Controls/Automation — Good-to-Know Rules of Thumb & Veteran Knowledge
Standard-practice and niche credentials, standards mastery, order-of-magnitude reflexes, and the things exams don't test. For working automation engineers.
1. Standard-practice and niche credentials — what each is, who needs it, when to pursue it
CCST Level 1/2/3 (Certified Control Systems Technician, ISA). The technician ladder: Level 1 = apprentice fundamentals, Level 2 = working technician, Level 3 = senior (troubleshooting, calibration leadership). Pursue if you're on the tools — I&E technician, calibration, loop checking. CCST 3 is often the qualification clients require for lead techs on turnaround crews. It pairs with CAP the way a journeyman pairs with a PE: one proves hands, the other proves scope ownership.
TÜV Rheinland Functional Safety Engineer (SIS / HW-SW Design tracks). The European-track functional-safety credential — covered by a shared guide (see README). Pursue when your market is Europe/Middle East or your clients specify TÜV; CFSE when your market is North American process industry or you want the expert tier. Many senior practitioners eventually hold both. The body of knowledge overlaps ~80% — the second one is mostly exam mechanics and issuing-body preference.
TÜV SÜD Functional Safety Certification (Level 1/Level 2). TÜV SÜD's parallel personnel-certification ladder for functional safety. Pursue under the same logic as TÜV Rheinland — client or regional specification drives the choice between the TÜV bodies more than technical content does.
CFSP (Certified Functional Safety Professional, exida). The practitioner tier below CFSE — same issuing body, lower experience bar. Pursue first if you don't yet have CFSE's 10 years: CFSP proves you can do SIL verification and safety-lifecycle work under direction; CFSE later proves you can lead it. The CFSP exam is the more tactical one; don't skip it waiting for CFSE eligibility — the credential compounds.
PE Control Systems (NCEES). The licensure route — covered by a shared guide (see README). Pursue if you stamp control-system or SIS designs offered to the public in the US. Note the exam is administered one day per year (small population) — plan a year ahead, unlike the year-round PE Power exam.
Siemens Certified Programmer (TIA Portal) / Siemens Certified Service Technician. Vendor credentials proving depth in the Siemens ecosystem. Pursue when your plant or your SI business is Siemens-standard — they're bid differentiators for system-integrator work, not engineering credentials. Same logic for Rockwell Automation Certificates of Achievement (Logix5000 tracks) in Allen-Bradley shops. Vendor certs get you deployed; ISA/exida certs get you trusted with scope.
2. Standards & regulations mastery
IEC 61508 — Functional safety of E/E/PE systems
Know cold: the overall safety lifecycle (16 phases — know the sequence conceptually, not all 16 by number); SIL determination and the two failure-measure regimes (PFDavg low-demand, PFH high-demand/continuous); architectural constraints (HFT, SFF, Type A vs. Type B subsystems); systematic capability (SC 1–4); the software lifecycle in Part 3.
How compliance is demonstrated: safety plan, verification records per phase, functional safety assessment by competent independent assessors, the safety case/justification file.
Common violations: treating SIL as a device certificate; skipping verification planning (verifying only at the end); no competence evidence for lifecycle roles; "proven in use" claims without the operating-history evidence IEC 61508-7 demands.
IEC 61511 / ISA-84.00.01 — SIS for the process industry
Know cold: the process-sector lifecycle stages and the four assessment stages; SRS contents (every SIF's functional + integrity requirements); application-software requirements; the 5-year periodic assessment expectation; bypass/inhibit management; proof-test requirements tied to the PFDavg assumptions.
How compliance is demonstrated: SRS document, SIL verification calculations with real data, proof-test procedures and records, MOC records, assessment reports.
Common violations: BPCS and SIS sharing the logic solver; proof-test intervals extended without re-verification; bypasses left in without time limits or alarming; SRS missing manual-reset or response-time requirements.
Recent change awareness: IEC 61511 Edition 2 (2016) tightened application-software requirements and clarified security-risk assessment (the safety-security interface) — know your plant's SIS was designed to which edition.
ISA-5.1 — Instrumentation Symbols and Identification
Know cold: tag anatomy (first letters = measured variable per the table: T temperature, P pressure, F flow, L level; succeeding letters = function: I indicate, C control, T transmit, V valve...), P&ID line and instrument symbols, loop diagrams. This is literacy — you read P&IDs the way programmers read code.
