ENGINEERING NOTE / DEPENDENCIES

Dependencies are part of the design.

Two supply paths can share one cooling dependency. Trace the relationships before counting the equipment.

Low Kah Yi · 30 September 2026 · Updated 23 October 2026 · Independent synthetic example

Start with the service.#

A diagram containing two supplies and two UPS units looks reassuring. But the question is not how many boxes it contains. The question is what has to remain available for the service to continue. Electrical supply is one condition. Removing the heat the process makes is another.

The One Plant exercise keeps both visible. Its control system is fed from both UPS units, so losing one supply cannot switch it off. Its heat leaves through cooling water, moved by a duty pump with a standby pump beside it. As found, both pumps draw power from bus A, and both push water round one shared loop.

Separate the consequences.#

Lose supply A at 60 seconds. UPS A carries the control system on its battery for 120 seconds and UPS B keeps feeding it throughout: the electrical redundancy works, and the control system never loses power. The duty pump stops at once, and the automatic start calls the standby pump 18 seconds later, on the same dead bus. Cooling-water flow is below half within 3 seconds, and the safety system shuts the unit down at 276 seconds.

The controls stayed powered. The process lost its heat sink. Counting supplies and UPS units would have answered the first question and missed the second.

A shared dependency changes the answer.#

Fail the cooling loop instead. Both supplies are healthy and both pumps keep running, yet no water moves, because the loop they share is the thing that failed: the unit shuts down at 276 seconds. Give each pump its own loop and the same fault is survived: pressure peaks at 323 kPa and returns to setpoint. Independent electrical paths do not remove a common cooling consequence.

Try it: open the plant as found and fail the loop. Then give each pump its own loop and run the same fault again.

Take the questions into a design review.#

For every service, identify the required support systems, where paths converge, and what an individual failure disables. Distinguish a component being available from a complete path being available. Then ask what evidence supports the proposed failure response and recovery sequence.

This example excludes protection coordination, restart interlocks, equipment curves and operating procedures. It illustrates a reasoning method; it establishes no redundancy classification. Its assumptions and model checks are available on the model code page and in the verification notebook.