14. Project Management, Safety and Governance

Introduction and Context

Electrical drives are no longer purchased merely as motors, converters, and control panels. A modern drive project is a socio-technical investment involving production objectives, energy performance, process continuity, personnel safety, cybersecurity, regulatory compliance, maintainability, and environmental responsibility. A technically superior drive may still be a poor investment if it cannot be integrated with the plant, causes unacceptable downtime, exposes workers to hazards, or creates long-term dependence on proprietary service arrangements.

Project management therefore becomes an engineering discipline rather than an administrative activity. The engineer must translate process requirements into a procurement specification, compare alternatives over their life cycle, control technical and commercial risks, and verify that the completed installation performs safely and economically. Retrofit projects add further complexity because new equipment must coexist with legacy motors, transformers, protection systems, control networks, mechanical couplings, and operating practices.

This chapter develops an integrated framework for project decisions in electrical drives. It considers techno-economic evaluation, risk and availability analysis, total cost of ownership, functional safety, electrical hazards, cybersecurity, standards, documentation, ethics, and sustainability governance. The emphasis is on decisions that remain defensible after installation, during maintenance, and at the end of the asset’s service life.

Learning Objectives

After studying this chapter, the student should be able to:

1. Define the technical, economic, safety, and governance requirements of a drive project.

2. Compare procurement and retrofit alternatives using life-cycle cost, risk, availability, and performance measures.

3. Apply structured methods such as weighted decision matrices, failure-mode analysis, fault-tree analysis, and risk registers.

4. Explain the relationship between machine safety, electrical safety, functional safety, and cybersecurity.

5. Identify the principal standards, documents, approvals, and responsibilities required in a drive project.

6. Evaluate ethical and sustainability implications of engineering decisions.

7. Formulate a practical project-control and verification strategy for an industrial drive installation.

From a Drive Specification to an Investment Decision

A drive project begins with a business and process need. The stated requirement may be “replace a failed motor,” “reduce energy consumption,” “increase line speed,” or “eliminate repeated trips.” These statements are not yet adequate specifications. The engineer must determine the duty cycle, torque-speed profile, acceleration and deceleration requirements, load inertia, permissible speed range, braking energy, ambient conditions, harmonic constraints, fault level, enclosure requirements, control interfaces, maintenance philosophy, and consequences of failure.

A useful requirements hierarchy separates four levels. The first is the process requirement: throughput, product quality, tension, pressure, flow, positioning accuracy, or synchronization. The second is the drive-system requirement: motor rating, converter topology, control mode, overload capability, braking, cooling, and feedback. The third is the plant requirement: supply compatibility, protection coordination, communications, spares, training, and maintainability. The fourth is the governance requirement: statutory compliance, safety validation, cybersecurity, environmental obligations, records, and change control.

This hierarchy prevents a common mistake: selecting a converter from a motor nameplate without understanding the driven process. For example, a pump operating at reduced speed may benefit greatly from a variable-speed drive, whereas a constant-torque conveyor may require a different overload rating, braking arrangement, and mechanical assessment. A high-performance regenerative drive may be justified in a hoist or test bench but economically inappropriate for a lightly loaded fan.

Procurement, Retrofit, and Replacement Choices

Three strategic alternatives are frequently considered. A new procurement can specify an integrated motor-drive package and modern control architecture, but it may require substantial capital expenditure and commissioning time. A retrofit retains valuable mechanical infrastructure while replacing the converter, motor, control system, or protection equipment. A like-for-like replacement usually minimizes engineering effort, but it may preserve obsolete technology, poor efficiency, or known reliability problems.

The correct choice depends on more than initial price. A retrofit can create interface risks: the existing motor insulation may not tolerate fast voltage edges, the old motor may overheat at low speed, the transformer may experience additional harmonic loading, or the control system may lack suitable communication interfaces. Conversely, full replacement can introduce installation downtime, new operator-training requirements, and disposal obligations.

A decision should document the “do nothing” or minimum intervention case as a baseline. Without a baseline, savings claims become uncertain. Each alternative should then be evaluated against common criteria such as capital cost, annual energy cost, expected availability, safety risk, cybersecurity exposure, maintainability, delivery time, future expandability, and environmental impact.

Economic Evaluation Beyond Purchase Price

Total Cost of Ownership

Total cost of ownership (TCO) is the discounted cost of acquiring, operating, maintaining, upgrading, and disposing of an asset. A general representation is

TCO = C₀ + Σ[(Cₑ,t + Cₘ,t + Cₛ,t + C_d,t + C_r,t − S_t)/(1+r)^t]

where C₀ is initial expenditure, Cₑ,t is energy cost in year t, Cₘ,t is planned maintenance cost, Cₛ,t is expected failure-related cost, C_d,t is other operating or disposal cost, C_r,t is retrofit or upgrade expenditure, S_t is residual value or benefit, and r is the discount rate. The formula is not a substitute for engineering judgement; it makes assumptions visible.

Energy cost is often dominant in continuously operated drives. It should be calculated from realistic load profiles rather than rated power alone. A motor operating at partial load, a converter with standby consumption, harmonic-related losses, cooling-fan power, and process changes must all be considered. Maintenance costs include inspection, lubrication, calibration, spare parts, specialist support, and planned outages. Failure cost may include lost production, damaged material, emergency labour, safety consequences, and contractual penalties.

Net present value, internal rate of return, and payback period can support investment decisions, but each has limitations. Payback is easy to communicate but ignores benefits after the payback date and may undervalue reliability. Net present value handles timing more appropriately but depends strongly on discount rate, energy-price assumptions, and production forecasts. Sensitivity analysis should vary the uncertain inputs rather than present a single precise result.

Risk-Adjusted Economics

Two alternatives with equal expected cost may not be equally attractive. A system with a higher mean availability, shorter repair time, and better spare-part support may justify a higher capital cost. Expected annual loss can be approximated as:

Expected loss = Σ Probability of event i × Consequence of event i.

The consequence may be expressed financially, in production hours, or through a separate safety-risk classification. Safety risks should not normally be traded against money using a simplistic monetary value of injury. Legal and ethical duties require hazards to be reduced according to an accepted hierarchy of controls. Economic analysis is appropriate for comparing residual technical and operational risks after mandatory safeguards have been applied.

Availability and Reliability

Availability is the probability that an asset is operational when required. For a repairable system under simple steady-state assumptions,

A ≈ MTBF/(MTBF + MTTR),

where MTBF is mean time between failures and MTTR is mean time to repair. This relationship shows why a reliable component can still produce poor availability if diagnosis, access, spares, or specialist support are inadequate.

Drive-system availability should be assessed at system level. The motor, converter, cooling system, encoder, control PLC, communication network, transformer, protection, and mechanical load may form a series path in which failure of one element stops production. Redundancy, bypass arrangements, spare converters, online diagnostics, and graceful degradation can improve availability, but they also increase cost and configuration complexity.

A practical analysis identifies critical failure modes, their detection method, repair time, required resources, and production consequence. “Mean time to restore” is often more useful to operations than a generic supplier reliability figure. Supplier claims must be checked for duty conditions, temperature, load profile, maintenance assumptions, and whether the value applies to the complete system or only to a component.

A Decision Framework for Drive Projects

A robust decision process is staged. First, establish the functional and operating requirements. Second, screen technically infeasible alternatives. Third, obtain comparable supplier proposals using a common specification. Fourth, evaluate life-cycle economics, risk, safety, availability, and sustainability. Fifth, perform design verification and commercial clarification. Sixth, approve the selected option with defined acceptance criteria. Finally, review actual performance after commissioning.

A weighted decision matrix can be useful when criteria cannot be reduced to money. Criteria may include TCO, energy performance, availability, maintainability, delivery risk, safety, cybersecurity, vendor capability, and environmental performance. Weights must be agreed before seeing supplier scores where possible. Scores require evidence: test reports, references, calculations, drawings, certifications, or contractual commitments. A matrix should support judgement, not disguise subjective preferences behind numerical precision.

Risk registers complement the decision matrix. Each risk should have a cause, event, consequence, owner, probability, severity, existing controls, treatment action, deadline, and residual rating. Typical risks include incorrect motor data, unsuitable insulation, harmonic resonance, inadequate braking, software incompatibility, unavailable spares, poor earthing, arc-flash exposure, network compromise, and undocumented modifications.

Project Execution and Control

Drive projects pass through concept, basic design, detailed design, procurement, factory testing, installation, commissioning, handover, and operational review. The project manager and lead engineer must define interfaces between the electrical, mechanical, process-control, safety, information-technology, procurement, and operations teams.

A statement of work should identify deliverables and exclusions. Typical deliverables include a design basis, load and fault calculations, single-line diagrams, motor and converter data sheets, protection settings, harmonic assessment, control narratives, network architecture, safety requirements specification, layout drawings, cable schedules, bills of material, inspection and test plans, operating manuals, maintenance schedules, software backups, training records, and as-built documentation.

Factory acceptance testing should be based on agreed procedures rather than informal demonstrations. Tests may include dimensional and visual inspection, insulation and dielectric checks where applicable, control-function tests, protective-trip verification, communication checks, alarm and event recording, simulated sensor failures, speed and torque response, and cybersecurity configuration review. Site acceptance testing must then demonstrate correct integration with the actual motor, load, supply, safety systems, and plant controls.

Management of change is essential after design approval. A change to motor rating, converter firmware, cable route, protective setting, network address, or safety logic can affect several disciplines. Every significant change should be assessed, approved by competent persons, recorded, tested, and reflected in the as-built documentation.

Safety as a Lifecycle Property

Safety is not achieved by adding an emergency-stop button at the end of a project. It is designed through hazard identification, risk reduction, verification, training, and disciplined operation. The lifecycle begins with defining intended use and reasonably foreseeable misuse. It continues through design, installation, commissioning, maintenance, modification, and decommissioning.

Electrical Hazards

Drive installations present shock, arc-flash, stored-energy, unexpected-starting, and induced-voltage hazards. A converter DC link can remain energized after the incoming supply is isolated. Regenerative loads can sustain or raise DC-bus voltage. Capacitors, filters, braking units, and long cables can retain charge. A motor may rotate because of mechanical movement, another drive, or the driven process even when its converter is disabled.

Safe isolation therefore requires identification of all energy sources, disconnection, prevention of re-energization, verification of absence of voltage with a suitable instrument, discharge of stored energy, and control of mechanical movement. The exact procedure must follow applicable law, organizational rules, and equipment instructions. Software stop commands and ordinary control inhibit signals are not equivalent to electrical isolation.

Arc-flash risk depends on available fault energy, clearing time, equipment construction, working distance, and task. Risk assessment should consider energized work justification, remote operation, current-limiting protection, selective coordination, enclosure design, boundaries, labels, and appropriate personal protective equipment. PPE is the last line of defence, not a replacement for de-energization and engineering controls.

Functional Safety

Functional safety concerns the ability of a control system to achieve or maintain a safe state when dangerous failures occur. Examples in drives include safe torque off, safe stop functions, speed monitoring, direction monitoring, brake control, and prevention of unexpected restart. A safety function must be specified by its initiating condition, required safe state, response time, performance target, reset behaviour, interfaces, and proof-test requirements.

The safety integrity of a function depends on architecture, component reliability, diagnostic coverage, common-cause failure control, and systematic design quality. A safety-rated input is not sufficient if the actuator, wiring, parameterization, or mechanical brake is outside the validated safety chain. Verification must examine the complete function from sensor or command through logic solver to final energy-control element.

