Engineering Compiler · Part of the IQ Platform

Your FDS lives in Word.
Your tags should live
in a relational model.

FDSIQ replaces Microsoft Word as the authoring tool for industrial automation Functional Design Specifications. Engineers fill a structured wizard. FDSIQ validates the data, exports a client-ready .docx and compiles directly into ScaffIQ, ScaffIQ Sequence Engine and ScaffIQ Perspective Engine. The document is a by-product of the data.

Get Started → Explore a Real Project → See How It Works
Food & Beverage
Water & Wastewater
ISA-88 · IEC 61511
FDSIQ · Dairy CIP System · Fonterra
Step 3 of 10
I/O & Tag Register: enforced naming convention
Convention
[FunctionCode]_[Area]_[Number]  ·  e.g. XV_CIP_001
Tag ID
Type
Description
Area
I/O
XV_CIP_001
XV
CIP Supply Valve
CIP
DO
PU_CIP_001
PU
Circulation Pump
CIP
DO
TT_CIP_001
TT
Supply Temperature
CIP
AI
LT_TK_301
LT
Lye Tank Level
CIP
AI
AT
Conductivity Analyser
CIP
AI
✓ AT_CIP_001: naming convention passed · no duplicate detected
4 tags defined · 0 convention errors
Live validation on keystroke
The current process

Word documents drift and tags end up defined three times over.

The FDS has been written in Microsoft Word for 30 years. The problem is not the format. The problem is that Word has no data model. Tags defined on page 12 are free text. By page 47 they have drifted. By the time the PLC programmer opens the document, the spec and the I/O list no longer agree.

Tags live in three places simultaneously
The I/O list is in Excel. The sequence references tags in Word. The interlock matrix is a third tab. None of them enforce consistency. Rename XV_101 and you have three manual updates, if you remember all three.
Revision B overwrites the record of Revision A
Save-as and track changes are not an audit trail. When a client disputes what was agreed in Rev A, there is no immutable record. The document is whatever it is today.
40-60 billable hours per project, lost to formatting
Cross-referencing the I/O list, reformatting tables, updating the revision register and aligning the sequence description with the interlock matrix. All of this is engineering time billed to the client for work that produces no design value.
AI document generators make it worse
Generating plausible-sounding FDS prose with an LLM produces unvalidated text with no data integrity. The engineer still has to check every line. The AI has not reduced the problem. It has moved it.
The safety section has no formal boundary
SIF functions and E-stop categories sit in the same Word document as the sequence logic. There is no structural separation. Any AI tool that reads the document reads the safety section too.
The spec does not compile
The PLC programmer reads the Word document and manually re-enters every tag, every sequence step and every interlock into Studio 5000 or TIA Portal. The FDS and the PLC program are parallel artefacts with no shared source of truth.
How FDSIQ works

The document is just a by-product of a relational data model.

Engineers fill a structured 10-step wizard. Tags are defined once, in Step 3. Every subsequent step references them by dropdown only. There is no free-text tag entry anywhere downstream. The exported .docx and the JSON compile target are both generated from the same locked data model.

3
I/O & Tag Register: defined once, enforced everywhere
Every instrument and actuator is defined here with a tag ID, device type, engineering units, range, alarm setpoints and area code. The naming convention is validated on every keystroke. From this point, no step in the wizard accepts a free-text tag reference. Dropdowns only, populated from this register.
4-6
Equipment Modules, Sequences and Interlocks: all relational
Equipment modules group tags from Step 3. Sequences reference equipment modules. Interlocks reference cause tags and effect tags, all from the same register. Rename a tag in Step 3 and it is renamed everywhere. Delete a tag and the broken reference is flagged immediately.
7
Safety section: structurally isolated from AI
SIF functions and E-stop categories are authored here by the engineer. The safety_functions node is stripped at the database role level before every AI call. It is not filtered in application code. It is architecturally inaccessible. The AI validation engine never reads or writes this section.
9
AI validation: checker, not author
The AI reads the sanitised JSON schema and returns a structured issue list: broken tag references, logic gaps, physically impossible timing, missing interlock definitions and S88 hierarchy violations. It flags. The engineer fixes. Every call is stateless, logged and cannot auto-correct any field.
10
Export: compilation, not formatting
Locking a revision writes an immutable snapshot to object storage (WORM). The .docx is rendered from the locked JSON. The JSON data package feeds ScaffIQ, ScaffIQ Sequence Engine and ScaffIQ Perspective Engine directly. No drift between document and compile target is architecturally possible.
The IQ Platform Pipeline
FDSIQ
Structured 10-step wizard
Relational data model
AI validation engine
.docx + .json on lock
.docx
Client deliverable
Corporate template
.json
Compile target
Single source of truth
JSON feeds downstream
SCAFFIQ
I/O framework · tag declarations
Compiled from JSON schema
→
SCAFFIQ
Sequence Engine
PLC sequence code
Compiled from JSON schema
→
SCAFFIQ
Perspective Engine
Ignition Perspective symbol templates
Compiled from JSON schema
Full Product Walkthrough

