Batch Process PLC Programming: ISA-88 Recipe Example

How does a PLC control a batch process?

The PLC executes reusable equipment phases—such as Charge, Agitate, Heat, Hold and Transfer—using parameters copied from an approved control recipe. A batch state machine starts only when equipment and safety permissives are true, records every transition and actual value, and routes hold, abort and recovery through explicit states.

The central design rule is separation:

• Recipe: what product requires—targets, tolerances, sequence choices and limits.
• Equipment logic: how this vessel, valve, drive or heater safely performs a phase.
• Batch procedure: which phase runs next and what completion condition advances it.

ISA-88 in practical PLC terms

The ISA-88 series establishes models and terminology for batch control. Its purpose is not to mandate one PLC language or vendor. It gives process, automation and operations teams a shared way to describe equipment, procedures and recipes.

For a single mixing cell, a practical mapping is:

ISA-88 concept	Example
Process cell	One batch production line
Unit	Mixer M-101
Equipment module	Ingredient dosing manifold, jacket loop, transfer skid
Control module	Valve, pump, agitator, temperature transmitter
Procedure	Make product A
Unit procedure	Produce one batch in M-101
Operation	Charge, mix, heat/hold, transfer
Phase	Dose ingredient, start agitator, control temperature, discharge
Control recipe	Approved recipe instantiated with batch ID and assigned equipment

The public ISA overview describes Part 1 as models and terminology, Part 2 as data structures/language guidance, Part 3 as general/site recipe representation, and Part 4 as batch production records. Buy or access the applicable standards through ISA for formal project requirements.

Reference batch: three-ingredient heated mix

This worked example uses one vessel with:

• three ingredient valves (V_A, V_B, V_C);
• vessel load cells;
• agitator and run feedback;
• jacket heating valve;
• product temperature;
• discharge valve and transfer pump;
• high-high level and independent protective functions outside normal control.

Control recipe

Parameter	Example value	Engineering rule
Ingredient A target	400.0 kg	Must be within equipment and inventory limits
Ingredient B target	150.0 kg	Dose tolerance applies to actual weight
Ingredient C target	50.0 kg	Fine-dose cut-off is recipe/equipment specific
Agitator speed	60%	Must be inside drive/equipment envelope
Mix-before-heat time	120 s	Timer runs only with confirmed agitation
Temperature setpoint	72.0 °C	Must be below approved recipe maximum
Temperature tolerance	±1.0 °C	Defines valid hold band
Hold duration	300 s	Accumulates only while temperature is valid
Empty threshold	10.0 kg	Used with time and flow checks

These are training values, not a formulation or process recommendation.

Recipe validation

Validate before copying a selected recipe into the active control recipe:

RecipeValid :=
    (Recipe.IngredientA_kg >= 0.0)
    AND (Recipe.IngredientB_kg >= 0.0)
    AND (Recipe.IngredientC_kg >= 0.0)
    AND (Recipe.Total_kg <= Unit.MaxWorkingMass_kg)
    AND (Recipe.Agitator_pct >= Unit.MinAgitator_pct)
    AND (Recipe.Agitator_pct <= Unit.MaxAgitator_pct)
    AND (Recipe.TempSP_C <= Unit.MaxRecipeTemp_C)
    AND (Recipe.HoldTime > T#0s);

Copy the validated recipe into a batch-specific immutable structure at start. Do not let an HMI edit the active master row while a batch is executing.

Batch and phase state models

A batch engine needs more than Step := Step + 1. Use explicit states such as:

IDLE
STARTING
RUNNING
HOLDING
HELD
COMPLETING
COMPLETE
ABORTING
ABORTED
FAULTED

Each equipment phase should expose a consistent command/status contract:

Phase input	Meaning
Start	Begin from a valid idle state
Hold	Pause progression through a defined controlled action
Restart	Resume after hold conditions are satisfied
Abort	Move toward a predefined aborted state
Reset	Clear a completed/aborted phase only when permissives allow
Parameters	Target, tolerance, timeout and equipment selection

Phase output	Meaning
Ready	Equipment and phase are available to start
Running	Phase is actively executing
Held	Phase has reached its defined held condition
Complete	Completion criteria are satisfied
Aborted	Abort sequence has completed
Faulted	Phase cannot continue; diagnostic code/context available

The exact names are implementation choices. Consistency is what allows one procedure engine to coordinate many phases.

