Tetra PlantMaster central control system

The control system follows the classic ISA-95 automation pyramid. Responsibilities are split by layer so that real-time safety never depends on the supervisory network being up: if PlantMaster drops, the field PLCs hold the process in a safe state.

PlantMaster supervises field controllers - typically Allen-Bradley (ControlLogix / CompactLogix over EtherNet/IP) or Siemens (S7-1500 over PROFINET). Integration is a data contract: a published, scaled, unit-correct tag for every signal the supervisory layer reads or commands.

Process visualization mirrors the P&ID: tanks, valves, pumps, and heat exchangers shown live, in true topology, with state-coloured elements. The goal is that an operator reads plant state at a glance and drills to any loop in two clicks.

State, not decoration. Colour encodes status (running, CIP, sterilising, fault) consistently across every screen. Grey is normal; colour draws the eye only to what needs attention - high information density without noise.

PlantMaster historizes process values, batch records, and the full alarm and event journal to a central database. This store is the backbone of traceability, OEE, and deviation analysis.

Tags are historized with deadband and scan-rate tuned per signal - fast for control-critical temperatures, slow for slow tank levels - to keep the historian dense where it matters without flooding storage. Every batch links its trends, alarms, and recipe version into one record.

Alarms follow rationalisation principles (the discipline behind EEMUA 191 / ISA-18.2): every alarm is actionable, prioritised, and timestamped. Nuisance and standing alarms are designed out, not tolerated.

Recipe management (modelled on the ISA-88 batch standard) separates the what from the how: a recipe defines parameters and a procedure of phases; the equipment knows how to execute each phase. Operators select and run recipes; they do not edit live logic.

Recipes are versioned and access-controlled: changes are logged with user, timestamp, and reason, and the executed version is stamped into every batch record. Parameter limits are enforced so an operator cannot enter a setpoint outside the validated window.

Sequencing coordinates units so transitions happen in the right order with the right interlocks - production cannot start on a circuit that has not completed CIP and sterilization, and the steriliser and filler stay synchronised through the aseptic tank.

Alcip is the centralised CIP system; PlantMaster coordinates which circuit it serves, when, and with which program - so one CIP station cleans many circuits without conflicts or cross-contamination.