Seven screens compile into one data model, with nothing left to drift.

A curated tour through the wizard, from project setup to a locked, client-ready export, using the same Fonterra Dairy CIP example throughout.

FDSIQ Wizard Walkthrough
7 screens · Project Setup to Export & Lock
FDSIQ · Dairy Plant CIP System Upgrade · Fonterra
Step 1 of 10
Project name
Dairy Plant CIP System Upgrade
Client
Fonterra Co-operative Group
Site
Darnum Processing Plant, VIC
Industry vertical (locked)
Food & Beverage
ISA-88 mode (locked)
Strict: Procedure › Unit Procedure › Operation › Phase
Locked once created. Tag and sequence data can't convert between the two shapes after the fact.
PLC platform
Rockwell ControlLogix 5580
SCADA / HMI
FactoryTalk View SE v14.0
System Overview: Process Description
Process description
The Darnum Processing Plant CIP system provide automated cleaning cycles for three dairy processing vessels: a 20,000 L cream separator, a 15,000 L pasteuriser and a 10,000 L buffer tank. The system operates in Strict ISA-88 mode with four defined sequences: Pre-Rinse, Caustic Wash, Intermediate Rinse and Post-Rinse.
⟳ Check grammar real Anthropic call, not a canned response
GRAMMARSubject/verb agreement
provide → provides
APPLIED
Domain terms (CIP, ISA-88, PLC) are recognised and left alone. Only genuine grammar and clarity issues are flagged.
I/O & Tag Register: defined once, dropdown-only downstream
Tag ID
Type
Description
Area
I/O
XV_CIP_001
XV
CIP Supply Valve
CIP
DO
PU_CIP_001
PU
Circulation Pump
CIP
DO
TT_CIP_001
TT
Supply Temperature
CIP
AI
LT_TK_301
LT
Lye Tank Level
CIP
AI
AT_CIP_001
AT
Conductivity Analyser
CIP
AI
5tags defined · 0 convention errors
No free-text tag entry anywhere downstream
Sequence Definition: Strict S88
All Procedures › CIP Procedure
UNIT PROCEDUREPre-Rinse3 Operations →
UNIT PROCEDURECaustic Wash5 Operations →
UNIT PROCEDUREIntermediate Rinse2 Operations →
UNIT PROCEDUREPost-Rinse3 Operations →
+ Add Unit Procedure
✓
All validation issues resolved, ready to export
AI Validation Engine · safety section excluded · 4 issues found, 3 resolved, 1 overridden with written justification
ERRORERR-001· Step 5 / PH_TEMPSOAKOVERRIDDEN
Hold duration has no timeout interlock. Override logged: operator-managed timeout per site procedure, confirmed with Fonterra engineering.
WARNINGWRN-001· Step 3 / AT_CIP_001RESOLVED
Conductivity HH threshold not set. Resolved: HH set to 8.0 mS/cm per process design.
WARNINGWRN-002· Step 4 / EM_CIP_001RESOLVED
PU_CIP_001 has no maintenance mode interlock. Resolved: interlock IL_005 added to matrix.
INFOINF-001· Step 5 / UP_LYEWASHACKNOWLEDGED
No Drain operation after Lye Wash. Acknowledged: handled in UP_RINSE downstream unit procedure.
Page preview
Rev B · Issued for Review
Watermarked .docx. No JSON package. No additional charge on this revision. The project's one-time licence fee activated back at Rev A; every revision since is included.
⬇ Download this sample (.docx)
FONTERRA CO-OPERATIVE GROUP
FC-2026-0041 · Rev B · ISSUED FOR REVIEW ONLY · 2026-04-02
FUNCTIONAL DESIGN SPECIFICATION
Dairy Plant CIP System Upgrade
Clean-in-Place Automation · Darnum Processing Plant
ClientFonterra Co-operative Group
SiteDarnum Processing Plant, VIC
Project No.FC-2026-0041
PLCRockwell ControlLogix 5580
SCADAFactoryTalk View SE v14.0
S88 ModeStrict
ISSUED FOR REVIEW ONLY: NOT APPROVED FOR CONSTRUCTION
Rev B · 2026-04-02 · J. Smith
Applicable Standards: ISA-88.01-2010 · FSANZ Food Safety Standards · SQF Code Edition 9 · HACCP Plan Rev 4
1. Revision History
RevDateAuthorStatusDescription
A2026-03-15J. SmithIFRInitial issue for client comment. Full system documented Rev A baseline.
B2026-04-02J. SmithIFRIncorporated client comments. Revised CIP lye wash sequence, added drain phase and updated interlock IL_003.
Auto-generated by FDSIQ from the immutable revision_history table. This register is a contractual record and must not be edited manually.
2. Project and System Overview
2.1 Process Description

