Two blocks are available in Desigo for superposed plant control:

  • CMD_CTL command control for sequence control
  • PWR_CTL power control for stepped control

Both blocks are based on the standard BACnet Command Object. They have both tables that define the operating modes and switching response of the underlying aggregates. The commandable blocks in the aggregates must have a BACnet [PrioArr] to use the following output and value blocks: AO, BO, MO, AVAL, BVAL und MVAL.

PWR_CTL may only be communicated using the MVAL blocks based on the specialized task – controlling steps.


Referencing is used exclusively for communications by the superposed control blocks with the output and value blocks in the aggregates to be commanded. The references are derived from the Technical Designation (TD) of the block. The reference is defined relative to the control block to the command block. The aggregate does not have to be in the same hierarchy; cross-plant communications is possible.

Example for a reference: B = \...\...\PreHcl’CmdVal

Where CmdVal is the designation for a BVAL object in the PreHcl aggregate. More than one block can be referenced for each aggregate.

As the project-specific root is not part of the address, the references do not need to be modified if the root changes. This simplifies project-specific name changes and the copying of library solutions into a project.

The references, that is, the technical designations with relative addresses are resolved in the controller at runtime. Any addressing errors will therefore only be apparent during runtime. The cause of the error can largely be eliminated, however, when parameterizing the controls blocks with the help of the Plant Control Editors.

The figure shows that the [PrioArr] can communicate directly with the referenced blocks. You can command switch and positioning values and enable them. A commanded command remains valid until the priority entry is enabled again. The control blocks automatically enables all commanded priorities, when the block commands the aggregates to the new plant operating mode. The entries for the [PrioArr] are deleted in the commanded blocks when restarting the PX controller, with the exception of local, manual interventions to priority 8.

Determining plant operating mode

A superposed plant control generally has different sources such as plant switch, scheduler program or important fault messages, from which the resulting plant operating mode must be determined.

The ENSEL_MS (Enable Selector Multistate) and ENSEL_BO (Enable Selector Boolean) blocks are available for evaluating the resulting plant operating mode in the firmware library of Desigo. As a rule, the block is placed before plant control as illustrated in the following figure. All potential influences are interconnected, prioritized by importance on the block and the corresponding required plant operating mode is determined.


  • A fire detector as a high priority (P04) and requires the plant operating mode EmergOff.
  • The smoke extraction switch has the highest priority (P01) and demands plant operating mode smoke extraction.
  • The scheduler has a low priority (P11) and demands plant operating modes Stage 1, Stage 2 and Off.

The output [Val] for ENSEL_MS now supplies the CMD_CTL the resulting plant operating mode for additional processing. It is important that the multistate enumerations for both blocks ENSEL_MS and CMD_CTL are the same. The multistate values are not text, but rather numbers based.

Superposed command control CMD_CTL

The command control CMD_CTL block is used primarily for the sequence control in the ventilation plants. The block makes it possible to sequentially switch on and off the aggregates. As it is implemented in a very general and flexible way, other fields of application are also conceivable, e.g., for refrigeration plants.

The block CMD_CTL controls and monitors output and value blocks mapped on BACnet. Communications is based on BACnet referencing rather than interconnections to optimize the costs of engineering. The following blocks can be used with CMD_CTL: AO, BO, MO and AVAL, BVAL and MVAL.

The sequence is determined in the CMD_CTL in a table. The command for the individual aggregates and the components can be determined based on the plant operating mode.

The main functionality of the block CMD_CTL is the sequential control of aggregates and components dependent on the preset plant operating mode [ValPgm]. For this purpose the switch-on sequence is defined by the order in the function table [FnctTb]. The switch-off sequence is the reverse of the switch-on sequence. Independent switch-on and switch-off sequences are not implemented in this block.

Switched on block can be monitored for their states. There is no monitoring of the OFF status.

Prior to switching on a block a test is made to see if the conditions for running a command are given. The switch-on process is not even available for active switch on delay, minimum switch off times or a switch command with a higher command (e.g., a maintenance switch). This Look Ahead mechanism is described in greater detail in this chapter.

This block does not contain interlocks of individual functional units within aggregates. These are implemented locally via the data flow between the relevant blocks.

