The Standby Compressor That Starts After the Trip: Catching Inverted Pressure Thresholds in BECCS Export Systems
In a BECCS export train the standby CO2 compressor can be configured to start only after the pipeline's low pressure trip has already isolated the line. That kind of change passes code review, because every setpoint in the diff is plausible when read alone. The defect lives in the ordering of the values, so it only shows up once the lead machine trips for real. Then the redundancy you paid for does nothing, and the capture unit vents captured CO2 while the pipeline sits blocked in.
Why the diff looks clean
Dense-phase CO2 transport depends on keeping the line well above the critical pressure. Most operators hold a minimum operating pressure of about 85 bara, so that pressure transients, Joule-Thomson cooling at chokes and impurities from oxy-combustion flue gas never push the fluid into two-phase flow. Around that floor sits a chain of thresholds on the same pressure signal: a high setpoint where the standby compressor auto-starts, a low alarm under it, then the ESD trip that closes the export valve, and finally the floor itself. Each threshold usually lives in its own block of the control config, often owned by a different discipline, and a reviewer checks each one against its own datasheet line. The common way the chain breaks is a units mismatch, where someone enters the standby start in barg because the compressor vendor's documents use gauge, while the ESD trip stays in bara to match the pipeline transmitter. The roughly one bar offset is enough to swap two neighbouring thresholds when the design margins were tight to begin with, and no single line of the diff is wrong.
What actually fails
When the lead compressor trips, line pack starts to fall, and the pipeline crosses the ESD threshold before it reaches the standby start, so the export valve closes, the standby sees a blocked discharge, its start permissive drops out, and the absorber has nowhere to send product except the vent stack.
A check you can run today
Export every setpoint attached to the export pressure tags, from the config repository or straight from the controller, into one table with tag, value, unit and role. Convert everything to bara using the declared unit, and treat a missing unit as a failure, never as a default. Then sort by value and assert strict descending order: standby start, low alarm, ESD trip, dense-phase floor, with a minimum gap between neighbours equal to the transmitter's stated accuracy plus the pressure the line loses during the standby's start time. If you only have historian data, replay the last real lead compressor trip and check that the standby start command comes before the ESD trip timestamp. A trip where both events land within the same scan interval is a warning that your margin is close to zero. Put the ordering assertion in CI as a test that blocks the merge, because it is the one property a human reviewer will never see in a line-by-line diff.
Where the margin comes from
The pipeline integrity standards, ISO's CO2 transport guidance and the classification societies' recommended practices for CO2 pipelines among them, tell you where the floor sits and why running ductile fracture and phase change matter. They don't tell you how far above the floor the standby must start. That figure comes from your own line pack decay rate, and as a rough estimate a mid-length onshore line falls a few bar per minute after losing its only running compressor, which leaves very little room for a start sequence that needs lube oil and anti-surge stabilisation. The decision rule is simple: if the standby start minus the ESD trip, in bara, is smaller than the measured decay rate multiplied by the standby's time to reach rated discharge, the redundancy is only on paper. In that case either raise the start threshold and accept more nuisance starts, or keep the standby on hot idle and pay the energy penalty against your net-negative balance. Both options cost something, and the ordering test only tells you which one you are currently not paying for.