Division 07 of 25 · Failure Database

Control System Failures

The dedicated failure-intelligence division for AGL control, monitoring, automation, communication and supervisory systems — PLC, SCADA, HMI, network infrastructure, communication modules, sensors, control panels, control logic, commands, interlocks, status indication and system synchronization.

20 / 20
Topics Published
CSF-01 → 20
Failure ID Range
6 Groups
Hardware · Alarm/HMI · Control-Mode · Comms/Data · Command/Logic · Network
Rev 0
Initial Issue

Key principle — Do not record a control-system problem simply as “SCADA failure” or “PLC failure.” Identify the failed control function, communication path, symptom, failure mechanism, root cause and resulting AGL operational effect. This prevents the database from accumulating thousands of records labelled simply “SCADA failure.”

Division 07 · Control System Failure Topics

20 of 20 topics published
A
PLC & Control Hardware Failures
4 topics
CSF-01 PLC Failure
Failure Definition

Failure of the Programmable Logic Controller responsible for control, monitoring, sequencing or automation functions.

Possible Symptoms
  • Loss of automatic control
  • Loss of equipment status
  • Incorrect commands
  • Control-system shutdown
  • Communication loss
  • Alarms generated
  • System operating only in local/manual mode
Possible Causes
  • Hardware failure
  • Power-supply problem
  • Module failure
  • Internal fault
  • Configuration problem
  • Environmental condition
  • Communication failure
Investigation — Check
  • PLC power supply
  • CPU/module status
  • Diagnostic indications
  • I/O status
  • Communication status
  • Configuration
  • Recent maintenance/change history
Important Distinction

PLC failure should be used when the PLC itself is determined to be defective. If the PLC is healthy but cannot communicate with SCADA, classify the primary failure as SCADA communication loss or communication failure, as applicable.

CSF-02 SCADA Communication Loss
Failure Definition

Loss of communication between the supervisory control system and the field/control equipment.

Symptoms
  • Field equipment unavailable on SCADA
  • Status not updating
  • Commands unavailable
  • Communication alarms
  • Stale data
Possible Causes
  • Network failure
  • Communication-module failure
  • PLC failure
  • Communication timeout
  • Configuration error
  • Network instability
Investigation

Determine where communication is lost along the path: SCADA → network → control panel → PLC → field equipment. This prevents incorrectly identifying the SCADA application itself as defective.

CSF-03 Network Failure
Failure Definition

Failure of the network infrastructure required for control-system communication.

Possible Causes
  • Network equipment failure
  • Cable/link failure
  • Switch failure
  • Configuration issue
  • Power loss
  • Communication interruption
Symptoms
  • Multiple devices unavailable
  • SCADA communication loss
  • HMI communication loss
  • Remote-control failure
  • Data loss
Investigation

Identify whether the failure is single-link, single-device, network segment or network-wide.

CSF-04 Sensor Malfunction
Failure Definition

Sensor provides incorrect, unstable, missing or unavailable input to the control/monitoring system.

Failure Modes
  • No signal
  • Incorrect signal
  • Intermittent signal
  • Unstable signal
  • Out-of-range indication
Possible Causes
  • Sensor hardware failure
  • Wiring problem
  • Communication problem
  • Calibration problem
  • Environmental condition
  • Configuration error
Consequences
  • Incorrect status
  • Incorrect control action
  • False alarm
  • Missed alarm
  • Incorrect automatic operation
B
Alarm, HMI & Communication Failures
5 topics
CSF-05 Alarm Failure
Failure Definition

Failure of the control system to correctly generate, display, transmit or acknowledge an alarm.

Failure Modes
  • Alarm not generated
  • False alarm
  • Alarm not displayed
  • Alarm not transmitted
  • Alarm cannot be acknowledged
  • Alarm remains active incorrectly
Possible Causes
  • Software configuration
  • Sensor failure
  • Communication failure
  • HMI problem
  • PLC logic problem
Operational Importance

An alarm failure can be more serious than an ordinary indication failure because it may prevent personnel from recognising an abnormal AGL condition.

CSF-06 Software Configuration Error
Failure Definition

Incorrect software parameter, configuration, database, address, logic or system setting affecting control-system operation.

Possible Causes
  • Incorrect configuration
  • Unauthorized modification
  • Incorrect software update
  • Human error
  • Incorrect parameter entry
  • Configuration mismatch
Symptoms
  • Incorrect status
  • Incorrect commands
  • Communication problems
  • Unexpected control behaviour
Investigation

Compare current configuration ↔ approved configuration/baseline.

