Operations and Safety

Operations and Safety

Note

Design stage. This page describes planned mechanics from the design document. Not implemented yet — see Roadmap (milestone M10).

At real plants most serious incidents happen not in normal operation but in deviations from it: maintenance, startup, shift change, a temporary bypass. Prompt Critical turns these moments into mechanics. Hazardous energy is isolated with a personal lock, work goes ahead under a permit, the atmosphere is checked with an instrument, pressure goes to the flare, and fires are fought by a system you designed. Mistakes lead to realistic consequences, and hazards are recognized through instruments.

This section owns the sim.ops package (Lockout, WorkPermit, ShiftLog) and the items lockout_padlock, lockout_tag, work_permit.

Common rules

• Hazardous energy kinds (EnergyKind): ELECTRICAL, MECHANICAL (Create rotation, flywheels), PRESSURE, THERMAL, CHEMICAL, RADIATION, GRAVITY (raised loads, control rods).
• Isolation point — a block that physically cuts off energy and accepts a lock. Its isolated position is fixed (gate valve closed, breaker open and racked out).
• Enforcement level ops.permit_enforcement: OFF, ADVISORY (default: warnings, log entries, shift score), ENFORCED (actions without a permit or lock are blocked). A LOTO lock works always when hung — it is a physical item.
• Single player: you hold all roles, sign a permit yourself on one screen, and two-sided procedures (shift handover) are off. Isolation and atmosphere mechanics stay fully active.
• Time: confined-space atmosphere, fires and flares run in real time (1–4 Hz). Repairs, wear and inspection intervals run in SLOW physical time. Permit and shift durations are real minutes.

LOTO — lockout/tagout

The procedure follows OSHA 29 CFR 1910.147 and equipment-isolation practice:

Step	Action	In the mod
1	Identify all energy sources	the permit builds an isolation plan automatically from network topology
2	Notify affected people	permit shown on permit_board and via pc_ops
3	Normal shutdown	command from panel or Lua
4	Isolate: close, open, disconnect	isolation points moved to the isolated position
5	Hang a personal lock and tag on each point	lockout_padlock + lockout_tag
6	Release stored energy	drain, vent, discharge, lower loads
7	Verify zero energy	try to start + measure
8	Work	permit ACTIVE
9	Remove: people and tools out, locks off, return to service	only the lock owner

Items and blocks

id	What	Mechanic
lockout_padlock	personal lock	lock_owner component (UUID, name, body colour); the key cannot be transferred; up to 8 locks per player (ops.max_locks_per_player)
lockout_tag	"Do not operate! People at work"	lock_tag (owner, reason, permit number, time); without a lock it is only a warning (tagout)
lockout_hasp	6-lock hasp	the point returns to service only when the last lock is removed
lockout_box	group lock box	the responsible person locks the points and puts keys in the box; the crew hangs personal locks on the box
line_blind	spectacle blind on a flange	OPEN/BLIND; positive isolation for hazardous media; swapping takes 10 s and needs ≤ 0.05 MPa in the line (otherwise a release)
mechanical_disconnect	lockable coupling on a Create shaft	breaks rotation transfer; upstream keeps turning
voltage_tester	voltage detector	shows voltage on a bus or breaker; must be proved on a known live source before and after (three-point test)

Isolation points

Block	Energy	Isolated position	Lock
valve_gate, manual valves	pressure, chemical, thermal	closed	on the handwheel / actuator (motor-operated: also cut actuator power)
valve_control	same	closed	only together with a manual valve — a control valve is not an isolation valve; under ENFORCED it alone does not count
esd_valve	same	fail position	on the manual override + vent actuator air
line_blind	same	BLIND	on the turning mechanism
grid breaker (pc_breaker)	electrical	open, racked out, earthed	on the cell shutter
relay_power_supply, ups_cabinet	control power	off	on the switch
mechanical_disconnect, pump couplings	mechanical	disengaged	on the lever
control_rod_drive	gravity	rods in, gripper released	on the drive; only in SHUTDOWN

While at least one lock hangs on a point:

• manual operation is impossible ("LOCKED OUT: ");
• Lua commands return E_INTERLOCK: LOCKED_OUT;
• wired PLC/relay outputs and watchdog actions are ignored;
• the safety system cannot move a locked device. If its action matches the isolated position (close a closed valve) there is no conflict; if it needs the opposite (open a deluge valve locked closed), the lock wins and the safety function reports failure to execute. Locking fire-protection or emergency-relief elements therefore needs a permit with compensating measures (fire watch).

