Release, Exposure and Consequence Boundaries

Learning objective. Trace inventory, containment and ventilation paths using explicit control-volume assumptions; avoid claiming that mixing calculations are site-specific dispersion analyses.

Linked synthetic case. A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models.

What an adequate output contains. Consequence assessment requires actual substances, phases, terrain, weather, source term, ventilation patterns and receptor locations.

Why this unit is needed

Process safety concerns preventing and limiting catastrophic releases of hazardous substances or energy, rather than merely maintaining a low count of routine injuries. A real project cannot infer its safety from a single score, accident-free period or calculation. For this unit, trace inventory, containment and ventilation paths using explicit control-volume assumptions; avoid claiming that mixing calculations are site-specific dispersion analyses. The basis of this reasoning is the physical configuration of equipment and operations, not the appearance of a matrix or dashboard. Assign each critical assertion an owner and identify how field observations could contradict it.

The case used across the lessons is deliberately hypothetical: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. It contains no named real chemicals, equipment certificates, actual incident frequencies or approved operating limits. That distinction is central to interpreting models. For a plant, process safety information must describe what can be hazardous, how the process can deviate, and which barriers genuinely remain functional in abnormal conditions. A model may reveal sensitivity while omitting the mechanism that actually dominates a serious accident.

The five-layer engineering argument

1. Hazard and inventory: Identify substances, energy and populations or environmental receptors that could be exposed. Document what remains unknown before assigning a numerical risk category.

2. Initiating mechanism: State a credible cause, including external utilities, human-machine interfaces, maintenance, abnormal startup and non-routine conditions; separate initiating cause from the loss-of-control top event.

3. Prevention: Identify physical design limits, independently verified interlocks, procedures and maintenance controls. Do not assume independence without checking power, instruments and common personnel.

4. Mitigation: Assess containment, shutdown, relief and emergency arrangements in the context of the actual consequence mechanism. A mitigation may reduce severity without reducing the initiating frequency.

5. Assurance: Specify evidence, proof tests, field observations and responsible action owners. Controls that are unavailable, bypassed or degraded must not be credited as if fully available.

How to use the three numerical laboratories

These interactive models intentionally isolate individual relationships rather than claiming to predict a hazardous plant. Before moving a slider, write the governing equation and the physical units. Decide which outcomes should rise or fall when one parameter changes. After moving it, check whether the response and the plotted curve agree with that expectation. Export numerical data and calculate one point independently. If a curve seems favorable, identify a missing mechanism that could reverse the real decision.

This unit's laboratories are:

• [Lab 07: Ventilated compartment steady concentration](../labs/lab-07.html) — Illustrate an ideal mass balance for a well-mixed compartment with continuous source. Boundary: Well-mixed, no chemistry, no local plume; not occupational exposure or toxic consequence assessment.
• [Lab 08: Ideal transient compartment buildup](../labs/lab-08.html) — Solve first-order accumulation from zero initial concentration. Boundary: Perfect mixing and constant source and exhaust; no worker-location concentration prediction.
• [Lab 09: Two-period exposure average](../labs/lab-09.html) — Contrast averaging with peak values for a schematic two-period history. Boundary: No occupational exposure limit comparison or short-term toxicity conclusion; chemicals differ.

How to review evidence

For each lesson prepare a three-column evidence ledger: declared fact, supporting observation/source, and status (measured, specified, assumed, inferred, or unresolved). Do not promote an assumption to a measurement when an equation happens to give a precise answer. In a team review, challenge the source of every probability and time constant. If an engineering standard is cited, verify the correct edition and legal applicability; standards differ by jurisdiction and project date. For serious events, methods used by qualified specialists should replace these elementary illustrations.

The course encourages deliberate disagreement: two reviewers should independently identify the hazardous deviation and potentially defeated safeguards before reconciling their lists. Record both the agreement and remaining uncertainty. The presence of a highly consequential unresolved scenario should not be hidden inside a low composite average. Closure means that a response has been implemented and verified to work, not that a spreadsheet cell has been colored green.

Progression and assessment

Complete the four lessons in order. Each assessment demands a short derivation, a sensitivity or limitation check, a scenario analysis and a documented decision. A numerical result without a stated boundary, units and credible evidence should receive no engineering credit. The final unit project asks for an auditable decision memo that separates a screening observation from an approval to build or operate. Peer review should specifically challenge common-cause failures and untested assumptions.

Lesson 1: Material inventory and loss of containment

A control-volume inventory defines how much can plausibly become involved in an event, but the release fraction and rate require separate physical models and equipment information. Key analytical anchor: M_in_system = flow_rate × residence_time for a steady holdup proxy. Investigate the following case: A flow of 400 kg/h and six hours of nominal residence corresponds to 2400 kg of average inventory in this proxy. The most likely conceptual error is equating total holdup to instantaneous releasable mass. In the lesson, assemble actual geometry, density, levels, isolation valves, secondary containment and flow paths before drawing the operational conclusion: treat inventory reduction as a design principle while verifying operability. Further discussion: Contrast reducing inventory by half with reducing line length while keeping throughput constant.

Lesson 2: Compartment ventilation and concentration

A well-mixed volume balance couples source rate, exhaust flow and accumulation. Real enclosures have stratification, dead zones and source-to-receptor gradients, so an ideal mixing model does not predict individual exposure. Key analytical anchor: V dC/dt = G − Q C. Investigate the following case: For G=0.06 g/s and Q=3 m³/s, ideal steady concentration is 0.02 g/m³, absent other removal. The most likely conceptual error is assuming well mixed equals safe, or comparing mass concentration directly with a ppm limit. In the lesson, assemble ventilation commissioning, local air sampling, release characterization, occupancy and chemical-specific limits before drawing the operational conclusion: use model to learn sensitivity, then apply recognized industrial hygiene methods. Further discussion: Explain why doubling airflow halves the ideal steady state but may not halve a worker's local plume.

Lesson 3: Transient buildup and removal

A first-order enclosure model illustrates approach to steady concentration and how air-change time scale differs from exposure during a short source event. Transients matter during startup and maintenance. Key analytical anchor: C(t) = G/Q × [1 − exp(−Qt/V)] for C(0)=0. Investigate the following case: With V=150 m³ and Q=3 m³/s, the nominal ideal mixing time constant is 50 s. The most likely conceptual error is forgetting source cessation, imperfect mixing or ventilation failure. In the lesson, assemble building volume, exhaust measurements, fan reliability and measured transient response before drawing the operational conclusion: test the time scale and acknowledge unmodeled short-circuit ventilation. Further discussion: Sketch a source-on/source-off thought experiment and locate the highest modeled concentration.