The Darnum Processing Plant CIP (Clean-in-Place) system provides automated cleaning cycles for three dairy processing vessels: a 20,000 L cream separator, a 15,000 L pasteuriser and a 10,000 L buffer tank. The system operates in Strict ISA-88 mode with four defined sequences: Pre-Rinse, Caustic Wash, Intermediate Rinse and Post-Rinse. All chemical dosing is interlocked against vessel isolation confirmation and flow verification to prevent cross-contamination.

2.2 Area Definitions
CIPCIP Utility Room
L1Line 1 Pasteuriser
3. I/O and Tag Register
Auto-generated from the relational tag register. Free-text tag entry is not permitted.
Tag IDTypeDescriptionI/OUnitAlarm Hi
XV_CIP_001XVCIP Supply ValveDON/AN/A
PU_CIP_001PUCirculation PumpDON/AN/A
TT_CIP_001TTSupply TemperatureAI°C95 HH
LT_TK_301LTLye Tank LevelAI%95 HH
AT_CIP_001ATConductivity AnalyserAImS/cm8.0 H
Produced using FDSIQ. The Lead Engineer remains solely responsible for technical accuracy, safety and fitness for purpose.
Page 1
ISSUED FOR REVIEW ONLY
NOT APPROVED FOR CONSTRUCTION
Locking Rev C: Issued for Approval… 0%
Assembling full JSON schema from relational tables
Confirming safety_functions node stripped, AI exclusion verified
Writing immutable snapshot to object storage (WORM)
Rendering .docx from locked snapshot + Fonterra template
Confirming project licence: active since Rev A, no additional charge
Creating Rev D draft: all relational data copied forward
AI Validation Engine

AI checks the data but the engineer always decides.

FDSIQ is not an AI document generator. The AI reads the sanitised data schema and returns a structured issue list. It cannot write, author, suggest or auto-correct any field. Every call is stateless, independently logged and safety-excluded by architecture.

Excluded
Safety Section: AI Excluded by Architecture
The safety_functions node is stripped at the database role level before every AI call. The AI validation service has no SELECT privilege on the safety_functions table. It is not filtered in application code. It is architecturally inaccessible. SIF functions, E-stop categories and cause-effect safety entries are human-authored and human-reviewed only.
Scope
What the AI checks
Broken tag references · Logic gaps between sequence steps · Physically impossible timing (e.g. 50ms for a pneumatic valve) · Missing interlock definitions for motorised equipment · S88 hierarchy violations in Strict mode · Incomplete alarm matrices
Never
What the AI never does
Suggests sequence steps · Authors interlock logic · Proposes tag names · Auto-corrects any field · Reads safety data · Retains memory between calls · Generates any content that appears in the exported document
Logged
Audit log: every call
Timestamp · User ID · Project ID + revision · Safety exclusion confirmation · Token counts in and out · Raw response. Logs are immutable. Retained 7 years. Cannot be deleted or modified by any application-level operation.
Revision Control

Locked revisions are immutable, so Rev A stays Rev A permanently.