Complete batch sequence

The example procedure is:

1. VERIFY_READY
2. TARE
3. DOSE_A
4. DOSE_B
5. DOSE_C
6. START_AGITATOR
7. MIX_PREHEAT
8. HEAT_TO_SETPOINT
9. HOLD_TEMPERATURE
10. TRANSFER
11. VERIFY_EMPTY
12. COMPLETE

Structured Text procedure skeleton

This is vendor-neutral IEC-style pseudocode. Adapt task, enum and function-block syntax to the target controller.

CASE Step OF

    VERIFY_READY:
        IF StartBatch
           AND RecipeValid
           AND UnitReady
           AND SafetyPermissive
           AND NOT MaterialPathConflict THEN

            ActiveRecipe := SelectedRecipe;
            BatchId := NewBatchId;
            LogEvent(BatchId, 'BATCH_START');
            Step := TARE;
        END_IF;

    TARE:
        WeighPhase(
            Command := START,
            Mode := TARE,
            Timeout := T#20s
        );
        IF WeighPhase.Complete THEN
            Step := DOSE_A;
        ELSIF WeighPhase.Faulted THEN
            Step := FAULTED;
        END_IF;

    DOSE_A:
        DosePhase(
            Command := START,
            Source := INGREDIENT_A,
            Target_kg := ActiveRecipe.IngredientA_kg,
            Tolerance_kg := ActiveRecipe.DoseTolerance_kg,
            Timeout := ActiveRecipe.DoseTimeout
        );
        IF DosePhase.Complete THEN
            LogActual('A', DosePhase.Actual_kg);
            Step := DOSE_B;
        ELSIF DosePhase.Faulted THEN
            Step := FAULTED;
        END_IF;

    DOSE_B:
        (* Same phase instance/interface, different source and target *)

    DOSE_C:
        (* Same pattern; do not duplicate valve logic in procedure code *)

    START_AGITATOR:
        AgitatePhase(
            Command := START,
            Speed_pct := ActiveRecipe.Agitator_pct,
            FeedbackTimeout := T#5s
        );
        IF AgitatePhase.Running THEN
            Step := MIX_PREHEAT;
        ELSIF AgitatePhase.Faulted THEN
            Step := FAULTED;
        END_IF;

    MIX_PREHEAT:
        MixTimer(
            IN := AgitatePhase.Running,
            PT := ActiveRecipe.MixBeforeHeat
        );
        IF MixTimer.Q THEN
            Step := HEAT_TO_SETPOINT;
        END_IF;

    HEAT_TO_SETPOINT:
        TemperaturePhase(
            Command := START,
            Setpoint_C := ActiveRecipe.TempSP_C,
            HighLimit_C := ActiveRecipe.MaxTemp_C
        );
        IF TemperaturePhase.InTolerance THEN
            Step := HOLD_TEMPERATURE;
        ELSIF TemperaturePhase.Faulted THEN
            Step := FAULTED;
        END_IF;

    HOLD_TEMPERATURE:
        HoldTimer(
            IN := TemperaturePhase.InTolerance
                  AND AgitatePhase.Running,
            PT := ActiveRecipe.HoldTime
        );
        IF HoldTimer.Q THEN
            Step := TRANSFER;
        END_IF;

    TRANSFER:
        TransferPhase(
            Command := START,
            EmptyThreshold_kg := ActiveRecipe.EmptyThreshold_kg,
            Timeout := ActiveRecipe.TransferTimeout
        );
        IF TransferPhase.Complete THEN
            Step := VERIFY_EMPTY;
        ELSIF TransferPhase.Faulted THEN
            Step := FAULTED;
        END_IF;

