Final project: a complete tank station with a state machine and alarms

What we are building

A station that runs batch after batch: fill the tank to a setpoint, hold for a settling period, drain to a low limit, log a batch, repeat. It stops safely on anything odd and raises an alarm that a human has to acknowledge. That is the skeleton of every real batch station, however large.

Decision 1: permissives before motion

No first step until the conditions are sound. Collect them into one named variable:

Permissive := NOT (LSH AND LSL) AND LevelF <= 99.0;

LSH AND LSL together is physically impossible, so it means a failed switch or a broken wire. One named condition beats seven conditions repeated in seven places: you read it in the watch table and know immediately why the station did not start.

Decision 2: the filtered level, not the raw one

A level measurement jitters, and any comparison against the raw value jitters with it. A one-line exponential filter:

LevelF := LevelF + 0.20 * (Level - LevelF);

The 0.20 means "take a fifth of the new reading", a reasonable trade between quiet and responsive. We copy the raw value once on the first scan, otherwise the filter starts at zero and we wait while it climbs.

Decision 3: a state machine, not a chain of conditions

Five states, each knowing its outputs and its one exit condition:

Two rules keep a state machine clean: an output is set in exactly one place, and each state has one clear exit. Fault is 9, well away from the sequence numbers, so the number alone tells you that you are outside the normal flow.

Decision 4: a timeout on every moving step

A step waiting on a physical event must wait with a limit. If fill is commanded and the level has not risen in 60 seconds, the pump has failed, a valve is shut, or the source is empty. Without a timeout the program waits forever while the pump runs dry.

One timer serves both moving steps, reset on any step change by comparing the current step with the previous one.

Decision 5: an ISA-18.2 style alarm

An alarm is not HiAlm := Level > 90. ISA-18.2 separates the process condition from the alarm state, and the practical consequence is this: the alarm stays visible until a human acknowledges it, even if the level has long since returned to normal. A deadband stops it chattering around the threshold:

• Raised above 90% or on LSH.
• Cleared only below 85% and after acknowledge.
• The lamp flashes while unacknowledged, and goes steady once acknowledged but still active.

The lab panel has only two buttons, so a START press doubles as acknowledge whenever there is an unacknowledged alarm or a fault. On a real station that is a pushbutton or a click on the HMI.

Decision 6: edges, not levels

Start, acknowledge and batch counting are all events, and an event is read on a rising edge. Without R_TRIG the batch counter would log twenty batches a second because the completion condition is true every scan. That is also why state 4 exists: a state that lives for one scan, counts, and leaves.

Decision 7: who stops what

Stop returns the machine to idle in an orderly way. A fault goes to state 9, drops everything, and stays there. The difference is deliberate: a stop is an operator request, a fault is a condition that needs a person to understand what happened before anything restarts.

How to read the program

The lab program under this lesson is laid out in eight sections, in this order: setpoints, filter, events and edges, alarm, fault detection, state machine, step timing, outputs. The order is not decoration. Everything that reads comes before everything that decides, and everything that decides comes before everything that writes. Follow it in every program you write from here on.