Automation
What moves a unit with nobody pressing a button: the model's External stop and the signal every unit follows, each unit's stop interlock, and the PLC-facing automation that selects a procedure, drives the lifecycle and answers back.
The Automation screen (Process > model > Definition > Automation) holds everything that moves a unit of the model with nobody pressing a button. On top, the model's own declaration: the External stop, one switch that makes every procedure on the model follow a stop observed at each unit, and the default signal the whole bench follows. Under it the units, and for the picked unit two cards: its Interlock (which signal it observes and its live state) and its Automation (the PLC-facing interface that selects a procedure, drives Start, Stop, Hold, Resume and Abort, snapshots metadata and echoes results). The header reads "What starts, holds and stops a unit of this model on its own: the stop it follows, and the signals a PLC drives it through."
Reading needs Look at models; every edit needs Manage process and an unlocked station, and the interlock fields carry a second gate of their own (below). The screen wears the shape every Definition screen shares (see Definition).
The two subjects differ in nature. The interlock is a continuous watch that ends a run, latches the unit across a restart of the app and blocks writes to its sources until somebody rearms it. An automatic Abort is a one-off order that ends the run in progress. They share a screen because both are configured by choosing a field signal.
Model definition: the External stop
The head reads "The model's declaration. It holds for every unit: one switch decides whether the whole bench observes a stop, and one signal is the default they follow." The table has one row today:
| Column | What it shows |
|---|---|
| Declaration | External stop. |
| Observed | Enabled or Off. |
| Default signal | "Tag · Simulated · Press · EStop · Trip when True"; "No signal chosen" (in the caution ink only while enabled); or "Signal no longer available · Trip when False" when the stored source is gone. |
Under the table stands the principle of the whole screen: "Monitoring only. This software observation is not a certified safety function and does not replace the machine's emergency-stop circuit, safety relay or safety PLC."
The settings column for the declaration
Picking the row opens the External stop card ("Automation · External stop"): "Make every procedure on this model follow an external stop observed at each unit." Its pill counts the coverage while enabled ("2 of 3 with a signal") and the units while off ("3 units").
| Field | What it is | Values / default | Effect |
|---|---|---|---|
| Enable for this model | The one switch. | on / off; off. | Off, nothing is observed on any unit, no execution is blocked, and the per-unit fields fold away. On, every unit is observed through the signal in force on it. |
| Boolean source | "The signal every unit of this model observes, unless it is given one of its own." | (none), then every Boolean tag of an enabled device as "Tag · Driver · Device · Tag", then every Boolean variable as "Variable · Name"; (none). A stored source the station no longer offers stays listed as "Missing Tag" or "Missing Variable" followed by its identity, so the field never reads as unbound. | Written on the model: every unit that follows sees it at once. |
| Trip polarity | Which reading is the stop. | Trip when True, Trip when False; Trip when True. | The other value is the safe reading. |
Both the switch and the default stay writable with the switch off, so a bench is prepared before it is armed. Under the fields the card says why it is read-only when it is: "Finish active run operations and rearm every latched unit before changing this setting." while any unit of the model is occupied by a run operation or holds a latched trip, or "Changing model protection needs the “Manage process” permission." The save refuses the same, with "Cannot disable the interlock while a Unit is busy or latched.", and refuses any change that moves the signal a busy or latched unit observes.
Per unit: the units list
| Column | What it shows |
|---|---|
| Unit | The unit's name. |
| Interlock signal | The signal in force and where it came from: "Tag · … · Trip when True · from the model" or "· from this unit"; "The model names no signal" or "No signal chosen" in the caution ink while the model observes; "Off for this model" otherwise. |
| Automation | Enabled or Off. |
Manage units at the far end of the head opens the model's page.
The Interlock card of the picked unit
The card's pill says the live state: Disabled (the model's switch is off), Unavailable, Normal, Tripped or Awaiting reset.
| Field | What it is | Values / default | Effect |
|---|---|---|---|
| Where this unit's stop signal comes from | Two answers written out. | Follows the model default ("Read from the model. Give this unit a signal of its own to change it here.") or Has its own signal ("Only this unit watches this signal. The model default no longer reaches it."); follows. | Detaching starts from the signal in force: a unit that never named one takes the model's, one that had one gets it back untouched. Following again erases nothing. |
| Boolean source, Trip polarity | The same picker the model uses. | As above. | Disabled while the unit follows (it shows the model's stored answer, not a copy), and while the unit is busy or latched. |
Under the fields: Source (the resolved name, or "Not configured"), Current value (True, False, or "Not read") and Quality (Good or Unavailable). While the state is not Normal a banner carries the state and its reason ("Waiting for the first valid source reading." at first). While the model's switch is off the card reads "This turns on with the model's External stop, declared in the definition above." and folds the choice and the pair into a Signal and polarity disclosure, where they can be prepared before the model arms. The card ends with "Source and polarity stay fixed while this Unit has a run operation or a latched trip." or "Changing this protection needs the “Manage process” permission." when either holds.
The interlock states
| State | Meaning |
|---|---|
| Unavailable | No valid reading has armed the interlock yet, or the signal in force names nothing. New execution and resume are refused; a persisted run attaches dormant rather than failed. |
| Normal | The source is good and reports the safe value. |
| Tripped | The stop condition is active, or the source's quality was lost after arming. |
| Awaiting reset | The source is good and safe again, but the persisted latch still needs a manual rearm. |
A trip ends the unit's active run through normal finalization as Aborted with the NOK verdict, recording StopInterlock as the termination reason; latches the unit across application restarts; blocks every new execution on it; and overlays a write block on the unit's writable sources. A source shared by several units is blocked only while all of them are interlocked, so one local stop cannot strand a healthy neighbour. Every transition is journaled with names, value, quality, polarity, time and actor, and appears under Events > Interlocks.
