UT_PUMP — Pump control and protection

Decides when a pump should run and protects the pump using whatever
instruments the site has. Pressure, flow and suction can each be a switch, a
transducer/meter, both, or not fitted at all. Each has four levels (HH, H, L, LL):
H and L warn early that something is wrong, HH and LL trip. Every protection can
recover by itself, retry a set number of times, or latch, which you choose per
protection.

It drives a motor block: RunCmd → motor AutoCmd, Healthy → motor Interlock.
The motor block owns Hand/Off/Auto and the electrical protection (overload,
thermistor, feedback). Because Healthy is the motor's interlock, a pump trip
(dry run, high pressure…) stops the motor in Hand too. For speed-controlled
pumps, put UT_SPEED_CTRL in front of it.

Pins

Record UT_PUMP_DATA

Control

Measurements (each a UT_MEAS)

Set the setpoints for the site: the values above are placeholders. The pressure and
flow switches are wired to PressureHigh / PressureLow and FlowSwitch; the
suction switch is DryRun. There are no NC settings: every switch pin is TRUE when it
signals (high, low, dry, flow present). Wire a contact that works the other way through
NOT at the pin.

Other protections (each a UT_PROTECTION)

Priming (prime : UT_PUMP_PRIME)

Priming starts when the motor is seen running (the rising edge of Running), so the
motor's restart delay, a start inhibit or the contactor time never count as priming
time, and lasts until primed or the pump stops. While priming, low levels with
maskAtStart are masked and Priming is TRUE (a VSD can run a fill speed from it);
primeLeft counts down the time left and the status shows Priming: 1 m 20 s left.

Prime next start only (cmdPrimeNext): sets primeNext; the next start primes
as with enable. primeNext clears after a completed prime and stays set if the run
stops before the prime completes (or times out). It is not kept over a power cut.
cmdPrimeCancel (or the PrimeCancel pin) withdraws it before that start; a prime
already running carries on.

A prime that can never finish is a configuration fault (status Config: prime needs pressure installed / Config: prime needs flow installed, the pump is held off):
with enable or primeNext, doneBy PRESSURE or FLOW names a measurement that is
not installed, or a switch with no low switch.

Diagnosis (warnings that point at the likely cause)

diagnosis : UT_PUMP_DIAG, from the levels in effect (H or HH = high, L or LL = low),
first match wins:

HMI commands

Each acts once, on its rising edge, and is cleared by the block; a held command acts
once.

Status fields

state : UT_STATE (FAULT · STARTING · WARNING · ON · STOPPING · OFF), runCmd,
demand (asked to run, after the delays), running, healthy, available,
priming, masked, runTime : TIME (this run), exercising, highFloat (the high
float is acting: EMPTY made or in its hold, FILL made), pvBad (Pv not a number in
EMPTY/FILL: the last decision is held), configBad (a setting is invalid, bit 18),
stationOwned, diagnosis, fault, warning, faultCode : DWORD, faultId : UT_FAULT
(the first trip by the bit order below, else the first warning),
statusCode : UT_STATUS and statusText : STRING(30) (what it is doing or what holds
it back, see Status).

More status fields:

Stop reasons (stopReason)

The shared reasons (conventions) and the pump's own:

Group fields, written by UT_PUMP_STATION: grpActive (set by the
station every scan, cleared by the pump), grpRun, grpRank, grpSkipped, and
grpRunTime : TIME (the run time the station has counted since power-up, for its
HOURS rotation; the station sets it back to 0 on its first scan after a power cut, also in a RETAIN record).

Fault code bits (lowest = most important; faultId names the first trip, else the first warning)

Invalid settings

• Configuration fault (bit 18 as a trip: Healthy FALSE, the pump is held off until
  it is fixed): an unknown pumpMode; a fitted measurement with an unknown sensor,
  highSwitch (only NONE, HH, H) or lowSwitch (only NONE, L, LL); an unknown
  response in any level or protection; with prime.enable or primeNext, an unknown
  prime.doneBy, or a doneBy measurement that is not installed (or a switch with no
  low switch).
  Each of these would switch a protection off without telling anyone.
• Warning (bit 18 as a warning, the pump runs): a negative time (it acts as 0); a
  level or protection with a bad setpoint, deadband or time (BadSetting of its check);
  an unknown reset (acts as AUTO).
• Start/stop points the wrong way round or not a number: the setpoints protection
  (bit 16, WARN by default) and no start from Pv.

