🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Manufacturing & Marine › Robotics / Mechatronics › Programmable Logic Controllers for Mechatronics › Lesson 12
MFG-MECH15-02 · Lesson 12 · 23 clock hours · lab

PLC Fault Diagnosis and Systematic Troubleshooting Capstone Lab

Objective. Students will systematically locate and correct a minimum of six pre-seeded PLC faults spanning hardware, wiring, and program-logic categories using a structured diagnostic procedure and document findings in a fault log.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by a licensed engineer or certified journey-level tradesperson or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

PLC Fault Diagnosis and Systematic Troubleshooting Capstone Lab

Why Systematic Troubleshooting Matters

A random approach to fault-finding wastes time and can create new problems. Industrial maintenance technicians are expected to restore production quickly and safely, every time. A structured five-step procedure — observe → isolate → hypothesize → repair → verify — turns an overwhelming machine problem into a series of manageable decisions. This capstone lab puts that procedure into practice on real PLC trainer hardware with pre-seeded faults covering hardware, wiring, and program-logic categories.

---

Step 1 — Safety First: Lockout/Tagout Before Any Wiring Work

Before touching wiring, terminals, or modules, follow OSHA 29 CFR 1910.147 lockout/tagout (LOTO) requirements:

1. Notify affected personnel.

2. Identify all energy sources (electrical, pneumatic, stored spring, gravity).

3. Shut down the equipment using the normal stopping procedure.

4. Isolate every energy source using the proper isolating device.

5. Apply your personal lock and tag to each isolating device.

6. Release or restrain stored energy (discharge capacitors, bleed air lines, block gravity loads).

7. Verify absence of voltage with a calibrated DMM — test line-to-line, line-to-neutral, and line-to-ground. This step aligns with NFPA 70E verification requirements.

Your instructor must initial the fault log for each wiring change to confirm LOTO was executed correctly. Program edits performed through software while the PLC is in Program mode with outputs disabled do not require de-energizing the panel, but confirm the machine is safe and outputs are suppressed before making any online change.

---

The Five-Step Diagnostic Procedure

1. Observe the symptom. Read indicator lights, fault codes, and HMI alarms. Note exactly what the system does and does not do. Write this down before touching anything.

2. Isolate the section. Divide the system into zones — input field devices, input module, CPU/program logic, output module, output field devices. Decide which zone is most likely. Use the PLC's online diagnostic tools: status of input and output bits, module fault LEDs, and the I/O force table.

3. Test your hypothesis. Choose one specific test — measure voltage at a terminal, force an output bit, compare a tag value to what you expect — and predict the result if your hypothesis is correct. Run the test, record the measured value, and compare to the expected value.

4. Repair. Correct only what your test confirmed is faulty. Common actions: replace a blown fuse, correct a transposed wire, fix a tag address in a rung, change a timer preset to the correct time base, add a missing seal-in contact, or correct an analog scaling formula.

5. Verify. Restore power under LOTO release procedures, cycle the machine through normal operation, and confirm the symptom is gone and no new faults have been introduced. Document the result.

---

Categories of Faults You Will Encounter

Hardware faults include blown fuses on output modules, failed indicators, or a module seated incorrectly. The module fault LED and processor diagnostics will usually flag these. Use your DMM to check supply voltage at the module power terminals.

Wiring faults include transposed wires (two signal wires switched at the terminal strip), an open circuit (wire not landed under the screw), or a wire landed on the wrong terminal number. Trace the circuit from the field device to the module terminal using the wiring diagram. Use the DMM in continuity or DC voltage mode to confirm signal presence at each node.

Program-logic faults are software problems: a wrong tag address in a rung contacts the wrong bit; a timer preset entered in the wrong time base (milliseconds vs. seconds) causes timing errors; a missing seal-in contact causes a momentary push-button to fail to latch a coil; an analog scaling formula uses the wrong span or offset, producing readings that are shifted or inverted.