Plant Control Editor

The block parameters are set in the Plant Control Editor.

The upper part of the dialog box serves primarily to provide a quick online overview of the present plant operating mode. You can also define exception value which become active as a plant operating mode during a plant fault.

The upper part of the table configures the sequences. The switch-on sequence of the objects, the monitoring mode and the switch on and off types for the sequence controllers can be defined here.

The lower part of the table is used to define the plant operating modes. You can define what command at what priority is command per plant operating mode for each sequence element.

The following priorities for commanding are available:

  • Priority 2: Life safety, automatic
  • Priority 5: Plant safety, automatic
  • Priority 14: Specific command object
  • Priority 16: System control

You can enable a command priority with the value Not command for plant operating modes where the local control is intended to assume control of the aggregate.

[DefVal] applies when the [PrioArr] for the corresponding block is empty, that is, not active recognition set, at that time.

Function workflows in CMD_CTL

A series of safety, monitoring and switch actions are conducted for each change to the plant operating mode in block CMD_CTL.





Safety function

Check AllLifeSafety plant operating modes.



Checks if the aggregates in question can be switched.


Cancel sequence

Incomplete sequences are interrupted.


Reset sequence

Switch off unneeded aggregates.


Step-up sequence

Switch on the newly needed aggregates.


Monitor switch-on states

Start monitoring of countdown of delay period.

Step 1: Safety function AllLifeSafety

If all switch commands for a given plant operating mode have the priority Life safety, it is referred to as the AllLifeSafety plant operating mode.

A pending AllLifeSafety plant operating mode in the [ValPgm] is run immediately in all cases and maintained regardless of previously existing and newly occurring faults in the plant – human life takes precedence over plant safety.

If the AllLifeSafety mode includes switch-on commands, then the preset delay times (Delay and Timeout) will be observed. However, in the case of the Timeout setting, the switching sequence will continue even in the absence of any feedback signal. Interlocks cannot therefore be guaranteed, with the exception of local interlocks implemented via Priority 1 (life safety, manual).

Priority 1 (life safety, manual) cannot be overwritten in the AllLifeSafety.

Step 2: Preview Look Ahead

Before changing to a different plant operating mode, in which referenced blocks are to be enabled, block CMD_CTL checks to ensure that all the aggregates can actually be enabled. For this purpose, the entries in the priority array [PrioArr] for the switching sequence blocks are checked in advance. If switch commands of a higher priority are found to be active (e.g., a minimum switch-off time or the OFF-command of a repair switch), then CMD_CTL waits to implement the new plant operating mode until the full switching sequence can be implemented. Only referenced blocks, for which a switch-on command exists in the new plant operating mode, are checked, and only if the operating-state monitoring feature has been enabled.

The following priorities are checked:

  • Priority 1 [EnSfty/ValSfty], life safety, manual.
  • Priority 7 [EnSwi/ValSwi], manual operation, e.g., manual switch.
  • Priority 8 [EnOp/ValOp], manual operation, operating unit.
  • Priority 6 [TiMinOff], minimum switch off time.

Priority 6 is checked only for a switch on command to determine whether the aggregate is still within the minimum switch off time. In this case, it waits until the switch off time expires and only then switches on.

There is no Look Ahead for Desigo 7.

Priority 4 (plant safety, manual [EnCrit/ValCrit]) is not considered during the check, since local mutual locking via data flow interconnection, such as depicted in the figure Cross-aggregate interlocking of damper/fan, would change this value during the switch-on process.

The present operating mode remains until it is certain that all impacted aggregates with active operating state supervision can be switched to the new set state. A process alarm is triggered in CMD_CTL of a monitored block is not switched on. The exception value [EcptVal] is active as the new plant operating mode in this case. The online diagnostics for the Plant Control Editors determines which element is the cause of the fault.

Step 3: Cancel sequence

On-going switch sequences are cancelled when delay times are still active. Exception: An alarm is generated when a fault occurs as part of internal monitoring of the block. The demanded plant operating mode is determined in this cased by the exception value [EcptVal]. If the switch sequence is active, but not completed, it is NOT canceled, but rather is completed.