Isolation plan and double block-and-bleed

When a permit is created for equipment, the domain walks the network graphs: hydraulic connections up to the nearest isolation points, breakers feeding motors and heaters plus control circuits, drive couplings, and stored-energy items. For TOXIC, FLAMMABLE, TOXIC_CO or ASPHYXIANT media above 1 MPa (ops.dbb_pressure_pa) it proposes double block and bleed (two valves with an open drain between them) or a line_blind.

Why: a single valve leaks through its worn seat. Example: 1 g/s of methane leaking into a 2 m³ isolated section raises pressure by 78 Pa/s — 0.1 MPa in 21 minutes. With an open bleed between two valves the pressure at the work site does not rise.

Stored energy	Release	Check
pressure in an isolated section	vent to flare or stack, drain	gauge ≈ 0
esd_valve spring	stroke to fail position	limit switch
pump flywheel	coast down (tens of seconds)	shaft speed = 0
capacitors, UPS batteries	disconnect and discharge	voltage_tester
raised load, counterweight	lower and secure	visual
hot medium	cool below 333 K	thermometer

"Verified" is ticked only by fact: an attempted start from the normal station does nothing, voltage_tester reads dead, pressure ≤ 0.01 MPa gauge, shaft speed 0, temperature below 333 K, and gas testing for atmosphere.

Multiplayer rules

Action	Who	Station log
Hang a lock	any station member with a work role (MAINTENANCE, ENGINEER, OPERATOR, OWNER)	LOCKOUT_ON
Remove own lock	owner only	LOCKOUT_OFF
Remove someone else's lock	no player; an admin with /pc lockout cut <point> <reason>	LOCKOUT_ADMIN_CUT (CRITICAL), announced to the station
Abandoned lock (owner offline)	if ops.abandoned_lock_hours > 0, a SHIFT_SUPERVISOR may remove it by procedure after inspecting the site	LOCKOUT_REMOVED_BY_PROCEDURE
Break a locked block	forbidden in all server modes except realistic, where it raises a P1 "ISOLATION TAMPERING" alarm	UNAUTHORIZED_ACCESS (CRITICAL)

The lock is also an anti-griefing tool: a member can lock equipment under repair and nobody — no member, no foreign computer — can start it. See Multiplayer.

Isolation point states: IN_SERVICE → ISOLATED → LOCKED → VERIFIED; removing the last lock returns to ISOLATED.

Work permits

PermitType	Required (under ENFORCED)	Mandatory items	Max duration
COLD	repair in an operating unit	isolation plan	one shift
HOT	any spark or flame within 11 m of a FLAMMABLE medium	isolation, LEL test before and continuously, fire watch, extinguishers	4 real hours
CONFINED_SPACE	entry into a confined space	positive isolation, ventilation, O₂/LEL/H₂S/CO test, attendant, rescue equipment	one shift
ELECTRICAL	work on grid equipment	open, rack out, earth, voltage_tester check	one shift
RADIATION	work in controlled unserviced areas	dose plan, health physicist, radiological PPE (Radiation Safety)	per dose plan
MOC	change to a PLC program flagged critical, safety bypass longer than 1 h, temporary pipe bypass	change description, risk checklist, approval by ENGINEER + SHIFT_SUPERVISOR	until the change is closed

work_permit is a form item (component permit_data) opened with right-click; the original lives in the domain, items are copies for the crew. A permit_board in the control room shows all station permits. Fields: number, type, scope (click blocks), hazards (HazardTag, EnergyKind, pre-filled), isolation plan, gas tests with timestamps, required PPE, times, signatures.

