Table of Contents

• 1. Executive Summary and Asset Risk Profile3
• 2. Introduction, Scope and Methodology4
• 3. Facility Description5
• 4. Major Accident Hazard Register6
• 5. System-Level Bowtie Assessments7
• 5.1 ACC7
• 5.2 Auxiliary Steam9
• 5.3 HRSG Bypass11
• 5.4 HRSG Duct Burner13
• 5.5 Fuel Gas15
• 5.6 Fuel Oil17
• 5.7 Feedwater19
• 5.8 Generator H221
• 5.9 HRSG IP23
• 5.10 HRSG LP25
• 5.11 HP Steam27
• 5.12 HRSG HP29
• 5.13 LP Steam31
• 5.14 Ammonia/SCR33
• 5.15 STG Steam35
• 5.16 CRH Steam37
• 5.17 HRH Steam39
• 5.18 STG Seals41
• 5.19 STG Lube Oil43
• 6. Asset Barrier Register60
• 7. SCE/SCA Register70
• 8. Risk Assessment and ALARP Demonstration80
• 9. Findings, Gap Analysis and Improvement Plan85
• 10. Assessment Confidence and Verification Requirements95
• 11. Conclusions and Forward Look100

1. Executive Summary and Asset Risk Profile

Scope: This assessment converts the submitted HAZOP study (1123 rows, 58 nodes) into bowtie format. The submitted study covers 10 of 32 mandatory systems for a complete CCGT asset-level scope (31% mandatory coverage; classification LIMITED). The remaining 22 mandatory systems (of 32 in total) are outside the submitted scope and are not represented in this bowtie package; see §2.3 for the full scope coverage table. Conclusions in this report relate only to the packages studied; a complete asset-level risk picture requires extension of the HAZOP to the excluded scope before operational decisions, lender engagement, or regulatory submission.

Scope Coverage: 10 of 32 mandatory systems -- LIMITED

1.1 Risk Landscape Overview

This Bowtie Risk Assessment evaluated 19 Major Accident Hazard scenarios across Copy_of_Qasim_HAZOP_report_Excel.xlsx (CCGT), developing 19 bowtie diagrams encompassing 47 threat pathways and 50 consequence pathways. A total of 134 prevention barriers and 99 mitigation barriers were identified and assessed against CCPS / EI barrier validity criteria (Effective, Independent, Auditable). The assessment is based on desk review of the source HAZOP (1123 rows, 355 scenarios at S>=3) and carries an evidence confidence cap of 40/100. All outputs require validation by the Process Safety Team.

1.2 Barrier Adequacy Summary

System-level adequacy ratings combining prevention coverage and mitigation specificity. Priority is set by the worse of the two ratings combined with the system's maximum consequence severity.

1.3 Key Findings

1. 15 of 47 threat pathways (32%) currently have zero prevention barriers. If any of these threats materialises, there is no engineered defence between the initiating event and loss of containment.
2. 81% of mitigation barriers are generic shared trunk controls (detection, ESD, access restriction, emergency response) rather than consequence-specific protection. The plant's post-release defence posture is weighted toward reactive response rather than targeted consequence reduction.
3. 10 barriers each appear across 3 or more systems, creating a systemic dependency where degradation of one shared barrier weakens protection across multiple MAH scenarios. The most widely shared barrier is insulation and lagging for personnel protection, present in 12 of 19 systems (63%).
4. The HAZOP safeguard set is dominated by instrumented hardware: 73% Hardware-Active. Only 39 of 233 barriers (17%) are human, procedural or organizational. This reflects HAZOP-methodology bias rather than necessarily inadequate plant protection.
5. 33% of barriers are assessed as Partially Effective from desk review -- the barrier exists but its reliability or completeness cannot be fully confirmed without site evidence. Lowest-effectiveness system: HRSG Bypass at 50% Effective.

1.4 Priority Recommendations

1.5 ALARP Position Statement

Based on this desk-review assessment, risks from 2 of 19 MAH scenarios cannot be confirmed as ALARP until the priority recommendations are addressed. The principal concerns are Ammonia/SCR, Fuel Oil where barrier coverage falls below industry good practice for CCGT facilities. The 25 Critical and 38 Major findings identified in Section 9 represent the minimum actions required before an ALARP demonstration can be completed. A formal ALARP assessment requires site-validated PFD data and operational performance evidence, which are outside the scope of this desk review.

2. Introduction, Scope and Methodology

2.1 Purpose and Objectives

This report converts the HAZOP study for Copy_of_Qasim_HAZOP_report_Excel.xlsx into structured bowtie risk assessment diagrams per CCPS / EI "Bow Ties in Risk Management" (2018). Objectives: (a) classify HAZOP safeguards as prevention or mitigation barriers, (b) identify gaps where barriers are missing or weakened, (c) derive the SCE/SCA register with FARSI performance standards, and (d) produce a Synergi-compatible barrier register for downstream import.

