Electrical Single Points of Failure: Rank the Production Consequence

Prepared by QuangAnhcons · Source review: 16 October 2026.

Rank an electrical single point of failure by the production function it can remove, the credible recovery path and the quality of the supporting evidence—not by equipment size alone. A small shared control supply can interrupt more production than a large feeder. A second transformer does not establish resilience if both routes still depend on one control circuit, cable corridor or unavailable operator action.

This owner-side guide explains how an operating FDI factory can build an auditable consequence register before ordering maintenance or redundancy work. It is not a protection study, a safety assessment, a reliability certification or authority to change switching arrangements. All numerical production and restoration inputs below are explicitly hypothetical. They are not QuangAnhcons project results, failure statistics or contractual guarantees.

1. Define the function and operating state

Start with a function that the factory actually needs: keeping a process within its safe condition, maintaining cooling, retaining controls, preserving a batch or restarting a production line. “Keep the transformer available” is an equipment objective. “Maintain the essential cooling function during an approved source transfer” is a functional objective. The latter exposes dependencies outside the transformer itself.

Agree the assessment boundary with production, facilities, process safety and the equipment suppliers. Identify the normal operating state, planned maintenance states and credible contingency states. Record which functions may stop safely, which cannot tolerate interruption and which require a controlled shutdown. Do not assign a universal permissible interruption from a generic article: use the actual process requirements and approved safety basis.

A single point of failure is conditional on this boundary and state. A feeder may be a single point for one line but not the whole plant. A shared auxiliary supply may become a single point only during maintenance when its alternative is isolated. The register should therefore identify the affected function and state in every row, rather than labelling an entire asset permanently “critical” without explanation.

2. Follow dependencies beyond the power single-line diagram

The electrical SLD is the starting map, not the complete dependency model. Trace the supply through MV switching, transformers, LV sections, essential feeders and final controls. Then ask what enables each supposedly independent route: auxiliary power, trip and closing supplies, interlocks, control networks, cooling, fuel, ventilation, physical access and authorised operating procedures.

Two power paths can share a cable trench or fire compartment. Separate feeders can terminate in the same vulnerable panel. A local backup may depend on a single transfer controller. Conversely, a communications failure may remove remote visibility without stopping local protection or production. Obtain the actual control philosophy before treating all network failures as a plant outage.

For transformer transfer limits, see the separate open-bus-tie N−1 load and load-shedding guide. This consequence register does not repeat that sizing exercise or authorise closing a tie. It asks whether the proposed recovery route is available in the particular scenario being assessed.

3. Build a register whose conclusions can be challenged

Give every scenario a stable ID. Record the initiating failure mode, local effect, downstream effect, affected production functions, detection method, isolation boundary, recovery route, evidence quality and action owner. Describe the failure mode precisely: a failed indication, an open circuit and a device that cannot open have different consequences. Do not merge them into one row called “breaker failure”.

Separate established facts from assumptions. A drawing can support the intended topology; an inspection can support observed condition; a test can support behaviour under the conditions actually tested. An unverified verbal claim that an alternative will work is not equivalent evidence. Keep unresolved items visible and specify the next observation or document needed.

IEC 60812:2018, Edition 3.0, describes the planning, performance, documentation and maintenance of FMEA/FMECA across items, processes and interfaces. Its public scope is useful for structuring this investigation. It is generic and does not provide application-specific safety guidance. This article uses catalogue scope only, not licensed clauses or a claim that the proposed register fully implements the standard.

IEC 31010:2019, Edition 2.0, provides guidance on selecting and applying risk-assessment techniques under uncertainty. The owner should choose a method suitable for the decision and available evidence. The worksheet here is an original consequence-screening proposal, not a prescribed IEC scoring system or a substitute for the project’s formal risk process.

4. Separate safety, production and restoration consequences

Screen safety and environmental implications before comparing production volumes. A scenario with a potential hazardous process state cannot be dismissed because a hypothetical throughput loss is small. Escalate it through the factory’s competent safety and engineering functions. Do not invent an acceptance threshold or assume a risk can be accepted by the maintenance contractor alone.

