PLC Tank Level Control Example: Band and Watchdog Tests

This PLC tank level control example combines a two-probe filling band with a timed diagnostic. You will calculate the fill request, follow a 60-second continuous low-level timer and test what happens when the timer's enabling condition disappears at its threshold. You will also use a small fictional volume balance to see why probe spacing alone cannot predict a cycle rate.

The example is a disconnected software model. FillCommand is a virtual command, not evidence that a pump is running or transferring liquid. SupplyAvailable is a supplied eligibility value. The lesson provides no pressure-switch specification, pump protection design, process installation or guaranteed response to a real fault.

For a separate latched-trip and manual-reset exercise, use float-switch pump control. This page focuses on a different question: what does a continuous-low timer actually prove, and what does it stop observing when its input goes false?

Define the probe meanings and filling band

LowCovered means the fictional level is at or above the lower threshold. HighCovered means it is at or above the upper threshold. Both are Boolean observations with the declared ordering below.

A fill request begins below the lower threshold. It continues in the middle band if it was already active, and clears at the upper threshold. If it was inactive when the level entered the middle band, it stays inactive. That dependence on previous state is the hysteresis behaviour being studied.

Flag the inconsistent tuple as InvalidProbes. Clear the fill request and command while it is present under this exercise's policy. The inconsistency does not uniquely prove a defective probe or damaged cable. It says the supplied observations do not match the assumed ordering; the source of that disagreement remains unresolved.

Do not attach a physical percentage or height to these Booleans without defining the tank and measurement model. A probe at a given height does not automatically represent the same percentage of volume in every vessel shape. The quantitative section later uses a declared constant-area tank specifically to make its volume arithmetic valid.

Separate demand, command and diagnostic inputs

Use FillDemand as the remembered request. ExerciseEnabled, SupplyAvailable and ValidProbes determine eligibility. In this version, losing eligibility clears FillDemand. Restoring eligibility in the middle band therefore leaves the model idle until a new below-low condition occurs.

ValidProbes = NOT HighCovered OR LowCovered
Eligible = ExerciseEnabled AND SupplyAvailable AND ValidProbes

If NOT Eligible:
    FillDemand = false
Else:
    FillDemand = NOT HighCovered AND (NOT LowCovered OR PreviousFillDemand)

FillCommand = Eligible AND FillDemand
WatchInput = FillCommand AND NOT LowCovered

Initialise FillDemand false for a fresh exercise. Calculate WatchInput from the newly updated command and current LowCovered value. Keep a single writer to the demand state and derive the command afterwards so a reader can follow the evaluation order.

WatchInput means “the virtual fill command is true while the lower threshold is not reported covered”. It does not mean a pump has run at full output, nor does it measure net inflow. That precise wording prevents a timer result from becoming an unsupported diagnosis.

The start-stop exercise explains holding-state patterns. The ladder logic simulator guide explains why a sequential model can show different results if you read old values before their assignments.

02

Give the diagnostic a narrow, testable meaning

The timer input is WatchInput and its preset is 60 seconds. LowWhileCommanded is the timer completion result. In this model it clears whenever WatchInput becomes false; it is not a latched alarm and has no acknowledgement input.

The diagnostic therefore means that the model has observed its qualifying condition over a continuous timed interval. It does not identify a closed valve, lack of liquid, air in a line, a detector issue or any other unique physical cause. Those possibilities cannot be distinguished from these few values alone.

Keep InvalidProbes as a separate result. Also define SupplyUnavailable as NOT SupplyAvailable if you want the current supply-input condition visible even while there is no fill command. Avoid combining unrelated conditions into a single unlabeled lamp; a reader should be able to tell which condition is being reported.

A cleared LowWhileCommanded result does not necessarily mean a problem was resolved. If SupplyAvailable becomes false, FillCommand clears and WatchInput becomes false, resetting the timer. The timed diagnostic can disappear precisely because the programme is no longer issuing the command it monitors. The separate supply indication preserves the reason available in the model.

Read the timer interface before implementing it

The CODESYS TON reference describes an on-delay block whose rising input starts timing and falling input resets it. Its Q is false with IN false and becomes true when the enabled delay has elapsed. ET provides elapsed time.

Schneider Electric's TON interface for the documented Machine Expert version similarly relates Q to IN, ET and PT and requires a declared instance. Check the actual tool's types, invocation and startup rules rather than assuming all timer implementations are interchangeable.

