{
  "title": "PLC logic design and management learning workbook",
  "status": "Illustrative design; not production logic or verification evidence",
  "design_steps": [
    {
      "step": "Define the process and intended use",
      "action": "Describe the equipment, product, operating limits and operator actions. Read the process flow, P&ID where relevant, electrical drawings and machine interfaces. Identify who owns process, controls, safety and quality.",
      "deliverable": "A scope and requirements list with unique IDs, owners and acceptance criteria."
    },
    {
      "step": "Review hazards and the safe response",
      "action": "Identify movement, pressure, electrical and process hazards with the responsible safety team. Define safe states, energy isolation and restart requirements. An ordinary PLC permissive is not a safety function.",
      "deliverable": "Reviewed risk assessment, required safety functions and a separate safety design / validation plan."
    },
    {
      "step": "Build the I/O and device list",
      "action": "List each sensor, actuator, drive and network device. Record signal type, normal state, electrical range, scaling, module/channel, diagnostic behavior and drawing reference. Confirm sourcing/sinking and field wiring.",
      "deliverable": "Approved I/O schedule, hardware list, network plan and interface ownership."
    },
    {
      "step": "Write the control narrative",
      "action": "Explain Auto, Manual, maintenance and stopped behavior. Distinguish a start permissive, a running interlock and an operator stop. Define what happens after sensor loss, communication failure and power restoration.",
      "deliverable": "Sequence description and cause-and-effect matrix before code."
    },
    {
      "step": "Draw states and transitions",
      "action": "Define Idle, Indexing, Filling, Complete and Fault for this example. Give every transition a condition, timeout and recovery route. State what each output may do in each state.",
      "deliverable": "State table, transition tests and an output ownership table."
    },
    {
      "step": "Select and configure the platform",
      "action": "Choose controller, I/O, power, network, HMI and engineering software from load and site standards. Confirm firmware, software, licenses, spares, cycle time and vendor support.",
      "deliverable": "Hardware configuration and compatible toolchain record."
    },
    {
      "step": "Create tags and program structure",
      "action": "Map physical I/O into named internal tags, then divide logic into equipment modules, modes, sequence, alarms and output mapping. Give every physical output one clear assignment point.",
      "deliverable": "Tag dictionary, routine/block map and naming rules."
    },
    {
      "step": "Implement the logic",
      "action": "Build small testable modules. Use explicit mode arbitration, reset behavior, timer ownership and event edges. Keep command and status separate; do not latch a physical output without a defined reset path.",
      "deliverable": "Reviewed logic linked to requirements and approved library versions."
    },
    {
      "step": "Add HMI, alarms and data interfaces",
      "action": "Show mode, state, permissive failures, active faults and data quality. Define alarm priority, acknowledgement and reset separately. Expose approved status tags to OPC UA; keep writes under a separate approved interface.",
      "deliverable": "HMI map, alarm list and documented external tag contract."
    },
    {
      "step": "Test offline and perform FAT",
      "action": "Compile and simulate supported functions. Exercise the normal sequence, stuck sensors, timeouts, loss of feedback, power-cycle behavior and duplicate events. Simulation does not prove wiring or safe machine behavior.",
      "deliverable": "Requirement-to-test traceability, results, defects and retest evidence."
    },
    {
      "step": "Commission and perform SAT",
      "action": "Use an approved window. Check isolation, wiring, I/O polarity, motor direction, scaling, network and local authority. Compare online logic to the approved release. Remove forces and temporary bypasses.",
      "deliverable": "Signed site checks, safety validation by responsible personnel and accepted operating tests."
    },
    {
      "step": "Release and manage the baseline",
      "action": "Archive the verified as-running project, source exports, versions, device settings and evidence. Assign support ownership, backup schedule, access permissions and rollback criteria.",
      "deliverable": "Approved release record, restore-tested backup and operating handover."
    }
  ],
  "io": [
    {
      "id": "I01",
      "tag": "BottlePresent",
      "type": "Digital input",
      "meaning": "Photoeye active when bottle is at fill position",
      "note": "Debounce and stuck-signal detection are required in production."
    },
    {
      "id": "I02",
      "tag": "AirOK",
      "type": "Digital input",
      "meaning": "Process air pressure available",
      "note": "Loss inhibits start and aborts an active cycle."
    },
    {
      "id": "I03",
      "tag": "DriveReady",
      "type": "Digital input / drive status",
      "meaning": "Conveyor drive available",
      "note": "Validate status freshness; lost communication is not ready."
    },
    {
      "id": "I04",
      "tag": "SafetyHealthy",
      "type": "Diagnostic feedback only",
      "meaning": "Safety system reports its healthy state",
      "note": "Independent safety system removes hazardous energy. This tag does not implement safety."
