The control-systems interview question bank, answered by engineers

A PLC is a hardened industrial controller that runs a repeating scan cycle: it reads all physical inputs into an input image table, executes the program logic top-to-bottom, then updates the output image table and writes the physical outputs — plus housekeeping, communications and self-diagnostics each scan.

The key insight is that inputs are sampled once per scan, not read live mid-logic. That's why scan time matters for fast events and why you can get the same logic behaving differently as program size grows.

Digital (discrete) I/O is two-state — on/off, 24 V DC or not, a limit switch or a contactor. Analog I/O is a continuous value — 4–20 mA, 0–10 V, or a direct RTD/thermocouple input — that must be scaled into engineering units (°C, bar, %) inside the controller.

A good candidate mentions resolution (e.g. a 12-bit card) and that analog signals need filtering and scaling, not just wiring.

It's about current direction. A sinking (typically NPN) device provides a path to 0 V / ground; a sourcing (typically PNP) device provides a path to the positive supply. The field device and the I/O card must be matched — a sourcing sensor needs a sinking input, and vice-versa.

The watchdog monitors scan execution. If a scan exceeds its configured maximum time — usually due to a logic fault, an infinite loop in Structured Text, or a comms hang — the CPU faults and drives outputs to their configured safe state rather than running with stale or unpredictable logic.

Retentive memory holds its value across a power cycle (backed by battery, capacitor or non-volatile memory) — you'd make a production counter, a totaliser, or an operator setpoint retentive so it survives a restart. Non-retentive memory clears on power-up — appropriate for transient states you want reset, like a step sequence that must restart from a known position.

Modbus RTU is a serial master/slave protocol, usually over RS-485, addressing coils and registers in a simple polled scheme. Modbus TCP carries the same register model over Ethernet, allowing multiple concurrent clients and easy integration — at the cost of the tight determinism a dedicated serial link gives you.

PROFIBUS is a serial fieldbus (DP for I/O, PA for process). PROFINET is Ethernet-based, offering higher bandwidth, larger address space, easy integration with IT networks, and real-time/isochronous modes (RT/IRT) for motion. The migration is driven by IT/OT convergence and the need for one cable infrastructure from field to enterprise.

OPC UA is a platform-independent, secure, machine-to-machine protocol with built-in information modelling. Unlike the legacy COM/DCOM-based OPC DA — Windows-only and firewall-hostile — it is cross-platform, encrypted and authenticated.

That makes it the backbone for moving structured, secured data from the plant floor up to MES, historians and the cloud — the heart of any credible IT/OT story.

MQTT is a lightweight publish/subscribe transport; Sparkplug B adds a standard topic namespace, payload definition and state awareness (birth/death certificates) on top. Instead of a SCADA polling every tag, edge devices publish by exception to a broker.

It shines on bandwidth-constrained, dispersed or greenfield Industry 4.0 architectures — and pairs naturally with vendor-neutral SCADA/MES layers.

A PLC is built for fast, discrete, machine-level control. A DCS is built for large, continuous, analog-heavy processes controlled plant-wide, with integrated engineering, deep redundancy and an operator-centric workflow.

Choose a PLC for machines, packaging, motion, high-speed sequencing. Choose a DCS — Emerson DeltaV, Honeywell Experion, Yokogawa CENTUM VP, Siemens PCS 7 / PCS neo, ABB 800xA — for refineries, power and chemical plants with hundreds of PID loops where stability and engineering scale matter more than raw scan speed.

Cascade uses an outer (primary) loop whose output becomes the setpoint of an inner (secondary) loop. Classic example: a reactor temperature loop (slow) sets the setpoint for a jacket flow loop (fast). The inner loop rejects flow disturbances quickly before they ever reach the temperature — far tighter control than a single loop.

Feedforward acts on a measured disturbance before it affects the controlled variable, rather than waiting for feedback error. It's worth adding when you can measure a major, fast disturbance (e.g. feed flow into a heat exchanger) — but it's always trimmed by a feedback loop, because a pure feedforward model is never perfect.

A FAT (Factory Acceptance Test) is run at the integrator's or vendor's facility before shipment, proving the system against the specification with simulated I/O. A SAT (Site Acceptance Test) is run on site after installation, verifying against real field I/O, real instruments and real process conditions.

A structured answer beats a lucky guess: confirm the symptom and what changed; check safety/E-stop and power first; go online with the PLC and look at the actual I/O states and the rung holding the machine; compare field reality to what the program expects (input not made? output not energising? interlock not satisfied?); isolate to field, I/O card, logic or comms. The point is a method, not poking at wires.

The risk is tripping a running process or losing control during the switch. You de-risk with thorough as-found documentation, a tested backup and rollback plan, staged I/O migration, marshalling and loop checks before cutover, agreed safe-state behaviour, and a window with operations aligned. Lead-level answers talk about the plan and the rollback, not just the wiring.