This chapter works from the PLC's scan cycle down to the valve at the end of the loop, covering ladder logic, P/I/D action, cascade and three-element boiler control, and the fail-safe and alarm rules examiners keep testing.
Strip away the touchscreen and the acronym and a PLC is a ruggedised computer built for one job: read a rack of input cards, run a stored program against those readings, and drive a rack of output cards, over and over, for years without a reboot. The central processing unit, power supply and input/output modules sit on a rack or in a distributed set of remote I/O stations linked back to the CPU by a fieldbus, so the same logic can reach sensors and actuators scattered across an engine room without a separate cable run for every signal.
What makes the machine deterministic is the scan cycle, and it is worth being able to say the three stages in order without thinking: read inputs, solve logic, write outputs. The CPU freezes a snapshot of every input at the start of the scan, solves the entire ladder program against that frozen snapshot, then writes all the outputs together at the end. Nothing changes mid-scan — a contact that flips halfway through is not seen until the next cycle. That freeze is what makes ladder logic predictable to trace: the state read at the top of a rung is the state for the whole scan.
Scan time is the number that turns this from an academic point into an exam point. If an input pulse is shorter than one scan time, the PLC can miss it entirely — it was high and low again before the CPU ever looked at it. That is exactly why genuinely safety-critical functions — main engine overspeed trip, boiler flame failure — are not left to the PLC program at all, but wired through hard-wired relay or dedicated trip logic that reacts to the signal directly, independent of whatever the scan cycle happens to be doing at that moment.
The scan cycle is why a PLC is predictable, and why it is not, on its own, safety-rated: predictable because inputs are frozen for the whole scan, and not safety-rated because a fast enough event can still slip between two scans.
Ladder logic is drawn to look like the relay panel it replaced, and that is deliberate — it lets an engineer who has never written a line of code still trace a fault. Each rung runs left to right between two power rails: contacts on the left represent conditions, a coil on the right represents the result. A normally open contact passes power when its associated bit is true; a normally closed contact passes power when its bit is false. Put several contacts in series on a rung and the logic is an AND; put them on parallel branches and the logic is an OR. Reading a rung is nothing more than working out whether that path from left rail to coil is closed.
Two elements cause most of the confusion in an exam question. The first is the latch, usually shown as a set (S) and reset (R) coil pair, or drawn as a self-sealing rung where the coil's own contact holds itself in. A latch, once set, stays set after the triggering contact opens — it does not need continuous power to stay on, and it will not turn off until its reset condition is separately satisfied. The practical skill is spotting a latch with no reset rung anywhere in the program, or a reset condition that can never occur: that output stays on forever, and on something like a fuel pump or an alarm silence that is a real hazard, not a curiosity.
The second is the timer. An on-delay timer (TON) starts counting once its input goes true and only makes its output true after the preset time has elapsed with the input still true — useful for ignoring a brief nuisance signal such as a pressure spike on start-up. An off-delay timer (TOF) does the opposite: the output drops out only after the preset time following the input going false, useful for keeping a lubricating pump running for a coast-down period after a stop command. Getting TON and TOF the wrong way round is a common error under exam pressure — the question to ask is always "when does the preset time start counting?"
Every PLC input and output card belongs to one of two families. Digital (discrete) cards handle on/off signals — a limit switch, a pushbutton, a motor-running contact, a solenoid valve coil — and simply report or drive a 24 V dc (occasionally 110 V ac) state. Analogue cards handle a continuously variable signal — a pressure, a temperature, a level, a valve position — and that variable has to be carried as an electrical signal proportional to it, almost always a 4–20 mA current loop rather than a voltage.
Current is used instead of voltage because a current loop is immune to the resistance of a long cable run: the same current flows at every point in the loop regardless of cable length, so voltage drop along the wire does not corrupt the reading the way it would for a 0–10 V signal. The range starts at 4 mA rather than 0 mA for the same reason a soundings book never reports "no water" as silence — a genuine zero reading has to look different from a dead loop. 4 mA is defined as the live zero, the bottom of the real measurement range; 0 mA can only mean a broken wire, a disconnected transmitter or a blown fuse, and the PLC, or the technician reading a meter, should treat it as a fault, not as "zero and fine."
Scaling a raw current into a usable number is simple once the live zero is remembered: subtract the 4 mA offset, divide by the 16 mA range of the signal, and multiply by the span of the instrument. The same idea runs in reverse for an analogue output card driving a valve positioner or a governor actuator — the PLC calculates a percentage demand internally and converts it back into a 4–20 mA drive signal for the field device. Analogue cards also need care over screening and earthing: a poorly screened analogue cable run alongside a power cable will pick up induced noise that a digital card would simply ignore, because a digital input only cares whether the signal is above or below a threshold, not its exact value.
Every closed control loop is chasing the same number: the error, the difference between setpoint and measured value. What a PID controller does with that error, and how much of each of the three terms it applies, is the core of this part of the syllabus, and it rewards being able to explain each term's job rather than just recite the formula.
