to ignore. We set up high-resolution trending, log the controller diagnostic buffer and, where needed, leave a data logger on the suspect loop for several days. Correlating the fault time with ambient temperature, a pump start, a radio transmission or a shift change usually points at the cause. Heat is a frequent factor in the Gulf, so we often check panel temperatures at the hottest part of the afternoon.

Diagnostic tools

Diagnostic tools for control system troubleshooting

The right tool turns a guess into a reading. Our engineers carry calibrated field equipment and use the engineering software and built-in diagnostics already in your system.

FIELD

Multimeter and loop calibrator

A true RMS multimeter checks supply, ripple and continuity. A loop calibrator measures mA in series, sources a signal to drive an input or simulates a two-wire transmitter. Intrinsically safe models are used in hazardous areas.

HART

HART communicator

HART rides a 1,200 baud FSK signal on the 4 to 20 mA loop and needs at least 250 ohms of loop resistance. A communicator reads the primary variable, range, damping, sensor diagnostics and device status without breaking the loop.

BUS

PROFIBUS and PROFINET diagnostics

For PROFIBUS DP we check termination, cable length and signal quality with a bus analyser and oscilloscope. For PROFINET we use topology tools such as Siemens PRONETA, switch port counters and packet capture from a mirror port.

PLC

Diagnostic buffers and online tools

An S7 diagnostic buffer records module faults, redundancy events and stop causes with timestamps. Equivalent logs exist on every major platform. We read them before anyone resets the controller, then compare online code with the approved backup.

STATUS

NAMUR NE107 device status

Smart devices report one of four NE107 signals: failure, function check, out of specification or maintenance required. Routing these to an asset management view tells maintenance which device needs attention before it trips the plant.

NETWORK

Network analysers and switch logs

Managed switches such as SCALANCE log link changes, CRC errors and redundancy events. On PRP networks we check that both LAN A and LAN B carry traffic, because a silent failure of one path removes your redundancy without any process upset.

Experience on redundant Siemens systems

On TenneT's 980 MW HVDC offshore wind converter platform, built by McDermott at Jebel Ali in Dubai, we commissioned two redundant Siemens S7-400H systems with CPU 410-5H processors. One ran integrated monitoring and control, the other the power management system. ET 200SP HA distributed I/O ran over PROFINET on multimode fibre, with SCALANCE XF204-2BA DNA switches for PRP networks and redundant SITOP 24 V DC supplies. That depth of work on H-systems, fibre networks and redundant power is what we bring to every fault-finding call.

Root cause

Root cause analysis and PID loop tuning

Restoring the plant is half the job. Root cause analysis explains why the failure happened, and loop tuning fixes control problems that look like equipment faults but are not.

5 WHYS

Five Whys

Quick and suited to simple, single-chain failures. The pump tripped because the motor overloaded. It overloaded because the valve was shut. Keep asking until you reach a cause you can act on, usually a process, design or maintenance gap.

FISHBONE

Ishikawa diagram

Groups possible causes under headings such as equipment, method, people, materials, environment and measurement. Useful in a workshop with operations and maintenance when several factors may have combined.

FTA

Fault tree and Apollo RCFA

Fault tree analysis to IEC 61025 works down from the top event through AND and OR gates. The Apollo method maps cause and effect with evidence for each link. We use these for repeat trips and high consequence events.

When the fault is the tuning

A loop that oscillates, overshoots or responds slowly often gets reported as a faulty transmitter or valve. Before touching the PID settings we check the loop is sound: the transmitter is scaled correctly, damping is sensible and the valve moves when asked. A valve with stiction produces a sawtooth controller output and a square-wave process variable. No amount of tuning cures that. The valve needs repair.

Once the hardware is right, we run open-loop step tests to measure process gain, dead time and time constant, then calculate settings using lambda tuning or the SIMC method. Lambda tuning lets you choose a closed-loop response time, which suits level and pressure loops that interact with other units. We trend the result, document old and new settings and change them only under your management of change procedure.

