CFC vs SFC for Pumping Station Change-Over Logic in PCS 7

Continuous-duty pumping stations present a classic control-engineering problem: two (or more) pumps must share load with a defined working/reserve relationship, and the reserve must take over within bounded time when the running pump faults, trips on interlock, or fails its feedback. In a Siemens PCS 7 environment, the implementer is immediately faced with a language choice: write the change-over as a Continuous Function Chart (CFC) that polls every cycle, or model it as a Sequential Function Chart (SFC) that walks through steps and transitions. This reference compares both approaches for 24/7 pump change-over, documents the dedicated Siemens add-on libraries (CIS_CK Pump Manager, Industry Library APL aggregates), and shows the field-proven pattern that combines both languages when each is used for what it does best.

1. Application Context: Working/Reserve Pump Architecture

A pumping station's redundancy strategy is not a programming decision, it is a process decision that the program must mirror. The driver below is mechanical wear and process availability:

• Working pump (W): Selected at runtime to meet current flow demand.
• Reserve pump (R): Stands ready, normally un-driven, but eligible to start within a defined change-over time.
• Interlocks: Suction pressure, discharge pressure, motor overload, vibration, bearing temperature, low NPSH, ESD signal, valve-end-switch feedback.
• Change-over trigger: Trip of the working pump, sustained feedback mismatch (e.g., contactor pulled in but no flow proves), operator-forced duty swap, scheduled run-hour rotation.

Process requirement: detect the misoperation, de-energize the failed pump, start the reserve, and confirm the corresponding suction/discharge valve motion. The control cycle has to be deterministic and must not depend on operator initiation, because the requirement is 24/7 unattended operation. The cycle time of a typical S7-400 OB1 with PCS 7 CFC charts is in the 100-1000 ms range; the pump trip-to-start window must fit comfortably inside that cycle budget. For a 50 ms AS cycle the change-over reaction is bounded by 1 AS cycle + 1 valve actuation time + 1 drive ramp time, so a well-designed CFC chart delivers a sub-second response from fault to reserve-start command.

2. CFC vs SFC: Selection Criteria

Both CFC and SFC are IEC 61131-3 languages, but their execution semantics are fundamentally different and that difference drives the choice.

For a working/reserve change-over that must react to any of N fault sources at any moment, the polling model of CFC is the natural fit. SFC is the right tool when the work has a definite start, ordered phases, and a defined end - for example, the sequenced start of a pump (pre-lube → cooling-water prove → discharge-valve open → VFD ramp → flow prove → run).

3. SFC Fundamentals: Per-Pump Start/Stop Sequence

An SFC for a single pump models the lifecycle as steps and transitions. The minimum useful sequence for a fixed-speed pump on a PCS 7 AS is:

1. Step 1: Idle - drive commanded OFF, valve commanded closed, wait for start request.
2. Step 2: Pre-start check - confirm discharge valve closed, suction pressure above low-low setpoint, no ESD, no trip latch.
3. Step 3: Start command - close contactor (or VFD run forward), start change-over timer T_START (typical 5-10 s).
4. Step 4: Run prove - wait for current feedback > I_RUN_MIN and discharge pressure rise. If T_START elapses without proof → transition to Step 6 (fault).
5. Step 5: Running - monitor interlocks continuously. Any trip → Step 6. Stop request → Step 7.
6. Step 6: Faulted - latch trip, raise alarm, wait for operator reset (or auto-reset timer).
7. Step 7: Coasting - drop run command, start T_COAST (typical 10-30 s), then open discharge valve if process requires.

Each step holds an output that drives the actuator; transitions evaluate the conditions for moving to the next step. Because the active step persists across scans, the SFC handles the time-out behavior (T_START, T_COAST) cleanly via timers attached to the step.

4. CFC Fundamentals: Continuous Change-Over Arbitration

The change-over chart in CFC is a continuous arbitration between two (or more) pumps. The minimum logical elements are:

• Per-pump status block: Ready, Running, Faulted, Run hours, Last-start timestamp.
• Duty selector: picks which pump is currently in the Working role.
• Change-over trigger: OR of all fault signals on the currently-working pump.
• Change-over timer: debounce window (typical 2-5 s) to avoid flapping on transient feedback loss.
• Reserve validation: confirm the reserve pump is Ready (no fault, no local-locked, no maintenance override).

Because the chart runs cyclically, a fault on the working pump is observed in the same scan it is signalled, the change-over timer is started, and on the next scan (or after the debounce window) the role swaps and the reserve SFC is allowed to start. The driving CFC chart is typically scheduled on OB35 (100 ms) or OB1 (the basic cyclic task) so that the polling budget matches the change-over requirement.