Permit role	Who	Confirms
Issuer	ENGINEER, SHIFT_SUPERVISOR, OWNER	scope, hazards, measures
Area authority	SHIFT_SUPERVISOR, on-shift OPERATOR	isolation done, site prepared
Person in charge	MAINTENANCE, ENGINEER	crew briefed, work per permit
Crew member	any station member	read and acknowledged (signature = right to be in the work area)

Permit states: DRAFT → ISSUED → ISOLATED → GAS_TESTED → ACTIVE → WORK_COMPLETE → CLOSED; gas alarm, safety trip, fire, unhanded shift end or expiry → SUSPENDED; EXPIRED. In SUSPENDED nobody may be in the work area: under ENFORCED players get 60 s to leave, then UNAUTHORIZED_WORK is logged.

Gas testing

Use a portable_gas_detector (four sensors: catalytic LEL, electrochemical O₂, H₂S, CO) or a fixed gas_detector bound to the work area. Results go into the permit automatically when you hold the instrument in the area for ≥ 30 s (T90); in confined spaces at three heights — top, middle, bottom — because gases stratify.

Parameter	Confined space entry	Hot work
O₂	19.5–23.5 %	19.5–23.5 %
Flammables	< 10 % LEL	0 % LEL in the area, < 10 % with continuous monitoring
H₂S	< 10 ppm	< 10 ppm
CO	< 25 ppm	< 25 ppm

The instrument needs a bump test with calibration_gas within the last 24 h (ops.bump_test_max_age_s), otherwise the result is marked "instrument not checked" and rejected under ENFORCED. Retest every 2 h (ops.gas_retest_s) and after any break. For hot work and confined spaces the detector must be worn — an alarm suspends the permit.

Hot work

Hot work is anything that can ignite a flammable atmosphere: placing, removing or "welding" pipe blocks on hydrocarbon networks and on flammable vessels; angle grinders, welding sets and similar tools; open flame (flint and steel, torches) within 11 m (35 ft, OSHA 1910.252). On each hot action the domain samples the atmosphere at 27 points around it; if any point is at ≥ 100 % LEL, the cloud flashes or explodes through DamageBudget. With an active HOT permit (0 % LEL, a fire watch with an extinguisher within 11 m, isolation in place) the only risk is what changed after testing — hence continuous monitoring.

Confined spaces

A confined space is registered by a manway block on a vessel, column, header or pit wall. On placement a flood fill finds an air volume of ≤ 2048 blocks (ops.confined_max_volume) with no more than two 1×1 openings — otherwise it is a room. Mine workings use the separate mine model (Coal and Metallurgy).

The atmosphere is a well-mixed volume (O₂, N₂, Ar, CO₂, CH₄, H₂S, CO, hydrocarbon vapours) with inflows from valve seat leaks (which is why positive isolation matters), nitrogen purge, sludge decomposition and combustion, and ventilation — natural through the manway (0.002 m³/s per opening) or a portable_ventilator (0.5 m³/s). It is computed at 1 Hz only when a player is inside or at the entry, or inflows are changing.

Example: a 20 m³ vessel with nitrogen leaking through a valve at 1.7 L/s drops from 20.9 % to 16 % O₂ in 52 minutes; a 50 L/s purge reaches 10 % in 5 minutes. Ventilating from 5 % back to 19.5 % takes 2.4 volume changes with perfect mixing; the mod applies a mixing factor of 3 → 7.3 air changes.

Gas	Level	Effect on the player
O₂ (asphyxiant)	16–19.5 %	Slowness I
	12–16 %	Slowness II, nausea, blur, 10 % of right-clicks miss (impaired judgement)
	8–12 %	Blindness, Weakness, 1 damage/s (promptcritical:asphyxiation)
	< 8 %	unconscious after 10 s, 2 damage/s; below 6 % death in ≈ 40 s
H₂S	10–50 ppm	nausea
	100–500 ppm	olfactory paralysis — the rotten-egg smell cue disappears; poison
	500–1000 ppm	unconscious in 30 s
	> 1000 ppm	instant collapse, 4 damage/s
CO	carboxyhaemoglobin builds with time constant 600 s	10–20 % nausea, 30 % slowness, 40–50 % unconscious, > 60 % death. 100 ppm → 10.3 % COHb (headache); 1000 ppm → 53 % (unconscious)

Why a filter mask does not help: a gas_mask removes contaminants but adds no oxygen and gives no protection below 17 % O₂. A catalytic LEL sensor in nitrogen reads zero — "no flammables", which is true, but there is nothing to breathe. Hence the mandatory O₂ sensor in every gas test.

