What You Should Learn
- How a field signal reaches the controller and HMI.
- How a command travels back to a starter, drive or actuator.
- How to separate an operator request from an output, equipment feedback and proof from the process.
- What usually fails at each stage of the signal path.
- What information should be kept onboard so another engineer can trace the same function.
A Green Pump Icon Is Only One Clue
The chilled-water page shows pump 2 in green. Down in the plant room the pump is silent, and discharge pressure is still falling.
The colour may show that somebody pressed Start. It may show that the PLC accepted the request, that an output was energised or that the VFD reported running. On a well-designed page, green might be driven by pressure or flow and therefore confirm that water is actually moving.
Until you know which tag controls the graphic, the screen gives you a clue rather than an answer. A surprising amount of automation fault-finding goes wrong because the team assumes that an HMI symbol represents the physical result.
Follow the Signal in Both Directions
Most automated functions can be drawn as two simple routes.
The monitoring route carries information towards the operator:
Process → sensor or switch → field wiring → I/O → controller → communications → HMI, alarm or history
The control route carries an instruction back to the machinery:
Operator or automatic logic → controller → output or network command → starter, drive or actuator → machinery → feedback and process response
A tank level may be monitoring only. A chilled-water pump uses both routes. A power management system coordinates several machines and breakers from live electrical conditions.
Vendors use different names for the overall platform, including vessel management system, alarm monitoring system, integrated automation system and machinery control system. Whatever the label, an engineer needs to know what the system can see, what it can operate and what remains available when part of it fails.
The Main Parts of the System
Scroll sideways to compare all columns
| Part of the system | What it does | Common problems |
|---|---|---|
| Process and field device | A sensor, transmitter or switch represents pressure, temperature, level, flow, position or equipment state. | The process is genuinely abnormal, the sensing point is blocked or unsuitable, or the device has drifted or failed. |
| Field wiring, signal conditioning and I/O | Terminals, fuses, isolators and input modules carry field signals. Output modules pass commands to the equipment. | Lost field power, an open circuit, a bad common, a blown fuse, wrong scaling or a failed channel. |
| Controller | A PLC or dedicated controller applies the selected mode, permissives, interlocks, sequences and control calculations. | A required condition is missing, the wrong mode is selected, or the configuration no longer matches the plant. |
| Communications | Serial, CAN or Ethernet links carry data between controllers, remote I/O, drives, gateways and servers. | Loss of power, damaged cabling, addressing errors, a failed switch or gateway, or incompatible settings. |
| HMI and supervisory system | Screens present values, alarms, trends and status. They may also allow authorised commands and setpoint changes. | Stale data, hidden quality flags, an incorrect tag, or loss of contact with the controller. |
| Final device and feedback | Relays, contactors, VFDs, solenoids and valves act on the process. Feedback reports what the equipment did. | The command stops at an intermediate device, the equipment is locally inhibited, or it runs without producing the expected result. |
From the Field Device to the Controller
A pressure switch may open or close a 24 V input. A transmitter may send 4–20 mA across a calibrated range. Temperature might come from an RTD, thermocouple or transmitter, while position may come from limit switches or an encoder.
The signal often passes through more than a length of cable. Fuses, marshalling terminals, isolators, converters and safety barriers may sit between the field device and the PLC input.
Remote I/O places the input or output rack nearer the machinery and sends its data back over a communications link. This reduces long field cable runs. It also gives the engineer two more things to check: power at the remote rack and communication back to the controller.
Analogue channels must also be scaled correctly. On a 4–20 mA input, 12 mA represents half of the configured range. The PLC still needs the correct setup to turn that into bar, degrees Celsius, metres or another engineering value.
What the Controller Is Deciding
A PLC or dedicated controller combines live inputs with its program and the current operating mode. A simple way to picture its work is that it reads inputs, runs the required logic, updates outputs and exchanges data with other devices. Larger systems may use several tasks and priorities, but the basic model is useful when following a fault.
Scroll sideways to compare all columns
| Logic term | Practical meaning | Example |
|---|---|---|
| Permissive | A condition that must be healthy before an action can start. | A pump requires the local isolator closed and the VFD ready. |
| Interlock | A condition that prevents an unsafe or incompatible action. | Two transfer valves cannot open together. |
| Trip | A fault condition that stops or inhibits equipment. | Low lubricating-oil pressure stops a running machine. |
| Sequence or control loop | Logic that manages order, timing, speed, pressure, temperature or position. | A lead pump starts first and a standby pump starts if pressure remains low. |
Some protection is kept separate from the main automation controller. Emergency stops, overspeed protection and other safety functions may use hard-wired circuits or dedicated safety controllers. The cause-and-effect documents and electrical drawings should show where normal automation ends and independent protection takes over.
From the Controller Output to the Machinery
A PLC output starts the action. It does not confirm the machinery is active.
A digital output may energise an relay and motor starter. A network command may tell a VFD to run. An analogue output may position a control valve. The controller then waits for feedback, perhaps from a contactor auxiliary contact, VFD status word, valve limit switch, motor-current signal or local run contact.
The process itself provides the final check. A motor starter can close even if the pump has lost its coupling. A valve actuator can reach its open limit while the line remains blocked. Pressure, flow, temperature or level tells you whether the requested action achieved anything useful.
What the HMI Can Tell You
The HMI reads values from controllers and allows authorised commands or setpoint changes. It may also hold alarm history, trends and maintenance counters.
