Sanity Check - Software Component Hand/Off/Auto

Hi all,

I'm generating AOIs for lots of our shipped components and, for the purpose of eliminating superfluous functionality/bloat, I got stuck thinking about the HOA concept as applied to individual components in a system. Example: an AOI driving an Ethernet VFD.

Whether or not the overall system has an HOA mode selection as example:
- Off = nothing attached will run from system hardware- or software-based (Ethernet) outputs.
- Hand = anything individually can run manually, if in its own 'manual' mode. No consideration of remainder of system.
- Auto = process/permissive-based run, no other external triggers permitted (short of mode change).

Does the component itself having an Off mode ever make sense?
- It's not exactly an actual means of lockout; would that just leave Manual/Auto/(maybe Commission) modes and hardwired safety-off?
- On system power-up, is the most-recently used mode the desired one? Or should the initial state be Manual?
- If a component is placed into Off while the system is in Auto, does the entire thing halt? Is there a situation demanding a stop like this that a safety circuit couldn't handle? Is a liability actually introduced with the addition of an Off mode?

Or am I missing another angle?

Thanks!

It's entirely up to you and how your system works.

We generally make the last mode the mode @ power up, because it stops confusion when something doesn't work.

We have designed system whereby going into manual mode from auto during a cycle could prove catastrophic, other machines it doesn't matter a jot.

There are no hard and fast rules. Only you can make a judgement, as we don't know your machine.

In my opinion if I am controlling a motor with a plc then all of the control of that motor is from the plc
unless there is an overwhelming reason for local control. On vfd’s I do like to have the local stop button in the vfd active but not any start. I like to always know in the plc what’s going on with a motor. Having a local rum / stop could affect other motors in the system and cause big problems with other things. On some equipment sudden reversing can cause damage.
If they want local buttons than it’s just a few wires to bring them back into the plc and you have full control.
I was on a job a few years ago where they had a 250hp hammer mills, if you know anything about them they are designed to run so many hours in one direction then they reverse them to balance the wear. They had a local Man For-Rev select at each bucket they were wires to bypass the plc control. When I question that I got a verbal beat down for questioning it. A few weeks later I the same supervisor came in to do test startup of the local controls start up went OK let it run doe about 5 min then shut it off waited a little and then tested the reverse. Then BANG it sounded like an explosion fir ball out of the bucket, hammer mill cracked everybody ducking for cover. Het looked at me and said I guess we should tie them into the plc and zero speed switch
I think that was when he realized why I questioning the local only switch.

Interesting questions.

JeremyM said:

- On system power-up, is the most-recently used mode the desired one? Or should the initial state be Manual?

Click to expand...

On system powerup, the outputs should go to a safe state. In my programs, that means anything is OK as long as it's not "Manual ON".

JeremyM said:

- If a component is placed into Off while the system is in Auto, does the entire thing halt? Is there a situation demanding a stop like this that a safety circuit couldn't handle? Is a liability actually introduced with the addition of an Off mode?

Click to expand...

Yeah, it really depends on the process/machine. In some cases, turning something OFF is totally okay, but in other cases it could cause damage (think a PD pump running in AUTO into a valve forced OFF. Usually I disable a sequence or function if a critical piece of equipment is not in AUTO or is not energized or de-energized when it should be.

I pretty much always leave the ability for something to be turned on or off though, for maintenance to be able to test everything.

I think HOA is really going back to the days when everything was relay controlled, the idea was multiple HOA switches one for each motor/drive/solenoid etc. so in hand it energised it, off is obvious & auto controlled by what ever the control logic is. Nowadays especially with HMI's Hand/Auto is all you need and only one per area so that in hand mode the process is manipulated by buttons for each drive/motor/solenoid from the HMI. auto is obvious so there is normally no need to have off as switching from auto to man & vice versa should stop the process.
Again as most systems are PLC controlled nowadays it is easy to hold a process when a hand/auto switch changes state or disable it until a process is stopped or held.
I know people will no. no. no.
But if a system is designed with safety in mind and all interlocks are in place then there is no need for off as such.
Example.
All drives have local lock off.
Hand mode can only be selected if process has been held or stopped.
Auto mode will not run if hand is selected.
possible use of key switch or level entry for mode.
hand mode should still have interlocks for safety reasons.
As you are talking about HOA in plc control then the above should prove satisfactory.
Again I re-iterate that all other safety considerations should still apply.

For years I just used Auto/Manual in my AOI's, but I did eventually come across an application that needed an Off mode. I had duty/standby motors, where the standby would become duty if the existing duty was unavailable. I also wanted to allow the duty motor to be managed manually in certain circumstances, without losing the duty status. But I also needed to distinguish between a motor that the user had designated "unavailable", and one that was just being used manually. So I determined that if a motor was switched to off, it would lose the duty status, but would retain it if just switched to manual.


My advice would be to put an off mode into the AOI - if you don't want to use it, you don't have to put an Off button on your HMI/SCADA.


I'd also recommend leaving everything in the last mode on powerup. I've worked with several systems that had the ability to set a default startup mode, and it's invariably caused problems. Just make sure, of course, that if the PLC powers up with a motor in manual mode, the motor doesn't continue running without a new start command.

^ this seems like a reasonable way to broad-brush a lot of boilerplate functionality. Thanks for adding to the thread ASF!