MURPHY - fuzz the procedure, not the plant

Every plant runs the same ceremony: a hazard review in a meeting, a signature, a revision number, and then a tired person performs the procedure at three in the morning on equipment that has just had instrument work. Nobody ever tests the sequence. Software has had forty years of fuzzing; high-hazard operations have nothing. MURPHY compiles a controlled procedure into an executable model. Each step carries the cue an operator reads, a duration, the plant variables it moves, and a typed error surface: the specific ways a real crew goes wrong there, expressed as a state of the plant rather than as blame. Thousands of simulated crews - a new trainee at 3am, a relief operator on an eleventh hour, a crew reading a procedure not in their working language - run against a continuous-time physics twin: mass balance, pump dead-head, vapour-space overpressure and bund headroom. Human error probabilities come from three published reliability methods (SPAR-H, THERP, HEART) over one interface, so a ranking's method-dependence is measured rather than assumed. Every figure carries an order-of-magnitude band and a derivation sheet. A repair loop proposes controls as typed mutations and accepts only what a paired bootstrap, a cost test and a false-discovery correction can defend. On one 17-step transfer procedure, at the application's own default seed: 0.70% of shifts lost by a competent crew on a tank as designed, 42.88% for a night trainee two weeks after instrument work - EUR 5.8M a year - and 32.1% breach the tank roof on an uprated vessel, EUR 42.9M a year. The repair loop takes 42.88% to 2.05% stacked, a net EUR 5.76M a year, and rejects six of its own twelve ideas, reasons on screen. The other two methods read 83.7% and 97.6% with one top-three station in common, and the tool says so rather than quoting the flattering number. Against three published investigations it raises all 13 recorded causes from the text alone, 7 inside its own top ten against a 17% chance level.