S7-1200 Two-Pump Duty-Standby Ladder Logic in TIA Portal V16

Duty/standby sequencing for a lifting-station or hydraulic power-pack pump pair is a classic PLC programming exercise that shows up in nearly every industrial automation curriculum. The job looks trivial on paper (alternate two pumps every 12 hours) but breaks down into several interlocking subsystems once you account for wear, hydraulics, operator override, and field-device health. This article builds a production-grade implementation for a SIMATIC S7-1200 CPU programmed in TIA Portal V16 using ladder logic, with an SCL implementation of the sequencing function block for clarity.

The deliverable is a single re-usable FB_PumpSequence that handles:

• 12-hour cyclic duty/standby rotation (or earlier changeover on stop)
• Asymmetric wear distribution (pump 1 runs more often than pump 2)
• Start counter, totalised run hours, and "next-start" pump selection
• Manual override with short-press / long-press semantics
• Breaker / isolator health feedback that gates every switchover
• Hydraulic no-movement interlock that defers timed changeover when the cylinder is in motion

1. Overview of the Control Problem

A lifting station typically drains a sump or charges a hydraulic accumulator using two identical pumps. The intent of dual pumps is redundancy: if the duty pump fails, the standby must come online within a defined time, and the station must continue to operate. The PLC is the only device that knows which pump is currently duty, when to rotate, and whether the standby is healthy enough to be started.

The three rules the controller must enforce:

1. Equal wear over the long term. Run hours and start counts must not diverge so far that one pump becomes the de-facto primary.
2. Asymmetric wear over the short term. In practice, you want one pump to be the "fresher" unit at any given moment so that a simultaneous failure of both pumps is unlikely.
3. Fail-safe switchover. If the duty pump trips, the standby must start before the process goes into alarm, but only if the standby is electrically and mechanically ready.

2. Prerequisites

Before opening TIA Portal, confirm the following items are in place.

Reference the SIMATIC S7-1200 Programmable Controller System Manual (entry ID 109759862) and the STEP 7 Professional V16 in the TIA Portal Programming and Operating Manual (entry ID 109773506) for tag, timer, and FB limits.

3. System Architecture and I/O Allocation

The PLC sits between the field sensors and the contactor coils. A clean tag name convention pays off in ladder logic because each network becomes self-documenting.

The i_Man_Swap input is debounced by an IEC timer with a 3 s preset. A press shorter than 3 s is interpreted as "request the next start to be the other pump." A press longer than 3 s is interpreted as "stop the running pump and start the other one now."

4. Control Philosophy: Duty / Standby Sequencing

The sequence has three states: idle, running on duty, and running on standby after fault. Transitions are governed by two clocks: a 12-hour process timer that requests changeover, and a stop event from the contactor feedback that requests immediate changeover on the next call to start.

The classic 12-hour cyclic changeover is implemented with a single TON timer (tag T_DutyHours) preset to PT = 12 h = 43 200 000 ms. When the duty pump runs continuously for 12 hours, the timer Q output flags a changeover request. The changeover itself is a soft sequence:

1. If the standby is healthy, start the standby.
2. Wait until i_Px_Run confirms the standby is up (preset 2 s in a TOF debounce).
3. Stop the duty pump.
4. Reset the timer and update the duty/standby pointers in the instance DB.

5. Function Block Design: FB_PumpSequence

Encapsulate the logic in an FB so the same code can be dropped into any lifting station. The block is added once to OB1 (or a cyclic OB such as OB35 if you want a fixed 100 ms scan) and called with a single instance DB.

5.1 Block Interface

5.2 SCL Implementation (mirrors the ladder)

The function block is shown in SCL for readability. The ladder program uses the same boolean equations; treat each IF block as one or two ladder networks.

