How to Detect a Disconnected Machine Sensor Safely

An unplugged sensor is not automatically distinguishable from a legitimate OFF state. On a conventional normally open input, a clear target, an open conductor, loss of sensor power, and a removed connector can all produce the same zero. The correct response begins by defining what the sensor does and what risk exists if that zero is accepted as healthy.

Fault-visible wiring improves diagnosis, but personnel protection depends on the complete validated safety function.

Separate process diagnostics from functional safety

A process sensor may detect a part, tank level, cylinder position, or conveyor jam. If its cable opens, the appropriate response might be a maintenance alarm, cycle inhibit, or controlled stop. A protective device such as an interlocked guard, light curtain, or emergency stop belongs to a safety function derived from the machine risk assessment. Its architecture, diagnostic coverage, response time, reset behavior, and verification must meet the required safety performance.

A standard PLC input can provide valuable maintenance evidence, but labeling its logic “safety” does not give it certified fault tolerance. Protective decisions should be made by suitable safety devices and safety logic. Standard control can receive diagnostic status for messages, timestamps, and troubleshooting without becoming the sole element that removes hazardous motion.

Relevant hardware categories can be reviewed through the site’s Sensors collection and PLC & PAC Systems, but the selected device, input module, and wiring method must be validated as one application.

Choose a circuit whose healthy state is observable

A normally closed contact carries current in its healthy idle state, so a broken conductor tends to make the input turn off. This is more fault-revealing than a normally open circuit, yet it is not complete protection. A short across the contact can hold the signal on, a common conductor can defeat several channels, and software may mishandle the transition.

Modern electro-sensitive protective devices commonly use two monitored semiconductor outputs, often called OSSD channels. A compatible safety controller evaluates both channels, including their timing and test behavior. Electromechanical guard devices can use positively driven contacts in a dual-channel arrangement. The point is not simply “two wires”; it is independent fault detection, controlled test behavior, and a defined safe response.

Understand what an open-wire input actually measures

Diagnostic input modules can distinguish an open conductor by expecting a small current even when the field contact is open. Rockwell Automation’s current ControlLogix digital I/O manual states that open-wire detection verifies field wiring and requires a minimum leakage current. For a contact input, a leakage resistor is placed across the contact so the module expects current during the logical OFF state. Loss of that current produces a point-level fault.

The 1756-IB16D is a 10–30 V DC diagnostic input module. Its published wiring information specifies leakage-resistor values by supply voltage, including 15 kΩ at 24 V DC. Those values are device-specific engineering data, not a universal recipe. Input thresholds, resistor tolerance and power rating, sensor off-state leakage, interface-module indicators, and supply variation all affect the diagnostic window.

Too little leakage current can make a healthy open contact look like a broken wire. Too much can hold the input on, create heat, or mask another failure. Indicator lamps and interface modules can also alter the off-state current. Use the exact module-series manual, calculate worst-case current and dissipation, and test the assembled field circuit at the minimum and maximum supply voltage.

Design power and return paths for diagnosis

An individual point diagnostic cannot always distinguish a broken signal conductor from a lost common return or field supply. If a group of inputs reports open-wire faults together, investigate the shared supply and return before replacing multiple sensors. Monitor field power where possible and group channels so a common loss does not create an ambiguous machine state.

Three-wire proximity and photoelectric sensors add another failure mode: the output conductor may be intact while sensor power is missing. Use device diagnostics, auxiliary status, current monitoring, or an input architecture that exposes loss of power. For networked smart sensors, communication status can add evidence, but it should not silently replace the hardwired protective path unless the networked safety function is specifically designed and validated for that purpose.

Define deterministic fault behavior

For each signal, document the safe or controlled response to open wire, short circuit, channel discrepancy, loss of field power, stale network data, and internal device fault. A process input may latch an alarm and block the next automatic cycle. A safety input should drive the defined safety function within its allowed response time.

Do not let a generic debounce or alarm delay conceal the fault. Filtering may be appropriate for contact bounce or electrical noise, but the delay must be shorter than the process risk allows. Record the raw diagnostic bits separately from the conditioned process status so maintenance staff can see why the machine stopped.

Restoration is equally important. Reconnecting a sensor should not cause unexpected restart. Require the reset conditions defined by the risk assessment, confirm that the hazardous area is clear, and separate fault acknowledgment from the command that starts motion.

Proof-test the installed circuit

A drawing review cannot prove field behavior. During commissioning, test normal actuation and then disconnect the sensor at the device and at intermediate connectors. Open each conductor individually, remove field power, interrupt the common return, and create the channel discrepancy cases permitted by the manufacturer’s test procedure. Confirm the controller identifies the expected point and that the machine response matches the safety requirements.

Where dual channels are used, test one channel at a time, cross-fault detection as specified, discrepancy timing, reset, and restart inhibition. Record actual stop time if it contributes to the safeguarding distance. After maintenance or device replacement, repeat the relevant proof tests rather than assuming identical connector pinning guarantees identical behavior.

Maintain diagnostic coverage over the machine life

Changes to terminal blocks, indicator modules, cable length, input cards, sensor types, or safety-controller configuration can shift the current window or alter diagnostic timing. Place those items under change control. Periodically review diagnostic logs for intermittent open-wire events; they often expose damaged cable carriers, loose terminals, contamination, or failing connectors before a hard outage.

The engineering boundary is clear: open-wire detection is an excellent maintainability feature and can contribute to fault detection, but it is not a complete safety function by itself. Reliable machines make each fault visible, assign it a deterministic response, and verify that response at the real field device.