Skip to main content
Call Eric:863-698-8266
CURRYCONTROLS.COMControls & Automation Knowledge Hub
ReferenceTroubleshootingDocumentationFundamentalsSCADAPLC

Troubleshooting Checklist

A general checklist for any control system problem, usable at 2 a.m.: define the problem, ask what changed, make the process safe, gather the evidence before touching anything, divide the chain, change one thing at a time, restore, and record.

8 min readUpdated Sep 5, 2026Published Sep 5, 2026By Eric Sullivan

The short answer

Troubleshooting Checklist

Troubleshooting a control system follows the same steps whatever the symptom: state the problem precisely, with what is wrong, since when, and what is not wrong; ask what changed, because most problems follow a change; make the process safe before diagnosing, with the affected equipment in a known state and the manual procedure ready; gather the evidence that already exists, the trends, the alarm journal, the event logs, the communication statistics, before touching anything; divide the signal chain from the field device to the display and find the layer where the truth stops; change one thing at a time and verify each change against the symptom; restore every temporary change; and record the symptom, the cause, the fix, and the evidence, because the same problem will return and the record is what makes it a ten-minute fix the second time.

Key points

  • One sentence: what is wrong, since when, and what is still right. A problem that cannot be stated cannot be solved.
  • What changed? A firmware update, a new cable, a setpoint, a storm, a contractor. Most problems follow a change.
  • Safe first: the equipment in a known state and the manual procedure ready before the diagnosis starts.
  • Evidence before action: trends, journals, and logs already hold the answer more often than not.
  • Divide the chain and change one thing at a time; two changes at once is a guess.
  • Restore and record: temporary changes become permanent faults, and unrecorded fixes are repeated.

The checklist

  1. 1

    Define the problem

    Write it down: what is wrong, on which equipment or tag, since when, how often, and what is working normally around it. A level that reads high on one wet well since Tuesday, with the other stations normal, is a different search from every level reading high since the server was patched.

  2. 2

    Ask what changed

    Change records, the vendor session log, the alarm journal for the hour before, the weather, the maintenance schedule, the last person in the panel. If something changed, start there.

  3. 3

    Make it safe

    The affected equipment in a known state: manual, off, or hand at the panel. The manual operation procedure ready. Lockout where hands go into equipment. Operations told what is being done.

  4. 4

    Gather the evidence

    Trends of the affected tag and the related ones over the period; the alarm journal; the controller fault log; the SCADA event log; the communication statistics; the switch and firewall logs if the network is suspect. Look before touching.

  5. 5

    Divide the chain

    From the field device to the display: the device display, the loop current, the controller input, the controller tag, the SCADA tag, the historian, the client. Compare the value at each layer; the fault is between the last true layer and the first false one.

  6. 6

    Form one hypothesis

    From the evidence, the most likely single cause. Write it down with the test that would confirm it.

  7. 7

    Test it, one change at a time

    The test that confirms or eliminates the hypothesis, with the result recorded. If confirmed, fix. If not, the next hypothesis. Never two changes without a check between.

  8. 8

    Verify

    The symptom gone under the conditions that produced it, not just at the moment of the fix. Watch the trend through a cycle.

  9. 9

    Restore

    Every temporary change reversed: forces, bypasses, shelved alarms, manual modes, test jumpers, disconnected shields, changed setpoints. Walk the list.

  10. 10

    Record

    Symptom, evidence, cause, fix, parts, time, and the person, in the work order and the plant notes. Update the drawing or the schedule if it was wrong.

QuestionWhat the answer tells you
One device or many?One: its own chain. Many with something in common: the common element, a card, a switch, a supply, a server
Constant or intermittent?Constant: configuration or a hard failure. Intermittent: a connection, noise, a link, a timing
Correlated with anything?A pump starting, a drive running, rain, a time of day, a shift change: the correlation is the cause or its neighbor
Wrong, frozen, noisy, or missing?Wrong: scaling or calibration. Frozen: a stopped update. Noisy: interference or air. Missing: a lost link or a failed device
Does the device itself agree?The transmitter display, the drive keypad, the controller online: if the device is right, the fault is downstream
Was it ever right?A problem since commissioning is design or configuration; a problem since last week is a change or a failure

Escalation

The checklist also says when to stop and call: when the process is unsafe and manual operation is not holding it, when the evidence points at a compromise, when a change would affect equipment or people beyond the technician authority, or when the search has gone two hours without a hypothesis that survived a test. The call list is on the same sheet: the on-call engineer, the integrator support line, the vendor, the supervisor. Calling early is cheaper than a night of guessing, and the evidence gathered in step four is what the person on the phone will ask for.

Where to go next

The specific troubleshooting pages on this site take the search from the checklist to the symptom: a transmitter reading wrong, a level that jumps, a device that times out, a drive that trips, a value frozen on the screen, an alarm that did not sound. Each follows the same shape, with the causes ranked and the checks for each, and the general checklist is the frame they fit in.

Frequently asked questions

What is the most common mistake?
Changing something before looking. A restart, a recalibration, a setpoint change, a re-download, done in the first five minutes, destroys the evidence and often adds a second problem. The trend and the journal were there; they are read first.
How do I keep track during a long search?
On paper: the hypotheses tried, the tests, the results, and every temporary change made, with times. When a second person joins or a shift changes, the sheet is the handover, and when the fault is found, the sheet is the record and the list of things to restore.
The problem went away on its own. Is it fixed?
No; it is intermittent, and it will return. Record what was observed, set up to catch it: a fast trend on the tag, a communication statistic, an alarm on the condition, and keep the sheet open. The next occurrence with better evidence is when it gets solved.
When is it a cyber incident rather than a fault?
When the evidence shows a change nobody made, a login nobody recognizes, a controller program that differs from the baseline, or behavior that no fault explains. At that point the incident response plan takes over from the troubleshooting checklist, starting with isolation and preservation of evidence rather than repair.

Direct contact

Have a controls question?

Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.