Common violations: tag-number chaos on brownfield projects (same loop, three names); P&IDs not updated after MOC (the drawing lies, the plant doesn't).
ISA-101.01-2015 — HMI for Process Automation
Know cold: the high-performance HMI philosophy — grayscale normal state so abnormal gets the color; no gratuitous 3D/perspective graphics; navigation hierarchy (overview → unit → detail); alarm integration per ISA-18.2; the human-factors rationale (operator situational awareness during upsets, when cognitive load peaks).
Common violations: the "Christmas tree" HMI — everything colorful, nothing meaningful; alarm lists detached from process graphics; mimicking the old panel layout instead of designing for abnormal-situation management.
IEC 61131 — Programmable controllers
Know cold: the five languages (LD, FBD, ST, SFC, IL) and the software model (configuration → resource → task → program → function block). Language-selection judgment: LD for discrete interlocking (electricians read it), ST for complex algorithms, SFC for sequential phases, FBD for continuous-function composition.
Common violations: writing everything in ladder because it's familiar (500-rung PID-and-math ladders are unmaintainable); no structured software practices (naming, versioning, documentation) in PLC code.
ISA-95 / IEC 62264 — Enterprise-control integration
Know cold: the level model (0–4), the Level 3 manufacturing-operations functions (production, maintenance, quality, inventory operations management), B2MML as the integration information model. Know why integration projects fail: master-data mismatch between ERP and MES, not protocol issues.
Common violations: exposing Level 1/2 networks to the enterprise without a DMZ and conduits; assuming OPC UA alone solves semantic interoperability.
IEC 62443 — IACS security
Know cold: zones and conduits (partition by security requirement, control the conduits between them); security levels SL 1 (casual) through SL 4 (nation-state); the lifecycle view (secure development, integration, operation); defense in depth as architecture, not product.
How compliance is demonstrated: risk assessment, zone/conduit drawings, security requirements specs, hardening and patch procedures with OT-appropriate maintenance windows, incident response plans.
Common violations: flat OT networks; USB sticks as the patch procedure; "air gap" claimed while a vendor VPN exists; safety-system networks treated as ordinary IT zones.
GAMP 5 — GxP computerized systems
Know cold: the category model (Cat 1 infrastructure → Cat 5 custom code) driving test rigor; the risk-based approach (test what matters to patient safety/product quality/data integrity); data integrity (ALCOA+ principles) as the real objective.
Common violations: validating the software while ignoring the data-integrity controls; treating GAMP as paperwork rather than risk management.
OSHA PSM 1910.119 — Process Safety Management
Know cold: the 14 elements (employee participation, process safety information, PHA, operating procedures, training, contractors, PSSR, mechanical integrity, hot work, MOC, incident investigation, emergency planning, compliance audits, trade secrets). For automation engineers: mechanical integrity owns your SIS proof tests legally; MOC owns your control-system changes; PHA (HAZOP) is where your SIS requirements are born.
How compliance is demonstrated: written program per element, PHA revalidation every 5 years, MI records, MOC documentation, audit every 3 years.
Common violations: control-system software changes without MOC ("it's just logic"); proof tests deferred without MOC; PHA recommendations tracked in a spreadsheet nobody owns.
EU Machinery Regulation 2023/1230
Know cold: it replaces the Machinery Directive (2006/42/EC) — full application after the transition; risk-assessment-driven design, safety-related control system requirements (EN ISO 13849-1 PL / IEC 62061 SIL for machinery), technical file and EU declaration, the manufacturer's obligations vs. the integrator's.
Common violations: treating purchased CE-marked components as making the integrated machine compliant (the integrator holds the conformity duty for the whole); missing the cybersecurity aspects the new regulation introduces.
ATEX 2014/34/EU — Explosive atmospheres
Know cold: zone classification (0/1/2 gas/vapor, 20/21/22 dust — 0/20 = continuous presence); protection concepts (Ex d flameproof, Ex e increased safety, Ex i intrinsic safety, Ex p pressurized...); the Ex i entity parameters (Ui, Ii, Pi vs. Uo, Io, Po — the barrier/instrument compatibility check); marking anatomy.
