One of the most important facts about major industrial incidents is that the barriers were usually there. The safety systems existed. Some were recently inspected. Some passed their most recent audit. They failed anyway — not by accident, but by following patterns that are recognisable, traceable, and preventable.
Understanding why barriers fail — the barrier failure modes Malaysia investigators encounter repeatedly — is as important as designing them correctly in the first place.
Failure Mode 1: Bypassed
A barrier is bypassed when a person or team takes a shortcut that removes the barrier from the sequence of events. The permit wasn’t raised. The isolation wasn’t completed. The interlock was defeated. The confined space wasn’t tested before entry.
These acts look like individual failures — and they are, at the level of the Substandard Act. But barrier bypass investigations that stop at the individual miss the more important question: why did the system allow this bypass to occur without detection or consequence?
A bypass that goes undetected for one shift will occur again. A bypass that goes undetected for six months has become the de facto practice. By the time it produces an incident, it is no longer a deviation from the norm — it is the norm, accepted through tolerance, visible to supervision, and embedded in how the site actually operates. The individual who eventually gets hurt is rarely the person who established the shortcut.
Failure Mode 2: Degraded
A barrier that is degraded still exists. It appears on the Bowtie. It passes its scheduled inspections. It provides no meaningful protection against the event it was designed to prevent.
Degradation happens gradually and visibly to anyone who is looking. Alarm suppression that accumulates month by month until the alarm system is effectively silent. A pressure relief valve whose disc has been underperforming since a partial blockage that maintenance didn’t fully resolve. A guard whose retention mechanism was reinstalled incorrectly after a maintenance job six months ago and hasn’t seated properly since.
Degraded barriers are more dangerous than missing barriers in one specific way: they produce false assurance. The inspection record says the barrier is present. The maintenance log shows it was serviced on schedule. The risk assessment lists it as a control. Everyone involved in managing the hazard believes the protection is in place — and it isn’t.
Finding degraded barriers before they fail during an incident requires a verification approach that goes beyond confirming presence to testing function under realistic conditions. The question isn’t whether the alarm activates — it’s whether it activates at the right threshold for current process conditions.
Failure Mode 3: Not Independent
Two barriers that share a critical failure point are not two barriers. They are one barrier with two names and a doubled false sense of security.
Common cause failure — where a single root cause disables multiple barriers simultaneously — is one of the most dangerous patterns in layered protection design, precisely because it is invisible until something goes wrong. Two barriers that both depend on the same operator being present, attentive, and correctly informed fail together under any circumstance that affects that one person. Two alarms that both read from the same sensor fail together when the sensor drifts or fails.
In Bowtie barrier analysis, independence is not assumed — it is verified. For any two barriers on the same Bowtie pathway, the independence test asks: is there a single failure mode that could disable both of these simultaneously? If yes, the number of independent barriers is one, not two, regardless of what the diagram shows.
Failure Mode 4: Wrong Scenario
A barrier designed for yesterday’s hazard profile provides uncertain protection for today’s. When operating conditions change — equipment is modified, throughput is increased, chemicals are substituted, new contractors bring different procedures — the barriers that were designed around the original conditions may not cover the evolved scenario.
This failure mode is produced by the gap between when barriers are designed and when Bowtie diagrams are reviewed. A Bowtie completed at commissioning reflects the hazard scenarios that existed at commissioning. Three years of operational changes, modifications, and process evolution may have produced a significantly different set of scenarios — with the original barriers still listed, still passing function tests, and now covering hazards that have partially or fully moved.
The sign that a barrier may be in wrong-scenario failure is a Bowtie diagram that has never been revised after a significant operational change. Not necessarily because the diagram is wrong about the original design — but because the original design is no longer an accurate description of what’s happening.
Finding Failure Modes Before Incidents Do
The investigator’s skill is recognising these barrier failure modes Malaysia patterns in post-incident analysis. The risk manager’s skill is finding them in routine verification before any incident occurs.
For each of the four failure modes, there is a corresponding verification question. For bypassed barriers: is there evidence that the barrier is consistently applied in practice, not just in documentation? For degraded barriers: does the verification confirm function at the correct threshold, not just presence? For non-independent barriers: is there a common cause that could disable multiple barriers simultaneously? For wrong-scenario barriers: has the barrier been reviewed against current operating conditions since the last significant change?
None of these questions are complex. All of them require someone to ask them deliberately, on a regular basis, rather than waiting for an investigation to ask them after the fact.
Want to build Bowtie diagrams that identify failure modes before incidents find them? Cikgu Barrier’s Barrier Management: Bowtie Analysis program teaches teams how to design, validate, and maintain barriers that hold under real operating conditions — not just under audit conditions. Available in-house and as a public workshop across Malaysia. For more on barrier management standards, see DOSH Malaysia’s guidance on safeguard effectiveness.