Abstract
This paper describes the development of a management model to control barriers devised to prevent major hazard scenarios. Additionally,
an audit technique is explained that assesses the quality of such a management system. The final purpose of the audit technique is to quantify
those aspects of the management system that have a direct impact on the reliability and effectiveness of the barriers and, hence, the probability
of the scenarios involved.
First, an outline of the management model is given and its elements are explained. Then, the development of the audit technique is described.
Because the audit technique uses actual major hazard scenarios and barriers within these as its focus, the technique achieves a concreteness
and clarity that many other techniques often lack. However, this strength is also its limitation, since the full safety management system is not
covered with the technique. Finally, some preliminary experiences obtained from several test sites are compiled and discussed.
© 2005 Elsevier B.V. All rights reserved.
Keywords: Safety management; Audit technique; Risk analysis; Safety barriers
1. Introduction
The safety management audit described in this paper
has been developed within the context of the ARAMISproject
[1], which is fully explained elsewhere in this special
issue. Although primarily aimed at companies that fall under
the European Seveso-regime, the audit is not necessarily
restricted to such companies. While major hazard scenarios
are its prime input, the underlying management system
controlling these is considered sufficiently generic to cover
most issues of safety management.
The ARAMIS audit builds on experiences gained with the
I-Risk Management Audit (IRMA audit technique) [2,3] that
was developed within an prior European project I-RISK [4].
The main improvement appears to be a more concrete focus
on barriers rather than the base events of fault trees, like time
to repair or error rate. Nevertheless, the establishment of a
valid link between the quantitative world of fault and event
trees (technical model) and the qualitative world of barrier reliability and its management control (management model)
remains a challenge
The purpose of this paper is to describe the audit in
more detail. First, the model underlying the audit will be
outlined followed by a description of the barrier concept. Barriers
are conceived here in a somewhat different way, which
will be discussed below. Thereafter, the development of the
audit manual will be described and some initial experiences
obtained with the audit will be sketchily reported. The paper
closes with an evaluation of the audit technique and a glimpse
of future developments.
2. Underlying models
2.1. Management model
As indicated above, theARAMISaudit takes as its primary
input major hazard scenarios that have been developed1 for a particular Seveso plant (or installation) and the barrier solutions
devised to prevent these scenarios from materializing.
The evident purpose of the safety management of a (Seveso)
company is to ensure that the barriers are operating as specified
or required and the audit aims to assess whether this is
actually the case. For this purpose the audit concentrates on
systems the company has in place to choose barrier solutions
and select barriers, the life cycle of barriers and on systems
to learn from and improve the current approaches to barrier
selection and management.