    VERIFY_EMPTY:
        IF VesselWeight_kg <= ActiveRecipe.EmptyThreshold_kg
           AND NOT ProductFlowDetected THEN
            Step := COMPLETE;
        END_IF;

    COMPLETE:
        LogEvent(BatchId, 'BATCH_COMPLETE');
        BatchComplete := TRUE;

    FAULTED:
        (* Outputs are governed by each phase's defined fault response. *)
        BatchFaulted := TRUE;
        LogFault(BatchId, ActivePhase, FaultCode, FaultContext);

END_CASE;

Why completion conditions need more than time

“Valve open for 30 seconds” is not proof that an ingredient arrived. A robust dose checks measured mass or flow total, tolerance, valve command/feedback and timeout. “Transfer pump ran” is not proof the vessel is empty. Use weight/level plus flow and timeout.

Coarse/fine dosing phase

A simple gravimetric dose has four stages:

1. Open coarse and fine feeds.
2. At Target - CoarseCutoff, close coarse feed.
3. At Target - FineCutoff, close fine feed.
4. Wait for settling, then compare stable actual weight with tolerance.

Remaining_kg := Target_kg - NetWeight_kg;

CoarseValve := Running
               AND (Remaining_kg > CoarseCutoff_kg);

FineValve := Running
             AND (Remaining_kg > FineCutoff_kg);

IF NOT CoarseValve AND NOT FineValve THEN
    SettleTimer(IN := WeightStable, PT := SettleTime);
END_IF;

Complete := SettleTimer.Q
            AND ABS(NetWeight_kg - Target_kg) <= Tolerance_kg;

Faulted := DoseTimeout.Q
           OR WeightSignalBad
           OR UnexpectedWeightLoss;

Tune cutoffs from measured in-flight material. Never hide an out-of-tolerance dose by overwriting the actual value with the target.

Temperature ramp and hold

Separate:

• temperature regulation;
• heat permissives;
• high-limit protection;
• recipe hold qualification.

The hold timer should accumulate only while:

temperature is inside the approved band
AND agitation feedback is healthy
AND temperature signal quality is good
AND batch is not held or faulted

If the process leaves tolerance, define whether the hold timer pauses, resets or causes a deviation. That is a process/quality decision and belongs in the functional specification.

See the PLC PID tuning guide for loop behavior and deadband for tolerance terminology.

Permissive, interlock and protective-function boundaries

Do not mix these concepts:

Layer	Example	Typical behavior
Start permissive	Vessel empty and transfer path available	Prevents phase start
Process interlock	Agitator feedback lost while heating	Removes heat command and faults/holds phase
Control alarm	Dose is approaching timeout	Warns operator, may continue
Independent protective function	High-high pressure/temperature	Implemented to the required safety lifecycle and integrity

The standard PLC sequence must not be represented as the sole protective layer for hazardous pressure, temperature, reactions or personnel exposure. Perform the required process-hazard and functional-safety work with qualified specialists.

Batch record and traceability

Record events and values with context:

Record field	Example
Batch identity	Batch ID, product/revision, unit
Recipe evidence	Master recipe ID, revision, approval and checksum/version
Execution	Start/end, operator, phase transitions
Setpoint and actual	Target mass versus settled actual mass
Quality	Signal status, tolerance result, sample/approval if applicable
Deviations	Alarm, hold, manual action, reason and authorization
Equipment	Controller/software version and calibrated instrument identifiers
Outcome	Complete, aborted, rejected or reworked

Time synchronization matters. PLC, HMI, historian and MES timestamps need an approved common source.

HMI requirements

The operator display should show:

• batch ID, product and recipe revision;
• active unit procedure, operation and phase;
• phase command and state;
• setpoint, actual, tolerance and time remaining;
• active permissives/interlocks;
• alarms with response guidance;
• held/aborting status;
• controlled manual actions with authorization.

Do not give every operator unrestricted recipe editing. Separate selection, parameter entry, approval and active-batch control by role.

Reproducible batch test matrix

Run on a simulator, test PLC or controlled FAT setup. Record the active step, phase state, commands, feedback, setpoints, actual values, alarm and batch record for each case.