CSF-07 HMI Failure
Failure Definition

Failure of the Human-Machine Interface used for monitoring and/or controlling the AGL system.

Failure Modes
  • Display failure
  • Touch/interface failure
  • Application failure
  • Communication loss
  • Frozen display
  • Incorrect display
Consequences
  • Operator cannot monitor equipment
  • Operator cannot issue commands
  • Incorrect status may be displayed
  • Local/remote operation may be affected
Investigation

Separate HMI hardware failure from HMI communication/software failure.

CSF-08 Communication-Module Failure
Failure Definition

Failure of a dedicated communication module/interface used to exchange data between control-system components.

Symptoms
  • Device unavailable
  • Communication loss
  • Timeout
  • Data loss
  • Incorrect status
Possible Causes
  • Hardware failure
  • Power-supply problem
  • Configuration issue
  • Network problem
  • Module fault
Investigation — Check
  • Module status
  • Power
  • Communication indicators
  • Configuration
  • Connected devices
  • Network path
CSF-09 Control-Panel Failure
Failure Definition

Failure of an AGL control panel or associated control-panel hardware affecting system operation.

Possible Failure Areas
  • Internal wiring
  • Control components
  • Power supply
  • Interface modules
  • Terminals
  • Communication interfaces
Symptoms
  • Local/remote control loss
  • Incorrect status
  • Control failure
  • Alarm condition
  • Communication loss
Investigation

Inspect the control panel as an integrated assembly while identifying the specific failed component where possible.

C
Control-Mode Failures
3 topics
CSF-10 Remote-Control Failure
Failure Definition

Failure to control AGL equipment from the designated remote-control/SCADA location.

Symptoms
  • Remote command rejected
  • Remote equipment unavailable
  • Command not executed
  • Incorrect status after command
Possible Causes
  • Communication loss
  • PLC problem
  • HMI/SCADA problem
  • Control logic error
  • Interlocking
  • Configuration mismatch
Diagnostic Principle

A remote-control failure does not automatically mean the controlled equipment itself has failed.

CSF-11 Local-Control Failure
Failure Definition

Failure to control the AGL equipment from the local control interface/panel.

Possible Causes
  • Local-control hardware failure
  • Control-panel failure
  • PLC problem
  • Interlocking
  • Wiring problem
  • Configuration/logic problem
Investigation

Determine whether local control fails but remote control works, or both local and remote control fail. This distinction is diagnostically important.

CSF-12 Interlocking Failure
Failure Definition

Failure of the control system's intended interlocking function.

Failure Modes
  • Required interlock does not operate
  • Incorrect interlock activation
  • Interlock remains active
  • Interlock prevents a legitimate command
  • Unsafe/incorrect command permitted
Possible Causes
  • Control logic error
  • Software configuration
  • Sensor/status error
  • Wiring issue
  • Configuration mismatch
Investigation — Verify
  • Required condition
  • Actual input
  • Logic state
  • Interlock state
  • Command response
  • Approved control philosophy
D
Communication & Data Failures
3 topics
CSF-13 Communication Timeout
Failure Definition

Expected communication response is not received within the configured/required period.

Symptoms
  • Device unavailable
  • Communication alarm
  • Stale status
  • Remote-control failure
  • Intermittent communication
Possible Causes
  • Network instability
  • Communication-module failure
  • Network congestion/problem
  • Device failure
  • Configuration issue
Important Distinction

Communication timeout is the observed failure condition. The root cause may be network failure, module failure, configuration error or device failure.

CSF-14 Data Loss
Failure Definition

Loss, corruption or unavailability of required control/monitoring data.

Potentially Affected Data
  • Equipment status
  • Alarm history
  • Event records
  • Control commands
  • Operational parameters
  • Historical data
Possible Causes
  • Communication failure
  • System failure
  • Software/configuration issue
  • Storage/database problem
  • Network interruption
Consequences
  • Loss of operational visibility
  • Incomplete event history
  • Difficulty in troubleshooting
  • Incorrect monitoring
CSF-15 Incorrect Status Indication
Failure Definition

Control system displays a status that does not correspond to the actual field/equipment condition.

Examples
  • Equipment shown ON when actually OFF
  • Equipment shown OFF when actually ON
  • Fault shown when no fault exists
  • Healthy status shown for faulty equipment
Possible Causes
  • Sensor malfunction
  • Communication failure
  • PLC logic error
  • Configuration mismatch
  • HMI/software problem
Investigation

Compare actual field condition ↔ PLC status ↔ SCADA status ↔ HMI indication. This four-point comparison is particularly useful for control-system troubleshooting.