Lesson 4: Exposure metrics and the interpretation trap

Time-weighted averages, ceilings and short-term limits control different exposure dimensions; a low average can hide a brief high peak. Regulatory limits are jurisdiction- and substance-specific. Key analytical anchor: C_TWA = Σ(C_i Δt_i)/ΣΔt_i. Investigate the following case: Exposure to 2 mg/m³ for one hour and 0.5 mg/m³ for seven hours yields a modeled 0.6875 mg/m³ eight-hour average. The most likely conceptual error is calling an average compliant without checking applicable short-term limits or uncertainty. In the lesson, assemble sampling method validation, location, exposure duration and the correct legally applicable limit before drawing the operational conclusion: report peak and cumulative statistics separately with units. Further discussion: Create two exposure histories with equal TWA but different peaks; explain why they are not equivalent.

Unit completion checkpoint

The minimum acceptable submission contains an annotated process boundary for release, exposure and consequence boundaries, a cause-to-consequence pathway, a register of assumptions, an independent numerical reproduction of each model, and an unresolved-information list. In the synthetic case, a process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Identify which missing single item is most likely to change your recommendation and why. Then state who would have authority to accept or reject the real project after a specialist review.

Unit 3 · Lesson 1: Material inventory and loss of containment

[Unit overview](../units/unit-03.html) · [Interactive lab 07](../labs/lab-07.html) · [Assessment](../assessments/unit-03.html) · [Applied project](../projects/unit-03.html)

The engineering question

A control-volume inventory defines how much can plausibly become involved in an event, but the release fraction and rate require separate physical models and equipment information. This lesson belongs to Release, Exposure and Consequence Boundaries, where the course objective is to trace inventory, containment and ventilation paths using explicit control-volume assumptions; avoid claiming that mixing calculations are site-specific dispersion analyses. The governing issue is not whether one can calculate a number; it is whether that number describes the failure mechanism under study. A competent analysis separates a claim about what happens, an argument about why it would happen, and evidence that the safeguards could withstand real operation.

Specific thought experiment. A flow of 400 kg/h and six hours of nominal residence corresponds to 2400 kg of average inventory in this proxy. Work from the equipment boundary outward. Name the initiating event, the operating mode, the top event, the potentially exposed people or environment, and the time over which the consequences could develop. If any one of these is unspecified, maintain the uncertainty rather than inventing a value.

Principles and analytical relationship

The working relation or structured method is M_in_system = flow_rate × residence_time for a steady holdup proxy. It is useful because it forces an analyst to state inputs and ask whether the units, time basis and conditioning assumptions match. A rate per year cannot be multiplied by an arbitrary probability without asking what event that probability conditions upon. Similarly, an ordinary fraction is not a mass fraction until the relevant mass balance has been declared. In a causal diagram, an arrow represents a proposed physical or organizational dependency; it is not, by itself, proof of causality.

The physical interpretation for material inventory and loss of containment is the following: A control-volume inventory defines how much can plausibly become involved in an event, but the release fraction and rate require separate physical models and equipment information. Thus the result needs an audit trail back to observations, design documents or a controlled estimate. There is no universal conversion from a neat calculation to safe operation. Where the relationship is qualitative, a complete answer explains the conditions for each step and which alternative cause could produce the same observed symptom. When the relation is quantitative, a complete answer supplies units, ranges and a check against a limiting case.

For the course case, a process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Consider three boundaries before deciding whether the model is applicable: the system under study, the observation period, and the intervention boundary. System boundaries determine which inventories and energy flows are included. Observation periods distinguish transient loss of control from a steady process average. Intervention boundaries identify where automatic protection, human response or passive containment can plausibly act. A safeguard that acts after the harm does not prevent the initiating event, although it may limit the consequence.

Worked reasoning example

Unverified numerical or qualitative illustration: A flow of 400 kg/h and six hours of nominal residence corresponds to 2400 kg of average inventory in this proxy. Begin with the stated conditions only. Write the relationships that must hold, then identify at least one variable not specified in the example. If an exact arithmetic result is given, reproduce it independently and add a clear qualifier about the simplified model. If the example is qualitative, draw a two-branch argument: one where the existing barrier is available and one where it is defeated by a plausible condition. Do not fill missing branches with assumed success simply to obtain a final score.

A useful way to test the claim is to ask what change would produce the opposite conclusion. For this topic, the specific analytical trap is equating total holdup to instantaneous releasable mass. Try to construct a counterexample with the same nominal process equipment but an altered startup, maintenance, utility, human or instrument condition. A single plausible counterexample indicates that the original claim was conditional. It does not automatically establish that the process is unsafe; it establishes which fact must be investigated before any stronger judgment.

Evidence and traceability

The minimum relevant evidence set is actual geometry, density, levels, isolation valves, secondary containment and flow paths. For each item record source, revision, date, scope, owner and confidence. Separate field-measured values from vendor guarantees, industry generic estimates and deliberately fictional learning inputs. For example, two pumps sold at the same nominal capacity do not necessarily share seal arrangements, failure modes or instrument interfaces. Even an authoritative standard does not substitute for actual testing or determine whether a particular facility falls within its legal scope.

An effective review checks whether evidence is current for the operating mode. Startup differs from steady production; temporary operation after a maintenance outage may differ from both. Procedures, alarms and emergency equipment must be evaluated for those modes explicitly. A reliability assertion based on one short interval must not silently be extended to years of service. Missing evidence should generate a specific work request instead of a generic recommendation to “improve safety.”

Laboratory investigation and sensitivity

Use [Lab 07: Ventilated compartment steady concentration](../labs/lab-07.html). The printed equation is C_ss = G/Q. Illustrate an ideal mass balance for a well-mixed compartment with continuous source. Start from each slider's default, record the displayed metric and vary the first parameter over five or more settings. The graph and CSV should agree with your hand calculations. Next, change one other parameter while keeping the first fixed; this distinguishes a mathematical sensitivity from a trend caused by simultaneous input changes.

Investigation target: Show inverse proportionality with airflow; why can local concentrations differ? The major simplification is Well-mixed, no chemistry, no local plume; not occupational exposure or toxic consequence assessment.. A good lab report predicts the sign of the derivative or change before observing the plot, then explains what physical process that derivative represents. If an output is nonphysical or a limiting denominator becomes zero, it should be reported as an invalid domain rather than manipulated into a finite reassuring result. Place the lesson's analytical relationship alongside the lab relation; explain whether they describe the same physical quantity or different levels of abstraction.

As a challenge, compare this model with [Lab 08: Ideal transient compartment buildup](../labs/lab-08.html). The second model's relation is C(t) = (G/Q)[1 − exp(−Qt/V)], and its stated limitation is Perfect mixing and constant source and exhaust; no worker-location concentration prediction.. The comparison is not an invitation to combine numbers blindly. Explain what would need to be measured so the two simplified relationships could appear in one defensible engineering argument.

Failure-first decision review

The unacceptable shortcut is equating total holdup to instantaneous releasable mass. Make a table with columns assumption, possible failure, observation that would expose it, cheapest credible check, owner, and decision consequence. For this particular topic the review should prioritize the evidence sources above rather than produce a broad list of every conceivable failure. Then ask what is the most important remaining uncertainty if all routine checks pass. Low-frequency high-consequence scenarios often cannot be validated simply by waiting for an incident.

