Glossary

Acceptable

This indicates that a Central Hazardous Event Bowtie has only a few degraded (or failed) preventive / recovery safeguards, but not enough to contribute to a Central Hazardous Event. Hence, coverage against the development of major accidents has degraded but still falls within acceptable risk region. (i.e., 0-40% Risk Exposure).

Adequacy

SCB Adequacy is a measure of the coverage provided by an SCB against the development of an undesirable event. The more promptly an SCB can stop the development or progression of an undesirable event, the more adequate it is.

As-Found

A type of MP. These MPs allow the performance of the SECE to be recorded prior to any maintenance/inspection intervention providing a historic record of how the SECE would have performed if needed.

As-Left

A type of MP. These MPs allow the performance of the SECE to be recorded after maintenance/inspection intervention providing the current status of the SECE.

Asset

The item of property owned by a person or company.

Assurance Task

See ‘Measuring Import..

Backlog

A list of assurance tasks and/or SECAs that have exceeded their check / scheduled maintenance dates according to performance standards.

Barriers

(Safety Critical Barriers - SCBs) are hardware, processes, or human activities whose purpose is to prevent an accident or to limit/mitigate the escalation of such an accident. Also known as Safety Critical Barrier (SCB). As far as is possible, each barrier appearing in a Bowtie must have three qualities: being independent, effective, and auditable.

The quality of independence means, a barrier must be defined to contain all elements required to ensure its robustness to prevent loss of control over a hazard or mitigate the outcome thereof. Hence, if we try to define a barrier against the consequence of explosion of flammable HC, it will be incorrect to simply define a barrier as “Gas detection system”, as gas detection alone cannot provide robust protection, but depends on emergency isolation and depressurisation. An independent barrier in this context is “Gas detection and activation of emergency isolation and depressurisation”.

The quality of being effective means that barriers are to be assigned to a threat or consequence line on which they truly provide protection, for example, PSV is completely ineffective against the threat of corrosion.

The quality of being auditable requires that every barrier defined must be capable of having one or more indices that can be used as a basis to assess its reliability and availability. For example, PSV as a barrier, can be audited by checking compliance with defined inspection routines and the results of PSV tests.

Barrier Code

A unique representative numeric or sometimes alphanumeric code for a safety critical barrier.

Barrier Reliability

A measure of how well a barrier will perform, under demand, relative to its performance in its best state.

Bowtie

A bowtie is a graphical representation of an accident event in terms of its initial causes or threats, ultimate negative consequences, and safety barriers designed to prevent or control the associated hazards.

Consequence

Further escalations that can result from loss of control over a hazard with the capacity to cause harm or damage to person, environment, or asset. Examples include: Jet Fire, VCE, BLEVE, Oil Spill to Environment, etc.

Control Barrier

A barrier that limits / prevents the consequence from occurring, after a top event has happened.

Current Barrier Reliability

The level of protection the Barrier currently provides. It is the reliability after factoring all existing “failures / non-compliances”.

Details MP

(Performance Standards Measuring Points) are used to record qualitative or quantitative measurements and/ or statuses collected during maintenance and inspection operations.

EER Barrier

(Escape, Evacuation and Rescue) these are barriers designed to help people / personnel escape, evacuate, and be rescued to limit exposure to or avoid the consequences after a top event has occurred.

Effectiveness

In barrier-based methodology, is a quantification of the amount of protection offered by an SCB. It is the product of the SCB reliability and SCB adequacy. Two effectiveness calculations are usually undertaken for an SCB, one at ALARP Reliability, and the other, at Current SCB reliability.

Fair

The functionality of the barrier is not fully in line with the performance standards of its composing SECEs. Hence, the SCB provides protection only to a reasonable level, but not up to the optimum level.

FLOC

‘Functional Location’ is a specific part of an SECE, identified by a unique tag. It is where equipment can be installed, or a maintenance task can be performed.

FLOC Override

Manual override to a Functional Location to cater for limitations in process or current workflow. For example, when an SECE FLOC or system is inhibited or under DGS and is yet to be reflected as such in SAP, an override can be applied on the status of such FLOC (Status override)/ system (System Reliability override), to reflect the current status of such SECE FLOC or System.

Good

Means that the SCB can provide full safety/environmental critical function although without redundancies. The SCB is also in Full compliance with Group Rule or Specifications. Hence, there is no delay on inspection, test and preventive maintenance program for all SECEs in the SCB, no degradation, no bypass.

Hazard

Any operation / activity of an installation with the potential to cause harm.

Intolerable

This indicates that a Central Hazardous Event Bowtie has all of the preventive safeguards in a failed state, and some recovery safeguards also in a degraded (or failed) state. Hence, coverage against the development of major accidents has degraded from tolerable levels (i.e., 60-100% Risk Exposure).

MACTPF

‘Maintenance Activity Performance Standard Measuring Point ’ is a specific Measuring Point of scheduling tag used to give a general integrity status of the related SECE primary function resulting from maintenance and inspection operations.

Major Risk

Major risks refers to the risks associated with scenarios having potential damage severity Catastrophic and Disastrous to people, the environment or to assets. Major Risks are typically identified through a Quantitative Risk Assessment (QRA) or Technological Risk Assessment (TRA) methodology.

Major Scenario Exposure

The cumulative risk exposure or loss of protection from all the Bowties on the asset.

Max % Deterioration

(Maximum Deterioration) For any given Bowtie, this is the scenario with gives the highest risk exposure.

