More checkers should mean fewer errors. Game theory says otherwise.

I’ve been thinking a lot about a comment made by Alexandre D’Amours a few months ago. So I’ve done some modelling of design checking as a game between the designer and checkers.

Intuition would tell you that more checkers equals fewer errors that pass through into the built infrastructure. In the model, that intuition doesn’t hold.

The starting point is the classic inspection game (Tsebelis, 1989), where at equilibrium, each party’s behaviour is set by the other party’s incentives. A checker will only check thoroughly if there’s likely something to find. A designer’s self-checking will be influenced heavily by how likely an error is to be caught.

A few interesting results:

Harsher penalties for errors don’t reduce errors. The designer error rate stays the same, but checkers end up reducing their effort, so more errors slip through.
Adding checkers can increase errors that pass through if there isn’t clear accountability. Checkers can rationally lean on each other. The designer knows it, too. In my simple model, an internal checker, a proof engineer and a client engineer working in parallel let more errors reach the structure than a single proof engineer.
The strongest prevention of escaped errors is clear separate scope. When each checker is responsible for a different item and this is clear with direct accountability, the layers add instead of overlapping.

The Miami FIU pedestrian bridge collapse in 2018 is a clear example of both sides of the “fixed scope” lever. Per the NTSB, the probable cause of failure was design errors, but the independent peer review, working to a limited scope, budget and schedule, didn’t check the construction stages or node connections. And of course this is exactly where failure occurred.

Leading up to the collapse, cracking at the node was observed by the designer, contractor, construction inspectors and the owner’s rep. Closing the road was a big call. Everyone deferred to the designer’s position that it wasn’t a safety issue, and the road stayed open.

What the model suggests:

Protect checking fees. In the model, this is a direct lever. The more a checker gets squeezed on budget, the more errors escape.
Require minimum scope for critical elements and construction stages - actually spell it out.
Make each checker accountable for their own findings.
Log each error: who found it, who missed it.
Strengthen consequences that don’t depend on a checker, e.g. audits and post-construction reviews.

None of this says engineers are unethical. Ordinary pressures - fee, program - affect effort across many jobs at a system level.

If everyone thinks someone else is responsible for catching the errors, there’s a good chance nobody does.