How to write a control specification — Decide how it stops and how it recovers before commissioning

Last updated: 2026-09-24 ／ Category: Control design, PLC

A control specification decides, before any program is written, how the machine stops and how it recovers, and gets everyone to agree on it. This guide is for the control designer at a machine builder who asks the customer what should happen on a fault and only hears "stop it".

When the robot stops on a fault, is the clamped part released? After the emergency stop is reset, where does the machine move from? If the specification does not say, the software engineer decides on the spot, and the customer's and the mechanical designer's differing assumptions surface at the acceptance test. The example is a transfer machine: a conveyor carries the part to a fixed position, it is clamped, and a robot picks it up.

1. Decide the form of each chapter, and leave no chapter as prose only

For each chapter, decide first what it settles and in what form. A chapter written only in prose lets every reader picture a different motion. Chapter names differ from company to company. The "form" column says what the chapter is written with.

Chapter	What it settles	Form	Agreed with
Scope and assumptions	How far your control reaches. Who makes the robot program, the safety circuit, and the communication with the production PC. Cycle time	Prose and tables	Customer, mechanical design
System configuration	Devices and communication. The master on each line	How to draw a system diagram	Electrical design, owners of the other devices
I/O and addresses	Signal names and PLC addresses. Whether signals in the stopping direction are ON when healthy	How to build a PLC address map	Electrical design
Operating modes and states	The list of modes and when switching is allowed. How the operating states (running, stopped and so on) change	Table	Customer (operators, maintenance)
Operation	The motion of each step and what it waits for before moving on	How to draw a PLC control flowchart	Mechanical design
Signals with other devices	The handshake order and the waiting-time limits. What the signals do when the other device stops	How to draw a timing chart	Owners of the other devices
Stops and faults	The kinds of stop. For each fault: how it stops, what keeps running, and the recovery procedure	Fault list table	Customer, safety
Manual operation	Interlocks that stay active in manual mode	Condition table	Mechanical design, customer
Screens and operator panel	The list of screens and how faults are announced (lamp, buzzer, screen)	Screen list	Customer
Change record	Versions and the reason for each change. Open items and who owns them	Table	Everyone

The chapters on configuration, I/O, operation and signals with other devices show their mismatches once drawn; the linked guides say how. The chapters most often dismissed in one sentence are modes, stops and faults, and manual operation. Section 2 below is what those chapters settle.

2. Modes, stops, recovery and manual operation: name them and settle them in tables

Draw the line around your own control first The robot program is written by the robot engineer, and power is cut by the safety circuit. The PLC reads the state of the safety circuit and owns the clean-up and recovery (Emergency stop recovery flowchart (sample)). Outside the line, write no internals: only who decides, and the signals exchanged at the boundary.
Put operating modes and states in separate tables A mode says who may move what; a state is the operating condition of the whole machine. Put them in one list and nobody can say what may be operated while the machine is in a fault stop in automatic mode. Write mode changes with the state as the condition, and allow automatic to manual only while waiting for start or in a fault stop.
Decide the kinds of stop and name them The customer's "stop it" covers several ways of stopping: a cycle stop at the end of a step, a pause that resumes where it stopped, a fault stop that waits for a reset, and an emergency stop that cuts the power. Whether the emergency stop is stop category 0 (cut power at once) or 1 (decelerate, then cut) is decided with the safety engineer.
Take the timeout faults from the waits in the flowchart Give each wait a number of seconds and every timeout maps one-to-one to a motion. Waits for a person, and waits where parts simply have not arrived from upstream, get no limit. Faults that can occur in any step, such as a servo alarm or air pressure, are picked up per device, separately from the waits.
Split recovery into three: remove the cause, reset, start The machine must never move on a reset. A reset only clears the display and accepts a start; parts left mid-cycle are removed and the machine is Homing flowchart (sample). Resuming from where it stopped is allowed only for faults where the presence of a part at each position is unambiguous (E01 and E02 in the example).
Write what the other device's signals do on a fault and on power loss Signals in the stopping direction are received as "healthy = ON". Receive "fault = ON" and a power loss or a broken wire reads as "no fault". The handshake order and the waiting-time limits are agreed with the other side on a How to draw a timing chart (section 4 of the Handshake timing chart (sample)).
Put the conditions for manual motion in a table Separate the interlocks that stay active in manual mode from the conditions that manual mode removes. Because manual mode is used to recover from faults, "never open or close the clamp while the robot is in the interference zone" stays active in manual. Only interlocks that exist for PLC functions can be bypassed from the screen; guard doors and emergency stops that protect people sit in the safety circuit and cannot be.

3. Example: the fault list of a transfer machine also says what keeps running

One row of the fault list holds the detection condition, how it stops, what keeps running, and the recovery procedure. The example transfer machine works in this order.

The conveyor starts when the entry sensor sees a part and carries it to the fixed position
Once clamped, a pick request goes to the robot
The robot comes in, grips the part and requests the clamp to open
The PLC opens the clamp, the robot carries the part out and returns pick complete

The robot is dedicated to this machine and comes at once when it receives the pick request. The seconds in the detection conditions are the motion times plus a margin: about 5 s for the conveyor, about 0.5 s for the clamp, about 5 s for the robot pick. The table is an excerpt of the fault list.

