Index: firmware/App/Controllers/DialOutFlow.c
===================================================================
diff -u -rd28280f1054fc9ddf9304a11373dc9ee963425e3 -r69ed3f91919e50b68ea448a70db81456fb4946a0
--- firmware/App/Controllers/DialOutFlow.c	(.../DialOutFlow.c)	(revision d28280f1054fc9ddf9304a11373dc9ee963425e3)
+++ firmware/App/Controllers/DialOutFlow.c	(.../DialOutFlow.c)	(revision 69ed3f91919e50b68ea448a70db81456fb4946a0)
@@ -27,6 +27,7 @@
 #include "ModeTreatment.h"
 #include "NVDataMgmt.h"
 #include "OperationModes.h"
+#include "PersistentAlarm.h"
 #include "PIControllers.h"
 #include "SafetyShutdown.h"
 #include "SystemCommMessages.h"
@@ -111,6 +112,9 @@
 #define DOP_ML_PER_MIN_FROM_PWM(pwm)            ( ( ( pwm - DOP_PWM_ZERO_OFFSET - 0.0972 ) / 0.0009 ) )
 
 #define PUMP_DIR_ERROR_COUNT_MASK                0x3F           ///< Bit mask for pump direction error counter.
+#define DOP_MIN_DIR_CHECK_SPEED_RPM              10.0F          ///< Minimum motor speed before we check pump direction.
+#define DOP_COMMUTATION_ERROR_MAX_CNT            3              ///< Maximum number of commutation errors within time window before alarm triggered.
+#define DOP_COMMUTATION_ERROR_TIME_WIN_MS        (15 * MS_PER_SECOND)    ///< Time window for DPo commutation error.
 #define DATA_PUBLISH_COUNTER_START_COUNT         40             ///< Data publish counter start count.
 
 /// Enumeration of dialysate outlet pump controller states.
@@ -242,6 +246,8 @@
     ufMeasuredRate = 0.0;
     dopRateCorrectionOffset = 0.0;
     resetDialOutFlowMovingAverage();
+
+    initTimeWindowedCount( TIME_WINDOWED_COUNT_DOP_COMMUTATION_ERROR, DOP_COMMUTATION_ERROR_MAX_CNT, DOP_COMMUTATION_ERROR_TIME_WIN_MS );
 }
 
 /*********************************************************************//**
@@ -563,6 +569,10 @@
         // Check for home position, zero/low speed
         checkDialOutPumpRotor();
     }
+    else
+    {
+        lastDialOutPumpDirectionCount = getFPGADialOutPumpHallSensorStatus() & PUMP_DIR_ERROR_COUNT_MASK;
+    }
 
     publishDialOutFlowData();
 }
@@ -933,24 +943,27 @@
     {
         MOTOR_DIR_T dopMCDir, dopDir;
         U08 dirErrorCnt = getFPGADialOutPumpHallSensorStatus() & PUMP_DIR_ERROR_COUNT_MASK;
+        F32  measMCSpeed = getMeasuredDialOutPumpMCSpeed();
+        BOOL minDirSpeed = ( measMCSpeed >= DOP_MIN_DIR_CHECK_SPEED_RPM ? TRUE : FALSE );
+        BOOL isHallSensorFailed = ( TRUE == minDirSpeed && lastDialOutPumpDirectionCount != dirErrorCnt ? TRUE : FALSE );
 
         // Check pump direction error count
+        if ( ( TRUE == isHallSensorFailed ) && ( TRUE == incTimeWindowedCount( TIME_WINDOWED_COUNT_DOP_COMMUTATION_ERROR ) ) )
+        {
 #ifndef _RELEASE_
-        if ( getSoftwareConfigStatus( SW_CONFIG_DISABLE_PUMP_DIRECTION_CHECKS ) != SW_CONFIG_ENABLE_VALUE )
+            if ( getSoftwareConfigStatus( SW_CONFIG_DISABLE_PUMP_DIRECTION_CHECKS ) != SW_CONFIG_ENABLE_VALUE )
 #endif
-        {
-            if ( lastDialOutPumpDirectionCount != dirErrorCnt )
             {
-                lastDialOutPumpDirectionCount = dirErrorCnt;
                 SET_ALARM_WITH_1_U32_DATA( ALARM_ID_HD_PUMP_DIRECTION_STATUS_ERROR, (U32)HD_PUMP_DIALYSATE_OUTLET_PUMP )
             }
         }
+        lastDialOutPumpDirectionCount = dirErrorCnt;
 
         dopMCDir = ( getMeasuredDialOutPumpMCSpeed() >= 0.0 ? MOTOR_DIR_FORWARD : MOTOR_DIR_REVERSE );
         dopDir = ( getMeasuredDialOutPumpSpeed() >= 0.0 ? MOTOR_DIR_FORWARD : MOTOR_DIR_REVERSE );
 