---

Analog Scaling — A Common Program-Logic Fault

Many PLCs scale a 4–20 mA sensor signal to engineering units using a linear formula:

```

EU = (Raw – Raw_min) × (EU_max – EU_min) / (Raw_max – Raw_min) + EU_min

```

A common seeded fault is swapping EU_max and EU_min, which inverts the reading, or entering the wrong raw counts for the 4 mA and 20 mA endpoints. Check the module documentation for its count range (often 0–32767 or 6242–31208 for 4–20 mA), verify the formula coefficients in the program, and compare the live tag value to a DMM measurement of the actual current loop.

---

Using PLC Software Diagnostics

Go online with the PLC in Run mode and use these tools:

---

Fault Log Requirements

Each of the six faults must be documented with five fields:

| Field | What to record |

|---|---|

| Symptom | What the machine or display showed |

| Test performed | The specific measurement or software check |

| Measured value | Actual reading with units |

| Root cause | The exact fault (e.g., "Fuse F3 open on Output Module slot 2") |

| Corrective action | What you did to fix it |

Incomplete entries will be flagged during peer review. You must earn a minimum of 5 out of 6 correct root causes with accurate corrective actions documented to pass this lab.

Key terms10

Lockout/Tagout (LOTO)An energy-control procedure required by OSHA 29 CFR 1910.147 that isolates all hazardous energy sources and applies a personal lock and tag before any servicing or wiring work begins.
Verify absence of voltageA mandatory NFPA 70E step in which a calibrated DMM is used to confirm that no voltage is present at the work location before touching conductors or terminals.
Seal-in contactAn auxiliary normally-open contact wired in parallel with a momentary push-button and controlled by the same output coil; it latches the coil on after the button is released.
I/O Force TableA PLC software feature that allows the technician to force an input or output bit to a known state (0 or 1) to isolate whether a fault is in the field wiring or in program logic.
Tag addressThe symbolic or numeric identifier assigned to a memory location in the PLC; an incorrect tag address in a rung instruction causes it to read or write the wrong data.
Timer time baseThe unit of time (typically seconds or milliseconds) used by a PLC timer instruction; entering a preset value in the wrong time base causes timing that is 1,000 times too fast or too slow.
4–20 mA analog scalingA linear conversion formula that maps the raw count range of an analog input module (corresponding to 4 mA and 20 mA) to engineering units such as PSI, °F, or GPM.
Module fault LEDAn indicator on an I/O module that illuminates or changes color when the module detects an internal fault such as a blown output fuse or a wiring short, providing a quick visual clue during diagnosis.
Rung continuityThe online display in PLC programming software showing which contacts are TRUE (closed, shown green) and which are FALSE (open), allowing a technician to trace exactly where logical power flow is blocked.
Root causeThe fundamental, specific defect that produced the observed symptom; identifying the root cause (rather than just the symptom) ensures the repair prevents recurrence.