Fault	Detection condition	How it stops	Recovery procedure
E01 Part not arrived	The position sensor is still OFF 8 s after the conveyor started	Fault stop. The conveyor stops where it is	Check the parts on the conveyor and clear the jam → reset → start (the transfer is repeated)
E02 Clamp failed to close	The closed-end sensor is still OFF 1.5 s after the clamp-close command	Fault stop. The clamp command is left unchanged	Check the part orientation → open and close the clamp by hand and check the closed end → reset → start (the clamp is repeated)
E03 Robot pick not completed	Pick complete has not come 10 s after the pick request turned ON	Fault stop. The pick request stays ON. The clamp command is left unchanged	Check the fault on the robot side → if the hand is gripping the part and the clamp is closed, open the hand → move the robot to its retreat position. Remove the part left in the jig or the hand → drop the pick request → reset → homing → start
E04 Conveyor axis servo fault	The servo amplifier's fault output (ON when healthy) turned OFF	Fault stop. Servo OFF	Remove the cause → clear the servo alarm → reset → homing → start
E05 Emergency stop	The safety relay monitor (ON when healthy) turned OFF	Emergency stop (the safety circuit cuts the power; the PLC drops its motion outputs and latches)	Release the emergency stop → reset → homing → start

The "how it stops" of E02 and E03 also says what keeps running. Opening the clamp on E02 would hide where the part jammed. Whether E03 keeps or drops the pick request goes together with what the robot does when it drops, so it is decided with the robot engineer. If the machine stops in the middle of the handover, the clamp is not opened while the robot is inside (item 7 of section 2), so it is the hand that opens.

The fault names are used unchanged in the screen text and the program comments, so that nobody asks at the acceptance test whether "part missing" on the screen is the same as "part not arrived" in the specification.

4. Start from the configuration; write the manual conditions after the fault list

Scope and system configuration Decide the scope of your control and put the devices and communication into a How to draw a system diagram.
I/O and addresses For each device in the diagram, allocate signals and addresses in the How to build a PLC address map. Receive signals in the stopping direction as ON when healthy. For the emergency stop, receive the safety relay monitor and the button's monitoring contact (NC); the stopping contact itself goes into the safety circuit.
Normal operation and the handover with other devices The stage where the step sequence goes into a How to draw a PLC control flowchart and the order with other devices into a timing chart.
Name the kinds of stop and the operating states The "how it stops" column of the fault list is filled with these names.
Build the fault list from the waits in the flowchart For each wait, decide the seconds, how it stops, what keeps running, and the recovery. Add the faults that can occur in any step per device.
Mode changes and the conditions for manual operation Written after the fault list, fewer conditions are missed, because manual operation is what recovers from faults.
Read-through and the list of open items Gather the people in the "agreed with" column and read it through together. Items not settled on the spot go into the list with an owner and a deadline.

5. Easily missed: the state right after power-on, how buttons are pressed, how parts are cleared, records

The state right after power-on is not written — After a power failure or the morning switch-on, parts may be left mid-cycle. Start in the not-homed state (see How to draw a PLC state transition diagram) and refuse a start. The operator checks the parts left in the machine and then starts the homing
Buzzer-stop and reset presses do not follow the customer's factory — Every factory has its own convention, such as the first press silencing the buzzer and the second resetting. If it differs from what the operators are used to, this machine is the one they get wrong
Deciding only "clear all parts before homing" — Write how the operator clears them. Otherwise you will be asked later for a manual discharge function. For faults only the mechanical side can fix, such as a jam, write who does what
The production record after a fault stop is not decided — Is the record of the part in progress deleted, or kept and flagged? On machines that report to a production PC, decide this with quality and production control. If it is not in the specification, it becomes extra work later

6. Each row of the fault list becomes one item of the acceptance test

One row of the fault list is one item of the acceptance test. For E01, hold a part by hand just before the fixed position. Does the conveyor stop after 8 s, does "Part not arrived" appear on the screen, does the written procedure bring it back? Number the rows, use the numbers in the test record, and write the pass criteria in the specification, or you will argue over a different word on the screen.

Changes agreed verbally at the acceptance test also get a new version of the specification and a reason in the change record. Without it, it becomes "you said, I said", and the discussion about extra cost turns sour.

Tools for the diagrams in each chapter

The diagram chapters of a control specification can be drawn with the editors on this site and exported as SVG or Markdown to paste into the document. The four editors read and write the same JSON format.

System Diagram Editor — The system configuration chapter. Devices, communication and the master on each line.
Address Map Editor — The I/O and addresses chapter. Allocates signals and PLC addresses to each device of the diagram.
Timing Chart Editor — The chapter on signals with other devices. The handover order and which signal triggers which.
Flowchart Editor — The operation chapter. The step sequence and the waits; the timeout faults come from the waits drawn here.

No installation, no sign-up. They run in the browser.

yk.builds