  • Check direct or reverse action and controller output limits first
  • Confirm the algorithm form, because ideal, series and parallel PID forms use different gains
  • Tune inner cascade loops before outer loops
  • Record before and after performance as variability or integrated absolute error
Standards

Standards behind our fault finding

Fault finding on a live plant is governed by the same standards as the original design. We work to them so that a repair never weakens safety or certification.

Functional safetyIEC 61511

Safety instrumented systems in the process sector. Governs bypasses, proof testing and modification of safety functions during fault finding.

Root causeIEC 62740

Root cause analysis guidance, covering methods such as Five Whys, Ishikawa and fault tree approaches.

Fault treesIEC 61025

Fault tree analysis, the formal top-down method we use for complex or repeat failures.

Device statusNAMUR NE107

Self-monitoring and diagnosis of field devices with four standard status signals.

Signal levelsNAMUR NE43

Failure signalling on 4 to 20 mA loops, with failure below 3.6 mA or above 21 mA.

FieldbusIEC 61158

Industrial communication networks, including PROFIBUS and PROFINET protocol definitions.

Redundant networksIEC 62439-3

Parallel Redundancy Protocol (PRP) and HSR for zero recovery time networks.

AlarmsISA-18.2 / IEC 62682

Alarm management lifecycle, used to rationalise nuisance alarms and trips found during call-outs.

Hazardous areasIEC 60079-17

Inspection and maintenance of electrical installations in explosive atmospheres, including intrinsically safe loops.

Call-out support

How our call-out support works

A call-out runs to a fixed pattern, whether it starts with a phone call at night or a planned visit for a recurring fault. Response targets are agreed with each client and written into the support agreement.

  1. First contact. You call +971 54 774 6012 or message us on WhatsApp. An engineer takes the symptom, the system type, recent changes and any alarms, and starts a fault record.
  2. Remote first-line diagnosis. Where your site security policy allows, we connect through your approved remote access route to read diagnostics and trends. Many faults are traced, and some fixed, without travel.
  3. Mobilisation. If a site visit is needed, we send an engineer matched to the platform with calibrated tools, laptops with the right software versions and site passes arranged in advance where possible.
  4. On-site fault finding. We follow the structured method under your permit to work: evidence first, half-split, signal tracing, proof of cause, repair and full loop retest.
  5. Handover. Before leaving we confirm the system is back to normal, all forces and bypasses are removed and any backups changed during the visit are saved and labelled.
  6. Report and corrective actions. A written service report follows, with root cause, readings, changes made and recommended corrective and preventive actions ranked by risk.
Plant tripped, cause unknownPreserve the logs, call us, and do not reset the controller until the diagnostic buffer and sequence of events are saved.
Same fault every few weeksBook a planned visit with data logging and a formal root cause analysis rather than another emergency call.
Loop oscillates or valve huntsAsk for a loop assessment: valve check, step tests and retuning in one visit.
Need cover for a shutdownWe supply engineers or full teams of 50 or 100 with supervisors through our commissioning teams service.
Deliverables

Reports and documents you receive

Every visit leaves a record your maintenance team can use. Good reports turn a single repair into a lasting improvement in plant reliability.

DocumentContentReference
Service reportSymptom, timeline, readings, cause found, repair carried out and loop retest result.Per call-out
Root cause analysis reportMethod used, evidence, cause and effect chain, root causes and contributing factors.IEC 62740 approach
Corrective action registerCorrective and preventive actions with owner, priority and target date.CAPA list
Marked-up drawingsLoop diagrams, wiring and network drawings corrected to match what was found on site.ISA-5.4, IEC 81346
Program change recordOnline changes, version compare and saved backup with reference number.IEC 61131-3 project
Loop tuning recordStep test data, old and new PID settings, before and after trends.Tuning sheet
Instrument test sheetsAs-found and as-left readings from calibrators and HART communicators.Calibration record
Bypass and force logEvery force or bypass applied, authorised by whom, and when it was removed.IEC 61511 control
GCC conditions

Control system troubleshooting in the UAE and GCC

Plants in the UAE, Saudi Arabia, Qatar, Oman, Kuwait and Bahrain fail in ways that plants in Europe rarely do. We look for the regional causes first.