The recommended analytical action is: Treat inventory reduction as a design principle while verifying operability. This recommendation is a learning exercise, not a control-system change or site-specific directive. Describe its boundaries. What would have to be established by independent qualified review? How would an operator learn that the intended protective measure had become unavailable? Which record would demonstrate closure after a modification? A paper action with no verification is not the same as an effective protective function.

Interpreting uncertainty and competing explanations

Uncertainty enters from input data, model structure, operating variability and human or organizational factors. Input uncertainty might be reduced by a calibrated measurement, whereas model-structure uncertainty demands a different physical model or field trial. Increasing the number of decimal places addresses neither. Separate uncertainty that could reverse the conclusion from uncertainty that changes only the reported numerical precision. The severity of a credible major-accident scenario should influence how urgently an evidence gap is reviewed, even when its probability is difficult to quantify.

For material inventory and loss of containment, an apparently successful barrier test may demonstrate only the modes exercised by the test. It might not probe lost utilities, common-cause failure, maintenance bypass or the specific initiating condition. A useful counterfactual question is: If the expected result were wrong tomorrow, which observation would reveal it first? Identify an observable precursor and a clear escalation action. This turns an educational calculation into a disciplined evidence requirement without representing it as a plant certification.

Independent exercises

1. Boundary and mechanism: Contrast reducing inventory by half with reducing line length while keeping throughput constant. Label at least one fact, one assumption and one unknown.

2. Quantitative check: Reproduce one result from Lab 07. Show units, the governing relationship and a simple limiting-case or conservation check.

3. Scenario variation: Replace one favorable assumption with an unfavorable but plausible operating condition. Explain which safeguarding claim is weakened and why.

4. Decision note: Summarize in 200–300 words whether treat inventory reduction as a design principle while verifying operability. Specify the additional observation that could change your conclusion.

5. Critical review: Explain why equating total holdup to instantaneous releasable mass would be misleading when a high-consequence scenario is involved.

Lesson outcome checklist

• A credible scenario chain is drawn, without conflating initiating cause, top event and outcome.
• Model assumptions and units are explicit and the numerical output is checked independently.
• Any barrier credit is tied to function, independence, availability, evidence and an owner.
• The decision specifies what remains unverified; it does not present an educational model as a safe operating limit.

Unit 3 · Lesson 2: Compartment ventilation and concentration

[Unit overview](../units/unit-03.html) · [Interactive lab 08](../labs/lab-08.html) · [Assessment](../assessments/unit-03.html) · [Applied project](../projects/unit-03.html)

The engineering question

A well-mixed volume balance couples source rate, exhaust flow and accumulation. Real enclosures have stratification, dead zones and source-to-receptor gradients, so an ideal mixing model does not predict individual exposure. This lesson belongs to Release, Exposure and Consequence Boundaries, where the course objective is to trace inventory, containment and ventilation paths using explicit control-volume assumptions; avoid claiming that mixing calculations are site-specific dispersion analyses. The governing issue is not whether one can calculate a number; it is whether that number describes the failure mechanism under study. A competent analysis separates a claim about what happens, an argument about why it would happen, and evidence that the safeguards could withstand real operation.

Specific thought experiment. For G=0.06 g/s and Q=3 m³/s, ideal steady concentration is 0.02 g/m³, absent other removal. Work from the equipment boundary outward. Name the initiating event, the operating mode, the top event, the potentially exposed people or environment, and the time over which the consequences could develop. If any one of these is unspecified, maintain the uncertainty rather than inventing a value.

Principles and analytical relationship

The working relation or structured method is V dC/dt = G − Q C. It is useful because it forces an analyst to state inputs and ask whether the units, time basis and conditioning assumptions match. A rate per year cannot be multiplied by an arbitrary probability without asking what event that probability conditions upon. Similarly, an ordinary fraction is not a mass fraction until the relevant mass balance has been declared. In a causal diagram, an arrow represents a proposed physical or organizational dependency; it is not, by itself, proof of causality.

The physical interpretation for compartment ventilation and concentration is the following: A well-mixed volume balance couples source rate, exhaust flow and accumulation. Real enclosures have stratification, dead zones and source-to-receptor gradients, so an ideal mixing model does not predict individual exposure. Thus the result needs an audit trail back to observations, design documents or a controlled estimate. There is no universal conversion from a neat calculation to safe operation. Where the relationship is qualitative, a complete answer explains the conditions for each step and which alternative cause could produce the same observed symptom. When the relation is quantitative, a complete answer supplies units, ranges and a check against a limiting case.

For the course case, a process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Consider three boundaries before deciding whether the model is applicable: the system under study, the observation period, and the intervention boundary. System boundaries determine which inventories and energy flows are included. Observation periods distinguish transient loss of control from a steady process average. Intervention boundaries identify where automatic protection, human response or passive containment can plausibly act. A safeguard that acts after the harm does not prevent the initiating event, although it may limit the consequence.

Worked reasoning example

Unverified numerical or qualitative illustration: For G=0.06 g/s and Q=3 m³/s, ideal steady concentration is 0.02 g/m³, absent other removal. Begin with the stated conditions only. Write the relationships that must hold, then identify at least one variable not specified in the example. If an exact arithmetic result is given, reproduce it independently and add a clear qualifier about the simplified model. If the example is qualitative, draw a two-branch argument: one where the existing barrier is available and one where it is defeated by a plausible condition. Do not fill missing branches with assumed success simply to obtain a final score.

A useful way to test the claim is to ask what change would produce the opposite conclusion. For this topic, the specific analytical trap is assuming well mixed equals safe, or comparing mass concentration directly with a ppm limit. Try to construct a counterexample with the same nominal process equipment but an altered startup, maintenance, utility, human or instrument condition. A single plausible counterexample indicates that the original claim was conditional. It does not automatically establish that the process is unsafe; it establishes which fact must be investigated before any stronger judgment.

Evidence and traceability

The minimum relevant evidence set is ventilation commissioning, local air sampling, release characterization, occupancy and chemical-specific limits. For each item record source, revision, date, scope, owner and confidence. Separate field-measured values from vendor guarantees, industry generic estimates and deliberately fictional learning inputs. For example, two pumps sold at the same nominal capacity do not necessarily share seal arrangements, failure modes or instrument interfaces. Even an authoritative standard does not substitute for actual testing or determine whether a particular facility falls within its legal scope.

An effective review checks whether evidence is current for the operating mode. Startup differs from steady production; temporary operation after a maintenance outage may differ from both. Procedures, alarms and emergency equipment must be evaluated for those modes explicitly. A reliability assertion based on one short interval must not silently be extended to years of service. Missing evidence should generate a specific work request instead of a generic recommendation to “improve safety.”

Laboratory investigation and sensitivity

Use [Lab 08: Ideal transient compartment buildup](../labs/lab-08.html). The printed equation is C(t) = (G/Q)[1 − exp(−Qt/V)]. Solve first-order accumulation from zero initial concentration. Start from each slider's default, record the displayed metric and vary the first parameter over five or more settings. The graph and CSV should agree with your hand calculations. Next, change one other parameter while keeping the first fixed; this distinguishes a mathematical sensitivity from a trend caused by simultaneous input changes.

