Two sides, two jobs
| Preventive | Recovery | |
|---|---|---|
| Position | Between threat and top event | Between top event and consequence |
| Job | Stops the top event | Limits the consequence |
| When it is tested | Every day, quietly | Once in years, on the worst day |
| Example | Level interlock, mechanical lock, permit system | Bund, fire suppression, evacuation arrangements |
The balance can be read
Once drawn, the number of boxes on each side is information in itself. A thin left side with a crowded right side means the site is waiting for the event. The reverse also happens: a crowded left side with an empty right side assumes "it will never get that far" and leaves emergency response unprepared.
The critical difference: testing
Preventive barriers work every day and their failure is usually noticed. Recovery barriers do nothing until demanded; that they are broken is discovered exactly when they are needed. Periodic proof testing therefore matters more on the recovery side than on the preventive one.
A classification error
A common mistake is putting an alarm on the preventive side. If the alarm announces the situation after the top event, it is a recovery barrier; if it catches the deviation before, it is preventive. The same hardware can sit on either side depending on where it acts — but never on both at once.