HOW I WORK / ENGINEERING PRINCIPLES
How I approach
critical systems.
The idea behind each case study and engineering note on this site, in one place. Follow a link to the work it came from.
From professional practice
A platform change also changes ownership, support and operating practice.
Compatibility, acceptance evidence and handover belong in the same plan.
From the case: Modernizing while operations continue. →An observation and an explanation are different things.
Useful monitoring helps test a hypothesis, identify missing evidence and check whether an intervention changes the behavior being investigated.
From the case: Reliability begins with evidence. →Bringing applications onto shared infrastructure changes the consequences of a dependency failure.
Resource demand, supportability, visibility and recovery need to be considered together.
From the essay: Consolidate the hardware. Plan the recovery. →Each acceptance stage answers a different question.
A factory test shows the system was built as specified; site tests show it works in place; integration shows it works with everything around it; handover shows the people inheriting it can run it. Skipping a stage moves its questions to a less convenient time.
From the case: Accept it before you depend on it. →
From the engineering notes
Dependencies are part of the design.
Two supply paths can share one cooling dependency. Trace the relationships before counting the equipment.
Read the note →Recovery is a sequence, not a switch.
Equipment restoration, service recovery and verification are different events. A synthetic experiment makes the gap visible.
Read the note →Capacity margin determines what happens after restoration.
Shortening a restart cannot remove a steady cooling deficit. Compare restored capacity, requested load and the heat left to remove.
Read the note →Changing a system that cannot stop.
Planned work removes redundancy before anything fails. Decide the stop points, the recoverable state and the evidence before the window opens.
Read the note →Count redundancy by what it survives.
N+1 and 2N describe how much equipment is installed. The useful question is which events the arrangement can absorb, including the ones that arrive together.
Read the note →Every alarm should ask for an action.
An alarm flood buries the cause of an upset. Priorities, delays and suppression each fix a different part of the problem, and none changes the process.
Read the note →Follow one fault across every boundary.
Design reviews split a plant by discipline; faults do not. One synthetic unit shows a redundancy in one discipline defeated through another.
Read the note →
New to some of the terms? See the glossary.