When the PLC loses its program: the backups you'll wish you had

It's Sunday night. The site's coming back up after a weekend power cut. Everything restarts except the case packer. The HMI says "no communication". The CPU has a red light on it you've never seen before.

Your shift electrician opens the panel. The battery holder in the CPU is empty, or the battery's been dead for years and nobody knew. The program has gone.

Someone asks the obvious question. Where's the backup? There's a laptop in the office that the old controls engineer used. It's locked, and they left two years ago.

Most sites lose more time looking for the program than reloading it. The fault takes ten minutes to understand. Finding the right file can take all night.

First, make it safe

A PLC with no program will do nothing. A PLC with half a program, or the wrong one, can do anything.

PUWER asks for control systems where a fault, or the loss of a power supply, "cannot result in additional or increased risk to health or safety", so far as is reasonably practicable (regulation 18). A blank CPU should leave the machine stopped. A reload is the moment that can change.

So before anyone downloads anything, the machine is isolated where it can be, and nobody is inside the guarding. The first run after a reload is done with everyone stood back and someone on the e-stop. Then test every interlock, light curtain and guard switch before the operators come back. Don't trust that the safety relay covers it. On plenty of older kit, some of the guard logic sits in the PLC.

The file you need, and the file you've got

There's a difference between a program and the right program.

The file on the laptop might be the one from commissioning. Since then, someone has changed a timer, added a sensor, bridged a fault that kept tripping, and put in a new recipe. None of that is in the old file. Load it and you've rolled the machine back five years.

HSE's guide to control system failures, HSG238, draws a clear line here. Maintenance restores equipment "to its original specification". A modification is anything meant "to change the specification" of the machine. Loading an older file than the one that was running is a change to the machine, even if nobody meant it. The same guide says the impact of a change on other safety systems is "often overlooked".

In practice, that means:

• compare the file against what you know about the machine before you download
• check the I/O list against what's wired, if you have one
• ask the operators what the machine did last week that it might not do now
• write down which file went in, from where, and who loaded it

Our guide to going online to a PLC to fault-find covers the safe way to connect once you're there.

When there's no file at all

Sometimes there's nothing. No laptop, no USB stick, no copy on the server. Now you have three options, and none of them are quick.

The machine builder may hold a copy. Ring them first thing, with the serial number off the plate. Some will email it the same day. Some went bust years ago. Some will want a paid visit to load it themselves.

The integrator who last worked on it may have one. Check old invoices and job sheets for the name.

Or someone rewrites it. On a simple machine, a good controls engineer can rebuild the logic from the drawings and the operators' memory. On a complex one, that's days. Your line is stood the whole time.

Here's where the cost shows. Work out what an hour of downtime costs on that line, then multiply by the time it takes to find a file. Our guide to working out the cost of downtime shows how. A backup on a USB stick costs nothing.

Get the right person on it

This is the point where a lot of sites lose the night. A good electrician is a good electrician. That doesn't make them a controls engineer.

Reloading a program means the right software, the right version of it, the right cable, and someone who knows the platform. An old processor might need software that won't install on a new laptop. A fitter who has never been online to that make of PLC will spend two hours on drivers before they touch the fault.

HSE's maintenance guidance says to "decide if the work should be done by specialist contractors", and says with high-risk or complex kit the work may be best done by "the manufacturer or specialist contractors" (HSE, maintenance). A PLC reload on a guarded machine is that kind of job. If nobody on shift has done one on that platform, make the call early. Our 30-minute rule applies here more than anywhere.

The backups you'll wish you had

Here's our view. Every PLC, HMI and drive on site should have a current backup in two places, and one of them is not the laptop.

For each machine, keep:

• the PLC program as it's running now, uploaded from the CPU, not the one from commissioning
• the HMI project and any recipe files
• drive parameters for every inverter and servo drive
• the software name and version needed to open each file
• passwords for the programs, kept somewhere secure that more than one person can reach
• the electrical drawings, marked up with every change

Store them on a server that gets backed up, and keep a copy offline. Label each one with the date and who took it. When anyone changes a program, the backup gets taken again that day.

Be careful how you move them about too. HSE lists "maintenance activities, software upgrades and unauthorised access" among the ways threats get into control systems (HSE, cyber security). A USB stick that's been in a contractor's van is a risk. Give the controls laptop one job, and keep it off the office network.

Then check the CPU batteries. A lot of older processors hold their program on a battery, and the low battery light has often been on for months. Put the batteries on the PPM list. Change them with the power on, if the manual says so, and with a fresh backup in hand.

We go further into managing the files in PLC program backups and version control, and into the rest of the paperwork in drawings, manuals and backups.

What to do on Monday

1. List every PLC, HMI and drive on site. Next to each, write where its current backup is, or "none".
2. Upload a fresh copy of the program from your three most critical machines this week, and store it in two places.
3. Check the CPU battery light on every processor, and add battery changes to the PPM.
4. Find out who can reload each platform, on your team or outside it, and put their number in the panel.