FUNCTION_BLOCK FB_PumpSequence
VAR_INPUT
    i_Start        : BOOL;
    i_P1_Healthy   : BOOL;
    i_P2_Healthy   : BOOL;
    i_P1_Run       : BOOL;
    i_P2_Run       : BOOL;
    i_InMotion     : BOOL;
    i_Man_Next     : BOOL;
    i_Man_Swap     : BOOL;
    DutyHours_PT   : TIME := T#12h;
    DutyPattern    : INT  := 2;
END_VAR
VAR_OUTPUT
    q_P1_Coil : BOOL;
    q_P2_Coil : BOOL;
    q_Alarm   : BOOL;
END_VAR
VAR RETAIN
    StartCount_P1 : DINT;
    StartCount_P2 : DINT;
    RunHours_P1   : REAL;
    RunHours_P2   : REAL;
END_VAR
VAR
    DutyPump       : INT := 1;
    NextPump       : INT := 2;
    PatternStep    : INT := 0;
    DutyTimer      : TON;
    ConfirmTimer   : TON;
    SwapLongTimer  : TON;
END_VAR

BEGIN
    // ---------- 1. Operator manual inputs ----------
    SwapLongTimer(IN := i_Man_Swap, PT := T#3s);

    IF i_Man_Next AND NOT SwapLongTimer.Q THEN
        // Short press: swap "next start" pointer only
        IF NextPump = 1 THEN NextPump := 2; ELSE NextPump := 1; END_IF;
    END_IF;

    IF SwapLongTimer.Q THEN
        // Long press: immediate changeover, but only if no movement
        IF NOT i_InMotion THEN
            IF DutyPump = 1 THEN DutyPump := 2; ELSE DutyPump := 1; END_IF;
            PatternStep := 0;
            DutyTimer(IN := FALSE);
        END_IF;
    END_IF;

    // ---------- 2. Determine which pump is duty and which is standby ----------
    IF NextPump <> 0 THEN
        DutyPump := NextPump;
        NextPump := 0;          // consume the manual selection
    END_IF;

    // ---------- 3. 12-hour cyclic timer ----------
    // Only accumulate time on the running duty pump
    IF (DutyPump = 1 AND i_P1_Run) OR (DutyPump = 2 AND i_P2_Run) THEN
        DutyTimer(IN := TRUE, PT := DutyHours_PT);
    ELSE
        DutyTimer(IN := FALSE);
    END_IF;

    // Changeover request from timer, but defer during movement
    IF DutyTimer.Q AND NOT i_InMotion THEN
        IF DutyPump = 1 AND i_P2_Healthy AND NOT i_P2_Run THEN
            q_P2_Coil := TRUE;                  // start standby first
            ConfirmTimer(IN := NOT i_P2_Run, PT := T#2s);
            IF NOT ConfirmTimer.Q AND i_P2_Run THEN
                q_P1_Coil := FALSE;             // stop duty only after confirmed
                DutyPump := 2;
                PatternStep := PatternStep + 1;
                DutyTimer(IN := FALSE);
            END_IF;
        ELSIF DutyPump = 2 AND i_P1_Healthy AND NOT i_P1_Run THEN
            q_P1_Coil := TRUE;
            ConfirmTimer(IN := NOT i_P1_Run, PT := T#2s);
            IF NOT ConfirmTimer.Q AND i_P1_Run THEN
                q_P2_Coil := FALSE;
                DutyPump := 1;
                PatternStep := PatternStep + 1;
                DutyTimer(IN := FALSE);
            END_IF;
        END_IF;
    END_IF;

    // ---------- 4. Start-on-demand logic ----------
    IF i_Start AND NOT i_InMotion THEN
        IF DutyPump = 1 AND i_P1_Healthy AND NOT i_P1_Run THEN
            q_P1_Coil := TRUE;
        ELSIF DutyPump = 2 AND i_P2_Healthy AND NOT i_P2_Run THEN
            q_P2_Coil := TRUE;
        END_IF;
    END_IF;

    // ---------- 5. Stop-on-demand (release start request) ----------
    IF NOT i_Start THEN
        q_P1_Coil := q_P1_Coil AND i_P1_Run AND (DutyPump <> 1) AND i_Start;
        // (Simplified: drop coils when process no longer demands and no
        // changeover in progress.)
    END_IF;

