Generator transfer switch on an Arduino Uno

// Generator transfer switch: the control logic of an automatic transfer
// switch (ATS), modeled with low-voltage stand-ins. Two contactors, UTILITY
// and GENERATOR, feed one load and may NEVER both be closed.
//
// SAFETY. This is a teaching model. Real transfer switches are listed
// equipment, installed by a licensed electrician to the code. A generator
// that is back-fed into a building's wiring, or into a panel, without a
// proper transfer switch energizes the utility lines outside and kills line
// workers. Nothing here is for connecting to a building, a panel or a real
// generator.
//
//   D2   generator ready, in: high from a slide switch (the engine's "running
//        and voltage OK" contact in a real unit)
//   D3   utility present, in: the 12 V utility stand-in through a 10k / 4.7k
//        divider, about 3.8 V when the utility is up and 0 V when it is out
//        (a real unit uses a voltage-sensing relay or module, such as a
//        ZMPT101B on a small AC source)
//   D4   AUTO selector, in, pulled up, low when the AUTO switch is on
//   D5   GEN selector, in, pulled up, low when the GEN switch is on
//        (neither on: OFF. Both on is not a position a real selector has, so
//        it is treated as OFF.)
//   D6   UTILITY contactor, out, through a 1k to an NPN that pulls the coil
//   D7   GENERATOR contactor, out, the same
//   D8   generator START, out, an LED here (a dry contact to the engine)
//   D9   bench fault button, in, pulled up: see HARDWARE LOCKOUT
//
// HARDWARE LOCKOUT. Each coil gets its 5 V through the OTHER contactor's
// normally closed contact. While the generator contactor is pulled in, the
// utility coil has no supply however the pins are driven, and the same the
// other way. So even if this code failed and drove both outputs high, the
// second contactor could not pull in. Real units add a mechanical interlock
// too. Limits of the wiring: if both coils are energized at the very same
// moment from both released, both can start to pull in, which is one more
// reason the code leaves a dead time and why a real mechanical interlock
// matters. Hold the bench fault button to drive both outputs on and watch
// the hardware keep only one closed. The button is a bench demonstration of a
// firmware fault, not a feature.
//
// BREAK BEFORE MAKE. A contactor is opened, then nothing closes for DEAD_MS,
// then the other one closes. The dead time is also applied at power on.
//
// AUTO SEQUENCE (times scaled down so a run takes seconds; real units use
// adjustable timers, minutes for the retransfer and the cool-down):
//   LOST_MS          5000  utility must stay out this long before starting
//   READY_STABLE_MS  3000  generator ready for this long before transfer
//   START_TIMEOUT_MS 15000 no ready by then: release start, lock out
//   RETURN_MS        10000 utility back and stable this long before retransfer
//   COOL_MS          5000  generator keeps running unloaded after retransfer
//   DEAD_MS          2000  both contactors open between a break and a make
// MANUAL: OFF opens everything and stops the generator, GEN starts it and
// transfers once it is stable, whatever the utility does.

const int PIN_READY = 2;
const int PIN_UTIL_SENSE = 3;
const int PIN_AUTO = 4;
const int PIN_GENSEL = 5;
const int PIN_UTIL = 6;
const int PIN_GEN = 7;
const int PIN_START = 8;
const int PIN_FAULT = 9;

const unsigned long DEAD_MS = 2000;
const unsigned long LOST_MS = 5000;
const unsigned long READY_STABLE_MS = 3000;
const unsigned long START_TIMEOUT_MS = 15000;
const unsigned long RETURN_MS = 10000;
const unsigned long COOL_MS = 5000;
const unsigned long STATUS_MS = 5000;

enum Source { NONE, UTIL, GEN };
enum State { S_OFF, S_UTIL, S_LOST, S_START, S_GEN, S_COOL, S_FAIL };
enum Mode { M_OFF, M_AUTO, M_GEN };

const char *const SOURCE_NAME[3] = {"NONE", "UTILITY", "GENERATOR"};
const char *const STATE_NAME[7] = {"OFF", "ON UTILITY", "UTILITY LOST", "STARTING", "ON GENERATOR", "COOL-DOWN", "GENERATOR FAULT"};
const char *const MODE_NAME[3] = {"OFF", "AUTO", "GEN"};