E
Command & Logic Failures
3 topics
CSF-16 Incorrect Command Execution
Failure Definition

System executes a command differently from the intended/authorized command.

Examples
  • Wrong equipment operated
  • Wrong intensity/state selected
  • Command operates unexpected output
  • Command partially executes
  • Command executes without required condition
Possible Causes
  • Control logic error
  • Configuration mismatch
  • Incorrect addressing
  • PLC problem
  • Communication issue
  • Human/configuration error
Investigation

Verify the full path: operator command → HMI/SCADA command → PLC command → output → field equipment response.

CSF-17 Control Logic Error
Failure Definition

Incorrect programmed control logic causes unexpected or incorrect system behaviour.

Failure Modes
  • Incorrect sequence
  • Incorrect interlock
  • Wrong output
  • Incorrect state transition
  • Unexpected equipment operation
Possible Causes
  • Programming error
  • Software modification
  • Incorrect logic design
  • Configuration change
  • Inadequate testing after modification
Investigation

Compare actual logic against the approved control philosophy and baseline configuration.

CSF-18 Configuration Mismatch
Failure Definition

Mismatch between configuration settings of connected control-system components.

Possible Areas
  • PLC
  • SCADA
  • HMI
  • Communication modules
  • Network devices
  • Field equipment
Symptoms
  • Communication loss
  • Incorrect status
  • Incorrect command
  • Device unavailable
  • Intermittent operation
Example

PLC address/configuration ≠ SCADA database configuration → communication failure.

F
Network & System Performance
2 topics
CSF-19 Network Instability
Failure Definition

Intermittent or unstable network performance resulting in unreliable control-system communication.

Symptoms
  • Intermittent communication
  • Repeated timeouts
  • Data interruptions
  • Remote-control instability
  • Status updates delayed or missing
Possible Causes
  • Network infrastructure problem
  • Intermittent link
  • Configuration issue
  • Power instability
  • Hardware deterioration
Investigation

Look for recurring/intermittent patterns, rather than treating each communication interruption as an independent failure.

CSF-20 System Synchronization Failure
Failure Definition

Failure of connected control-system components to maintain the required synchronization of data, states, timing or system operation.

Possible Symptoms
  • Different systems show different status
  • Delayed status updates
  • Incorrect sequence
  • Event/time mismatch
  • Control-system instability
Possible Causes
  • Communication problems
  • Configuration mismatch
  • Timing/synchronization problem
  • Software issue
  • Network instability
Investigation

Compare synchronization between: SCADA ↔ PLC ↔ HMI ↔ communication modules ↔ field equipment.

No topics match your search.

Division-Wide Requirements

Failure chains, diagnostic matrix, standard record structure, RCA relationships and classification that apply across all 20 Division 07 control-system-failure topics.

A. Control-System Failure Chains

These relationships are built into the failure database so a control-system problem is never recorded as a single, undifferentiated “SCADA failure.”

Chain 1 — Network
NETWORK FAILURECOMMUNICATION LOSSCOMMUNICATION TIMEOUTSCADA STATUS UNAVAILABLEREMOTE-CONTROL FAILURELOSS OF OPERATIONAL CONTROL
Chain 2 — Configuration
CONFIGURATION MISMATCHCOMMUNICATION PROBLEMINCORRECT/MISSING DATAINCORRECT STATUS INDICATIONINCORRECT OPERATOR DECISION
Chain 3 — Logic
CONTROL LOGIC ERRORINCORRECT COMMAND EXECUTIONINCORRECT EQUIPMENT STATEAGL OPERATIONAL CONDITION
Chain 4 — Sensor
SENSOR MALFUNCTIONINCORRECT INPUTINCORRECT PLC LOGIC RESPONSEINCORRECT STATUS/ALARMINCORRECT CONTROL ACTION
Chain 5 — Alarm
SENSOR/PLC PROBLEMALARM LOGIC FAILUREALARM NOT GENERATED/DISPLAYEDABNORMAL CONDITION NOT RECOGNIZEDDELAYED CORRECTIVE ACTION

These relationships become extremely valuable when Division 07 is later connected to the Root Cause Analysis Database and Reliability & Failure Trend Analysis.

