SystemHSE, Process Safety & OT Security

Safety Case Management

Safety case management that tests the claims in an offshore safety case against the platform's own records, night after night.

See the demo Book a demo

Follow the refuge finding from the overnight check to Rev 7 ↓

The problem

The case still says the refuge holds the crew, and nobody went back to check

A safety case is written for a thorough review and then read rarely. The platform does not stand still. A campaign brings extra crew, a maintenance review stretches a test interval, a change form asks about pipe loads and never about escape widths. Each change lands in its own system, and none of them points back to the sentence it breaks.

So the owner hears about changes through meetings and the change register, and the review team reads the case section by section, years later, asking asset staff for evidence. By then a limit may have been broken for weeks and a new plan may be about to break it again.

Built forSafety case ownersTechnical authoritiesInstallation managersSafety engineersInternal auditors

The Problem Today

A safety case makes thousands of statements about the platform, and the platform keeps changing while the case sits unread.

5 years: longest gap between full reviews under two national rule sets published
716 h: hours to test one case's claims by hand, at 20 minutes each our estimate

Checked by hand today

Crew counts
Test data
Changes
Promises

Changes miss the caseChange forms rarely ask which claim they break
Crew plans grow unseenExtra campaign crew is not read against the limit

The Solution

Each claim pulledThe statements the case must keep true, in their exact words, with their page
Tested against recordsCrew counts, tests, deferrals and changes read overnight
No longer trueCase and record side by side, with what the agent ruled out
Work and redline openedThe owner rules, a second person signs, the work gets an owner

Built-in controls

A second person countersigns each decision
Agents read records; they never change them
A blank record is never counted as a pass

What You Get

Case owners see drift the morning after a record changes, and walk into the thorough review with the changes already sorted by topic.

Plans held before they startA crew plan above the limit is held by two people
Real gaps open real workEach one gets an owner and a date on the platform
Redlines drafted from rulingsThe next revision starts from what two people agreed

One finding, ruled and signed

Safety case management on one platform, from the overnight check to Rev 7

A campaign put more people on the platform than the temporary refuge is sized for, and the next campaign plan goes higher still. Here that finding moves from the overnight check to a held plan and a redline.

demoSample data throughout: the platform, its crew, the case and each figure on these screens.

016:10 am
1,788 record tests ran overnight, and 23 claims no longer hold
Safety case owner
Each claim on the page is shaded by what the records say, and the night's findings are pinned in the margin, tied to their sentence by a line. A count across the top splits 2,147 claims into those a record can test and those that wait for a record or a person. A note names the claim to read first.
02Morning
Sized for 96, and 104 people slept on board for 23 days
Safety case owner
Section 6.3.2 sits beside the personnel-on-board log, drawn day by day against the limit. Below it, the check says what it ruled out: no accommodation vessel in the vessel log, standby vessel crew left out of the count, no approved change found for going above 96. With 108 beds on the platform, nothing physical stopped the count.
03Morning
The next compressor campaign peaks at 108
Safety case owner
Today 82 are on board, so the claim is true again. The owner opens the crew plans. Core crew 78 plus campaign crew 30 puts the re-wheel campaign 12 above the limit at its peak, while the three plans after it stay within it. The same campaign that broke the refuge claim also broke the muster time and the lifeboat seats.
049:15 am
A real gap, with work on the platform and a date
Safety case owner
She rules the claim a real gap: the facility no longer matches it. The work goes to the installation manager with a date, and the draft redline is ticked so the case can say plainly that persons on board shall not exceed 96. It counts only once the technical authority countersigns. Three minutes later she proposes a hold on the campaign plan.
059:21 am
Countersign stays off until he has opened both sources himself
Offshore technical authority
He opens the case passage and then the crew record. Her opening them earlier does not count for him. He sees her reason and the work text marked as typed by a person and compared with nothing. Only then does the button to countersign come on, and sending the ruling back stays open to him too.
069:21 am
Countersigned: the work is open and the redline is in the draft
Offshore technical authority
Now the chip reads real gap, work open. Who ruled, who countersigned, the reason, the owner and the date all sit on the claim, with links to the redline, the work list and the crew plans. A reopening can be proposed, but it takes a second person too, and it leaves work already opened on the platform in place.
079:30 am
Mobilize is refused, and the screen says who holds the gate
Offshore installation manager
At 9:27 the technical authority countersigned the hold. When the installation manager presses Mobilize on the campaign, the gate refuses it and names who proposed the hold and who countersigned it. The agents only read the platform's records; a hold on a crew plan is the one write, and it takes two people. It lifts once the plan is cut and the ruling settled.
089:36 am
Campaign crew 14, peak 92, about 86 days
Offshore installation manager
The manager acknowledges the hold and cuts the plan. The same crew-days spread over more days: 78 plus 14 gives a peak of 92, which leaves room inside 96 for the 4 visitors on board today. A peak above 92 is refused. He must confirm the work can run over the longer window, since a re-wheel sits inside a shutdown.
099:39 am
The cut is countersigned and the gate opens at 92
Offshore technical authority
Because a change after signing voids a signature, he opens this version of the plan before he signs. With the refuge ruling settled, the hold can lift. The campaign now runs 86 days with a peak of 92 and room for 4 visitors, and the other three plans stay within the limit as before.
10Afternoon
Rev 7 holds 5 redlines, each from a countersigned ruling
Safety case owner
At the top of the next revision sits the refuge redline, beside wording fixes and real gaps ruled earlier. It does not raise the limit: the refuge is still sized for 96. To go out, the revision needs the safety representatives' consultation, the technical authority, the accountable manager and then the owner. An edit on the way voids the signatures.

