ENGINEERING NOTE / SYSTEMS

Follow one fault across every boundary.

Design reviews split a plant by discipline; faults do not. One synthetic unit shows a redundancy in one discipline defeated through another.

Low Kah Yi · 22 October 2026 · Independent synthetic example

Reviews follow disciplines. Faults do not.#

Electrical, mechanical, control and operations reviews each examine their own part of a design, and each can pass. The One Plant exercise has a fired vessel cooled by a duty pump with a standby pump beside it, an automatic standby start, two electrical supplies with a UPS on each side, and a pressure controller. Every one of those is a sensible redundancy. Lose supply A, and the unit still shuts down at 276 seconds.

The standby started on a dead bus.#

The automatic start works exactly as designed. It sees low flow and starts the standby pump 18 seconds after the fault. But both pumps draw power from bus A, so the start command reaches a pump with no power. A mechanical redundancy was defeated by an electrical arrangement: a common-cause failure that a review of the pumps would not see, and that a review of the switchboard would not connect to cooling.

Each redundancy covers some faults, not all.#

The figure runs every combination of three choices against three faults: one cooling loop or two, the standby pump on bus A or bus B, and an automatic start or none.

A pump trip needs only the automatic start. Losing supply A also needs the standby pump on the other bus. Losing a loop also needs a loop the standby pump does not share. One arrangement rides through all three, and it is the one where the two pumps share nothing: not a bus, not a loop.

The other views move too.#

The pressure controller cuts the burner to its minimum 53 seconds after the fault and then has no room left. Without a heat sink, tuning only changes when the unit trips: between 250 and 286 seconds from the slowest controller to the fastest. Control buys seconds, not cooling.

Meanwhile the as-found alarm system presents 33 alarms, and two minutes in, the one naming the cause is 7 of 9 on the list. And when the failed pump is repaired after six minutes, cooling returns at 440 seconds to a unit that tripped at 276: the equipment is back, the production is not. Recovery is a sequence of its own.

Try it: open the plant as found and watch supply A fail. Then move the standby pump to bus B, run the same fault, and fail the loop instead. Or stay as found and close the bus tie yourself before the trip.

Take the questions into a design review.#

For each credible fault, walk it through every discipline before accepting any of them: what loses power, what loses its cooling or other medium, what the controls can still do, what the operator is shown, and what it takes to get back to production. For each redundancy, list what it shares with the thing it backs up: supply, bus, loop, control system, location, procedure. A redundancy is only as independent as the least obvious thing its two halves share.

This note describes general practice. The plant is invented and simple: one fault at a time, instant switching and no protection coordination, restart procedure or human factors. It does not represent any facility or establish a design. Read its source on the model code page, and its checks in the verification notebook.