◇ OpenCyber Academy
Engineering · Chapter 6 · English

Chapter 6 — Calculus II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Calculus II

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Geometric retries on a fieldbus"]
  N2["6.2 Alarm backlog as a rate equation"]
  N3["6.3 When continuous is enough"]
  N4["Practice note"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Geometric retries on a fieldbus"]
  N2["6.2 Alarm backlog as a rate equation"]
  N3["6.3 When continuous is enough"]
  N4["Practice note"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Geometric retries on a fieldbus]
    |
    v
[6.2 Alarm backlog as a rate equation]
    |
    v
[6.3 When continuous is enough]
    |
    v
[Practice note]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) use series to reason about repeated retries of plant communications; (2) apply a simple differential model to alarm backlog; (3) decide when a continuous model is good enough for a maintenance debate.

6.1 Geometric retries on a fieldbus

If each Modbus request succeeds with probability p = 0.9 independently (synthetic, for a noisy trunk), the chance of succeeding within k tries is 1 − (1 − p)^k. With k = 3, that is 0.999. Retries raise reliability but multiply traffic: expected attempts until success equal 1/p ≈ 1.11, so a 1,000-poll cycle expects about 1,110 frames. The communications budget (Chapter 3) must count the retries, not only the logical polls.

Lena includes retries when she checks the RS-485 trunk to PLC-A, since a noisy period can raise traffic by a tenth or more.

6.2 Alarm backlog as a rate equation

Let B(t) be open alarms. Alarms arrive at rate a and are acknowledged at rate c when staffed. Then B′ ≈ a − c. If a = 3.3/h (the pre-rationalisation rate from the alarm lab) and two operators together clear 2.0/h, the backlog grows. After rationalisation to 1.05/h, the same staff clears it. The model is crude — it ignores priority — but it makes staffing and rationalisation quantitative.

"""Lab: alarm load per operator hour before and after rationalisation (synthetic counts)."""
before = {"T-1 high": 140, "T-2 high": 95, "R-101 temp": 30, "pump trip": 6, "comm loss PLC-A": 210, "door open": 75}
remove = {"comm loss PLC-A": 200, "door open": 70, "T-1 high": 110}   # chattering/duplicate alarms removed
hours = 24 * 7
tb = sum(before.values()); ta = tb - sum(remove.values())
print(f"week alarms before={tb} after={ta}")
print(f"per operator-hour before={tb/hours:.2f} after={ta/hours:.2f}")
top = max(before, key=before.get)
print(f"worst source before: {top} ({before[top]/tb:.0%} of load)")

Expected output:

week alarms before=556 after=176
per operator-hour before=3.31 after=1.05
worst source before: comm loss PLC-A (38% of load)

Lena uses the model to argue for rationalisation before asking for staff. The numbers made the case clearly.

6.3 When continuous is enough

Maintenance debates often need an order of magnitude: "Will 200 chattering communication-loss alarms per week overwhelm one operator?" Yes: that alone is about 1.2/h. Reserve exact analysis for loops that affect safety timing.

Synthetic case — Ashford Batch Plant. The alarm lab cut weekly load from 556 to 176 by removing known chattering sources. Lena used B′ to show that one night operator could keep up after the change, which unblocked the CNHP proposal that had been stuck on "we need more staff first".

6.4 Errors and limits

Independence of retries fails when the trunk is systematically down. Backlog models ignore safety-critical alarms that must interrupt; treat those separately.

When the trunk to PLC-A is down, every retry fails together, so the geometric formula greatly overstates reliability; Lena treats a trunk outage as a separate case with its own alarm. Likewise, high-high level on T-1 or a trip from SIS-B must reach the operator at once, whatever the backlog of routine alarms. The rate model is for planning staffing and rationalisation, not for deciding which alarms may wait.

Practice note

Keep a weekly plot of a and c next to the alarm-rationalisation log. When a rises after a firmware change, you know to look for a new chatter source before blaming the operators.

Exercises

Synthesis

Series and rates turn "try again" and "hire someone" into numbers that fit a communications or staffing decision.

Continue studying — chapter 06 of 50

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →