Drawing the System Boundaries

Consider the chemical plant example. While the hazard could be defined as death or injury of residents around the plant (the loss event), there may be many factors involved in such a loss that are beyond the control of the plant designers and operators. One example is the atmospheric conditions at the time of the release, such as velocity and direction of the wind. Other factors in a potential accident or loss are the location of humans around the plant and community emergency preparedness, both of which may be under the control of the local or state government. The designers of the chemical plant have a responsibility to provide the information necessary for the design and operation of appropriate emergenq preparedness equipment and procedures, but their primary design responsibility is the part of a potential 

As another example of the relationship between hazards and system boundaries, consider the air traffic control system. If an accident is defined as a collision between aircraft, then the appropriate hazard is the violation of minimum separation between aircraft. The designer of an airborne collision avoidance system or a more general air traffic control system theoretically has control over the separation between aircraft, but may not have control over other factors that determine whether two aircraft that get close together actually collide, such as visibility and weather conditions or the state of mind or attentiveness of the pilots. These are under the control of other system components such as air traffic control in directing aircraft away from poor weather conditions or the control of other air transportation system components in the selection and training of pilots, design of aircraft, and so on. 

All that is being suggested here is that top-down system engineering is critical for engineering safety into complex systems. In addition, when a new component is introduced into an existing system, such as the introduction of a collision avoidance system in the aircraft, the impact of the addition on the safety of the aircraft itself as well as the safety of air traffic control and the larger air transportation system safety needs to be considered. 

Another case is when a set of systems that already exist are combined to create a new system. While the individual systems may have been designed to be safe within the system for which they were originally created, the safety constraints enforced in the components may not adequately control hazards in the combined system or may not control hazards that involve interactions among new and old system components. 

The reason for this discussion is to explain why the definition of the hazards associated with a system is an arbitrary but important step in assuring system safety and why a system engineering effort that considers the larger sociotechnical system is necessary. One of the first steps in designing a system, after the definition of an accident or loss and the drawing of boundaries around the subsystems, is to identify the hazards that need to be eliminated or controlled by the designers of that system or subsystem. 

---

Define the system and draw the system boundaries for which the material balance is to be made. 

---