Chapter 33 — Data governance: safety and resilience
Lesson map
Lesson 33 published. Map, example, EX097.
flowchart TD
N0["Learning outcomes"]
N1["33.1 Data and safety"]
N2["33.2 Resilient supply"]
N3["33.3 Degraded modes"]
N4["33.4 Learning from incidents"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX097"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["33.1 Data and safety"]
N2["33.2 Resilient supply"]
N3["33.3 Degraded modes"]
N4["33.4 Learning from incidents"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX097"]
[Learning outcomes]
|
v
[33.1 Data and safety]
|
v
[33.2 Resilient supply]
|
v
[33.3 Degraded modes]
|
v
[33.4 Learning from incidents]
|
v
[Worked example] --> [Exercise EX097]
Learning outcomes
You will (1) relate data governance to physical safety; (2) design resilient data supply for operations; (3) plan for degraded modes.
33.1 Data and safety
Some Tidewater data affect physical safety. Pressure and flow readings guide decisions on valve operations; chlorine readings protect public health. Kofi distinguishes these safety-relevant data from business data. Changes to their quality rules, sources or processing require review by the operations safety engineer as well as the data owner. He explains that a governance process designed for billing data, where errors can be corrected later, is not adequate for data whose errors could lead to unsafe actions. Kofi lists these data sets explicitly.
33.2 Resilient supply
Operators need sensor data during incidents, when networks and systems are stressed. Kofi reviews the resilience of the sensor data supply: redundant communication paths for critical sites, local displays at treatment works and a second historian server in a separate building. He finds that the leakage dashboard depends on a single warehouse server, which is acceptable for planning but not for incident response. He recommends that incident response never depend on the analytics platform for critical readings. Operators approve the recommendation in writing.
33.3 Degraded modes
Kofi writes procedures for degraded modes: what operators do when sensor data are missing, delayed or suspected wrong. Procedures include using manual readings from site staff, comparing with neighbouring sensors and marking decisions made on degraded data in the operations log. He tests the procedures in a tabletop exercise with operators, who point out that manual readings need standard forms and units to be usable, which he adds to the procedure. A second exercise with the revised forms goes smoothly, and operators keep copies in the control room.
33.4 Learning from incidents
After each operational incident, Kofi proposes a data review asking whether data contributed, whether data quality controls detected problems and whether degraded mode procedures worked. Findings feed back into controls and procedures. Prof. Varga relates this to safety engineering practice, where learning from incidents without blame is essential, and notes that data governance in safety contexts must borrow these practices rather than relying solely on compliance checks. The first such review, after a burst main, finds that a pressure sensor alarm was ignored because it had fired falsely many times before.
Worked example
Kofi separates safety-relevant data with extra review, assesses resilient sensor supply, writes and tests degraded-mode procedures and adds data reviews after incidents.
Synthetic case. The scenarios are synthetic.
Errors and limits
Treating safety data like business data underestimates harm.
Exercises
- EX097 — Extra reviewer. Who else reviews changes to safety-relevant data? Rubric: 3 = the operations safety engineer;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX098 — Dashboard dependency. Why must incident response not rely on the leakage dashboard? Rubric: 3 = it depends on a single warehouse server;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX099 — Tabletop finding. What did operators point out? Rubric: 3 = manual readings need standard forms and units;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 33 (chapter 33 of 50)
← Chapter 32 · Course chapter index · Chapter 34 →
Continue to the next authored lesson.