Operator Clicks Twice and the Machine Runs Twice? Give Commands an Identity
A slow acknowledgement can lead an operator or client to retry a command that the PLC already accepted. If every retry creates a new action, one intended request can execute twice. Define how the system recognizes a repeated request and communicates its result.
Original command-protocol design example; implementation needs application-specific review.
What is happening?
Command delivery and process execution are different events. A request identifier, explicit state, and acknowledgement can help an application distinguish new work from a repeated transmission. The design must also define restart behavior, identifier reuse, rejection, and whether a command is safe to repeat.
Check these five things
-
Describe the command's intended lifecycle from request through acceptance, execution, and completion.
-
Identify retry behavior in the HMI or supervisory client.
-
Use a supported identity and acknowledgement scheme appropriate to the application rather than only a transient button bit.
-
Define how duplicate, stale, out-of-order, and invalid requests are handled.
-
Test delayed responses and disconnects around acceptance in simulation.
Worked example
A client sends request 104 for a nonrepeating operation but loses the acknowledgement. It sends 104 again. A reviewed application can report the existing request's state instead of interpreting the retry as a fresh operation. The exact persistence rules must account for controller restarts.
Quick diagnostic reference
| Message | Decision |
|---|---|
| New valid identity | Accept according to requirements |
| Repeated identity | Return known state or defined response |
| Stale or invalid identity | Reject with explanation |
The mistake to avoid
A sequence number alone does not guarantee exactly-once behavior across every failure. Define persistence and recovery at the point where the physical action occurs.
How to verify the fix
Show that the tested retry and restart scenarios cannot create unintended duplicate actions and that the operator can determine the command outcome.
Field-work boundary: These are educational diagnostic guides. Use the exact equipment manuals and approved site procedures. Electrical testing and machinery changes belong to qualified, authorized personnel; control hazardous energy and validate affected functions before release.
Technical reference
Rockwell Automation: controller and HMI communication documentation. The examples and diagnostic tables above are original teaching material; they do not replace the product manual.