Investigation target: Find time constant V/Q and estimate 63.2% buildup time. The major simplification is Perfect mixing and constant source and exhaust; no worker-location concentration prediction.. A good lab report predicts the sign of the derivative or change before observing the plot, then explains what physical process that derivative represents. If an output is nonphysical or a limiting denominator becomes zero, it should be reported as an invalid domain rather than manipulated into a finite reassuring result. Place the lesson's analytical relationship alongside the lab relation; explain whether they describe the same physical quantity or different levels of abstraction.

As a challenge, compare this model with [Lab 09: Two-period exposure average](../labs/lab-09.html). The second model's relation is C_avg = (C₁t₁+C₂t₂)/(t₁+t₂), and its stated limitation is No occupational exposure limit comparison or short-term toxicity conclusion; chemicals differ.. The comparison is not an invitation to combine numbers blindly. Explain what would need to be measured so the two simplified relationships could appear in one defensible engineering argument.

Failure-first decision review

The unacceptable shortcut is assuming well mixed equals safe, or comparing mass concentration directly with a ppm limit. Make a table with columns assumption, possible failure, observation that would expose it, cheapest credible check, owner, and decision consequence. For this particular topic the review should prioritize the evidence sources above rather than produce a broad list of every conceivable failure. Then ask what is the most important remaining uncertainty if all routine checks pass. Low-frequency high-consequence scenarios often cannot be validated simply by waiting for an incident.

The recommended analytical action is: Use model to learn sensitivity, then apply recognized industrial hygiene methods. This recommendation is a learning exercise, not a control-system change or site-specific directive. Describe its boundaries. What would have to be established by independent qualified review? How would an operator learn that the intended protective measure had become unavailable? Which record would demonstrate closure after a modification? A paper action with no verification is not the same as an effective protective function.

Interpreting uncertainty and competing explanations

Uncertainty enters from input data, model structure, operating variability and human or organizational factors. Input uncertainty might be reduced by a calibrated measurement, whereas model-structure uncertainty demands a different physical model or field trial. Increasing the number of decimal places addresses neither. Separate uncertainty that could reverse the conclusion from uncertainty that changes only the reported numerical precision. The severity of a credible major-accident scenario should influence how urgently an evidence gap is reviewed, even when its probability is difficult to quantify.

For compartment ventilation and concentration, an apparently successful barrier test may demonstrate only the modes exercised by the test. It might not probe lost utilities, common-cause failure, maintenance bypass or the specific initiating condition. A useful counterfactual question is: If the expected result were wrong tomorrow, which observation would reveal it first? Identify an observable precursor and a clear escalation action. This turns an educational calculation into a disciplined evidence requirement without representing it as a plant certification.

Independent exercises

1. Boundary and mechanism: Explain why doubling airflow halves the ideal steady state but may not halve a worker's local plume. Label at least one fact, one assumption and one unknown.

2. Quantitative check: Reproduce one result from Lab 08. Show units, the governing relationship and a simple limiting-case or conservation check.

3. Scenario variation: Replace one favorable assumption with an unfavorable but plausible operating condition. Explain which safeguarding claim is weakened and why.

4. Decision note: Summarize in 200–300 words whether use model to learn sensitivity, then apply recognized industrial hygiene methods. Specify the additional observation that could change your conclusion.

5. Critical review: Explain why assuming well mixed equals safe, or comparing mass concentration directly with a ppm limit would be misleading when a high-consequence scenario is involved.

Lesson outcome checklist

• A credible scenario chain is drawn, without conflating initiating cause, top event and outcome.
• Model assumptions and units are explicit and the numerical output is checked independently.
• Any barrier credit is tied to function, independence, availability, evidence and an owner.
• The decision specifies what remains unverified; it does not present an educational model as a safe operating limit.

Unit 3 · Lesson 3: Transient buildup and removal

[Unit overview](../units/unit-03.html) · [Interactive lab 09](../labs/lab-09.html) · [Assessment](../assessments/unit-03.html) · [Applied project](../projects/unit-03.html)

The engineering question

A first-order enclosure model illustrates approach to steady concentration and how air-change time scale differs from exposure during a short source event. Transients matter during startup and maintenance. This lesson belongs to Release, Exposure and Consequence Boundaries, where the course objective is to trace inventory, containment and ventilation paths using explicit control-volume assumptions; avoid claiming that mixing calculations are site-specific dispersion analyses. The governing issue is not whether one can calculate a number; it is whether that number describes the failure mechanism under study. A competent analysis separates a claim about what happens, an argument about why it would happen, and evidence that the safeguards could withstand real operation.

Specific thought experiment. With V=150 m³ and Q=3 m³/s, the nominal ideal mixing time constant is 50 s. Work from the equipment boundary outward. Name the initiating event, the operating mode, the top event, the potentially exposed people or environment, and the time over which the consequences could develop. If any one of these is unspecified, maintain the uncertainty rather than inventing a value.

Principles and analytical relationship

The working relation or structured method is C(t) = G/Q × [1 − exp(−Qt/V)] for C(0)=0. It is useful because it forces an analyst to state inputs and ask whether the units, time basis and conditioning assumptions match. A rate per year cannot be multiplied by an arbitrary probability without asking what event that probability conditions upon. Similarly, an ordinary fraction is not a mass fraction until the relevant mass balance has been declared. In a causal diagram, an arrow represents a proposed physical or organizational dependency; it is not, by itself, proof of causality.

The physical interpretation for transient buildup and removal is the following: A first-order enclosure model illustrates approach to steady concentration and how air-change time scale differs from exposure during a short source event. Transients matter during startup and maintenance. Thus the result needs an audit trail back to observations, design documents or a controlled estimate. There is no universal conversion from a neat calculation to safe operation. Where the relationship is qualitative, a complete answer explains the conditions for each step and which alternative cause could produce the same observed symptom. When the relation is quantitative, a complete answer supplies units, ranges and a check against a limiting case.

For the course case, a process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Consider three boundaries before deciding whether the model is applicable: the system under study, the observation period, and the intervention boundary. System boundaries determine which inventories and energy flows are included. Observation periods distinguish transient loss of control from a steady process average. Intervention boundaries identify where automatic protection, human response or passive containment can plausibly act. A safeguard that acts after the harm does not prevent the initiating event, although it may limit the consequence.

Worked reasoning example

Unverified numerical or qualitative illustration: With V=150 m³ and Q=3 m³/s, the nominal ideal mixing time constant is 50 s. Begin with the stated conditions only. Write the relationships that must hold, then identify at least one variable not specified in the example. If an exact arithmetic result is given, reproduce it independently and add a clear qualifier about the simplified model. If the example is qualitative, draw a two-branch argument: one where the existing barrier is available and one where it is defeated by a plausible condition. Do not fill missing branches with assumed success simply to obtain a final score.

