Plant trip root cause analysis that finds the first-out, tests every cause and proves each fix worked before the trip is closed
Every trip explained, every repeat prevented.
See one case, screen by screen ↓When a combined-cycle block trips, the plant engineer has to rebuild what happened from four clocks that disagree: the sequence-of-events recorder at 1 ms on GPS time, the control-system journal at 1 s with its own clock, the historian, compressed and late, and the shift log, written from memory during an alarm flood. The spreadsheet that lines them up is built by hand, and by the time the trends arrive the shift log has usually decided the cause.
So the first story wins. A pump that tripped half a second after the first-out is blamed for the trip, a valve that stuck is recorded as slow operator response, and the investigation closes on “retraining” with nothing that measures whether it worked. The same valve model trips the next block nineteen months later. Each full-load trip costs replacement energy, a restart and turbine life; a repeat from a cause already closed is the most avoidable of them.
Estimated split for one unit trip, in working days, by hand and with the solution. The closing check that proves an action worked runs over its own window (30 days of load following in the sample case) and is not counted here.
Six agents freeze, align and test the evidence of every trip; the engineer accepts the cause and the manager signs.
Harbourside Power and Water Station runs four combined-cycle blocks for the fictional Lumina Utilities, and supplies steam to its desalination units. On Sunday 11 Oct 2026, Block 2 trips during a ramp. Here is the investigation, screen by screen, in the working solution.
Block 2 is ramping to 390 MW on a dispatch instruction when HRSG-21 trips on HP drum level low-low. GT-21 and ST-21 go with it: 386 MW lost, back on the grid at 10:52, 7 h 40 min later, and desalination unit D4 cut to 2.6 MIGD. The control-system journal lists 186 alarms in the first minute, with a feed pump B alarm listed above the trip in the same second. At 03:20 Faisal writes what he saw first.
Shift log, 03:20: “HP FW pump B tripped then drum level low-low. Suspect pump B.”
Priya leads every trip investigation on the four blocks. She opens TRP-26-031 and clicks Build the timeline. The evidence keeper had frozen the evidence at 03:41 on the night. The timeline builder corrects the journal by −0.42 s, replaces the historian with the 250 ms trip buffer and merges 214 SOE events, 186 alarms and 38 trends on one GPS clock.
Agents' run: “journal −0.42 s · historian replaced by the 250 ms trip buffer · dispatch log ±0”
The first-out register of the master trip relay names HP drum level LO-LO, 2 of 3, at 03:12:47.318. Pump B tripped at 03:12:47.902, 0.584 s after the first-out. Before that, FCV-2104 sat at 41.2 % for 25.9 s while its demand rose to 100 %, and feedwater held at 214 t/h while steam rose to 231 t/h. The cause analyst drafts the cause: feedwater valve stuck.
“Pump B tripped at 03:12:47.902 — 0.584 s after the first-out”
Zoomed to 5 seconds, every lane reads on the same axis: the drum level crosses LO at −200 mm 1.8 s before the LO-LO trip at −350 mm, the valve is still held, and only after the trip does FCV-2104 break free and jump to 63.0 % — stick-slip. The shift log's line is shown on the timeline, struck through.
On the timeline: “falling · 1.8 s before the first-out”
Under the trends, the merged list gives each event its GPS time, its offset from the first-out, its kind and its source. Events found only in a trend are marked “no alarm”: ZT-2104 position stops following its demand at 03:12:21.400, 25.9 s before the trip, and no alarm sounded. The master trip relay operates 6 ms after the first-out, GT-21 at 11 ms, ST-21 at 17 ms.
“FCV-2104 position stops following its demand at 41.2%” · no alarm
The cause analyst tests the shift log's cause first, then the standard set. Pump B: refuted, it tripped after the first-out while pushing against a closed path. The level transmitters: refuted, they agree within 12 mm. Operator response: refuted, level control was in automatic. The protection: refuted, the 2-of-3 vote worked. FCV-2104 stuck: confirmed. Priya accepts the cause.
Root cause: “The packing was torqued to 95 N·m on 22 Sep — the datasheet says 55–65”
In the frozen evidence, work order WO-2026-18842 shows a contractor repacked FCV-2104 on 22 Sep and torqued the gland nuts to 95 N·m to stop a leak. The stroke was checked by hand signal from the control room — “moves OK”. Post-work test: none recorded. Torque value source: not stated. The positioner had logged 14 travel deviations at 40–42 % since.
