There is a failure mode every operations team eventually meets: the data stops changing, and nobody notices, because unchanging data looks exactly like a calm plant. The trend is flat, the screen is green, and the numbers are hours old.
The uncomfortable part is that “the data stopped changing” has at least three different causes, and they demand three different responses. Maybe nothing is happening — the plant is idle overnight and the values genuinely are flat. Maybe the collection chain is down — the PLC is running the plant fine, but nothing it does has reached the historian since smoko. Or maybe the controller itself has stopped scanning — the worst of the three, because the plant is now running on whatever the outputs last held.
The traditional check — how old is the newest sample? — cannot tell these apart. An idle plant produces no fresh samples because values only historize on change. A dead chain produces no fresh samples because nothing arrives. A stopped controller produces no fresh samples because nothing is computed. Three states, one symptom, and the screen shows green for all of them.
A tag that is never allowed to be boring
Our answer is a standard system block that every controller carries — Controller System, the newest type in the standard library. It exposes a small, deliberately dull set of tags: a scan counter that advances on every scan, a first-scan flag, the scan-cycle time, an aggregate of field-comms health, and a controller fault summary.
The scan counter is the load-bearing one. It is the one value on the controller that is guaranteed to change whether or not the plant does — and we historize it on a fixed cadence rather than on change, so its arrival is a promise, not an accident of activity. Every fresh heartbeat sample is evidence that the entire chain worked: the PLC scanned, the edge read it, the site server ingested it, the cloud received it. Not a health flag someone computed and forwarded — the actual data path, exercising itself.
Three verdicts instead of one shrug
With a heartbeat under it, the health check can finally say which of the three worlds you are in.
Heartbeat fresh, counter advancing, process tags quiet — the plant is idle, and now you can assert that with evidence rather than hope. The chain is demonstrably alive; the flat trend is real.
Heartbeat samples stale — the chain is down, regardless of how plausible the cached values on the screen look. This is the “green while dead” case, and it now announces itself instead of hiding.
Heartbeat samples arriving, but the counter not advancing — the chain is fine and the controller is not scanning: stopped, faulted, or switched to program mode. The freshest sample in the historian is faithfully reporting a frozen machine.
The supporting tags fill out the picture. The first-scan flag means a controller restart shows up as a fact on the record, not an inference from a gap. Scan time gives you the load trend that precedes trouble. And the comms-health aggregate distinguishes “the controller is fine but its field network is degrading” from either.
The same heartbeat on every vendor
The block is a cross-platform parity surface: the same tag set on every controller type — ControlLogix, PLCnext, and the virtual PLCs that stand in during simulation. A health check written against it does not care whose logo is on the panel, and a simulated controller proves its liveness the same way a physical one does. That is the same one-model discipline as the rest of the library, applied to the platform’s own plumbing.
To be precise about the line:
- Shipped: the heartbeat modelling on the controller model, the fixed-cadence historization, the health check that turns sample age and counter movement into the three verdicts, and the
Controller Systemtype in the standard library. - In progress: rolling the block through each PLC platform’s native code path — ControlLogix first, where the fleet is.
A monitoring system’s first duty is to be honest about whether it is itself alive. It took a dedicated heartbeat, historized on a schedule, to make that honesty structural — because the one thing a dead chain cannot do is deliver the sample that proves it.