The spare that keeps stealing the run

What the checks test

1. T1Start is a rising-edge request, not a maintained enable.
2. T2No scan commands both pumps; handover waits 400 ms.
3. T3One failed run gets one failover; a second failure latches Alarm.

The checks run 10 tests on the machine, scan by scan: Stop during handover cancels the pending restart; The selected spare trips before its timer finishes; An unavailable preferred motor uses the healthy spare; Alternate only after a healthy Stop; 400 ms break before make; recovery cannot steal the run; A second trip locks out instead of chasing motors; Permission restoration with Start held cannot restart; Stop wins over simultaneous Start and handover; A dead spare cannot receive a command; Standby failure has the same handover rules.

Where you’d find this

In a block of flats, the spare pump takes over when the main motor trips and cuts out. Once it recovers, the main pump must wait for the next run.

Both pumps starting without warning can overload the supply. Retrying again and again can damage a motor and leave the flats without water.

How it should behave

Idle / selection

State 0 commands both pumps OFF. A fresh Start with Permit and no Stop/Alarm selects the preferred healthy pump: initially duty. State 10 = DutyPump, 20 = StandbyPump. Use the other if the preferred motor is faulty.

Alternation

A healthy run ended by Stop makes NextStandby select the other motor for the next run. Permit loss and a failed run do not change it. FailedRun records that a failover has already been used.

Handover

Fault is the duty motor trip; StandbyFault trips the spare. On the first active-motor fault, enter State 30 with both commands OFF. PendingStandby remembers the selected replacement. Call Delay while in 30: timing starts at zero on the first invocation and transfer occurs at 400 ms. Recovery of the old motor must not change selection.

Lockout

If the selected replacement fails during the delay, or the running replacement fails afterwards, enter 0 and latch Alarm. Do not try a third motor start. Reset clears Alarm only while idle, both motor faults clear and Start released. Reset never starts a motor.

Priority

Stop or lost Permit removes both commands immediately, including during handover. Restoring Permit with Start still held must not start. Release and press Start again. On a healthy start or completed handover, the command set may follow the previous or new state for one scan, then must match the selected state. No overlap is allowed.

Press Run, then press and release Start. Set Fault TRUE to watch both shafts stop before the spare starts. Clear Fault: the spare must keep the run. Trip StandbyFault next, then replay the failure if it starts switching repeatedly.