Source closed = NONE;       // which contactor the outputs hold closed
Source want = NONE;         // which one the control wants
unsigned long openedAt = 0; // when a contactor last opened
State st = S_OFF;
Mode mode = M_OFF;
unsigned long stateAt = 0;
bool genStart = false;
bool coolRunning = false;
unsigned long coolAt = 0;
bool utilPresent = false;
unsigned long utilSince = 0;
bool genReady = false;
unsigned long genSince = 0;
bool forcing = false;
unsigned long lastStatus = 0;
unsigned long loopNow = 0;  // the time this pass of loop() works with, so no timer reads ahead of it

void stamp() {
  unsigned long t = millis() / 100;
  Serial.print("[");
  Serial.print(t / 10);
  Serial.print('.');
  Serial.print(t % 10);
  Serial.print(" s] ");
}

void say(const char *msg) {
  stamp();
  Serial.println(msg);
}

void enter(State next, const char *msg) {
  st = next;
  stateAt = loopNow;
  coolRunning = false;
  stamp();
  Serial.print(STATE_NAME[next]);
  Serial.print(": ");
  Serial.println(msg);
}

void setStart(bool on) {
  if (on == genStart) return;
  genStart = on;
  digitalWrite(PIN_START, on ? HIGH : LOW);
  say(on ? "generator START requested" : "generator START released, engine stops");
}

Mode readMode() {
  bool a = digitalRead(PIN_AUTO) == LOW;
  bool g = digitalRead(PIN_GENSEL) == LOW;
  if (a && !g) return M_AUTO;
  if (g && !a) return M_GEN;
  return M_OFF;
}

void changeMode(Mode m, unsigned long now) {
  mode = m;
  stamp();
  Serial.print("selector: ");
  Serial.println(MODE_NAME[m]);
  if (m == M_OFF) {
    enter(S_OFF, "contactors open, generator stopping");
  } else if (m == M_GEN) {
    if (closed == GEN && genReady) {
      enter(S_GEN, "manual generator");
    } else {
      setStart(true);
      enter(S_START, "manual generator, waiting for ready");
    }
  } else if (closed == GEN) {
    enter(S_GEN, "auto, carrying the load");
  } else if (genStart) {
    if (utilPresent) enter(S_COOL, "auto, generator running unloaded");
    else enter(S_START, "auto, waiting for generator ready");
  } else {
    if (utilPresent) enter(S_UTIL, "auto, utility present");
    else enter(S_LOST, "auto, utility is out");
  }
  (void)now;
}

// The control: decides which source it wants and when to start the engine.
void control(unsigned long now) {
  bool utilStable = utilPresent && now - utilSince >= RETURN_MS;
  bool genStable = genReady && now - genSince >= READY_STABLE_MS;
  switch (st) {
    case S_OFF:
      want = NONE;
      if (closed == NONE) setStart(false);
      break;
    case S_UTIL:
      want = UTIL;
      if (!utilPresent) enter(S_LOST, "utility lost, waiting 5 s before starting");
      else if (genStart) enter(S_COOL, "generator still running, cooling down");
      break;
    case S_LOST:
      want = UTIL;
      if (utilPresent) {
        enter(S_UTIL, "utility back before the timer ended, no start");
      } else if (now - stateAt >= LOST_MS) {
        setStart(true);
        enter(S_START, "utility out 5 s, start generator");
      }
      break;
    case S_START:
      want = UTIL;
      if (mode == M_AUTO && utilStable) {
        enter(S_COOL, "utility stable 10 s, stop generator after cool-down");
      } else if (genStable) {
        enter(S_GEN, "generator ready and stable 3 s, transfer to generator");
      } else if (now - stateAt >= START_TIMEOUT_MS) {
        setStart(false);
        enter(S_FAIL, "GENERATOR FAIL: not ready in 15 s, start released, lockout");
      }
      break;
    case S_GEN:
      want = GEN;
      if (!genReady) {
        setStart(false);
        enter(S_FAIL, "GENERATOR FAIL: ready signal lost, contactor opens");
      } else if (mode == M_AUTO && utilStable) {
        enter(S_COOL, "utility stable 10 s, transfer back to utility");
      }
      break;
    case S_COOL:
      want = UTIL;
      if (mode == M_AUTO && !utilPresent) {
        enter(S_LOST, "utility lost again, waiting 5 s");
      } else if (closed == UTIL) {
        if (!coolRunning) {
          coolRunning = true;
          coolAt = now;
        } else if (now - coolAt >= COOL_MS) {
          setStart(false);
          enter(S_UTIL, "cool-down done, generator stopped");
        }
      }
      break;
    case S_FAIL:
      want = NONE;
      setStart(false);
      if (mode == M_AUTO && utilStable) enter(S_UTIL, "utility stable, fault cleared");
      break;
  }
}

// The interlock in code: one contactor opens, then DEAD_MS passes, then the
// other closes. The only place the outputs are written.
void drive(unsigned long now) {
  if (closed != want) {
    if (closed != NONE) {
      stamp();
      Serial.print(SOURCE_NAME[closed]);
      Serial.println(" contactor OPEN");
      closed = NONE;
      openedAt = now;
    } else if (now - openedAt >= DEAD_MS) {
      closed = want;
      stamp();
      Serial.print(SOURCE_NAME[closed]);
      Serial.println(" contactor CLOSED");
    }
  }
  bool fault = digitalRead(PIN_FAULT) == LOW;
  if (fault != forcing) {
    forcing = fault;
    say(fault ? "BENCH FAULT: both outputs forced on, the hardware lockout must hold" : "bench fault released");
  }
  digitalWrite(PIN_UTIL, (closed == UTIL || forcing) ? HIGH : LOW);
  digitalWrite(PIN_GEN, (closed == GEN || forcing) ? HIGH : LOW);
}

void setup() {
  Serial.begin(115200);
  pinMode(PIN_READY, INPUT);
  pinMode(PIN_UTIL_SENSE, INPUT);
  pinMode(PIN_AUTO, INPUT_PULLUP);
  pinMode(PIN_GENSEL, INPUT_PULLUP);
  pinMode(PIN_FAULT, INPUT_PULLUP);
  pinMode(PIN_UTIL, OUTPUT);
  pinMode(PIN_GEN, OUTPUT);
  pinMode(PIN_START, OUTPUT);
  digitalWrite(PIN_UTIL, LOW);
  digitalWrite(PIN_GEN, LOW);
  digitalWrite(PIN_START, LOW);
  Serial.println("Mokxi Arduino Uno: generator transfer switch (control-logic model, low-voltage stand-ins)");
  Serial.println("Teaching model only: real transfer switches are listed equipment installed by a licensed electrician.");
  utilPresent = digitalRead(PIN_UTIL_SENSE) == HIGH;
  genReady = digitalRead(PIN_READY) == HIGH;
  loopNow = millis();
  utilSince = loopNow;
  genSince = loopNow;
  openedAt = loopNow; // the dead time applies at power on too
  changeMode(readMode(), loopNow);
}

void loop() {
  unsigned long now = millis();
  loopNow = now;

  bool u = digitalRead(PIN_UTIL_SENSE) == HIGH;
  if (u != utilPresent) {
    utilPresent = u;
    utilSince = now;
    say(u ? "utility PRESENT" : "utility LOST");
  }
  bool r = digitalRead(PIN_READY) == HIGH;
  if (r != genReady) {
    genReady = r;
    genSince = now;
    say(r ? "generator READY" : "generator not ready");
  }
  Mode m = readMode();
  if (m != mode) changeMode(m, now);

  control(now);
  drive(now);

  if (now - lastStatus >= STATUS_MS) {
    lastStatus = now;
    stamp();
    Serial.print("status: ");
    Serial.print(MODE_NAME[mode]);
    Serial.print(" | ");
    Serial.print(STATE_NAME[st]);
    Serial.print(" | closed ");
    Serial.println(SOURCE_NAME[closed]);
  }
}