Automatic Isolation Trip¶

Automatic protective control — instantiates Eventual-Occurrence Containment Design

The instant a trigger fires, it severs the connections around a failing part — confining damage inside a pre-drawn boundary and dropping the isolated piece into a safe state, with no human in the loop.

When the event finally happens, seconds decide how far it spreads — and seconds are faster than any human can react. Automatic Isolation Trip is the pre-wired reflex that closes that gap: a hard-coupled trigger-and-action pair that, the moment a fault condition is sensed, cuts the connections around the failing element so damage cannot propagate past a boundary drawn in advance, and leaves what it isolated in a designed safe state. Its whole identity is in three words — automatic, at occurrence, isolate — which set it apart from the siblings that only watch (they alert a human) or only analyze (they produce a report). The trip does not decide whether the boundary is in the right place or how bad the loss could be; it enacts a boundary someone else sized, and it does so at machine speed.

Example¶

A distribution feeder on a regional power grid develops a fault — a tree limb bridges two phases. Left alone, the surge would travel back toward the substation and cascade into neighboring feeders, blacking out a whole district. A protective relay watching that feeder sees the fault current cross its pickup threshold and, within roughly 50 milliseconds, commands the breaker to trip open, isolating just the faulted segment. The rest of the substation keeps running; the isolated segment sits de-energized — the safe state — until crews clear the limb and a controlled reclose brings it back. The blackout that would have spanned a district is confined to a few blocks. No operator was consulted, because there was no time to consult one; the boundary and the safe state were decided long before the limb ever fell.

How it works¶

The distinguishing move is the hard coupling of a local sensor to a local actuator, so the response needs no diagnosis, no dispatch, and no approval. A trip is deterministic and fast where a human response is deliberative and slow, and it is designed to fail toward isolation — if the trip logic itself loses power or confidence, its default is to open the boundary, not hold it closed. That fail-safe bias is what lets it be trusted as the last-ditch reflex rather than a best-effort one. Everything upstream (how likely the fault is, how wide the boundary should be) is somebody else's component; the trip's contribution is purely the sever-and-safe action at the instant of occurrence.

Tuning parameters¶

Trip threshold — how extreme the condition must be before it fires. Set it tight and you catch faults early but suffer nuisance trips on benign transients; set it loose and you avoid false alarms but let real faults grow before the cut.
Trip latency — how long the condition must persist before acting. Faster confines more but is jumpier; a short delay rides through momentary glitches at the cost of a wider blast.
Isolation granularity — how much gets cut: the whole subsystem or one narrow segment. Coarse cuts are simpler and surer but sacrifice more service; fine cuts preserve capacity but need more sensors and more logic to place the boundary right.
Latch vs. auto-reset — whether the trip stays open until a human clears it or re-closes on its own once the condition passes. Latching is safer for real faults; auto-reset restores service faster but can re-energize into a persistent fault.
Fail direction — which state the trip defaults to when it loses power or confidence. Failing open maximizes safety; failing closed maximizes availability. The choice encodes what you fear more.

When it helps, and when it misleads¶

Its strength is that it bounds damage at the one moment prevention has already failed and no one is watching closely enough — it turns "someone should have caught that" into a mechanical certainty. But a trip is only as good as its last proof: a protective device that sits idle for months can suffer a dormant failure^[1] and be silently dead when finally called, discovered only in the incident it was meant to contain. The classic organizational misuse is quieter than that — a trip that nuisance-trips gets desensitized or bypassed to stop the interruptions, and the safeguard is gradually normalized away until it no longer fires when it must. And a trip that shares a dependency with the very thing it protects (the same power supply, the same control bus) can fail in the same event that triggers it. The discipline that keeps it honest is to proof-test it under induced faults (see Failure-Injection Test) and to keep its trigger and power independent of the protected system.

How it implements the components¶

Automatic Isolation Trip realizes the act-at-occurrence slice of the archetype's consequence-control machinery — the parts a reflex can enact, not the parts it must be handed:

containment_boundary_plan — the trip is the boundary made real: its cut points are the perimeter past which damage is not allowed to travel.
safe_state_or_degraded_mode — the element it isolates lands in a pre-defined safe state (de-energized, quarantined, inert) reachable under the very conditions that caused the incident.

It does not size the worst-case loss the boundary must cap — that is Blast-Radius Test — nor keep continuous watch for the event (Sentinel Event Monitoring), nor run the reduced operation it drops into (Degraded-Mode Runbook).

Instantiates: Eventual-Occurrence Containment Design — the trip is the automatic isolation-and-safe-state layer the archetype demands once occurrence is treated as a when, not an if.
Consumes: Blast-Radius Test sizes the boundary and cap the trip enforces.
Sibling mechanisms: Degraded-Mode Runbook · Blast-Radius Test · Failure-Injection Test · Sentinel Event Monitoring · Cumulative Risk Horizon Table · Fault Tree with Repeated-Opportunity Branch · Recovery Drill and Restore Test · Probabilistic Safety Assessment · Repeated-Trial Probability Calculator · Opportunity Exposure Register · Post-Incident Recurrence Review · Stop-or-Scale-Back Gate

Notes¶

The trip enacts a boundary that another mechanism must have drawn. A perfectly functioning trip that isolates the wrong perimeter — because the blast radius was mis-sized — will confine damage to exactly the wrong place, quickly and confidently. Keeping the sizing (Blast-Radius Test) separate from the enacting (the trip) is what lets you re-draw the boundary as evidence arrives without touching the reflex itself.

References¶

[1] A dormant (or latent) failure is one that occurs in a standby or protective system and produces no visible effect until the system is demanded — the reason protective devices need scheduled proof-testing, since normal operation never exercises them. ↩