Attendant and rescue. Under CONFINED_SPACE:

• an attendant must stand within 4 m of the manway and not enter; without one, entry is blocked under ENFORCED;
• the entrant wears a safety_harness with a lifeline attached to a rescue_tripod over the opening; the attendant rescues without entering (right-click the tripod — the winch pulls the player out in 5 s, even unconscious);
• entering to rescue without a scba means the same atmosphere and the same collapse. A large share of confined-space deaths are would-be rescuers, and the mod reproduces this without scripting.

Patrols and shifts

Patrol rounds. A route is an ordered list of patrol_checkpoint blocks. With a patrol_reader, right-clicking a checkpoint records the visit and opens its card: read the local instrument and enter the value (a discrepancy > 2 classes flags "instrument faulty?"), listen to the equipment (choose "bearing noise", "cavitation" — a correct choice opens a repair work order), inspect for leaks, locks and tags. The route must be walked within ops.patrol_period_s = 3600 s, otherwise a P4 "PATROL OVERDUE" alarm. Patrols find what telemetry cannot: hidden sensor failures and early acoustic symptoms.

Shift log (ShiftLog) summarizes for people: events (scrams, trips, P1 alarms, starts/stops), operator entries, standing orders, equipment under repair, deviations (safety bypasses, PLC forces, shelved alarms, devices in MAINTENANCE), and the shift report from the historian.

Shift handover. A shift lasts ops.shift_length_s = 3600 real seconds when a SHIFT_SUPERVISOR is online (servers can disable shifts). States: ON_SHIFT → HANDOVER_PENDING → ON_SHIFT (new); 10 min without a signature keeps the old shift with a P3 "SHIFT NOT ACCEPTED"; outgoing player leaves → UNATTENDED. The incoming supervisor must tick every checklist item: open permits, locked points, safety bypasses, forces, shelved alarms, deviations, orders. Permits pass to the new shift; an unsigned transfer suspends them. Shift score: −5 for an unaccepted shift, −3 per item marked "not checked", +5 for a shift with no overdue permits and completed patrols.

Public address system

Block	Function
intercom_station	PA console: push-to-talk, channel and zone selection, prerecorded message buttons; usable by a player within 2 m holding a key card of the right role
plant_loudspeaker	horn speaker; zone assigned in its GUI

Channel	Who speaks	Heard	Priority
EVAC	automatic: fire panel in FIRE, fire & gas safety logic, radiation alarm; live voice only SHIFT_SUPERVISOR	all speakers	0
FIRE_GAS	automatic, SHIFT_SUPERVISOR	event zone and neighbours	1
ALL	OWNER, SHIFT_SUPERVISOR	all zones	2
CONTROL	OPERATOR, SHIFT_SUPERVISOR	control room, turbine hall, units	3
MAINTENANCE	MAINTENANCE, ENGINEER	workshops	3
CHEM_RAD	CHEMIST, HEALTH_PHYSICIST	chemistry, controlled area	3

A message is intelligible where the speaker level exceeds the plant noise by ≥ 10 dB: with 110 dB(A) at 1 m, one horn covers 5.6 m in an 85 dB(A) turbine hall but the full 48 m limit in a 55 dB(A) yard — so noisy halls need many speakers. Live voice uses optional Simple Voice Chat integration (mod.compat.voicechat); without it, and always for automatic messages, there are sirens, gongs and prerecorded phrases (pa.voice.fire_zone, pa.voice.gas, pa.voice.evacuate, pa.voice.all_clear) with subtitles. The PA runs on 0.4 kV backed by station_battery. Lua: announce, page, getPaStatus; event pc_pa_announce.

Relief systems and flares

Relief valves

valve_relief gets a psv_spec component: set pressure, orifice letter (API 526), discharge destination (atmosphere / flare header / drain), conventional or balanced bellows, last bench test date.