A useful way to test the claim is to ask what change would produce the opposite conclusion. For this topic, the specific analytical trap is forgetting source cessation, imperfect mixing or ventilation failure. Try to construct a counterexample with the same nominal process equipment but an altered startup, maintenance, utility, human or instrument condition. A single plausible counterexample indicates that the original claim was conditional. It does not automatically establish that the process is unsafe; it establishes which fact must be investigated before any stronger judgment.

Evidence and traceability

The minimum relevant evidence set is building volume, exhaust measurements, fan reliability and measured transient response. For each item record source, revision, date, scope, owner and confidence. Separate field-measured values from vendor guarantees, industry generic estimates and deliberately fictional learning inputs. For example, two pumps sold at the same nominal capacity do not necessarily share seal arrangements, failure modes or instrument interfaces. Even an authoritative standard does not substitute for actual testing or determine whether a particular facility falls within its legal scope.

An effective review checks whether evidence is current for the operating mode. Startup differs from steady production; temporary operation after a maintenance outage may differ from both. Procedures, alarms and emergency equipment must be evaluated for those modes explicitly. A reliability assertion based on one short interval must not silently be extended to years of service. Missing evidence should generate a specific work request instead of a generic recommendation to “improve safety.”

Laboratory investigation and sensitivity

Use [Lab 09: Two-period exposure average](../labs/lab-09.html). The printed equation is C_avg = (C₁t₁+C₂t₂)/(t₁+t₂). Contrast averaging with peak values for a schematic two-period history. Start from each slider's default, record the displayed metric and vary the first parameter over five or more settings. The graph and CSV should agree with your hand calculations. Next, change one other parameter while keeping the first fixed; this distinguishes a mathematical sensitivity from a trend caused by simultaneous input changes.

Investigation target: Find two exposure histories with equal averages but different peaks. The major simplification is No occupational exposure limit comparison or short-term toxicity conclusion; chemicals differ.. A good lab report predicts the sign of the derivative or change before observing the plot, then explains what physical process that derivative represents. If an output is nonphysical or a limiting denominator becomes zero, it should be reported as an invalid domain rather than manipulated into a finite reassuring result. Place the lesson's analytical relationship alongside the lab relation; explain whether they describe the same physical quantity or different levels of abstraction.

As a challenge, compare this model with [Lab 07: Ventilated compartment steady concentration](../labs/lab-07.html). The second model's relation is C_ss = G/Q, and its stated limitation is Well-mixed, no chemistry, no local plume; not occupational exposure or toxic consequence assessment.. The comparison is not an invitation to combine numbers blindly. Explain what would need to be measured so the two simplified relationships could appear in one defensible engineering argument.

Failure-first decision review

The unacceptable shortcut is forgetting source cessation, imperfect mixing or ventilation failure. Make a table with columns assumption, possible failure, observation that would expose it, cheapest credible check, owner, and decision consequence. For this particular topic the review should prioritize the evidence sources above rather than produce a broad list of every conceivable failure. Then ask what is the most important remaining uncertainty if all routine checks pass. Low-frequency high-consequence scenarios often cannot be validated simply by waiting for an incident.

The recommended analytical action is: Test the time scale and acknowledge unmodeled short-circuit ventilation. This recommendation is a learning exercise, not a control-system change or site-specific directive. Describe its boundaries. What would have to be established by independent qualified review? How would an operator learn that the intended protective measure had become unavailable? Which record would demonstrate closure after a modification? A paper action with no verification is not the same as an effective protective function.

Interpreting uncertainty and competing explanations

Uncertainty enters from input data, model structure, operating variability and human or organizational factors. Input uncertainty might be reduced by a calibrated measurement, whereas model-structure uncertainty demands a different physical model or field trial. Increasing the number of decimal places addresses neither. Separate uncertainty that could reverse the conclusion from uncertainty that changes only the reported numerical precision. The severity of a credible major-accident scenario should influence how urgently an evidence gap is reviewed, even when its probability is difficult to quantify.

For transient buildup and removal, an apparently successful barrier test may demonstrate only the modes exercised by the test. It might not probe lost utilities, common-cause failure, maintenance bypass or the specific initiating condition. A useful counterfactual question is: If the expected result were wrong tomorrow, which observation would reveal it first? Identify an observable precursor and a clear escalation action. This turns an educational calculation into a disciplined evidence requirement without representing it as a plant certification.

Independent exercises

1. Boundary and mechanism: Sketch a source-on/source-off thought experiment and locate the highest modeled concentration. Label at least one fact, one assumption and one unknown.

2. Quantitative check: Reproduce one result from Lab 09. Show units, the governing relationship and a simple limiting-case or conservation check.

3. Scenario variation: Replace one favorable assumption with an unfavorable but plausible operating condition. Explain which safeguarding claim is weakened and why.

4. Decision note: Summarize in 200–300 words whether test the time scale and acknowledge unmodeled short-circuit ventilation. Specify the additional observation that could change your conclusion.

5. Critical review: Explain why forgetting source cessation, imperfect mixing or ventilation failure would be misleading when a high-consequence scenario is involved.

Lesson outcome checklist

• A credible scenario chain is drawn, without conflating initiating cause, top event and outcome.
• Model assumptions and units are explicit and the numerical output is checked independently.
• Any barrier credit is tied to function, independence, availability, evidence and an owner.
• The decision specifies what remains unverified; it does not present an educational model as a safe operating limit.

Unit 3 · Lesson 4: Exposure metrics and the interpretation trap

[Unit overview](../units/unit-03.html) · [Interactive lab 07](../labs/lab-07.html) · [Assessment](../assessments/unit-03.html) · [Applied project](../projects/unit-03.html)

The engineering question

Time-weighted averages, ceilings and short-term limits control different exposure dimensions; a low average can hide a brief high peak. Regulatory limits are jurisdiction- and substance-specific. This lesson belongs to Release, Exposure and Consequence Boundaries, where the course objective is to trace inventory, containment and ventilation paths using explicit control-volume assumptions; avoid claiming that mixing calculations are site-specific dispersion analyses. The governing issue is not whether one can calculate a number; it is whether that number describes the failure mechanism under study. A competent analysis separates a claim about what happens, an argument about why it would happen, and evidence that the safeguards could withstand real operation.

Specific thought experiment. Exposure to 2 mg/m³ for one hour and 0.5 mg/m³ for seven hours yields a modeled 0.6875 mg/m³ eight-hour average. Work from the equipment boundary outward. Name the initiating event, the operating mode, the top event, the potentially exposed people or environment, and the time over which the consequences could develop. If any one of these is unspecified, maintain the uncertainty rather than inventing a value.

Principles and analytical relationship

The working relation or structured method is C_TWA = Σ(C_i Δt_i)/ΣΔt_i. It is useful because it forces an analyst to state inputs and ask whether the units, time basis and conditioning assumptions match. A rate per year cannot be multiplied by an arbitrary probability without asking what event that probability conditions upon. Similarly, an ordinary fraction is not a mass fraction until the relevant mass balance has been declared. In a causal diagram, an arrow represents a proposed physical or organizational dependency; it is not, by itself, proof of causality.

