4–20 mA fault handling and range validation

The Core Idea

A scaled number is useful only when the signal behind it is valid. Analog fault handling distinguishes a usable measurement from a sensor or wiring problem before the program acts on the value.

What you will learn

• Decide whether a 4–20 mA signal is a real measurement, using stated limits: the NAMUR (a process-industry user association) NE 43 bands.

• Keep four values apart and say what each one is for: the raw signal, the scaled value, a clamped display, and a bad-signal alarm.

• Keep a bad signal out of the decisions that use the measurement, in Ladder and in Structured Text.

Why it matters

Treating a failed signal as a real process value can send the program down the wrong control path, even when its scaling calculation is correct.

The problem

A level transmitter on a tank sends 4–20 mA: 4 mA means 0% (empty) and 20 mA means 100% (full). You scaled a signal like this in Scale a 4–20 mA Signal. Now the signal fails. A broken wire or a loose terminal drops the loop current to 0 mA. A transmitter that detects a fault inside itself drives the current to a failure level on purpose. Scaling turns each of these into a number that looks like a level but is not one.

This lesson uses the limits from NAMUR NE 43, a widely used recommendation for 4–20 mA transmitters:

The narrow gaps between those bands (3.6–3.8 mA and 20.5–21 mA) are neither a measurement nor a failure signal. This lesson's rule: any signal below 3.8 mA or above 20.5 mA is not a valid measurement.

On a real input card the raw signal arrives as counts; Scale Raw Counts to Engineering Units covers that step. Here it is already in mA, so the lesson can focus on what to do when the signal is wrong.

Predict

Type 0 into Raw signal. Compare Scaled level (not clamped), Display level (clamped), the tank graphic, and the BAD SIGNAL lamp. Then type 12 to put the signal back.

Try it

Keep using the demo above. It appears once you lock in a prediction. Type each value into Raw signal (0–24 mA):

1. 12 mA, a normal signal. Scaled level 50.00%, display 50%, no alarm, FILL PERMIT on.

2. 2 mA, under range. Scaled level −12.50%, display 0%, BAD SIGNAL on, FILL PERMIT off.

3. 22 mA, over range. Scaled level 112.50%, display 100%, BAD SIGNAL on, FILL PERMIT off.

4. 3.9 mA, slightly low. Scaled level about −0.63%, display 0%, and no alarm: the transmitter is healthy and the tank is just below its calibrated empty point.

5. 20.4 mA, slightly high. Scaled level 102.50%, display 100%, no alarm. FILL PERMIT is off because the tank is full, not because the signal is bad.

Now use the Fault injection panel below the demo. Set Fault to Out-of-range transmitter, Tag to LEVEL_MA, and Signal to Below range, then press Inject fault. The fault replaces what the programmable logic controller (PLC) reads with 2.4 mA, whatever the Raw signal box says; the fault list shows the value, and the scan stepper shows it as LEVEL_MA. The scaled level drops to about −10% and the alarm comes on. Inject Above range (21.6 mA) the same way, then press Clear fault.

Look closer

The program keeps four values, each with its own job:

Pause, type 0 into Raw signal, and use Step one scan. The scan stepper shows each value.

• Rung 1 subtracts the 4 mA live zero (SUB) into OFFSET_MA, then multiplies by 6.25 % per mA (MUL) into LEVEL_PCT. There are no limits here, so 0 mA gives −25%.

• Rung 2 is the range check: a less-than comparison (LT) of LEVEL_MA with 3.8 mA in parallel with a greater-than comparison (GT) with 20.5 mA, driving SIGNAL_BAD. It compares the raw signal in mA, because the limits are stated in mA.

• Rungs 3–5 build the display. A move (MOVE) copies LEVEL_PCT into DISPLAY_PCT. Below 0%, the next rung moves 0 in its place; above 100%, the last one moves 100. Rungs run from top to bottom, so the limit rungs replace the copy in the same scan. This is the same limit pattern as Operator Setpoints and Limits.

• Rung 6 permits filling: LEVEL_PCT less than 90% in series with a normally closed SIGNAL_BAD contact. A bad signal opens the permit, whatever the level appears to be.

