14.1 PLC and HMI Operation
Key Takeaways
- A PLC typically reads field inputs, executes approved logic, and updates outputs; an HMI displays selected data and offers only the commands configured for the operator.
- A screen command, controller RUN indication, or animated symbol does not prove that the final device moved or that the process changed; use independent feedback.
- Class I operators inspect status, record symptoms, use approved modes and setpoints, and escalate faults without forcing I/O, defeating interlocks, or editing live logic.
- Every PLC or HMI change requires authorization, a known baseline, testing, documentation, and a safe recovery path under the facility's change-control procedure.
Quick answer: A programmable logic controller (PLC) receives inputs, runs configured logic, and commands outputs. A human-machine interface (HMI) is the operator-facing display and command layer. Chapter 2 explains how their signals support process interpretation; this section focuses on equipment operation, health checks, maintenance coordination, and safe limits.
Follow the control chain
A typical PLC repeatedly reads inputs, evaluates its approved program, updates outputs, and performs communications and diagnostics. Plant drawings, program documentation, and the manufacturer manual govern the actual controller.
| Component | Equipment role | Useful operator evidence |
|---|---|---|
| Power supply and processor | Powers the rack and executes control logic | Power, RUN, fault, battery, or diagnostic status |
| Input module | Receives switch states or analog measurements | Channel indication, tag quality, and a safe field comparison |
| Output module | Sends commands to relays, drives, valves, or other devices | Command state plus independent run, position, flow, or pressure feedback |
| Communications module | Exchanges data with an HMI, SCADA server, or another controller | Link status, communication alarms, and fresh timestamps |
| HMI | Displays tags, alarms, trends, modes, and permitted controls | Correct screen, tag, unit, mode, command, and returned status |
A controller showing RUN means that it is executing its program; it does not prove that every input is valid, every output channel is healthy, or every final device responded. Likewise, an HMI pump symbol may show a start command while motor current and flow remain absent. Treat command, controller output, auxiliary contact, and process response as separate facts. Color meanings are plant-specific; read the HMI legend.
Routine operator checks
Perform only checks assigned by the standard operating procedure (SOP):
- Review controller, remote I/O, HMI, and uninterruptible power supply alarms at shift turnover.
- Confirm displays are readable, timestamps are current, and critical equipment shows the expected local, remote, manual, or automatic mode.
- Look and listen for abnormal cabinet heat, ventilation blockage, moisture, corrosion, vibration, odor, or fan noise without opening energized equipment unless qualified and authorized.
- Compare selected HMI states with safe local indication and expected process response.
- Record intermittent faults, including time, equipment state, alarm text, and recent maintenance.
Do not use a power cycle as a casual diagnostic. Restarting a controller or HMI can remove control, erase useful transient evidence, interrupt communications, or start an automatic sequence when service returns. Follow the approved shutdown and restart procedure and notify affected operators first.
Diagnose by layer, not by guess
When a command fails, begin with the operating condition. Is the device available, in the correct mode, and free of an active trip? Are required permissives true? Has an interlock intentionally blocked the action? Then compare the PLC/HMI indication with local device feedback under the SOP. A failed field switch can make healthy logic appear wrong; a tripped motor can leave a valid PLC output with no process response; a lost communication link can leave an HMI value stale while the local controller continues operating.
Use an evidence table in the work request:
| Observation | What it establishes | What it does not establish |
|---|---|---|
| PLC is in RUN | Program execution is active | Field I/O and equipment are healthy |
| Start command is on | Logic requested operation | Contactor closed or motor turned |
| Valve-open feedback is on | Feedback circuit reports open | Actual position is correct if the switch failed |
| HMI value is frozen | Displayed value is not changing | Whether the process or data path caused it |
An I/O force overrides the normal relationship between field state, logic, and output. A bypass or forced value can defeat a protection or make the display misleading. Class I operators should never create or leave a force, alter ladder logic, suppress an interlock, or connect programming equipment unless the facility specifically authorizes that work and applies formal controls. Report any unexpected force, bypass, password prompt, changed screen, or program mismatch immediately.
Maintenance and change control
Authorized instrumentation or control personnel may inspect terminals in a safely isolated cabinet, replace modules, manage batteries, back up software, or modify configuration. The operator contributes process knowledge: the safe state, affected equipment, acceptable manual operation, alarm response, and post-work checks. A controlled change identifies the reason and approver, captures the current baseline, assesses hazards, provides a rollback plan, tests away from live service where possible, schedules the cutover, and records the as-left condition.
After authorized work, verify more than a quiet fault light. Confirm correct mode, tag scaling, alarm action, permissives and interlocks, command and feedback, and expected field response. Remove maintenance flags only after the responsible roles accept the test. Preserve the work order, program or configuration version, test result, and unresolved limitations.
Application scenario
An HMI shows Pump 2 available and sends a start command, but run feedback remains off and discharge flow does not rise. The safest response is not to force the run input or bypass the permissive. Check the displayed mode, trip, permissive, and interlock indications; coordinate an authorized local inspection; protect supply using the SOP; and record the command and feedback sequence. If the starter is tripped, electrical maintenance owns that fault. If the field device is healthy but the PLC output never changes, control staff investigate the I/O or logic under change control.
Official source trail
A PLC is in RUN, and the HMI shows a pump start command, but motor current and discharge flow remain zero. What is the best next action for a Class I operator?
Which statement correctly distinguishes a PLC from an HMI?
After authorized replacement of a PLC input module, which acceptance check provides the strongest evidence that the work is complete?