B. Control-System Diagnostic Matrix

No.FailurePrimary Investigation
1PLC failurePLC diagnostics/I/O/power
2SCADA communication lossEnd-to-end communication
3Network failureNetwork infrastructure
4Sensor malfunctionSensor/input signal
5Alarm failureAlarm logic/display/communication
6Software configuration errorApproved configuration comparison
7HMI failureHMI hardware/software
8Communication-module failureModule/power/configuration
9Control-panel failurePanel hardware/interface
10Remote-control failureRemote command path
11Local-control failureLocal command path
12Interlocking failureInterlock logic/status
13Communication timeoutCommunication response
14Data lossData transmission/storage
15Incorrect status indicationField/PLC/SCADA comparison
16Incorrect command executionCommand-to-output path
17Control logic errorPLC/control philosophy
18Configuration mismatchConfiguration baseline
19Network instabilityIntermittent network behaviour
20System synchronization failureSystem state/time/data synchronization

C. Recommended Division 07 Failure Record

For every Division 07 case, capture:

System identification

  • Failure ID
  • Airport/project
  • System name
  • PLC ID
  • SCADA/HMI ID
  • Control-panel ID
  • Network segment
  • Field equipment affected

Failure information

  • Failure date/time
  • Failure category
  • Failure mode
  • Symptoms
  • Alarm generated
  • Actual field condition
  • Displayed condition
  • Operational impact

Diagnostic information

  • PLC status
  • I/O status
  • Communication status
  • Network status
  • HMI status
  • SCADA status
  • Configuration status
  • Control-logic status

Evidence

  • Alarm/event logs
  • Screenshots
  • Configuration record
  • Network diagnostics
  • PLC diagnostics
  • Maintenance/change history

RCA

  • Immediate cause
  • Failure mechanism
  • Root cause
  • Contributing factor

Restoration

  • Corrective action
  • Configuration correction
  • Hardware replacement
  • Software/logic correction
  • Communication restoration
  • Functional test
  • Return-to-service confirmation

Reliability

  • Repeat occurrence
  • Duration
  • Operational impact
  • Preventive action
  • Lessons learned

D. RCA Distinction — Symptom, Failure Mode, Root Cause

Division 07 distinguishes system symptom, failure mode, and root cause. This prevents the database from accumulating thousands of records labelled simply “SCADA failure.”

Example 1
REMOTE-CONTROL FAILURECOMMUNICATION TIMEOUTNETWORK INSTABILITYNETWORK INFRASTRUCTURE PROBLEM
Example 2
INCORRECT STATUS INDICATIONINCORRECT PLC INPUTSENSOR MALFUNCTIONSENSOR FAILURE
Example 3
INCORRECT COMMAND EXECUTIONWRONG OUTPUT LOGICCONTROL LOGIC ERRORSOFTWARE/CONFIGURATION CHANGE
Example 4
SCADA COMMUNICATION LOSSCOMMUNICATION MODULE UNAVAILABLECOMMUNICATION-MODULE FAILUREHARDWARE FAILURE

E. Classification Groups

The 20 topics are organised into six logical groups while retaining the original numbering, making the database easier to search without changing the master architecture:

  • A — PLC & Control Hardware (Topics 1–4)
  • B — Alarm, HMI & Communication (Topics 5–9)
  • C — Control-Mode Failures (Topics 10–12)
  • D — Communication & Data (Topics 13–15)
  • E — Command & Logic (Topics 16–18)
  • F — Network & System Performance (Topics 19–20)

F. Failure Severity

Every failure receives a severity classification, plus operational-impact tagging:

Critical / Safety-Critical — immediate operational or safety risk

Major / Operationally Critical — significant availability impact

Moderate — reduced performance, not yet critical

Minor / Non-Critical — limited or no operational effect

Degradation / Intermittent / Latent — developing or hidden fault

G. RCA Connection

Division 07 links every failure to the Root Cause Analysis Database. The most relevant RCA categories for control-system failures are:

ElectricalSoftware/FirmwareCommunicationConfigurationEnvironmentalInstallationMaintenanceComponentHuman/Procedural

H. Recommended Database Architecture

CONTROL SYSTEM FAILURE EVENT FAILURE MODE SYSTEM SYMPTOM ACTUAL FIELD CONDITION DIAGNOSTIC EVIDENCE FAILURE MECHANISM ROOT CAUSE CORRECTIVE ACTION FUNCTIONAL VERIFICATION OPERATIONAL IMPACT RELIABILITY TREND LESSONS LEARNED

This makes Division 07 suitable not only for PLC/SCADA troubleshooting, but also for AGL control-system RCA, configuration management, alarm reliability, communication reliability, change management and long-term control-system performance analysis.