The same decision in Structured Text uses the same tags:

OFFSET_MA := LEVEL_MA - 4.0;
LEVEL_PCT := OFFSET_MA * 6.25;            (* scaled value, not clamped *)

SIGNAL_BAD := (LEVEL_MA < 3.8) OR (LEVEL_MA > 20.5);

DISPLAY_PCT := LEVEL_PCT;                 (* display only: limit to 0-100 % *)
IF LEVEL_PCT < 0.0 THEN
    DISPLAY_PCT := 0.0;
ELSIF LEVEL_PCT > 100.0 THEN
    DISPLAY_PCT := 100.0;
END_IF;

FILL_PERMIT := (LEVEL_PCT < 90.0) AND NOT SIGNAL_BAD;

Both versions are checked against the same cases and give the same values for every signal.

Change it

In this practice program, the fill permit rung trusts the scaled level and has no alarm check. Open it and, in the editor's tag list, set LEVEL_MA to 12: FILL_PERMIT is TRUE. Now set LEVEL_MA to 0, as if the loop were broken. SIGNAL_BAD turns on, but FILL_PERMIT stays TRUE, because −25% is "below 90%". The inlet could open on a tank whose level nobody knows. Add the missing check to the fill permit rung, then try 0, 12, and 22 mA again and press Validate. The Fault injection panel works here too.

Show the guided change

Add a normally closed SIGNAL_BAD contact in series with the less-than comparison on the fill permit rung. A normally closed contact passes power only while its tag is FALSE, so the permit can turn on only while the signal is valid. At 0 mA and at 22 mA the alarm opens the rung; at 12 mA the permit works as before. The scaling, alarm, and display rungs do not change.

Check yourself

A 0–10 bar pressure transmitter sends 4–20 mA (4 mA = 0 bar, 20 mA = 10 bar). The challenge editor opens with the tags PRESS_MA, OFFSET_MA, PRESS_BAR, DISPLAY_BAR, and SIGNAL_BAD, and no rungs. Build:

• PRESS_BAR: the scaled pressure in bar, not clamped.

• DISPLAY_BAR: a copy of PRESS_BAR limited to 0–10 bar.

• SIGNAL_BAD: TRUE while PRESS_MA is below 3.8 mA or above 20.5 mA.

In the editor's tag list, type values into PRESS_MA, for example 12, 0, 22, and 3.9 mA, and watch the three results. The checks use normal and full-scale signals, a broken loop, an over-range failure, both band edges, the failure signals, signals in the gaps, and a signal that returns to normal. Run them as often as you need.

Hint 1

Which of the three values must keep a reading like −2.5 bar so a technician can see it? Which one may be limited, and what should the alarm compare: bar or mA?

Hint 2

Scale first: subtract 4 mA, then multiply by the bar per mA (10 bar spread over 16 mA). Check the raw signal for the alarm. Limit only a copy of the scaled value for the display.

Hint 3

SIGNAL_BAD comes from PRESS_MA less than 3.8 in parallel with PRESS_MA greater than 20.5. Move PRESS_BAR into DISPLAY_BAR, then move 0 when PRESS_BAR is less than 0, and move 10 when it is greater than 10.

Show the worked solution

1. Subtract 4 from PRESS_MA into OFFSET_MA, then multiply OFFSET_MA by 0.625 into PRESS_BAR. (Multiplying by 10 and then dividing by 16 gives the same result.)

2. A less-than comparison of PRESS_MA with 3.8, in parallel with a greater-than comparison of PRESS_MA with 20.5, drives the output coil SIGNAL_BAD.

3. A move copies PRESS_BAR into DISPLAY_BAR.

4. A less-than comparison of PRESS_BAR with 0 enables a move of 0 into DISPLAY_BAR.

5. A greater-than comparison of PRESS_BAR with 10 enables a move of 10 into DISPLAY_BAR.

At 0 mA, PRESS_BAR is −2.5 bar, DISPLAY_BAR is 0 bar, and the alarm is on. At 3.9 mA, the pressure is slightly below 0 bar and the display shows 0 bar, but there is no alarm: the reading is inside the measurement band. Three display rungs with exclusive conditions (below 0, above 10, and 0 to 10) also pass, and the alarm rung can come before or after the scaling.