The physical interpretation for exposure metrics and the interpretation trap is the following: Time-weighted averages, ceilings and short-term limits control different exposure dimensions; a low average can hide a brief high peak. Regulatory limits are jurisdiction- and substance-specific. Thus the result needs an audit trail back to observations, design documents or a controlled estimate. There is no universal conversion from a neat calculation to safe operation. Where the relationship is qualitative, a complete answer explains the conditions for each step and which alternative cause could produce the same observed symptom. When the relation is quantitative, a complete answer supplies units, ranges and a check against a limiting case.

For the course case, a process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Consider three boundaries before deciding whether the model is applicable: the system under study, the observation period, and the intervention boundary. System boundaries determine which inventories and energy flows are included. Observation periods distinguish transient loss of control from a steady process average. Intervention boundaries identify where automatic protection, human response or passive containment can plausibly act. A safeguard that acts after the harm does not prevent the initiating event, although it may limit the consequence.

Worked reasoning example

Unverified numerical or qualitative illustration: Exposure to 2 mg/m³ for one hour and 0.5 mg/m³ for seven hours yields a modeled 0.6875 mg/m³ eight-hour average. Begin with the stated conditions only. Write the relationships that must hold, then identify at least one variable not specified in the example. If an exact arithmetic result is given, reproduce it independently and add a clear qualifier about the simplified model. If the example is qualitative, draw a two-branch argument: one where the existing barrier is available and one where it is defeated by a plausible condition. Do not fill missing branches with assumed success simply to obtain a final score.

A useful way to test the claim is to ask what change would produce the opposite conclusion. For this topic, the specific analytical trap is calling an average compliant without checking applicable short-term limits or uncertainty. Try to construct a counterexample with the same nominal process equipment but an altered startup, maintenance, utility, human or instrument condition. A single plausible counterexample indicates that the original claim was conditional. It does not automatically establish that the process is unsafe; it establishes which fact must be investigated before any stronger judgment.

Evidence and traceability

The minimum relevant evidence set is sampling method validation, location, exposure duration and the correct legally applicable limit. For each item record source, revision, date, scope, owner and confidence. Separate field-measured values from vendor guarantees, industry generic estimates and deliberately fictional learning inputs. For example, two pumps sold at the same nominal capacity do not necessarily share seal arrangements, failure modes or instrument interfaces. Even an authoritative standard does not substitute for actual testing or determine whether a particular facility falls within its legal scope.

An effective review checks whether evidence is current for the operating mode. Startup differs from steady production; temporary operation after a maintenance outage may differ from both. Procedures, alarms and emergency equipment must be evaluated for those modes explicitly. A reliability assertion based on one short interval must not silently be extended to years of service. Missing evidence should generate a specific work request instead of a generic recommendation to “improve safety.”

Laboratory investigation and sensitivity

Use [Lab 07: Ventilated compartment steady concentration](../labs/lab-07.html). The printed equation is C_ss = G/Q. Illustrate an ideal mass balance for a well-mixed compartment with continuous source. Start from each slider's default, record the displayed metric and vary the first parameter over five or more settings. The graph and CSV should agree with your hand calculations. Next, change one other parameter while keeping the first fixed; this distinguishes a mathematical sensitivity from a trend caused by simultaneous input changes.

Investigation target: Show inverse proportionality with airflow; why can local concentrations differ? The major simplification is Well-mixed, no chemistry, no local plume; not occupational exposure or toxic consequence assessment.. A good lab report predicts the sign of the derivative or change before observing the plot, then explains what physical process that derivative represents. If an output is nonphysical or a limiting denominator becomes zero, it should be reported as an invalid domain rather than manipulated into a finite reassuring result. Place the lesson's analytical relationship alongside the lab relation; explain whether they describe the same physical quantity or different levels of abstraction.

As a challenge, compare this model with [Lab 08: Ideal transient compartment buildup](../labs/lab-08.html). The second model's relation is C(t) = (G/Q)[1 − exp(−Qt/V)], and its stated limitation is Perfect mixing and constant source and exhaust; no worker-location concentration prediction.. The comparison is not an invitation to combine numbers blindly. Explain what would need to be measured so the two simplified relationships could appear in one defensible engineering argument.

Failure-first decision review

The unacceptable shortcut is calling an average compliant without checking applicable short-term limits or uncertainty. Make a table with columns assumption, possible failure, observation that would expose it, cheapest credible check, owner, and decision consequence. For this particular topic the review should prioritize the evidence sources above rather than produce a broad list of every conceivable failure. Then ask what is the most important remaining uncertainty if all routine checks pass. Low-frequency high-consequence scenarios often cannot be validated simply by waiting for an incident.

The recommended analytical action is: Report peak and cumulative statistics separately with units. This recommendation is a learning exercise, not a control-system change or site-specific directive. Describe its boundaries. What would have to be established by independent qualified review? How would an operator learn that the intended protective measure had become unavailable? Which record would demonstrate closure after a modification? A paper action with no verification is not the same as an effective protective function.

Interpreting uncertainty and competing explanations

Uncertainty enters from input data, model structure, operating variability and human or organizational factors. Input uncertainty might be reduced by a calibrated measurement, whereas model-structure uncertainty demands a different physical model or field trial. Increasing the number of decimal places addresses neither. Separate uncertainty that could reverse the conclusion from uncertainty that changes only the reported numerical precision. The severity of a credible major-accident scenario should influence how urgently an evidence gap is reviewed, even when its probability is difficult to quantify.

For exposure metrics and the interpretation trap, an apparently successful barrier test may demonstrate only the modes exercised by the test. It might not probe lost utilities, common-cause failure, maintenance bypass or the specific initiating condition. A useful counterfactual question is: If the expected result were wrong tomorrow, which observation would reveal it first? Identify an observable precursor and a clear escalation action. This turns an educational calculation into a disciplined evidence requirement without representing it as a plant certification.

Independent exercises

1. Boundary and mechanism: Create two exposure histories with equal TWA but different peaks; explain why they are not equivalent. Label at least one fact, one assumption and one unknown.

2. Quantitative check: Reproduce one result from Lab 07. Show units, the governing relationship and a simple limiting-case or conservation check.

3. Scenario variation: Replace one favorable assumption with an unfavorable but plausible operating condition. Explain which safeguarding claim is weakened and why.

4. Decision note: Summarize in 200–300 words whether report peak and cumulative statistics separately with units. Specify the additional observation that could change your conclusion.

5. Critical review: Explain why calling an average compliant without checking applicable short-term limits or uncertainty would be misleading when a high-consequence scenario is involved.

Lesson outcome checklist

• A credible scenario chain is drawn, without conflating initiating cause, top event and outcome.
• Model assumptions and units are explicit and the numerical output is checked independently.
• Any barrier credit is tied to function, independence, availability, evidence and an owner.
• The decision specifies what remains unverified; it does not present an educational model as a safe operating limit.

