Control, automation and networks

Control, automation and networks

From control architecture and channel allocation to operation logic, error management and remote access

The control system coordinates the behavior of the fountain equipment with each other. The time of turning on the pumps, changing the height of the fountains, the movement of the nozzles, the color of the light, the daily schedule and the reaction to the environment are all dependent on this system.

The quality of control is not only determined by the performance of a beautiful show. The system must be able to manage start and stop, detect inappropriate conditions, provide reliable information to the operator, and reach a defined state after a failure.

In professional design, three issues should be clearly distinguished: display command, process control and safety functions. The communication of these parts is essential, but their tasks and required level of assurance are not the same.

This chapter deals with the control structure and operation. The artistic design of the show and the precise coordination of water, light and music will be reviewed in the relevant chapter.

27–1. What does the control system do?

Control tasks can be divided into five groups:

These tasks are not necessarily performed on the same device. In a small project, a suitable controller may cover several tasks; In a large project, it is more logical to divide the responsibility between the display controller, the industrial controller, the protection equipment and the monitoring system.

The selection criterion is the realization of the required performance and its testability. A large number of inputs and outputs or a large display alone do not determine the quality of the system.

27–2. Proposed control architecture

A reviewable architecture has four parts:

Field equipment section: pump, drive, valve, light, movable nozzle and sensor.

Process control section: management of start-up permit, water level, treatment circulation, restrictions and sequence of operations.

Show Execution Section: Generate timing commands for water effects, lighting, and other authorized components.

Monitoring and operation section: display status, receive operator command, record information and management access.

Safety functions should be implemented based on risk assessment, with appropriate equipment and architecture. A conventional PLC or display software should not be considered a certified safety system simply because of its programmability.

For example, OASE introduces stand-alone display controllers with DMX/RDM, I/O, and networking capabilities in the WECS suite. Capacity and features are different between models. WECS-OASE controllers ^[181]

In the map, it should be clear which section gives "execution request" and which section issues or interrupts "execution license".

Figure note from the source manuscript

Figure 27-1 instead

Suggested image: Architecture diagram including display controller, process controller, safety equipment, local network, operation panel and field equipment. The path of command, feedback and execution permission should be marked with different lines.

Caption: "The control architecture should clarify the responsibility for performing demonstration, process control, and safety functions."

27–3. Protocol selection; What is each connection good for?

The protocol defines the rules of data exchange. Its selection should be in harmony with the equipment, the required speed, the possibility of troubleshooting and future development.

ESTA introduces the DMX512-A, RDM, and sACN standards in the E1.11, E1.20, and E1.31 families, respectively. RDM and sACN cover the two-way communication of DMX data over an IP network. List of control protocol standards - ESTA ^[182]

Sharing the type of socket or cable does not mean the same protocol. The RJ45 connector may be used for Ethernet networking, dedicated communication, or other applications; The manufacturer's connection plan should be checked.

27–4. DMX, Channel and Universe

In DMX512, a Universe has up to 512 eight-bit channels. The value of each channel is usually between 0 and 255. A device may consume one channel or multiple channels. Basics of DMX512 - ENTTEC ^[183]

For example, an RGBW light in a simple case might have four channels for red, green, blue, and white. The same light in another mode may require more channels for general intensity, internal effect or other settings.

Therefore, it must be registered for each device:

• Internal software model and version;

• selected working mode or profile;

• number of channels used;

• Start Address and Universe;

• The meaning and scope of each channel;

• Behavior when data is interrupted.

The number of a channel is not necessarily the percentage of water height. For example, a value of 128 may be the middle command of a drive, but the height of the fountain depends on the pump curve, network resistance and nozzle specifications.

RDM is also not a substitute for a real pressure or flow sensor. The information that can be obtained from it is limited to the capability of the equipment.

27–5. Design example: calculation of channels and address allocation

Consider a hypothetical water fountain with the following equipment. The number of channels is only an assumption for this example and is not attributed to a specific product.

A continuous assignment could be:

Consumed capacity:

$\frac{252}{512}\times 100\approx 49.2\%$

So, in terms of the number of channels, a Universe has enough capacity. If 25% development is considered for the initial estimate:

$N_{design}=252\times 1.25=315$

This number is still less than 512. The 25% margin here is a planning assumption, not a standard requirement.

But the above result does not mean the possibility of connecting all equipment to a physical line. The number of receivers, electrical load of interfaces, path length, branching, isolation and manufacturer's limitation should be checked separately.