What happened and why

Each value in a fault-handling routine has one job. The raw signal is the evidence: it is what a technician measures at the terminals with a meter, and it is what the stated limits are written in. The scaled value carries the measurement into engineering units. Leaving it unclamped keeps its errors visible: −25% cannot be a level, so it points straight at the loop. The clamped display is for people. A tank graphic cannot draw −25%, so it pins at 0%, and that makes a broken loop look exactly like an empty tank. That is why the display must never feed a decision, and never be the place where the program looks for a fault. The bad-signal alarm is the program's statement that the level is unknown.

When the alarm is on, every decision that uses the measurement must take its safe side. For the fill permit, the safe side is "do not fill": with no measurement, nobody can say the tank has room. Which side is safe depends on the decision. Closing a tank inlet is safe; stopping a cooling pump on a bad temperature signal may not be, so decide for each decision and write it down.

The alarm in this lesson follows the signal and clears as soon as the signal returns. A plant alarm system usually also latches it until the operator acknowledges it (Discrete Alarms and Acknowledgement), and many programs add a short delay so that one noisy reading does not raise an alarm.

Show the math

LEVEL_PCT = (LEVEL_MA − 4 mA) × 6.25 %/mA, because 100% spread over the 16 mA span is 6.25% per mA.

For the pressure transmitter, 10 bar over 16 mA is 0.625 bar per mA, so 0 mA gives (0 − 4) × 0.625 = −2.5 bar.

Common mistakes

• Checking the clamped display for a bad signal. Cause: the alarm compares DISPLAY_PCT with 0% and 100%. Symptom: the alarm never turns on, because the display never leaves 0–100%. Fix: compare the raw signal in mA with the stated limits.

• Treating 4–20 mA as the only valid band. Cause: alarming below 4 mA and above 20 mA. Symptom: a healthy transmitter reading 3.9 mA, just below the calibrated empty point, raises a false alarm. Fix: use the measurement band, 3.8–20.5 mA.

• Clamping the scaled value itself. Cause: the limit rungs write LEVEL_PCT instead of a display copy. Symptom: a broken loop reads 0%, the same as an empty tank, and the diagnostic value is gone. Fix: leave the scaled value unclamped and limit only DISPLAY_PCT.

• Using the scaled value in a decision without the alarm. Symptom: on a broken loop the level reads −25%, which looks low, so the fill permit stays on. Fix: put a normally closed SIGNAL_BAD contact in every rung that acts on the measurement.

• Treating the band edges as failures. Cause: less-than-or-equal (LE) and greater-than-or-equal (GE) comparisons at 3.8 and 20.5 mA. Symptom: exactly 3.8 mA or 20.5 mA raises the alarm. Fix: use less-than and greater-than; the edges belong to the measurement band.

• Alarming only on the failure signals. Cause: checking for 3.6 mA or less and 21 mA or more. Symptom: 3.75 mA or 20.75 mA, in the gaps between the bands, passes as a measurement. Fix: anything outside 3.8–20.5 mA is not a valid measurement.

Platform notes

Many analog input cards can detect an under-range signal, an over-range signal, or a broken loop on their own and report it in a channel status bit or as a special value. Their limits may differ from NE 43, and some diagnostics must be switched on in the card's configuration. Find out what the card reports and at which currents, then decide whether the program adds its own check, as this lesson does. NE 43 also lets you choose whether a transmitter signals a failure low (3.6 mA or less) or high (21 mA or more); the receiving program must catch both.

The editor's Compare palette lists the comparisons by their IEC names, LT (Less Than), GT (Greater Than), LE (Less Or Equal), and GE (Greater Or Equal), and the Math palette lists MOVE.

The comparisons are LES (Less Than), GRT (Greater Than), LEQ (Less Than or Equal), and GEQ (Greater Than or Equal), and the move is MOV. Logix analog input modules provide per-channel under-range and over-range status bits; the module manual gives the current at which each one sets.

A 4–20 mA input reads 0–27648 counts across its rated range. Readings beyond it continue into an overshoot or undershoot range, and 32767 or −32768 marks an overflow or underflow. Current inputs can also raise a wire-break diagnostic when it is enabled in the module configuration.

Enable JavaScript to run the embedded simulator and complete the interactive exercises.