botminds.aiRequest a demo
SystemAsset Integrity & Inspection

Safety-Critical Element Management

Safety-critical element management software that asks of each criterion whether it could ever fail, then reads the test reports against the answer.

See the demoBook a demo
Follow one firewater standard from 10:41 to 10:47 ↓
The problem

Performance standards nothing could fail, and reports nobody holds to them

A performance standard is the promise an element has to keep, and plenty of them are written so that no result could break it: adequate flow, good condition, as appropriate. The test runs, the work order closes, and the contractor writes that the pump delivered adequate flow. Nobody lays the curve over the design study, because the standard gives no number to lay it against.

So the maintenance system reads complete while the proof underneath is thin. Contractor PDFs land faster than the element owner can open them, the verifier samples what it can on a visit, and an out-of-service note can rest on a pump that nobody has shown meets its duty.

Built forElement ownersTechnical authoritiesMaintenance plannersIndependent verifiersAssurance auditors

The Problem Today

Standards say adequate flow, so a report can record a shortfall and nobody has to act.

19%
of offshore audit deficiencies fell under mechanical integrity published
1,638
hours to reread 2,184 test reports by hand, at 45 minutes each our estimate

Compared by hand today

  • Standards
  • Reports
  • Work orders
  • Findings
  • Lists drift from the plantChanges reach the element list late, or not at all
  • Verifiers can only sampleReports arrive faster than anyone can read them

The Solution

  1. Could this ever fail?Each criterion checked for a measure, a limit and a test
  2. Wording from the studyProposed only from a number on a cited page, or not at all
  3. Reports read against itContractor files read page by page, with the shortfall and its page
  4. People decideThe owner accepts; the technical authority countersigns and opens findings

Built-in controls

  • Whoever accepts a wording cannot countersign it
  • A deferred or bypassed test leaves its letter dark
  • Agents do not pass or fail equipment

What You Get

Owners, verifiers and auditors share one board where each lit letter rests on a result and its page.

  • Standards that can failWording proposed only from a cited study page
  • Shortfalls already on fileOld results read against the new limit, with the page
  • A statement that stays trueAn open critical finding stops the quarterly signature
One morning on the board

10:41 to 10:47: a firewater pump standard meets its own test sheet

An offshore platform with two diesel firewater pumps. The B pump is already out for a gearbox overhaul, and the standard for both still says adequate flow. Here is that morning as the team worked it.

demoThe platform, the crew and the numbers on these screens are sample data.

  1. 0106:02

    84 of 130 letters lit, while closed work orders call 128 of them done

    Element owner

    Twenty-six element groups sit on a dark board, five letters each. A letter lights only when its criterion can fail and a current result passed it. This morning 84 are lit, 29 are words only, 10 have no current result and 7 have failed. The owner’s next step points at the firewater pumps.

  2. 0210:41

    Adequate flow: a firewater pump criterion that no test result could miss

    Element owner

    The standard asks the firewater pumps for adequate flow to the ring main. The standards reader quotes the word at fault and explains it: adequate has no number, so any flow would pass and a report could say anything. Under it sits the proposed wording, each pump delivering at least 2,400 gpm at 145 psi net at its discharge within 30 seconds of a start signal.

  3. 0310:41

    Page 22 of the firewater study holds the sum behind 2,400 gpm

    Element owner

    The cited page opens beside the letter with the demand lit. The largest single fire, on the process deck, needs 1,900 gpm of deluge plus two hose streams of 250 gpm. Pressure adds 60 psi at the farthest nozzle, 52 for 120 ft of lift and 33 for ring main and riser friction, which makes 145 psi net at the pump discharge.

  4. 0410:42

    Countersign appears only once the checker has opened the study page

    Offshore technical authority

    The owner accepts the wording, and the letter moves to the technical authority. On the owner’s own screen it says plainly that the person who accepted cannot check the decision. Acting as the checker, the panel reads accepted, you have opened the source, and only then do the countersign and send-back buttons show. A send-back clears the record for a fresh check.

