Sun Tech WCS decides where load units go and asks a driver to move them. It is plant control software, not safety software: this page sums up what that means, and how it is put into operation. The binding text is SAFETY.md, in the repository.

It is not a functional-safety system

It is not a safety-related control system in the sense of the functional-safety standards, such as IEC 61508, IEC 62061 or ISO 13849, and must not be used as one: it provides no safety function.
It does not replace safety PLCs, emergency stops, guards, light curtains or safety interlocks.
Machine safety must be independent of the WCS: people must be protected with the WCS stopped, crashed, disconnected, misconfigured or sending wrong commands, with the network down, with the driver faulty and with the WMS sending wrong data.
Stopping the engine prevents the WCS from sending new commands and closes the driver connections, but it is not an emergency stop.

Every plant needs its own assessment

Every installation needs a risk assessment of its machines, carried out by whoever is responsible for them under the rules that apply where the plant is (in the European Union, for example, the Machinery Directive or Regulation), and commissioning with the driver tested on the actual machines. Simulation does not replace factory and site acceptance tests. Manual commands need written procedures. Anyone who installs the WCS on a plant with real machines is responsible for the safety of that plant, as with any other control software.

Connections that do not lie

A device that should be connected and has no connection goes offline, and starting the engine is refused: the WCS does not have it served silently by the simulator. In production the host refuses to start if the simulator is enabled in place of missing connections.

Network and keys

The WCS goes on a segregated plant network and must never be exposed to the Internet: an API key alone is not enough to protect it.
It has a full key and an optional read-only key. It refuses to start with the placeholder keys, and to speak plain HTTP beyond the local machine unless that is explicitly allowed.
It ships no TLS certificates: they are configured at installation. The threat model is in Security and threat model.

Operations

It runs as a Windows service and writes warnings and errors to the event log.
It keeps its data in SQLite, with no database server; a tool does backup, verification and restore, even with the engine running.
It has three monitoring scripts with exit codes suited to monitoring systems, and a monthly history of operations and moved units.
It publishes no hardware requirements: sizing comes from a capacity test on your own plant.

Declared limitations

One host per plant, with no clustering or failover. No per-operator identity and no roles, beyond the two keys. The operators' log is not tamper-proof and the database files are not encrypted. Rotating the keys needs a restart, and part of the messages and logs is in Italian. The full list is in the known limitations, and before going to production there is a checklist.

Warranty

The WCS is distributed under the Apache License 2.0, "as is", without warranties. Sun Tech offers its own driver, integration and commissioning on request.

Evaluating the WCS for a real plant? Let us talk about machines, network and commissioning before you choose. Talk to an engineer

Safety and operations