Which fault actually happened first?

What the checks test

1. T1TripCode captures the first cause and does not change before a valid Reset.
2. T2Opening feedback gets 500 ms; an interrupted command starts a fresh wait.
3. T3A held Ack cannot silence a later event. Alarm, Horn, PumpOn and ValveCmd are checked every scan.

The checks run 7 tests on the machine, scan by scan: A healthy plant cannot reset while Start is still held; First cause survives later faults; defined simultaneous priority; High-level boundary and held Ack cannot silence the next event; Feedback at the last allowed scan prevents a timeout; 500 ms timeout trips, latches and refuses unsafe reset; Interrupted travel gets a fresh timeout; Permission return never restarts a held Start.

Where you’d find this

A brewery tank stops filling after an alarm. The engineer needs to know which fault came first, before later faults bury it.

If later faults overwrite the first fault code, the engineer goes to the wrong equipment. Using Ack to clear the alarm could restart equipment that is still faulty.

How it should behave

Start and flow

A fresh Start edge latches ValveCmd with Permit, no Stop and no Alarm. PumpOn is TRUE only with ValveCmd AND ValveOpen. Stop/Permit loss immediately removes both commands; restoration needs a new Start press.

Three causes

TripCode 0 = clear; 1 = Fault; 2 = Level >= 95%; 3 = ValveCmd without ValveOpen continuously for 500 ms. Call Delay every scan; its first true invocation starts at zero. The next invocation at 500 ms trips. Interrupted travel resets the delay.

First cause and priority

If more than one cause appears on the same scan, Fault wins, then high Level, then valve timeout. After capture, preserve TripCode even if another cause appears. Alarm = TripCode <> 0. Both process commands must be OFF on the trip scan.

Horn and Ack

A new capture sounds Horn. A rising edge of Ack silences only Horn. Holding Ack through a valid reset cannot silence the next new fault. Release and press it again.

Reset

Reset clears TripCode, Alarm and Horn only with Start released, Fault FALSE, Level < 95% and ValveStuck FALSE. The valve remains closed and a fresh Start is needed. Reset during an active cause cannot clear it.

Reset the simulation and select ValveStuck before pressing Run and Start. Watch ValveCmd and ValveOpen disagree while the valve stays shut. Test and replay the exact timeout boundary. Use Inputs to hold Ack while clearing and retriggering a fault; a new event must still sound Horn.