Barrier performance standards: function, availability and survivability

Start from the protective purpose

HSE’s offshore fire and emergency-response guidance, paragraph 71, calls for performance standards related to purpose and capable of measurement and audit. It is cited for that engineering principle, not as a statement that its offshore legal scope covers every ship. Begin with the consequence being prevented or mitigated and the function needed to achieve that aim.

Pump available is weaker than a statement that defines delivered flow, pressure, response time and duration at a specified receiving point. A sensor specification is weaker than an end-to-end detection-and-response requirement if a protective action depends on the complete chain. The relevant standard may allocate requirements to several elements, but their interfaces must still support the overall function.

Write a testable functional requirement

A functional requirement needs the operating condition, output quantity, units, tolerance and location of the measurement. If the requirement concerns flow at a consumer, a pump discharge measurement alone may not capture downstream bypass or distribution losses. If the requirement concerns detection, the relevant substance, range, environmental conditions and alarm or action boundary need definition.

The requirement should also identify what counts as failure. Does a short interruption matter? Is partial capacity sufficient? Is a delayed response equivalent to no response for this consequence? An acceptance phrase such as satisfactory operation leaves those questions unresolved. Numerical limits must come from the actual hazard analysis, applicable requirements and equipment basis, rather than being selected merely because they are easy to test.

Check capacity and duration together

For an invented inventory example, suppose a protective service needs a constant 12 L/min for 20 min. The ideal consumed volume is 240 L. A reservoir contains 300 L, but 40 L is unavailable to the service because of the defined unusable inventory. Usable inventory is 260 L, leaving a nominal volume margin of 20 L under these assumptions.

This arithmetic establishes neither the required pressure nor that the final 20 L is deliverable in the relevant ship attitude. Leakage, unusable suction geometry, temperature-dependent fluid behaviour and changing demand may reduce actual service. The example shows why gross tank volume, flow capability and endurance are separate evidence questions. A large reservoir cannot compensate for a flow path that does not deliver the required rate.

Separate availability from continuity of operation

The dated NOPSEMA well-integrity guidance separately discusses availability, reliability, survivability and dependencies. Here those headings help distinguish being ready at demand from continuing to perform for the required interval. Its Australian well-specific obligations are not adopted as maritime rules.

A stated availability of 0.998 over a defined time population corresponds to an unavailability fraction of 0.002. Applied to a hypothetical 8,760 h observation basis, that fraction represents 17.52 h. It does not mean every outage lasts that long, that outages are evenly distributed, or that a demand occurs independently of them. The relevant demand-availability measure can differ when the initiating event also damages the barrier or is more likely in an impaired state.

Specify the event the barrier must survive

Survivability concerns capability during or after the challenge relevant to the barrier’s job. A protective function intended to act after a fire starts needs a defined environmental exposure and time requirement for its necessary elements. A general equipment enclosure rating or ordinary operating-temperature range does not, by itself, demonstrate survival of the complete scenario.

Identify the vulnerable path, including sensors, cables, power, logic, actuators, distribution and the person if a human action is essential. Protection of one element may be ineffective if an unprotected support fails first. A survivability claim should name the exposure, duration, configuration and evidence method. Avoid treating a material label or a successful benign-condition test as proof of performance during a different hazard.

Match the verification method to the requirement

Inspection can establish presence, condition or alignment; measurement can establish a quantity under its test conditions; a functional test can demonstrate a response through the tested path. Analysis can address conditions that are impractical to reproduce, provided its model and inputs are justified. These evidence types answer different questions and can complement one another.

For the inventory example, a drawing may establish geometry, a level observation may estimate contents, and a controlled delivery test may demonstrate rate under specified conditions. None alone establishes all capacity, duration and survivability requirements. The performance record should make that chain visible, including measurement uncertainty and any extrapolation from tested conditions to the actual demand.

Do not infer perfect reliability from a short test series

Exact binomial confidence methods are documented by NIST. Consider an original statistical example: 20 independent, representative demands have the same unknown failure probability p, and no failures are observed. The probability of zero failures is (1 − p)²⁰. Setting this to 0.05 gives the one-sided 95% upper confidence bound p = 1 − 0.05^(1/20), approximately 0.1391.

The example illustrates the limited strength of a small all-success sample; it is not a recommended test programme or a claimed acceptable failure probability. The bound requires the stated Bernoulli sampling model. Repeating an unchanged bench demonstration, omitting difficult conditions or counting several observations from one common exposure as independent demands can invalidate that interpretation. Statistical confidence does not repair a nonrepresentative test.

Define how an impairment is recognized and resolved

A performance standard should let an observed shortfall be evaluated against an explicit requirement. If measured flow falls below the required value, reporting that the pump still rotates does not resolve the impairment. If evidence is missing rather than a physical failure observed, that distinction should also be recorded; uncertainty and demonstrated failure are different states that can both require attention.

The response to an impairment depends on the actual operating and authorization framework. The analytical record can identify affected scenarios, dependencies, compensating measures that need evaluation and the evidence required for restoration. It should not create a universal permission to continue operating merely because a temporary measure has been listed. Closure requires evidence against the relevant requirement.

Keep the standard connected to change

A changed consumer load, revised alarm logic, replacement component or altered operating mode can invalidate a previously adequate criterion or its evidence. Preserve the rationale for each requirement so that changes can be traced to the hazard scenario and test boundary. A document review date alone does not show that this technical comparison has been made.

A concise performance standard can therefore carry purpose, functional criteria, availability and duration basis, survivability conditions, dependencies, verification evidence and impairment handling. Its value is not the length of the form. It is whether the record lets a reviewer distinguish an installed barrier from a barrier whose required capability has been demonstrated within the stated limits.

Sources

• L65: Prevention of fire and explosion, and emergency response on offshore installations · UK HSE · Source check date: 2026-10-07
• Well Integrity Control Measures and Performance Standards, N-04600-GN1617, 18 May 2020 · NOPSEMA · Source check date: 2026-10-07
• Exact Binomial Confidence Limits · NIST · Source check date: 2026-10-07