2.2 Scope and Battery Limits

HAZOP source: 1123 rows analysed, 355 scenarios with severity S>=3 (SPEC-XL §5 step 1 filter). Out of scope: electrical protection systems (covered in a separate E-HAZOP study), and equipment with no S>=3 scenarios.

2.3 Scope Completeness Check

The submitted HAZOP is benchmarked against the Ascendera Reference Scope v1.0 for CCGT (40 reference systems, 32 mandatory). Scope Coverage: 10 of 32 mandatory systems -- LIMITED

Submitted HAZOP covers 10 of 32 mandatory systems for CCGT scope (31% mandatory coverage). Classification: LIMITED. Missing mandatory: Fuel Gas Receiving Station, Gas Turbine Lubrication System, GT Enclosure Ventilation and Fire Suppression, HRSG Drums (HP/IP/LP) and Downcomer System, Superheater and Reheater, Economiser, Steam Turbine Lube, Seal, and Control Oil, Condensate Polishing, Demineralisation Water Treatment, Boiler Water Chemical Dosing, Generator Step-Up Transformer, Unit Auxiliary and Station Service Transformers, HV / EHV Switchyard (AIS or GIS), Medium Voltage Switchgear, Emergency Diesel Generator, Distributed Control System and SCADA, Safety Instrumented System / Emergency Shutdown, Fire and Gas Detection, Special Hazard Fire Suppression, Plant Service Air, Nitrogen Generation and Distribution, HVAC for MCC, Chemical Buildings, Control Room. Conclusions in this report relate only to the packages studied; a complete asset-level risk picture requires extension of the HAZOP to the excluded scope.

2.4 Methodology

2.5 Confidence Doctrine

Evidence confidence is capped at 65/100 for any desk-review run. Site verification is a separate, paid activity that is not covered by this report. Every page footer carries the FOR REVIEW -- REQUIRES PROCESS SAFETY TEAM VALIDATION notice.

3. Facility Description

Facility name: Copy_of_Qasim_HAZOP_report_Excel.xlsx
Technology: CCGT
HAZOP source file: /data/output/003bb41d-890d-4104-928a-1daf2c3c2d9f/input.xlsx
HAZOP rows ingested: 1123

3.1 Asset Boundaries

Asset boundaries follow the systems defined in the source HAZOP. See Section 5 for system-by-system breakdown including hazardous inventory, operating envelope, threat pathways, and barrier coverage. Section 4 lists the Major Accident Hazards this assessment addresses.

4. Major Accident Hazard Register

The following MAH register summarises every Major Accident Hazard scenario identified at this facility. Each MAH maps to one bowtie diagram in Section 5.

5. System-Level Bowtie Assessments

One sub-section per system. Each contains the system description, the hazard, the bowtie SVG, the barrier register, and the gap findings specific to that system.

5.1 ACC

Catalogue ref: BT-CCGT-AC-001
Hazard: Air cooled condenser
Top Event: Loss of containment from air-cooled condenser
Max severity: S=4 | Prev barriers: 6 | Mit barriers: 5 | Gaps: 2

ACC has 6 prevention and 5 mitigation barriers. Of these, 6 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 2 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 3 barrier types (Hardware - Active, Organizational, Procedural). Barrier effectiveness from desk review: 64% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.2 Auxiliary Steam

Catalogue ref: BT-CCGT-AX-001
Hazard: Auxiliary steam system for deaerator and tracing
Top Event: Loss of containment of auxiliary steam
Max severity: S=4 | Prev barriers: 6 | Mit barriers: 5 | Gaps: 2

Auxiliary Steam has 6 prevention and 5 mitigation barriers. Of these, 6 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 2 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 3 barrier types (Hardware - Active, Organizational, Procedural). Barrier effectiveness from desk review: 64% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.3 HRSG Bypass

Catalogue ref: BT-CCGT-BY-001
Hazard: HP/IP/LP bypass valves dumping steam to condenser during trip
Top Event: Loss of containment from HRSG bypass and casing
Max severity: S=4 | Prev barriers: 3 | Mit barriers: 5 | Gaps: 2

HRSG Bypass has 3 prevention and 5 mitigation barriers. Of these, 3 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 2 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 3 barrier types (Hardware - Active, Organizational, Procedural). Barrier effectiveness from desk review: 50% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.4 HRSG Duct Burner

Catalogue ref: BT-CCGT-DB-001
Hazard: Natural gas fired duct burner in HRSG
Top Event: Uncontrolled release from HRSG duct burner
Max severity: S=5 | Prev barriers: 5 | Mit barriers: 7 | Gaps: 2

HRSG Duct Burner has 5 prevention and 7 mitigation barriers. Of these, 5 were traced to HAZOP safeguards while 7 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 2 barrier types (Hardware - Active, Hardware - Passive). Barrier effectiveness from desk review: 58% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 3 consequence-specific barriers parented to individual consequences (event-tree branching).

