botminds.aiRequest a demo
SystemHSE, Process Safety & OT Security

Barrier Management

Barrier management on a live bowtie: agents read the records behind each gate, and a barrier owner rules when they read worse than the status.

See the demoBook a demo
Follow the morning from 05:12 to the night handover ↓
The problem

A test that needed a second try still reads PASS on the barrier report

A status field has no room for passed on the second attempt. That is the result that matters most, because on a real demand the barrier would have failed. The closing technician writes the truth in the note, and the result field says PASS.

The bypass that ran for weeks sits in a separate log. The deferral that rests on a spare someone has since used sits in its register. Neither touches the status, and reading all of it takes hours nobody has, so audits sample and the dashboard trusts the field.

Built forBarrier ownersAsset managersProduction supervisorsMaintenance plannersInternal auditors

The Problem Today

Barrier dashboards show one word from a status field, while the truth sits in test notes and bypass logs.

19%
share of audit deficiencies under mechanical integrity, the most published
10 of 20
deluge systems tested in one regulator program read red or amber published

Read by hand today

  • Test notes
  • Bypass logs
  • Deferrals
  • Defects
  • A second try reads as a passOne result field has no room for a stuck first stroke
  • Audits can only sampleToo many records sit behind each gate to read by hand

The Solution

  1. Draw the bowtieAgents turn your hazard studies into live bowties, each barrier a gate
  2. Read the records nightlyTests, notes, bypass lines and deferrals tied to the gate they prove
  3. Says healthy, reads worseThe agent proposes a change and quotes the sentence that caused it
  4. A person rulesThe barrier owner rules, and the plan and the handover follow

Built-in controls

  • Agents never change a barrier state
  • Nobody signs a record they have not opened
  • The asset manager countersigns each ruling

What You Get

Leaders see the state the records support, and a weak barrier carries an owner, a plan and an end date.

320 h
of reading a week, at 2 minutes a record our estimate
  • Risk moves in front of the teamA falling gate shows how far a threat can now travel
  • Rulings that reach the planPriority, handover and bypass checks follow the ruled state
  • Evidence an auditor can openThe sentence, the reason and both names on a ruled barrier
One morning, one separator

Barrier management on one HP separator, from the overnight read to handover

The first stage separator on the platform shows 15 healthy gates and one degraded gas detector. This is the morning its level trip stopped counting, in the order each person acted.

demoPlatforms, people, tags and figures here are sample data.

  1. 0105:12

    373 records read behind 16 gates, and one gate reads worse than it says

    Barrier owner

    Through the night the agents read the tests, notes, bypass lines and deferrals behind each gate on the separator bowtie. Its knot still says holding, as the maintenance system does. A line under the bowtie names one gate, LSHH-2102, the high-high level trip, and quotes the words that put it there, each linked to its record.

  2. 0208:43

    The result field says PASS, and the technician wrote that the valve stayed put

    Barrier owner

    The first link opens the monthly function test. Result field: PASS. The note says the trip passed on the second attempt, because the solenoid stuck on the first stroke and SDV-2106 did not move. Cycled by hand, the valve closed in 22 s against a 45 s limit. No spare solenoid was on board.

  3. 0308:46

    In bypass for 19 days on an approval for 72 hours

    Barrier owner

    The second link opens the electronic bypass log. That trip sat bypassed while a level transmitter waited for a replacement and a calibration slot, with no extension filed. Neither this line nor the stuck solenoid ever reached the status field. Here they sit on one gate, each beside the record it came from.

  4. 0408:47

    Both trips close SDV-2106, so two lines on the bowtie fall short

    Barrier owner

    Switched to what the records say, the level trip reads Failed, proposed, and stops counting at once. PSHH-2102 closes the same valve, so its chip reads valve in question. Liquid overfill and blocked outlet each need 2 working and now have 1. A red line runs past the gate, and the knot turns Weak, 1 to rule.

