ASP Fellowship II key terms

A condition, event, or circumstance that could cause harm to people, equipment, or the environment. It exists independently of whether anyone is exposed or whether any resulting loss actually occurs.

The combination of the likelihood of a hazardous event and the severity of its consequences. It expresses how much loss is plausible, not merely whether a hazard is present.

The degree of harm or loss that a hazardous event could produce, usually ranked from negligible through catastrophic. It describes the outcome magnitude, independent of how often the event occurs.

The estimated likelihood that a hazard will lead to a mishap within a stated period or exposure. It is often expressed as a qualitative rank or a frequency such as per hour of operation.

An unplanned event or series of events that results in death, injury, occupational illness, damage to or loss of equipment or property, or environmental harm. It is the realized outcome of an uncontrolled hazard.

A grid that pairs severity categories against probability categories to assign a risk level. It provides a consistent, visible basis for ranking hazards and deciding which need treatment.

A documented decision by the accountable authority that a residual risk may be tolerated for a defined period and use. It records the rationale, the level accepted, and any compensating controls.

The risk remaining after controls, design changes, or mitigations have been applied. It is the value compared against acceptance criteria before an activity is authorized to proceed.

A test requiring risk to be reduced until further reduction is grossly disproportionate to the benefit gained. It weighs control cost and effort against the safety improvement achieved.

The systematic process of finding and documenting conditions or events that could cause harm, before losses occur. It draws on design data, operating history, and structured team techniques.

An early, broad listing of hazards produced during concept or preliminary design. It guides later, more detailed analyses and highlights areas needing design attention.

A structured examination of a system to determine how hazards arise, what their consequences are, and which controls reduce risk. It produces documented findings that feed design and operational decisions.

A deductive technique that starts from an undesired top event and traces backward through logical gates to the combinations of basic failures that could cause it. It supports both qualitative and quantitative evaluation.

An inductive technique that examines each component or function, lists the ways it can fail, and traces the local and system-level effects of each failure. It is used to prioritize design and maintenance attention.

The loss of two or more supposedly independent items from a single shared cause, such as a common power supply, environment, or design error. It defeats redundancy assumptions and must be analyzed explicitly.

A failure of one item that alone causes loss of a required function or an unacceptable consequence. Its presence usually signals a need for redesign, redundancy, or added monitoring.

Providing more than one means to perform a required function so a single failure does not cause loss of that function. Its value depends on genuine independence between the redundant paths.

The ability of a system to continue delivering its required function, or to fail safely, despite the presence of faults. It is achieved through redundancy, monitoring, and designed recovery behavior.

A design approach in which a failure drives the system to a state that is safer than continued operation. The safe state must be defined deliberately and must itself be reachable under credible failure conditions.

Maintaining a controlled record of each identified hazard from discovery through closure, including its status, assigned owner, planned controls, and verification evidence. It prevents hazards from being lost across program phases.

The governing document that defines how safety activities, responsibilities, schedules, and deliverables will be managed across a program's life cycle. It is typically contractually binding and subject to customer approval.

A disciplined engineering and management approach that applies analysis, design, and verification throughout a system's life cycle to keep risk within accepted limits. It treats safety as a design property, not an inspection outcome.

A designated group with authority to review hazard analyses, risk acceptance decisions, and readiness to proceed. It provides independent challenge and records formal concurrence or dissent.

A structured argument, supported by evidence, that a system meets its safety requirements and that residual risk is acceptable for a defined operating context. It is maintained and revised as the system changes.

A discrete target level for the reliability of a safety function, assigned from risk assessment and realized through specified engineering and verification practices. Higher levels demand stronger architectural and diagnostic measures.

A function whose failure or unintended operation could directly cause or contribute to a catastrophic or severe outcome. Such functions attract the strictest design assurance, verification, and change control.

The application of analysis and assurance practices to software so that it cannot cause or fail to prevent hazardous system states. It addresses requirements, design, coding, verification, and configuration control.

An action or inaction by a person that departs from intended or required behavior and contributes to an undesired outcome. Analysis distinguishes slips, lapses, mistakes, and violations rather than assigning blame.

The study of how human capabilities, limits, and behavior interact with equipment, procedures, and environments. Its findings shape designs that reduce error and support reliable performance.

A structured breakdown of what an operator must perceive, decide, and do to complete a task, including information sources, tools, and timing. It reveals mismatches between task demands and human capability.

The mental and physical effort required to perform tasks within available time and resources. Excessive or persistently low workload can degrade attention, decision quality, and error detection.

An action taken to reduce the probability or severity of a hazard's consequence, such as a design change, interlock, procedure, or training. Its effectiveness must be verified, not assumed.

A physical or logical feature added specifically to prevent a hazardous condition or to limit its consequences, such as a guard, interlock, or relief valve. It is distinct from a control needed for normal operation.

A controlled procedure that isolates and secures energy sources before maintenance or servicing, with locks and tags identifying who holds them. It prevents unexpected energization or release of stored energy.

The practices that keep servicing, inspection, and repair activities from injuring workers or degrading system safety. It covers procedures, training, access, energy isolation, and return-to-service verification.

The disciplined control of a system's requirements, design, software, and documentation so that changes are identified, reviewed, approved, and recorded. It ensures that analyzed and fielded configurations match.

A structured inquiry into an event to establish what happened, why defenses failed, and what must change. It seeks causes and corrective actions rather than individual blame.

A method for tracing an undesired outcome back to underlying systemic conditions, such as design flaws, missing barriers, or management decisions, that, if corrected, would prevent recurrence.

Documented insights from incidents, analyses, or programs that are shared and applied to prevent repeat problems. Effective programs track whether recommended changes were actually adopted and verified.

A specific change made to eliminate the cause of a detected problem so it does not recur, with an owner and completion evidence. It is distinct from immediate containment of the symptom.