Mechanical¶
Machine and pressure vessel design¶
Rules found in this domain: P44, P60.
Illustrative, not evidence.
Scenario. A team designs a compressed-air receiver. It first meets the applicable pressure vessel code as the minimum, and the inspector's code check passes. It then applies the other rules. It sets the design pressure well above the highest expected working pressure, with the relief valve set between the two.
- P60: A code exists, so the team meets it as the minimum and then applies the other rules. The code compliance check passes.
- P44: Capacity sits above the expected load: the design pressure is well above the highest working pressure, and the relief valve keeps the real pressure below the design pressure.
Technical drawing¶
Rules found in this domain: P56.
Illustrative, not evidence.
Scenario. A machinist receives a drawing for a bracket. The drafter drew it. A colleague who is not the author checks dimensions and tolerances before the drawing is released. For a part on a lifting device, the checker comes from a separate design office.
- P56: Every drawing has a checker who is not the author. The checker is more independent where the consequence of failure is higher.
Aerospace design¶
Rules found in this domain: P23, P24, P45, P17.
Illustrative, not evidence.
Scenario. An airframe team designs a flap actuator. It picks the simplest design that meets the requirements and splits it into modules, each with one stated purpose. It adds a second actuator channel so that the flap survives the loss of either channel, and a test with either channel disabled shows the flap still moves. The team would like a new composite hinge. Its recorded maturity assessment finds it immature, so the flap keeps a proven metal hinge until the composite one is qualified.
- P23: The team chooses the simplest design that meets the requirements and splits it into modules with one stated purpose each.
- P45: The function survives the loss of any single channel, and removing one channel in a test keeps the flap moving.
- P17: The design would depend on a technology new to the team. Its maturity is assessed and recorded, and the immature hinge stays out of the critical path.
Aerospace testing¶
Rules found in this domain: P57, P65, P82.
Illustrative, not evidence.
Scenario. A test team qualifies a fuel pump. It runs the test in the same configuration and conditions as real flight and lists each difference from flight with a reason. After a seal is repaired, it tests again. During a run, the pump shows an unexpected pressure ripple. Nobody is hurt, but the team records the anomaly and investigates it before accepting it.
- P57: The test runs in the configuration and conditions of real operation. Differences are listed and justified, and the test is repeated after repair.
- P82: The system behaves differently from what was expected. The ripple is recorded and investigated, with a decision to fix it or accept it with a written reason.
Aviation operations and maintenance¶
Rules found in this domain: P37, P74, P76.
Illustrative, not evidence.
Scenario. An airline plans maintenance for a fleet. Parts that wear out with age, such as life-limited engine discs, it replaces after a set number of flight cycles. For everything else it monitors condition. Each maintenance task states which failure pattern it addresses. During taxi, takeoff and landing, the flight crew keeps to essential talk only, as the airline's written rules require.
- P74: The maintenance method follows how each part fails: scheduled replacement only for what wears with age, here counted in flight cycles, and condition monitoring for the rest. Each task states its failure pattern.
- P76: Taxi, takeoff and landing are critical phases. Only the activity and communication that they need are allowed, under written rules.
Automotive¶
Rules found in this domain: P46, P59, P22.
Illustrative, not evidence.
Scenario. A carmaker develops a braking system. Two brake controllers share one supplier, so a single defect could hit both. The team makes the second controller from a different design. It lists what the two still share, such as the vehicle power supply, with a reason for each. Every requirement links to design and test, and back. Before building, the team lists how each part can fail and how parts can interact unsafely, and reviews the list.
- P46: One cause could hit all copies at once, so the copies are made different. Shared dependencies are listed and justified.
- P59: The system is safety-critical. Each requirement links in both directions to design and test, with no requirement lacking a test.
- P22: Before building, the team lists failure modes and unsafe interactions per component, and the list is reviewed.
Naval architecture¶
Rules found in this domain: P41.
Illustrative, not evidence.
Scenario. A shipyard designs a ferry hull. Watertight bulkheads divide the hull into isolated compartments. In the damage stability analysis, one flooded compartment leaves the other compartments dry and the ship afloat.
- P41: The system is divided into isolated compartments. The damage case for one compartment leaves all the others working.
Elevators¶
Rules found in this domain: P37.
Illustrative, not evidence.
Scenario. A lift maker defines the safe state as the car stopped and held. If power or the controller fails, the spring-applied brake closes. If the car overspeeds, for example after a rope failure, the governor trips the safety gear. A test with cut power shows that the brake stops the car, and an overspeed test shows that the safety gear catches it.
- P37: A safe state is defined and failure is designed to move there. Failure injection shows that the system reaches the safe state.
Control engineering and machinery¶
Rules found in this domain: P48, P4.
Illustrative, not evidence.
Scenario. A press has an automatic temperature controller. The team adds a deadband around the setpoint so the heater does not switch on and off repeatedly, and a test shows no repeated switching. The press has a stop button. It works in every mode, overrides all other functions, and does not restart the press when it is reset. Any operator may press it without blame.
Acoustic¶
Rules found in this domain: P38, P27.
Illustrative, not evidence.
Scenario. A plant has a loud compressor. The team checks the higher control levels first. The process still needs compressed air, so the compressor cannot be removed, and no quieter model meets the demand. It records both reasons. It then encloses the compressor, an engineering control at the source, rather than handing out ear protection at the receiver. The compressor runs at varying speeds, so the enclosure panels and mounts are designed to stay clear of resonance across the whole speed range. Tests across that range show that the noise at the work stations changes little and stays within limits.
- P38: Elimination and substitution are not possible, and a record states why. The team uses the next level, an engineering control, and places it at the source rather than along the path or at the receiver.
- P27: The input, the compressor speed, varies. The enclosure is designed so the result changes little across that range, and tests at varied speeds show stable noise levels.
Space systems¶
Rules found in this domain: P44, P33.
Illustrative, not evidence.
Scenario. A satellite team sizes its power budget with capacity above the expected load, and a larger factor in the early design phase. It lowers the factor at later reviews as the load estimates firm up. The flight computer and the thruster controller exchange data over an interface with a machine-checked schema. It states units and reference frames explicitly. The interface rejects and logs a thrust command that has no frame field.
Optomechanical and precision engineering¶
Rules found in this domain: P30.
Illustrative, not evidence.
Scenario. A telescope mirror mount can be positioned by the kinematic mount and by the clamp ring. If both set the same position, they fight and distort the mirror. The designers constrain each degree of freedom exactly once. The kinematic mount owns position and the ring only holds the mirror in place.
- P30: Several mechanisms could set the same property. Each property is constrained exactly once, with one owner.
Energy engineering¶
Rules found in this domain: P3, P49.
Illustrative, not evidence.
Scenario. A utility adds a power line to relieve a congested grid corridor. It forecasts that demand will grow into the new capacity and adds a demand control: a time-of-use price. Before choosing the line, it checks whether efficiency and demand response could free enough capacity instead. For the line it builds, it measures and reviews energy losses and materials over the whole lifecycle, from construction through operation to removal.