If the timeout cell is empty, which of these eleven steps is allowed to run itself? Eleven sequence steps have been delivered for this project's control system, spanning normal, failure, maintenance, restart and emergency-stop modes [TARGET]. Each names its systems, its objects, its precondition, its command, its feedback, its safe state and its transition pair. The timeout cell is the single field left unobtained on all eleven. The controls basis those steps implement treats an unobtained timeout as a bar on automatic execution, not as a commissioning detail to be settled later.
A Fixed Interval Passes Because It Checks Nothing
The states are inherited rather than invented here. S0 normal utility supply through S7 charge recovery, with a failure branch beside them, are defined in the heat-rejection basis and quoted by the controls basis without modification. So is the transition rule that governs the whole ring. It was written first for the staged-loading ladder: a stage may be admitted once the bus voltage and frequency depression caused by the previous stage has recovered into band, and a fixed interval may not be substituted.
The stated reason is that fixed intervals fail in both directions at once. Where the machine's transient is poor they stack successive depressions. Where it is good they spend ride-through budget for nothing. The recommendation names a five-second interval as the form that always "passes" because it checks nothing [TARGET]. A criterion-driven ladder is the only form an integrated test can disprove.
The controls basis adds three disciplines of its own. Every transition must be capable of being triggered in a real test. Every transition must name the party that initiates it and the default behaviour when that party is off the network. Every path into the failure branch must name who may reset it. The state-machine table itself publishes no seconds.
An Empty Timeout Slot Prohibits Automatic Execution
Any command in this project has to fit an eight-slot template, and the basis writes the treatment of each empty slot beside it [TARGET]. An empty precondition stops the step running automatically. An empty feedback point stops the command being automated at all, leaving it to be executed and recorded by hand. An empty timeout is graded as no obtained input and automatic execution is prohibited outright. An empty reset defaults to on-site confirmation. An empty evidence anchor makes the step unacceptable at handover.
The timeout row is the one that binds here. A measurable criterion with no bound on how long it may go unmet is a wait and not a transition. The bound is not left to judgement. The basis requires each timeout to be shorter than the development time of the consequence it guards, and it names two rates this project already holds. Primary-side liquid warms at about 2.4 K/min once heat-rejection capability reaches zero [TARGET], and loss of secondary flow drives computing equipment into throttling within 5 to 15 s [TARGET]. Worked back from those two, primary commands fall in a tens-of-seconds band and secondary criterion chains below a second [TARGET, derived in this draft from the two published rates and quoted from neither basis]. The prohibition lifts if the equipment suppliers return the detection and stabilisation times together with their declared behaviour on loss of supervision. That fills the timeout slot, and the same criterion rule stops barring automation and becomes an implementable ladder.
No Party Can Close the Timeout Column by Itself
Routing in the delivered file sends every held step to the party that owes it. Counting the timeout column alone, equipment suppliers hold four steps, the record engineer and suppliers jointly two, the authority and the record engineer three, the owner one and the commissioning authority one [TARGET]. No party can close the column by itself. Every timeout cell in that file still reads as to be confirmed.
Upstream of the file, the controls basis indexes sixteen named sequences with their template completeness marked per row, and three of those sixteen — black start, islanding and parallel operation with a live feeder — carry no obtained input in any slot [TARGET]. Those three are conditional branches, not selected schemes. The eleven delivered steps are mode steps, not the eight restoration states. They do not fill the timeout the restoration machine still lacks.
The eleven steps are not badly written. Their safe states are stated, their feedback points are named, and each carries a hold identifier against a review that has not been run. What is absent is the bound, and the basis's own treatment of an absent bound is a prohibition on automation.
Limits and open items
Confirmed: any command, interlock action or sequence step that cannot fill the eight-slot template may not enter a sequence of operations. An empty timeout prohibits automatic execution. [FACT]
The eleven delivered steps, the eight template slots, the holder split of four, two, three, one and one, the sixteen named sequences and the three empty branches remain register counts [TARGET]. The 2.4 K/min primary warming rate and the 5 to 15 s secondary-flow window remain the study rates the timeout rule is written against [TARGET]. The five-second fixed interval is the form the recommendation names in order to reject it [TARGET]. The tens-of-seconds and sub-second bands are derived in this draft [TARGET].
Open: detection and stabilisation times from equipment suppliers; declared behaviour on loss of supervision; the engineer-of-record bus-recovery envelope. Naming the party that collects the column is not the controls author's to do. The same basis records that its seven-party responsibility table is a design-side boundary claim until the owner approves it. The owner must appoint that collector before equipment enquiries go out, or the timeouts never become contract requirements at all. Nothing has been sealed. [HOLD]
Name the Bus-Recovery Criterion and Its Timeout
The useful question is not whether the next sequence file still has eleven rows. It is which measured bus recovery the owner will accept as the transfer, and after how long with no recovery the step aborts. Until that pair is written into the timeout cell, none of the eleven steps is allowed to run itself.
© 2026 K&K Data Service Inc. All rights reserved. Reproduction or republication is permitted only with clear attribution to K&K Data Service Inc. and a working hyperlink to the canonical URL of this article. Excerpts must preserve the technical context, maturity labels, assumptions, and limitations. No excerpt may imply project approval, field validation, certification, or endorsement that the original article does not state.
Source: K&K Data Service Inc., “Restoration Sequences Must Advance on Criteria, Not Fixed Delay,” https://www.kkdatasvc.com/lab/controls-epms-bms-and-dcim/state-machine-s0-s7-moves-on-criteria-not-delay/.
Discuss This Constraint. If your project record shows a different result, or the same failure domain under another name, we want to see it. Email inquiry@kkdatasvc.com or use the contact page.