Measuring Point (MP)

Also known as ‘Assurance Task’ and are used to give the overall integrity status or record measurements of the related SECE FLOC / Tags resulting from maintenance and inspection operations.

Measuring Point Description

Gives the description of the assurance task(s) carried out on the FLOC during maintenance and inspection operations.

Mitigation Barrier

Designed with the intent to limit the severity of an undesirable outcome. e.g. Fire water / Foam spray, Deluge, etc.

MP Frequency

This is the frequency of check for a measuring point or assurance task as per the performance standards.

MP Last / Next Check Date

The date when a measuring point activity was previously carried out or will be carried out in the nearest future.

MP Status

Gives the status of the assurance task for an SECE FLOC. Can be ‘Online’ (operating optimally), ‘Offline’ (does not meet performance criteria) or ‘Not done’ (performance has not been ascertained).

Not Done SECE FLOCs

Status of assurance tasks in SAP is "Not Done". It reflects that assurance tasks to determine SECE FLOC status has not been carried out.

Online SECE FLOCs

Status of assurance tasks in SAP is "Pass" or "Minor Defect". It reflects that an SECE FLOC is operating optimally and meeting its performance standards.

Offline SECE FLOCs

Status of assurance tasks in SAP is "Fail" or "Major Defect". It reflects that an SECE FLOC is not operating optimally and is not meeting its performance standards. Hence, it cannot offer any protection against potential major accident events.

Optimum Protection

This indicates that a Central Hazardous Event Bowtie has all of the preventive and recovery safeguards in a good state, functioning and meeting their performance standards. Hence, coverage against the development of major accidents is at the highest level (i.e., 0% Risk Exposure).

Optimum Protection Reliability

The highest level of protection a barrier can achieve or the reliability of an SCB at its best state.

Performance Standard

Minimum requirements of an SECE. The Performance Standards define the functionalities to be fulfilled and checked during the maintenance and inspection operations to ensure SECE equipment functionality, reliability, availability, and survivability.

Poor

This Critical barrier is not operational and no compensating measures are installed, or they are not effective. Hence, the SCB provides protection only minimally or not at all.

Preventive Barrier

A barrier that prevents the realization of a top event.

Reliability Override

Manual override to a barrier to cater for limitations in process or current workflow.

Risk Exposure

A measure of the loss of protection offered by barriers on a scenario, because of failure in one or more barriers. Expressed as a percentage.

Risk Exposure Chart

A plot of Maximum Scenario Deterioration per Bowtie, over a period. Each plot point on the graph consists of Date data (horizontal axis) and the Maximum Scenario deterioration data for a Bowtie, on a specific date (vertical axis).

SCB

See ‘Barrier’.

Scenario

A potential accident path. It is depicted by a Threat-to-Consequence chain passing through the Top event. For example, if there are 3 threats and 3 consequences, there are a total of (3 x 3) 9 different accident paths.

Scenario deterioration

A measure of the loss of protection offered by barriers on a scenario, because of failure in one or more barriers. Expressed as a percentage.

SECA

‘Safety and Environmental Critical Activities’ Activities, the purpose of which is to prevent or limit the consequence of a Major Accident or the failure of which could cause or contribute substantially to a major accident. SECAs are a subset of SCB. Emergency preparedness drills are an example of a SECA.

SECA Reliability

The level of protection the SECA currently provides to the Barrier. It is determined by evaluating findings from audit of a SECA associated with an SCB. Each SECA is assigned a rating of: Very Good, Good, Fair, Poor, depending on the audit finding.

SECA Supporting Document

An installation document from which the Safety Critical Activity was obtained from. This is indicated for reference purposes.

SECE

‘Safety and Environmental Critical Element’ are parts of an installation, including computer programs, the purpose of which is to prevent or limit the consequences of a Major Accident Event (MAE), or the failure of which could cause or contribute substantially to a major accident. Individuals called SECE Guardians are put in charge of ensuring that each SECE continues to maintain its integrity, in line with specified performance criteria for the SECE usually contained with a document referred to as the SECE Performance Standards (PS) or the Operational Integrity Assurance and Verification Scheme (OIAVS).

SECE Reliability

The level of protection the SECE system currently provides to the Barrier.

Status Unknown

This indicates that the risk exposure from the Central Hazardous Event Bowtie is unknown due to insufficient data.

Sub-Systems

Subset of a ‘System’.

Systems

Groups of FLOCs that are determined through a methodical connection between SECE Functional locations (FLOCs), established through a process called relationship modelling.

Threat

Anything with the ability to trigger the loss of control over a hazard.

Tolerable

This indicates that a Central Hazardous Event Bowtie has majority or all of the preventive safeguards in a degraded (or failed) state, and only a few recovery safeguards also in a degraded state. Hence, coverage against the development of major accidents has degraded from acceptable levels (1.e., 40-60% Risk Exposure).

Top Event

A point in time when control is lost over a Hazard. The top event is not a disaster yet, but the dangerous characteristics of the hazard are now in the open. For example: oil leak from a pipeline (loss of containment). Not a major disaster, but if left unmitigated, it can result in more undesirable events (consequences).

Very Good

Means that the SCB can provide full safety/environmental critical function and some redundancy or is in Full compliance with Group Rule or Specifications. Hence, there is no delay on inspection, test and preventive maintenance program for all SECEs in the SCB, no degradation, no bypass.