HEAT

Heat and electronics

Summer ambient temperatures above 45 °C push panel interiors well beyond component ratings when cooling fails. Power supplies, I/O modules and switches age faster. We check air conditioners, filters, fan alarms and panel temperature as part of every intermittent fault investigation.

DUST

Dust, sand and humidity

Fine dust blocks filters and builds up on boards. Coastal sites in Dubai, Abu Dhabi, Doha and Jubail see high humidity and condensation overnight, which corrodes terminals and creates leakage paths. Salt-laden air attacks fibre connectors and earth bonds.

HAZ

Hazardous areas and client specs

Many oil and gas sites are classified zones under IEC 60079, so we use certified test equipment and follow IEC 60079-17. We work to client requirements such as ADNOC specifications, Saudi Aramco SAES-J instrumentation standards and the site rules of QatarEnergy and PDO.

Outdoor work is also shaped by the climate. Summer midday work restrictions apply across much of the region, so we plan field tests for early morning or evening and use remote diagnostics to keep progress moving through the hottest hours.

FAQ

Fault finding: common questions.

Short answers to what clients ask us most. For anything specific to your plant, talk to an engineer.

What is the half-split method in PLC fault finding?

Half-splitting means testing at a point near the middle of the signal path and deciding which half contains the fault. You then test the middle of the faulty half and repeat. It finds the fault in the fewest measurements, so a loop with eight stages needs at most three tests.

How do you troubleshoot a 4-20 mA loop that reads zero?

First check whether the input is below 3.6 mA, which NAMUR NE43 treats as a failure, or truly 0 mA, which suggests an open circuit or lost supply. Measure loop supply voltage, then put a loop calibrator in series at the marshalling cabinet to split the loop into field and system halves. Continue splitting until the open circuit, failed barrier or faulty transmitter is found.

What does NAMUR NE107 status mean on a smart instrument?

NE107 defines four standard status signals for field devices: failure, function check, out of specification and maintenance required. They tell operators and maintenance whether a reading can be trusted and how urgently the device needs attention. Most HART, PROFIBUS PA and Foundation Fieldbus devices support them.

Why does my control loop keep oscillating?

Common causes are valve stiction, a controller tuned too aggressively, interaction with another loop or a noisy measurement. A sawtooth controller output with a square-wave process variable points to stiction, which needs valve repair rather than retuning. We step test the process, fix any hardware problem and then retune using a method such as lambda tuning.

How do you find intermittent faults in a control system?

We capture evidence over time with high-resolution trends, controller diagnostic buffers and data loggers left on the suspect circuit. Matching the fault times to temperature, vibration, equipment starts or radio use usually reveals the cause. Thermal imaging and careful tap testing on terminals help confirm it.

Do you provide emergency call-out support in Dubai and Abu Dhabi?

Yes. We provide call-out support across the UAE and the wider GCC, starting with remote diagnosis where your site allows and mobilising engineers to site when needed. Response targets are agreed with each client and written into the support agreement.

What is the difference between fault finding and root cause analysis?

Fault finding locates the failed part and restores the system. Root cause analysis asks why that part failed, using methods such as Five Whys, fishbone diagrams, fault tree analysis or Apollo RCFA. Without it, the same failure tends to return.

Which PLC and DCS platforms do you troubleshoot?

We have deep experience of Siemens PCS 7, S7-400H redundant systems, ET 200SP HA I/O and SCALANCE networks. We also work across Rockwell, Schneider, ABB, Emerson, Honeywell and Yokogawa platforms.

Request a quote

Request fault finding or call-out support

Tell us what the system is doing, what it should be doing and when it started. An engineer will review the details, advise on remote diagnosis or a site visit and send a clear scope and price. For urgent faults call +971 54 774 6012 or message us on WhatsApp.

  • Site location and access or permit requirements
  • Control system platform, model and software version
  • Description of the fault and when it started
  • Alarm list, diagnostic buffer or event log exports
  • Recent changes, shutdowns or maintenance work
  • Loop diagrams and wiring drawings for affected circuits
  • Hazardous area classification of the work location
  • Whether any safety instrumented functions are involved
  • Remote access options permitted by site security
  • Required response time and preferred support model