feat(demos/manymove_industrial): add PLC OPC UA cross-source fault demo

Adds a PLC simulator (asyncua-based OPC UA server) and an OPC UA -> medkit
fault bridge so PLC AlarmConditionType events land in the same medkit
FaultManager that aggregates manymove BT-side faults. Both faults appear
in one dashboard with distinct source_ids, demonstrating cross-source
correlation as the actual differentiator over single-source logging.

The PLC sim exposes three canonical alarms (photoeye_flicker / WARN,
conveyor_overspeed / ERROR, estop_engaged / CRITICAL) plus an admin HTTP
endpoint so container_scripts and demo orchestrators can raise/clear
alarms without speaking OPC UA themselves. Designed to be swappable
with a real OpenPLC v3 + ST program once the IEC 61131-3 build pipeline
is set up; the OPC UA surface (AlarmConditionType events on namespace 2)
stays identical.

The bridge is a ROS 2 Python node (rclpy + asyncua) that subscribes to
AlarmConditionType events and calls /fault_manager/report_fault for
each, with SourceName -> MANYMOVE_PLC_* fault code mapping. Loopback
prevention drops events whose SourceName starts with our own source_id.

Manifest gains a conveyor-line area, four PLC-side components
(openplc, photoeye-pick, photoeye-drop, conveyor-motor), an opcua-bridge
component, plus matching apps and a fault-aggregation function tying
the bridge to the existing FaultManager + gateway.

Smoke test now exercises the conveyor-line container_scripts
(inject-photoeye-flicker, restore-line) and asserts MANYMOVE_PLC_*
faults round-trip through the bridge into medkit.

Author: mfaferek93

.github/workflows/ci.yml

@@ -170,17 +170,20 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Build and start manymove_industrial demo
+      - name: Build and start manymove_industrial demo (sim + plc + bridge)
         working-directory: demos/manymove_industrial
-        run: docker compose --profile ci up -d --build manymove-sim-ci
+        run: docker compose --profile ci up -d --build
 
       - name: Run smoke tests
         run: ./tests/smoke_test_manymove_industrial.sh
 
       - name: Show container logs on failure
         if: failure()
         working-directory: demos/manymove_industrial
-        run: docker compose --profile ci logs manymove-sim-ci --tail=200
+        run: |
+          docker compose --profile ci logs manymove-sim-ci --tail=200 || true
+          docker compose --profile ci logs plc-sim --tail=100 || true
+          docker compose --profile ci logs opcua-bridge --tail=100 || true
 
       - name: Teardown
         if: always()

demos/manymove_industrial/config/manymove_industrial_manifest.yaml

@@ -21,6 +21,14 @@ areas:
     name: "Diagnostics"
     description: "ros2_medkit fault management"
     namespace: /
+  - id: conveyor-line
+    name: "Conveyor line"
+    description: "PLC-driven conveyor line: photoeyes, motor, e-stop"
+    namespace: /
+  - id: bridge
+    name: "Bridges"
+    description: "Cross-protocol bridges (OPC UA, etc.)"
+    namespace: /
 
 components:
   - id: xarm7-arm
@@ -68,6 +76,31 @@ components:
     type: "diagnostics"
     description: "SQLite-backed fault store"
     area: diagnostics
+  - id: openplc
+    name: "Line PLC (OPC UA)"
+    type: "controller"
+    description: "IEC 61131-3 soft PLC exposing photoeye / conveyor / e-stop tags + AlarmConditionType events"
+    area: conveyor-line
+  - id: photoeye-pick
+    name: "Pick photoeye"
+    type: "sensor"
+    description: "Diffuse-mode photoelectric sensor at pick position"
+    area: conveyor-line
+  - id: photoeye-drop
+    name: "Drop photoeye"
+    type: "sensor"
+    description: "Diffuse-mode photoelectric sensor at drop position"
+    area: conveyor-line
+  - id: conveyor-motor
+    name: "Conveyor motor"
+    type: "actuator"
+    description: "Belt drive motor"
+    area: conveyor-line
+  - id: opcua-bridge
+    name: "OPC UA -> medkit bridge"
+    type: "bridge"
+    description: "Subscribes to PLC AlarmConditionType events and forwards them as medkit faults"
+    area: bridge
 