Common violations: installing Ex d equipment without verifying the flamepath after maintenance; entity-parameter mismatch on Ex i loops (the most common hazardous-area design error); zone drawings not matching the actual plant (dust zones especially).
NERC CIP — Bulk power system cybersecurity
Know cold: CIP-002 (BES cyber system categorization: high/medium/low impact), CIP-005/007 (electronic security perimeter, system security management), CIP-006 (physical security), CIP-010 (configuration change management), CIP-013 (supply chain). Know it applies to entities operating the bulk electric system — generation, transmission, control centers.
Common violations: miscategorizing assets to dodge high-impact requirements; treating CIP as an IT audit rather than an OT security program.
FDA 21 CFR Part 11 — Electronic records/signatures
Know cold: when it applies (records required by FDA predicate rules kept electronically); controls: validation, audit trails (who/what/when, immutable), authority checks, device checks, education/training. The famous scope: closed vs. open systems.
Common violations: shared logins on HMI stations (destroys attribution); audit trails that can be edited or disabled; spreadsheets as GMP records without controls.
3. Rules of thumb
Order-of-magnitude numbers:
- PLC scan: 1–10 ms typical; safety PLC: 10–50 ms. If your process needs <1 ms response, you're in dedicated-hardware territory, not PLC.
- 4–20 mA loop: 250 Ω → 1–5 V; loop power typically 24 VDC; max loop resistance ≈ (24 − transmitter_min_V)/0.02.
- Control valve: size for 60–80% travel at normal flow; rangeability 50:1 modern trims. If your valve sits at 15% open normally, it's oversized — controllability is gone.
- Proof-test intervals: annual is the default assumption in most SIL verifications; pushing beyond 2 years needs justification and usually partial-stroke testing.
- Alarm rates: manageable ≈ 150/day, target < 1 per 10 min steady-state (EEMUA 191 lineage behind ISA-18.2). If your console averages 10/min, the alarm system is decorative.
- Network: control traffic latency budget in ms; historian compression (swinging-door 0.1–0.5% typical) — know your historian's compression before trusting a trend.
Sanity checks:
- If the PID output is saturated and the PV isn't moving, the problem is the process (valve stuck, pump dead), not the tuning. Check the field before the algorithm.
- If PFDavg is dominated by one subsystem (>70%), that's where the money goes — don't gold-plate the logic solver when the valves own the number.
- If a loop oscillates with constant amplitude regardless of tuning, suspect a nonlinearity (valve stiction, hysteresis) — linear tuning can't fix mechanical problems. The stiction signature: square-wave PV, triangular output.
- If two redundant devices share a power supply, impulse line, or maintenance procedure, your β-factor assumption is optimistic.
Unit-conversion reflexes:
- psi ↔ kPa: × 6.895. bar ↔ psi: × 14.5. (Field instruments speak both; your calculations must pick one.)
- GPM ↔ m³/h: × 0.227. SCFM is at standard conditions — actual flow needs P/T correction.
- mA ↔ %: (mA − 4)/16. Do it in your head: 12 mA = 50%, 20 mA = 100%, 8 mA = 25%.
Typical safety factors:
- SIS design margin: target PFDavg at least 3–5× better than the SIL band edge (not the 1.05× of the textbook example).
- Instrument ranges: normal operating point at 50–70% of calibrated span (room for upsets both directions).
- Spare I/O: 20% installed spare + space for 20% more (the universal DCS/PLC panel rule — future always needs I/O).
4. Veteran knowledge
Costly beginner mistakes:
- Tuning a mechanical problem. Stiction, backlash, deadband, undersized valves — no tuning fixes these. Diagnose with a valve-travel vs. output plot before touching Kc.
- Alarm system as designed, not as operated. The rationalization workshop produces a beautiful philosophy; operations then disables half the alarms in year one. Veterans design the management (MOC on alarm changes, periodic audits) not just the configuration.
- FAT as theater. Witnessing a FAT where the vendor drives and the client watches is not acceptance — the veteran's FAT has the client's test scripts, failure injection, and the right to fail the system.
- Cybersecurity as a project phase. Bolting security on at commissioning means re-architecting. Zones, conduits, and account structures are design deliverables.
