Three protections a control mode can carry on top of its interlocks: safety trips on its sensor reading, a rate limit on how often its output switches on, and what it does about a local override at the device.
These are set from the app, not on the controller’s screen. The controller runs them, and the Boiler profile sets its own safety trips during setup, but the screen offers no editor for them at present. Their starting values are in Factory Defaults.
A safety trip watches the mode’s own sensor and acts when the reading cannot be trusted or has gone somewhere it never should. Each trip is independent; set only the ones you need.
| Trip | Fires when |
|---|---|
| Hard low | The reading is below this value — for example a conductivity probe reading near zero because it is fouled, dry, or disconnected. |
| Hard high | The reading is above this value — a runaway the setpoint alone should never allow. |
| Maximum rate of change | The reading changes faster than this, per second, between two fresh readings — a spike, not real water chemistry. |
| Stale after | No fresh reading has arrived for this long. |
On trip decides what happens:
| On trip | The output |
|---|---|
| Alarm only | Keeps running under the mode. |
| Force off | Goes to its safe state while the trip lasts. |
| Latch last | Stays where it was last put — unless that is the unsafe state, when it is forced off instead. |
When a trip holds the output, the controller raises Policy Blocked (200). An alarm hold keeps it raised for a minimum time, so a reading bouncing on a limit cannot make it chatter.
A trip can clear by itself when the reading comes back, or latch: stay tripped until someone clears it. A latched trip is saved, so it survives a restart.
A latched trip cannot yet be cleared from the screen or the app. The Boiler profile’s trips latch by default. If a Boiler mode latches, contact support before changing anything: removing and re-creating the mode, or a factory reset, also clears the latch, but loses the mode’s settings.
A Stale after trip never latches. A missing reading is a communication problem, not a measured excursion, so the output resumes on its own when readings return.
If two enabled modes read the same sensor and only one has safety trips, a failure of that sensor stops one mode and not the other. The controller raises Sensor Asymmetry (221) until they match.
The Boiler profile adds safety trips to its blowdown mode during setup — hard low 100 µS/cm, hard high 1.5 × the setpoint, a stale-reading trip, a rate-of-change trip, and force off, latched. Its settings must satisfy the profile’s checks: a hard high above the setpoint, and a stale-reading trip no longer than the profile allows. See Factory Defaults — Boiler profile and Sampling and Blowdown Control.
A rate limit caps how many times the output may switch on within a sliding window — for example 20 starts per hour — to protect a pump or valve from short-cycling.
| Used | Alarm |
|---|---|
| 80 % of the budget | Rate Limit Warning (210) |
| All of it | Rate Limit Exhausted (211). New switch-ons wait until older ones age out of the window. |
An output that hits its rate limit often is switching too much. Widen the mode’s differential, or lengthen its minimum on time, before raising the budget.
The controller notices when an output its mode owns is switched on at the device itself — at a pump’s own keypad, say — against what the mode commands, and raises Local Override (231). The mode is set to one of two responses:
See Switched at the device itself.