This morning, I read this article about a problem in two small towns in Massachusetts when the engineers responsible for a normally reliable, safe, natural gas distribution infrastructure don't really think about what they are doing, and the consequences of their designs. It's shameful.
The NTSB report about what happened was very clear, and very troubling:
The contracted crew was working on a tie-in project of a new plastic distribution main and the abandonment of a cast-iron distribution main. The distribution main that was abandoned still had the regulator sensing lines that were used to detect pressure in the distribution system and provide input to the regulators to control the system pressure. Once the contractor crews disconnected the distribution main that was going to be abandoned, the section containing the sensing lines began losing pressure.
As the pressure in the abandoned distribution main dropped about 0.25 inches of water column (about 0.01 psig), the regulators responded by opening further, increasing pressure in the distribution system. Since the regulators no longer sensed system pressure they fully opened allowing the full flow of high-pressure gas to be released into the distribution system supplying the neighborhood, exceeding the maximum allowable pressure.
Why the control system wasn't smart enough to detect:
- Pressure Reading of Zero - the sensor was on the abandoned line - which had no pressure. Why didn't that fact alone cause an alarm?
- Zero Change on Output based on Input Change - when the first change was done, why wasn't the change seen on the sensor - at least in a percentage measure? Even, if you look at the first-derivative of the sensor reading, a simple thing to do even with analog control systems, and see that no change could be seen should have been an error.
- Upper Limit on Input - when you see that you have increased the input some percentage in the last "...few minutes..." - then sound the alarm. There is no reason to ramp the input like this. It's a leak - or worse, and needs to be corrected.
As an engineer, I'm stunned that the folks that created this control system didn't do these, or something similar, to them to sound alarms as opposed to letting four homes blow up. I mean, it's one thing to have a leak, with a bad scent in the house - but to actually have homes blow up - that's way past bad design.
An old friend and I have talked about this many times over the years - How do you really teach this kind of design? - and it's not easy. It comes from experience, and the problem is, most engineers don't have it - any more than most people are wise. You have to accumulate experience over years - to know what to think about... what to look for... all that needs to be considered, and it takes years to really gain that perspective.
But companies will pass things like this off to the junior engineers - because that's who they believe can do all that's needed. And if you ask the folks doing the work if they are ready to do this kind of work, they are always going to say "Yes!". That's just "confidence".
Until we come to terms with this gap in the education of engineers, we're going to have these problems, and they could be a whole lot worse.