Worked examples4

1. An analog pressure transmitter rated 0–150 PSI outputs 4–20 mA. The PLC analog input module produces raw counts of 0 at 4 mA and 32767 at 20 mA. The technician suspects the scaling formula in the program swaps EU_max and EU_min. The live tag reads 112.5 PSI when the actual pressure gauge reads 37.5 PSI. Confirm the error and state the correct formula output at a raw count of 8192.
  1. Step 1 — Identify the correct formula: EU = (Raw – Raw_min) × (EU_max – EU_min) / (Raw_max – Raw_min) + EU_min, where Raw_min = 0, Raw_max = 32767, EU_min = 0, EU_max = 150.
  2. Step 2 — Calculate correct EU at Raw = 8192: EU = (8192 – 0) × (150 – 0) / (32767 – 0) + 0 = 8192 × 150 / 32767 = 1,228,800 / 32767 ≈ 37.5 PSI.
  3. Step 3 — Determine what the faulty formula produced: if EU_max and EU_min are swapped, the formula becomes EU = (8192) × (0 – 150) / 32767 + 150 = (8192 × –150) / 32767 + 150 = –1,228,800 / 32767 + 150 ≈ –37.5 + 150 = 112.5 PSI.
  4. Step 4 — Confirm the diagnosis: the faulty formula inverts the span and offsets by EU_max (150), producing 112.5 PSI instead of 37.5 PSI. The root cause is swapped EU_max and EU_min constants in the scaling instruction.
  5. Step 5 — Corrective action: open the scaling rung in the PLC program, set EU_min = 0 and EU_max = 150 in the correct positions, download the corrected program (with outputs disabled), then verify the live tag reads approximately 37.5 PSI to match the gauge.
Answer: The correct EU output at a raw count of 8192 is approximately 37.5 PSI. The faulty formula (swapped limits) produced 112.5 PSI. Correcting EU_min to 0 and EU_max to 150 in the scaling instruction resolves the fault.
2. A PLC timer instruction (TON) is set with a preset of 30 and is programmed in a platform where the time base is milliseconds. The process requires a 30-second delay. The timer energizes and immediately sets its Done (DN) bit. What is the actual delay the timer is producing, and what corrective action is required?
  1. Step 1 — Determine the actual delay: the preset is 30 and the time base is milliseconds, so the timer times out after 30 ms = 0.030 seconds.
  2. Step 2 — Compare to requirement: the process requires 30 seconds = 30,000 ms.
  3. Step 3 — Identify the fault: the preset value of 30 is correct for seconds but was entered in a timer configured for milliseconds, making the delay 1,000 times too short (30 ms instead of 30,000 ms). The DN bit sets almost instantly.
  4. Step 4 — Corrective action: change the timer preset from 30 to 30,000 (keeping the time base in milliseconds), or reconfigure the timer instruction to a seconds time base and leave the preset at 30, depending on the platform options. Verify by watching the ACC value increment to 30,000 over approximately 30 seconds before DN sets.
Answer: The timer is producing a 30 ms delay. The corrective action is to change the preset to 30,000 (if the time base remains milliseconds) so the timer produces the required 30-second delay.
3. During troubleshooting, a technician measures 0 VDC at the load terminals of an output module channel that should be energized. The output bit in the PLC tag monitor shows TRUE (1) and the output LED on the module is lit. The module is a relay-type output powered by 24 VDC. List the most likely fault and describe the DMM measurements needed to confirm it.
  1. Step 1 — Interpret the clues: the PLC bit is TRUE and the module LED is lit, meaning the relay inside the module has commanded to close. However, 0 VDC appears at the load terminal. The fault is downstream of the module's internal relay.
  2. Step 2 — Suspect a blown output fuse: many relay and transistor output modules include a replaceable fuse per group of output channels. A blown fuse would break the circuit between the common power supply terminal and the output terminal even if the relay closes.
  3. Step 3 — Measure supply voltage at the module common (COM) terminal with DMM set to DC voltage, negative lead on chassis ground. Expected: 24 VDC. If 24 VDC is present at COM but 0 VDC at the output terminal with the output bit TRUE, the relay contact or the fuse between COM and that channel is open.
  4. Step 4 — Check the fuse: with LOTO applied, remove and test the fuse with DMM in continuity or resistance mode. An open fuse reads OL (overload/infinite resistance). Replace fuse with the correct type and rating per module documentation.
  5. Step 5 — Restore power, verify 24 VDC appears at the output terminal when the bit is TRUE and the load operates correctly.
Answer: The most likely fault is a blown fuse on the output module. Confirmed by measuring 24 VDC at the COM terminal but 0 VDC at the output terminal with the bit TRUE and LED lit, then finding the fuse open in continuity mode. Replace the fuse with the correct rated fuse after applying LOTO.
4. A technician uses the DMM to check an input field device — a 24 VDC proximity sensor — and measures 23.8 VDC at the sensor output wire. The corresponding PLC input bit shows FALSE (0) in the tag monitor, and the input LED on the module is off. The wiring diagram shows the sensor output wire should land on terminal I:0/3. Describe the diagnostic steps to determine if the fault is a transposed wire or a module problem.
  1. Step 1 — Confirm sensor output is active: 23.8 VDC at the sensor output wire is consistent with a healthy sourcing (PNP) 24 VDC sensor; signal is present in the field.
  2. Step 2 — Measure voltage at the module input terminal I:0/3: place DMM positive lead on terminal I:0/3 and negative lead on the module's common (0 V) terminal. If the reading is 0 VDC, the signal is not reaching the terminal — pointing to a wiring fault (open or transposed wire). If the reading is approximately 24 VDC and the bit is still FALSE, suspect a failed input channel.
  3. Step 3 — Trace the wire from the sensor output to the terminal strip: compare the physical wire landing against the wiring diagram. If the sensor wire is landed on I:0/4 instead of I:0/3 (transposed), terminal I:0/3 will read 0 VDC and I:0/4 (or another terminal) will read ~24 VDC.
  4. Step 4 — Confirm transposition: measure voltage at adjacent terminals. If ~24 VDC appears on I:0/4 instead of I:0/3, the wire is transposed. Apply LOTO, move the wire to the correct terminal I:0/3, restore power.
  5. Step 5 — Verify: the input LED for I:0/3 should illuminate and the tag bit should show TRUE when the sensor is activated.
Answer: If the DMM reads 0 VDC at terminal I:0/3 but ~24 VDC at an adjacent terminal while the sensor is active, the fault is a transposed wire. After LOTO, move the wire to terminal I:0/3 and confirm the input bit reads TRUE.
In class: Fault-diagnosis procedure review: students write out a five-step systematic diagnostic procedure (observe symptom → isolate section → test hypothesis → repair → verify) in their own words and submit for instructor review before starting. · Fault-finding lab: instructor has pre-seeded six faults across two trainer stations (examples: blown fuse on output module, transposed wires on input, wrong tag address in rung, timer set-point in wrong base, missing seal-in contact, analog scaling formula error); students work in pairs, rotating stations, using DMM, software diagnostics, and wiring diagrams to find and correct each fault; each fault entry in the fault log must include symptom, test performed, measured value, root cause, and corrective action. · Debrief and peer review: pairs exchange fault logs and verify each other's root-cause explanations against an instructor answer key; discrepancies discussed as a class; students correct any incomplete entries.
Materials: Two or more PLC trainer stations with pre-seeded faults (instructor fault list kept confidential), DMM, oscilloscope (optional), wiring diagrams, PLC programming software, fault log template, LOTO kit
Check: All six faults correctly identified with accurate root cause and corrective action documented in fault log (minimum 5 of 6 correct to pass); LOTO procedure executed correctly before each wiring change (instructor initialed).