 apps:
   - id: bt-client-xarm7
@@ -126,6 +159,20 @@ apps:
     ros_binding:
       namespace: /
       node_name: ros2_medkit_gateway
+  - id: openplc-runtime
+    name: "OpenPLC runtime"
+    category: "controller"
+    is_located_on: openplc
+    ros_binding:
+      namespace: /plc
+      node_name: openplc_runtime
+  - id: opcua-bridge-app
+    name: "opcua_bridge"
+    category: "bridge"
+    is_located_on: opcua-bridge
+    ros_binding:
+      namespace: /plc
+      node_name: sensor_io
 
 functions:
   - id: pick-and-place
@@ -151,3 +198,17 @@ functions:
     hosted_by:
       - fault-manager-app
       - gateway-app
+  - id: line-control
+    name: "Line control"
+    category: "controller"
+    description: "PLC-driven conveyor sequencing with safety interlocks"
+    hosted_by:
+      - openplc-runtime
+  - id: fault-aggregation
+    name: "Cross-source fault aggregation"
+    category: "diagnostics"
+    description: "Bridge PLC AlarmConditionType events into the same medkit FaultManager that aggregates ROS-side faults"
+    hosted_by:
+      - opcua-bridge-app
+      - fault-manager-app
+      - gateway-app

demos/manymove_industrial/container_scripts/conveyor-line/inject-estop/metadata.json

@@ -0,0 +1,5 @@
+{
+  "name": "Inject PLC e-stop (CRITICAL)",
+  "description": "Raises the EstopEngaged AlarmConditionType on the PLC OPC UA server. The opcua_bridge forwards it as MANYMOVE_PLC_ESTOP_ENGAGED (CRITICAL) into the medkit FaultManager.",
+  "format": "bash"
+}

demos/manymove_industrial/container_scripts/conveyor-line/inject-estop/script.bash

@@ -0,0 +1,13 @@
+#!/bin/bash
+# Raise EstopEngaged AlarmConditionType (CRITICAL severity) via the PLC
+# admin endpoint. opcua_bridge forwards it to medkit as
+# MANYMOVE_PLC_ESTOP_ENGAGED.
+set -e
+
+PLC_ADMIN="${PLC_ADMIN_URL:-http://plc-sim:8500}"
+
+curl -fsS -X POST -H "Content-Type: application/json" \
+    -d '{"message":"Line e-stop pressed at station 2"}' \
+    "${PLC_ADMIN}/alarm/estop_engaged/raise" >/dev/null
+
+echo "EstopEngaged alarm raised on ${PLC_ADMIN}"

demos/manymove_industrial/container_scripts/conveyor-line/inject-photoeye-flicker/metadata.json

@@ -0,0 +1,5 @@
+{
+  "name": "Inject PLC photoeye flicker (WARN)",
+  "description": "Raises the PhotoeyeFlicker AlarmConditionType on the PLC OPC UA server. The opcua_bridge subscribes and forwards it as MANYMOVE_PLC_PHOTOEYE_FLICKER (WARN) into the medkit FaultManager.",
+  "format": "bash"
+}

demos/manymove_industrial/container_scripts/conveyor-line/inject-photoeye-flicker/script.bash

@@ -0,0 +1,13 @@
+#!/bin/bash
+# Raise PhotoeyeFlicker AlarmConditionType via the PLC admin endpoint.
+# The opcua_bridge service is subscribed and forwards it as
+# MANYMOVE_PLC_PHOTOEYE_FLICKER (WARN) to the medkit FaultManager.
+set -e
+
+PLC_ADMIN="${PLC_ADMIN_URL:-http://plc-sim:8500}"
+
+curl -fsS -X POST -H "Content-Type: application/json" \
+    -d '{"message":"Pick photoeye toggled 12 times in 2s, expected <=3"}' \
+    "${PLC_ADMIN}/alarm/photoeye_flicker/raise" >/dev/null
+
+echo "PhotoeyeFlicker alarm raised on ${PLC_ADMIN}"

demos/manymove_industrial/container_scripts/conveyor-line/restore-line/metadata.json

@@ -0,0 +1,5 @@
+{
+  "name": "Clear PLC alarms",
+  "description": "Clears all three PLC AlarmConditionType alarms (photoeye_flicker, conveyor_overspeed, estop_engaged). The opcua_bridge forwards PASSED events that heal the corresponding medkit faults.",
+  "format": "bash"
+}

demos/manymove_industrial/container_scripts/conveyor-line/restore-line/script.bash