For production, identify which lines, utilities and batches depend on the failed function. Include quality holds, cleaning, material disposition and restart approval where relevant. A line may remain stopped after electrical power is restored. A nominally unaffected line may also stop because it shares cooling or cannot receive material from the interrupted upstream process.

For restoration, distinguish detection, diagnosis, safe access and isolation, repair or replacement, testing, controlled re-energisation and process restart. Some activities overlap; some require a previous stage to finish. Use an event sequence or a critical-path view rather than adding every labour estimate mechanically. Record access, specialist availability and spare readiness separately from hands-on repair time.

5. Worked example: a smaller component can have a larger consequence

Source class E: every input in this example is invented solely to demonstrate arithmetic. Consider two independent production lines in a fictitious factory. Line A makes 80 units/hour and line B makes 50 units/hour at constant rates during the comparison window. Assume no intermediate stock, recovery overtime, scrap, safety consequence or downstream bottleneck. These exclusions would have to be revisited in a real assessment.

Scenario F-01 is a feeder interruption affecting only line A. Assume sequential, non-overlapping periods of 0.5 hour for diagnosis and safe preparation, 1 hour for repair and verification, and 1.5 hours for process restart. Scenario F-02 is loss of a shared control-power function stopping both lines. Assume corresponding periods of 0.25, 0.75 and 1 hour. These are not standard restoration durations or a promise that any equipment can safely be returned within them.

Independent check: F-02 removes 160 units of opportunity from A and 100 from B, giving 260 units in total. F-01 removes 40 + 80 + 120 = 240 units across its three time segments. Units check: units/hour multiplied by hours gives units. The difference is 20 units in this narrow illustration, although the second interruption is shorter.

The ranking is sensitive to recovery assumptions. F-02 equals the F-01 opportunity loss at 240 / 130 = 1.84615 hours, approximately 1 hour 50 minutes 46 seconds. At an assumed 1 hour, its result would be 130 units; at 3 hours, 390 units. The decision should therefore seek better restoration evidence, not pretend that a small numerical lead makes F-02 definitively the highest risk.

No failure frequencies have been supplied. Consequently, these values are not expected annual losses, availability percentages or a return-on-investment calculation. Nor are “units not produced during the window” automatically lost sales. Production planning and finance would need to assess recovery, inventories, contracts and margins before any commercial conclusion.

6. Rank actions without manufacturing probabilities

Use a transparent discussion order: unresolved safety implications first; then breadth and duration of production impact, recovery feasibility and uncertainty. Distinguish the severity of an individual event from the likelihood of the initiating failure. If credible failure records do not exist, write “not established”, not a precise annual probability copied from an unrelated installation.

A coloured matrix can help organise a meeting, but its categories need definitions accepted by the owner. Do not multiply arbitrary ordinal scores and describe the result as a measured risk. Keep the underlying reasons beside any ranking so a reviewer can see whether it reflects safety, throughput, lead time, common dependencies or simply a missing document.

Prioritisation should also consider the next useful action. A low-cost verification may resolve a major uncertainty before capital spending is justified. Examples include confirming the actual control-power distribution, checking whether a spare matches the installed variant, or reconciling the transfer sequence with the process restart requirements. These are investigation proposals; live inspection and testing still require safe planning and authorised personnel.

7. Compare treatments at the failure-mode level

Possible treatments include reducing failure likelihood through appropriate maintenance, reducing detection time, improving repair access, holding a compatible spare, eliminating a shared dependency or providing a genuinely independent alternative. State which part of the scenario each treatment changes. A monitoring system may shorten detection without preventing the fault. A spare may shorten replacement time but leave diagnosis or safe isolation unchanged.