Parameter	Value
Set pressure	≤ MAWP of the protected volume
Accumulation	10 % (single valve), 16 % (multiple), 21 % (fire)
Blowdown	7–10 % below set
Back pressure	conventional ≤ 10 % of set; bellows up to ≈ 50 %
Inlet loss	≤ 3 % of set ("3 % rule", otherwise chatter)

Orifice area is sized per API 520 for gas (critical flow) or liquid. Example: separator gas, 10,000 kg/h, M = 18, 320 K, set 1000 kPa(g) → 1342 mm² → next larger orifice L (1841 mm²). Standard orifices: D 71, E 126, F 198, G 325, H 506, J 830, K 1186, L 1841, M 2323, N 2800, P 4116, Q 7129, R 10 323, T 16 774 mm². If the required flow is < 25 % of capacity (oversized valve) or inlet loss > 3 %, the valve chatters: seat wear ×10 and leakage after reseating. Relief scenarios to check: blocked outlet, cooling/condenser failure, exchanger tube rupture, thermal expansion of trapped liquid, and external fire (API 521). The valve GUI has a sizing wizard.

Discharge to	When allowed	Consequence
Atmosphere (vent stack)	steam, air, nitrogen, water	nitrogen is an asphyxiant within 3 m below the stack in still air
Atmosphere, hydrocarbons	forbidden under ENFORCED, warning under ADVISORY	vapour cloud, ignition from any source, emissions
Flare header	flammable and toxic gases and vapours	see below
Closed drain	liquids	drain vessel

Flare system

Block	Function	Mechanic
flare header	pipe_large designated "flare"	back pressure on relief valves rises with flow
flare_knockout_drum	separates droplets	overfilled drum → liquid carryover → burning rain: class B fire within 40 m (ops.flare_rain_radius_m)
flare_seal_drum	water seal	stops air and flame flashing back; low water level → explosion in the header
purge gas	nitrogen or fuel gas at the stack base	without purge, air enters the stack (O₂ > 6 % at the base: P2 alarm)
flare_stack	stack segments 1×1×1, height H	height sets ground-level radiation
flare_tip	tip with 3 pilots and steam ring	losing all pilots → unburnt release (P1)
flare_ignition_panel	flame-front generator	pilot ignition; thermocouple, steam and gas tags

Smokeless burning. Steam to the tip entrains air: required steam/hydrocarbon ratio is 0.25–0.5 kg/kg for light saturated gas, up to 1 for olefins. Too little steam → smoke (Ringelmann particles, emissions); more than 3× required → combustion efficiency falls below 0.98, down to 0.6 and flame-out. CO₂, SO₂ (from H₂S) and unburnt methane go to the emissions ledger (Environment and Economy).

Radiation (API 521 point source, 25 % radiant fraction):

kW/m²	Permissible	Effect on the player
1.58	continuous presence	—
4.73	emergency action 2–3 min	0.5 damage/s without fire_suit
6.31	emergency action ≤ 30 s	1 damage/s
9.46	seconds — escape	3 damage/s, ignition
≥ 12.5	wood and wool blocks ignite	through DamageBudget

Example: an emergency release of 50 kg/s of gas (50 MJ/kg) = 2.5 GW; the 6.31 kW/m² boundary is ≈ 89 m from the flame centre. The stack must be tall and the sterile zone around it empty.

Nitrogen purging

Before opening equipment — gas freeing; before startup — air freeing. Nitrogen comes from the air separation unit.

Method	Formula	Example
Continuous sweep with dilution	x = x₀·e⁻ⁿ	100 % CH₄ → 1 %: 4.6 volumes, 6.9 with mixing factor 1.5
Pressure cycles	x = x₀·(p_low/p_high)ᵏ	0.1 ↔ 0.6 MPa abs: 3 cycles to 1 %

Air freeing target: O₂ ≤ 60 % of the limiting oxygen concentration — for methane ≤ 7 % O₂ (ops.purge_o2_target). A nitrogen-purged vessel is an asphyxiant hazard for entry: ventilate with air and gas-test first.