Also, the number of physical outputs of the controller is not necessarily the number of independent universes or its software capacity. For example, in the WECS III 64 specification, four DMX/RDM lines are introduced in addition to the 64-channel capacity. Specifications of WECS III 64 - OASE ^[184]

Figure note from the source manuscript

Figure 27-2

Suggested image: color map of example channel allocation, showing four equipment groups and free channels. Beside the map, the image of a device tag including ID, Universe, start address and profile should be placed.

Subtitle: "Channel capacity, number of equipment and number of physical lines must be calculated separately."

27–6. Network design and communication routes

In DMX lines, chain arrangement, proper cable and proper line termination are important. Passive Y-splitting can degrade signal quality; Appropriate equipment must be used for branching.

In the Line Termination Guide, ENTTEC describes the appropriate terminating resistor for the DMX line and the independent termination of each splitter output branch. Installation details must be consistent with actual equipment and connections. DMX-ENTTEC line termination ^[185]

In an Ethernet network, the map should include switches, controllers, gateways, addresses, and connections between segments. If sACN is used in multicast mode, the multicast traffic management should also be configured according to the architecture.

Art-Net uses UDP packets for data transfer and defines the concept of Port-Address to identify data streams. Art-Net Architecture - Official Protocol Reference ^[186]

For long runs or between buildings, fiber optics can be an option to consider. Media selection should be coordinated with distance, environmental conditions and protection plan.

The RDM capability must also be supported in all the necessary paths, from the controller to the splitter and equipment; It is not enough to have it at both ends of the path.

27–7. List of signals and measurement validity

The input and output list must be prepared before programming. Every signal needs information beyond the name.

For a zero to 6 bar hypothetical sensor with 4 to 20 mA output:

$P=\frac{I-4}{16}\times 6$

At a current of 12 mA:

$P=\frac{12-4}{16}\times 6=3bar$

This conversion is only applicable within the valid range of the signal. A wire break should not be interpreted as "true zero pressure" without investigation.

In Modbus communication, the register format, unit, scale factor, word order and addressing method should be extracted from the equipment documentation. The protocol alone does not determine the specific meaning of each register. Introducing Modbus - Modbus organization ^[187]

27–8. start, run and stop sequence

Starting a fountain should not be a series of simultaneous commands without feedback. A reviewable sequence includes these steps:

1. Checking public licenses and the absence of obstruction errors; 2. Verification of water level and equipment readiness; 3. Meeting the necessary conditions for circulation and water quality; 4. Setting up the equipment with the approved order; 5. Receive the necessary flow, pressure or status feedback; 6. Issuance of permission to perform the show.

Basic system states can include "Shutdown", "Readiness Check", "Startup", "Ready", "Run Show", "Controlled Stop", "Error" and "Repairs".

To pass from each state to the next state, there must be a specific condition and deadline. If the pump receives an ON command, but the necessary feedback is not obtained in the specified time, the system should not assume the pump is ready based on the issued command.

Normal stop should also be coordinated with hydraulic behavior. The order of reducing the speed and changing the position of the valves should prevent the creation of inappropriate conditions.

27–9. Behavior during error and disconnection

For each error, the range of effect and response should be specified.

The data interrupt behavior setting should also be checked in the device itself or the nearest effective controller. If only the central controller is responsible for disconnection detection, the failure of the same controller can destroy this detection.

Conventional DMX should not be the only way to implement a critical safety function. ESTA documents also limit the use of DMX for hazardous applications. Explanation of DMX-ESTA safety application limitation ^[188]

"Turn off all outputs" isn't always the perfect answer either; Shutting down an outlet may cause a valve to close quickly or interrupt an essential task. The safe state must be defined for each device.

27–10. Control based on wind, surface and environmental conditions

Ambient control can reduce out-of-range spraying, water consumption and unnecessary downtime.

For example, OASE and Safe-Rain introduce equipment to reduce the height or stop the fountain based on the wind. Wind dependent control - OASE ^[189], fountain anemometer - Safe-Rain ^[190]

The wind threshold should not be chosen the same for all projects. The height and type of jet, the distance to the passageway, the wind direction and the geometry of the pond play a role in determining it.

To avoid frequent state changes, the return threshold can be separated from the descent or stop threshold. Also, the confirmation period of wind increase and the waiting period for return should be determined according to the risk; The delay should not unduly delay the necessary response.

The sensor should be installed in a location that accurately represents the conditions affecting the fountain. The exact number of a sensor placed behind an inappropriate barrier is not necessarily useful data for control.

27–11. Response time and actual coordination of equipment

The arrival time of the command is not the same as the time of seeing the effect.

The response chain may include the following steps:

• command generation in the software;

• controller processing;

• network transfer;

• drive processing or equipment;

• mechanical movement or flow change;

• Reaching the water to a visible state.