Every export locks a revision to object storage with write-once-read-many enforcement. The revision history is the audit trail: author-stamped, change-described and retained for the project's life.

Rev
Date
Author
Status
Change Description
Rev A
2026-03-15
J. Smith
IFR
Initial issue for client comment. Full system documented Rev A baseline.
Rev B
2026-04-02
J. Smith
IFR
Incorporated client comments. Revised CIP lye wash sequence, added drain phase and updated interlock IL_003.
Rev C
2026-04-22
J. Smith
IFA
Issued for formal client approval. All review comments incorporated.
Rev D
2026-05-07
J. Smith
IFC
Issued for construction following client sign-off on Rev C.
Project licence (AUD $995) fired once, at Rev A, this project's first locked export. Every revision since, IFR, IFA, IFC, is included at no extra charge.
Write-once object storage
Every locked revision is written to WORM (write-once-read-many) object storage. No application-level operation can overwrite or delete a locked revision.
Three roles, one source of truth
Lead Engineer has full edit access. Reviewer can comment and approve but cannot edit. Client Viewer has read-only access to selected sections. Free seat.
7-year audit log retention
Every AI validation call, every revision lock and every override justification is logged and retained for 7 years. Immutable. Required for HACCP and regulatory review.
Project-based licensing
One flat fee per project, fired once, on your first locked export, whatever stage that is. No subscription running while the project sits idle, no per-revision billing after that: IFR, IFA, IFC, as many as you need, all included.
User Specs & Requirements

What you need to run FDSIQ.

Nothing to install. FDSIQ runs entirely in the browser.

Modern browser
A current version of Chrome, Edge, Firefox or Safari. JavaScript and cookies must be enabled, both are required for sign-in and for the wizard itself.
Reliable internet connection
25 Mbps or faster recommended. Every save, validation run and export is a live call, there is no offline mode.
A .docx-capable application
Microsoft Word, LibreOffice Writer or Google Docs, for opening the generated FDS. FDSIQ produces the .docx file, it does not include a viewer for it.
A credit card with sufficient available funds
The AUD $995 project licence fires once, on your first locked revision. Held on file via Stripe, charged automatically, no manual invoice step.
A desktop or laptop screen
The structured wizard, with its tag tables and multi-column layouts, is built for a real screen. It is not optimised for a phone.
Qualified engineers only
FDSIQ is built for qualified engineers (Controls, Process Control, Systems Integration, EI&C or Applications), not as a substitute for one. The Engineer of Record must review and authorise every generated output before it reaches a live system, accepting full professional responsibility for the result.

Compile your FDS
instead of writing it.

FDSIQ is available now for System Integrators, Engineering Consultants and In-house Control Engineers in Food & Beverage and Water & Wastewater.

Get Started →
$995 per project. No subscription.
Food & Beverage Water & Wastewater ISA-88 Strict & Simplified Rockwell · Siemens · Beckhoff · Schneider HACCP · IEC 61511
Dairy Plant CIP System UpgradeSample FDS · Fonterra Co-operative Group · FC-2026-0041
⬇ Download FC-2026-0041-B.docx
ISSUED FOR REVIEW ONLY: NOT APPROVED FOR CONSTRUCTION
FUNCTIONAL DESIGN SPECIFICATION
Dairy Plant CIP System Upgrade
Clean-in-Place Automation · Darnum Processing Plant
ClientFonterra Co-operative Group
SiteDarnum Processing Plant, VIC 3822
Project No.FC-2026-0041
PLC PlatformRockwell ControlLogix 5580
SCADAFactoryTalk View SE v14.0
ISA-88 ModeStrict: Procedure › Unit Procedure › Operation › Phase
ISSUED FOR REVIEW ONLY: NOT APPROVED FOR CONSTRUCTION
Rev B · 2026-04-02 · J. Smith
Applicable Standards: ISA-88.01-2010 · FSANZ Food Safety Standards · SQF Code Edition 9 · HACCP Plan Rev 4
1. Revision History
RevDateAuthorStatusDescription
A2026-03-15J. SmithIFRInitial issue for client comment. Full system documented Rev A baseline.
B2026-04-02J. SmithIFRIncorporated client comments. Revised CIP lye wash sequence, added drain phase and updated interlock IL_003.
C2026-04-22J. SmithIFAIssued for formal client approval. All review comments incorporated.