5.5 Fuel Gas

Catalogue ref: BT-CCGT-FG-001
Hazard: Pressurised natural gas in fuel gas supply pipework
Top Event: Loss of containment of natural gas from fuel gas system
Max severity: S=5 | Prev barriers: 16 | Mit barriers: 7 | Gaps: 3

Fuel Gas has 16 prevention and 7 mitigation barriers. Of these, 17 were traced to HAZOP safeguards while 6 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 3 barrier types (Hardware - Active, Hardware - Passive, Procedural). Barrier effectiveness from desk review: 70% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.6 Fuel Oil

Catalogue ref: BT-CCGT-FO-001
Hazard: Backup fuel oil (HFO / LFO) supply system
Top Event: Loss of containment of fuel oil
Max severity: S=5 | Prev barriers: 0 | Mit barriers: 7 | Gaps: 3

Fuel Oil has 0 prevention and 7 mitigation barriers. Of these, 2 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 3 of 3 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 2 barrier types (Hardware - Active, Hardware - Passive). Barrier effectiveness from desk review: 57% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 3 consequence-specific barriers parented to individual consequences (event-tree branching).

5.7 Feedwater

Catalogue ref: BT-CCGT-FW-001
Hazard: High pressure boiler feedwater
Top Event: Loss of containment from feedwater system
Max severity: S=5 | Prev barriers: 9 | Mit barriers: 4 | Gaps: 1

Feedwater has 9 prevention and 4 mitigation barriers. Of these, 9 were traced to HAZOP safeguards while 4 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 4 barrier types (Hardware - Active, Hardware - Passive, Organizational, Procedural). Barrier effectiveness from desk review: 77% Effective; the remainder are Partially Effective and need site validation.

5.8 Generator H2

Catalogue ref: BT-CCGT-GH-001
Hazard: Hydrogen cooling gas in generator casing
Top Event: Uncontrolled release of hydrogen from generator
Max severity: S=5 | Prev barriers: 5 | Mit barriers: 5 | Gaps: 2

Generator H2 has 5 prevention and 5 mitigation barriers. Of these, 5 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 3 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 2 barrier types (Hardware - Active, Hardware - Passive). Barrier effectiveness from desk review: 80% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 2 consequence-specific barriers parented to individual consequences (event-tree branching).

5.9 HRSG IP

Catalogue ref: BT-CCGT-HI-001
Hazard: IP water/steam in HRSG IP section
Top Event: Loss of containment from HRSG IP section
Max severity: S=5 | Prev barriers: 6 | Mit barriers: 5 | Gaps: 3

HRSG IP has 6 prevention and 5 mitigation barriers. Of these, 6 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 2 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 4 barrier types (Hardware - Active, Hardware - Passive, Organizational, Procedural). Barrier effectiveness from desk review: 55% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.10 HRSG LP

Catalogue ref: BT-CCGT-HL-001
Hazard: LP water/steam in HRSG LP section
Top Event: Loss of containment from HRSG LP section
Max severity: S=5 | Prev barriers: 8 | Mit barriers: 5 | Gaps: 3

HRSG LP has 8 prevention and 5 mitigation barriers. Of these, 8 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 4 barrier types (Hardware - Active, Hardware - Passive, Organizational, Procedural). Barrier effectiveness from desk review: 54% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.11 HP Steam

Catalogue ref: BT-CCGT-HP-001
Hazard: High pressure superheated steam in HP steam header
Top Event: Loss of containment of HP steam
Max severity: S=4 | Prev barriers: 9 | Mit barriers: 5 | Gaps: 3

HP Steam has 9 prevention and 5 mitigation barriers. Of these, 9 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 4 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 4 barrier types (Hardware - Active, Hardware - Passive, Organizational, Procedural). Barrier effectiveness from desk review: 64% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.12 HRSG HP

Catalogue ref: BT-CCGT-HR-001
Hazard: HP water/steam in HRSG HP section (economiser, evaporator, superheater)
Top Event: Loss of containment from HRSG HP section
Max severity: S=4 | Prev barriers: 12 | Mit barriers: 5 | Gaps: 6

HRSG HP has 12 prevention and 5 mitigation barriers. Of these, 12 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 2 of 4 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 4 barrier types (Hardware - Active, Hardware - Passive, Organizational, Procedural). Barrier effectiveness from desk review: 59% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.13 LP Steam

