H2-1 | Page Boundary & System Role: What Manifold & Pump Control Owns

A liquid-cooling manifold and pump control module sits inside the server/rack coolant loop and owns the execution layer: driving the BLDC pump, conditioning flow/ΔP/temperature inputs, enforcing safety interlocks (including leak response), managing redundant power domains for continuity, and emitting actionable telemetry plus time-ordered fault events for diagnosis.

What this page covers

• Pump drive + protection: BLDC/PMSM drive chain, startup/priming ownership, derating and safe shutdown triggers.
• Signal front-end contract: where flow, differential pressure (ΔP), and coolant temperatures enter, and what “control-grade” means.
• Safety enforcement: leak and interlock latching, graded response (warn → derate → shutdown) and anti-oscillation rules.
• Redundant power domains: A/B feed, OR-ing behavior, continuity of control rail vs power rail, and switchover evidence in logs.
• Diagnosability: minimal telemetry fields and event codes that make field failures reproducible.

Explicit non-goals (to avoid cross-page overlap)

• No facility CDU / chiller plant design: only the local loop and its execution controls are in scope.
• No BMC protocol deep dive: transport (IPMI/Redfish details) is out-of-scope; only “what must be observable” is defined.
• No PSU topology (PFC/LLC) and no rack PDU metering: this page stays at the pump module domain.
• No general thermal policy: system-level fan curves and workload scheduling are handled elsewhere; this page provides reliable actuation + evidence.

H2-2 | What Must Be Measured: Flow, ΔP, Temperature, Bubbles & Leaks

Reliable pump control is not “one-sensor control.” The execution layer needs a minimal observability set that survives real coolant loops: flow (delivery), differential pressure ΔP (loop impedance / blockage proxy), and temperature gradient (heat transport result). A leak signal is safety-critical and must be treated with graded certainty to prevent false shutdowns.

The engineering meaning of each signal

• Flow (delivery capacity): confirms coolant is actually reaching the load. Most useful to confirm “flow established” after priming and to detect intermittent dropouts.
• ΔP (impedance proxy): reacts strongly to blockage, filter loading, kinked lines, or cold-plate restriction changes; often more control-stable than raw flow in noisy regimes.
• Temperature (Tin/Tout, ΔT): validates heat transport and provides hard safety limits; it can detect “pump spinning but not transporting heat” when paired with flow/ΔP.
• Leak (safety latch): must support warning/derate/shutdown tiers; condensation and service events demand anti-false-positive logic.

Common “false reality” traps (and how to avoid being fooled)

• Bubbles / poor priming: flow readings can oscillate; ΔP can look inconsistent; current ripple often increases. Use cross-checks rather than a single threshold.
• Low-flow quantization: many flow sensors become jumpy near minimum measurable flow. Treat flow as diagnostic in that region, not as a tight control target.
• ΔP zero drift: temperature and mounting stress shift the baseline. A control loop must include drift tolerance (deadband/hysteresis) and plausibility checks.
• Slow temperature response: Tin/Tout can lag fast transients. Use temperature primarily for protection and slow validation, not for fast torque decisions.
• Condensation vs leak: moisture sensors may trigger during cold starts. Grade the leak signal (suspect vs confirmed) and require persistence or multi-sensor corroboration.

A practical cross-check triangle (minimal but powerful)

• Low flow + high ΔP → likely restriction/blockage (filter/cold plate) rather than a drive failure.
• Low flow + normal/low ΔP → likely bubbles, dry-run, or loss of prime (not enough head built).
• Flow looks “OK” but ΔT stays high → sensor placement error, bypass/short-circuit path, or insufficient contact at the load.

H2-3 | BLDC Pump Drive Architecture: 6-Step vs FOC (Why Servers Often Prefer FOC)

Data center liquid-cooling pumps commonly use 3-phase BLDC/PMSM motors driven by a three-phase half-bridge (integrated or discrete MOSFET stages). The practical decision between 6-step trapezoidal commutation and field-oriented control (FOC) should be made using execution-layer constraints: low-speed torque for priming, acoustic/vibration limits, and diagnostic visibility under bubbles or partial dry-run conditions.

