H.E.R.P.S — Functional Safety, Hardwired Trips, Control Modes & Cybersecurity

HERPS Functional Safety Architecture

HERPS Revision D uses an independent functional-safety architecture layered over the normal PLC, HMI, SCADA and supervisory optimization systems.

Safety-critical protective functions are designed so that required protective actions do not rely solely on normal application software, cloud connectivity, enterprise networking or operator intervention.

• Independent hardwired and safety-rated protective actions
• Dual-channel emergency-stop architecture
• Hardwired trip functions
• Start permissives and operating interlocks
• Defined machine safe states
• Cause-and-effect safety logic
• Controlled hydraulic safe-bypass operation
• Electrical and DC-link protection interfaces
• BESS isolation and safety integration
• Controlled bypass and override management
• Industrial firewall architecture
• Segregated OT network architecture
• HAZOP and functional-safety validation framework

Independent Safety Philosophy

HERPS separates normal machine control from independent protective functions. Where the risk assessment requires an independent safeguard, that safeguard is not dependent solely on the normal PLC application, SCADA system, remote HMI, cloud service or enterprise network.

• Local protective capability remains available with external networking disconnected.
• Emergency-stop and independent trip circuits use de-energize-to-trip principles where appropriate.
• Mechanical pressure relief remains independent of PLC and VFD control.
• Electrical unloading is not treated as the sole turbine overspeed safeguard.
• Hydraulic admission reduction and direct-path takeover remain part of the protection strategy.
• Loss of non-safety communications does not remove local hardwired safeguards.
• Safety actions preserve protective bonding and passive/mechanical safeguards.

Dual-Channel Emergency Stop System

Two dual-channel emergency-stop stations — ESD-001 and ESD-002 — are positioned on opposite sides of the HERPS package to provide accessible emergency shutdown capability from normal service approaches.

Hardwired & Independent Trip Register

Independent Mechanical Pressure Protection

HERPS distinguishes the operational high-high pressure trip from the mechanical pressure-relief function. The PT-D201 ≥ 11 bar(g) value is a design-development control-trip baseline and is not the mechanical relief-valve set pressure.

• Main-water pressure boundary: 25 bar(g)
• Approximate maximum normal process ceiling: 10 bar(g)
• Preliminary discharge high-high control trip: ≥ 11 bar(g)
• Mechanical pressure relief remains independent of PLC, HMI, network and VFD availability
• Final PSV set pressure and capacity remain validation-controlled
• Valve closure and pump-rundown timing require water-hammer validation

Main Pump Start Permissives

A HERPS start command is accepted only when the required machine, hydraulic, electrical, thermal and safety conditions are satisfied.

• E-stop loop healthy and reset
• No unacceptable latched hard trip
• Main isolator and switchgear available
• AFE/VFD ready
• Motor protection healthy
• Pump released from maintenance lockout
• Approved suction-path condition
• Direct discharge path available
• Cooling system operating within approved conditions
• Critical instrumentation healthy or approved degraded-mode rules satisfied
• Local controls operational independently of enterprise/cloud connectivity

Operating Interlocks

• Recovery is enabled only when measured pump flow and recoverable hydraulic conditions are valid.
• Recovery flow cannot be commanded above measured pump flow.
• The DN300 direct path assumes required process duty if the recovery branch trips or becomes unavailable.
• Cooling duty/standby operation is supervised and low-low flow escalates to protective action.
• BESS operation requires valid BMS, contactor, precharge, insulation, temperature, SOC and converter conditions.
• Supercapacitor support requires approved voltage, thermal and converter conditions.
• Remote commands are rejected during incompatible local maintenance or commissioning authority.
• Hard safety trips override normal PLC, HMI, SCADA and optimization commands.

Revision D Control Modes

DN300 Recovery-Path Safe Bypass Logic

The recovery subsystem is not required for basic pumping duty. The DN300 direct pressure-control path provides process continuity whenever the DN300 recovery path is unavailable.

• Recovery disabled when usable recoverable head is unavailable
• FCV-D201 carries required flow and pressure duty when recovery is unavailable
• Turbine overspeed causes admission reduction/closure and direct-path takeover
• PMG or rectifier fault disables hydraulic recovery
• DC-link inability to absorb recovered power causes recovery curtailment
• Recovery actuator faults transition toward the validated safe state
• Emergency-stop response places recovery in its validated safe minimum/off state

BESS Functional-Safety Integration

Battery protection is integrated with the wider HERPS cause-and-effect architecture while preserving the ability of the grid-fed pumping system to continue when the BESS is safely isolated, where the applicable hazard assessment permits.

• BMS warnings can derate charge/discharge operation.
• SOC outside the approved operating window limits or stops battery energy transfer.
• Insulation faults open BESS contactors and inhibit DC/DC operation.
• Cell/module overtemperature causes BMS derating followed by isolation at the validated threshold.
• Smoke, off-gas or thermal events initiate BESS isolation and approved fire-response actions.
• HVIL/service-disconnect opening makes the BESS unavailable and inhibits DC/DC operation.
• BMS communications loss transitions the battery to its supplier-approved safe power state.

Alarm & First-Out Event Philosophy

HERPS alarms are intended to be actionable, prioritized and attributable to a defined operator response. First-out trip information is retained to distinguish the initiating event from consequential alarms.