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Safety and Regulatory Compliance
1. Before changing any wiring on an energized PLC trainer station, what must a technician do first according to OSHA 29 CFR 1910.147?
Hardware Fault Diagnosis
2. A PLC output bit shows TRUE and the module output LED is lit, but the field device does not energize and the technician measures 0 VDC at the output terminal. What is the most likely cause?
Program Logic Fault Diagnosis
3. A TON timer with a preset of 45 and a time base of milliseconds is used where a 45-second delay is required. How long will the timer actually run before setting the DN bit?
Program Logic Fault Diagnosis
4. During online monitoring, rung continuity is shown in green up to the last normally-open contact before the output coil, but the contact itself appears gray (FALSE) even though the corresponding input sensor is active and its LED is lit on the module. What is the most likely fault?
Analog Scaling and PLC Programming
5. An analog input module has a raw count range of 0 to 32767 for a 4–20 mA input. A flow transmitter rated 0–100 GPM is connected. At a raw count of 16384, what is the correct scaled engineering-unit value?
Safety and Regulatory Compliance
6. Which document governs the use of arc-flash PPE categories and shock boundaries when a technician must work near energized electrical panels associated with a PLC system?
Program Logic Fault Diagnosis
7. A start push-button is wired as a normally-open input and the PLC program energizes a motor-starter output coil. After the button is released, the motor stops immediately. Which fault best explains this behavior?
Troubleshooting Documentation and Process
8. When documenting a fault in the fault log required by this lab, which five elements must every entry include?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram plan