Catalogue ref: BT-CCGT-LP-001
Hazard: LP steam header distribution
Top Event: Loss of containment of LP steam
Max severity: S=4 | Prev barriers: 8 | Mit barriers: 5 | Gaps: 1

LP Steam has 8 prevention and 5 mitigation barriers. Of these, 8 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 4 barrier types (Hardware - Active, Hardware - Passive, Organizational, Procedural). Barrier effectiveness from desk review: 69% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.14 Ammonia/SCR

Catalogue ref: BT-CCGT-NH-001
Hazard: Aqueous ammonia (19-25%) for SCR injection
Top Event: Uncontrolled release of ammonia
Max severity: S=4 | Prev barriers: 4 | Mit barriers: 6 | Gaps: 3

Ammonia/SCR has 4 prevention and 6 mitigation barriers. Of these, 4 were traced to HAZOP safeguards while 6 were identified from domain knowledge or engineering standards and require site verification. 2 of 3 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 3 barrier types (Hardware - Active, Human - Active, Organizational). Barrier effectiveness from desk review: 50% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.15 STG Steam

Catalogue ref: BT-CCGT-SS-001
Hazard: HP/IP/LP steam within steam turbine casing
Top Event: Loss of containment from steam turbine
Max severity: S=4 | Prev barriers: 12 | Mit barriers: 5 | Gaps: 2

STG Steam has 12 prevention and 5 mitigation barriers. Of these, 12 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 3 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 4 barrier types (Hardware - Active, Human - Active, Organizational, Procedural). Barrier effectiveness from desk review: 76% Effective; the remainder are Partially Effective and need site validation. Mitigation includes 1 consequence-specific barrier parented to individual consequences (event-tree branching).

5.16 CRH Steam

Catalogue ref: BT-CR-001
Hazard: Condensate in CRH Steam
Top Event: Loss of containment of cold reheat steam
Max severity: S=4 | Prev barriers: 4 | Mit barriers: 3 | Gaps: 1

CRH Steam has 4 prevention and 3 mitigation barriers. Of these, 4 were traced to HAZOP safeguards while 3 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 3 barrier types (Hardware - Active, Hardware - Passive, Organizational). Barrier effectiveness from desk review: 71% Effective; the remainder are Partially Effective and need site validation.

5.17 HRH Steam

Catalogue ref: BT-HH-001
Hazard: Steam in HRH Steam
Top Event: Loss of containment of hot reheat steam
Max severity: S=4 | Prev barriers: 8 | Mit barriers: 5 | Gaps: 1

HRH Steam has 8 prevention and 5 mitigation barriers. Of these, 8 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 3 barrier types (Hardware - Active, Organizational, Procedural). Barrier effectiveness from desk review: 69% Effective; the remainder are Partially Effective and need site validation.

5.18 STG Seals

Catalogue ref: BT-SL-001
Hazard: Hydrogen in STG Seals
Top Event: Loss of containment from turbine shaft seals
Max severity: S=5 | Prev barriers: 8 | Mit barriers: 5 | Gaps: 1

STG Seals has 8 prevention and 5 mitigation barriers. Of these, 8 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. Defence-in-depth includes 2 barrier types (Hardware - Active, Hardware - Passive). Barrier effectiveness from desk review: 85% Effective; the remainder are Partially Effective and need site validation.

5.19 STG Lube Oil

Catalogue ref: BT-LO-001
Hazard: Lube oil in STG Lube Oil
Top Event: Loss of containment of lube oil from ST system
Max severity: S=4 | Prev barriers: 5 | Mit barriers: 5 | Gaps: 2

STG Lube Oil has 5 prevention and 5 mitigation barriers. Of these, 5 were traced to HAZOP safeguards while 5 were identified from domain knowledge or engineering standards and require site verification. 1 of 2 specific threat pathways carry no prevention barrier -- these are unprotected initiating-event scenarios that need either safeguard documentation in the HAZOP or an engineering review. Defence-in-depth includes 3 barrier types (Hardware - Active, Hardware - Passive, Procedural). Barrier effectiveness from desk review: 80% Effective; the remainder are Partially Effective and need site validation.

6. Asset Barrier Register

Every barrier identified across the assessment, with side, category, condition, PFD/SIL where known, and provenance tier. Three quality columns help reviewers scope their verification: Independence flags barriers that depend on another (e.g. operator response to an alarm); Shared Count shows how many systems carry the same barrier title (a high count signals systemic dependency); EIA Status is the desk-review Effective / Independent / Auditable validity bucket (Valid / Conditional / Verify / Concern). Cross-references the WORLD_CLASS.xlsx Bowtie Elements sheet.