Emergency stopping and safe torque off are related but not identical. Safe torque off prevents the drive from producing torque; it may not remove electrical energy from the converter or stop a freely rotating load immediately. A risk assessment may therefore require controlled stopping, mechanical braking, isolation, or additional guarding. Safety functions must be selected from the hazard and stopping-time analysis, not from a catalogue label.

Cybersecurity and Digital Governance

Networked drives create operational benefits through diagnostics, remote support, condition monitoring, and coordinated control. They also expand the attack surface. Threats include unauthorized parameter changes, malicious firmware, denial of service, stolen credentials, insecure remote access, and movement from an office network into an operational network.

Cybersecurity should be treated as a lifecycle risk. Asset inventories should identify drives, PLCs, engineering workstations, gateways, protocols, firmware versions, and external connections. Access should follow least privilege, with individual accounts, strong authentication where feasible, controlled vendor access, and timely removal of obsolete accounts. Network segmentation, allow-listing, secure backups, patch governance, logging, time synchronization, and incident-response procedures reduce exposure.

Availability and safety impose special constraints in operational technology. A patch that is desirable from an information-security perspective may disrupt a validated control system. Conversely, leaving unsupported firmware connected to a network creates an unmanaged risk. Changes should be tested in a representative environment, scheduled with operations, and accompanied by rollback plans. Remote access should be time-limited, approved, monitored, and disabled when not required.

Data governance includes ownership of parameter files, source code, event logs, production data, and digital twins. Contracts should state who may access data, how backups are delivered, what happens when a supplier withdraws support, and whether the owner receives editable engineering files. Artificial intelligence may assist anomaly detection and predictive maintenance, but recommendations require validation. An unexplained model should not silently alter a safety-critical control decision.

Standards, Documentation, and Accountability

Standards provide a common technical language, but compliance claims must be specific. Depending on jurisdiction and application, relevant frameworks may include machinery-safety standards, electrical installation and low-voltage equipment standards, adjustable-speed power-drive requirements, functional-safety standards, electromagnetic-compatibility requirements, occupational safety rules, and industrial cybersecurity guidance. The project team must identify which standards are legally required, contractually required, or adopted as good engineering practice.

A declaration or certificate is not a substitute for verifying the actual installation. The engineer must check scope, edition, product configuration, environmental conditions, limitations, and required complementary equipment. National regulations and authority requirements take precedence where applicable.

Documentation is a safety and governance control. At minimum, the owner should receive approved drawings, calculations, settings, parameter backups, firmware records, test results, risk assessments, safety validation evidence, certificates, maintenance instructions, spare-part lists, training records, and a change history. Drawings must be updated after commissioning. A technically sound installation with inaccurate drawings is difficult to maintain safely.

Responsibility should be assigned through a responsibility matrix. The owner remains accountable for defining operational needs and providing accurate plant information. The designer is responsible for competent design and verification. The supplier must provide conforming equipment and truthful technical information. The installer must follow approved methods. The commissioning team must test the integrated system. Operators and maintainers must be trained and authorized. Responsibilities cannot be transferred merely by inserting a disclaimer into a purchase order.

Ethics and Sustainability Governance

Engineering ethics becomes visible when project pressures conflict with safety, truthfulness, or public interest. Examples include concealing a failed test, accepting an undocumented parameter change, overstating energy savings, selecting equipment solely because of a personal supplier relationship, or delaying a safety upgrade to meet a production target. Professional judgement requires transparent escalation, traceable evidence, and refusal to approve work that presents unacceptable risk.

Sustainability decisions should consider the full life cycle. High-efficiency motors and converters can reduce operating energy, but embodied materials, cooling requirements, rare-material content, packaging, transport, repairability, and end-of-life recovery also matter. A repairable modular converter may have lower life-cycle impact than a sealed unit that must be replaced after a minor failure. Energy savings should be measured against a credible baseline, and claims should distinguish rated efficiency from actual field performance.