Step 4: Ramp-down sequence

The ramp-down sequence is started first for the new plant operating mode. This shuts down all aggregates that must be switched off per the new plant operating mode. The shut down takes place in the table sequence from right to left, in other words, the last aggregate in the switch sequence is the shut down first. The parameterized times for the time off delay are active during ramp down to off. The time off delay can be activated using a fixed delay time or a maximum timeout or deactivated using the immediate option. The length of the delay for timeout depends on the switch off state of the monitored sequence elements. Transition to the next sequence occurs as soon as it reports switched off, that is, the process value of the block [PrVal] = Off. It switches after the timeout time expires when the shut-down message is not sent.

If a sequence element with a life-safety or plant-safety priority is switched off, the preset delay times will be ignored.

Step 5: Step-up sequence

The step-up sequence is then started for the new plant operating mode. The remaining aggregates are switched on per the data in the function table. The switch on takes place in the table sequence from left to right, in other words, the first aggregate in the switch sequence is the switched on first.

The parameterized times for the time on delay is active during step-up.

The step-up delay can be activated using a fixed delay time or a maximum timeout or deactivated using the immediate option. The length of the delay for timeout depends on the switch on state of the monitored sequence elements. Transition to the next sequence occurs as soon as it reports switched on, that is, the process value of the block [PrVal] <> Off. It switches after the timeout time expires when the switch on message is not sent.

When a sequence element with a life-safety or plant-safety priority is switched on, the preset delay times will take effect first.

Step 6: Monitoring switch on state

A process alarm (off normal) is generated when the monitored aggregate is not switched on after the sequence delay time expires.

The current switch sequence is immediately canceled when the current plant operating mode is not AllLifeSafety and the exception value [EcptVal] is selected as the operating mode.

If, however, the exception value [EcptVal] is already the plant operating mode, the switch sequence is not canceled and the plant operating mode does not change.

Switch on aggregates

The following figure shows the switch response and monitoring mechanism for block CMD_CTL.

The system initially checks if the new plant operating mode is an AllLifeSafety mode. The Look Ahead check takes place in the second step, followed by the check and canceling of on-going sequences. The next step is to run the shut-down series, where objects 8 and 4 are switched off to the extent they have not yet be shut down. The sequences are then switched on one after the other in the follow-on switch on series.

The set time (delay or timeout) marks a switch on or off sequence that may consist of one or more objects. The times apply for the entire sequence and take effect, when a switch on or step up command or a switch off or ramp down command is demanded.

Switch on occurs in parallel per sequence. A check of the switch on state occurs only in the switch on type timeout. The next sequence is only started after either all monitored objects report a switched on state or the timeout period expires. Operating state monitoring of the objects for monitoring, as depicted in the following figure, only become active after the step-up process for a sequence is completed.

Operating status monitoring is optional and monitors only blocks in a Switched on state. If a referenced block is found to be switched off during active operating state monitoring, but that the block should have been in the state Switched on, a process alarm is generated and the plant operating mode changes to exception value [EcptVal].

The momentary alarm state is visible from the state flag [StaFlg].

Monitoring is active from the point when the corresponding sequence successfully completes the switch on process, that is, the process value for block [PrVal] is not equal to Off and the transient state is completed [TraSta] = No.

The [PrVal] of the block will be monitored. Hence, only those events which affect [PrVal] can be detected, that is:

  • Local fault shut down using interconnection of fault [Dstb] to enable safety, manual [EnSfty].
  • Local shut down of the block in a higher priority application program.
  • Switch-off by manual operation of the output module if the I/O module returns the manual setting value.
  • Block switched off via HMI operation or manual switch in control panel

Command control is only in a position to recognize fault-related deviations and act accordingly when the interconnection of all relevant faults [Dstb] occur locally on a monitored output of value block to [EnSfty]. Its default value [DefVal] becomes the process value [PrVal], if a referenced output or value block is out of service [OoServ]. The state monitoring of the plant cannot operate correctly, since [PrVal] no longer reflects the actual state of the aggregate.