Communication loss can appear in several ways. One system may blank the value or mark it as bad quality. Another may leave the last value on the screen. A frozen graphic can look convincing if the page does not clearly show data quality and timestamp information.
On many yachts, the PLC and packaged controllers keep working when the main HMI or supervisory server fails. Machinery may continue in its last mode, but the crew can lose central visibility, alarm presentation and remote control. The reverse can also happen: the screen remains available while a remote I/O rack or output supply has failed.
Common Yacht Arrangements
One Main PLC with Remote I/O
One controller performs most of the logic, while remote I/O racks collect signals from machinery spaces around the vessel. This arrangement is easy to understand on a drawing, but one failed controller, network path or remote-I/O supply may affect several systems at once.
No large yacht will have one PLC onboard that covers all systems, but consider the Bridge navigation and control as one system. Yes, the AMS will get feedback from all systems onboard, but this is not what we are covering.
Packaged Equipment Connected to a Central VMS / AMS
Chillers, generators, watermakers, drives and other packages often control themselves locally. The central VMS receives selected alarms, values and commands through hard-wired I/O or a gateway.
A loss of communication may remove the information from the main screen while the package continues to run. On other installations, remote start and stop also depend on that gateway, so the effect is more serious. The I/O list and communications schedule should make the difference clear.
Redundant Controllers, Servers or Networks
Some systems duplicate controllers, servers, network paths or power supplies. Check which parts both sides still share. On a yacht with two automation servers, a single network switch or UPS may still take both displays out at the same time.
Redundancy also needs to be tested. A standby controller that has not received the latest project, or a second server that has never been allowed to take over, is difficult to rely on during a real failure.
Most yachts contain a mixture of these arrangements rather than one clean design throughout.
Worked Example: A Chilled-Water Pump Will Not Start
An engineer selects Start on the HMI. The request changes state, but the pump remains stopped.
- The command tag shows that the request reached the controller.
- The permissive page shows VFD Ready as false.
- The VFD is powered and has no active fault, but its external-enable input is missing.
- The drawing leads to an auxiliary contact on the local maintenance isolator.
- The isolator is mechanically closed, although its auxiliary contact has failed to remake after recent work.
- The contact is repaired and the work controls are cleared. VFD Ready returns, the PLC issues the run command, the drive reports running and discharge pressure confirms flow.
Nothing was wrong with the HMI, PLC or VFD. The missing field permissive stopped the sequence. Forcing the PLC output or bypassing the ready signal would have covered up the fault and removed a condition that the original design expected to be healthy.
Five Stages to Check
Scroll sideways to compare all columns
| Stage | What it tells you |
|---|---|
| Request received | The operator or automatic sequence asked for the action. |
| Controller output issued | The logic allowed the action and sent the command. |
| Equipment feedback received | The starter, drive or actuator reports an operating position or state. |
| Electrical activity present | The motor or actuator is drawing current or power. |
| Process response confirmed | Flow, pressure, speed, temperature, level or position changed as intended. |
The HMI should make these stages easy to distinguish. During fault-finding, check them in order.
Minimum Signal-Path Record
For each important automated function, the vessel should be able to find:
- the equipment and process condition being monitored or controlled;
- the sensor, signal type and calibrated range;
- field terminals, intermediate devices, I/O rack and channel;
- the controller and relevant logic or cause-and-effect reference;
- the HMI page and the meaning of its status indications;
- the output path through relays, starters, drives or actuators;
- equipment feedback and process confirmation;
- any communications link or gateway involved;
- the local or manual operating method; and
- the current drawing, software backup and document revision.
Operational records made by the engineering team needs enough detail for the next engineer to follow the signal without starting from scratch.
Before Using Engineering Software
Begin with the plant. Check the local equipment, read the drawings, compare HMI values with local instruments and look at controller diagnostics before making changes.
Viewing live logic and I/O states is useful. Forcing an output, bypassing an interlock, editing code or downloading a project carries a very different level of risk. These actions can start machinery, defeat protection or overwrite the controller with the wrong version.
Any change should have competent authorisation, a clearly defined work scope, a current backup and a way back to the previous configuration. Record all temporary forces and bypasses, and remove them before the work is closed.
Applicability Note
This article applies to yacht and shipboard monitoring and control systems built from PLCs, dedicated controllers, remote I/O, HMIs, communications networks and field equipment. The exact behaviour depends on the fitted system, software version, operating mode and whether the function supports essential or safety-related services.
Use the vessel's approved drawings, I/O schedules, cause-and-effect documents, manufacturer manuals and applicable class or flag requirements as the controlling information. Similar-looking HMI pages do not guarantee that two systems use the same logic or feedback.
References
IEC 60092-504:2026 — Electrical installations in ships — Part 504: Automation, control and instrumentation
https://webstore.iec.ch/en/publication/68493
IEC 61131-1:2003 — Programmable controllers — Part 1: General information
https://webstore.iec.ch/en/publication/4550
IEC 61131-2:2017 — Industrial-process measurement and control — Programmable controllers — Part 2: Equipment requirements and tests
https://webstore.iec.ch/en/publication/31007
IACS UR E22 — Computer-based systems
https://iacs.org.uk/resolutions/unified-requirements/ur-e/ur-e22-rev2-cln-2
NIST SP 800-82 Rev.3 — Guide to Operational Technology Security