Duplex pump controller
Executed reference model; no field commissioning
Operating sequence
A deterministic two-pump controller with low/start/assist level inputs, independent run feedback, availability and manual requests. Start demand latches an automatic cycle until the low switch becomes dry. The next lead changes after a cycle with proven running feedback.
Inputs at the same timestamp are one atomic snapshot. Power loss, invalid sensors, unavailability and feedback faults take priority over run requests. A dry low switch stops both pumps regardless of the minimum-run timer.
Reference settings
| setting | value |
|---|---|
| source | Defined reference sequence; no plant data or hardware observations |
| start_timeout_s | 3.0 |
| feedback_loss_timeout_s | 1.0 |
| minimum_run_s | 10.0 |
| lead_at_first_boot | A |
| restart_policy | Power restoration requires quiet inputs and an explicit reset |
| low_level_policy | Dry low-level input stops both commands immediately |
| scan_contract | All inputs at one timestamp are applied atomically; timers checked on each scan |
Executed checks
| check | value |
|---|---|
| tests_passed | 23 |
| input_snapshots_per_seed_state | 2048 |
| representative_seed_states | 7 |
| one_scan_interlock_cases | 14336 |
| independent_trace_checkpoints | 10 |
| declared_pump_state_edges_tested | 7 |
| reference_failover_time_s | 4.0 |
| field_commissioned | False |
The regression suite contains an independent expected-output trace and transition-specific tests. The scripted 46-second trace adds ten fixed checkpoints rather than deriving expectations from the controller.
Simulation trace
| time_s | A | B | mode |
|---|---|---|---|
| 0 | 0 | 0 | IDLE |
| 1 | 1 | 0 | PUMP_A |
| 4 | 0 | 1 | PUMP_B |
| 12 | 0 | 0 | NO_CAPACITY |
| 24 | 0 | 0 | POWER_OFF |
| 25 | 0 | 0 | INHIBITED |
| 28 | 0 | 1 | PUMP_B |
| 34 | 1 | 0 | PUMP_A |
| 37 | 1 | 0 | PUMP_A |
| 44 | 0 | 0 | IDLE |
Cause and effect
| priority | condition | commands | recovery |
|---|---|---|---|
| 1 | Power absent | Both off | Quiet-input reset after power returns |
| 2 | Invalid level order | Both off; sensor fault latched | Valid dry inputs and reset |
| 3 | Pump unavailable | Affected pump off; select usable alternative | Availability returns |
| 4 | Start timeout or lost run feedback | Affected pump off; fault latched; select alternative | Dry, no feedback/manual request, available and reset |
| 5 | Dry low level | Both off, including manual/minimum run | Wet permissive and new demand |
| 6 | Start demand | Lead or usable substitute | Cycle ends at dry low |
| 7 | Assist demand | Both usable pumps | Assist hold until minimum run expires |
| 8 | Manual request | Requested usable pump with wet permissive | Minimum-run hold applies after release |
Files
Controller source · Tests · Trace CSV · I/O list · Hardware acceptance procedure
Limits
- An executable supervisory model, not deployed PLC firmware or commissioned pump hardware.
- External availability inputs stand in for motor protection, emergency circuits, and mechanical safeguards.
- Timers are evaluated on scans. A physical implementation must bound scan time and feedback latency.
- The input sweep is exhaustive for one scan at seven representative states, not for all continuous-time histories.
- Persistent fault/lead memory is modeled in a live process; a deployed controller needs specified nonvolatile storage behavior.
Virtual validation
Executed synthetic and theoretical run-through. The report includes cases, acceptance results and model boundaries.