Proportional action multiplies the instantaneous error by a fixed gain, Kp, and moves the valve by that amount. It responds immediately and is stable, but it has a structural weakness: a proportional-only controller needs some error present to hold the valve away from its rest position, so as soon as the load moves away from the condition the controller was tuned at, a permanent offset appears between setpoint and actual value. Proportional band, expressed as a percentage, is simply another way of stating the same gain — a narrow band (high gain) moves the valve hard for a small error; a wide band (low gain) moves it gently.
Integral action is what removes that offset, and it does so by accumulating — literally integrating — the error over time, so that even a small, persistent error keeps adding to the output until the error is driven to zero. The cost is that integral action always lags behind the current situation, because it is reacting to history, and if it is set too aggressively (too short a reset time) it overshoots and hunts. Derivative action looks the other way: it reacts to how fast the error is changing, not its size, giving the loop an anticipatory kick that can noticeably improve the response to a genuine ramp or upset. Its weakness is that it cannot tell a genuine fast change from electrical noise on the signal, so applying derivative action to a noisy, fast-responding loop — a small-bore steam pressure loop is the classic case — makes the valve hunt violently rather than settle.
Proportional reacts to how big the error is, integral reacts to how long it has been there, derivative reacts to how fast it is changing — and only integral ever drives the error itself to zero.
A single control loop measures one variable and drives one final element, and for most services that is entirely adequate. Two situations push beyond a single loop: when the final element itself has a disturbance worth correcting before it ever reaches the process, and when the measured variable is not a trustworthy guide to what the final element should do at every instant. Cascade and feed-forward answer the first; three-element boiler level control answers the second.
In a cascade arrangement, an outer (primary) loop does not drive the final element directly — it sets the setpoint of an inner (secondary) loop, which then drives the valve. A common marine example is a temperature controller (outer) whose output becomes the setpoint for a flow controller (inner), which in turn positions the steam or cooling valve. The inner loop corrects disturbances in its own variable — a supply pressure change, say — long before that disturbance would otherwise have worked its way through to upset the slower outer variable. For cascade to work at all, the inner loop has to respond faster than the outer one; if the two loops are similar in speed they interact and hunt against each other rather than cooperating.
Feed-forward takes a measurement of a known disturbance and applies a correction to the final element immediately, without waiting for that disturbance to show up as an error in the controlled variable at all. Three-element boiler level control is the clearest worked case of feed-forward on a marine exam: instead of trusting drum level alone, the scheme adds steam flow (feed-forward, telling the valve roughly how much feedwater is about to be needed) and feed flow (confirming how much is actually being delivered) to the level signal. The level loop then only has to trim a small remaining error rather than chase the full demand change from a standing start, which is exactly what defeats the shrink-and-swell behaviour that fools a level-only controller during a load change.
Every control valve with a spring-return actuator has to fail somewhere when it loses its signal or its actuating air or hydraulic supply, and which way it fails is a design decision made at the drawing-board stage, not an accident of the hardware. The rule is to ask which position is safer with no control at all: a fuel oil valve or a steam valve fails closed, because an uncontrolled supply of fuel or steam is the dangerous state; a cooling water valve or a lubricating oil valve usually fails open, because losing cooling or lubrication is the dangerous state. An examiner asking for the fail-safe direction of a named valve wants that reasoning stated, not just the word "closed" or "open" — naming the direction and explaining why it is the safer default is worth more of the mark than describing how the spring or the diaphragm works.
Alarm philosophy on a modern automated ship rests on keeping the safety function separate from the control function, right down to the transmitter. A control loop and its associated alarm can reasonably share an instrument, but the shutdown or trip function that acts when the alarm is ignored must not — sharing a transmitter between control/alarm and shutdown means a single instrument failure can defeat both layers of protection at the same time, which is precisely the failure mode independent safety systems exist to avoid.
Unattended machinery space (UMS) notation adds a further layer of requirements on top of ordinary automation: alarms must be audible and visible both in the control room and, through an extension system, wherever the duty engineer might be — cabin, mess, public spaces — so that a fault raised while the engine room is unmanned still reaches someone. A dead-man alarm requires the duty engineer to periodically acknowledge that they are fit and available, sounding a general alarm if no acknowledgement is made within the set interval. Standby equipment such as a second lubricating oil pump or cooling pump must start automatically on detection of a fault in the running unit, and every alarm event is logged so that a sequence of events can be reconstructed afterwards.
The three problems below are deliberately layered rather than a single formula substitution — each one asks for a calculation and then a decision or explanation built on top of it, which is the shape the real exam questions take.
A boiler's steam pressure is controlled by a single fuel-valve positioner working on proportional action only. The pressure transmitter spans 0–16 bar and the controller gain is set to Kp = 4. At no load the valve sits at 50% open with pressure exactly on the 10 bar setpoint (zero error). A manoeuvring order raises steam demand, and the valve must open to 74% to supply it. Because this is proportional-only control, find the steady-state pressure the boiler settles at once the valve has repositioned, and state the offset.
Transmitter span: 0–16 bar Controller gain K_p = 4 Setpoint: 10 bar Valve travel: 50% → 74%
Find the output change the valve had to make.
