Failures, engineering design errors

There are no known or accepted rigorous or scientific ways to obtain probabilistic or even subjective likelihood information using historical data or analysis in the case of non-random failures and system design errors, including unsafe software behavior. When forced to come up with such evaluations, engineering judgment is usually used, which in most cases amounts to pulling numbers out of the air, often influenced by political and other nontechnical factors. Selection of a system architecture and early architectural trade evaluations on such a basis is questionable and perhaps one reason why risk usually does not play a primary role in the early architectural trade process. 

There are many examples of planning and design errors. A few will suffice. A common computational problem for engineers is converting units of measure. For example, failure to convert square inches to square feet will produce a large error in a load calculation. Failure to include a factor of safety in a structural calculation can be disastrous. Using the wrong factor of safety can introduce a hazard. 

Examples of inadequacies or failures of engineering controls include BOP malfunction, hydraulic failure, gauge or indicator equipment error or malfunction, power disruption, and valve failure. Engineering controls are subject to failure due to inadequate design, installation, inspection, testing, and maintenance. 

The failure of any engineering structure is cause for concern, for a single incident can indicate a material flaw or design error that renders myriad apparent structural successes irrelevant. In... 

Common cause failures are described in Section 2.2.3.4 as simultaneous failures of multiple components due to some underlying common cause, such as design errors or environmental factors. Common cause events can be placed directly on fault trees for analysis. Engineering judgment is used to determine which common cause events are important enough to include. It is not possible to include all conceivable combinations of common cause events due to the number of components involved. For example, the number of combinations of motor-operated valves in a plant that could fail from a common cause is almost endless. Standard practice is to consider common cause combinations across multiple trains of single systems, but with a few exceptions not across multiple systems. 

It should be clear that a complete FMEA approach is not practical for the evaluation of production facility safety systems. This is because (1) the cost of failure is not as great as for nuclear power plants or rockets, for which this technology has proven useful (2) production facility design projects cannot support the engineering cost and lead time associated with such analysis (3) regulatory bodies are not staffed to be able to critically analyze the output of an FMEA for errors in subjective judgment and most importantly, (4) there are similarities to the design of all production facilities that have allowed industry to develop a modified FME.A approach that can satisfy all these objections. 

Although checklists are a useful way of transferring information about human-machine interaction to designers and engineers, they are not a standalone tool and they cannot provide a substitute for a systematic design process. The main concern with checklists is that they do not offer any guidance about the relative importance of various items that do not comply with the recommendations, and the likely consequences of a failure due to a noncompliance. To overcome such problems, checklists should be used in combination with other methods of task analysis or error analysis that can identify the complexities of a task, the relationships among various job components, and the required skills to perform the task. 

Physical property data and sometimes reaction rate characteristics are required for making relief sizing calculations. Data estimated using engineering assumptions are almost always acceptable when designing unit operations because the only result is poorer yields or poorer quality. In the relief design, however, these types of assumptions are not acceptable because an error may result in catastrophic and hazardous failures. 

There are other software packages available for doing such calculations, including those available in general-purpose process simulators. The design engineer is wise to verify that the models selected are applicable to acid gas-water mixtures. Failure to do so could lead to significant errors. 

While the failure of the LMA CD engineer who designed the II rate filter to find the error during his visual check was clearly related to the difficulty of checking long lists of differently formatted numbers, it also may have been partly due to less care being taken in the process due to an incorrect mental model (1) he did not know the values were manually entered into the database (and were not from the electronic file he had created), (2) he did not know the load tape was never formally tested in any simulation prior to launch, and (3) he was unaware the load tape constants were not used in the IV V process. 

---