Five Control Boundary Defects Trigger Together on Utility Loss

Six control boundary items are carried as open in the controls basis. A single event exercises five of them. Loss of utility supply arms the charger inhibit, stops the heat rejection serving the UPS room at the moment UPS loss is at its maximum, runs the primary-side pump and isolation sequence, exercises both media-room supplies, and is the event the basis pairs with loss of supervisory communications. The sixth, fire cause and effect, sits on an entirely independent trigger. The five do not pass through the liquid three-zone, the UPS redundancy, or the generation redundancy the rest of the package argues about. The finding concerns how these items can be scheduled and specified, not what any of their settings should be.

The Five Cannot Be Treated as Separate Tractable Defects

Take them as separate entries on a defects list and each looks tractable. Take them at one instant and they interact. The charger inhibit must be armed by a generator breaker auxiliary contact rather than by any monitoring data point, and its feedback must be measured charging current near zero rather than a command readback, precisely because the supervisory layer is among the things that may be unavailable in the same minute. The UPS-room path is the one that bypasses every cooling redundancy: its rejection equipment is not on protected supply, so liquid-cooling zoning, redundant distribution units and redundant heat rejection have no bearing on it, and no energy-saving or load-shedding logic may list that equipment as sheddable. If the primary side turns out to be a shared header rather than zoned, the pump and isolation sequence becomes a site-wide sequence, and the independence of the three cooling zones is cancelled upstream of where it was designed in.

The second reason they cannot be separated is the implementation layer. Two rows of the failure-domain matrix describe the same event, supervisory communications loss together with loss of utility supply, and differ only in whether the interlocks execute in the hardwired layer or the supervisory one. Hardwired, the row shows no consequence for the generator loading sequence or for cooling-zone independence. In the supervisory layer, the same event takes out the hardwired-interlock column, the loading sequence and the zone independence together, and the matrix marks it a common-mode event. That is not a detail to settle after the equipment is bought. It is the difference between a graceful transfer and losing two things that were meant to be independent at once.

The controls basis states the value of the discipline on this project is not implementing automation. It is keeping the plant on the safe side when the control system itself has failed. Device autonomy and hardwired safety must not change when the supervisory layer fails. A hardwired trigger must not be a supervisory data point.

Unknown Cells Stay Cannot-Evaluate, Not No Impact

A matrix that refuses to guess is worth more than one that looks complete. Where a supplier controller's behaviour on loss of communication is unknown, the cells carry an explicit token meaning cannot be evaluated, and the basis states that this is not the same as no impact. The same discipline governs the media-room supplies, which may not be assumed identical to the three electrical domains, and the dual-channel leak alarm: two channels sharing one switch, one containment route or one supply are one channel, so crossing both the network zone and the physical route is mandatory, verified by disconnecting one channel during integrated testing.

A security response that isolates a network segment is the same event as supervisory loss during a start. It does not change the hardwired layer if that layer is actually independent. That is a second reason for the three-layer split, independent of the utility dying.

Limits and open items

The basis groups five of the six named boundary items on the utility-loss minute, and places the sixth on an independent fire trigger. A cannot-evaluate cell is not a no-impact cell. A supervisory failure must not change device autonomy or hardwired safety. Those are the basis's own statements, not a freeze.

Held: all eight interlocks in the machine matrix are recorded as held for approval, each with a named approver among the Engineer of Record, the supplier, the commissioning authority and the owner. [HOLD]

Open: most response times in that matrix are to be confirmed by the Engineer of Record or the supplier. Only the supervisory communications timeout and its restoration condition carry proposed values, at 30 and 60 seconds [TARGET], and leak detection carries 2 seconds with the isolation time still open [TARGET]. Also open: whether the primary side is shared or zoned; the allowable loss-of-cooling time for the UPS room and the heat load inside it; the supply attribution for that room's rejection equipment; and the black-start case, in which the charger inhibit conflicts with the restoration objective and needs a current-limited release condition that does not yet exist. [HOLD]

No sequence, setpoint, cause-and-effect content or interlock identifier appears in this note. Nothing is specified for purchase. No Engineer of Record, commissioning authority or authority having jurisdiction has reviewed any of it.

Do the Six Close Before the Equipment Enquiries Go Out?

The procurement consequence is the one with a date attached. The charger inhibit is not a setting to be commissioned later. It changes the load the generators carry, and without it the worst corner moves the heat rejection unit count by one. Requirements of that kind belong verbatim in the equipment specification and in the enquiry as non-deviable clauses, with any supplier deviation returned in writing and written back into the point list and the test script. So the useful question is not when these six items will be closed. It is whether they close before the enquiries go out, or after the suppliers have already priced something else.

© 2026 K&K Data Service Inc. All rights reserved. Reproduction or republication is permitted only with clear attribution to K&K Data Service Inc. and a working hyperlink to the canonical URL of this article. Excerpts must preserve the technical context, maturity labels, assumptions, and limitations. No excerpt may imply project approval, field validation, certification, or endorsement that the original article does not state.

Source: K&K Data Service Inc., “Five Control Boundary Defects Trigger Together on Utility Loss,” https://www.kkdatasvc.com/lab/controls-epms-bms-and-dcim/five-boundary-defects-fire-in-the-same-minute-the-utility-dies/.