This simulator heats a lumped-capacity process vessel with an immersion heater bundle, temperature probe, cooling coil, heater isolation contactor, alarm annunciator and first-out sequence recorder. It teaches the distinction between a high alarm (attention required, process continues), a high-high protective trip (heater command removed and latched), acknowledgement (clears alarm memory only) and reset/rearm (two separate, deliberate operator actions required after a trip).
• A real-time 3D model of the heated process vessel and its liquid content (color-coded by temperature), immersion heater bundle, temperature probe/transmitter, cooling coil, heater isolation contactor, alarm annunciator with acknowledge lamps, and first-out/sequence recorder, with home view, focus-selected-part, toggleable full-enclosure cutaway, exploded view, auto-rotate, expand and show/hide labels controls, and tappable numbered components with callouts. • Eight live controls: heater capacity (1–12 kW), cooling coefficient at 20 K rise (0.5–4 kW), high alarm threshold (45–75 °C), high-high trip threshold (80–100 °C), alarm qualification delay (0.5–5 s), trip qualification delay (0.2–3 s), a temperature input (sensor) fault, and a heater-contact-welded-on fault. • Play/pause, single-step (0.1 s) and larger-step (1 s) time controls, plus a playback-speed selector (10× slow motion, real time, 10× faster, 1 minute per second) — useful for accelerating the multi-minute heating trials. • Six actions: Start trial, Stop trial, Rearm heater, Disable heater, Acknowledge alarm and Reset trip, with a live sequence narrative and per-component status. • Eight live metrics: process temperature, high alarm threshold, trip threshold, actual heater power, cooling removal, high alarm active, uncleared alarm memory, and protective trip state. • A Curves & measurements tab with two charts (process temperature/alarm/trip thresholds vs. time, and actual heat/cooling removal vs. time), the full model equations, and snapshot measurements. • An Experiments tab with four guided scenarios (alarm then trip, adequate cooling, sensor failure, welded heater), a model-verification bench of independent automated checks, and a timestamped event log with a copyable trial report. • A Learn & assess tab with four guided lessons, a two-question knowledge-check quiz, and a written scope/reference statement.
Process temperature follows a lumped thermal model — 8 dT/dt = Qheater − coolingCoefficient × (T − Tambient)/20 — so it rises toward equilibrium under constant heat and falls under cooling. The high alarm activates only once temperature has stayed above its threshold for the full configured alarm qualification delay, and separately, the high-high trip activates only once temperature has stayed above the (higher) trip threshold for its own configured trip qualification delay — the built-in check specifically confirms the alarm always occurs before the trip on a heating trial with default settings, never the reverse.
Once tripped, the heater command is removed and the condition is latched as a specific first-out cause (temperature sensor fault takes priority as its own distinct cause when injected). The alarm itself clears once temperature falls 3 °C below its threshold, but if it was never acknowledged while active, it remains flagged as "uncleared alarm memory" even after the process returns to normal.
Acknowledging an alarm only changes how the annunciator records that occurrence — it never touches process temperature, the protective trip state, or the heater command, which is exactly what the corresponding lesson and quiz question emphasize. Reset trip is blocked until temperature has fallen below the trip threshold minus 5 °C and any sensor or welded-heater fault has cleared; once accepted, it clears the trip and first-out memory but also disables the heater, requiring a separate Rearm heater action before heat can resume.
The welded-heater-contact fault is a deliberate final-element check: even after a trip removes the heater command, actual heater power stays on if the contact is welded closed, which the model reports distinctly (command off, heater power still nonzero) so the trip logic and the physical isolation can be diagnosed independently. This is a lumped thermal and logical sequence model, not a process-hazard analysis — it does not represent boiling, pressure generation or independent redundant protection.
The alarm threshold is set lower than the trip threshold, and both require the temperature to remain above their respective threshold for a separately configured qualification delay before activating. Because the alarm threshold is reached first as temperature rises, the alarm always has the opportunity to qualify before the trip threshold is even reached, which the model's built-in check verifies directly.
No. Acknowledgement only affects how the alarm annunciator records that occurrence in memory — it does not change process temperature, does not remove a protective trip, and does not restore heater power. Reset trip and Rearm heater are the separate actions that actually restore control, and reset itself is blocked until temperature has cooled at least 5 °C below the trip threshold.
This happens specifically when the welded-heater-contact fault is injected: the trip logic correctly removes the heater command, but the physical contactor contact has fused closed, so power keeps flowing regardless of the command. The model reports the command and the actual heater power as separate metrics precisely so this final-element failure can be distinguished from a logic failure.
This is a representative educational lumped-thermal and logical-sequence model with generic parameters, not a manufacturer-specific process-hazard analysis or protection-system design. It does not model boiling, pressure generation, or independent redundant protection layers.