Use Case · Documentation · Plant Engineering · 2026

Everything certified.
And still it doesn't add up.

A plant builder delivers a hydrogen transfer station to a research institution. Material certificates complete. ATEX certification for every component. Leak test on record. An explosion protection assessment signed by an accredited expert.

And the operating manual fails to pass on one of that assessment's conditions — the very one the zone-free classification rests on.

Starting point

A project folder like any other.

Hydrogen, fluid group 1, outdoor installation, explosive atmosphere. One-off build for a customer with its own safety apparatus. The documentation is above average — that is not a courtesy, it is precisely why this case matters.

Files in folder480grown, with legacy versions
Bought-in parts26each with its own limits
Directives in play3+PED, ATEX, possibly MR
Of those, addressed1Pressure Equipment Directive

A completeness check would have found almost nothing here. Every single document is present, signed and technically sound.

The finding

Two documents. Released the same day. Nobody put them side by side.

The explosion protection assessment declares the plant zone-free. But its summary ties that conclusion to two explicit conditions. The operating manual — the document the operator actually receives — passes on neither of them in that form.

Assessment · accredited expert
“… the following additional measure is required: … a regular helium leak test must be carried out. Replacing the compression fittings after they have been opened is mandatory.”
The zone-free classification rests on this condition.
Operating manual · to the operator
“Permissible methods are: suitable leak detectors / portable H₂ detectors … Helium leak test: may be applied as an extended method, where practicable.”
Replacing the fittings: not mentioned anywhere in the maintenance chapter.

The condition the zone-free classification rests on is therefore not secured in later operation. Not because anyone was careless — both documents are carefully made.

But because both were released on the same day and nobody had the job of reading one against the other. The assessment's appendix even still refers to the draft of the operating manual from three days earlier.

The error is not inside the documents.
It sits between them.
And further

One day of review. Six more open points.

Each backed by quotation and source. Each phrased as a question — for every one of them there may be an explanation that does not appear in the folder.

The assessment rests on a superseded design status.
It is based on revision C of the P&ID. Revision D sits in the documentation folder. Operating manual and manufacturer's declaration both reference the drawing with no revision at all — with seven versions in existence.
The declared explosive zone never reaches the operator.
The assessment calculates the venting events properly and requires a zone 2 of 8.6 metres around the vent outlet. The operating manual mentions only the zone-free status at the panel itself.
Two protective shutdown chains nobody is accountable for.
Two pressure-triggered chains guard against diaphragm rupture in the regulators. Wiring and programming, according to the manual, sit entirely with the operator. No PL or SIL verification exists anywhere.
A component carries an “X” — and nobody knows what it means.
Four pressure gauges are marked with the suffix X: special conditions for safe use. Where those conditions are stated, and whether they are met, is nowhere documented in the folder.
Three documents state three different design pressures.
Manufacturer's declaration, P&ID and assessment diverge. The drawing also states a test pressure below the permissible pressure — technically impossible.
The Machinery Regulation does not appear anywhere in the project.
Four power-operated valves with position feedback and fail-safe logic. Whether the assembly falls under the Machinery Regulation is a legitimate question of scope — but it was never answered on record.
Putting it in place

The fourth gap.

Currency, change, coverage — three gaps open up between design and document. This case shows a fourth, sitting in between: between two documents that are both current, both correct and both signed.

01
Currency gap
The documentation describes a machine you no longer build that way.
02
Change gap
At what point does an adaptation become a substantial modification?
03
Coverage gap
The standard declaration ships with a machine that deviates from the standard.
04 · New
Hand-over gap
An assessment sets a condition. The document that would have to implement it does not pass it on.
Why this belongs here

Copying is silent — and that is exactly where the hand-over fails.

This project's operating manual came out of a template. The template was good. It simply knew nothing of the two conditions the expert had written into his assessment three days earlier. And when you copy, nobody asks.

The agent does not copy. It derives the draft — and reads every source that belongs to it, the assessment among them. A condition stated there cannot get lost along that path: it lands in the chapter where it belongs, or the agent asks where it should go.

A checklist asks whether the document exists.
The question is whether it matches the next one.
The real lever

Reconciliation is not a second step. It happens while writing.

This page shows a diagnosis: seven points found after the fact. Checking after the fact beats not checking at all. But it is not the point.

Checking afterwards
The operating manual is written, released, signed. Only then does someone notice a condition is missing. Now somebody has to go back, correct it, re-release it — and explain why.
Finds the error. After it has been made.
While writing
The agent derives the draft from template and project documents. The assessment is one of its sources. The condition is in chapter 11 before anyone reads the document for the first time.
The error never occurs.

Anyone who sets out to write an operating manual has to read the assessment — otherwise they do not know what belongs in it. That is precisely why reconciliation happens anyway while drafting. It does not cost an extra pass. It is the pass.

The documentation check on an existing folder is therefore the diagnosis, not the service. It shows you, on a completed project, what happens when that pass is missing.

Checking finds the contradiction.
Writing keeps it from arising.
The role

The documentation department you never had.

A corporation has one. There, people exist whose only job is to write the draft, hold it against the assessments, and notice when a new revision supersedes everything that came before. A plant builder with ten design engineers does not have one. So the engineer does it on the side, on a Friday afternoon, out of the last project.

Draft

Derives the draft from your template and the project documents — operating manual, declarations, document index, a compilation of component limits. Asks about what it cannot derive from the files.

Reconcile

Reads every relevant source while writing. Every condition from an assessment lands in the chapter where it belongs. The contradiction never arises and does not have to be found.

Keep current

Notices when a new revision supersedes a piece of evidence. The assessment stood on rev. C, rev. D sat in the folder — unnoticed, because nobody was responsible. The agent flags it before anyone asks.

Why the third is the hardest

Documentation is not the end of a project. It is a state.

An assessment rests on a particular design status. A declaration points to a drawing number. An operating manual describes a machine that may no longer exist in that form today. Every change to the design puts a chain of documents under suspicion — and nobody has the task of following that chain. This is exactly where the currency gap opens, and exactly where the agent keeps working long after the project has closed.

The line

What the agent does. And what it never does.

In machinery safety this boundary is not a formality. It is the core.

The agent
  • Opens up the project folder without anyone having to prepare anything
  • Derives the draft documents from template and source files
  • Carries every condition from the assessments into the chapter where it belongs
  • Compiles the limits of bought-in parts and holds them against the nameplate
  • Flags when a piece of evidence stands on a superseded status
  • Backs every point with a source and marks what remains unsupported
  • Asks instead of guessing
Only the engineer
  • Decides whether a deviation is acceptable
  • Answers the machinery question
  • Determines the required performance level
  • Judges whether zero margin on a temperature limit is defensible
  • Owns the risk assessment
  • Signs

One finding had to be withdrawn in this case — it rested on file names rather than on the drawing as read. That is precisely why the agent exposes the source for every point. What is not supported is marked as not supported.

The agent drafts and keeps watch.
The engineer decides and signs.
Use case as PDF

Download the full use case.

All seven points with quotation and source, the four gaps at a glance, and the line between agent and engineer. You get the PDF right after submitting, plus a short email from me. The PDF is in German.

Next step

What would an auditing operator find in your folder?

We take one completed project of yours. You release the folder as it is, with no preparation — and we put the open points on the table. If we find nothing, it ends there, and you have certainty. The entry point is a diagnostic workshop for €1,200 net.

Arrange a 30-minute call →