In a hypothetical example, if the successive delays of a route are 10, 20, 120, and 350 ms:

$t_{total}=10+20+120+350=500ms$

This summation is only valid when the steps in the same path occur consecutively.

Fixed lag can be partially compensated for in the display program; Delay variability is a different matter. For this reason, the test should be performed in different load and display modes.

The data transmission rate does not guarantee the mechanical response time of the pump or valve. Also, reading diagnostic information and logging data should not occupy resources necessary to run the show without checking.

Figure note from the source manuscript

Figure 27-3 instead

Suggested image: timeline including the moment of issuing the command, receiving the equipment, starting to change the flow and observing the effect. Example numbers should be inserted with the "hypothetical" label.

Caption: "Full path response time must be measured for demonstration coordination."

27–12. Alerts operation and management interface

The home page should answer the user's everyday questions:

• What is the state of the fountain?

• Which show or program is active?

• What restrictions have been applied?

• Why does the system not allow to start?

• Which error requires action?

A "pump error" message is not enough. The appropriate message should specify the equipment, status, time, and initial action authorized; Such as: “Pump P-03: Start command issued, flow feedback not confirmed; The show of the third group is stopped.

The three operations must be separate in the interface:

Confirmation of alert view: The operator has seen the message.

Remedy: The condition causing the error has been resolved.

Reset: The system, if allowed, exits from permanent error mode.

Acknowledging the warning should not automatically fix it. The reset command should not bypass the protection either.

The data record should also show the measurement validation status; The old number remaining on the display should not be displayed as the current value.

27–13. Remote access and network security

Remote access is useful for viewing status and support, but must be scoped.

In designing this access:

• The control network should be separated from the public network of users;

• The controller and management interface are not directly available on the Internet;

• Accounts are personal and have appropriate access levels;

• Remote communication is established through a controlled path and with multi-factor authentication;

• Register changes and user logins;

• The contractor's access should be limited in the required time and scope.

CISA recommends eliminating direct Internet access of operational equipment, using secure routing, and the principle of least access. Communication protection of operational systems - CISA ^[191]

Normal Modbus TCP should not be considered encrypted communication simply because it uses an IP network. The Modbus organization has defined the use of TLS and digital certificates for the security version; Actual equipment support should be checked. Modbus Security - Modbus organization ^[192]

Internet outages should not prevent the local protection response. Safety permits and operating restrictions must also take precedence over remote control.

27–14. Backup and change management

The backup should be able to restore the system, not just an unknown file left on memory.

Required items may include:

• Controller program and agreed editable version;

• display file and equipment profile;

• drive and gateway settings;

• Table of addresses and mapping of channels;

• version of software and middleware;

• Network settings and access policies;

• software licenses and their recovery method;

• Installation instructions after replacing the equipment.

Before any change, the current version must be registered. Changing the profile of a light or moving the address can affect the performance of multiple devices.

The update should also be done by checking the compatibility, the possibility of returning and testing the affected parts. Receiving the new version alone is not enough reason to immediately install it on the active system.

27–15. Factory test and on-site test

The test should cover normal operation and failure situations before general operation.

A factory test, or FAT, can include program checks, signal lists, address assignments, warning logic, execution permissions, and simulation of inputs.

The on-site test or SAT should check the compatibility of the program with the installed equipment, direction of operation, actual feedback, delays and response of the set.

Fault injection should be done by a controlled method, such as a simulator or a method approved by the manufacturer. Accidentally cutting the wire or creating a dangerous situation by the water is not an acceptable test method.

For each test, the initial condition, action, expected result, and actual result should be recorded.

Figure note from the source manuscript

Figure 27-4

Suggested image: the actual operation page next to the test form sample. display status, permissions, and the reason for a trial stop are visible; Login information and sensitive network settings are not displayed in the image.

Subtitle: "Delivery of the control system must be accompanied by proof of normal operation and error response."

27–16. Delivery documents and system acceptance criteria

The deliverables must allow the user to use, debug and develop in a controlled manner:

• description of the function and control architecture;

• Input and output list;

• network map and list of equipment;

• Universe table, address and profile;

• map of registers and scale of signals;

• Cause and effect table of errors;

• Start, stop and error recovery sequence;

• Factory and site test results;

• Backups and recovery method;

• User guide and training records;

• Limits of responsibility and access of the operator and support.

Acceptance criteria should be determined before construction. Terms like "intelligent control" or "programmable" are insufficient to evaluate delivery without defining the function.

A reliable system should implement the demonstration, clearly indicate the reason for the limitation or stoppage, and have tested behavior in anticipated failures.

In chapter 28: show design and coordination of water, light and music, music selection and analysis, construction of show scenes, setting response time of equipment, design of sequence of effects and final test of the show will be examined.

Show and manage performance