ID	Injected condition	Expected result
B01	Valid recipe and all permissives	Batch starts and snapshots recipe revision
B02	Recipe total exceeds vessel capacity	Start rejected with explicit validation message
B03	Weight signal bad before dose	Dose cannot start
B04	Coarse valve fails to close	Fine approach inhibited; dose faults on defined condition
B05	Ingredient does not increase weight	Dose timeout; actual value preserved
B06	Agitator feedback lost during heat	Heat command removed; batch follows specified hold/fault response
B07	Temperature leaves tolerance during hold	Hold timer follows documented pause/reset rule
B08	Transfer path unavailable	Transfer phase cannot start
B09	Flow continues after empty threshold	Empty verification fails and alarms
B10	Operator requests hold in each phase	Each phase reaches its documented held condition
B11	Abort during heat and transfer	Outputs follow the phase-specific abort design
B12	Power cycle during batch	Recovery follows approved retained-state/reconciliation procedure
B13	HMI edits selected master recipe mid-batch	Active control recipe remains unchanged
B14	Historian unavailable	Defined buffering/alarm behavior occurs without corrupting control

Common batch-programming failures

One monolithic step integer

A single routine with hundreds of step comparisons makes phases hard to reuse and hold/abort behavior inconsistent. Encapsulate equipment phases behind a common interface.

Recipe values wired directly to outputs

A recipe target is a request. Equipment limits and permissives must constrain it before any output changes.

Timer-only completion

Time does not prove material transfer, agitation or temperature. Use measured completion criteria plus timeout.

Editing the active recipe

Snapshot the approved version for the batch. Route controlled adjustments through explicit deviation logic with audit context.

Resume after power loss without reconciliation

Retaining Step = 7 does not prove that valves, vessel contents or temperature still match state 7. Recover through an operator-guided reconciliation state.

Safety logic hidden inside normal phase code

Keep required independent protective functions separate, validated and access-controlled according to their safety lifecycle.

Practise the sequence in a simulator

PLC Simulation Software provides a browser batch-mixer scenario for learning recipe parameters, timers, state progression and fault injection.

Ownership disclosure: PLC Programming and PLC Simulation Software are operated by the same publisher. The simulator is a training product; it is not a validated batch platform and is not suitable for controlling a production process.

Open the batch-mixer simulator and reproduce B01–B12 before adapting the phase pattern to a vendor PLC.

Primary sources and scope

• ISA-88 series of standards
• ISA-88 committee scope
• ISA explanation of ISA-88 batch-control standards

This article is an implementation tutorial, not the ISA-88 standard. Formal regulated or hazardous-process designs require the applicable standards, user requirements, process-safety work, validation plan and vendor documentation.

Frequently asked questions

What is the difference between a recipe and PLC logic?

The recipe contains product-specific parameters and procedural choices. PLC equipment logic contains the tested way the assigned equipment performs a phase inside its limits. Separating them lets many products reuse validated equipment control.

Should a hold timer reset when temperature leaves tolerance?

The process owner and quality requirements must define whether it pauses, resets or creates a deviation. Implement and test that rule explicitly.

Where should recipes be stored?

That depends on controller capacity, number of recipes, approval workflow and integration requirements. Wherever the master is stored, snapshot the approved revision into the active control recipe and record its identity.

Can ladder logic implement ISA-88 concepts?

Yes. ISA-88 is a model and terminology framework, not a required programming language. Ladder, Structured Text, SFC and vendor batch tools can implement the model when roles and interfaces are clear.

How is a batch restarted after a PLC power cycle?

Enter a reconciliation state. Verify vessel contents, equipment positions, recipe identity, actual process conditions and operator authorization before resuming, aborting or discarding. Do not resume solely from a retained step number.

Related process-control guides

• Batch mixing PLC control
• PLC state-machine reference
• PLC PID tuning
• Cause-and-effect matrix
• Clean-in-place control
• Food-processing PLC programming
• ISA-88 explained