What makes a barrier critical?
A safety barrier prevents an unwanted event or limits its consequences. It is considered critical when it plays an essential role in a serious scenario and its absence or failure could significantly compromise protection. The selection should be based on an analysis of the scenario, not solely on the cost or size of the equipment.
The terminology doesn’t diminish the importance of other controls. Its purpose is to focus specific attention on functions that need to remain reliable. An inventory where everything is declared critical without criteria loses its usefulness for prioritizing checks and decisions. It’s advisable to explain why each barrier has been selected and what scenario it controls.
Relationship with risk analysis
Bow-tie analysis helps to link threats, the central event, consequences, and barriers. From this relationship, one can examine what prevents a loss of control and what limits the damage if it occurs. A single barrier can contribute to several scenarios, which increases the importance of understanding their dependencies.
In process safety, classification can be supplemented with other studies. When using LOPA, accreditation as an independent layer requires additional specific requirements. Designating a barrier as critical does not, in itself, demonstrate its independence or authorize assigning it a specific probability of failure.
Define a testable function
The description should specify what the control should do, in what situation, and under what conditions. Expressions like “safe equipment” or “trained personnel” are too general for verifying performance. It’s important to distinguish the barrier itself from the activities that support it, such as maintenance, training, or document review.
Requirements may relate to capacity, response, availability, integrity, or conditions of use, depending on the function. They must be derived from analysis and appropriate technical criteria. A useful specification allows the verifier to know what to look for and the operator to understand when the protection is no longer sufficient for the intended task.
Factors that degrade protection
Barriers can deteriorate due to wear, corrosion, dirt, configuration changes, or incomplete maintenance. They can also lose effectiveness due to organizational conditions: confusing instructions, lack of resources, or a workload incompatible with the required performance. The review should consider how this degradation occurs in practice.
Changes deserve special attention. A modification can alter a response time, an interface, or an independence condition without physically removing the equipment. Change management must verify these relationships. Temporary overrides and out-of-service protections require explicit handling and should not be normalized by custom.
Verify design and implementation
Verification asks whether the control is suitable for its purpose and whether it is actually implemented and functioning. These are distinct issues: a piece of equipment may be present but insufficient for the scenario; it may also be well-designed but unavailable. Verification methods must address both needs.
The frequency, scope, and required competence are defined according to the risk and the function. Equipment inspection may be part of this verification, along with testing or practice reviews. The record must contain results and criteria, not just a “completed” checkbox. An inspection date does not automatically certify the control status.
Responsibility and response to failures
Each barrier must have a clearly defined responsibility for maintaining its performance and addressing any deviations. Those working with it need clear criteria for not starting a task, or for stopping or modifying it, when protection is lacking. Information must escalate to those who can make decisions and allocate resources.
Interim measures require evaluation and monitoring. Simply increasing vigilance while essential protection remains disabled is insufficient. The permitted condition, applicable restrictions, and the procedure for closing the deviation must be clearly defined. The organization needs to support the reporting of failures so that a detected problem is not hidden by production pressures.
Practical example
A workshop identifies an interlocking function as critical for preventing access to a hazardous area during movement. It defines what situation the system must detect and what response it must produce. The verification is not limited to checking that the device is installed; it examines the function and relevant conditions according to the technical procedure.
If an override or fault is detected, the equipment is prevented from being used in a condition incompatible with the protection, and repair is initiated. Before returning it to service, the required function is verified. This example illustrates control management; it does not replace the design or safety validation of a specific machine.
Indicators and learning
Leading and lagging indicators can show pending verifications, detected failures, downtime, and recurrence of deviations. They should be interpreted in relation to the specific scenarios and not become a competition to complete forms. Detecting a failure early can be a useful indicator of the verification system’s functionality.
The analysis of incidents and outcomes should review whether the selected barriers are appropriate and whether their requirements remain valid. Management improves when each critical control has a clearly understood function, convincing verification, and an effective response to performance loss.