• Strength: simpler implementation and fewer tuning dependencies; robust for fixed-speed or moderate dynamic requirements.
• Trade-off: commutation torque ripple can amplify mechanical resonance (pump + tubing), raising acoustic noise in some operating points.
• Low-speed caveat: sensorless operation becomes less stable when back-EMF is weak; open-loop alignment/forced commutation can reduce priming success rate under bubbles.
• Diagnosability: fewer internal observables; abnormal conditions are often detected later (e.g., “no-flow” rather than root-cause signatures).

• Strength: smoother torque (lower ripple) and better low-speed authority; improves startup reliability and reduces vibration-sensitive behavior.
• Strength: current-loop control makes “torque intent vs outcome” measurable, enabling stronger abnormal detection (bubbles, partial dry-run, restriction).
• Trade-off: requires reliable current measurement and parameter/tuning management; control complexity increases validation effort.
• Failure containment: when sensors degrade (noisy flow, drifting ΔP), the controller can degrade to safer modes while preserving evidence in logs.

• Priming sensitivity: frequent cold starts, trapped air risk, or low NPSH conditions favor smoother low-speed torque control.
• Noise budget: if torque ripple excites tubing/manifold resonance, prioritize torque smoothness over simplest commutation.
• Fault evidence: if root-cause isolation matters (bubble vs restriction vs dry-run), prioritize current-sense observability and event logs.
• Complexity risk: if calibration/tuning cannot be controlled across units, keep control architecture conservative and enforce strict degradation rules.

H2-4 | Startup & Priming Are the Hard Part: Low-Speed Torque, Bubbles, Dry-Run, Cavitation

A pump “spinning” does not guarantee coolant transport. Priming is the execution-layer reliability bottleneck because trapped air can prevent head buildup, and abnormal regimes (bubbles, partial dry-run, incipient cavitation) can look acceptable if only one signal is trusted. A robust implementation treats priming as a bounded state machine with graded evidence, power limits, and explicit fault codes.

• Air lock: the impeller moves air rather than liquid; speed may rise while ΔP/flow stay low or unstable.
• Partial dry-run: rotation exists but coolant contact is insufficient; current/estimator stability may change before flow confirms failure.
• Incipient cavitation: pressure fluctuations reduce effective flow and can cause ΔP oscillation; prolonged operation risks damage and noise spikes.

• Soft-start: limit acceleration (dRPM/dt) and/or electrical power (Pmax) during START/PRIME to prevent supply dips and mechanical shock.
• Low-speed torque margin: during PRIME, allow controlled torque boost within a strict time window; avoid infinite retries that become destructive dry-run.
• Evidence-based detection: treat “no-flow” as a conclusion from multi-signal mismatch (flow vs ΔP trend vs electrical signatures), not a single threshold.
• Anti-oscillation: enforce minimum dwell time and hysteresis between states to prevent rapid start/stop cycling.

• Prime outcome: success / timeout / unstable signals / safety trigger.
• Key snapshots: RPM target, current proxy (bus/phase), flow, ΔP, and a brief window statistic (mean + ripple).
• Counts & timing: prime duration, retry count, time since last successful prime.

H2-5 | Sensor AFE & Sampling: Turning “Dirty Signals” into Controllable Metrics

Pump control quality is limited by signal quality. Flow, differential pressure (ΔP), and coolant temperature are “dirty” in the field: drift, noise coupling, quantization at low flow, and transient artifacts during priming can destabilize control and inflate false alarms. A production-grade implementation separates control-grade signals (stable, low bandwidth) from diagnostic features (ripple, slope, plausibility), and records the evidence that explains state transitions.