- Ignoring the operator. The best control strategy fails if the HMI hides it. Operators run the plant 8,760 hours a year; your elegant cascade is their daily reality — design with them, commission with them, train them like the system depends on it (it does).
- Proof-test deferral drift. "We'll catch it next turnaround" — repeated until the PFDavg assumption is fiction. The veteran treats the proof-test schedule like a pressure-vessel inspection: non-negotiable without MOC.
When to call a specialist:
- SIL 3+ SIS architecture the first time — the architectural-constraint and systematic-capability judgments need experienced eyes.
- Machinery safety on novel equipment (robotics cells, collaborative applications) — EN ISO 13849/ IEC 62061 application to new tech is specialist work.
- Control-system cybersecurity incident response — the responder who knows both OT and forensics, not your IT helpdesk.
- Advanced process control (MPC) on strongly interactive units — the modeling and commissioning cycle is a specialty; a bad MPC is worse than good PID.
- Forensic analysis after a safety-system failure or demand — preserve logs, call the functional-safety assessor, write nothing speculative.
What exams don't test: the politics of getting operations to accept a new control strategy; the judgment to stop a startup when the SIS isn't ready (and survive the schedule pressure); reading a trend like a doctor reads an ECG — pattern recognition built over years of watching processes misbehave; and knowing that the most dangerous phrase in automation is "it's just a small logic change."
5. Commissioning, loop-checking, and startup quick-reference
Loop-checking ritual (every loop, no exceptions): (1) continuity and insulation resistance of the field wiring (megger the home run before landing it — finding the crushed cable now is free); (2) instrument calibration sticker current and range correct for the service; (3) simulate at the field device — inject 4/8/12/16/20 mA at the transmitter terminals and verify the DCS/PLC reads correctly (the five-point check catches scaling errors); (4) verify fail-safe direction — disconnect the signal and confirm the valve/actuator goes to its safe state; (5) alarm and interlock trip points — test at the setpoint, not near it.
The five-point check is the whole game. A loop that reads correctly at 4, 8, 12, 16, and 20 mA has correct zero, span, and linearity — three of the five most common commissioning defects (wrong range, reversed acting, bad scaling) are caught here. The remaining two are wiring faults (caught in step 1) and fail-safe direction (step 4).
HART commissioning notes: multidrop mode disables the 4–20 mA (fixed at 4 mA) — a classic "the loop reads 4 mA and won't move" mystery. Device descriptors (DD) must match firmware revisions. Document the tag-to-device mapping; the next turnaround will thank you.
PID commissioning sequence: manual mode first — step the output, observe the process response (this is your process model); tune conservatively from the observed response; transfer to auto bumplessly; then test setpoint changes and load disturbances separately. Never auto-tune a loop you haven't stepped manually — the auto-tuner's model is only as good as the test it ran, and yours is the sanity check.
Valve stroking: stroke every control valve full travel during commissioning — verify position feedback linearity, seat tightness (shutoff class matters for isolation valves), actuator timing, and fail direction on air/power loss. A valve that strokes on the bench but sticks at temperature is a process problem discovered at the worst time.
Common startup defects (the veteran's top five): (1) scaling errors — engineering units vs. raw counts mismatch between PLC and HMI; (2) reversed-acting loops — controller output increases when it should decrease (the five-point check catches the symptom; the fix is configuration, not tuning); (3) missing interlocks — the logic was "obvious" to the programmer and absent from the code; (4) alarm floods — every alarm at the same priority, none shelved, operators blind in the first upset; (5) grounding — 4–20 mA loops grounded at two points, or shields grounded at both ends, injecting noise that looks like process variation.
Alarm rationalization in one paragraph: every alarm must have a defined operator action, a consequence of inaction, and time to respond — if it lacks any of the three, it's not an alarm (it's an indicator, a log message, or noise). Target: <6 alarms/hour/operator steady state, <10 during upsets (EEMUA 191). The exam-adjacent standard is ISA-18.2; the field practice is mercilessly deleting alarms that fail the three-question test.
When to call a specialist: SIS validation (the functional-safety assessor — independence is the point); advanced process control (MPC commissioning is its own discipline); machinery vibration analysis (the analyst with the data collector sees what the DCS can't); arc-flash/incident-energy studies (the PE with the software and the liability insurance).
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.