How 2,147 claims split before anyone reads one

The same sum shows on each screen. A blank record counts as cannot tell, and holds only when a record agrees.

Hold against their record	1,765
Old result, because the training system failed overnight	55
No longer true17 wait for the owner, 2 for the checker, 4 are in the Rev 7 draft	23
Claims with a record test	1,843
Wait for a record	148
A person judges	156
All claims in the case	2,147

demoSample data, from the working solution.

Around the case

The register, the records to find and the thorough review behind the case

The rest of the platform's case work, each screen enlarged on a click.

Safety case owner's work list: claims to rule on, each with a priority and a due date or days over — **The owner's work list**Each claim waiting for a ruling, with its clock and the days it is over. At the top sits the decision whether to tell the regulator about the refuge.

Offshore safety case claim register: each claim with page, the record it is tested against, next due date and state — **Claim register**All 2,147 claims with their page, the record each is tested against and when that record falls due. Filters split them by state and by part of the case.

Records to find: 148 claims with no usable record, split into no record found, past due, unclear scan and two records disagree — **Records to find**148 claims the agents cannot test yet, each with why and who owns the record. 32 have only a copy of the same record, and a copy is not evidence.

Changes, deferrals and events read against the case: 21 broke a claim, 170 still hold, 1,073 touched nothing — **What the facility did**1,264 records read since the case was accepted: 21 broke a claim, 170 touched a claim that still holds, 1,073 touched none. 64 open deferrals sit on a safety barrier.

Safety case thorough review plan: milestones, the four jobs of the review, sample checks by part and review topics by lead — **Thorough review**Milestones to the five-year date, the four jobs and the topics by lead. Two parts carry a countersigned sample check: a sample, and no proof of each claim.

Audit trail of the morning: a real gap ruling, a proposed hold, three countersignatures, a refused mobilization and a cut plan — **Audit trail**The morning in order, people and agents alike: ruling, hold, three countersignatures, the refused mobilization and the cut. Nothing in it can be edited.

demoSample data, from the working solution.

Who rules on a claim, who countersigns, and what each must open

The owner rules and someone else signs. A checker must open what they sign, and the opening counts only for that version.