Status

statusCode, faultId and statusText say the one main thing the pump is doing,
or what holds it back, so a technician can see on the HMI why it is not running
without opening the program. The most important reason wins: configuration > fault >
held / waiting > warning > running > idle. A pump asked to run (a request, an
exercise, or its run command) that is not running always shows a held, fault or
configuration status, or UT_ST_STARTING while its run command is out and the
motor's run feedback is not yet in. A warning shows over "Running" so it is seen.
The countdown is in timeLeft, and timeLeftOf says which status it belongs to.
The text is rebuilt only when the status or the fault changes (or when the text has
been cleared). A pump with Demand TRUE never says Idle. The numbers are in
conventions.

<fault> is faultId: the first trip by the bit order above, else the first warning.
<setting> with UT_ST_CONFIG is one of: UT_F_PUMP_MODE (pump mode) ·
UT_F_PRIME_DONEBY (prime doneBy) · UT_F_PRIME_NEEDS_PRES (prime: no pressure) ·
UT_F_PRIME_NEEDS_FLOW (prime: no flow) · UT_F_PRESSURE_SENSOR /
UT_F_FLOW_SENSOR / UT_F_SUCTION_SENSOR (sensor or switch level unknown) ·
UT_F_RESPONSE (response unknown) · UT_F_POINTS (start/stop points wrong way
round). With UT_ST_WARN_SETTING it is the setting found, or UT_F_SETTING (a setting).

How it works

• Run request: a station's grpRun while a station owns the record, otherwise
  the pumpMode and Demand. Then startDelay / stopDelay, then exercise. RunCmd
  follows it with minRunTime / minOffTime; any pump trip, and Inhibit, drop it at
  once; Permissive FALSE holds back a start; so does StartHold, which keeps the
  pump available.
• Demand in every mode. DEMAND: runs while Demand is TRUE (with
  demandStopAtPv until Pv ≤ stopPoint). EMPTY: Demand pumps down now, to
  stopPoint, with the protections kept ("run now"). FILL: Demand fills now, to
  stopPoint or the high float. After such a stop a held Demand runs again once
  Pv is back at startPoint (the level control would start it there anyway), or
  when it is given again (a new rising edge). A Pv that is not a number holds it.
• Station: the station sets grpActive every scan and the pump clears it after
  reading it, so if the station block stops being called the pump is back on its own
  mode from the next scan. On its first scan after power-up the pump ignores
  grpRun (a retained record must not start every pump at once).
• Resets of MANUAL protections (and RETRY ones whose retries are used up): the
  Reset pin, cmdReset, or the motor leaving Auto (resetByOff). Refused while the
  cause is still there. A reset clears faults only: the event counts
  (count in each protection) are kept.
• Exercise: an idle pump that is healthy, ready and in Auto runs exerciseTime
  after exerciseInterval without running (or on cmdExercise). A real request
  takes over from an exercise.
• A Pv that is not a number (NaN, infinity) holds the pump as it is (the last good
  decision) and raises a warning (bit 17, pvBad). The floats still act.
• High float (HighFloat, own control only, ignored while a station owns the
  pump). EMPTY: overflow backup. The pump runs while the float is made, whatever Pv
  says, and highFloatHold after it clears. After that Pv decides again: a good Pv
  above the stop point keeps it running down to the stop point; a stuck or bad Pv
  lets it stop, and the float catches the next rise. A float stuck made keeps the pump
  running until its dry-run protection (DryRun) stops it, so fit one. FILL: the tank
  is full, the pump stops while the float is made (its own stopDelay / minRunTime
  still apply) and is not exercised. DEMAND and TIMED: not used.

Power cut

Nothing is kept: every protection starts clear, with no retries used. A latched
(MANUAL) trip is forgotten; a fault that is still there trips again before the pump
can start. primeNext, stopReason, the last fault and trips start again. Power-up
counts as a stop for minOffTime.

Keep your record RETAIN (or write the settings every scan) so the settings are
there on the first scan.

Examples of set-ups

Using it

Pump1(Demand := LevelHigh, Running := M1.Running, MotorReady := M1.Ready, MotorAuto := M1.Auto,
      DryRun := LowFloat, PressureHigh := P1_HiPS, Data := Pump1Data);
M1(AutoCmd := Pump1.RunCmd, Feedback := P1_Aux, Overload := P1_OL,
   Interlock := Pump1.Healthy, Data := Motor1);