Shut down a CODESYS PLC from an HMI button

What you need

• Access to the CODESYS project, so you can add the timer and the command call and download the changed program.
• File access to the controller, the same path you used when you set the runtime up, because the permission lives in CODESYSControl.cfg on the board. If an edit to that file ever leaves the runtime refusing to start, the recovery steps are in Fix a CODESYSControl.cfg edit that locked you out.
• The SysProcess library, which comes with the CODESYS installation and carries the command execution block.
• One boolean request bit, an on-delay timer, and an HMI screen the operator can reach.

Give the runtime permission to run commands

1. Stop the runtime.
2. Open CODESYSControl.cfg, the runtime's configuration file on the controller.
3. Add the entry SysProcess-Command=1. That entry switches command execution on for the SysProcess library; without it set, the runtime refuses command execution.
4. Start the runtime again and confirm the project comes up normally.

A typo in this file can keep the runtime from starting at all; if that happens, work from Fix a CODESYSControl.cfg edit that locked you out to get back in.

Build the button, the warning and the cancel path

1. Put a push button on the HMI screen that writes a boolean request bit in the PLC program, FALSE until pressed. The wiring is the same one described in Make an HMI button turn on a PLC output through a command bit, with shutdown as the target action.
2. Run that bit into an on-delay timer preset to 10 seconds, entered as T#10S in the IEC 61131-3 time literal format. That preset is the length of the warning window used everywhere below.
3. While the timer runs, show a warning line on the screen with the seconds left, and put a Cancel button next to it that clears the request bit. The bit reaches the task at the next scan; how that timing changes behavior is covered in HMI button writes vs the PLC input scan: what changes.
4. Leave the program running normally through the window so its writes keep landing. That is the point of the warning: buffered writes finish while the operator still holds a cancel.

Call the shutdown command when the window closes

1. When the timer's done output rises, call the SysProcess.ExecuteCommandLine block from the SysProcess library once, on that edge, so the command runs a single time.
2. Pass it the command string sudo shutdown -h now. The operating system flushes its pending writes and powers the board off.
3. If you have done file work through this block before, you have met its one-shot shell: each call starts fresh, which is why cd does not persist between calls, as described in Fix cd that does not persist in SysProcess calls.
4. Check that sudo lets the runtime user run shutdown without a password prompt. If sudo asks for a password, the command call fails and the board keeps running; that allowance is set in the board's sudo configuration.
5. On a Windows CODESYS target, the same block calls the Windows shutdown command with that system's own flags.

The command ends the PLC program. Use the button only when the process is already in a safe stopped state, or confirm the power-loss behavior parks it; the button is a clean shutdown, not a stop control.

Check it worked

1. Press the button: the warning appears with the seconds left and the program keeps running.
2. Press Cancel while the warning is still up: the warning clears and nothing shuts down.
3. Press again and leave it: the board powers off when the window closes.
4. Power the board back on: the project starts, and the retain values written before the shutdown are back. A clean shutdown is the save path those values need; what breaks when the power goes early is covered in Why CODESYS retain variables fail to save on shutdown.

Example: a packing-table PLC shut down behind the warning window

Inputs, with their sources:

• Warning window: 10 seconds, set once by the timer preset T#10S in the steps above and reused as the window length throughout.
• Command string: sudo shutdown -h now (from the steps above); now orders the halt with no wait beyond the call.
• Scheduled variant: sudo shutdown -h +1; the shutdown command reads its delay in minutes after the plus sign, so +1 means 60 seconds.
• The controller: a small Linux board running the CODESYS runtime, the setup the steps above were written for.

The rule in words: time from button press to power off equals the warning window plus the delay written into the command string.

The arithmetic:

• Press at t = 0 s.
• The timer closes the warning window at t = 10 s.
• With now: 10 s + 0 s = 10 s from press to power off.
• With +1: 10 s + 60 s = 70 s from press to power off.

Result: 10 seconds with now, 70 seconds with +1, measured from the same button press.

The decision: keep now behind the warning window when every write your program makes finishes inside it; time the write-back once in your project to confirm it fits. If a write can still be running when the window closes, switch the command string to +1 and take the 70 second path; the operator still sees the warning the moment the button is pressed.

Recommendation: On any CODESYS target an operator can reach, put the warning window with its Cancel button ahead of the command call and run sudo shutdown -h now behind it. Move the delay into the command string as +1 only when a write-back in your program can outlast the window.

Questions