Governance can use performance indicators such as energy per unit of production, unplanned downtime, mean time to restore, safety observations, overdue safety actions, cybersecurity patch status, documentation completeness, and percentage of critical assets with tested backups. Indicators should stimulate learning rather than encourage concealment. For example, a low reported failure rate may indicate under-reporting rather than reliability.

Illustrative Case Study: Retrofit of a Conveyor Drive

Background

A fictional mineral-processing plant operates a conveyor driven by a 250 kW induction motor through a gearbox. The existing electromechanical starter causes high starting current and mechanical shock. The plant proposes a variable-speed drive to reduce belt stress, improve process control, and lower energy use during periods of reduced throughput.

Situation and Problem

The lowest-priced proposal is a standard drive with remote vendor access and limited documentation. A second proposal costs more and includes an input reactor, braking capability, redundant cooling fans, a documented safety function, training, and five years of spare-parts support. The existing motor is twelve years old, its insulation data are incomplete, and the conveyor has a downhill section that can drive the motor during stopping.

Analysis

The project team first measured the load profile and identified regenerative energy during stopping. It reviewed motor insulation compatibility, cable length, earthing, harmonics, transformer capacity, stopping time, and the consequences of a drive trip. A hazard analysis found risks of unexpected belt movement, stored mechanical energy, and access to the conveyor during maintenance. The team also identified cybersecurity risks associated with remote access.

The first proposal had a lower capital cost but required additional braking equipment, uncertain motor suitability, and plant engineering effort. Its apparent payback advantage disappeared when downtime, harmonic mitigation, and specialist commissioning were included. The second proposal provided clearer safety validation evidence and a controlled support model. Neither proposal was accepted without changes: the contract was revised to require editable parameter backups, local emergency support, documented remote-access approval, and site acceptance tests.

Approach and Solution

The plant selected the second alternative after a risk-adjusted TCO comparison. A pre-installation survey confirmed motor condition and measured insulation resistance. The supplier provided a compatible output filter and regenerative braking arrangement. The safety design used a controlled stop for normal process stopping and a separately validated torque-removal function for hazardous access, with mechanical isolation procedures for maintenance.

The project included factory tests, a staged site commissioning plan, operator training, network segmentation, firewall rules, backup of the final configuration, and a thirty-day performance review. Acceptance criteria covered speed regulation, acceleration, stopping behaviour, temperature, harmonic performance, protective trips, safety response, alarm records, and recovery from communication loss.

Outcome

The retrofit reduced mechanical starting stress and permitted operation at lower belt speed during reduced production. More importantly, the plant obtained a documented and maintainable system rather than an isolated converter installation. The project team recorded that predicted energy savings were conditional on the actual production schedule; savings were therefore reported using measured energy per tonne rather than a nominal motor-rating comparison.

Learning Points

The case demonstrates that the lowest purchase price is not necessarily the lowest project cost. Regeneration, legacy-motor compatibility, safety functions, cybersecurity, documentation, and support obligations must be considered before procurement. It also shows that acceptance testing should verify the integrated process, not merely the converter’s ability to run a motor.

Challenges, Limitations, and Common Mistakes

Several recurring errors weaken drive projects. One is using supplier catalogue efficiency or reliability values without checking operating conditions. Another is treating a retrofit as a component replacement while ignoring system interfaces. A third is calculating payback without downtime, maintenance, financing, or disposal costs. Projects also fail when safety is delegated entirely to a safety specialist without process and maintenance input.

Other common mistakes include inadequate motor thermal assessment at low speed, failure to evaluate regenerative operation, poor EMC and earthing practices, uncontrolled firmware changes, incomplete parameter backups, and commissioning under production pressure without a structured test plan. Excessive dependence on one vendor can create lifecycle risk if support, software tools, or spare parts become unavailable.

