How to Find Which Controller Is Actually in Charge

Why this matters

On any system that has been touched more than once, several things are capable of writing to the same output and only one of them is doing it right now. The print will not tell you which, the graphic will not tell you which, and the person who installed the last retrofit has moved on. Adjust the wrong one and nothing happens, which is the mildest possible outcome; the worse one is that something happens two hours later when the writer you adjusted takes a turn.

Authority is not a documented property. It is an observable one, and it is observed the same way in every system: you move the output by hand, and you watch what puts it back. The rest of this procedure is about doing that safely, and about narrowing a long candidate list quickly enough that the test is worth running.

Before your first perturbation

You are about to command real equipment by hand. Establish the final element's failure position and neutralize stored energy before anything moves: isolate the actuator's supply, lock and tag it under 29 CFR 1910.333(b)(2), prove dead by the live-dead-live sequence in NFPA 70E-2021, 120.5, and relieve spring or linkage tension under 29 CFR 1910.147 before any part of you is inside the swing path. Once it is energized again, hands and tools stay clear of the drive train while it can move.

Do not perturb an output that serves a combustion path, a pressurized or refrigerant-bearing path, or a relief or protective function. On those, the search is conducted by reading the writers rather than by moving the element.

Where the perturbation has to be commanded with the control circuit live, that is the narrow troubleshooting allowance at 29 CFR 1910.333(a)(1), and it comes with meter and leads rated for the circuit's measurement category and available fault current plus the shock and arc-flash protection the assessment calls for.

And before you move anything: know how to put it back. Record the present value, in its own units, and know which action restores it. A perturbation you cannot reverse is not a test.

Step 1: Write the candidate list, because a search with no denominator is not a search

List every entity capable of writing that output. Not every controller - every writer. One controller routinely holds several: a control loop, a startup or warm-up routine, a limit override, a schedule.

For each candidate, record how often it writes and whether it writes a computed value or a fixed one. Those two properties are what the following tests measure against, and if you skip this step the tests produce numbers you have nothing to compare to.

Typical candidates on an ordinary system: a local control loop; a local startup routine; one or more supervisory routines; an operator's manual entry; a scheduled event; a hardwired relay that forces the output through a contact; and any second system that shares the point.

Step 2: Pick a perturbation with a stated floor and a stated cap

Floor: move the output by at least 5 times the peak-to-peak variation it shows at steady state. If the output normally wanders within about 2 percentage points, move it 10 points. Anything smaller cannot be distinguished from the wander.

Cap: stop at whatever keeps the controlled variable inside the tolerance the customer lives with, and stop below any point where the process itself changes character - a coil that could freeze, a duct that could collapse against a closed damper, a vessel that could reach a limit.

Step size if the first attempt is inconclusive: if 10 points produces no reassertion within 3 times the longest write interval on your candidate list, double it once to 20 points and stop there. A third increase is a sign that the answer is in Step 6, not that the perturbation is too small.

Skipping the cap is how a diagnostic test becomes a service call of its own.

Step 3: Cut the widest shared channel first

The first cut should remove the most candidates per action, and on almost every system that is the network or bus connection at the local controller. Isolating it removes every remote writer in one move: supervisory routines, front-end manual entries, scheduled events from above, and any second system sharing the point.

Perturb again with the channel cut. If the output still gets put back, every remote candidate is eliminated at once and the search is now inside one controller and its hardwiring. If it stays where you put it, the reverse is true and the local candidates are eliminated instead.

This ordering matters. Techs commonly start by disabling one suspected routine, which removes one candidate per action, and on a list of eight that is a long afternoon.

Step 4: Time the reassertion, four trials rather than one

Move the output, start a stopwatch, and record the interval until it changes back. Do this four times, because a single trial lands anywhere inside the winner's write cycle and tells you the interval only to within its own length.

The reassertion interval equals the write interval of whichever writer is continuously asserting. Compare your measured interval against the intervals you recorded in Step 1. A candidate whose interval differs by more than the resolution of your measurement is eliminated. This routinely removes most of what survived Step 3, because write intervals on a real system are usually separated by factors rather than by percentages.

Step 5: Read the value it returns to, not just the timing

Two writers in the same controller can share a scan interval, in which case timing cannot separate them. The value does.

A control loop returns the output to a computed value that moves when its input moves. A startup routine, a limit override or a hardwired relay returns it to a fixed value - usually an endpoint - that does not care what the input is doing. So change the input by a small known amount and see whether the returned value follows.