• Dominant failure mode: slow offset/temperature drift that masks real restriction changes or fabricates apparent ΔP.
• Execution-layer rule: allow zero/offset re-baselining only in an explicitly safe window (stable low activity), never as a continuous hidden correction.
• Noise coupling: reference and supply disturbances can appear as ΔP movement; treat ΔP credibility as a scored signal, not a single number.

• Low-flow limit: quantization and jitter dominate near the minimum measurable range; avoid using raw flow as a fast control variable in that region.
• Air/bubbles: transient spikes or dropouts are common during priming; classify flow as “unstable” when ripple and persistence criteria fail.
• Engineering output: publish both Flow and a Flow stability flag so the state machine can degrade rather than oscillate.

• Safety: enforce over-temperature and abnormal temperature rise rate (dT/dt) limits.
• Transport check: use inlet/outlet trends as evidence that coolant transport is effective, especially when flow sensing is unstable.
• Placement awareness: interpret temperature in context (inlet vs outlet) to avoid false conclusions during transients.

• Window averaging: best for slow, stable control metrics (temperature trends, long-term ΔP).
• IIR filters: common choice for control loops—stable output with adjustable responsiveness via time constant.
• Kalman-style estimators: use for fusion and credibility (e.g., combining noisy flow with electrical/ΔP evidence), not as a default filter everywhere.

H2-6 | Leak Detection: Conductivity, Humidity, Optical, Inference — and False-Alarm Control

Leak handling must be evidence-based. The difficult part is not “detecting something,” but preventing condensation and service artifacts from causing disruptive shutdowns. A robust pump-control implementation uses graded evidence and tiered actions: suspect → confirmed → emergency, with explicit debounce/persistence rules and a clear lock-and-log policy.

• Conductivity (rope/point): fast local detection near manifold fittings and pump area; requires fluid-compatibility and aging-aware thresholds.
• Humidity / moisture: useful as a suspect indicator; high condensation risk demands strong debounce and environmental gating.
• Optical / local level: provides direct “fluid present” evidence when mechanically feasible; strong candidate for confirmation.
• Inference: flow drop + ΔP anomaly + temperature pattern is auxiliary only; do not confirm a leak from inference alone.

• Time persistence: require a minimum duration above threshold (debounce/persistence) before changing severity state.
• Context gating: during priming, maintenance windows, or known condensation risk, prevent moisture-only inputs from jumping directly to confirmation.
• Cross-check: confirm using at least one “strong” sensor class (conductivity/optical), plus an optional inference score for confidence.

• Severity transitions: Suspect → Confirmed → Emergency, including the exact trigger class (conductivity / humidity / optical / combined).
• Snapshot: flow, ΔP, temperature, electrical effort proxy, and current pump state (START/PRIME/RUN/DEGRADED) at confirmation time.
• Latch policy: whether the condition is self-clearing or requires explicit clearing after inspection.

H2-7 | Redundant Power Domains & Fault Tolerance: A/B Rails, OR-ing, Switchover Without Speed Drop

“Redundancy” in a pump control board is not a single backup wire—it is a power-domain architecture that keeps the control domain alive while the high-current motor domain can switch sources. The practical goal is to prevent a brownout reset, avoid reverse-current propagation, limit DC-link sag, and record a traceable event with timestamp and reason code.

• Power-stage domain: the high-current path feeding the inverter DC-link (A/B → OR-ing → Vbus).
• Control always-on domain: MCU, gate-driver logic, and critical sensor rails remain stable through switchover.
• Sense integrity: ΔP/flow/temp credibility is preserved by keeping references and ADC rails out of brownout.

• Reverse-current control: prevent backfeed from DC-link into a failing input rail so the fault does not propagate.
• Low drop: ideal-diode OR-ing minimizes voltage loss and heat compared with diode drops in high-current paths.
• Switchover transients: treat Vbus sag and dV/dt as first-class signals; avoid trip-chains caused by brief dips.