    },
    {
      "id": "I05",
      "tag": "FillComplete",
      "type": "Digital input",
      "meaning": "Target reached / fill result accepted",
      "note": "Must be false before start; check stuck-high and timeout."
    },
    {
      "id": "Q01",
      "tag": "ConveyorRun",
      "type": "Digital output / drive command",
      "meaning": "Index bottle only",
      "note": "One output mapping point; drive direction and speed require separate design."
    },
    {
      "id": "Q02",
      "tag": "FillValve",
      "type": "Digital output",
      "meaning": "Open only in Filling with bottle present",
      "note": "Physical fail state, closing time and feedback require site review."
    },
    {
      "id": "D01",
      "tag": "CompletedCycles",
      "type": "Internal / reporting value",
      "meaning": "Increment once on accepted fill completion",
      "note": "Retention and reset authority documented; not proof of actual quantity or quality."
    }
  ],
  "states": [
    {
      "state": "Idle",
      "outputs": "Conveyor OFF; valve OFF",
      "condition": "Rising Start command, Auto and all permissives; FillComplete must be false",
      "next": "Indexing"
    },
    {
      "state": "Indexing",
      "outputs": "Conveyor ON; valve OFF",
      "condition": "BottlePresent true; maximum indexing time 10 s",
      "next": "Filling, or Fault on timeout"
    },
    {
      "state": "Filling",
      "outputs": "Conveyor OFF; valve ON",
      "condition": "FillComplete true before 5 s, while bottle remains present",
      "next": "Complete, or Fault on timeout / bottle loss"
    },
    {
      "state": "Complete",
      "outputs": "Both outputs OFF; count incremented once",
      "condition": "Bottle removed, then advance evaluation",
      "next": "Idle; new Start required"
    },
    {
      "state": "Fault",
      "outputs": "Both outputs OFF; fault latched",
      "condition": "Cause cleared and deliberate Reset",
      "next": "Idle; never automatic restart"
    }
  ],
  "management": [
    {
      "stage": "1 \u00b7 Establish the baseline",
      "action": "Upload / compare the actual controller against the approved engineering project. Resolve differences before editing. Record controller identity, firmware, hardware and software versions.",
      "owner": "Controls owner"
    },
    {
      "stage": "2 \u00b7 Open a change record",
      "action": "Describe the problem, affected requirements, routines, tags, HMI, alarms, recipes and external consumers. Assess operational, safety and quality impact.",
      "owner": "Change owner"
    },
    {
      "stage": "3 \u00b7 Preserve the recovery package",
      "action": "Archive native project, supported source exports, device settings and agreed retained values / recipes. Record checksums, access protection and restore prerequisites.",
      "owner": "Asset owner"
    },
    {
      "stage": "4 \u00b7 Develop in a controlled copy",
      "action": "Use a branch or checked-out revision. Make one coherent change. Keep simulation tags and credentials out of the production release.",
      "owner": "Engineer"
    },
    {
      "stage": "5 \u00b7 Review and test",
      "action": "Compare logic, hardware configuration and library dependencies; peer review and test normal, fault and restart cases. Attach evidence and unresolved deviations.",
      "owner": "Reviewer / test owner"
    },
    {
      "stage": "6 \u00b7 Authorize the plant change",
      "action": "Agree shutdown or online-edit method, responsible person, operating restrictions, success criteria and rollback trigger. Safety changes follow their own approval and validation.",
      "owner": "Operations / controls / quality"
    },
    {
      "stage": "7 \u00b7 Deploy deliberately",
      "action": "Confirm target controller and baseline; apply approved changes. Online edit capability does not mean the edit is safe for a running machine. Follow vendor-specific edit and rollback behavior.",
      "owner": "Authorized engineer"
    },
    {
      "stage": "8 \u00b7 Verify as running",
      "action": "Compare online / offline state, prove affected behavior, check data interfaces, remove forces / temporary bypasses and record actual results.",
      "owner": "Commissioning owner"
    },
    {
      "stage": "9 \u00b7 Release and monitor",
      "action": "Create the approved as-running revision, archive test and approval records, update drawings / runbooks, and monitor for drift.",
      "owner": "System owner"
    },
    {
      "stage": "10 \u00b7 Recover when needed",
      "action": "Use the tested rollback method. Restore compatibility and required values, verify outputs / modes and obtain authority to restart. A previous project file alone is not a complete rollback.",
      "owner": "Operations / support"
    }
  ],
  "tests": [
    {
      "title": "Normal cycle",
      "expected": "Start \u2192 Indexing \u2192 Filling \u2192 Complete \u2192 bottle removal \u2192 Idle. One accepted completion."
    },
    {
      "title": "Missing permissive",
      "expected": "Remove each permissive before Start and during each active state. Commands turn off and no automatic restart occurs."