An illustrative structured text fragment is:

tLowWatch(IN := FillCommand AND NOT LowCovered, PT := T#60s);
LowWhileCommanded := tLowWatch.Q;
InvalidProbes := HighCovered AND NOT LowCovered;
SupplyUnavailable := NOT SupplyAvailable;

Call the timer after calculating FillCommand and call it on evaluations where its input is false as well. Skipping an invocation is not the same programme action as invoking it with a false input. This fragment is not a complete compiled project for every vendor, and it supplies no physical protective function.

03

Calculate a continuous-low timing trace

For reproducible arithmetic, use this explicit timestamp model: the first true WatchInput evaluation stores the current timestamp and reports ET zero. Subsequent true evaluations report the time since that start, capped at 60000 ms. A false evaluation clears the start, ET and Q. Use monotonic supplied timestamps.

Begin with FillDemand false, ExerciseEnabled true and all timer state reset. The table shows values after each evaluation. 1 means true. Times and elapsed values are milliseconds.

At 61000 ms the lower threshold becomes covered, so WatchInput goes false even though filling continues through the band. The diagnostic clears. When LowCovered becomes false again at 62000 ms, a new continuous interval starts. It does not resume the previous 60 seconds.

At 123000 ms supply permission disappears. The command and timer clear. SupplyUnavailable is true on that row, although the timed diagnostic is false. At 124000 ms supply returns while the tank is below low, so the level-driven model begins filling again without a separate Start action.

These are calculated model results, not native PLC measurements. A physical signal change entirely between supplied observations is not represented by this trace. State your acquisition and observation assumptions before drawing conclusions from a real programme's recorded timing.

Check the exact-threshold race explicitly

Run a separate fixture where WatchInput started at time zero. At 60000 ms, supply LowCovered true with HighCovered false and supply available. Because the current input is false for the timer, the timer resets and LowWhileCommanded is false at that evaluation.

Compare that with the main trace's 60000 ms row, where LowCovered remains false and the timer completes. The time is the same; the current qualifying condition differs. A claim that the diagnostic must always appear exactly one minute after a fill began ignores this condition.

Test one observation just before the threshold, one exactly at it and one after it with the condition still true. Then repeat with the condition clearing at each point. Record timer input as well as elapsed time so you can explain why a result is true or false.

If you want to remember that the diagnostic was previously active, add a separate history or acknowledgement policy. Do not change the timer itself into an undocumented latch. The flashing-beacon exercise separates a timed sequence from remembered acknowledgement state.

04

A fictional volume balance explains cycle time

Use a separate idealised tank for arithmetic: total capacity 1000 litres, constant cross-sectional area, lower threshold at 400 litres and upper threshold at 900 litres. Assume a constant outlet flow of 10 litres per minute and an inlet of 60 litres per minute whenever the fill command is active. Ignore switching delays, measurement uncertainty and all hydraulic dynamics.

The volume band is 900 minus 400, or 500 litres. During filling, net inflow is 60 minus 10, or 50 litres per minute. Filling across the band takes 500 divided by 50, or ten minutes. With the inlet off, draining across the band takes 500 divided by 10, or fifty minutes.

Under those exact assumptions, one full repeat cycle takes sixty minutes, or one cycle per hour. The result depends on the flows as well as the band volume. It cannot be inferred from “two probes” or a percentage difference alone.

Now reduce the fictional inlet to 40 litres per minute while the outlet stays at ten. Net filling becomes 30 litres per minute, so the fill interval is about 16.67 minutes and the full cycle about 66.67 minutes, or 0.9 cycles per hour. The probe positions did not change, but the cycle rate did.

If inlet equals outlet while commanded, the ideal net filling rate is zero and the upper threshold is never reached from below in this simplified model. A sixty-second diagnostic might then indicate prolonged low condition, but it would still not identify why those flows are equal. The lesson's Boolean inputs do not measure either flow.

Relate that arithmetic to the watchdog carefully

In the first fictional flow case, start at 350 litres. Reaching the 400-litre lower threshold requires fifty litres of net gain. At fifty litres per minute, that takes one minute. If the observation at exactly one minute reports LowCovered true, the continuous-low timer resets under the previously defined priority.

That example is not a recommended alarm preset. It shows that choosing a timeout requires more than copying a round number. A legitimate fill could reach the threshold at, before or after that time depending on starting volume and net flow.

The fill-band cycle calculation also differs from the below-low diagnostic interval. The former spans 400 to 900 litres; the latter ends when the lower threshold is first reached. Treating both as “fill time” can produce a misleading test or an unsuitable expectation.