“Read 22 work orders on FCV-2104 since 2019; this is the only repack at more than 65 N·m.”
Matched on the valve model, the travel band where it sticks and the shape of demand against position, across 14 past investigations and 212 bulletins: TRP-25-009 on Block 1 in March 2025 is a 94 % match. FCV-1104 held at 40.6 % for 19 s. It was recorded as slow operator response and closed with operator retraining — no check. A Block 3 runback in June 2024 is an 81 % match.
“A repack came first, every time. None of the three work orders records a torque source.”
The action planner drafts five actions: re-pack FCV-2104 at 60 N·m, a demand-against-position alarm on all 6 HP and IP feedwater valves, the datasheet torque in the work instruction for all 38 control valves, reopen TRP-25-009, and 30 days of load following without a deviation. Tomas approves at 08:22; CA-2 changes an alarm, so it carries MOC-26-044. Hana runs the signal injection test and CA-2 passes on 6 of 6 valves.
“CA-2 passed · alarm in 3.2–3.6 s on all 6 valves · 1 of 5 checks”
The report is drafted with every fact cited: what happened, the cause, what was not the cause, the five actions and the safety note — PSV-2107 lifted for 4.4 s and reseated, nobody on HRSG-21. Beside it, the forced outage report to the system operator, due 14 Oct, carries the cause code “HRSG HP feedwater control valve”. Tomas signs with the meaning of his signature. The investigation closes only when all five checks pass; the last runs on 14 Nov.
Signed: “I have reviewed the evidence and agree with the cause and the actions”
The same Block 2 trip, seen by the five people who own a part of it — what an investigation looked like, and what it looks like now.
Six agents freeze, align and test the evidence of every trip; the engineer accepts the cause and the manager signs.
Freezes the SOE recorder export, the control-system journal, the trip buffer for the unit's 38 tags at ±30 minutes, the shift log and every statement within the hour, hashes each file and records the time it was frozen.
Finds each source's offset against the SOE recorder's GPS clock from shared events such as breaker openings and trip relays, corrects and merges every event and trend on one millisecond timeline, and reads the first-out register of the master trip relay.
Lists the candidate causes — the shift log's, the standard set of pump, transmitter, operator response, protection and control valve, and any from similar events — tests each against the timeline with a measurable test, and builds the why-chain to a root cause with a record on every link.
Reads the work orders, positioner diagnostics, datasheets and makers' bulletins for the equipment in the chain.
Finds past trips, runbacks and bulletins with the same equipment, travel band and signature, and flags past causes that do not fit.
For each link of the chain, drafts an action that removes it and a check that can fail — a test, a measurement, a record or a historian query, with its limit — raises work orders once approved, runs the checks as their data arrives and keeps the investigation open until all pass.
Accepts every cause. The agents propose; a named person decides.
Ask about any trip, event, tag or action — or say what to check. Every answer points to the timeline or the record behind it.
What tripped Block 2 first?
The HP drum level LO-LO on HRSG-21, 2 of 3, at 03:12:47.318 GPS time. Everything else followed: the master trip relay 6 ms later, GT-21 at 11 ms, ST-21 at 17 ms. The level had crossed LO 1.8 s before, while FCV-2104 sat at 41.2 %.
Was feed pump B the cause?
No. Pump B tripped at 03:12:47.902, 0.584 s after the first-out, on minimum flow. In the 25.9 s before, its discharge pressure rose from 128 to 141 bar: it was pushing against a valve that would not open, not failing. The shift log saw both in the same second of the journal, with pump B listed first.
Has this valve done this before?
Yes — the same model. TRP-25-009, Block 1, 14 Mar 2025: FCV-1104 held at 40.6 % for 19 s and the drum tripped on LO-LO, 371 MW. It was recorded as slow operator response and closed with retraining and no check. A Block 3 runback in June 2024 shows the same shape. All three followed a repack, and the maker's bulletin gives 55–65 N·m.
How will we know the fix worked?
Every action carries a check that can fail: CA-1, friction ≤ 1,100 N and stroke deviation ≤ 2 % after the repack; CA-2, signal injection raises the alarm within 4 s on 6 valves; CA-3, the next 5 repacks inside the torque range; CA-4, a friction test on FCV-1104; CA-5, no deviation over 2 % to 14 Nov. The investigation stays open until all five pass.