  5. 0508:52

    Confirm stays grey until the cited record has been opened

    Barrier owner

    Before anyone confirms, the ruling panel states the effect: liquid overfill short, the bowtie Weak. The owner opens the test record, picks as-found failure and types why. Under the site standard a second-attempt pass is a failure as found, and the cause is still there.

  6. 0609:04

    Keep running until an end date on four measures, or stop 18,000 bbl/d

    Asset manager

    The owner recommends keep running on four drafted measures. They are a dedicated level watch at the panel, wells back one at a time, no bypass on the scrubber trip or the relief valve, and the solenoid fitted with both trips retested. Sign stays off until the asset manager opens the test record. Then she signs, and countersigns the ruling.

  7. 0709:13

    A bypass on the scrubber level trip is refused at the form

    Production supervisor

    Tonight’s handover lists both short lines on the separator in plain words, with the measures and the signed decision under them. After taking it, the supervisor asks to bypass LSHH-3282 so a transmitter can be recalibrated. The form refuses: liquid overfill needs 2 working and would have 0, and only the asset manager can change that after a bowtie decision.

  8. 0809:16

    The solenoid job jumps from P3 to P1, and its deferral bounces

    Maintenance planner

    Raised as routine and tied to nothing, the solenoid work order is now P1, linked to the barrier, with the part on the Thursday boat. When the planner tries to defer it, a box explains the refusal: the trip reads Failed, and deferring its repair would leave the separator short for longer.

  9. 09Later

    Each ruling sits beside the records its signer opened first

    Internal auditor

    Filtered to people, the audit trail shows each record the owner opened, his ruling with the typed note marked as not compared, and the asset manager opening the record herself before signing twice. The refused bypass and the refused deferral follow. No row can be changed, and both the trail and the assurance evidence download as files.

61 of 387 healthy statuses that do not count as working, line by line

Before the morning’s ruling, the maintenance system called 387 of the 412 barriers healthy. The records stop counting these.

Open proposals, each quoting its sentence10
Tests past their date, read Not proven by rule23
Tests deferred, so the gate cannot be proven24
Barriers in bypass2
Firewater pump out of service1
Trip sharing the failed valve1
Healthy statuses that do not countThe count leaves out the 3 operator alarms no study credits.61

demoSample data, from the working solution.

Work orders closed as complete whose own notes say the barrier fell short

Four more proposals waiting that morning, each quoting a note the status field could not hold.

A blowdown valve that opened in 31 s

The limit is 15 s. The order closed as complete, promising a look at the actuator next visit.

Deluge flow achieved, with 12 of 96 nozzles blocked

The flow test is marked complete, while its completion comments list the blocked nozzles, with photos.

A detector calibrated with an expired test gas

The calibration passed, but its test gas cylinder had expired, so the reading proves nothing.

A relief valve deferred twice on a spare that has gone

The yearly bench test was deferred again on a spare in stores, and that spare went elsewhere.

demoSample data, from the working solution.

Around the bowtie

The barrier management system beyond the separator bowtie

Proposals, the field, trends, measures, a drafted bowtie and the states, as the rest of the team sees them.

Says healthy, reads worseEach proposal quotes its note and sets the state it says against the state it reads, with the agent’s confidence and the hours left to rule.
The field, weak or worseEight of the 38 bowties are weak across three platforms, with the gates left to rule on each. One click opens any of them.
One part behind several notesThe stuck solenoid is a part fitted to 12 shutdown valves. Three other notes in a year say much the same. A person decides if it is a common cause.
Extra measuresWhat the crew does instead while a barrier is weak: who owns it, how often it is checked and when it ends. Two checks show as behind.
A bowtie drafted from a studyAgents read a hazard study and draft its bowtie. Three tags or counts disagree with the maintenance records, and nothing goes on until each is settled.
Five states, defined onceHealthy, degraded, failed, not proven and in bypass, each in one line. Unproven is not impaired, and a bypassed barrier does not count while it lasts.

demoSample data, from the working solution.

Who rules on a falling gate, who signs after it, and what each reads

A status goes up only on a fresh test record and two signatures. Whoever rules cannot countersign.