Adding equipment can introduce other failure modes. A bypass can create a dangerous operating state if its interlocking or procedure is wrong. Additional sources can change fault duty and earthing requirements. A second route installed in the same exposure may not remove a common-cause vulnerability. Evaluate the complete proposed arrangement rather than counting components.

Where the treatment changes the electrical network, commission the relevant design checks separately. The factory fault-case register explains the input-case boundary for a short-circuit study. It is not acceptable to infer breaker suitability, relay settings or safe switching from this production-consequence worksheet.

8. Turn the review into a usable maintenance or upgrade scope

The procurement brief should name the assessed functions, permitted operating states, required site evidence and deliverables. Ask bidders to identify assumptions, exclusions, access needs, owner dependencies and residual risks. A blanket undertaking to “improve reliability” is difficult to verify and can conceal very different scopes between quotations.

Separate investigation, engineering design, supply, installation and verification. Require exact equipment references and applicable manufacturer documents when a physical treatment is proposed. This article selects no device, spare, torque, test voltage, setting or maintenance interval. Those decisions need the real asset information, operating conditions and approved engineering basis.

Give each action an owner, due date, decision gate and closure evidence. Useful evidence might be an approved drawing revision, an inspected spare record, a witnessed functional-test report or an accepted operating instruction. Purchasing a spare or receiving a consultant’s presentation is not automatically proof that the original failure scenario has been treated.

Use the separate operating-factory retrofit and tie-in guide when planning an intervention. An analysis meeting does not authorise an outage or physical work. Isolation, lockout, verification of the safe working condition, stored-energy control and coordinated permits must follow the actual installation and authorised procedures. Do not defeat interlocks or create a fault to demonstrate a consequence.

9. Maintain the register when the factory changes

A new production line, revised control system, UPS bypass, different spare, changed cable route or altered staffing arrangement can invalidate an earlier recovery assumption. Keep a version history showing what changed, which scenarios were affected and who accepted the revised basis. Retain the earlier evidence rather than rewriting history to make an action appear closed.

Use incidents and planned shutdown observations to improve the model. Separate measured timestamps from estimates and explain unusual conditions. One successful recovery is evidence of that event, not a statistical guarantee of future restoration. Review the register after significant changes and within the owner’s management process; this article does not prescribe a universal calendar interval.

For the handover boundary, see the MV/LV, OEM and EPC interface register. Clear ownership helps prevent a corrective action remaining open because each package assumes another party is responsible.

Owner questions before approving a reliability proposal

Does a second transformer remove every single point?

No. Capacity, approved transfer, common auxiliaries, protection, cable exposure and process restart all matter. Independence must be demonstrated for the function and operating state concerned.

Can an asset be critical even if its replacement price is low?

Yes. Replacement cost and production consequence answer different questions. A shared control component can affect several functions; its actual dependencies and recovery plan need evidence.

Is an unknown failure frequency a reason to ignore a scenario?

No. Record the uncertainty and consider proportionate investigation or treatment. Do not convert missing data into either a zero probability or a fabricated precise risk.

What should the factory send for a scoped review?

Provide an authorised SLD, functional and process dependencies, permitted operating modes, incident and restoration records, spare information and constraints on access or shutdown. Remove confidential customer and production details that are not needed for the review.

Sources and evidential limits

• IEC 60812:2018, Edition 3.0 — FMEA and FMECA: source class B, public catalogue scope reviewed. No paywalled procedure, clause or prescribed scoring value is reproduced.
• IEC 31010:2019, Edition 2.0 — Risk assessment techniques: source class B, public catalogue scope reviewed. Selection of a technique does not establish legal or safety acceptance.
• The scenario register, action matrix and production example are original editorial material. Numerical inputs are class E hypotheses, not class D plant records. There is no OEM equipment selection, failure-rate database or claimed customer outcome.

Send the permitted network and process information to QuangAnhcons to discuss an electrical survey, maintenance or upgrade scope. The useful first deliverable is a traceable list of functions, dependencies and evidence gaps—not an unsupported assurance that the plant is fully redundant.