13 screens from the working solution, on its sample data. Pick one to see it large.
The reference clock, the evidence window, the causes always tested, the check limits and who decides are settings, kept as numbered rule versions.
| Setting | Default | Choose from |
|---|---|---|
| Reference clock | SOE recorder · GPS | SOE recorder · GPS, protection relay clocks or control-system clock |
| Flag a source when it is off by more than | 50 ms | Set in steps; the offset is shown on the timeline |
| Freeze the evidence within | 60 min | Set in steps, from the first-out; the investigation records the time |
| Trend window and resolution | ±30 min · 250 ms | ±30 min · 250 ms, ±60 min · 250 ms or ±15 min · 100 ms |
| Test the shift log's cause first | On | On · Off — the first written story is always tested against the SOE |
| Similar events: search back | 5 years | 5 years · 10 years · All records |
| Check limits | 1,100 N · 2 % · 30 days | Valve friction limit, travel deviation limit and effectiveness window, each set in steps |
| Forced outage report | Operations manager sends | Operations manager sends · Reliability engineer sends — to the system operator within 3 days |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample plant data · “target” = the design goal, measured in the live solution · “estimated” = our arithmetic, inputs shown (USD 248K for one trip = replacement energy USD 136K, 2,960 MWh × USD 46/MWh above own cost, + hot restart fuel and wear USD 85K + auxiliary boiler for desalination unit D4 USD 27K, from the demo plant's prices, before the turbine life the trip uses; the working-days split is our estimate) · “typical” = published figures (NERC 2026 State of Reliability via Power Engineering: combined-cycle equivalent forced outage rate 4.2 % in 2024 → 5.7 % in 2025; TWI and Reliabilityweb: a full-load trip ≈ 8 normal starts of cyclic life; iFactory RCA practice guide, a vendor: 30–90 days for a defensible RCA). Lumina Utilities, Harbourside Power and Water Station and the people, equipment, makers and records named on this page are fictional — characters and sample data in the working solution.
It is the investigation that follows a unit trip or forced outage: what tripped first, why, and what will stop it happening again. Plant Trip Root Cause Analysis runs that investigation from the frozen evidence to corrective actions that each carry a check proving they worked. The reliability engineer accepts the cause and the operations manager signs.
Six agents share the work. The evidence keeper freezes and hashes the SOE export, journal, trends, shift log and statements within the hour; the timeline builder puts every clock on GPS time and marks the first-out; the cause analyst tests every candidate cause; the maintenance and history checker and the similar event finder bring in work orders, bulletins and past trips; the action planner drafts actions with checks.
It reads the first-out register of the master trip relay and lines the 1 ms SOE list up with the control-system journal and the trend buffer, each corrected to the SOE recorder's GPS clock with its offset shown. In the sample case that showed pump B tripping 0.584 s after the drum level LO-LO first-out — a consequence, not the cause.
That is the aim. The similar event finder matches past trips by equipment, travel band and signature and flags past causes that do not fit — in the sample case, a 2025 trip closed as slow operator response. Every corrective action carries a check against real data, and the investigation cannot close until all of them pass.
It drafts it beside the investigation report: unit, event type, start and end, duration, capacity and energy lost, cause code and the effect on water production. A person sends it — the operations manager by default, or the reliability engineer if you choose.
Yes. The agents read the evidence and never edit a source or change a work order. They propose; the reliability engineer accepts the cause and the actions, the operations manager signs and approves alarm and protection changes with a change number, and any link of the why-chain can be challenged.
Yes. The reference clock, the tolerance before a source is flagged, the evidence freeze window, the trend window, the causes always tested, the search-back period, the friction and deviation limits, the effectiveness window and who sends the forced outage report are settings, kept as numbered rule versions. The same screen names who accepts the cause, who signs and who joins when a safety valve lifts.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your trip investigation and evidence procedures, protection relay lists, tag register and a sample of past investigations — and it goes live once every quality gate has passed. We will walk you through it on one of your own trips first.
Outages scoped right, so they finish on time.
1-min demoPlant Operating Procedure SearchEvery answer drawn on the plant diagram, so the right valves close in the right order.
1-min demoDesalination Plant Performance MonitoringClean membranes when they need it, not by the calendar.
1-min demoWe'll run Plant Trip Root Cause Analysis on one of your own closed trip investigations.