         // Check set direction vs. direction from hall sensors
-        if ( dialOutPumpDirectionSet != dopDir )
+        if ( ( dialOutPumpDirectionSet != dopDir ) && ( TRUE == minDirSpeed ) )
         {
             if ( ++errorDialOutPumpDirectionPersistTimerCtr >= DOP_DIRECTION_ERROR_PERSIST )
             {
@@ -963,7 +976,7 @@
             }
         }
         // Check set direction vs. direction from sign of motor controller speed
-        else if ( dialOutPumpDirectionSet != dopMCDir )
+        else if ( ( dialOutPumpDirectionSet != dopMCDir ) && ( TRUE == minDirSpeed ) )
         {
             if ( ++errorDialOutPumpDirectionPersistTimerCtr >= DOP_DIRECTION_ERROR_PERSIST )
             {
@@ -1093,49 +1106,52 @@
 {
     F32 dopCurr;
 
-    // DialOut pump should be off
-    if ( DIAL_OUT_PUMP_OFF_STATE == dialOutPumpState )
+    if ( FALSE == isAlarmActive( ALARM_ID_HD_AC_POWER_LOST ) )
     {
-        dopCurr = fabs( getMeasuredDialOutPumpMCCurrent() );
-        if ( dopCurr > DOP_MAX_CURR_WHEN_STOPPED_MA )
+        // DialOut pump should be off
+        if ( DIAL_OUT_PUMP_OFF_STATE == dialOutPumpState )
         {
-            dopCurrErrorDurationCtr += TASK_PRIORITY_INTERVAL;
-            if ( dopCurrErrorDurationCtr > DOP_MAX_CURR_ERROR_DURATION_MS )
+            dopCurr = fabs( getMeasuredDialOutPumpMCCurrent() );
+            if ( dopCurr > DOP_MAX_CURR_WHEN_STOPPED_MA )
             {
+                dopCurrErrorDurationCtr += TASK_PRIORITY_INTERVAL;
+                if ( dopCurrErrorDurationCtr > DOP_MAX_CURR_ERROR_DURATION_MS )
+                {
 #ifndef _RELEASE_
-                if ( getSoftwareConfigStatus( SW_CONFIG_DISABLE_MOTOR_CURRNT_CHECKS ) != SW_CONFIG_ENABLE_VALUE )
+                    if ( getSoftwareConfigStatus( SW_CONFIG_DISABLE_MOTOR_CURRNT_CHECKS ) != SW_CONFIG_ENABLE_VALUE )
 #endif
-                {
-                    SET_ALARM_WITH_1_F32_DATA( ALARM_ID_DIAL_OUT_PUMP_MC_CURRENT_CHECK, getMeasuredDialOutPumpMCCurrent() );
+                    {
+                        SET_ALARM_WITH_1_F32_DATA( ALARM_ID_DIAL_OUT_PUMP_MC_CURRENT_CHECK, getMeasuredDialOutPumpMCCurrent() );
+                    }
                 }
             }
+            else
+            {
+                dopCurrErrorDurationCtr = 0;
+            }
         }
+        // DialOut pump should be running
         else
         {
-            dopCurrErrorDurationCtr = 0;
-        }
-    }
-    // DialOut pump should be running
-    else
-    {
-        dopCurr = fabs( getMeasuredDialOutPumpMCCurrent() );
-        if ( dopCurr > DOP_MAX_CURR_WHEN_RUNNING_MA )
-        {
-            dopCurrErrorDurationCtr += TASK_PRIORITY_INTERVAL;
-            if ( dopCurrErrorDurationCtr > DOP_MAX_CURR_ERROR_DURATION_MS )
+            dopCurr = fabs( getMeasuredDialOutPumpMCCurrent() );
+            if ( dopCurr > DOP_MAX_CURR_WHEN_RUNNING_MA )
             {
-#ifndef _RELEASE_
-                if ( getSoftwareConfigStatus( SW_CONFIG_DISABLE_MOTOR_CURRNT_CHECKS ) != SW_CONFIG_ENABLE_VALUE )
-#endif
+                dopCurrErrorDurationCtr += TASK_PRIORITY_INTERVAL;
+                if ( dopCurrErrorDurationCtr > DOP_MAX_CURR_ERROR_DURATION_MS )
                 {
-                    SET_ALARM_WITH_1_F32_DATA( ALARM_ID_DIAL_OUT_PUMP_MC_CURRENT_CHECK, getMeasuredDialOutPumpMCCurrent() );
+    #ifndef _RELEASE_
+                    if ( getSoftwareConfigStatus( SW_CONFIG_DISABLE_MOTOR_CURRNT_CHECKS ) != SW_CONFIG_ENABLE_VALUE )
+    #endif
+                    {
+                        SET_ALARM_WITH_1_F32_DATA( ALARM_ID_DIAL_OUT_PUMP_MC_CURRENT_CHECK, getMeasuredDialOutPumpMCCurrent() );
+                    }
                 }
             }
+            else
+            {
+                dopCurrErrorDurationCtr = 0;
+            }
         }
-        else
-        {
-            dopCurrErrorDurationCtr = 0;
-        }
     }
 }