• Priority 1 — trip or immediate protective action
• Priority 2 — high condition requiring prompt operator action
• Priority 3 — advisory, maintenance, communications or degraded-redundancy condition
• First-out cause retention
• Timestamped event history
• Operating-mode recording
• Role-controlled alarm shelving and suppression
• Separate communications-loss indication

Controlled Safety Bypass & Override Management

Protective-function bypasses are controlled engineering actions rather than unrestricted operator functions.

• Maintenance or commissioning authorization required
• Only the specific required function may be bypassed
• Persistent HMI indication while a bypass is active
• Event logging of bypass activation and removal
• Time-limited or shift-limited overrides where practical
• Normal software bypass cannot defeat mandatory E-stop safeguards
• Compensating measures required where applicable
• Proof testing required before normal release after bypass removal

Industrial Cybersecurity Architecture

Cybersecurity protects the availability and integrity of the HERPS control environment but is not treated as the sole functional-safety layer. The machine remains locally controllable and safely trippable when enterprise or cloud connectivity is removed.

Industrial Firewall & Managed Network Segregation

• Industrial firewall separates HERPS OT systems from enterprise/cloud networks.
• Unsolicited inbound traffic follows a deny-by-default policy.
• Only documented required ports, protocols, peers and directions are permitted.
• Managed VLAN segregation separates drives, controls, BMS/EMS and supervisory access.
• Unused physical network ports are disabled or administratively controlled after commissioning.
• Configuration backups and firmware inventories are maintained.
• Network controls must not impair deterministic local machine operation.
• Final addressing, firewall rules, certificates and remote-access configuration remain site-controlled.

Remote Access, Authentication & Change Control

• Remote write access disabled by default
• Authenticated and authorized maintenance access only where permitted
• Separate operator, maintenance/engineering and administrator privileges
• Unique user accounts
• No retained vendor-default passwords at handover
• Automatic timeout for privileged sessions
• Approved firmware and configuration versions
• Configuration backups and change logging
• Controlled portable-media policy
• Safety-related changes require engineering change control and revalidation

Controlled Final-Element Fail Philosophy

Reset, Restart & Recovery After Trip

• Alarm acknowledgement is not equivalent to safety reset.
• Trip reset occurs only after the initiating condition has cleared and the equipment is safe.
• E-stop reset does not automatically restart the machine.
• Overspeed reset does not automatically restart the affected machine.
• BESS thermal/off-gas events require appropriate supplier/site fire-safety release.
• Recovery remains disabled after pump trip until its enable permissives are re-proven.
• Safety-logic or firmware changes require regression testing of affected cause-and-effect functions.

HAZOP & Functional-Safety Validation — D-G15

Final functional-safety release is controlled through the D-G15 validation gate. This process determines the final risk-reduction architecture rather than assuming unresolved SIL, PL, proof-test or site-specific requirements.

• Hazard identification
• Risk estimation
• Independent safeguard review
• Safety-function determination
• SIL/PL determination where applicable
• Final trip thresholds and delays
• Voting and hysteresis requirements
• Final valve fail-state validation
• Bypass policy approval
• Proof-test definition
• Cyber-dependency review
• HAZOP action closeout before final release

FAT / SAT Safety & Cybersecurity Acceptance

Revision D requires functional testing of the safety and cybersecurity architecture before the system is frozen as the final production record.

• Both E-stop stations and channels verified
• Pump overspeed simulation
• Turbine overspeed simulation
• High-high discharge-pressure response
• Cooling and thermal trip verification
• AFE/VFD and DC overvoltage protection verification
• BESS insulation and thermal-event isolation testing
• Loss-of-external-network testing
• Firewall and access-role verification
• Safety-bypass control verification
• Power-cycle testing with no unintended restart
• Operating-mode transition testing
• Optimization safety-boundary verification

Revision D Controlled Safety & Cybersecurity Records

• CTL-D901: Cause & Effect / Optimization
• CTL-D902: Safety I/O Diagram
• CTL-D903: Sequence Narrative
• CTL-D904: Alarm & Setpoint Register
• CTL-D905: Bypass Register
• NET-D901: OT Network Architecture
• NET-D902: Firewall Rule Schedule
• FSA-D901: Functional Safety / HAZOP File
• FAT-D1401: Safety FAT/SAT Record
• ASB-D1501: As-Built Controls Record

Revision D Engineering Status

HERPS-VOL-16 is a Revision D R2.0 consolidated design-development baseline. It defines the source-supported functional-safety, hardwired-trip, control-mode and cybersecurity integration architecture while deliberately leaving validation-controlled and site-controlled values to the required engineering gates.

Final SIL/PL determination, proof-test intervals, final trip delays, final valve fail states, protective-device settings, BESS fire response, site addressing, firewall rule objects, hazardous-area requirements and jurisdictional compliance remain subject to the applicable validation, OEM, site and regulatory processes.

Revision D Engineering Blueprint System

This page provides a public technical overview of the HERPS Revision D functional safety, hardwired protection, control-mode and cybersecurity architecture.

The complete documentation forms part of the wider HERPS multi-volume conceptual engineering blueprint system and remains subject to the stated validation gates before IFC, fabrication or production release.