To reduce the frequency with which aggregates are switched on and off, it is possible to define a minimum switch-off time [TiOffMin] in the aggregates. The look-ahead mechanism in the CMD_CTL block prevents the switching of the whole sequence if the minimum off-time in one aggregate with active state-monitoring has not yet expired. The output [TraSta] shows the transitional state and [PrVal] remains unchanged, at the last value. The new plant operating mode will be implemented only when all the aggregates to be enabled in the switching sequence can actually be enabled.

A minimum off-time should always be set for aggregates incorporating a rotating mass (e.g., fans).

Operating mode changeover

The following figure shows a changeover from operating mode Stage Y to Night cooling.

All objects were switched on in Stage Y. During the changeover to Night Cooling, the system initially checks whether the new plant operating mode is an AllLifeSafety mode. The Look Ahead check takes place in the second step; followed by the check and canceling of on-going sequences.

In the next step, the switch off series is conducted where the sequence elements of switch off sequence 1 are switched off in parallel. It transitions to the second sequence after the delay time expires. Object 5 is commanded to Off with plant safety, priority 5. For plant safety or life safety (priority 2), the delay times or timeouts have no effect. The transition to switch-off sequence is immediately since object 4 is already switched on.

Objects 3 and 2 are switched at the same time as object 5. Object 1 remains switched on.

Alarm management

Block CMD_CTL is alarmable and differentiates process from system alarms.

A process alarm occurs, when:

  • One of the monitored aggregates is not switched on.
  • One of the referenced aggregates cannot be switched on.

The exception value [EcptVal] becomes the present plant operating mode as a reaction to a process alarm. In addition, an alarm is sent.

A system alarm occurs for the following configuration efforts:

  • A referenced aggregate is not available.
  • A referenced aggregate is not a commandable object.
  • Impermissible priorities are used (priorities 2, 5, 14, 16 are allowed).
  • [ValPgm] or [EcptVal] are outside the permissible range.
  • The referenced aggregates have a different number of operating modes.

The command control attempts for a system alarm to enable all referenced blocks for local control. The four commandable priorities are commanded – in other words enabled to Not commanded: Life safety (2), plant safety (4), specific command control (14) and system control (16).

The response of the block to an alarm can be defined. The following mechanisms have been incorporated to prevent hunting in the plant.

  • Basic and standard: When the block goes into alarm, the exception value [EcptVal] is switched. When all the aggregates are ready for switching again, CMD_CTL automatically tries to implement the present plant operating mode [PrVal]. If all the aggregates are ready for direct switching immediately after implementation of the exception value [EcptVal], hunting is likely to occur. In this case, CMD_CTL prevents any further switch-on attempt, and the required plant operating mode [PrVal] must be changed.
  • Extended: When the block goes into alarm, the exception value [EcptVal] is switched. The alarm has to be reset by the user, and there is therefore no risk of hunting.

The block is not alarmable for Desigo 7.

Out of service

The block can be taken out of commissioning using [OoServ]. The following occurs when switching [OoServ] to On:

  • Immediate canceling of the switch on and off sequences and monitoring.
  • All objects are commanded with a release of the priorities: Life safety (2), plant safety (4), specific command control (14) and system control (16)

Superposed power control PWR_CTL

The power control function block PWR_CTL is used for control and monitoring of the performance of a number of energy producers (multiple boiler systems, refrigeration machines, etc.). As is the case for command control CMD_CTL, the data is exchanged bilaterally between power control and the individual energy producers (boiler, refrigeration aggregate, among others), via referencing. Since the energy producers are generally implemented in the form of logical aggregates, and contain local logic, the PWR_CTR block communicates only with MVAL blocks.

The control strategy is based on the use of tables and is designed for multi-stage energy producers. Additional energy-producer stages are connected or disconnected in accordance with the actual power demand. For modulating energy producers, a stepped output is converted into a proportional output within the aggregate. This makes it possible to handle the full power range (0…100%) in one stage, or to divide the power range into several stages (e.g., Stage 1: 0…20%; Stage 2: 20…40%; etc.).

Plant Control Editor

The block parameters are set using the Plant Control Editor.

The upper part of the dialog box serves primarily to provide a quick online overview of the block. The maximum power controlled by the block is set with the maximum power parameter [MaxPwr]. The value must be greater than 0 kW in order for the block to work. Any changes in this limit value have a direct effect in online mode. If no limit value is required, the maximum power must be set at an appropriately high value.