    },
    {
      "title": "Fault recovery",
      "expected": "Clear the cause, Reset and verify Idle with outputs off. A fresh Start must be required."
    },
    {
      "title": "Stop and restart",
      "expected": "Stop during motion or filling; test startup from every state. Outputs stay off until authorized restart."
    },
    {
      "title": "Timeout and stuck signal",
      "expected": "Hold BottlePresent false for 10 s; hold FillComplete false for 5 s in Filling; try FillComplete already true at Start."
    },
    {
      "title": "Duplicate count",
      "expected": "Hold completion true across multiple evaluations and verify one increment. Validate production sensor filtering separately."
    },
    {
      "title": "I/O and commissioning",
      "expected": "Verify actual polarity, wiring, scaling, direction, fail states, communications and removal of all forces on site."
    },
    {
      "title": "Release and restore",
      "expected": "Compare as running, archive approved version, restore on a safe test target and verify dependencies and rollback."
    }
  ],
  "dependencies": [
    {
      "dependency": "S01 \u00b7 E-stop / protective devices",
      "inputs": "Assessed safety channels and diagnostic coverage",
      "failure_action": "Safety relay or safety PLC acts on safety outputs independently of ordinary sequence.",
      "recovery": "Clear hazard, reset the safety system under its approved conditions, then process reset and separate Start."
    },
    {
      "dependency": "S02 \u00b7 Guard, locking and access",
      "inputs": "Guard position / lock state and any required safe standstill",
      "failure_action": "Guard release and stopping behavior follow risk assessment and stopping time.",
      "recovery": "Guard closure alone must not start the machine. Whole-body access needs additional protective measures."
    },
    {
      "dependency": "S03 \u00b7 External device monitoring",
      "inputs": "Contactor / safe drive feedback, discrepancy and fault detection",
      "failure_action": "Safety system detects failed final elements as required by the design.",
      "recovery": "Correct fault and prove feedback; a feedback checkbox is not safety validation."
    },
    {
      "dependency": "P01 \u00b7 Auto and authority",
      "inputs": "Selected mode, local / remote ownership, one accepted Start edge",
      "failure_action": "Block start or perform the defined controlled stop on loss. Manual mode retains applicable protection.",
      "recovery": "Re-establish authority and issue a fresh Start."
    },
    {
      "dependency": "P02 \u00b7 Utilities and drive",
      "inputs": "Pressure, power, drive ready, fault state and fresh communications",
      "failure_action": "Drop run and valve commands on a failed running interlock in this example.",
      "recovery": "Clear cause, deliberate process Reset and fresh Start."
    },
    {
      "dependency": "P03 \u00b7 Upstream / downstream",
      "inputs": "Upstream availability and downstream capacity / handshake freshness",
      "failure_action": "Upstream ready is a start-only permissive here; downstream ready is a running interlock. Other machines may use hold / blocked states instead.",
      "recovery": "Specify hold, timeout, resume and anti-restart behavior for each machine interface."
    },
    {
      "dependency": "P04 \u00b7 Bottle and fill signal",
      "inputs": "Presence, debounce, plausible transitions, fill sensor quality",
      "failure_action": "Loss of bottle while filling aborts; completion timeout faults; stuck-high completion blocks start.",
      "recovery": "Remove affected bottle, reconcile result and clear sensor condition before reset."
    },
    {
      "dependency": "P05 \u00b7 Actuator feedback",
      "inputs": "Valve closed before start; open / close proof; conveyor stopped feedback",
      "failure_action": "Inhibit unsafe transitions; alarm / fault on disagreement and timeout. Feedback contacts and timing need an engineered design.",
      "recovery": "Prove position / standstill and reset according to the cause-and-effect design."
    },
    {
      "dependency": "P06 \u00b7 Data / recipe / execution",
      "inputs": "Approved recipe, bounds, order and required traceability records",
      "failure_action": "Only required local dependencies may inhibit production. Define behavior for missing recipe or failed required record.",
      "recovery": "Owner approves valid data and any hold/rework decision. Cloud dashboard availability is not a default permissive."
    },
    {
      "dependency": "T01 \u00b7 Timing and communications",
      "inputs": "Sensor filters, I/O update, task scheduling, safety communication timeout, watchdog",
      "failure_action": "Maintain defined worst-case response; watchdog or stale I/O produces the reviewed fault response.",
      "recovery": "Investigate timing / network faults; do not extend watchdogs just to suppress errors."
    }
  ],
  "timing_review": {
    "ordinary_response": "sensor/filter + input transfer + task wait + execution + preemption + output transfer + actuator response",
    "safety_response": "Separate assessed and validated chain; do not use ordinary timing as a safety guarantee"
  }
}