  5. 0510:43

    Read against the signed limit, pump A gives about 2,210 gpm at 145 psi

    Report reader and technical authority

    Countersigning sets the report reader on the reports already filed. The letter turns failed. Its current result reads about 2,210 gpm at 145 psi against a limit of 2,400, and the chart of four annual tests shows the pump sliding: 2,610, 2,460, 2,340, then 2,210. Pump B meets the limit on its own page but is out for overhaul. A critical finding is proposed.

  6. 0610:43

    Churn and the 150% point both pass, so the sheet raised no action

    Offshore technical authority

    Page 14 of the contractor’s annual test opens with its lines lit: churn at 180 psi, 2,500 gpm at 138 psi, which is 92% of rated pressure, and 3,750 gpm at 101 psi, 67%. The contractor checked churn under 140% and the 150% point over 65%, found both inside, and wrote adequate flow, no action. Nobody had held the curve against the study until now.

  7. 0710:43

    One failed letter takes the ring main, deluge and helideck dark with it

    Offshore technical authority

    Back on the board, interdependence is computed. Availability fails too, because the out-of-service entry for pump B rests on pump A meeting its flow. The ring main, deluge and helideck letters need a pump that meets its flow, so they fail with it. Lit stays at 84; words only falls to 28, no current result to 6, and failed rises to 12.

  8. 0810:44

    The installation manager hears at 10:44, with two hours to record a call

    Offshore installation manager

    The finding sets out three sums from page 14 and the study: 190 gpm short at 145 psi, 140 psi from pump A at 2,400 gpm against 145, and 55 psi at the farthest nozzle against 60. It says it is no judgment on whether the platform may keep running. The manager types the platform decision, marked for a person to read rather than for software to compare.

  9. 0910:46

    Page 14 is read in a window before the finding opens as critical

    Offshore technical authority

    The technical authority reads the manager’s decision, opens the test page from the finding itself, then opens it as critical with the reason: result below, and no other unit in service meets it. Beside it, what it stops is listed in plain words. Date changes on the firewater pump tests are held, the assurance statement cannot be signed, and the owner’s response clock is running.

  10. 1010:47

    The quarterly statement stops on the finding, and the retest is planned

    Technical authority and maintenance planner

    The draft statement now reads 84 proved, 28 words only, 6 with no current result and 12 failed, with 12 open findings, 1 of them critical. Its decision panel says stopped and names the finding. The statement says what the records show and leaves safety to the people named on it. The planner books the retest.

Pump A on its annual test, against the 2,400 gpm the study asks for

The points the contractor measured, and the point the study needs, on one curve.

Point on the curveFlow, gpmNet psiAgainst the limit
Churn0180120% of rated, under the 140% cap
Rated, 100%2,50013892% of rated pressure
Peak, 150%3,75010167%, over the 65% minimum
Study demand2,400145The new criterion
Pump A at 145 psiabout 2,210145190 gpm short

demoSample data, from the working solution. Both checks the contractor ran pass. Only the new criterion shows the shortfall.

Seven results short of a limit, filed with no action raised

What the board turned up on the sample platform before anyone signed the quarter.

Criteria nobody could fail

29 of 130 were words only: adequate, good condition, as appropriate.

Shortfalls already in the reports

7 results on file fall short of a proposed criterion, such as 11 of 12 deluge skids opening on first demand.

An old limit counted as proof

A riser shutdown valve closed in 52 s against the 45 s the safety case allows. The 60 s printed on the test sheet is out of date.

A bypass read as a pass

A process trip in bypass and an inhibited gas detector leave their availability letters failed, citing the bypass log.

demoSample data, from the working solution.

Around the board

Safety-critical element management, from the element list to the audit trail

The rest of the team’s screens, on the same platform. Pick one to see it full size.

As reportedThe same board as the maintenance system tells it: 128 of 130 letters closed. One switch turns it back to the 84 that are proved.
Could this ever fail?Each criterion that is words only, with the proposal beside it. A batch of 6 signs only after the checker opens the 2 records drawn for the sample.
Contractor reports2,184 reports from the last 24 months. Seven results fall short of a proposed criterion, and three files it could not read are held for a person.
Element listNine differences against drawings, the maintenance system, change records and the fire study. An added tag needs a test; a removed one needs a closed change record.
Assurance testsThe retest at churn, 100% and 150% is planned. Five firewater pump tests are stopped by the critical finding and cannot change date.
Audit trailFiltered to one finding: proposed, sent to the installation manager, the platform decision, opened as critical, retest planned. Each line names its person or agent.

demoSample data, from the working solution.

