PLC Commissioning Checklist

Back to Resources

How to Use This Checklist

The checklist is organized as seven phases in the order most commissioning jobs actually run: preparation, pre-download checks, I/O checkout, communications, fail-state behavior, alarm and interlock testing, and handover. Work each phase to completion before moving on - most late-night commissioning problems trace back to a skipped item in an earlier phase.

Two ground rules. First, this page describes common practice, not requirements: your site procedures, permit system, and the equipment manufacturer's instructions always take precedence. Second, where a value is site-specific (test tolerances, setpoints, password policy), record what your site requires rather than inventing one on the spot.

Phase 1 - Preparation and Prerequisites

Everything in this phase happens before you connect a programming laptop to anything.

• Confirm the scope in writing: which controllers, which routines, and which sites are being changed.
• Collect current as-built drawings, the I/O list, and the P&ID set, and record their revision numbers.
• Take a verified backup (upload) of the running program before any change, and store a copy somewhere other than the programming laptop.
• Record the processor model, firmware revision, and installed card layout, and confirm your programming software version supports them.
• Agree on an addressing plan: controller IP addresses, subnets, and any serial node addresses, checked against what is already on the network.
• Review lockout/tagout and permit-to-work requirements with the site before energizing, forcing, or stroking anything.
• Confirm the maintenance window, who is affected, and who has the authority to stop the test.
• List every connected system that could react to the change: HMI, historian, telemetry, drives, and any safety systems.

Phase 2 - Pre-Download Checks

Run these immediately before transferring the program to the controller.

• The offline program compiles or verifies with zero errors, and every warning has been read and dispositioned.
• A cross-reference check has been run: no unintended duplicate writes to the same output or tag.
• First-scan and power-up initialization logic has been reviewed: presets, latches, and one-shot logic behave as intended on a cold start.
• Retentive vs non-retentive tag behavior is confirmed against what the process needs after a power cycle.
• Timers, scaling constants, and setpoints are populated with reviewed commissioning values, and placeholders are flagged.
• You are connected to the intended controller (verify the path, controller name, and serial number) - not a neighboring unit on the same network.
• The process is in a safe state for a download, and the operator knows outputs may change state.
• The pre-download upload is saved alongside the new program file with a dated change note.

Phase 3 - I/O Checkout

Isolate outputs from the process wherever actuation could cause harm, and clear each point one at a time against the I/O list.

• Digital inputs: operate each field device (or simulate at the device terminals) and confirm the correct program tag and HMI indication change state.
• Digital outputs: command each output from the controller and confirm the correct field device responds, with mechanical or process isolation confirmed first.
• Analog inputs: inject 0, 25, 50, 75, and 100% of range and verify both raw counts and scaled engineering values at each point.
• Analog outputs: command 0, 25, 50, 75, and 100% and measure the result at the field device.
• Engineering units, ranges, and decimal formatting match the instrument index at every layer: controller, HMI, historian.
• Wire labels and terminal numbers match the drawings; discrepancies are redlined immediately, not remembered for later.
• Spare I/O points are verified and documented as spares in the I/O list.
• Every force and simulation is removed at the end of checkout, and the force table is verified empty.

Phase 4 - Communications Verification

• Every configured comms partner shows a healthy status: HMI, RTU or telemetry gateway, drives, and third-party devices.
• Register and tag maps for third-party devices are spot-checked against the vendor documentation, including data type, scaling, and byte order.
• Watchdog or heartbeat tags are configured and verified in both directions where the link supports it.
• Each critical link has been failed deliberately (pull the cable or disable the port) and the comms-loss alarm and programmed fallback behavior confirmed.
• Update rates are verified with the full device count online, not just with one device connected.
• Redundant comms paths, if present, are verified by failing the primary and watching the switchover.

Phase 5 - Fail-State Behavior

This is the phase most often skipped under schedule pressure, and the one that matters most at 2 AM.

• Outputs go to their specified states when the processor is switched to stop or program mode.
• Remote I/O behavior on comms loss (hold last state vs go to a configured safe state) is confirmed and matches the design intent.
• A full power-cycle test has been run: the process comes back to a safe, known state without manual intervention in the logic.
• Valve and motor fail positions are verified against the P&ID, not against the program comments.
• Behavior on power restoration is verified: nothing auto-restarts that should require an operator.
• Emergency stops and hardwired interlocks are verified to act independently of the program.

Phase 6 - Alarm and Interlock Testing

• Every alarm in the approved alarm list is exercised - at the field device where practical, otherwise at the marshalling terminals.
• Alarm setpoints are verified against the approved alarm list, not against memory.
• Alarm messages, priorities, and groupings display correctly at the HMI and in remote notifications where configured.
• Latching alarms and reset behavior are verified, including the case where the condition is still active at reset.
• Each interlock and permissive is tested one at a time, with the result recorded.
• All test bypasses and simulation flags are removed, and their removal is verified by a second person.

Phase 7 - Documentation and Handover

• A final as-left program backup is taken and archived with a dated change note.
• The I/O list, drawings, and setpoint/alarm lists are redlined to as-left condition and submitted per site procedure.
• Controller access accounts and passwords are handled per site policy and recorded in the site’s system, not on a sticky note in the panel.
• Firmware revisions, software versions, and recommended spare parts are recorded.
• Operators are briefed on what changed, and on any temporary conditions left in place.
• A punch list of open items is issued with owners and target dates.
• Sign-off from the site representative is obtained before the crew leaves.

Sources & Standards

This checklist reflects common commissioning practice. For the underlying standards and guidance:

• International Society of Automation (ISA) - standards covering instrumentation documentation, alarm management, and control system security that commissioning work touches.
• International Electrotechnical Commission (IEC) - publisher of the IEC 61131 series covering programmable controllers and their programming languages.
• NIST SP 800-82 Rev. 3 - the Guide to Operational Technology (OT) Security, relevant to controller access, network changes, and change management during commissioning.