Analytical models also have limitations. MTBF figures may not predict site availability; risk scores can conceal uncertainty; TCO depends on assumptions; and weighted matrices can create false objectivity. These limitations should be handled through sensitivity analysis, evidence quality ratings, pilot tests, independent review, and post-project validation.

Current Developments and Best Practice

Drive governance is increasingly influenced by connected condition monitoring, digital commissioning, model-based diagnostics, modular power electronics, regenerative systems, and energy-management platforms. Digital twins can support parameter verification and maintenance planning, but their value depends on accurate data and disciplined configuration control. Edge analytics can detect bearing, insulation, cooling, or load anomalies without sending all operational data to external services.

Best practice is to:

• define process, electrical, safety, cybersecurity, and sustainability requirements before requesting quotations;
• compare alternatives using risk-adjusted TCO and realistic load profiles;
• assess availability at system level, including repair time and spares;
• validate complete safety functions rather than individual safety-labelled devices;
• control remote access, firmware, parameters, and configuration backups;
• require factory and site acceptance tests with measurable criteria;
• maintain accurate as-built records and a formal management-of-change process;
• involve operators, maintainers, safety professionals, and cybersecurity personnel early;
• review actual energy, reliability, safety, and environmental performance after handover.

Chapter Summary

Project management for electrical drives integrates engineering design with economic evaluation, risk control, safety, cybersecurity, documentation, ethics, and sustainability. Procurement and retrofit decisions should be based on process requirements and life-cycle consequences rather than purchase price alone. Total cost of ownership, availability, expected failure loss, sensitivity analysis, and evidence-based decision matrices provide a defensible basis for comparison.

Safety must be designed throughout the asset lifecycle. Electrical isolation, stored energy, arc-flash exposure, unexpected movement, and functional safety require distinct but coordinated controls. Networked drives require asset inventories, access control, segmentation, backups, patch governance, and incident planning. Standards establish expectations, while verification, documentation, competent responsibility, and management of change make those expectations effective. Ethical engineering requires truthful reporting and prioritization of people and public interest. Sustainable governance extends evaluation from energy efficiency to repairability, materials, data quality, and end-of-life responsibility.

Key Terms

Total cost of ownership: The discounted life-cycle cost of acquiring, operating, maintaining, upgrading, and disposing of an asset.

Availability: The probability that an asset is operational when required.

MTBF: Mean time between failures for a repairable or replaceable asset.

MTTR: Mean time to repair or restore an asset after failure.

Risk register: A controlled record of identified risks, owners, controls, treatments, and residual ratings.

Weighted decision matrix: A structured comparison in which alternatives receive evidence-based scores against weighted criteria.

Management of change: A formal process for assessing, approving, testing, and documenting changes.

Functional safety: The part of overall safety dependent on correct operation of safety-related control functions.

Safe torque off: A function that prevents the drive from producing motor torque, without necessarily removing all electrical energy.

Arc flash: An energetic electrical fault producing intense heat, light, pressure, and molten material.

Safe isolation: A verified process of disconnecting and securing all relevant energy sources.

Expected loss: The probability-weighted consequence of an adverse event.

Factory acceptance test: A documented test of equipment before shipment or installation.

Site acceptance test: A documented test demonstrating integrated performance at the installation site.

Cybersecurity: Protection of systems, networks, and data against unauthorized access, disruption, or manipulation.

Least privilege: Granting users and systems only the access necessary for their authorized tasks.

As-built documentation: Final records representing the equipment and configuration actually installed.

Life-cycle assessment: Evaluation of environmental impacts across an asset’s stages of existence.

Residual risk: Risk remaining after safeguards and treatment measures have been applied.

Review Questions

Short Answer Questions

1. Why is purchase price an inadequate basis for selecting an industrial drive?

2. Define availability and explain the roles of MTBF and MTTR.

3. Why is safe torque off not always equivalent to electrical isolation?

4. What information should a drive project risk register contain?

5. State two cybersecurity controls relevant to networked drives.

Long Answer Questions

1. Explain how TCO, discounted cash flow, energy use, maintenance, and downtime should be combined in a drive procurement decision.

