Start a turbine or a pump step by step, and stop it safely

It checks the start conditions, also called permissives. For a small hydro unit: enough water in the forebay (headwater level), the inlet valve and the guide vanes closed, the breaker open, no trip latched and the emergency stop chain closed. For a pump: enough water in the well, the discharge valve closed and the motor stopped. If one condition is missing, the PLC does not start, and it tells you which one is missing.

After the start, the PLC runs one step at a time. Each step sends a command, waits for a feedback signal, such as a limit switch, a pressure or a speed, and has a timeout. If the feedback does not come in time, the PLC stops the sequence, raises a fault and runs the stop sequence.

Run the Step timeout scenario and watch the timer of step 3.

• Permissive. A condition that must be true before a step can start. It blocks the step. It does not stop a unit that already runs. Example: a pressure difference under 5% across the inlet valve before it opens.
• Interlock. A condition that the PLC watches while the unit runs. It raises an alarm or starts a normal stop. Example: a low forebay level.
• Trip. A condition that stops the unit at once and stays latched. You acknowledge it, clear its cause and reset it before a new start. Example: vibration high-high.

The PLC marks the first trip of an event as FIRST OUT. The alarms that come after it are often consequences of the first one, so the first out tells you where to look.

One Raspberry PLC 42 runs the sequence as a state machine: one state per step, each with its command, its feedback and its timer. The transmitters send 4-20 mA signals: level (LT), flow (FT), vibration (VT) and pressure (PT). Limit switches, the speed pickup (ST) and the breaker contacts go to digital inputs. The commands to the valves, the guide vanes and the breaker leave on digital and analog outputs.

The PLC sends states and alarms to an HMI or a SCADA, for example over Modbus TCP or MQTT, and keeps an alarm log with time stamps. You write the sequence in Python, Node-RED or C/C++ on the Debian system of the PLC. For a remote site, one optional board adds 4G or LoRa.

Read the case studies on these applications:

• Small hydro plant: Raspberry PLC 21 FLEX controllers with a CAN board run the turbine, and a Raspberry PLC 42 in a second cabinet reads the plant signals, such as the forebay level. The logic has the same three stages as this simulator: start, level control and safe stop. Read the case study
• Water network telecontrol: at each pumping station, an ESP32 PLC 21 starts and stops the pumps on the well level and reports over LoRaWAN. At the treatment plant, a Raspberry PLC 42 reads the 4-20 mA transmitters and the Modbus devices. Read the case study

What you see in this simulator is a general pattern. The thresholds, the times and the I/O list are examples, not the design of a real plant.

1. Feedback, not timers

Each step waits for a real signal: a limit switch, a pressure, a speed or a contact. A timer alone only proves that the command left the PLC. Use the timer as a timeout on top of the feedback.

2. Step timeouts and the way back

Set each timeout from the real travel time or ramp time, plus a margin. For every step, decide what the PLC does on a timeout. In this simulator, it latches a fault and runs the normal stop sequence.

3. Normal stop and quick stop

In a normal stop, the hydro unit unloads before the breaker opens. In a quick stop after a mechanical trip, such as high vibration, the guide vanes close along the fast ramp, the breaker opens near zero load and the inlet valve closes after the vanes. When the grid or the protection relay opens the breaker with load, the speed rises until the guide vanes close: that is a load rejection. Try it with the Grid trip fault. The closing speed of guide vanes and valves is limited by water hammer in the penstock. Your turbine supplier gives these limits.

A pump closes its discharge valve slowly before the motor stops. On a trip, the motor stops at once and the check valve stops the reverse flow. The surge protection of the pipe is part of the hydraulic design. The pump keeps pumping while the valve closes, so set the stop level with a margin for the closing time.

4. Protections that stay outside the sequence

The PLC sequence is process logic. The emergency stop is a hardwired safety circuit. The overspeed protection of a turbine, the generator protection relay and the motor protection of a pump work on their own. The PLC reads their state, runs the stop sequence and logs the event. It does not replace them.

5. Synchronization

With a synchronous generator, the voltage regulator (AVR) excites the generator near the rated speed. Then an automatic synchronizer, or a protection relay with a synchronism check, sends raise and lower pulses to the PLC speed loop and to the AVR, matches voltage, frequency and phase, and closes the breaker. The PLC enables it and waits for the breaker closed contact. With an induction generator, the breaker closes near synchronous speed and there is no synchronizer.

6. Vibration thresholds

4.5 and 7.1 mm/s are example values. Take your alarm and trip values from the machine supplier and from the ISO 20816 series, for example ISO 20816-5 for machine sets in hydro plants. Add a delay to the trip, so a short peak does not stop the unit.

7. 4-20 mA signals on 0-10 V inputs

The analog inputs of the Raspberry PLC 42 measure 0-10 V. For a 4-20 mA transmitter, add a precision shunt resistor: 500 Ω gives 2-10 V. To also see the high fault (21 mA or more, NAMUR NE 43), use a lower value such as 470 Ω. Check that your loop supply still gives the transmitter its minimum voltage. A reading of 3.6 mA or less means a broken wire or a failed transmitter. Treat it as a fault, not as a low level.

This list follows the simulator. Your plant may need more signals, for example bearing temperatures or a second pump.

One Raspberry PLC 42 has 12 analog inputs, 14 digital inputs, 10 digital outputs and 6 analog outputs, so one unit leaves spare I/O. For more units or more signals, add remote I/O over Modbus RTU on one of the two RS-485 ports. Check the input frequency of your speed pickup and the ratings of your loads in the datasheet. The outputs are transistor outputs: drive the breaker coil, the valve actuators and the motor contactor through interposing relays.

Full specs: Raspberry PLC 42 · Raspberry PLC family datasheet · all Raspberry Pi based devices.

These examples cover parts of this pattern. Some use an ESP32 PLC: the logic is the same.

• 4-20 mA level sensor reading
• Closed-loop current calibration on a Raspberry PLC
• Flow measurement with a pulse flow meter
• Solenoid valve control with a state machine
• Water pump control with float switches
• Dual pump station with LoRaWAN telemetry
• Node-RED dashboard for multi-station monitoring
• Water pumping project pack
• Remote site telemetry simulator: the same pumping station seen from the control room

More examples: PLC Solution Library · all simulators.