Fire fighting

Class	Burns	Extinguish with	Never with	Where in the mod
A	solids (wood, coal, polymers)	water, foam	—	stores, cables, graphite (special)
B	liquids (oil products, alcohols)	foam, powder	solid water jet (spreads burning liquid)	tanks, spills
C	gases	shut off the source; powder	extinguishing a gas flame without cutting supply (re-ignition of the cloud)	pipelines, gas plant
D	metals (Na, K, Mg, Zr, U)	special powder, dry sand	water (reaction, hydrogen, explosion)	sodium reactor, zirconium, melts
E	live electrical equipment	powder, CO₂, gas	water and foam before de-energizing	grid, I&C cabinets

Detection

id	Detector	Response
smoke_detector	optical smoke	above threshold, 10–30 s lag
heat_detector	fixed 57/68 °C or rate > 10 K/min	RTI element model with Alpert ceiling jet
flame_detector	IR/UV, line of sight to 30 m	≤ 5 s; safety input FIRE_DETECTED, usually 2oo3
manual_call_point	manual	instant
gas_detector	gas	GAS_DETECTED

Example: a 1 MW fire under a 6 m ceiling heats the ceiling jet by 85 K; a standard-response sprinkler (RTI 100, 68 °C bulb) operates in ≈ 36 s. The fire_alarm_panel groups detectors into zones, uses two-detector logic before releasing suppression, adds a warning delay for gas systems, and drives sirens. Process-unit fire & gas logic uses a sis_logic_solver with energize-to-act outputs.

Suppression systems

id	System	Rate	Activation	Notes
sprinkler_head	sprinkler	4.1 / 6.1 / 8.1 / 12.2 / 16.3 mm/min by hazard class (NFPA 13)	each bulb individually	only over the fire; class A
deluge_nozzle	open deluge nozzle	vessel cooling ≈ 10.2 L/(min·m²)	group valve from fire panel or safety logic	cools vessels near a fire — without it, BLEVE
foam_chamber	tank foam chamber	≥ 4.1 L/(min·m²) on the surface, 55 min	panel, safety logic or manual	foam_concentrate via foam_proportioner (3 % or 6 %)
fire_monitor	monitor nozzle	1000–4000 L/min, up to 60 m	manual or remote	water or foam
fire_hydrant	ring main hydrant	0.6–1.0 MPa	hose connection	—
fire_water_pump	fire pump	—	auto-start on main pressure drop	diesel drive or Create shaft; small jockey version
gas_suppression_cylinder	room gas suppression for I&C rooms	inert gas (O₂ to 12–13 %), CO₂ ≥ 34 % (lethal), clean agent ≈ 7 %	two detectors + 30 s delay with siren	inert gas and CO₂ are asphyxiants; lock it out with LOTO while people work in the room
fire_extinguisher	water, foam, ABCE powder, CO₂, D powder	one fire up to 1–4 m²	right-click	wrong class is useless or dangerous

Fire model

New fire kinds: POOL_HYDROCARBON, JET_GAS, SOLID_A, ELECTRICAL_E, alongside the reactor fires (graphite, uranium metal, hydrogen jet, sodium). A pool fire's power is Q = 0.7 · ṁ'' · ΔH_c · A (burning rate gasoline ≈ 0.055, crude and diesel ≈ 0.045 kg/(m²·s)); a 20 m gasoline tank fire is ≈ 530 MW.

• Foam: at solution rate ≥ 4.1 L/(min·m²) the burning area shrinks linearly over t = 300 s × r_min / r; below the minimum rate the flames destroy the foam and the fire is not extinguished — the real reason many tank fires fail. Plain water on class B spreads the pool by 20 % per minute.
• Deluge cooling at or above the design rate keeps neighbouring vessel walls below 573 K; otherwise BLEVE or rupture.
• Sprinklers: a class A fire is extinguished if operated heads over it deliver the class rate within 120 s; otherwise it grows as a "fast" t² fire until fuel-limited.

All fire damage goes through DamageBudget. A station fire brigade building and a Create fire engine contraption are backlog (M15).

Maintenance

Planned preventive maintenance

A WorkOrder is created automatically from counters and due dates, or manually, and proposes the right permit type and isolation plan.