Rearm is not on this screen: it stands on the interlock banner of the unit's panel and on the InterlockStatus dashboard component, only while the state is Awaiting reset with a good, safe reading. It needs Run procedures, clears the latch, never restarts the aborted run, and is recorded with the operator.
The Automation card of the picked unit
"Let a PLC Tag or a Logic Variable select a Procedure and drive this Unit's lifecycle, without removing manual, Dashboard or MCP control." The pill reads Disabled, Ready, Not ready or Active. Without Manage process the card reads "Editing automation needs the “Manage process” permission." and every control is read-only.
The switch stands on the card: Enable automation for this Unit ("Observe published values to select a Procedure and drive the lifecycle."). Five folding sections stand under it; turning the switch on opens Procedure, turning it off collapses all five, and otherwise the sections stay as you left them. Every source list offers (none), then the station's tags as "Tag · Driver · Device · Tag" and variables as "Variable · Name", reduced to what the field can use; a stored source the station no longer offers stays listed as "Missing Tag" or "Missing Variable" followed by its identity.
Procedure
| Field | What it is | Values / default | Effect |
|---|---|---|---|
| Procedure selection | How the procedure an automatic Start uses is resolved. | Fixed Procedure, Numeric selector; Fixed Procedure. | |
| Fixed Procedure | "Every automatic Start of this Unit uses this Procedure." | (none), the model's procedures by name, or "Missing Procedure" followed by its identity for one that was deleted; (none). | |
| Selector source (integer Tag or Variable) | "The PLC writes an integer code; the map below resolves it to a Procedure by stable identity, so a rename never breaks the map." | A readable integer tag or variable; (none). | |
| The code map | One row per selector code: the code, the procedure it selects, Remove selector code; then an add row (a code, a procedure, Add). | Integer codes, unique on the unit. | Refused in the feed: "Selector code must be an integer.", "Choose a Procedure for the selector code.", "Selector code 7 is already configured.", "Choose a Procedure or remove the selector row." An unmapped or unreadable code refuses the Start as Invalid selection. |
Command signals
"An optional Boolean source per lifecycle command; each fires once when its signal goes from off to on." One picker per command: Start, Stop, Hold, Resume, Abort, each taking a readable Boolean tag or variable, or (none). A signal arms only after a valid low has been seen, so a signal stuck high at boot cannot fire.
Metadata sources
"Where an automatic Start takes each metadata value from, frozen into the run when the Start is accepted." The section lists every procedure the selection can resolve (the fixed one, or every mapped one in code order); until one is chosen it reads "Select a fixed or mapped Procedure first to list its metadata fields." Under each procedure stands one picker per field it prompts (a required field is marked "required"; a procedure prompting none reads "This Procedure prompts no metadata."):
| Field kind | Choices |
|---|---|
| Text | (none), Fixed value (a text field appears under the picker), any readable tag or variable except an image, icon or color variable. |
| Number | (none), Fixed value, any readable integer or decimal tag or variable. |
| Sequential | (none) or Automatic sequence, its only source. |
Values are validated at Start; an invalid one refuses the Start as Invalid metadata.
PLC returns
"Optional writable Tags echoing automation state back to the PLC." Returns bind to writable tags only, never to a variable.
| Return | Expects | Meaning |
|---|---|---|
| Ready | Boolean | "can accept Start now" |
| Active | Boolean | "Unit has an active run" |
| Selected code | Integer; offered only in Numeric selector mode | "echoes the observed selector". A mapping made in that mode is kept when the unit moves to a fixed procedure, but it is neither written nor listed in the diagnostic while the mode holds, and it comes back with the mode. |
| Command result | Integer | "stable result 0–7", the fixed contract below |
| Code | Meaning |
|---|---|
| 0 | Waiting / rearmed |
| 1 | Accepted |
| 2 | Unit not ready |
| 3 | Invalid selection |
| 4 | Invalid metadata |
| 5 | Incompatible command |
| 6 | Conflicting commands |
| 7 | Internal failure |
"A fixed contract, so PLC logic never depends on message text."
Live state & diagnosis
Read live on every render: Status (Disabled, Enabled, or "Enabled · monitoring"), Command arming ("No command signals", "Armed", or "Waiting for valid low"), Ready (Yes or No, with "Ready off because" and the reason), Active run, Selector (the code and its quality, in selector mode), Resolved Procedure, Last command (the command, its result code and its time) and Reason (the last diagnostic). Under them three blocks: Command signals (each source, its value and quality, Armed or Waiting), Metadata preflight (each field's source, value, quality, Valid or Invalid with the reason) and Return writes (each tag under the name it carries, the time of its last write, Healthy or Failed with the error; a return the selection mode never writes is not listed). A return that keeps failing is journalled once when it starts failing, summarized while it lasts and once more when it writes again, rather than on every cycle of the loop.
Every edit of the card autosaves and is put back when the station refuses it; the reason lands in the action feed. A run the automation starts records Automation as the responsible.
What this screen does not do
- The interlock is software observation of a value Connector or Logic already publishes: no debounce, no evaluation, no safety rating. It never replaces the machine's safety circuit.
- The automation removes no other control: manual, dashboard, command-point and MCP commands keep working beside it.
- Nothing here rearms a unit: Rearm lives on the unit's panel and on the InterlockStatus component.
- Nothing here stages a procedure by hand or fills metadata by hand: that is the unit's panel under Operate.