The controller output moved from 50% to 74%, a change the proportional action alone had to produce.
Convert that output change into the error (deviation) that produced it.
Using the proportional relationship output = K_p × e, so e = ΔOutput / K_p.
Convert the error from percent of span into bar.
Then apply it to the setpoint to get the pressure the boiler is actually holding once it has settled — this deviation is the offset, and no amount of waiting removes it, because there is no integral action present to accumulate it away.
AnswerBoiler pressure settles at 9.04 bar against a 10 bar setpoint — a permanent 0.96 bar offset that only integral action would remove.
The trap: assuming a bigger proportional gain removes the offset — it only shrinks it; proportional action can never drive the error to zero on its own.
A ship's boiler is on three-element level control, meaning drum level, steam flow and feed flow all enter the feed-demand calculation. Steam demand rises suddenly from 8000 kg/h to 12000 kg/h as the plant answers a manoeuvring order. The feedwater flow-measurement range is 0–15000 kg/h, and at the instant of the load change the level controller's trim output is +2% of that range, correcting a small level deviation that had built up beforehand. Calculate the new feedwater flow setpoint the three-element scheme demands, and explain why this responds faster and more safely than a level-only scheme would during the same transient.
Steam flow: 8000 kg/h → 12000 kg/h Feedwater flow range: 0–15000 kg/h Level-loop trim: +2% of feed range
Calculate the new feedwater flow setpoint the three-element scheme demands, and explain why this responds faster and more safely than a level-only scheme would during the same transient
Take the steam-flow signal as the feed-forward term.
In steady running, feed mass flow must equal steam mass flow for drum level to stay constant, so the new steam flow becomes the base feed demand immediately — the scheme does not wait for level to move first.
Add the level controller's trim.
Which corrects the small residual deviation the level loop was already working on before the load changed.
Compare this with single-element (level-only) control.
On a sudden load increase the drum level typically rises first even though feedwater mass is falling — shrink and swell, caused by more steam bubbles forming in the water as boiler pressure eases. A level-only controller reads that rise as ‘too full’ and throttles the feed valve back, exactly when more feed is actually needed; when the swell subsides and true level then drops, the boiler is already short of water. Three-element control is not fooled, because its fast response comes from steam flow, not from the temporarily misleading level signal.
AnswerNew feedwater setpoint = 12,300 kg/h, driven onto the valve by the steam-flow feed-forward path before the level signal has even had time to show the swell.
The trap: trusting the level signal to lead the response during the first seconds of a load change — swell and shrink make it read backwards, which is precisely why steam flow, not level, drives the fast part of three-element control.
The main engine lube-oil pressure transmitter is a linear 4–20 mA device spanning 0–10 bar, wired into a PLC analogue input that drives the control-room low-pressure alarm (setpoint 2.5 bar) and, as currently installed, also feeds the engine slow-down/trip logic. During a watch the loop current reads 7.6 mA. Find the actual lube-oil pressure, decide whether the low alarm should be active, and assess whether wiring the trip from the same transmitter is acceptable.
Transmitter: 4–20 mA linear over 0–10 bar Low-pressure alarm setpoint: 2.5 bar Measured loop current: 7.6 mA Same transmitter also wired to the engine trip
Find the actual lube-oil pressure, decide whether the low alarm should be active, and assess whether wiring the trip from the same transmitter is acceptable
Convert the loop current to engineering units.
The 4–20 mA range maps linearly onto the 0–10 bar span, with 4 mA representing the live zero, not a fault.
Compare against the alarm setpoint.
Assess the shared wiring.
A single transmitter feeding both the operating alarm and the trip means one failed instrument — a stuck signal, a snapped capillary, a dead sensor — can simultaneously hide the alarm and disable the shutdown that is meant to protect the engine when the alarm is ignored or missed. The trip function needs its own, independent transmitter so that no single instrument fault can defeat both layers of protection at once.
AnswerActual pressure = 2.25 bar, so the low alarm is correctly active; the shared trip wiring is not acceptable and the trip must run from a separate, dedicated transmitter.
The trap: reading 0 mA as ‘zero pressure’ instead of a broken loop — with a 4–20 mA live zero, anything below 4 mA is a fault, not a low reading — and assuming one transmitter can safely carry both the alarm and the trip.
PLC scan cycleRead inputs → solve logic → write outputs → housekeepingOutput = K_p(e + (1/T_i)∫e dt + T_d de/dt)Full PID actionProportional band = 100 / K_p %Span of error needed for 100% valve travelPV = (I − 4)/16 × spanScaling a linear 4–20 mA signal into engineering unitsCascade: outer loop sets inner loop's setpointInner loop must be the faster of the twoThree-element level = level + steam flow + feed flowFeed-forward on steam flow defeats shrink and swellFail closed: fuel, steam · Fail open: cooling, lubricationDirection set by which failure is safer4–20 mA live zero0 mA reads as a broken loop, not a genuine zeroUMS: alarms, extensions, dead-man, auto standby pumpsConditions underpinning unattended machinery space operation