    // ---------- 6. Counters and run hours ----------
    IF i_P1_Run AND NOT q_P1_Coil THEN // rising edge detection done in ladder
        ; // start counter increment handled in rising-edge network
    END_IF;
    RunHours_P1 := RunHours_P1 + 0.0002778; // add 1 s per OB1 scan when running
    RunHours_P2 := RunHours_P2 + 0.0002778;

    // ---------- 7. Alarm: no healthy pump available ----------
    q_Alarm := i_Start AND NOT (i_P1_Healthy OR i_P2_Healthy);

END_FUNCTION_BLOCK

5.3 Ladder Network Layout

The ladder program is organised in ten networks. Network numbers must match the comments so they survive renumbering.

6. Asymmetric Wear Distribution

Equal run hours is the wrong target. The right target is predictable wear so that maintenance can be scheduled with a buffer. A common field pattern is to keep the duty/standby ratio at 2:1 (pump 1 takes two consecutive duty windows, pump 2 takes one). The FB exposes the ratio as DutyPattern.

// PatternStep counts completed changeovers. Modulo arithmetic picks the
// next duty pump from the configured sequence.
CASE DutyPattern OF
    1: // 50/50 alternation
        IF (PatternStep MOD 2) = 0 THEN DutyPump := 1; ELSE DutyPump := 2; END_IF;
    2: // P1, P1, P2
        CASE (PatternStep MOD 3) OF
            0,1: DutyPump := 1;
            2  : DutyPump := 2;
        END_CASE;
    3: // P1, P1, P1, P2
        CASE (PatternStep MOD 4) OF
            0,1,2: DutyPump := 1;
            3    : DutyPump := 2;
        END_CASE;
END_CASE;

The PatternStep counter is incremented only on a successful changeover (standby confirmed running, then duty stopped). If the standby is unhealthy, the changeover is blocked, the pattern does not advance, and an alarm is raised so the operator can intervene.

7. Manual Override, Breaker Health, and Start Counting

7.1 Breaker / Isolator Feedback

Every q_Px_Coil must be gated by i_Px_Healthy. The "healthy" signal is the AND of:

• Motor protection breaker (or fused isolator) in the closed position
• Thermal overload relay in the reset (NC contact) state
• Optional: low oil-pressure switch for a hydraulic power pack

If i_Px_Healthy is FALSE, the FB refuses to start pump X, and q_Alarm goes TRUE if the process is still demanding a pump. The operator HMI must show which pump is in "not healthy" state and why (breaker open, overload tripped, low pressure).

7.2 Manual Selection Semantics

7.3 Start Counting and Run Hours

Two statistics are kept per pump and made visible on the HMI:

• StartCount_Px — total number of contactor closures. Use an IEC CTU with a rising-edge contact wired to the contactor auxiliary. Limit the count to DINT (2 147 483 647) which is decades of headroom.
• RunHours_Px — total running time in hours. Accumulate the OB1 scan time in seconds on every cycle where i_Px_Run is true. Store in a REAL with retain attribute.

For a 10 ms OB1 cycle, the per-scan increment is 0.002777 hours (10 ms = 1/360 000 h). For a 100 ms cycle, use 0.0002777 h. The run-hours total is accurate to within one scan period over the life of the pump.

8. Hydraulic Interlock: No-Movement Switchover

For a hydraulic power pack, the changeover should never interrupt a cylinder movement in progress. The machine controller provides an i_InMotion signal (TRUE while a valve is commanded open and a cylinder is moving). The FB defers every changeover request (timed or manual long-press) until i_InMotion drops. If a changeover is requested during movement:

1. The request is latched internally in a static BOOL SwapPending.
2. The current duty pump continues to run.
3. When i_InMotion goes FALSE, SwapPending is honoured within one scan.

