Partial Power Loss Response

The purpose of the partial power-loss response is first to determine what portions of the installation are affected and respond to those losses. The PLC Pro™ method is to preserve the availability of equipment unaffected by the detected power-loss event.

Once the resources that were lost are detected as active again, the control program must reconcile its state with the actual equipment state before normal operation resumes.

A partial power loss is determined by the installation's power distribution. The PLC may remain powered while remote I/O, field power, drives, supporting services, or other controlled resources lose electrical power. Because the PLC continues executing, the control program can (and should) immediately respond to and manage any such detected condition.

Determining the affected portion of the installation requires usable indications of resource availability. Communication status, field-power status, drive status, and other monitored conditions may be used to identify which controlled resources are unavailable.

Remote I/O provides a common example. Many PLC and I/O systems provide communication or module-status indications that the control program can monitor directly. When a usable indication is not provided, the PLC Pro can create one. For example, an output can be cycled through a remote I/O section and returned through an input; if the returned signal stops changing within the expected time, the program can treat that I/O section as unavailable.

Loss of electrical power to an I/O resource may be indistinguishable from loss of communications caused by another condition. Unless the cause can be independently determined, the PLC Pro must treat the affected resource as untrustworthy and assume worst case.

Once an I/O resource is considered untrustworthy, its input states are invalid and its output states cannot be assumed. Outputs may have been de-energized by the power loss or may have assumed their configured default state if the failure is actually a loss of communications.

The response should be applied to the smallest practical operating scope affected by the loss. If an entire area depends on unavailable remote I/O or another lost resource, automatic operation for that area must be cancelled. If the loss affects only an independently controlled workstation or machine section, unaffected portions of the installation may remain available for operation.

Equipment that remains powered, available, and independent of the affected resources should remain under normal control whenever practical. A partial power-loss response should not unnecessarily cancel operation, reset control states, or otherwise disturb portions of the installation that can continue operating safely.

When determining the appropriate response, err on the side of caution. If the affected condition presents a hazard, assert the required E-Stop response even when its effect extends beyond the portion of the installation that lost power. Likewise, if Auto Mode can only be cancelled for a larger operating group, apply the response at that available scope rather than preserve operation at the expense of safety or reliable control.

The response begins by cancelling Auto Mode for the affected operating scope. If the condition presents a hazard, the control program may assert and maintain an E-Stop request through the safety-related control system. If no safety response is required, cancelling Auto Mode establishes Manual Mode and stops automatic motion and sequence progression while the condition is resolved.

Consider a workstation whose remote I/O loses power while the PLC controlling the line remains powered. The PLC may detect loss of communications with the remote I/O and immediately cancel Auto Mode for the affected workstation, effectively preventing normal operation.

Consider a drive cabinet that loses communications with the PLC while the rest of the installation remains powered. The control program can no longer rely on the drive status or assume that the drives are responding to their last commands. The immediate response is to cancel Auto Mode for the affected operating scope and, if loss of control over the drives presents a hazard, assert the appropriate E-Stop request through the safety-related control system.

Restoration of electrical power or communications does not complete recovery by itself. Remote I/O, drives, and other controlled resources may require time to initialize, reconnect, or reset before their status can again be relied upon. The control program must verify that the required resources are available and that the actual equipment state is established before normal operation is allowed to resume.

Once the affected resources are again available, the control program must reconcile its state with the actual equipment state. Equipment may have moved, stopped, changed state, or otherwise departed from the condition represented by the control program while the affected resources were unavailable.

Retained or latched requests that become actionable when functionality is restored must be evaluated to ensure that recovery does not create a hazard.

A PLC Pro Sequence does not require a reset simply because a partial power-loss condition interrupted operation. If no Sequence Reset condition was asserted, its recorded sequence state can be retained while Auto Mode is cancelled. After the affected equipment is reconciled and the required conditions are restored, the sequence can resume from its established step.

Whether an affected PLC Pro Sequence should be allowed to persist is a separate decision. If the partial power-loss condition makes the sequence state or the equipment associated with that sequence untrustworthy, the PLC Pro must determine whether the sequence should be reset or whether its recorded state can remain valid through recovery.

When the recorded sequence state remains valid, another recovery method is to use Manual Mode to place the affected equipment into the state required by the current Sequence Step. Once that equipment state has been re-established and verified, the sequence can then be allowed to continue from its recorded step.

Recovery proceeds through Manual Mode, where the affected equipment can be placed into the required operating condition and its state verified. Any later request for Auto Mode is then handled through the normal Auto Mode entry requirements.

• Provide usable indications of controlled-resource availability.
• Treat an affected resource as untrustworthy and assume worst case when the cause of its loss cannot be independently determined.
• Treat inputs from unavailable I/O as invalid and do not assume the state of its outputs.
• Apply the response to the smallest practical operating scope while preserving unaffected operation whenever practical.
• Err on the side of caution when determining the required response scope.
• Cancel Auto Mode for the affected operating scope.
• Assert and maintain an E-Stop request when the affected condition presents a hazard requiring that response.
• Verify that affected resources are again available before recovery proceeds.
• Reconcile the control-program state with the actual equipment state during recovery.
• Evaluate retained or latched requests that may become actionable when functionality is restored.
• Determine whether an affected PLC Pro Sequence should be reset or allowed to retain its recorded sequence state.
• Do not bypass Auto Mode entry requirements during recovery.