ISA-88 Batch Control: Separate What to Make from Equipment That Makes It

The physical model is a hierarchy of equipment. A process cell contains the batch-producing equipment. Units are major equipment entities that can carry out processing activities, such as a reactor, mixer or hold tank. Equipment modules coordinate smaller functions, and control modules connect to regulatory or discrete control around devices and instrumentation. The names are not merely drawing labels; they define capability, ownership and allocation boundaries.

The procedural model organizes work. A procedure can contain unit procedures; a unit procedure contains operations; an operation contains phases. A phase is the smallest procedural element commonly presented to batch coordination and usually maps to an equipment capability such as Add Material, Heat, Agitate or Transfer. Not every small PLC action must become a recipe-visible phase.

The recipe model describes production intent. Formula parameters, procedural steps, equipment requirements and related information should not hard-code one device address when the process can run on equivalent equipment. At execution, the selected equipment and recipe meet in a control recipe. That is where actual unit allocation, parameter values and execution identity become concrete.

These models overlap in time but not in responsibility. The recipe can request “Heat to 80 °C”; the unit capability knows which steam valve, temperature loop, interlocks and ramp policy deliver heat. This separation allows a recipe to move across suitable units and lets maintenance change a valve implementation without rewriting product procedure.

A phase is more than a routine call. It receives parameters and a command, owns an execution lifecycle and reports state plus results. Define legal commands for idle, running, held, completed and abnormal states. Reject an invalid transition visibly instead of ignoring it. If a phase cannot start, report the readiness reason the procedural layer and operator can act on.

Parameter handling deserves its own contract. Validate range, unit, recipe revision and equipment capability before moving material or energy. Decide whether parameters can change while running and how such a change is recorded. Preserve the actual values used, not only the master-recipe defaults.

Define hold, stop and abort separately. A hold aims for a controlled stable condition from which continuation may be possible. Stop may complete an orderly early termination. Abort may drive a more immediate equipment response and require recovery before restart. These meanings must be tailored to the process and risk; copying state names without physical definitions creates false confidence.

Phase reports should include enough evidence for coordination and later analysis: actual quantities, start and end times, completion code, limit or timeout reached, equipment identity and relevant quality. Do not make every scan value a report field. Link high-rate historian data when it is required for diagnosis.

Design exceptions at each layer. A motor module owns loss-of-feedback behavior. An equipment phase owns whether agitation failure prevents heating from continuing. The procedure owns whether a failed charge can be retried or whether the batch requires disposition. Pushing every fault to one global abort loses context and can produce unnecessarily destructive responses.

Hold must describe a physical stable condition: stop addition, maintain agitation, close energy paths, retain temperature control, or another process-specific policy. The correct response may depend on material state and elapsed time. Record when the exception began and how long the batch remained outside normal execution.

Restart is a transition, not a reset bit. Reconcile physical equipment, measured material, allocated resources, phase state and recipe position. Determine whether completed actions are repeatable; adding the same ingredient twice is not recovery. Provide authorized skip, repeat or alternate-path tools only with clear consequences and records.

Test exception combinations, not only one isolated fault. Loss of a shared transfer route while another unit holds it, communication loss during addition, or a controller restart during a hold can expose ownership gaps. Define how batch identity and execution state survive or recover after system restarts.

Begin at the bottom. Device and equipment modules need deterministic commands, feedback and faults before a recipe layer can coordinate them. Define a small phase interface used consistently across capabilities. Build a phase test harness that supplies commands and parameters and asserts state, lower commands, reports, timeouts and recovery.

Use a state machine or SFC-style model for procedure coordination. Make current procedure element, active phase, waiting resource and transition reason observable. Separate procedural decisions from the device logic that performs them. Avoid one monolithic CASE statement that directly writes every valve and loses reusable capability boundaries.

Introduce recipe data only after equipment capabilities and limits are stable. Validate every control-recipe parameter against type, unit and equipment range. Store recipe and program revisions with test evidence. Add a batch event stream whose ordering and identity can be queried after an exception.

For formal ISA-88 conformance, regulated production, redundancy, electronic records or enterprise scheduling, use appropriately reviewed architecture, products and validation. This guide and browser exercises teach the models; they do not certify an implementation.