The owner accepts, the technical authority countersigns, the verifier reads

Two signatures on each criterion, and a person on each finding.

Element owner
Sees
The board, the words-only queue and the findings on each standard
Signs
Accepts, edits or rejects proposed wording, and answers findings inside the clock
Offshore technical authority
Sees
The source page behind each accepted criterion, opened before signing
Signs
Countersigns or sends back, opens findings and signs the quarterly statement
Offshore installation manager
Sees
Each critical finding the moment it exists, with its sums
Signs
The platform decision, and a second name on any declined critical
Maintenance planner
Sees
Tests past date, deferred, bypassed and stopped, kept apart
Signs
Plans retests and asks for new dates through the deferral process
Independent verifier
Sees
All of it
Signs
Raises and reopens findings, and changes nothing else
Assurance auditor
Sees
The board, the evidence and the trail, without edit rights
Signs
Nothing; samples and downloads the evidence
The agents

Six agents read standards and reports, and none passes equipment

Each one reads, proposes or keeps a clock, and hands to a named person.

Standards reader

Asks of each criterion whether it could ever fail, and quotes the word at fault.

  • Never rewrites a standard
Design basis finder

Proposes measurable wording from a numbered page of the design study.

  • Never invents a limit
  • Never proposes wording weaker than the study
Report reader

Reads contractor reports against the signed criterion, page by page.

  • Never passes or fails equipment
Element list keeper

Compares the element list with drawings, the maintenance system, change records and the fire study.

  • Never adds or removes a tag
Finding tracker

Watches finding clocks and drafts responses for the owner.

  • Never closes a finding
  • Never says whether equipment may run
Evidence assembler

Builds the evidence file for the verifier and the auditor.

  • Adds nothing that is not on file

What element owners ask about safety-critical element management

What is safety-critical element management?

Safety-critical element management keeps three things true: the list of elements whose failure could cause or worsen a major accident, the performance standard each must meet, and the evidence that it does. This solution tests each criterion for a measure, a limit and a test, proposes wording from the design study, and reads contractor reports against it for people to sign.

What does FARSI mean in a performance standard?

Functionality, availability, reliability, survivability and interdependence. Here each group carries one letter for each, holding the hardest criterion in its standard, and a letter lights only when that criterion can fail and a current result passed it.

How does it decide whether a criterion could ever fail?

The standards reader looks for a measure, a limit and a test. Where one is missing it quotes the word at fault, such as adequate. The design basis finder then proposes wording only from a number on a cited page, and says so when no such page exists.

Does it read contractor test reports?

Yes. Once a criterion is signed, the report reader goes back through the reports already filed and compares each result with the new limit, citing the page. A file it cannot read is held and sent to a person.

How does the independent verifier use it?

The verifier reads the board, the standards, the source pages, the findings and the trail, can raise a finding and reopen a closed one, and has no button that signs or changes anything else.

What happens when a critical shortfall is found?

It goes to the offshore installation manager at once, with a short clock to record the platform decision. Date changes on that element’s tests stop, and the quarterly statement cannot be signed. Only a passing result dated after the finding, with its page opened, can close it.

Does a deferred test or a bypass count as proof?

No. A test under deferral or an element in bypass leaves its letter unlit, and the screen cites the deferral or bypass entry. The setting for how long a result stays current can only shorten it, and a change needs the owner to propose and the technical authority to sign.

Asset Integrity & Inspection

Other asset integrity solutions

All 8 solutions →
Asset Life Extension

One earliest limit with its evidence, not six separate reports.

1-min demoMechanical Integrity Audit

Every inspection record tested, and the ones that could not be, counted.

1-min demoIntegrity Operating Windows

Exceedances answered with so what, and only a person moves the date.

1-min demo

Bring one performance standard
and the test reports behind it.

We’ll read your own standard against your own contractor reports with you, page by page.

Book a demoBrowse solutions