• Control continuity: keep state machine and sampling stable; do not allow a reset to re-enter startup logic.
• Vbus protection: enforce sag limits and UVLO margin by managing DC-link energy and short transient handling.
• Soft transition: temporarily cap acceleration/power during switchover to prevent overcurrent trips and oscillation.

• Power cap: limit maximum electrical effort when only one domain is healthy.
• Target reduction: reduce flow/ΔP targets to stay away from critical rail margins.
• Anti-flap rule: avoid repeated A↔B bouncing; lock preference until rails are stable for a defined window.

H2-8 | Protections & Fault Modes: Stall, Overcurrent, Overtemp, Dry-Run, Sensor Distortion

Effective protection is evidence-driven and stable. The goal is to map field symptoms (flow, ΔP, current/power proxy, temperature) to fault classes, apply tiered actions (warn → derate → shutdown), and avoid oscillation caused by repeated start-stop cycles. Sensor faults must be handled as credibility problems first, not as immediate shutdown triggers.

• Electrical effort (current/power proxy): the drive is “pushing” vs limited.
• Hydraulic result (flow + ΔP): whether pressure head and transport are established.
• Thermal outcome (temperature + dT/dt): whether heat is being removed as expected.

• Stall / blockage: electrical effort rises while flow remains near zero and ΔP does not build as expected.
• Overcurrent: current exceeds limit (transient or sustained); Vbus sag can amplify trips if not handled with margin.
• Overtemperature: device/winding temperature rises; derating is preferred before escalation to shutdown.
• Dry-run: flow fails to establish while temperature rise pattern becomes abnormal; electrical effort may not be extreme.
• Sensor distortion: stuck-at flow, drifting ΔP, open/short temperature—treat as credibility loss and degrade conservatively.

• Warn: log evidence, tighten sampling, and maintain safe limits.
• Derate / Degraded: cap power/acceleration, reduce targets, and continue operation when safe.
• Shutdown / Latched: stop and latch only when safety thresholds or repeated failures demand it.

H2-9 | Control Strategy: From Speed Control to ΔP / Flow Control (Practical Boundaries)

Pump control targets are chosen by signal credibility and operating phase, not by algorithm complexity. Speed control is the most robust baseline, while ΔP control tracks loop impedance changes more directly. Flow control can be effective only when flow sensing is stable and trustworthy; otherwise, flow is better used for diagnostics and cross-checks.

• Speed control: simplest and most stable; does not guarantee flow or ΔP under changing impedance.
• Flow control: targets transport directly; depends heavily on flow sensor quality and bubble sensitivity.
• ΔP control: targets pressure head / impedance behavior; requires a stable ΔP signal (offset + drift managed).

• Reliable ΔP available: prefer ΔP-control and apply speed / power clamps to protect margins during transients.
• Flow is noisy or bubble-prone: keep flow as diagnostic-grade (credibility scoring, cross-check, alarms), not the primary loop target.
• Low temperature / degas / bubble period: fall back to a conservative mode (typically speed control) until signals stabilize.

• Control-grade: bounded noise, stable offset, reasonable rate-of-change, and consistent with physics.
• Diagnostic-grade: helpful for triage but unsafe to close the loop directly when it can chase noise.
• Cross-check: compare trends across {ΔP, flow, electrical effort, temperature} before enabling aggressive control modes.

H2-10 | Telemetry & Fault Logs: What to Record to Diagnose Problems

This section focuses on what the pump control board / manifold controller should record locally. Continuous telemetry provides trends, while event logs provide evidence. The diagnostic minimum is an event code plus a snapshot of key rails, hydraulic signals, and active limits—captured with a consistent relative timestamp.

• Telemetry: periodic values (rails, RPM, flow, ΔP, temperatures) used for trending and cross-check.
• Event log: discrete records (start, prime failure, dry-run, leak, domain switch, derate, sensor fault).
• Snapshot: a “freeze frame” of key telemetry taken at the event moment; the snapshot is what makes logs actionable.