For a programme extension, keep the assumed starting volume, flow units and measured or simulated source of each quantity in the record. Do not present an ideal balance as proof that a real vessel will fill at that rate.

05

Test the middle band and invalid tuple separately

Prepare two middle-band fixtures with LowCovered true, HighCovered false and supply available. In the first, previous FillDemand is true; filling continues. In the second it is false; the command remains false. The current level tuple alone does not determine the result.

Now remove supply permission during an active middle-band fill. This model clears demand. Restoring supply with the same middle-band tuple leaves it idle, because the remembered request was discarded. If you require resumed filling, define a different memory policy and test it rather than assuming the original rung provides it.

Apply HighCovered true while LowCovered false. InvalidProbes becomes true, demand and command clear, and the low-command timer resets. The indication says the tuple is inconsistent with the declared ordering. It does not uniquely diagnose a probe, relay, wire or process condition.

The float-switch exercise adds a separate source trip and fresh-reset rule. Keep that policy distinct from this page's direct supply eligibility so readers can understand which behaviour they are implementing.

Deliberate changes that reveal hidden assumptions

Time low level regardless of command. Replace WatchInput with NOT LowCovered. The timer can then complete while filling is not commanded, including when supply is unavailable. That may be a useful different diagnostic, but it is not the same condition as this lesson's low-while-commanded timer.

Accumulate separate low intervals. Preserve elapsed time across a false WatchInput evaluation. The second interval in the main trace can complete earlier. That changes continuous timing into accumulated timing and needs a new specification.

Assign the alarm from an old Q value. Move the result assignment ahead of the timer call in a sequential model. Compare end-of-evaluation values at the threshold. Keep call order in the report rather than treating a delayed display as unexplained behaviour.

Combine all diagnostics into one unlabeled output. Compare a prolonged low-command condition, unavailable supply and invalid tuple. Preserve the separate reasons so a learner can explain which evidence exists, even if a later interface also provides a summary indication.

Claim pressure permission proves dry-run protection. Remove that claim from the project description. The exercise does not provide the sensor, installation, failure analysis or protective design needed to establish it.

Use the exercise to evaluate training depth

A South African learner comparing PLC courses can ask whether tank lessons distinguish a command from actual running, continuous from accumulated timing, and detection from diagnosis. A syllabus mentioning level control does not demonstrate those distinctions. The online PLC training guide covers wider course-selection questions.

For a KwaZulu-Natal learner, a Gauteng evening class or a Western Cape college project, the Boolean and volume examples can be prepared offline and checked later in software. These are possible learning settings, not claims about a dairy installation, provider premises or current bookings.

Keep the level meanings, demand-memory policy, timer definition, normal trace and threshold-clearing fixture together. Label the volume balance as fictional and record its units and assumptions. State which results were calculated and which were observed in a named environment.

The instrumentation technician learning guide connects this exercise to wider signal interpretation. The process-control training guide helps place simple on/off logic alongside broader control topics. Completing this lesson does not establish a formal qualification or physical commissioning result.

Continue with relevant simulation material

Inspect the PLC timer learning page for related timing concepts and current access conditions. Compare its stated objectives with this article. The complete diagnostic trace and volume model here are not claimed to be automatically graded there.

The sensor learning material is relevant when input interpretation is the main difficulty. Preserve your own test notes independently of product progress records.

Use the pump-alternation exercise when you are ready to separate demand from selection between two available commands. Return to the PLC examples collection to choose other projects by the specific behaviour you want to investigate.

06

Questions about PLC tank-level control

Does the 60-second alarm identify an upstream fault?

No. It identifies the specified continuous low-while-commanded condition in the model. Determining a physical cause requires additional observations and a defined investigation.

Why does the diagnostic clear when supply becomes unavailable?

The command clears, so WatchInput becomes false and resets the timer. The separate SupplyUnavailable indication remains true. A cleared timer result does not prove normal operation has resumed.

Why can the same middle-band levels produce different commands?

The filling band uses remembered demand. A previously active fill continues through the band, while an inactive request stays inactive. The initial and interruption policies determine that memory.

What should I ask an AI tutor to calculate?

Supply the timestamp trace and ask for WatchInput, ET and Q at 60000 and 61000 ms. Then change LowCovered to true at exactly 60000 ms and ask why the result changes. Check the current input and reset rule yourself rather than accepting an answer based only on elapsed time.