Applied Project 03 — Release, Exposure and Consequence Boundaries

Scenario and objective

Scenario: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models.

Target: Trace inventory, containment and ventilation paths using explicit control-volume assumptions; avoid claiming that mixing calculations are site-specific dispersion analyses.

The task is a supervised conceptual study. It is not permission to change operating procedures, introduce hazardous chemicals, bypass protection or size relief devices. Assume that a multidisciplinary panel must decide whether to commission additional analysis, not whether this student workbook certifies a plant. Your deliverable must identify the claim being made, what evidence supports it, and what uncertainty remains. The board values clear red flags over cosmetic completion percentages.

Work package A: describe the situation

Draw a block-flow boundary showing process inventory, incoming feeds or energy, manipulated variables, utilities, protective controls and relevant maintenance interfaces. Record the operating mode, unit conventions, material identity gaps and any location- or jurisdiction-dependent regulatory questions. Write one plausible hazardous event without guessing its annual frequency. For each asserted safeguard, identify what action it takes, when it acts relative to the top event, and which elements it shares with other protective controls.

The case provides a starting point only: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models.. Ask how equipment failure and incorrect operating information could combine. Check a routine operation, startup, shutdown and an interrupted utility condition. Treat any missing process safety information as a question with an owner; do not silently assume that a procedure exists or a transmitter is independent. Make a compact register of at least eight assumptions grouped into physical properties, instrumentation, human response and external conditions.

Work package B: model and verify

Lab 07 — [Ventilated compartment steady concentration](../labs/lab-07.html). Compute the baseline from C_ss = G/Q and export a one-parameter sweep. Show inverse proportionality with airflow; why can local concentrations differ? The condition Well-mixed, no chemistry, no local plume; not occupational exposure or toxic consequence assessment. must appear as a red-line limitation in the report. Record at least one changed parameter set and reproduce one plotted point without JavaScript. Explain whether a favorable change in this model would genuinely improve the identified hazard or merely change one simplified quantity.

Lab 08 — [Ideal transient compartment buildup](../labs/lab-08.html). Compute the baseline from C(t) = (G/Q)[1 − exp(−Qt/V)] and export a one-parameter sweep. Find time constant V/Q and estimate 63.2% buildup time. The condition Perfect mixing and constant source and exhaust; no worker-location concentration prediction. must appear as a red-line limitation in the report. Record at least one changed parameter set and reproduce one plotted point without JavaScript. Explain whether a favorable change in this model would genuinely improve the identified hazard or merely change one simplified quantity.

Lab 09 — [Two-period exposure average](../labs/lab-09.html). Compute the baseline from C_avg = (C₁t₁+C₂t₂)/(t₁+t₂) and export a one-parameter sweep. Find two exposure histories with equal averages but different peaks. The condition No occupational exposure limit comparison or short-term toxicity conclusion; chemicals differ. must appear as a red-line limitation in the report. Record at least one changed parameter set and reproduce one plotted point without JavaScript. Explain whether a favorable change in this model would genuinely improve the identified hazard or merely change one simplified quantity.

Work package C: argue the controls

Prepare a bow-tie-style diagram with three credible threats and two possible consequence pathways. Describe at least one prevention design measure, one operating or inspection control, one possible protective-system layer and one mitigation measure. Do not treat all of these as independent or calculate a cumulative protection factor without justified evidence. Identify a shared-cause vulnerability (for example, common power supply, blocked sensing line or maintenance isolation) and show how your recommended verification would detect it.

Create a control register with columns control purpose, covered initiating mechanism, physical element, mode of demand, availability evidence, testing method, owner, and unresolved dependency. A valid control should have a documented performance claim that can be tested in the field. If field testing would introduce danger, propose a qualified nonintrusive verification method or documentation review instead of suggesting an uncontrolled trial.

Work package D: decision, uncertainty and follow-up

Deliver a 600–900-word decision memo with a recommendation of further analysis, redesign for inherent safety, or insufficient evidence to proceed. The answer must not state that a student's simulation proves safety or regulatory compliance. Begin with the most serious potentially unmitigated scenario. Include a one-page assumptions register and a prioritized list of the five most valuable additional data items. Differentiate uncertainty in inputs from uncertainty in the basic model structure. Show how one new piece of evidence could reverse your recommendation.

The expected project artifact is: Consequence assessment requires actual substances, phases, terrain, weather, source term, ventilation patterns and receptor locations. Describe at least three acceptance tests, responsible roles and the evidence each would produce. Finish with a handover list for a qualified engineer or hazard-analysis team. A statement like “we will improve training” is insufficient without specifying which error pathway it is intended to reduce and how the effect would be checked.

Assessment criteria

• Process and time boundaries are explicit and aligned with the chosen hazardous event.
• Equations reproduce the baseline, limits are visible, and CSV data agree with an independent computation.
• Claimed safeguards have separate mechanisms and credible evidence; common-cause weaknesses are challenged.
• Unknown chemical properties, actual frequencies and code requirements are not invented.
• The conclusion is proportional to evidence and contains accountable next actions rather than a blanket approval.

Unit 03 — Assessment: Release, Exposure and Consequence Boundaries

Scenario: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. This assessment contains 16 separately numbered, multi-part tasks, four per lesson. Students should complete the numerical parts independently and explicitly distinguish illustrative assumptions from measured or regulated inputs. There is no site-specific pass/fail safety conclusion.

Learning standard: Consequence assessment requires actual substances, phases, terrain, weather, source term, ventilation patterns and receptor locations.

Scoring rubric

Each task is worth ten marks: physical or causal boundary (2), correct relationship or defensible logic (2), evidence and units (2), explicit limitation (2), and transparent action or interpretation (2). A risk claim without necessary provenance receives no numerical credit regardless of apparent precision. Students may challenge an ill-posed input as part of the solution if they explain which information is missing.

Lesson 1 — Material inventory and loss of containment

The four problems below require different kinds of evidence; do not copy a single stock paragraph as four answers.

Q01 — Physical reconstruction (10 marks). Start from M_in_system = flow_rate × residence_time for a steady holdup proxy in the following case: A flow of 400 kg/h and six hours of nominal residence corresponds to 2400 kg of average inventory in this proxy. Identify each term or causal link, the relevant units or event definition, and a reasonable limiting case. Describe at least one operational state in which the relationship would no longer be adequate. For numerical examples, reproduce the printed result with no more significant figures than the inputs justify.

Q02 — Interactive computation and falsification (10 marks). Run [Lab 07](../labs/lab-07.html), Ventilated compartment steady concentration. Tabulate at least seven points for its first variable, calculate one independent output, then change its second variable. The lab asks: Show inverse proportionality with airflow; why can local concentrations differ? Evaluate the specific restriction Well-mixed, no chemistry, no local plume; not occupational exposure or toxic consequence assessment.; provide a case where this restriction matters and state what additional physical model would be needed.