Safety case owner

Sees: The claim beside its record, what the agent ruled out, and what else the same change touches
Signs: Rules real gap, wording fix or not a gap, and proposes holds

Offshore technical authority

Sees: The case passage and the record, opened by him, with typed text marked as not compared
Signs: Countersigns or sends back each ruling, hold and cut

Offshore installation manager

Sees: Crew plans against the limit, and questions the case owner asks of the platform
Signs: Acknowledges holds and proposes the cut

Safety engineer

Sees: Claims with no usable record, and the parts drawn for a sample check
Signs: Adds an independent record, and agrees or disagrees on each sampled claim

Accountable manager

Sees: The revision export and what the workforce said
Signs: Approves the revision before it is sent

Internal auditor

Sees: Each decision, its cited records and the audit trail
Signs: Nothing: reads and exports only

The agents

Claim reader to commitment tracker: seven agents, and none of them rules

Each has one job and a line it does not cross.

Claim reader

Pulls each claim with its exact words and page.

Never rewords a claim
Never says a claim is true

Check builder

Turns a claim into a check against a named record.

Never invents a record
Sends judgment claims to a person

Record matcher

Reads the record and compares it with the claim.

Read only
A blank is cannot tell, never a pass

Change watcher

Pins each new record to the claims it touches.

Never closes a pin

Revision drafter

Drafts redlines and first answers to the regulator.

Works only from countersigned rulings
Never sends, and never decides whether to notify

Review preparer

Builds the thorough review file by topic.

Never states the review is complete

Commitment tracker

Tracks each promise in the case against its record.

Never closes a commitment

Safety case management calls that stay with named people

The agents read and draft. These decisions need a person, and a second person to sign.

Whether a drift is a real gapThe owner rules real gap, wording fix or not a gap. Overruling an agent's flag needs a written reason and a record the system holds.

Clearing a claim that cannot be toldOnly a new, independent record the system holds can clear it. The record that raised the flag, or a copy of it, never does.

Holding or releasing a crew planA hold takes the owner and the technical authority. It lifts only after the plan is cut and the ruling is settled.

Whether to tell the regulatorThe drafter writes a notice. Sending it or not sending it takes two people, with a reason.

Sending the revisionConsultation, a countersignature and the accountable manager's approval come first, and the revision is frozen once sent.

What safety case owners ask before they hand the reading to agents

What is safety case management?

Safety case management is the work of keeping an accepted safety case true to the facility it describes, between thorough reviews. Here agents pull each claim from the case, test the ones a record can test, and pin each change on the platform to the claims it touches. The case owner rules on each drift and a second person countersigns.

Do we have to rebuild our offshore safety case in a new notation?

No. The agents read the case as it stands, page by page, and keep each claim in its exact words with its page. Standards text is licensed, so you load your own copies.

What happens to claims no record can test?

They go to people. Some wait for a record, with the reason and the record owner shown. Others are judgment claims that a safety engineer reads and records a view on, and the technical authority countersigns. A blank record shows as cannot tell.

How does this help with the safety case thorough review?

The review starts from a register tested overnight rather than a blank page. Changes are sorted by topic with a lead for each, the system draws sample checks part by part, and the review file is drafted by topic. No agent marks it complete.

Can a crew plan really be stopped before it mobilizes?

In the working solution a hold shuts the plan's gate, and Mobilize is refused with the names of the two people who placed it. Whether your own crew planning system honors that gate is part of setting it up.

How is a safety case revision drafted?

Only from rulings two people have signed. The drafter proposes wording for each, the owner edits it, and any edit restarts the check. The revision then goes through consultation, a countersignature and the accountable manager's approval before it is sent.

HSE, Process Safety & OT Security

Bring one part of your case
and last year's crew log.

Bring one part of your case, and we’ll show its claims tested against your own records.

Book a demo Browse solutions

Safety Case Management

The case still says the refuge holds the crew, and nobody went back to check

The Problem Today

The Solution

What You Get

Safety case management on one platform, from the overnight check to Rev 7

1,788 record tests ran overnight, and 23 claims no longer hold

Sized for 96, and 104 people slept on board for 23 days

The next compressor campaign peaks at 108

A real gap, with work on the platform and a date

Countersign stays off until he has opened both sources himself

Countersigned: the work is open and the redline is in the draft

Mobilize is refused, and the screen says who holds the gate

Campaign crew 14, peak 92, about 86 days

The cut is countersigned and the gate opens at 92

Rev 7 holds 5 redlines, each from a countersigned ruling