Stop mode S (Shutdown UC4 System) is handled by the Primary Work Process (PWP). I verified this by enabling tcp/ip 2 & db 4 tracing.
When you select a CP or WP from the Service Manager GUI and choose Shutdown (UC4 System), the Service Manager receives this message and passes it along to the selected AE server process. (Interestingly, the Service Manager also appears to send some messages to the CPs.)
...
Command: STOP-PROCESS
U00022020 Client statement: process 'EXP2-NodeA-WP1' should be stopped
U00022031 Client data: User 'MYCORP\MYUSER' of computer 'MYPC'.
U00022010 Terminate process 'EXP-NodeA-WP1/UC4 PWP-Server [AE_EXP#WP003] - 4 Connections' (ID '18561') with mode 'S'.
The next step takes place on the CP or WP that receives the shutdown message from the Service Manager.
If you initiate the shutdown from a CP or from a WP other than the PWP, this server process will identify the PWP, and send the shutdown message (F90000?) to the PWP.
handle_terminate_shutdown(SRV(name=AE_EXP#WP003,runmode=N,srvmode= ,pcx-roles=,netarea=AE_EXP)) -->
sockets_get_primary() -->
sockets_get_primary <-- (primary@0x317fa50)
ActionSendShutdown() -->
ActionSend(msgsize=51, SOCKET(s=15,name=AE_EXP#WP001,type=04,host=,add=10.95.42.1,port=22100,id=0,netarea=AE_EXP,roles=,nxt=0x2980150)) -->
U00009909 TRACE: (Send to Server AE_EXP#WP001) 0x7ffd6bdafb10 000051
00000000 30303030 30303531 5543343A 676C6F62 >00000051UC4:glob<
00000010 616C3030 314E4154 20202020 20202020 >al001NAT <
00000020 20202020 20202020 20202020 20202020 > <
00000030 F90000 >...<
ActionSend <-- (OK)
ActionSendShutdown <-- (OK,rslt=0)
handle_terminate_shutdown <-- (OK)
U00003432 Termination of Server 'AE_EXP#WP003' initiated.
In this case, I selected WP3 (not the PWP) from the Service Manager GUI to initiate the shutdown. Note that WP3 stopped itself immediately after sending the shutdown message to the PWP. If you initiate the shutdown from the PWP, the above step is skipped.
The PWP receives the shutdown message. (If the shutdown is initiated from the PWP, several handle_terminate_shutdown messages appear here.)
socket_read(SOCKET(s=19,name=AE_EXP#WP003,type=02,host=uc4exp.mycompany.com,add=10.95.42.1,port=0,id=223219001,netarea=AE_EXP,roles=R,nxt=0x37a5f70)) -->
U00009909 TRACE: (Recv from Server AE_EXP#WP003) 0x3c848f0 000051
00000000 30303030 30303531 5543343A 676C6F62 >00000051UC4:glob<
00000010 616C3030 314E4154 20202020 20202020 >al001NAT <
00000020 20202020 20202020 20202020 20202020 > <
00000030 F90000 >...<
socket_read(1424): msg=0x3c848f0, remaining=51
socket_read(1455): logical msg len=51
U00009909 TRACE: (Msg Server AE_EXP#WP003) 0x3c848f0 000051
00000000 30303030 30303531 5543343A 676C6F62 >00000051UC4:glob<
00000010 616C3030 314E4154 20202020 20202020 >al001NAT <
00000020 20202020 20202020 20202020 20202020 > <
00000030 F90000 >...<
Immediately after receiving the shutdown message, the PWP begins sending shutdown messages to all of the other running AE server processes. Here is an example.
ActionSendShutdown() -->
ActionSend(msgsize=51, SOCKET(s=16,name=AE_EXP#CP003,type=40,host=uc4exp.mycompany.com,add=10.95.42.1,port=22190,id=223212027,netarea=AE_EXP,roles=,nxt=0x1ea9470)) -->
U00009909 TRACE: (Send to Server AE_EXP#CP003) 0x7ffc090046b0 000051
00000000 30303030 30303531 5543343A 676C6F62 >00000051UC4:glob<
00000010 616C3030 314E4154 20202020 20202020 >al001NAT <
00000020 20202020 20202020 20202020 20202020 > <
00000030 F90000 >...<
ActionSend <-- (OK)
ActionSendShutdown <-- (OK,rslt=0)
Judging from the PWP trace, the rest of the shutdown process is quite complicated and involves many additional steps including communication with the other processes. Some processes do not stop immediately. Once these additional shutdown steps have been completed and all of the other AE server processes have stopped, the PWP also stops.
As far as I can tell, most of the inter-process communication related to an AE system shutdown is conveyed via TCP sockets.