The Aggregates tab is used to set the control variables of the aggregates (boiler, refrigeration machine).

  • Enable: Activation/deactivation of an entry if they are not released, aggregates in the Profile table will be ignored.
  • Command object reference: Reference (relative addressing) to multistate value blocks [MVAL] of the relevant energy producer. During the configuration process, all MVAL blocks at the same and at lower hierarchical levels are displayed.
  • Aggregate description: The reference to the value object provides access to (and hence, knowledge of) all information in a special dialog box via the referenced object in the control command.
  • Switch-on delay: Delay time when switching from OFF to Stage 1.
  • Switch-off delay: Delay time when switching from Stage n to OFF.
  • Step-up delay: Delay time when switching from Stage n up to Stage n+1.
  • Step-down delay: Delay time when switching down from Stage n to Stage n–1.
  • Switch-on stage power: Power in [kW] at the lowest (that is, first) stage.
  • Next power stage: Additional power at the next stage(s) in [kW].

The control sequences for the aggregates (boiler, refrigeration machine) are defined under the Aggregates tab. Each profile describes the order in which the energy producers are to be switched and the maximum stage in each case. A total of 8 profiles each with 15 sequence entries can be defined.

The active profile table is defined by entering the profile number [PrfNr] as an input parameter, or by selecting it from the Profile dropdown list in the Plant Control Editor. This input parameter can be interconnected, so that the profile can be changed as a function of other events (faults, summer mode, boiler operating hours, etc.). If the profile is changed during operation, the power output [PrPwr] is switched in accordance with the power profile in the new profile table.

The profile definition determines the order in which individual aggregates are to be switched on or off. The following information must be entered for every sequence entry:

  • Object: Selected from the previously referenced aggregates.
  • Stage limitation: Limit up to which the aggregate may be enabled.
  • Control type: Specifies whether the enabled stages are to be switched permanently or released to the control system.
    • Fixed: The total power provided by a given switch stage is switched on or off permanently. This option can be used, e.g., for a specific base load which is required to be present at all times. The command is implemented with Priority 14.
    • Enable: The power actually required from the released switch stage is determined by local control of the aggregates. The command is implemented with Priority 16.

For each sequence step, the function block only ever releases the last aggregate marked Release to the control system. It displays this released object [RlsObj], with the released object stage [RlsObjSt], at the output. All other aggregates are fixed at the released stage value. If none of the aggregates is marked Release, the aggregate of the current sequence step is released to the control system.

On/Off switching of PWR_CTL

When PWR_CTL is switched on [ValPgm = On], the first step in the sequence of the current profile is performed immediately. In this case, the switch-on delay is not valid. If the trigger for default power is on [PwrTrg = On], the aggregate is switched directly to the default power level [DefPwr].

A switch-off command [ValPgm = Off], disables all the energy producers defined in the profile table with Priority 14.

Out of service

If the PWR_CTL function is taken out of service [OoServ = On], then all referenced aggregates are switched OFF with Priority 14, without taking account of delay times. The monitoring of the aggregates is disabled.

Demand signals

The current power demand is determined locally in the energy producers. In the event of a power deficit or surplus, the aggregate will send the appropriate demand signal to the PWR_CTL block. The demand signal from the aggregate can be generated, e.g., on the basis of the boiler setpoint deviation and the primary flow. The demand signals of the separate aggregates are combined and transmitted to the [StepUp] or [StepDn] input of the PWR_CTL block. After expiry of the relevant delay times, the block runs the appropriate sequence step to increase or reduce the power, as necessary.

When both [StepUp] and [StepDn] demand signals are present simultaneously, [StepDn] takes priority.

Direct switching of a load

In cases where the power is to be increased or decreased without observing the delay times, the default-power trigger input [PwrTrg] can be used to switch to a defined default power level [DefPwr]. From the current profile, and taking account of the current power output, the PWR_CTL block determines the sequence steps required to cover the power demand and implements them directly.

Power display

The block has two outputs at which it displays the current total power of the energy producers. This consists firstly of the controlled power output [CtldPwr]. This output represents the total power switched by the PWR_CTL block.