Auto-generated by FDSIQ from the immutable revision_history table. This register is a contractual record and must not be edited manually.

2. Project and System Overview
2.1 Process Description

The Darnum Processing Plant CIP (Clean-in-Place) system provides automated cleaning cycles for three dairy processing vessels: a 20,000 L cream separator, a 15,000 L pasteuriser and a 10,000 L buffer tank. The system operates in Strict ISA-88 mode with four defined sequences: Pre-Rinse, Caustic Wash, Intermediate Rinse and Post-Rinse. All chemical dosing is interlocked against vessel isolation confirmation and flow verification to prevent cross-contamination.

2.2 P&ID References
DrawingDescription
FC-2026-0041-P01CIP Skid General Arrangement
FC-2026-0041-P02CIP Dosing Skid
FC-2026-0041-P03Product Tank Area Overview
2.3 Area Definitions

CIP CIP Utility Room  ·  L1 Line 1 Pasteuriser  ·  L2 Line 2 Filler  ·  L3 Line 3 Buffer Tank

3. I/O and Tag Register

Auto-generated from the relational tag register. All tag references in Sections 4-7 are validated against this table. Free-text tag entry is not permitted anywhere downstream.

Tag IDTypeDescriptionI/OUnitAlarm
XV_CIP_001XVCIP Supply Isolation ValveDON/AN/A
XV_CIP_002XVLye Return ValveDON/AN/A
XV_CIP_003XVAcid Return ValveDON/AN/A
XV_CIP_004XVRinse Water Supply ValveDON/AN/A
XV_DRN_001XVCIP Drain ValveDON/AN/A
PU_CIP_001PUCIP Circulation PumpDON/AN/A
PU_CIP_002PUCIP Return PumpDON/AN/A
XV_DOS_001XVLye Dosing Injection ValveDON/AN/A
XV_DOS_002XVAcid Dosing Injection ValveDON/AN/A
PU_DOS_001PULye Dosing PumpDON/AN/A
AT_CIP_001ATCIP Return Conductivity AnalyserAImS/cm8.0 HH
LT_TK_301LTLye Tank LevelAI%95 HH / 5 LL
LT_TK_302LTAcid Tank LevelAI%95 HH / 5 LL
TT_CIP_001TTCIP Supply TemperatureAI°C95 HH
TT_CIP_002TTLye Tank TemperatureAI°C85 HH
FT_CIP_001FTCIP Supply FlowAIL/s2.0 LL
XV_SEP_001XVCream Separator CIP Inlet Isolation ValveDON/AN/A
XV_SEP_002XVCream Separator CIP Outlet Isolation ValveDON/AN/A
XV_PAST_001XVPasteuriser CIP Inlet Isolation ValveDON/AN/A
XV_PAST_002XVPasteuriser CIP Outlet Isolation ValveDON/AN/A
XV_BUF_001XVBuffer Tank CIP Inlet Isolation ValveDON/AN/A
XV_BUF_002XVBuffer Tank CIP Outlet Isolation ValveDON/AN/A
4. Equipment Modules

Equipment modules group tags from Section 3 into the physical/functional units the sequence logic (Section 5) and interlock matrix (Section 6) reference. Renaming a tag in the register renames it everywhere a module references it.

ModuleNameTags
EM_CIP_001CIP Circulation SkidPU_CIP_001, PU_CIP_002, XV_CIP_001-004, XV_DRN_001
EM_DOS_001Chemical Dosing SystemPU_DOS_001, XV_DOS_001-002, AT_CIP_001, LT_TK_301-302, TT_CIP_002
EM_VESSEL_001Product Vessel CIP InterfacesXV_SEP/PAST/BUF_001-002 (inlet/outlet isolation, all 3 vessels)
EM_INST_001CIP Process InstrumentationTT_CIP_001, FT_CIP_001
5. Sequence Definition: Strict S88

CIP Procedure is structured as four Unit Procedures, each decomposed into Operations and Phases per ISA-88.01. Pre-Rinse is shown here in full detail as a representative sample; Caustic Wash, Intermediate Rinse and Post-Rinse follow the same structure and are summarised below.