Q03 — Hazard and barrier chain (10 marks). Examine material inventory and loss of containment using this hazard background: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Name an initiating mechanism, the loss-of-control top event, one possible consequence, an inherently safer alternative and an independent barrier if credible. The analysis must explicitly challenge the misleading assumption equating total holdup to instantaneous releasable mass. Which shared utility, maintenance activity or human action could defeat the claimed protections?

Q04 — Evidence-led technical memo (10 marks). Prepare a 250-word memo answering: Contrast reducing inventory by half with reducing line length while keeping throughput constant. The recommendation should be treat inventory reduction as a design principle while verifying operability but you must justify or challenge it. List the real-world records needed: Actual geometry, density, levels, isolation valves, secondary containment and flow paths. Separate a hypothetical mathematical statement from an engineering action and identify the competent approver and a falsifiable follow-up test.

Lesson 2 — Compartment ventilation and concentration

The four problems below require different kinds of evidence; do not copy a single stock paragraph as four answers.

Q05 — Physical reconstruction (10 marks). Start from V dC/dt = G − Q C in the following case: For G=0.06 g/s and Q=3 m³/s, ideal steady concentration is 0.02 g/m³, absent other removal. Identify each term or causal link, the relevant units or event definition, and a reasonable limiting case. Describe at least one operational state in which the relationship would no longer be adequate. For numerical examples, reproduce the printed result with no more significant figures than the inputs justify.

Q06 — Interactive computation and falsification (10 marks). Run [Lab 08](../labs/lab-08.html), Ideal transient compartment buildup. Tabulate at least seven points for its first variable, calculate one independent output, then change its second variable. The lab asks: Find time constant V/Q and estimate 63.2% buildup time. Evaluate the specific restriction Perfect mixing and constant source and exhaust; no worker-location concentration prediction.; provide a case where this restriction matters and state what additional physical model would be needed.

Q07 — Hazard and barrier chain (10 marks). Examine compartment ventilation and concentration using this hazard background: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Name an initiating mechanism, the loss-of-control top event, one possible consequence, an inherently safer alternative and an independent barrier if credible. The analysis must explicitly challenge the misleading assumption assuming well mixed equals safe, or comparing mass concentration directly with a ppm limit. Which shared utility, maintenance activity or human action could defeat the claimed protections?

Q08 — Evidence-led technical memo (10 marks). Prepare a 250-word memo answering: Explain why doubling airflow halves the ideal steady state but may not halve a worker's local plume. The recommendation should be use model to learn sensitivity, then apply recognized industrial hygiene methods but you must justify or challenge it. List the real-world records needed: Ventilation commissioning, local air sampling, release characterization, occupancy and chemical-specific limits. Separate a hypothetical mathematical statement from an engineering action and identify the competent approver and a falsifiable follow-up test.

Lesson 3 — Transient buildup and removal

The four problems below require different kinds of evidence; do not copy a single stock paragraph as four answers.

Q09 — Physical reconstruction (10 marks). Start from C(t) = G/Q × [1 − exp(−Qt/V)] for C(0)=0 in the following case: With V=150 m³ and Q=3 m³/s, the nominal ideal mixing time constant is 50 s. Identify each term or causal link, the relevant units or event definition, and a reasonable limiting case. Describe at least one operational state in which the relationship would no longer be adequate. For numerical examples, reproduce the printed result with no more significant figures than the inputs justify.

Q10 — Interactive computation and falsification (10 marks). Run [Lab 09](../labs/lab-09.html), Two-period exposure average. Tabulate at least seven points for its first variable, calculate one independent output, then change its second variable. The lab asks: Find two exposure histories with equal averages but different peaks. Evaluate the specific restriction No occupational exposure limit comparison or short-term toxicity conclusion; chemicals differ.; provide a case where this restriction matters and state what additional physical model would be needed.

Q11 — Hazard and barrier chain (10 marks). Examine transient buildup and removal using this hazard background: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Name an initiating mechanism, the loss-of-control top event, one possible consequence, an inherently safer alternative and an independent barrier if credible. The analysis must explicitly challenge the misleading assumption forgetting source cessation, imperfect mixing or ventilation failure. Which shared utility, maintenance activity or human action could defeat the claimed protections?

Q12 — Evidence-led technical memo (10 marks). Prepare a 250-word memo answering: Sketch a source-on/source-off thought experiment and locate the highest modeled concentration. The recommendation should be test the time scale and acknowledge unmodeled short-circuit ventilation but you must justify or challenge it. List the real-world records needed: Building volume, exhaust measurements, fan reliability and measured transient response. Separate a hypothetical mathematical statement from an engineering action and identify the competent approver and a falsifiable follow-up test.

Lesson 4 — Exposure metrics and the interpretation trap

The four problems below require different kinds of evidence; do not copy a single stock paragraph as four answers.

Q13 — Physical reconstruction (10 marks). Start from C_TWA = Σ(C_i Δt_i)/ΣΔt_i in the following case: Exposure to 2 mg/m³ for one hour and 0.5 mg/m³ for seven hours yields a modeled 0.6875 mg/m³ eight-hour average. Identify each term or causal link, the relevant units or event definition, and a reasonable limiting case. Describe at least one operational state in which the relationship would no longer be adequate. For numerical examples, reproduce the printed result with no more significant figures than the inputs justify.

Q14 — Interactive computation and falsification (10 marks). Run [Lab 07](../labs/lab-07.html), Ventilated compartment steady concentration. Tabulate at least seven points for its first variable, calculate one independent output, then change its second variable. The lab asks: Show inverse proportionality with airflow; why can local concentrations differ? Evaluate the specific restriction Well-mixed, no chemistry, no local plume; not occupational exposure or toxic consequence assessment.; provide a case where this restriction matters and state what additional physical model would be needed.

Q15 — Hazard and barrier chain (10 marks). Examine exposure metrics and the interpretation trap using this hazard background: A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models. Name an initiating mechanism, the loss-of-control top event, one possible consequence, an inherently safer alternative and an independent barrier if credible. The analysis must explicitly challenge the misleading assumption calling an average compliant without checking applicable short-term limits or uncertainty. Which shared utility, maintenance activity or human action could defeat the claimed protections?

Q16 — Evidence-led technical memo (10 marks). Prepare a 250-word memo answering: Create two exposure histories with equal TWA but different peaks; explain why they are not equivalent. The recommendation should be report peak and cumulative statistics separately with units but you must justify or challenge it. List the real-world records needed: Sampling method validation, location, exposure duration and the correct legally applicable limit. Separate a hypothetical mathematical statement from an engineering action and identify the competent approver and a falsifiable follow-up test.

Synthesis: no-go evidence check

Construct an evidence table for release, exposure and consequence boundaries. Include the case A process enclosure contains transfer equipment; small routine leaks and large loss-of-containment events have fundamentally different models.. State one safety-critical condition that cannot be closed by the calculations above. Propose a technically reasonable way to obtain missing evidence, an owner and a hold point. Explain why a numerically appealing dashboard could still hide an unacceptable unresolved scenario.