Supervisory control
The authority model, how confirmation works, and exactly what the audit trail records for every command.
What can be commanded
Against authorized field devices:
- setpoint writes
- equipment start and stop
- remote shutdown
The authority model
Two rules do most of the work here.
Visibility and control are separate grants. A user who can see a well cannot necessarily command it. The two permissions are administered independently, so an operator can give a contractor visibility across a whole field and command rights on nothing.
Control is scoped per device group, not per user globally. Authority is granted on a defined set of equipment. There is no “can control things” permission — only “can control these things”.
Both are bounded by company grant, the same as visibility. See security.
Confirmation
No command is a single click. Every one requires an explicit confirmation step that states what is about to change, showing both the prior value and the commanded value before you commit.
The device’s own acknowledgment is captured, so a command that was sent but not accepted is visible as such rather than assumed to have worked.
The audit trail
Every control action writes an append-only entry recording:
| Field | Example |
|---|---|
| Device | JR14.PMP.SETPOINT |
| Action | setpoint write |
| Prior value | 38.0 SPM |
| Commanded value | 42.5 SPM |
| Device acknowledgment | accepted 09:14:02 |
| Author | the account, and the grant it acted under |
| Origin | where the command was sent from |
| Time | when it was sent |
Entries cannot be edited or removed after the fact.
A failed command produces the same entry, including the device response. Being able to distinguish sent and acknowledged from sent and not acknowledged matters when reconstructing an incident.
Commissioning control safely
Control is not enabled by connecting a device. A sensible sequence:
- Bring telemetry from the equipment in and verify it against the device display.
- Confirm the units and scaling are right — a control write in the wrong scaling is worse than a reading in the wrong scaling.
- Grant control authority on a small, defined device group.
- Expand once the audit trail shows what you expect.
Telemetry can run indefinitely with control disabled everywhere, and many operators run that way for a long time before enabling anything.