Control Module
A control module (CM) is the lowest level of the ISA-88.01 physical model — the smallest grouping of sensors, actuators and other control modules that performs a basic control function. A valve with its actuator and feedback, a temperature loop with sensor and trim, a motor with run/stop and overload — each is a control module.
Read the full summary
CMs are the atomic vocabulary of process control, and the way they are encapsulated decides whether engineering can iterate fast or whether every change ripples chaotically across the plant.
On this page · 7 sections
How does Control Module apply to your shop floor?
Pick your industry and scale — Ask V5 rewrites the definition in your context, gives a worked example, and shows what V5 does on day one.
01What a control module is
ISA-88 defines the control module as "the lowest level grouping of equipment in the physical model that can carry out basic control". In practice, a CM is one of:
- Discrete valve — solenoid + actuator + open/closed feedback.
- Modulating valve — positioner + valve + position feedback.
- Pump — motor + run/stop + overload + amp feedback.
- Loop — PID controller with sensor, output, and tuning parameters.
- Indicator — sensor with scaling and alarm thresholds.
- Composite — small grouping (e.g. a vessel-fill CM that pairs a level sensor with a fill valve).
A CM is the smallest thing that can be commanded — Open / Close, Start / Stop, Setpoint = X — and that reports back a state and feedback.
02Encapsulation
The CM's value is encapsulation: nothing outside the CM writes to its internal tags. A valve CM exposes Open and Close commands plus Open and Closed feedback bits; the internal solenoid energise and feedback wiring are hidden. Consequences:
- Replacing the valve with a different vendor's model changes the internal CM logic, not the upstream callers.
- Adding an interlock ("do not open if downstream is closed") happens inside the CM, not scattered through phase code.
- Maintenance can substitute spare devices without rewriting upstream logic.
- Diagnostics live with the CM — "valve failed to open" is a CM-level fault, surfaced upward.
03Command / state model
A clean CM exposes a small command set and a clean state model. Example for a discrete valve:
| Element | Type | Values |
|---|---|---|
| Command | Input | Open / Close / Halt |
| Mode | Input | Auto / Manual / Maintenance |
| State | Output | Opening / Open / Closing / Closed / Faulted |
| Fault | Output | Feedback mismatch / Interlock / Communication |
| Inhibit | Output | Interlocked / Override / OK |
Mode arbitration determines who can issue commands. In Auto, the parent EM drives; in Manual, an operator with the right role; in Maintenance, only maintenance personnel.
04Interlocks at CM level
Many safety and process interlocks belong at the CM level — close to the device, hard to bypass from above. A CIP supply valve's interlock "do not open if process valve is open" lives inside the CM; phase code cannot accidentally violate it.
- Process interlocks — implemented in the CM, can be bypassed only with role + audit trail.
- Safety interlocks — implemented in a separate safety PLC (per IEC 61511); the CM observes the safety status as an input.
- Override management — manual overrides are time-bounded, role-gated, alarmed and audit-trailed.
- Permissive logic — "start command is rejected unless prerequisites are met" — typically lives in the CM or the parent EM, never in higher-level phase code.
05Data flow to historian
CMs are the primary source of process data. Tag values (commands, feedbacks, faults, modes) flow:
- PLC scan — CM updates its tags every scan (typically 10–100 ms).
- OPC-UA / OPC-DA — historian collector pulls or subscribes to tags.
- Historian — stores time-series with compression.
- MES — pulls aggregated values into the batch record at phase boundaries (start, exit, IPC sample) and important deviations live.
The BMR records summary values (peak temperature, average rpm, end-of-phase value) plus any deviations; the historian carries the full waveform. Together they satisfy ALCOA+ and Annex 11 expectations.
06Common mistakes
- Phase code writes directly to PLC tags — breaks CM encapsulation, makes refactoring impossible.
- CMs without mode arbitration — operator switches to manual during an Auto phase and silently corrupts the batch.
- Faults reported only as a generic "fault" bit — diagnostic narrative impossible.
- Interlocks duplicated in phase code AND CM — inconsistent behaviour at edge cases.
- Safety interlocks in CM instead of safety PLC — SIL rating cannot be claimed.
- Overrides without expiry — temporary fix becomes permanent invisible state.
- CM tag naming inconsistent — historian collection coverage is patchy.
- Manual mode does not pause the batch — operator actions go unrecorded.
07How V5 Ultimate handles control modules
Frequently asked questions
Q.Does the MES ever talk directly to control modules?+
Not directly. The MES talks to equipment modules (or units), which talk to control modules. Direct MES-to-CM writes break encapsulation and create version-coupling between MES code and PLC code that becomes unmaintainable.
Q.Where do PID loops fit in?+
A PID loop is typically a CM — a composite that contains a sensor, a setpoint, a controller and an output. The loop's tuning parameters live with the CM; phase code reads and writes the setpoint through the CM interface, never the raw output.
Q.Are control modules versioned?+
Yes — through the control-system's change-control process (the same one that governs the PLC programme). Each CM revision triggers an impact assessment on every EM and phase class that uses it.
Q.How do alarms relate to control modules?+
Alarm definitions usually live with the CM (the loop knows its own deviation alarm; the valve knows its feedback-mismatch alarm). Higher-level alarms (batch-level, plant-level) compose CM alarms. Alarm management per ISA-18.2 is built on the CM as the source.
Q.Can a CM be entirely software?+
Yes — a soft CM (e.g. a calculated value with its own state model, fault detection and override management) is fully valid under ISA-88. Common examples: derived flow totals, calculated efficiency, model-predictive control outputs. The same encapsulation rules apply.
Primary sources
Further reading
Want to see how Control Module could fit into your own records and workflows? Explore the related V5 pages or talk to our team about what applies to your operation.