Input	Counter	Default threshold	Work
pump and turbine bearings	accumulated L10 damage	0.7 of life or vibration zone C	bearing replacement
valve seats	cycles, seat leakage	leak > 1 % of rated flow	valve overhaul
sensors	calibration due	30 physical days	calibration
safety functions	proof test due	per SIL	proof test
relief valves	bench test due	365 physical days (ops.psv_test_interval_days)	remove, test on valve_test_bench, refit
catalysts	activity	< 0.6	replace at turnaround
walls	remaining life	< 2 × inspection interval	thickness survey, section replacement
UPS	capacity	< 80 %	discharge test, battery replacement

Turnaround

A full unit overhaul lasting several physical days that you plan and execute:

Phase	Work	Mechanic
PLANNING	work list, spare parts, crews, schedule	planning screen with critical-path calculation
SHUTDOWN	normal shutdown by procedure	safety logic in "planned shutdown" without trips
FREEING	drain, steam out, nitrogen purge, blinds	gas tests; nitrogen from air separation
OPEN	open vessels, inspect, repair, change catalyst	mass permits and LOTO, confined spaces; pyrophoric iron sulfide in sour service ignites on air unless wetted first
BOX_UP	reassemble, remove blinds, leak test	leaks show as particles and pressure drop
PSSR	pre-startup safety review (OSHA 1910.119(i))	automatic checklist: permits closed, locks off, blinds out, safety proof tests done, loop check sheet closed, no forces
STARTUP	start	—
COMPLETE	results	duration vs plan, incidents, cost

A turnaround can also be triggered by statutory pressure-vessel inspection every 1460 physical days (ops.statutory_inspection_days): escalating P3 alarm, then optionally no restart after the next shutdown.

Ultrasonic thickness. ultrasonic_thickness_gauge shows wall thickness (±0.1 mm). Minimum thickness per ASME B31.3, remaining life RL = (t_actual − t_min) / corrosion rate, next inspection at RL/2 (API 570). Example: 219 mm pipe at 4 MPa → t_min 3.14 mm; 6.1 mm actual at 0.25 mm/yr → 11.8 years remaining, inspect within 5.9 years.

Spare parts carry a spare_part_spec (DN, shaft size): bearing_kit, mechanical_seal, gasket_set, gland_packing, valve_trim_kit, filter_cartridge. No repair without the part. Parts come from the machine shop (steel, copper) and chemistry (seals, PTFE, elastomers). Valve overhaul and relief-valve setting are done on the valve_test_bench.

Maintenance panel

Every major unit — pump, compressor, turbine, column, furnace, blast furnace, exchanger, generator — gets one maintenance_panel (an idea from GregTech: New Horizons' maintenance hatch, mapped onto real engineering). It shows what exactly is wrong, how badly, what it leads to, and how to fix it. Faults are never random: each is a threshold on a wear variable already computed elsewhere. The front shows 6 category lamps (mechanical, seals, heat transfer, corrosion, instruments, electrical); right-click opens the screen:

┌ MAINTENANCE  P-101 "Feed pump"                          run time 4,812 h ┐
│ ● BEARING (coupling end)      ███████░░  REPAIR REQUIRED               │
│   effect: vibration ×2.4 (zone C), efficiency −3 %, trip risk 0.8 %/h   │
│   fix: [bearing_kit 50]  stop  LOTO(mech+elec)  ~60 s                   │
│ ● MECHANICAL SEAL             ████░░░░░  ATTENTION                      │
│   effect: leak 0.02 kg/s (flammable)                                    │
│ ? DISCHARGE WALL THICKNESS    not measured for 412 days → [ultrasonic_thickness_gauge] │
│ ● LUBRICATION                 ██░░░░░░░  normal for 30 h                │
└ [Create work order]  [Add to turnaround]  [Log] ─────────────────────────┘

Severity: 0 normal, 1 ATTENTION, 2 REPAIR REQUIRED, 3 CRITICAL. Faults never stop a unit permanently; they reduce efficiency and output, raise vibration, leaks and trip rate (λ_trip = λ₀(1 + Σ c_k·s_k²) — the square keeps wear invisible until mid-life, then sharply dangerous).