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Clear every PLC AlarmConditionType. opcua_bridge forwards a PASSED
+# event per alarm, healing the corresponding medkit fault.
+set -e
+
+PLC_ADMIN="${PLC_ADMIN_URL:-http://plc-sim:8500}"
+
+for alarm in photoeye_flicker conveyor_overspeed estop_engaged; do
+    curl -fsS -X POST "${PLC_ADMIN}/alarm/${alarm}/clear" >/dev/null || true
+    echo "cleared ${alarm}"
+done

demos/manymove_industrial/docker-compose.yml

@@ -19,7 +19,9 @@ services:
     ports:
       - "8080:8080"   # medkit gateway HTTP
       - "8765:8765"   # foxglove-bridge
-    networks: [medkit-net]
+    networks:
+      medkit-net:
+        aliases: [medkit-gateway]
     stdin_open: true
     tty: true
     command: >
@@ -37,6 +39,40 @@ services:
       - manymove-sim
     networks: [medkit-net]
 
+  # PLC simulator: OPC UA server emulating a line PLC (photoeye, conveyor,
+  # e-stop). Publishes AlarmConditionType events the bridge subscribes to.
+  # Swappable with a real OpenPLC v3 + ST program once the IEC 61131-3
+  # build pipeline is in place; the OPC UA surface stays identical.
+  plc-sim:
+    profiles: ["cpu", "ci"]
+    build:
+      context: ./plc_sim
+      dockerfile: Dockerfile
+    container_name: manymove_industrial_plc_sim
+    ports:
+      - "4840:4840"   # OPC UA endpoint
+      - "8500:8500"   # admin (raise/clear alarm via curl)
+    networks: [medkit-net]
+
+  # OPC UA -> medkit fault bridge. Subscribes to PLC alarm conditions and
+  # POSTs them to the FaultManager so PLC faults land in the same
+  # dashboard / SOVD entity tree as the manymove BT-side faults.
+  opcua-bridge:
+    profiles: ["cpu", "ci"]
+    build:
+      context: ./opcua_bridge
+      dockerfile: Dockerfile
+    container_name: manymove_industrial_opcua_bridge
+    environment:
+      - OPCUA_ENDPOINT=opc.tcp://plc-sim:4840/manymove_plc/server
+      - BRIDGE_SOURCE_ID=/plc/sensor_io
+      - REPORT_FAULT_SERVICE=/fault_manager/report_fault
+      - ROS_DOMAIN_ID=42
+      - RMW_IMPLEMENTATION=rmw_fastrtps_cpp
+    depends_on:
+      - plc-sim
+    networks: [medkit-net]
+
   # CI profile: headless, no web UI, no X11. Suitable for the smoke test.
   manymove-sim-ci:
     profiles: ["ci"]
@@ -51,15 +87,14 @@ services:
       - "8080:8080"
     volumes:
       - manymove_faults_ci:/var/lib/ros2_medkit
-    networks: [medkit-net]
+    networks:
+      medkit-net:
+        aliases: [medkit-gateway]
     command: >
       bash -c "source /opt/ros/jazzy/setup.bash &&
                source /opt/manymove_ws/install/setup.bash &&
                ros2 launch manymove_industrial demo.launch.py headless:=true"
 
-# OpenPLC + OPC UA bridge for the tier-2 PLC correlation narrative are
-# planned in a follow-up; see README "TODO: PLC tier".
-
 networks:
   medkit-net:
     driver: bridge

demos/manymove_industrial/opcua_bridge/Dockerfile

@@ -0,0 +1,20 @@
+FROM ros:jazzy-ros-base
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PYTHONUNBUFFERED=1 \
+    OPCUA_ENDPOINT=opc.tcp://plc-sim:4840/manymove_plc/server \
+    BRIDGE_SOURCE_ID=/plc/sensor_io \
+    REPORT_FAULT_SERVICE=/fault_manager/report_fault
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        python3-pip \
+        ros-jazzy-ros2-medkit-msgs=0.4.0-1* \
+        ros-jazzy-ros2-medkit-fault-reporter=0.4.0-1* \
+    && rm -rf /var/lib/apt/lists/* \
+    && pip install --no-cache-dir --break-system-packages \
+        "asyncua==1.1.5"
+
+WORKDIR /opt/opcua_bridge
+COPY bridge.py ./
+
+CMD ["bash", "-c", "source /opt/ros/jazzy/setup.bash && exec python3 -u bridge.py"]