The Function of Safety Barriers (Layers of Protection)

The use of risk controls or barriers to protect the people from hazards is a core principle of safety. Barriers are employed to serve two purposes:

1. to prevent the release of hazardous energy and to
2. mitigate harm in the event hazardous energy is released

Energy is defined broadly as used here and includes multiple forms, for example:  Kinetic, biological, acoustical, chemical, electrical, mechanical, potential, electromagnetic, thermal, or radiation.

The dynamics of accidents may be categorized into five basic components, as illustrated below:

1. the threat or triggering action or energy,
2. the prevention barrier between the threat and the hazard,
3. the hazard or energy potential,
4. the mitigation barrier to mitigate hazardous consequences towards the target,
5. the targets in the path of the potential hazard consequences

When these controls or barriers fail, they allow unwanted energy to flow, resulting in an accident or other adverse consequences.

The objective is to contain or isolate hazards through the use of protective barriers.

• Prevention barriers are intended to preclude the release of hazards by human acts, equipment degradation, or natural phenomena.
• Mitigation barriers are used to shield, contain, divert or dissipate the hazardous energy if released, thus precluding negative consequences to the employees or the surrounding communities. Distance from the hazard is a common mitigating barrier.

Barrier analysis is based on the premise that hazards are associated with all accidents

Barriers are developed and integrated into a system or work process to protect personnel and equipment from hazards. For an accident to occur, the design of technical systems did not provide adequate barriers, work design did not specify use of appropriate barriers, or barriers failed. Investigators use barrier analysis to identify hazards associated with an accident and the barriers that should/could have prevented it. Barrier analysis addresses:

• Barriers that were in place and how they performed
• Barriers that were in place but not used
• Barriers that were not in place but were required
• The barrier(s) that, if present or strengthened, would prevent the same or a similar accident from occurring in the future.

All barriers are not the same and differ significantly in how well they perform. The following are some of the general characteristics of barriers that need to be considered when selecting barriers to control hazards. When evaluating the performance of a barrier after an accident, these characteristics also suggest how well we would expect the barrier to have performed to control the hazard.

• Effectiveness – how well it meets its intended purpose
• Availability – an assurance the barrier will function when needed
• Assessment – how easy to determine whether the barrier will work as intended
• Interpretation – the extent to which the barrier depends on interpretation by humans to achieve its purpose

Categorization of Barriers

Barriers may also be categorized according to a hierarchy of cost/reliability and according to barrier function. The barrier cost/reliability hierarchy includes:

• Physical or engineered barriers – These structures are built, or sometimes naturally exist, to prevent energy flow or personnel access to the hazards. These barriers require an investment to design and build and have a cost to maintain and update. Examples: Personnel cage around a multi-story ladder, a guard rail on a platform, or a barricade to prevent access.
• Administrative or management policy barriers – These include rules, procedures, policies, training, work plans that describe the requirements to avoid hazards. These barriers require less capital investment but have a cost in the development, review, updating, training, communication, and enforcement to assure adequacy and compliance. Examples: Requirement to use harness and strap ties while climbing a multi-story ladder, a prescriptive process procedure sequence, or laws against trespassing.
• Personal knowledge or skill barriers – These include human performance aspects of fundamental lessons learned, knowledge, common sense, life experiences, and education that contribute to the individuals’ survival instincts and decision-making ability. These barriers require little or no investment except in the screening and selection process for qualified personnel used in a task and providing supervision. Examples: The decision not to climb a ladder with a tool in one hand, the decision not to violate one of the administrative barriers, or recognizing a dangerous situation.

Another analysis system divides barriers into four categories that reflect the nature of the barriers’ performance function. These four categories can be useful in the barrier analysis for characterizing more precisely the purpose of the barrier and its type of weakness. Examples for each of the four categories are as follows:

1. Physical– physically prevents an action from being carried out or an event from happening
   1. Containing or protecting – walls, fences, railings, containers, tanks
   2. Restraining or preventing movement – safety belts, harnesses, cages
   3. Separating or protecting – crumple zones, scrubbers, filters
2. Functional– impedes actions through the use of pre-conditions
   1. Prevent movement/action (hard) – locks, interlocks, equipment alignment
   2. Prevent movement/action (soft) – passwords, entry codes, palm readers
   3. Impede actions – delays, distance (too far for single person to reach)
   4. Dissipate energy/extinguish – air bags, sprinklers
3. Symbolic– requires an act of interpretation in order to achieve their purpose
   1. Countering/preventing actions – demarcations, signs, labels, warnings
   2. Regulating actions – instructions, procedures, dialogues (pre-job brief)
   3. System status indications – signals, warnings, alarms
   4. Permission/authorization – permits, work orders
4. Incorporeal– requires interpretation of knowledge in order to achieve their purpose
   1. Process – rules, restrictions, guidelines, laws, training
   2. Comply/conform – self-restraint, ethical norms, morals, social or group pressure

There is typically a defense-in-depth policy for reducing the risks of a system failure or an accident due to the threats. This policy maintains a multiple-layered barrier system between the threats or hazards and the requirement to correct any weaknesses or failures identified in a single layer. Therefore, an accident involving such a protected system requires either a uniquely improbable simultaneous failure of multiple barriers, or poor barrier concepts or implementation, or a period of neglect allowing cascading deterioration of the barriers.

Defense-in-depth can be comprised of layers of any combination of these types of barriers.

It is much more difficult to overcome multiple layers of physical or engineered barriers. This is the most reliable and most costly defense. Risk management analysis determines the basis and justification for the barrier reliability and investment level based on the probability and consequence of a hazard release scenario. For low probability, low consequence events, the level of risk often does not justify the investment of physical barriers.

Cost and schedule-conscious management may influence the selection of non-physical barriers on all but the most likely and catastrophically hazardous conditions. Such choices rely on layers of the less reliable barriers dependent on human behavior. Adding multiple barrier layers can add more confidence, but multiple layers may also lead to complacency and diminish the ability to use and maintain the individual barrier layers. Complex barrier systems and barrier philosophies place heightened importance on the context of organizational culture, and human performance becomes a major concern in the prevention of accidents as barrier systems become more complex and individual barrier layer functionality becomes less apparent.

A cascading effect can occur in aging facilities. Engineered barriers can become out-of-date, fall into disrepair or wear out; or be removed as part of demolition activity. Management should transition to reliance on a substitute administrative barrier, but this need may not be recognized.

For example, a fire protection system, temporarily or permanently disabled, is replaced by a fire watch until the protection system is restored, replaced, or the fire potential threat is removed.  Administrative barriers may weaken due to inadequate updates to rules, inadequate communication and training, and inadequate monitoring and enforcement. This results in management’s often unintentional reliance on personal knowledge barriers. Personal knowledge barriers can be weakened by inadequate screening for qualifications, inadequate assignment selections, or inadequate supervision.

An alignment of cascading weaknesses in barriers can result in an unqualified worker unintentionally violating an administrative control and defeating a worn-out physical barrier to initiate an accident. Effective management of any of the barriers would have prevented the accident by breaking the chain of events. Therefore, investigating a failure of defense in depth requires probing a series of management and individual decisions that form the precursors and chain of actions that lead to the final triggering action.