EXPERIMENT 05 / ONE PLANT
One fault.
Five views.
A fictional process unit and the utilities it depends on, in one model. Choose a fault and a design, then move through ten minutes and watch the same event reach the equipment, the heat balance, the controller, the alarm list and the outcome.
One shared cooling loop; standby pump on bus A; automatic standby start; balanced tuning; alarm system as found; repair not within the ten minutes.
Shown at 120 seconds, one minute after the fault. With JavaScript you can change the fault and the design and move through the ten minutes.
ONE FAULT, IN ORDER
- 60 s Electrical supply A is lost.
- 60 s Bus A loses power. UPS A carries the control system on battery; UPS B also feeds it.
- 60 s The duty pump stops: it runs from bus A.
- 63 s Cooling-water flow falls below half.
- 78 s The standby pump is started automatically, but its bus has no power.
- 101 s Vessel pressure passes its high alarm.
- 113 s The pressure controller has cut firing to its minimum. It cannot remove more heat.
- 113 s The 11th alarm arrives: more than one operator can work through.
- 180 s UPS A battery is exhausted. The control system stays up on UPS B.
- 276 s The safety system shuts the unit down.
01 · DEPENDENCIES
What still has power and water?
ElectricalCooling water
02 · HEAT BALANCE
Is heat leaving as fast as it arrives?
Heat in (burner)Heat removed
03 · CONTROL
Can the controller still hold pressure?
PressureSetpointTripFiring
04 · ALARMS
What does the operator see?
11 alarms since the fault · flood (more than 10)
Newest first; every alarm looks the same. The alarm naming the cause is 7 of 9.
- High Burner firing at minimum: pressure control has no room left since 113 s
- High Vessel temperature high since 107 s
- High Vessel pressure high since 102 s
- High Standby cooling-water pump started since 78 s
- High Cooler outlet temperature high since 67 s
- High Cooling-water flow low since 63 s
and 3 more below
05 · RECOVERY
Which arrangement rides through?
The safety system shut the unit down at 276 s.
Lost output: 6.5 minutes of full production in nine minutes.
| Loops | Standby power | Start | Outcome |
|---|---|---|---|
| Shared | Bus A | Manual | Trip at 276 s |
| Shared | Bus A | Auto | Trip at 276 s |
| Shared | Bus B | Manual | Trip at 276 s |
| Shared | Bus B | Auto | Rides through |
| Separate | Bus A | Manual | Trip at 276 s |
| Separate | Bus A | Auto | Trip at 276 s |
| Separate | Bus B | Manual | Trip at 276 s |
| Separate | Bus B | Auto | Rides through |
MODEL & BOUNDARIES
Every redundancy covers some faults, not all.
A fired vessel is held at 300 kPa by a pressure controller that trims the burner. Cooling water carries the heat away, pumped by a duty pump on electrical bus A with a standby pump beside it. Two supplies feed buses A and B, and the control system is fed from both through two UPS units with 120 seconds of illustrative battery each. A fictional safety system shuts the unit down at 380 kPa.
At 60 seconds one thing fails. With automatic start, the standby pump is started after 15 seconds of low flow and delivers 10 seconds later, if its bus has power and its loop is intact. The burner cannot fire below 40%, so once cooling water is lost the controller can slow the rise in pressure but cannot stop it. 15 alarm points watch the utilities and the process; the alarm system can be left as found or rationalized as in the Alarm Flood, where alarms that ask for no action are recorded as events instead.
You can act once the fault has happened: start the standby pump, close the bus tie so supply B feeds bus A and the duty pump restarts, or cut feed to minimum rate, which narrows the burner to 20–40% and holds the pressure down at a cost in output. Each action keeps you busy for 20 seconds, and an action on equipment without power achieves nothing. The failed equipment can also be repaired after three or six minutes; a repair after the trip brings the equipment back but leaves the unit shut down, because restarting it is a procedure of its own.
What this exercise can establish
It shows how one fault crosses the boundaries between electrical, mechanical, control and operational views, and why each arrangement of pumps, buses and loops survives some faults and not others. It is not a design method or guidance for any facility. Every value and arrangement is invented for this page and does not reflect any employer's systems or practices. The results are computed in your browser and repeat exactly for the same settings.
Terms used on this page
- UPS (uninterruptible power supply)
- Batteries and power electronics that keep equipment running for a short time when its normal supply fails.
- Alarm flood
- More alarms than one operator can read and act on, commonly more than about ten in ten minutes, so the important ones are lost in the rest.