The seat is empty. Somebody is still working the machine.
When nobody has to be in the field, the person has not gone anywhere. They have moved off the machine. This page is the station they work from, what is allowed to travel between that station and the machine, and what can never travel on that link at all.
The second and third of three states.
The Site Foreman keeps three things apart, and the order matters. Preparation is the Foreman’s own work, and it ends at ready to ask. Authority is held by a person, for one machine and one piece of work, for a stated time. Control is the machine itself.
The Foreman is the first of those and stops there. It never touches the machine, it holds no session with Eddie, and it cannot start anything. This page is the second and the third: where a person holds that authority, what they can see from where they are, and what the link between them is permitted to carry.
Today, the person watching is the person working it.
Every Steady Eddie works at Remote, and remote operation is manual operation with the person somewhere else. An operator holds one machine from a station off it, for the length of the job, and the work is in their hands the whole time they have it.
So there is no second screen watching over an unattended machine, because there is no unattended machine. The station the work is done from is the station the work is seen from, and the person sitting at it is an operator rather than an observer.
A console that watches without working is what a machine running on its own would need, and the rungs that let a machine run on its own open one machine and one site at a time, when the validation for them exists. The console is designed. It is not built, because the machines that would need it are not built.
What crosses it, and what never does.
One link joins the station to the machine. What may travel on it was settled in the design, and it is not a setting anybody changes on a site.
| What travels | Does it cross | Why |
|---|---|---|
| A view of the work | Crosses | A view is not a command. |
| An operator’s command | Crosses | It lands inside an envelope the machine already holds, and it cannot widen it. |
| The signal that says the station is there | Crosses | Its absence is the event, not its content. Absence for longer than the machine allows stops the machine. |
| Health and telemetry | Crosses | Read only, and it grants nothing. |
| A record, for export | On request | Signed, and checkable away from the machine. |
| A software update | Staged only | Staged and verified, never applied from the link. |
| A safety veto | Never | The safety side is wired and local to the machine. No veto travels on a network. |
| A grant of motion authority | Never | Nothing arriving on this link can give a machine permission to move. |
| A change to the rules | Never unsigned | An unsigned change is refused, and a stale one expires. |
| A change to the record | Never unlogged | An unlogged change breaks the record, not only the setting. |
The last four rows are the reason this page exists. A control link is one the machine’s safety rests on. This one carries no veto and can grant no motion, so it is a supervisory link, and the machine is safe without it.
Losing it never starts the machine and never stops it.
The machine is left as it was, and it says so. The one exception is the signal that says the station is still there: if that stops arriving for longer than the machine allows, the machine comes to a stop without being told to. Getting the link back is not by itself permission to carry on. Somebody has to say so.
Nothing on a site should rest on a radio for its safety, and nothing here does.
It has an end on it before it begins.
A person holds authority for one machine and one piece of work, for a stated time, and it is signed. It can be taken back. Withdrawal or expiry brings the machine to a safe stop at its next safe point and then to its minimum risk condition.
Never an instant stop sent over the air. The wired stop set at the machine is what stops a machine, and it is local to it.
How many machines one person can hold.
The Site Foreman will hold twelve units on one job on one site. That is a ceiling on a job, and it says nothing about a person.
We have not done the human factors work that would let anybody say how many machines one person can watch at once. How often a notice arrives, how long each one takes to deal with, what a tired supervisor at the end of a shift misses: those are open, and we have not closed them. Until somebody has, we will not put a number on it.
Our own software says so to its own users. From the second unit onward the Foreman carries a notice that cannot be dismissed: it holds them, and it does not assert that one person can supervise them. Authority is granted one machine and one piece of work at a time, by a person, so twelve prepared units is twelve separate permissions to ask for, hold and release.
A supplier who hands you that number without the work behind it has invented it, and you should ask to see the work.
It should feel like the machine.
Familiar control geometry, feedback that does not flatter, and no invented vocabulary where the trade already has words. A competent operator should become a competent Steady Eddie supervisor in a shift. If the station took a week of training, we would have removed one scarce job and created a scarcer one.
It is a better day at work before it is anything else. The first jobs anybody wants this for are the ones nobody wants to sit in: dust, heat, cold, fumes, unstable ground, the night shift. Moving to the safe side of the fence is a step up in the work rather than a step out of it.
It is designed with no inbound path from the internet to a machine that moves several tonnes of steel, and with your site’s data staying on your site. A machine that cannot reach the outside world cannot be reached from it.
Where this stands.
The first thing you are told, because everything after it depends on it.
What this page describes is designed, specified and written down, and that design is what we will put in front of your engineers and your safety people. One unit is built and cycling on our own machines, and we will demonstrate the three ways to take control away by hand for you at our own Test Facility in Alberta. The rules above about what may and may not cross the link are settled in the design. The station itself, and the separate console that would watch a machine working on its own, are designed and are not built. No assessment against ISO 13849 or ISO 17757, the standards we design against, has been performed. We would rather you read that here than find it out for yourself later.