5.1 Unit Procedure: Pre-Rinse (fully detailed)
OperationPhaseActionsTransition
1. Vessel Line-Up1.1 Confirm IsolationVerify LSH_SEP_001 = Product Present; open XV_SEP_001; open XV_SEP_002XV_SEP_001 AND XV_SEP_002 open · timeout 15 s
1.2 Open CIP SupplyOpen XV_CIP_001; verify open within 3 sXV_CIP_001 open · timeout 10 s
2. Rinse Cycle2.1 Start CirculationStart PU_CIP_001; verify runningFT_CIP_001 > 2.0 L/s · timeout 20 s
2.2 Timed RinseHold circulation 180 s; monitor TT_CIP_001 < 95°CRinse timer complete · timeout 185 s
3. Drain3.1 Drain VesselStop PU_CIP_001; open XV_DRN_001Drain complete OR 60 s elapsed · timeout 60 s → Caustic Wash
5.2 Remaining Unit Procedures (summary)
Unit ProcedureOperationsPurpose
Caustic Wash582°C lye circulation with conductivity-monitored return (IL_003); duration extended by drain-timeout condition per Rev B change.
Intermediate Rinse2Fresh-water rinse to clear residual lye ahead of acid wash, conductivity-verified against AT_CIP_001.
Post-Rinse3Final potable-water rinse and vessel drain-down before line-up for production; mirrors Pre-Rinse structure.
6. Interlock and Alarm Matrix
IDCauseEffectDescription
IL_001XV_SEP_001 closedPU_CIP_001 cannot startCIP circulation blocked unless separator inlet isolation is open, preventing dead-heading the pump against a closed valve.
IL_002LT_TK_301 ≤ 5% (LL)PU_DOS_001 stops, XV_DOS_001 closesLye tank low-level trip, preventing dosing pump running dry.
IL_003AT_CIP_001 > 8.0 mS/cm during RinseXV_DRN_001 opens, alarm raisedConductivity high during rinse indicates incomplete lye removal. Added Rev B.
IL_004TT_CIP_001 > 95°CPU_CIP_001 stopsCIP supply over-temperature trip, protects product-contact seals.
IL_005PU_CIP_001 running AND FT_CIP_001 < 2.0 L/s for > 10 sPU_CIP_001 stops, alarm raisedLow-flow trip, protecting pump from dry-running / cavitation.
IL_006LSH_PAST_001 = Product PresentCIP sequence to Pasteuriser blockedPrevents CIP chemicals contacting product in the Pasteuriser.
IL_007E-Stop pressed (any station)All CIP pumps stop, all dosing valves closeCategory 0 safety stop.
IL_008LT_TK_302 ≥ 95% (HH)Acid fill inhibited, alarm raisedPrevents acid tank overfill.
7. Safety Section
This section is authored and reviewed exclusively by the Lead Engineer. Per FDSIQ's architecture, the safety_functions data has no SELECT privilege granted to the AI validation service at the database role level. It is not filtered in application code, it is architecturally inaccessible. The AI Validation Engine never reads or writes any content in this section.
7.1 Safety Instrumented Functions
SIFTriggerActionRating
SIF-01LT_TK_301 ≥ 95% (Lye Tank High-High Level)Trips PU_DOS_001, closes XV_DOS_001, raises Priority 1 alarmSIL 1
SIF-02TT_CIP_001 ≥ 98°C (CIP Supply Over-Temperature)Trips PU_CIP_001, closes XV_CIP_001SIL 1
SIF-03Any E-Stop activeCloses XV_DOS_001 and XV_DOS_002; trips PU_DOS_001SIL 1
7.2 E-Stop Categories
StationLocationCategoryType
ES-01CIP Utility RoomCategory 0: immediate removal of powerLocal mushroom-head, hardwired
ES-02CIP Dosing SkidCategory 0: immediate removal of powerLocal mushroom-head, hardwired
8. HMI Overview

The FactoryTalk View SE v14.0 HMI provides three primary CIP graphics: CIP Overview (skid status, active sequence and running tags), Vessel Selection (choose target vessel: Separator, Pasteuriser or Buffer Tank) and Alarm Summary (active and acknowledged alarms, banded per ISA-18.2 priority).

Tag-level HMI bindings are generated directly from the I/O and Tag Register (Section 3); no manual re-entry of tag names into HMI configuration is required, eliminating a common source of tag-naming drift between the FDS and the deployed SCADA project.