Process Safety and Asset Integrity Beyond the Checklist
A procedure on file and a barrier that works are different things. Bowtie analysis shows which one you have.
Two questions that get confused
Process safety systems are often assembled to satisfy an audit, which asks whether a control is documented, while the hazard asks whether the control will work. These are separate questions, and a system can answer the first perfectly while failing the second.
A procedure that crews do not follow provides no protection against a major accident, and neither does a relief device that was inspected on time but would not lift at its set pressure. In both cases the paperwork is complete.
What a bowtie shows
Bowtie analysis draws a hazard as a diagram with the unwanted event in the middle. Threats that could cause it sit on the left, with the preventive barriers that block each one, and consequences sit on the right, with the barriers that limit them. The picture makes it obvious which barriers the site is relying on.
Barrier management is the work that follows, in which each barrier gets an owner, a defined function and a way to verify that function across the life of the asset.
Exhibit 1: The difference between a compliance check and a barrier check for the same piece of equipment.
| Question | Compliance check | Barrier check |
|---|---|---|
| What is examined? | The procedure and the maintenance record | The equipment and the task as performed |
| What counts as a pass? | Document exists, inspection on schedule | Barrier performs its protective function |
| Who is asked? | The document owner | The crew doing the work |
| What does leadership see? | Completion percentages | Which barriers are healthy, degraded or failed |
Where degradation hides
- A barrier that depends on a person, such as an operator response to an alarm, erodes when alarm loads rise or staffing changes.
- A temporary bypass becomes permanent because nobody owns its removal.
- Maintenance restores the equipment but not the setting the design assumed.
- A modification upstream changes the duty on a barrier that was never reassessed.
The last of these is a management-of-change failure, which we deal with separately in why process safety management fails quietly.
In one composite engagement, a power generation and transmission operator verified its safety-critical equipment against design intent, and three degraded barriers were found and repaired before a regulatory audit. See the barrier management case study.
Verification in practice
Field verification runs alongside the document review. Someone watches the task, tests the device or walks the line, and compares what they find with what the barrier is supposed to do. Where the two differ, the finding is specific and can be fixed.
Sites that work this way tend to discover their gaps themselves, which is a much better position than learning of them from an auditor, and far better than learning from an event.
Key takeaways
- Pick one major-accident hazard and list every barrier that stands between it and an incident.
- For each barrier, name an owner and state the function it must perform.
- Ask for evidence that the barrier was tested against that function, not only that it was serviced.
- Report barrier condition to the board alongside maintenance completion.
Verify your safety-critical barriers
We can build a bowtie for your major hazards and check each barrier in the field against its design intent.
Contractor Safety Management for an Outsourced Workforce
Subcontracting the work does not subcontract the duty. Whoever controls the site answers for safety on it.
Why Safety Culture Metrics Can Mislead Leadership
A falling incident rate can mean the site is safer. It can also mean people have stopped reporting. The board dashboard should be able to tell which.
What ISO 45001 Auditors Look For
Certification audits rarely fail a system for missing documents. They fail it when the documents and the site do not match.