Duplex pump controller
CJ Ackley | Controls | Project brief

STATUS
Control brief; operating sequence to define. Detailed design and analysis pending.

THE PROBLEM
Two pumps serve a collection sump. A simple level switch does not define which pump starts, when the second joins, or what happens after a failed start. This project specifies and tests that sequence before selecting control hardware.

DESIGN QUESTION
Can every start, stop, and fault leave the controller in a defined state?

SCOPE
- Build a deterministic state machine for lead rotation, assist demand, and minimum run times.
- Represent level inputs, running feedback, manual requests, and unavailable pumps.
- Simulate failed starts, conflicting sensors, and power restoration.

CONSTRAINTS
Equipment: Two duty-capable pumps with independent running feedback
Inputs: Discrete level signals with explicit fault assumptions
Restart: Defined behavior after power loss and fault reset
Boundary: Supervisory sequencing; independent protections excluded

ENGINEERING DECISIONS (PROPOSED)
Event priority, timers, and resets
Specify event priority, timer ownership, and reset conditions before writing the transition logic. Keep a faulted pump unavailable until its reset conditions are satisfied.

ALTERNATIVE
Independent timer and relay rules are easy to add individually, but their combined behavior becomes difficult to reason about when requests arrive together.

TRADEOFF
An explicit state model takes more initial work. It makes simultaneous demand, missing feedback, and power restoration reviewable in one place.

PROPOSED TOOLS AND METHODS
State-transition model, Discrete-event simulator, Trace assertions

VERIFICATION SCENARIO (NOT YET RUN)
The lead pump fails as assist demand arrives
Schedule the failed-start timeout and assist request for the same simulated instant, then repeat with their arrival order reversed.

PASS CONDITION
The specified event priority gives a defined output in both traces. No unavailable pump receives a start command, and demand cannot leave the controller in an unhandled state.

EVIDENCE TO RETAIN
An independent expected-output table, transition coverage, timestamped traces, and assertions for command interlocks and timer behavior.

MEASUREMENT AND LIMITS
Test loss and restoration of power from each reachable state. Simulation checks supervisory sequencing; electrical protections and a hardware commissioning procedure remain separate.

COMPLETION CRITERIA (PLANNED)
- Every specified transition has a reproducible trace.
- Simultaneous events, stuck inputs, missing feedback, and resets have defined outcomes.
- The state table and implementation agree under the fault suite.

VERIFICATION PLAN
State coverage
Exercise every transition and verify command interlocks.

Fault injection
Replay stuck inputs, missing feedback, and simultaneous requests.

Repeatability
Run event traces against an independent table of expected outputs.

PLANNED DELIVERABLES
- Executable controller model and automated scenario tests
- I/O list, state diagram, and cause-and-effect table
- Hardware acceptance-test script and recorded simulation traces

SCOPE NOTE
No field operation is claimed. Electrical protection, emergency functions, and site commissioning require separate design and testing.

NEXT STEP
Define the level-switch arrangement, pump feedback, and permitted restart behavior.
