🎓 Lesson 12
D5
State Machine Design: Defining Modes, Transitions, and Failure Handling
A state machine is like a smart switchboard that tracks what mode a power system is in—like 'charging', 'supplying power', or 'shutting down'—and automatically changes modes only when safe, clear conditions are met.
🎯 Learning Objectives
- ✓ Design a 5-state FSM for an off-grid solar-diesel-battery hybrid system using UML statechart conventions
- ✓ Analyze system safety by identifying and eliminating invalid transitions (e.g., bypassing battery low-SoC lockout)
- ✓ Explain how watchdog timers and hardware interlocks integrate with software FSMs to enforce fail-safe degradation
- ✓ Apply failure-mode-and-effects analysis (FMEA) to prioritize critical transitions requiring redundancy or voting logic
📖 Why This Matters
In remote mining camps or autonomous drilling sites powered by off-grid hybrid systems, a single misstep—like starting a diesel generator while batteries are deeply discharged—can cause catastrophic voltage collapse, equipment damage, or unplanned downtime costing $50k+/hour. State machines aren’t abstract theory; they’re the embedded logic that turns a collection of inverters, charge controllers, and generators into a coordinated, self-protecting power plant—even during sensor failures or communication blackouts.
📘 Core Principles
State machines in power systems operate on three foundational layers: (1) States represent stable, observable operating conditions (e.g., 'Solar-Only', 'Battery-Discharge', 'Gen-Assist'), each with defined entry/exit actions and invariants (e.g., 'SoC ≥ 20% required in Battery-Discharge'). (2) Transitions are guarded by Boolean conditions (e.g., 'if SoC < 15% AND grid unavailable → trigger Gen-Start'). (3) Failure handling is built-in via error states (e.g., 'Isolation-Fault') and recovery policies (e.g., 'auto-retry after 60s unless thermal shutdown asserted'). Real-world implementations use hierarchical FSMs (HFSMs) to manage complexity—e.g., a top-level 'Energy Management' FSM delegates battery-specific logic to a nested 'BMS-State Machine'.
📐 Transition Guard Condition Reliability Index (TGRI)
TGRI quantifies the robustness of a transition guard against sensor noise, latency, or calibration drift. It guides design decisions on filtering, hysteresis, and redundancy. A TGRI < 0.7 indicates high risk of spurious or missed transitions.
Transition Guard Reliability Index (TGRI)
TGRI = 1 − √[ (δ_SoC / ΔSoC_guard)² + (δ_Load / ΔLoad_guard)² + (δ_Pmax / ΔPmax_guard)² ]Quantifies confidence that a transition guard will fire correctly despite measurement uncertainty.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| δ_SoC | SoC measurement uncertainty | fraction | Absolute uncertainty in state-of-charge reading (e.g., ±0.03 for ±3%) |
| ΔSoC_guard | SoC guard margin | fraction | Distance from current value to guard threshold (e.g., 0.15 if SoC = 70% and guard = 85%) |
| δ_Load | Load measurement uncertainty | fraction | Relative uncertainty in real-time load measurement |
| ΔLoad_guard | Load guard margin | fraction | Normalized distance to load-based transition threshold |
| δ_Pmax | Solar max power uncertainty | fraction | Uncertainty in forecasted or rated solar capacity |
| ΔPmax_guard | Pmax guard margin | fraction | Normalized distance to solar power threshold |
Typical Ranges:
Commercial-grade SoC sensors (Coulomb counting + voltage fusion): ±0.02 – ±0.05
Industrial energy meters (Class 0.5S): ±0.005 – ±0.025
💡 Worked Example
Problem: A transition from 'Solar-Only' to 'Battery-Discharge' is guarded by: 'SoC ≤ 85% AND Load > 0.9 × P_solar_max'. Sensor specs: SoC accuracy = ±3%, load meter accuracy = ±2.5%, P_solar_max uncertainty = ±5%. Calculate TGRI.
1.
Step 1: Compute worst-case relative uncertainty: √[(0.03/0.15)² + (0.025/0.9)² + (0.05/0.9)²] = √[0.04 + 0.00077 + 0.00309] ≈ √0.0439 ≈ 0.209
2.
Step 2: Apply TGRI formula: TGRI = 1 − (worst-case uncertainty) = 1 − 0.209 = 0.791
3.
Step 3: Compare to threshold: 0.791 > 0.7 → transition guard is robust; no hysteresis needed per IEC 62443-3-3 Annex F guidance.
Answer:
The TGRI is 0.791, which exceeds the recommended minimum of 0.7, indicating acceptable reliability for this guard condition under field tolerances.
🏗️ Real-World Application
At the Diavik Diamond Mine (Northwest Territories, Canada), the 12 MW off-grid hybrid system uses a hierarchical FSM implemented in IEC 61131-3 Structured Text on Siemens S7-1500 PLCs. During a winter blackout event, the FSM detected rapid SoC decline (<10%/hr), suppressed non-critical loads, entered 'Critical-Backup' state, and sequenced diesel generator start-up *only after* verifying battery voltage stability (>48 V for 5 s) and exhaust temperature <60°C—preventing cold-start damage. This FSM logic reduced unplanned outages by 83% over legacy timer-based controls (Diavik 2022 Reliability Report).
✏️ Design Exercise
Given: A solar-battery-diesel microgrid serves a remote assay lab (critical load = 45 kW, non-critical = 22 kW). Battery: 500 kWh LiFePO₄, SoC range 10–100%. Generator: 100 kVA, min run time = 30 min, cooldown = 15 min. Design the FSM: (a) List all valid states (min. 4), (b) Define 3 critical transitions with guards and entry actions, (c) Identify one unsafe transition and propose a hardware-enforced interlock.
📋 Case Connection
📋 Alaskan Remote Research Station Power Resilience Upgrade
Designing a resilient, low-maintenance hybrid power system capable of sustaining uninterrupted operation through extreme...