The other output, the present power output [PrPwr], shows the additional power output of energy producers that are not directly switched by PWR_CTL. To do this, PWR_CTL evaluates the priority array [PrioArr] of the MVAL blocks. In this way it can detect, e.g., that an energy producer has been switched manually [Prio8] to a given stage.

Configuration error

The entries in the two configuration tables are checked cyclically for validity.

  • A fault alarm is generated under the following circumstances:
  • Aggregates no longer accessible from PWR_CTL, owing, e.g., to retrospective modifications to the technical hierarchy, affecting the references of the energy producers
  • Retrospective changes to the stage-limit value in the aggregate, making the value configured in the profile table too high
  • No multistate value object
  • Reference block no longer available: e.g., deleted with delta download
  • Several references to the same block
  • Empty profile table

In the event of a fault alarm, all aggregates still accessible by PWR_CTL are switched OFF permanently.

Alarm management

The PWR_CTL block in the system is an alarm-generating block with a configurable alarm class [AlmCl] and alarm function [AlmFnct].

An Offnormal process alarm is generated:

  • When the step-up demand signal [StepUp] persists for longer than the monitoring time deviation [TiMonDev], and there are no further sequence steps to increase the power.
  • When the step-up demand signal [StepUp] persists for longer than the monitoring time deviation [TiMonDev] plus the step-up delay time of the next sequence step, AND a step-up would cause the maximum power limit [MaxPwr] to be exceeded.

The process alarm is reset to normal:

  • When a sequence step with an increase in power becomes possible again. Another sequence step with an increase in power becomes possible when the [MaxPwr] limit will no longer be exceeded, or when a further sequence step with a power increase is present.
  • When there is no further [StepUp] demand signal

The text of process alarms can be defined to suit customer requirements.

Switching alternatives

Various switching alternatives can be defined by entries in the profile table. Note that where one or more step-up sequence steps (intended to increase the power) would, in practice, result in a drop in the power output, all steps in the step-up sequence are enabled automatically until a sequence entry is reached, at which the power output actually does increase as required. See also the following example.

The power data in the object table and the sequence entries in the profile table in Figure Example of aggregate table together give the power profile illustrated in Figure Example of profile entries with a drop in power (Profile 2).

Profile 1

In the main application of the PWR_CTL function, a new energy producer is added for each sequence entry in the profile table. For this purpose, an aggregate only needs to be entered in the sequence table once.

In the event of a power demand, which the boiler transmits to the PWR_CTL function in the form of the [StepUp] demand signal, a further boiler stage / sequence step is enabled when the step-up delay has expired. When a boiler reaches the stage limit, the function switches to the next boiler or boiler stage after expiry of the switch-on delay. The last-enabled boiler stage is released to local power control, while all other boilers are fixed at their current power output.

If the power needs to be reduced, this is transmitted to the PWR_CTL function via the [StepDn] demand signal. The sequence steps are then run in reverse order, with the defined switch-off and step-down delay times.

Profile 2

Profile 2 shows that the order in which boiler stages are to be enabled has been changed, and that sequences which will cause a drop in the power output have been defined in the power profile. In the example illustrated, Boiler 3, which is currently delivering 200 kW, is switched OFF via sequence entry 2. Boiler 1, which could achieve a power output of 150 kW with its enabled stages, is defined as the next object in the sequence. This results in a drop in the power output, causing the function block to enable all sequence steps automatically until an actual increase in power is achieved.

In sequence entry 4, Boiler 2 is enabled up to stage 2, giving a further 150 kW output. Boilers 1 and 2 are thus enabled simultaneously up to stage 2, to prevent a drop in power. The effective delay time for the simultaneous switching process is determined the maximum delay time of the boilers concerned. Since it is Boiler 1 which has the longest delay (15 minutes), the simultaneous switching operation will be delayed for this period of time.

Sequence entry 5 would again result in a drop in performance, because stage 2 of Boiler 2 is no longer enabled. The block therefore switches straight to sequence entry 6, enabling Boiler 3 to compensate for the power deficit. In this case the effective switch-on time is based on the switch-on delay for Boiler 3 (10 minutes).

Online diagnostics

A diagnostics screen for the PWR_CTL block is available online in Xworks Plus (XWP).