Preventive Barriers, Outcomes and Points of Intervention

A follow-up to the Operations BowTie, this time on the left side. A preventive barrier should not be marked green simply because it exists. The article proposes a three-state view of barrier health, effective, degraded, and failed or unknown, with a defined operational response for each, and sets out the routine questions that reveal which state a barrier is actually in. The worked example is the EPD: having one means the barrier exists, an unreviewed plant change means it is degraded, and assumptions that no longer match reality mean it has failed.

A machinist in a blue hard hat operates a metal lathe in a dimly lit workshop.

As a follow up of my recent discussion with Head of Operations we reviewed the barriers

For preventive barriers, the POI is: “What must Operations routinely verify to know this barrier is actually working?”

So the outcome we want from every preventive barrier is essentially:
The threat is intercepted before the plant leaves its demonstrated Ex-safe condition.
Head of Operations — Preventive barriers, outcomes & POIs

A table listing Ex-safety preventive barriers with their desired operational outcomes and the Head of Operations' decision points.

The second layer I would add here: barrier health.
A preventive barrier should not simply be shown as green because it exists.

For the Head of Operations, each barrier should effectively have three possible outcomes:
GREEN — EFFECTIVE Barrier exists, is current, adequately resourced and demonstrably working. → Continue
AMBER — DEGRADED Barrier still provides protection, but weakness/degradation exists. → Assess → temporary controls → owner → deadline → monitor
RED — FAILED / UNKNOWN Barrier cannot perform its intended function, or its effectiveness cannot be demonstrated. → Restrict / escalate / STOP depending on significance

The Head of Operations’ POIs are questions such as:
Are inspections actually completed? Are critical findings open? Is there an inspection backlog? Are identified defects being corrected? Has equipment condition changed since inspection? Can we still demonstrate Ex integrity?
If those answers deteriorate, the barrier itself becomes degraded.
Same with the EPD/HAC:
Having an EPD = barrier exists.
Plant changed but EPD not reviewed = barrier degraded.
EPD assumptions clearly no longer represent reality = barrier failed.
And that leads to what I think should be the central management message of this part of the BowTie:

The Head of Operations does not only manage threats.

The Head of Operations must know whether the barriers preventing those threats from reaching the Top Event are actually effective.

So any developing model becomes very clean:
THREAT → POI → PREVENTIVE BARRIER → BARRIER HEALTH → OPERATIONAL DECISION → TOP EVENT prevented
And when the barrier is degraded:
DEGRADATION / BLOCKING ELEMENT → POI → assess → restore / compensate / restrict / STOP

Preventive Barriers, Outcomes and Points of Intervention

Topic