Division 07 vs. Divisions 01/02

Divisions 01 and 02 capture failures at the fixture and electrical-path level — LED, driver, cable, connector, insulation. Division 07 captures failures in the control, monitoring, automation and supervisory layer sitting above them — PLC, SCADA, HMI, network, sensors and control logic. Before recording a fixture as failed, confirm the command actually reached it: a fixture that appears failed may in fact be correctly following an incorrect PLC command, an interlock condition, or a status indication that never matched the field.

Frequently Asked Questions

Quick answers about AGL control, monitoring, automation and communication failures, as covered in Division 07 of the AGL Failure Database.

Q1What is Division 07 — Control System Failures in the AGL Failure Database?

Division 07 covers failures in AGL control, monitoring, automation, communication and supervisory systems. It contains 20 published topics (CSF-01 to CSF-20) covering PLC, SCADA, network, sensor, alarm, HMI, communication modules, control panels, remote and local control, interlocking and control logic.

Q2Which control system failures does Division 07 cover?

PLC failure, SCADA communication loss, network failure, sensor malfunction, alarm failure, software configuration error, HMI failure, communication-module failure, control-panel failure, remote-control failure, local-control failure, interlocking failure, communication timeout, data loss, incorrect status indication, incorrect command execution, control logic error, configuration mismatch, network instability and system synchronization failure.

Q3How are the 20 control system topics grouped?

They are organised into six groups while keeping the original numbering: PLC & Control Hardware (4 topics), Alarm, HMI & Communication (5), Control-Mode Failures (3), Communication & Data (3), Command & Logic (3) and Network & System Performance (2).

Q4Why is “SCADA failure” not enough as a record?

Division 07 distinguishes system symptom, failure mode and root cause so the database does not accumulate thousands of records labelled simply “SCADA failure”. For example, a remote-control failure may be a communication timeout caused by network instability, with a network infrastructure problem as the root cause. An incorrect status indication may trace to an incorrect PLC input caused by sensor malfunction.

Q5What control-system failure chains does Division 07 capture?

In the network chain, network failure leads to communication loss, communication timeout, SCADA status unavailable, remote-control failure and loss of operational control. In the configuration chain, a configuration mismatch leads to a communication problem, incorrect or missing data, incorrect status indication and an incorrect operator decision.

Q6How do Divisions 01 and 02 differ from Division 07?

Divisions 01 and 02 capture failures at the fixture and electrical-path level, such as LED, driver, cable, connector and insulation. Division 07 captures failures in the control, monitoring, automation and supervisory layer above them: PLC, SCADA, HMI, network, sensors and control logic. Before recording a fixture as failed, confirm the command actually reached it, because a fixture may be correctly following an incorrect PLC command.

Q7Where should the investigation start for a control-system failure?

The diagnostic matrix assigns a primary investigation to each topic. PLC failure starts with PLC diagnostics, I/O and power, SCADA communication loss with end-to-end communication, network failure with network infrastructure, sensor malfunction with the sensor and input signal, alarm failure with alarm logic, display and communication, and software configuration error with comparison against approved configuration.

Q8What should be recorded for a control-system failure?

Records capture system identification (system name, PLC, SCADA/HMI and control-panel IDs, network segment, field equipment affected), failure information including alarm generated, actual field condition and displayed condition, and diagnostic information such as PLC, I/O, communication, network, HMI, SCADA and configuration status. The recommended architecture runs from failure event through mode, symptom, diagnostic evidence, mechanism and root cause to functional verification and reliability trend.

Q9How are failure severity and operational impact classified?

Every failure receives a severity classification, plus operational-impact tagging. The classes are Critical / Safety-Critical (immediate operational or safety risk), Major / Operationally Critical (significant availability impact), Moderate (reduced performance, not yet critical), Minor / Non-Critical (limited or no operational effect), and Degradation / Intermittent / Latent (a developing or hidden fault).

Beyond the System Fault

DON’T JUST REBOOT THE SYSTEM. UNDERSTAND THE LOGIC THAT FAILED.

ALCMS and control-system failures can stem from communication faults, software logic errors or field-device miscommunication — real troubleshooting means understanding the monitoring and control architecture well enough to isolate where the failure actually began.

Take that knowledge further with Precision AGL Academy.

Build Practical AGL Troubleshooting Skills

Learn how to connect:

Failure Symptoms System Understanding Investigation Root Cause Corrective Action Verification Recurrence Prevention

Develop structured knowledge across AGL fundamentals, components, electrical systems, testing, photometry, troubleshooting, maintenance and commissioning.

Find the failure. Understand the cause. Build the engineering skill.

Talk to Precision AGL Academy

Follow the Academy