5. PCS 7 CIS_CK AddOn Library: Pump Manager Block

Siemens ships a dedicated add-on for the water-industry vertical called CIS_CK (formerly CIS/CK, now branded PCS 7 Water Library). The library exposes a pre-engineered Pump Manager block that encapsulates the working/reserve arbitration that would otherwise have to be written by hand in CFC. The block exposes inputs for the pump status (Ready, Running, Fault), the duty request, and the role of the pump (Working, Reserve, Standby, Out-of-Service). It produces the start/stop commands and a generated duty-swap signal for the partner pump.

6. PCS 7 Industry Library: APL Aggregates

For users without the CIS_CK license, the standard PCS 7 Industry Library (also referenced as the Advanced Process Library, APL) ships a family of aggregate blocks - MotSpeed, MotRev, ValveAn, ValveMo - and the higher-level Aggregate blocks that wrap a motor plus its associated interlock chain. The aggregate blocks expose a LIOP (Local Interlock Override Pushbutton) input and a Permit chain that integrates cleanly with the change-over chart. For a working/reserve pair you instantiate two Motor blocks and wire the change-over logic in a small CFC that selects which one receives the duty start command.

7. Implementation Pattern: Combined CFC + SFC

The field-proven pattern for a two-pump change-over is hybrid:

1. One CFC chart per pump (or one shared chart with two instances) - implements the change-over arbitration: who is Working, who is Reserve, when to swap. Uses the CIS_CK Pump Manager or a hand-rolled duty-selector built from RS flip-flops and a TON debounce.
2. One SFC per pump - implements the per-pump start/stop lifecycle (Idle → Pre-start → Start → Run → Coasting → Idle).
3. One CFC chart per associated valve - the valve's open/close command follows the pump's start/stop SFC outputs; the valve's end-switch feedback is fed back into the pump's RUNNING_FB prove logic.

The change-over CFC issues START_CMD to the reserve SFC. The reserve SFC walks through its start sequence. If the SFC cannot complete the start prove (e.g., T_START elapses with no current feedback), it transitions to the Faulted step and the CFC raises a START_FAILED alarm, which in turn fires a second-level change-over to a third pump if the station is configured with N+1 redundancy.

8. Drive-Level Interlock Integration

For variable-speed pumps the change-over CFC must command the VFD into a defined state before swapping. Recommended sequence:

1. Working pump fault detected.
2. CFC issues STOP_CMD to working SFC.
3. Working SFC ramps speed reference to 0 (typical 5-10 s ramp), drops run enable, then signals STOPPED.
4. CFC waits for STOPPED confirmation plus a configurable interlock-purge time (typical 2-3 s) to allow the DC bus to discharge.
5. CFC issues START_CMD to reserve SFC. The reserve SFC closes its breaker, ramps the VFD to the setpoint inherited from the working pump's last reference, and proves flow.

Hardwired permissives (emergency stop, motor protection relay) must remain in series with the contactor/VFD enable and must not be implemented in software alone. The CFC reads them as PERMIT on the APL Motor block and the SFC will not advance from Idle to Start if the permit is absent.

9. Valve Sequencing and Feedback Handling

For a pump with a non-return valve on the discharge, the change-over can be simplified: the non-return valve prevents back-flow, so the reserve pump can start as soon as its own suction valve is open and its own discharge valve is open (the failed pump's discharge NRV will close on depressurization). For a pump with a motorised discharge valve that must be commanded, the CFC must include the valve open-end-switch in the RUNNING_FB prove chain and must treat a stuck valve as a separate fault that does not trigger a duty swap (because the reserve will encounter the same stuck valve).

10. Testing and Verification Procedures

Before commissioning, validate the change-over logic on the AS test rack (S7-PLCSIM or a hardware simulator) and then on the real plant. The minimum test matrix is:

Verify in the CFC online view that the change-over timer (TON block) is reset on every successful swap. Verify in the SFC online view that after a swap the previously-working SFC is in Idle (not stuck in Coasting or Faulted). Cross-check the WinCC alarm log for spurious PUMP_FAULT messages caused by the CFC debounce window being too short.

11. Troubleshooting Matrix

12. Library Sourcing and Documentation

For the most current catalog numbers, license terms, and engineering notes, consult Siemens Industry Online Support. The CIS_CK add-on has been rebranded under the PCS 7 Water Library naming in recent PCS 7 versions; the underlying block set and the Pump Manager faceplate remain functionally equivalent. The Industry Library (APL) is part of the standard PCS 7 delivery and is documented in the PCS 7 Engineering System help set. Search the Siemens support portal for "PCS 7 Water Library", "CIS_CK Pump Manager", and "APL Motor block" for the latest engineering manuals and example projects.