Fault	Detected by	Fixed with	Conditions
BEARING_WEAR	stage 1–2 only by vibrometer spectrum; stage 3 by bearing temperature	bearing_kit	stop, LOTO mech + elec, 60 s
LUBRICATION	counter	grease_gun + lube_oil	greasing on the run
IMBALANCE	vibrometer	balancing_weights	on the run (trial weight)
MISALIGNMENT	vibrometer (2×)	alignment_kit	stop, LOTO, 120 s
SEAL_LEAK	leak rate, patrol	mechanical_seal + torque_wrench	stop, LOTO, double block and bleed
FLANGE_LEAK	inspection, gas test	gasket_set + torque_wrench (cross pattern)	depressurize, LOTO
PACKING_LEAK	inspection	tighten or gland_packing	isolation to replace
VALVE_SEAT_WEAR	pressure test behind a closed valve	valve_trim_kit or bench overhaul	isolation (an unreliable isolation valve!)
HX_FOULING	temperature approach and Δp trends	hydroblast_lance	isolation, COLD permit
FURNACE_COKING	tube wall thermocouples, Δp	steam-air decoking procedure (PLC sequence)	unit down, furnace on steam
CORROSION_THINNING	only ultrasonic_thickness_gauge	section replacement (hot work)	HOT permit, gas freeing
SENSOR_DRIFT	calibration due; size only by calibration	instrument_calibrator	sensor in MAINTENANCE
FILTER_CLOGGING	differential pressure	filter_cartridge	isolate filter
INSULATION_AGING	insulation_tester on a de-energized machine	drying or rewinding	electrical LOTO
CATALYST_DEACTIVATION	analyzers	catalyst change	turnaround OPEN phase

The panel only shows what is diagnosable: early bearing wear, wall thinning and sensor drift appear as "?" with the instrument to use; exact severity appears after measurement and ages. With the tool in hand and conditions met, a progress bar runs, the part is consumed, the wear variable resets and MAINTENANCE_DONE is logged. Under ADVISORY you may repair "on the run" with consequences (medium release when changing a seal under pressure, injury from rotating parts) and an UNSAFE_MAINTENANCE log entry. Lua: getFaults() on any pc_device; event pc_maintenance_required; tag <unit>.maint.severity.

Personal protective equipment

id	Slot	Protection	Limits
hard_hat	head	falling objects ×0.3 damage	one head slot; masks fit as an insert
gas_mask + gas_mask_filter	head	×50 against gases of the filter type: A organic vapours, B inorganic (H₂S, Cl₂), E acid (SO₂, HCl), K NH₃, CO, AX low-boiling organics	no protection below 17 % O₂ or against N₂/Ar/CO₂; filter consumed by concentration × time
scba + scba_cylinder	chest + mask	full isolation, ×10,000, any O₂	6.8 L × 30 MPa ≈ 2000 L at 40 L/min ≈ 50 min; whistle at 20 %
fire_suit	body	radiant heat ×0.1, burning ×0.2	Slowness I, overheating after 5 min of work
safety_harness + lifeline	body overlay	fall ≤ 2 m with no damage when anchored; confined-space rescue	16 m lanyard
hearing_protection	head insert	−25 dB on hazardous sounds (deafening effect only)	—

The hard_hat has one insert slot (ppe_attachments): gas_mask, scba mask, hearing_protection or the radiological half-mask. Radiological PPE is covered in Radiation Safety.

Hazard marking

Hazard signs (radiation, chemical, electrical, UN numbers and hazard diamonds for products) are functional blocks owned by this section; the decor family only uses them (Player Content).

Real-world lessons

The section reproduces, without naming sites, lessons such as: a permit lost at shift change (a pump started without its relief valve), a forced interlock left after commissioning, a misreading level gauge and column overfill, a temporary bypass without calculation, and nitrogen in a confined space. Each is available as a simulator scenario (Player Content).

See also

• Multiplayer — roles, station log, anti-griefing, DamageBudget
• Automation Platform — analyzers, safety logic solvers, forces, MOC for PLC programs
• Accidents — consequence pipeline, reactor fires
• Radiation Safety — radiological PPE and zones
• Oil and Gas — flares, tanks, pipelines
• Environment and Economy — flare and fire emissions