This logic prevents the pressure dip that occurs when one pump stops before the other is up to speed. In a lifting station with a sump, the equivalent interlock is "defer if sump is above high-high level," which is normally satisfied by the level switch itself, but the same latched-pending pattern applies.

9. HMI Tag Mapping

Build a WinCC screen inside TIA Portal V16 with the following tags pulled from the FB_PumpSequence instance DB.

Use the WinCC Engineering V16 in TIA Portal manual (entry ID 91174767) for tag-prefix configuration. If you name the instance DB DB_Sequence, all tags are accessible as DB_Sequence.RunHours_P1 from the HMI tag list.

10. Commissioning and Verification

Walk through the following checklist with the pumps locked out and a test PSU feeding the contactor coils. The PLC outputs can be observed in the watch table of TIA Portal before the contactors are energised.

1. Tag monitor. Open the instance DB in "Monitor / Modify" and confirm every input toggles when the corresponding field device is actuated. Forcing inputs here is acceptable only for the commissioning engineer with the local selector in OFF.
2. Healthy gating. With the breaker for P1 open, force i_Start=TRUE. Confirm q_P1_Coil=FALSE, q_P2_Coil=TRUE, and q_Alarm=FALSE (since P2 is healthy). Open the P2 breaker, repeat, and confirm q_Alarm=TRUE.
3. Manual short press. In ladder, set i_Man_Next=TRUE for one scan, then clear. Confirm the NextPump tag flipped.
4. Manual long press. Set i_Man_Swap=TRUE for 4 s. Confirm DutyPump flipped and the standby started first, then the duty stopped, with the make-before-break order.
5. 12-hour timer. Temporarily set DutyHours_PT = T#30s in the instance DB and run a full cycle. Confirm the changeover happens with the standby confirmed running before the duty drops out.
6. No-movement interlock. Force i_InMotion=TRUE and trigger a changeover. Confirm the changeover is deferred and honoured when i_InMotion goes FALSE.
7. Counters. Force i_P1_Run for 10 scan cycles and confirm StartCount_P1 increments once on the leading edge, and RunHours_P1 advances by 10 x (scan time in seconds).
8. Power-cycle retention. Stop the CPU, repower, and confirm the start counts, run hours, and pattern step all survive. If they reset, the RETAIN attribute is missing on those tags.
9. Local / remote. Switch the local selector to HAND and confirm the PLC outputs go OFF and the field contactors respond to the local pushbuttons. Return the selector to AUTO and confirm normal sequencing resumes on the next call to start.

11. Troubleshooting Matrix

For deeper diagnosis, open the CPU's diagnostic buffer via Online > Diagnostics > Diagnostic Buffer in TIA Portal. SF (system fault), BF (bus fault), and OB85 events point to missing or wrong I/O addressing and are the usual culprits on first power-up.

12. Field-Proven Caveats

The following items are not in any single manual but are responsible for the majority of lifting-station callbacks. Treat them as commissioning prerequisites, not nice-to-haves.

• Non-return valves. Each pump discharge needs a check valve rated for the maximum system pressure, with a cracking pressure lower than the pump's dead-head pressure. Without the check valve, a stopped pump back-spins from the common manifold and the contactor auxiliary bounces, confusing the running logic.
• Isolation valves. Suction and discharge isolation on each pump allow a pump to be removed for service while the partner pump keeps the station running. The PLC must not attempt to start a pump whose suction or discharge isolation is closed — wire limit switches from the valves into the healthy chain.
• Run-dry protection. A level switch or conductivity probe in the sump must inhibit both pumps below a minimum level. The current implementation starts the pumps on i_Start; gate that input with the low-level signal to avoid burning out the mechanical seal.
• Thermal overload relay. Set the overload to the motor's full-load current from the nameplate, not the breaker rating. The overload's NC contact is part of the healthy chain.
• Contactor coil surge. Use RC snubbers on the contactor coils, especially on relay-output DQ modules, to suppress the back-EMF that otherwise couples into the analog level probe.