A probe false-trip on one cooling distribution unit is three different actions if the matrix is built correctly, and one zone-level loss of cooling if it is not. A cause-and-effect matrix for this project is built under six construction rules [TARGET], and the first of them sets the shape of every row. One cause per row, one execution object per column, and any combination logic written into the intersecting cell, never promoted into a row of its own. The reason is stated beside the rule: it exists to keep stopping the pump, closing the valve and tripping the power from being bound into one indivisible action. Three effects that share a trigger are still three effects, and each of them has its own fail state, its own feedback and its own reset authority.
The effect dictionary makes the scale of that visible. It holds 21 action classes, of which 15 must be executed over hard wiring and only event logging and some remote transmission may travel by software [TARGET]. The terminal count that follows is driven by the granularity chosen for emergency power-off, not by the number of detectors, a distinction that decides panel quantities and room allocation long before any detector is selected. Until the authority rules on that granularity the terminal count stays an unknown; once it rules, the cells can be filled downward from the decision and the refusals become the smaller part of the file.
The Skeleton Already Separates Unit Stop From Zone Pump Stop
A distribution unit sits in three hazard zones at once. Its isolation therefore has to be layered: trip is not close valve, and close valve is not stop the zone. Binding those three into one action turns a probe false-trip into a zone-level loss of cooling. The fire chapter therefore requires three independent rows for the three effects, and forbids merging them.
Three of the matrix rows show the rule doing work. A confirmed alarm limited to the scope of one cooling distribution unit stops that unit only and is forbidden from stopping the zone's pumps. A leak input escalates through four levels, branch valve, then ring segment, then unit, then room assessment, with an independent position feedback required at each [TARGET]. The row that would stop the secondary pumps exists only if the authority rules that it should, because stopping the pumps is loss of cooling and the thermal time constant that would bound it has not been supplied by the cooling side.
The feedback rule is the one no delivered row yet satisfies. Every action needs a position or status feedback returning to the fire panel, and the feedback source may not be the same relay that issued the command. Reset authority has to be named for every action, and automatic reset is prohibited by default unless the authority has ruled item by item.
The fire chapter writes a twenty-three-row skeleton, of which six rows are freezeable now as structure and not as settings. Those six include the single-unit stop. Settings — thresholds, delays, voting — remain empty.
Separation Exists as Refusals, Not as Filled Effect Cells
The machine-side cause-and-effect file carries eight rows, every one open for approval with its own hold [TARGET]. It is not the twenty-three-row skeleton. It refuses the wrong couplings explicitly, and the refusals are the content:
- area smoke annunciates and releases no suppression;
- area heat escalates without automatic power tripping unless the authority has ruled;
- a valve tamper raises a supervisory alarm and shuts down no equipment;
- emergency power-off latches with manual reset and no automatic restart;
- a battery alarm releases nothing without a sequence the authority has ruled;
- a suppression release sequence is separated from authorising an actual discharge.
What the eight rows do not yet carry is the other half. Every command and effect cell is written as to be confirmed, so the separation currently exists as a set of refusals and not as a set of filled cells. The valve question shows why the empty cell is the harder one: a de-energised isolation valve can be specified to hold or to close, and the two choices trade leak containment against loss of cooling in opposite directions.
The controls side holds the matching boundary and states it as a prohibition on itself. Definition of fire actions is not its work, it keeps interface code positions and status points only, and if the building management system implements a shutdown because the point happens to be available, the matrix acquires a second owner who sits outside fire acceptance. That is the specific mechanism by which a separation written correctly on paper is recombined in software.
No fail state has been recorded against a de-energised isolation valve on any of the eight delivered rows, and until one is, the row that would hold the valve and the row that would close it are the same empty cell.
Limits and open items
The six construction rules, the 21 action classes and the 15 hard-wired classes, the four leak levels and the eight machine rows remain register counts [TARGET]. The twenty-three-row skeleton and the six freezeable rows are structure, not settings [TARGET].
Open: emergency-power-off granularity; whether the zone pumps stop; fail-in-place versus fail-closed on the isolation valve; the owner fork on leak auto-close; fire cause-and-effect versus cooling interlock on the same actuator. The facility must not default to auto-close. Nothing has been sealed. Nothing is a filled matrix. [HOLD]
© 2026 K&K Data Service Inc. All rights reserved. Reproduction or republication is permitted only with clear attribution to K&K Data Service Inc. and a working hyperlink to the canonical URL of this article. Excerpts must preserve the technical context, maturity labels, assumptions, and limitations. No excerpt may imply project approval, field validation, certification, or endorsement that the original article does not state.
Source: K&K Data Service Inc., “Electrical Trip, Valve Close, and Zone Stop Are Separate Interlock Effects,” https://www.kkdatasvc.com/lab/fire-structure-site-and-compliance/trip-not-equal-close-valve-not-equal-stop-the-zone/.
Discuss This Constraint. If your project record shows a different result, or the same failure domain under another name, we want to see it. Email inquiry@kkdatasvc.com or use the contact page.