Step 6: When nothing reasserts at all

This is the outcome people misread as success. If the output stays exactly where you put it, no writer is continuously asserting, and that does not mean nobody set it. It means the present value was established by a one-shot writer: an operator's manual entry, a scheduled event that fired and finished, or a priority claim that was taken and never released.

The reassertion test cannot see any of those, by construction. Move to the record instead: the point's own priority or command levels, its manual and override flags, and whatever last-write information the system keeps. What you are looking for is an occupied slot with no active writer behind it, which is the classic reason a schedule appears to have stopped working while every piece of logic in the building is healthy.

A sibling card covers overrides and their expiry in full; do not treat a one-shot writer as an absence of authority.

Step 7: Confirm by predicting a move, not by observing one

Naming a winner is a hypothesis until it makes a prediction that could have failed.

Take the winning loop's proportional band - the input span that drives its output across the full range - and compute the gain. Then change its measured input by a known amount and state, before you do it, which direction the output will move and roughly how far. Injecting a known value at the input is the cleanest way to make that change, and it is done with the input's field wiring lifted at the terminals with the circuit isolated and proved dead first.

If the output moves the predicted way by roughly the predicted amount, the identification holds. If it moves the wrong way or barely moves, you have found a second writer that Step 3 did not remove.

Worked example: eight candidates cut to one in three moves

A modulating output on a unit that will not hold its target. The output sits at 62 percent and nobody can say why.

Step 1, the candidate list. Eight writers, with their intervals read off the devices themselves: the local temperature loop at a 5 second scan, writing a computed value; the local warm-up routine at the same 5 second scan, writing a fixed 100 percent while active; a supervisory reset routine at 60 seconds; a supervisory demand-limit routine at 300 seconds; an operator manual entry at the front end, one-shot; a scheduled event, event-driven; a hardwired relay that forces the output through a contact, effectively continuous; and a second system writing the same networked point at 20 seconds.

Step 2, the perturbation. At steady state the output wanders within about 2 percentage points, so the floor is 10 points. The process tolerance allows a move of that size for under a minute, so the cap is not binding. Perturb from 62 percent to 52 percent.

Cut one, isolate the bus. With the network connection lifted at the local controller, the output is perturbed and comes back anyway. That eliminates the supervisory reset, the supervisory demand limit, the operator entry, the scheduled event and the second system in one action. Eight candidates down to three: the local loop, the warm-up routine and the hardwired relay.

Cut two, time it. Four trials give 4, 5, 4 and 4 seconds against a stopwatch resolution of about a second. The hardwired relay would restore the output within a fraction of a second, well inside one tick, so it is eliminated. Three candidates down to two, and both of the survivors live in the same controller on the same 5 second scan, which is why timing can go no further.

Cut three, read the value. The output returns to 62 percent each time. Raising the measured input by a known amount moves the returned value to 58 percent. A fixed writer would have returned 100 percent regardless. The warm-up routine is eliminated. One candidate remains: the local temperature loop.

Step 7, the prediction. The loop's proportional band is set to 10.0 F across the full 0 to 100 percent output, which is a gain of 10 percentage points per degree F. That gain describes the proportional term alone; over an observation window of a few seconds the integral contribution is small enough to ignore, which is exactly why the prediction is made over seconds rather than minutes. Injecting a value 2.0 F above the current reading should therefore drop the output by about 20 points, from 62 percent to about 42 percent.

Observed: 44 percent. Two points off a 20 point predicted move, roughly a tenth of the move, comfortably inside what integral action and settling account for over that window. The identification holds.

What a shortcut would have concluded. A tech who perturbed once, saw the output snap back, and stopped there would have known only that something is writing. The single most common wrong answer at that point is the supervisory system, because it is the one with a screen showing this output, and it was eliminated by the first cut in under a minute.

The failure mode to avoid on the way out. Every perturbation in this procedure is an override. Reverse each one as you finish with it, reconnect the bus, and confirm the output is back under the writer you identified before you leave. An abandoned test perturbation looks exactly like a fault to the next person, and the reason it is there is not written anywhere.

References

• 29 CFR 1910.333(a)(1) - live parts de-energized before work, and the narrow conditions permitting energized troubleshooting
• 29 CFR 1910.333(b)(2) - lockout and tagging for work on electric circuits and equipment
• 29 CFR 1910.147 - control of hazardous energy for mechanical isolation and stored energy
• NFPA 70E-2021, 120.5 - process for establishing and verifying an electrically safe work condition
• Manufacturer documentation for each writer's scan or write interval, the point's priority or command-level behavior, and the loop's proportional band
• See related: What Happens When Two Controls Want Different Things; What an Override Does and How Long It Lasts; How to Document a Control Change So the Next Tech Can Undo It