2. Describe a lifecycle approach to functional safety in a variable-speed drive installation.

3. Discuss the principal technical and managerial issues involved in retrofitting a drive onto an existing motor and process.

4. Explain how standards, acceptance testing, documentation, and management of change contribute to governance.

5. Discuss the ethical and sustainability responsibilities of engineers involved in drive-system projects.

Analytical / Application Questions

1. Two drive alternatives have similar TCO, but one has a longer MTTR and proprietary spare parts. Develop a decision method that incorporates availability and supply-chain risk.

2. A conveyor can be driven by the load during stopping. Identify the hazards, measurements, design controls, safety functions, and acceptance tests required before commissioning.

3. Prepare a high-level risk register for connecting a variable-speed drive to a plant Ethernet network, including causes, consequences, controls, owners, and residual-risk treatment.

22. Multiple Choice Questions with Answers

Question 1

Which evaluation method best captures energy, maintenance, downtime, and disposal costs over a drive system’s life?

A. Purchase-price comparison

B. Total cost of ownership analysis

C. Nameplate-rating comparison

D. Simple current calculation

Correct Answer: B. Total cost of ownership analysis

Question 2

A drive system has high MTBF but poor availability. Which condition most plausibly explains this result?

A. Very short repair and diagnosis time

B. No production consequences during failure

C. Long MTTR caused by unavailable spares

D. Excessive motor efficiency

Correct Answer: C. Long MTTR caused by unavailable spares

Question 3

Why may a downhill conveyor require special stopping equipment?

A. The load can regenerate energy into the drive

B. The motor cannot produce torque

C. The conveyor always operates at zero speed

D. The control network removes all mechanical energy

Correct Answer: A. The load can regenerate energy into the drive

Question 4

Which statement correctly distinguishes safe torque off from electrical isolation?

A. Safe torque off always removes DC-link voltage

B. Electrical isolation is only a software command

C. Safe torque off prevents torque production but may leave electrical energy present

D. They are legally and technically identical in every application

Correct Answer: C. Safe torque off prevents torque production but may leave electrical energy present

Question 5

What is the principal purpose of a management-of-change process?

A. To avoid recording design decisions

B. To assess, approve, test, and document modifications

C. To replace all factory tests

D. To transfer responsibility to the supplier

Correct Answer: B. To assess, approve, test, and document modifications

Question 6

Which cybersecurity practice most directly limits the damage from compromised user credentials?

A. Least-privilege access

B. Increasing motor speed

C. Removing all event logs

D. Disabling configuration backups

Correct Answer: A. Least-privilege access

Question 7

Why should a weighted decision matrix be supported by evidence?

A. Weights eliminate all uncertainty

B. Numerical scores can otherwise create false objectivity

C. It makes safety assessment unnecessary

D. It guarantees the lowest capital cost

Correct Answer: B. Numerical scores can otherwise create false objectivity

Question 8

Which document most directly records the configuration actually installed after commissioning?

A. Preliminary quotation

B. As-built documentation

C. Marketing brochure

D. Unapproved concept sketch

Correct Answer: B. As-built documentation

Question 9

Which action is most appropriate when a supplier requests permanent remote access to a networked drive?

A. Approve it without review

B. Use controlled, approved, monitored, and time-limited access

C. Connect the drive directly to the public internet

D. Disable all local accounts and backups

Correct Answer: B. Use controlled, approved, monitored, and time-limited access

Question 10

Why should energy savings from a retrofit be reported using measured energy per unit of production where possible?

A. Rated motor power always equals actual consumption

B. Production level and duty profile affect actual savings

C. Measurement eliminates the need for a baseline

D. It avoids considering process operation

Correct Answer: B. Production level and duty profile affect actual savings