Barrier owner
Sees
The proposal, the sentence that caused it and the record it came from
Signs
The ruling and its reason, then the keep running or shut in recommendation
Asset manager
Sees
The cited record, opened after the item last changed
Signs
The countersignature on each ruling, and keep running with an end date
Offshore installation manager
Sees
The last test of the barrier asked to come off the line
Signs
A bypass on the platform, after the barrier owner agrees
Production supervisor
Sees
What is weak tonight, the extra measures and what must not be done
Signs
The handover, and a log against each measure check
Internal auditor
Sees
Each action in order, and the evidence file; read only
Signs
Nothing at all: each button stays refused for this role
The agents

Who reads the bypass log at night, and what each agent may not touch

Each works on one kind of record and hands what it finds to a person.

Bowtie builder

Drafts bowties from existing hazard studies and matches their tags to the maintenance system.

  • Never publishes a bowtie
  • Never invents a barrier
Record reader

Ties tests, notes and shift log lines to the barrier they speak about.

  • Never changes a record
Bypass watcher

Works out hours in bypass against the hours approved.

  • Never applies or removes a bypass
Deferral reader

Checks that the conditions each deferral rests on still hold.

  • Never extends a deferral
State checker

Compares what the status says with what the records read, and proposes a change with the sentence behind it.

  • Never changes a state
Measures drafter

Drafts extra measures from past approved cases and watches that their checks are logged.

  • Never decides keep running or shut in
Handover writer

Writes what is weak tonight in plain words for the shift.

  • Never gives how-to on isolation, pressure or lifting

Calls on a weak barrier that stay with the people on the asset

The agents read, compare and draft. The calls below stay with named people.

A barrier state moves only by a rulingThe state checker proposes. The barrier owner confirms or rejects, giving a reason, and the asset manager countersigns.
Going back to healthy needs a fresh testA note is never enough. The barrier rises only on a new test record and two signatures.
Keep running or shut in is a person's decisionThe measures drafter drafts. The barrier owner recommends and the asset manager signs, after opening the record.
No setting makes an uncredited alarm countLoosening a rule needs a reason, a source and the study opened by the signer. No setting hides a gate.

What barrier owners and asset managers ask about barrier management

What is barrier management?

Barrier management means keeping each safety barrier on a major hazard able to do its job, and knowing which ones cannot. This solution draws each hazard as a live bowtie, reads the records behind every gate each night, and proposes a change when the records read worse than the status.

Our dashboard already shows barrier health. What changes?

A dashboard shows the status field. Here the state comes from the test note, the bypass log line, the deferral and the open defect, and each proposed change quotes the sentence that caused it. A switch sets what the system says beside what the records say.

Is a pass on the second attempt counted as a failure?

Your own site standard and study decide. In the sample, the standard calls it a failure as found while the cause is still there. Changing a rule like that takes the barrier owner’s proposal and the asset manager’s signature.

Why is the operator alarm not counted as a barrier on the bowtie?

An alarm counts only when the study credits it and the operator has enough time to act. On the sample separator that is about four minutes from alarm to trip, under what the site credits, so the alarm stays on the bowtie without counting.

What does a barrier management system like this read from our systems?

The maintenance system's test records and work order notes, the electronic bypass log, the deferral register and open defects, the shift log, and the safety studies and performance standards in document management. The agents never change a record.

How does process safety barrier management reach the shift and the work plan?

A ruling moves more than a color. The handover lists what is weak tonight and what must not be done, a bypass that would leave a line short is refused at the form, and the repair order is raised and linked to the barrier.

HSE, Process Safety & OT Security

More process safety work around the live bowtie

All 10 solutions →
Process Safety Information Management

Relief valves with no full sizing reason found, each with a relief engineer and a date for its study.

1-min demoPHA Revalidation

Records since the last study pinned to their nodes, failed closures found, and people write every scenario.

1-min demoLearning from Incidents

Past incidents gather around the job, and you see which fixes really held.

1-min demo

Bring one bowtie
and a month of its records.

We’ll read the notes behind your own green statuses with you, gate by gate.

Book a demoBrowse solutions