PLC Commissioning Checklist

Back to Resources

How to Use This Checklist

The checklist is organized as seven phases in the order most commissioning jobs actually run: preparation, pre-download checks, I/O checkout, communications, fail-state behavior, alarm and interlock testing, and handover. Work each phase to completion before moving on - most late-night commissioning problems trace back to a skipped item in an earlier phase.

Two ground rules. First, this page describes common practice, not requirements: your site procedures, permit system, and the equipment manufacturer's instructions always take precedence. Second, where a value is site-specific (test tolerances, setpoints, password policy), record what your site requires rather than inventing one on the spot. If a technician on the crew is new to this work, the free controls-engineering courses at Automation University cover the background each phase assumes.

Phase 1 - Preparation and Prerequisites

Everything in this phase happens before you connect a programming laptop to anything. A common prerequisite hiding behind these items is the panel itself: if the enclosure is still in the shop, the wiring, labeling, and factory acceptance test described in how an industrial control panel is fabricated all have to finish before field commissioning can start.

• Confirm the scope in writing: which controllers, which routines, and which sites are being changed.
• Collect current as-built drawings, the I/O list, and the P&ID set, and record their revision numbers.
• Take a verified backup (upload) of the running program before any change, and store a copy somewhere other than the programming laptop.
• Record the processor model, firmware revision, and installed card layout, and confirm your programming software version supports them.
• Agree on an addressing plan: controller IP addresses, subnets, and any serial node addresses, checked against what is already on the network.
• Review lockout/tagout and permit-to-work requirements with the site before energizing, forcing, or stroking anything.
• Confirm the maintenance window, who is affected, and who has the authority to stop the test.
• List every connected system that could react to the change: HMI, historian, telemetry, drives, and any safety systems.

Phase 2 - Pre-Download Checks

Run these immediately before transferring the program to the controller.

• The offline program compiles or verifies with zero errors, and every warning has been read and dispositioned.
• A cross-reference check has been run: no unintended duplicate writes to the same output or tag.
• First-scan and power-up initialization logic has been reviewed: presets, latches, and one-shot logic behave as intended on a cold start.
• Retentive vs non-retentive tag behavior is confirmed against what the process needs after a power cycle.
• Timers, scaling constants, and setpoints are populated with reviewed commissioning values, and placeholders are flagged.
• You are connected to the intended controller (verify the path, controller name, and serial number) - not a neighboring unit on the same network.
• The process is in a safe state for a download, and the operator knows outputs may change state.
• The pre-download upload is saved alongside the new program file with a dated change note.

Phase 3 - I/O Checkout

Isolate outputs from the process wherever actuation could cause harm, and clear each point one at a time against the I/O list.

• Digital inputs: operate each field device (or simulate at the device terminals) and confirm the correct program tag and HMI indication change state.
• Digital outputs: command each output from the controller and confirm the correct field device responds, with mechanical or process isolation confirmed first.
• Analog inputs: inject 0, 25, 50, 75, and 100% of range and verify both raw counts and scaled engineering values at each point.
• Analog outputs: command 0, 25, 50, 75, and 100% and measure the result at the field device.
• Engineering units, ranges, and decimal formatting match the instrument index at every layer: controller, HMI, historian.
• Wire labels and terminal numbers match the drawings; discrepancies are redlined immediately, not remembered for later.
• Spare I/O points are verified and documented as spares in the I/O list.
• Every force and simulation is removed at the end of checkout, and the force table is verified empty.

Phase 4 - Communications Verification

• Every configured comms partner shows a healthy status: HMI, RTU or telemetry gateway, drives, and third-party devices.
• Register and tag maps for third-party devices are spot-checked against the vendor documentation, including data type, scaling, and byte order.
• Watchdog or heartbeat tags are configured and verified in both directions where the link supports it.
• Each critical link has been failed deliberately (pull the cable or disable the port) and the comms-loss alarm and programmed fallback behavior confirmed.
• Update rates are verified with the full device count online, not just with one device connected.
• Redundant comms paths, if present, are verified by failing the primary and watching the switchover.

Phase 5 - Fail-State Behavior

This is the phase most often skipped under schedule pressure, and the one that matters most at 2 AM.

• Outputs go to their specified states when the processor is switched to stop or program mode.
• Remote I/O behavior on comms loss (hold last state vs go to a configured safe state) is confirmed and matches the design intent.
• A full power-cycle test has been run: the process comes back to a safe, known state without manual intervention in the logic.
• Valve and motor fail positions are verified against the P&ID, not against the program comments.
• Behavior on power restoration is verified: nothing auto-restarts that should require an operator.
• Emergency stops and hardwired interlocks are verified to act independently of the program.

Phase 6 - Alarm and Interlock Testing

• Every alarm in the approved alarm list is exercised - at the field device where practical, otherwise at the marshalling terminals.
• Alarm setpoints are verified against the approved alarm list, not against memory.
• Alarm messages, priorities, and groupings display correctly at the HMI and in remote notifications where configured.
• Latching alarms and reset behavior are verified, including the case where the condition is still active at reset.
• Each interlock and permissive is tested one at a time, with the result recorded.
• All test bypasses and simulation flags are removed, and their removal is verified by a second person.

Phase 7 - Documentation and Handover

• A final as-left program backup is taken and archived with a dated change note.
• The I/O list, drawings, and setpoint/alarm lists are redlined to as-left condition and submitted per site procedure.
• Controller access accounts and passwords are handled per site policy and recorded in the site’s system, not on a sticky note in the panel.
• Firmware revisions, software versions, and recommended spare parts are recorded.
• Operators are briefed on what changed, and on any temporary conditions left in place.
• A punch list of open items is issued with owners and target dates.
• Sign-off from the site representative is obtained before the crew leaves.

Sources & Standards

This checklist reflects common commissioning practice. For the underlying standards and guidance:

• International Society of Automation (ISA) - standards covering instrumentation documentation, alarm management, and control system security that commissioning work touches.
• International Electrotechnical Commission (IEC) - publisher of the IEC 61131 series covering programmable controllers and their programming languages.
• NIST SP 800-82 Rev. 3 - the Guide to Operational Technology (OT) Security, relevant to controller access, network changes, and change management during commissioning.