Bowtie methodology’s independence test is usually applied to equipment: does one barrier share a component, a power source, or a sensor with another barrier on the same threat line? That test catches a real and well-understood failure mode. It does not, on its own, catch a second version of the same problem — where the equipment is genuinely independent, but the human verification of both barriers is not.
Two Tests, Same Technician
At a petrochemical storage terminal in Malaysia, a Bowtie diagram for a major hazard scenario showed two barriers on the same threat line: a relief valve set-pressure test and a high-pressure trip function test. The equipment was genuinely different — different components, different failure modes, independent by any equipment-level reading of the diagram.
Both tests happened to fall in the same maintenance window and were signed off by the same technician, working alone, against the same checklist, within the same two-hour period before a shift change. The equipment was independent. The verification was not.
When the trip function later failed to activate during an actual pressure excursion, the post-incident check found that the trip’s isolation valve had been left in the wrong position after that combined test window — a single transposition error the technician made once, which silently affected both barriers he had just verified as functioning correctly.
What “Independent” Actually Means in Bowtie Methodology
Bowtie applies two tests to every barrier before it counts as a genuine, standalone layer of protection: whether it is Specific — performing one clearly defined function — and whether it is Independent — able to function without relying on another system or condition being correct first. The equipment-sharing version of the independence test is well known in Malaysian process safety practice. A less commonly applied extension of the same test asks whether the verification of each barrier is independent: could a single point of human error, occurring once, invalidate confidence in more than one barrier at the same time?
In this case, the answer was yes. A shared technician, working the same checklist in the same short window, meant that one transposition error had the practical effect of a common cause failure — even though nothing about the physical equipment was shared at all.
Why This Version of the Gap Is Easy to Miss
Common cause failure through shared equipment is relatively straightforward to trace on a Bowtie diagram or a piping and instrumentation drawing — the shared component is a physical thing that can be identified and documented. A shared verifier working within a shared time window leaves no equivalent physical trace on the diagram itself. The diagram shows two barriers, correctly labelled as independent by equipment, and gives no visual indication that both were tested by one person in the same sitting.
CIMAH 1996 and Genuine Layered Protection
Under Malaysia’s Control of Industrial Major Accident Hazards Regulations 1996, major hazard facilities are expected to demonstrate genuine layered protection against major accident scenarios. A safety case document that lists two barriers as independent, where both were in practice verified by the same person within the same short window, satisfies the letter of having two documented barriers without necessarily satisfying the substance of the independence requirement — particularly where the verification method itself introduces a shared point of failure.
Extending Barrier Verification Scheduling
Closing this gap does not require adding barriers or equipment. It requires extending how verification scheduling is planned: staggering which technician tests which barrier, or at minimum flagging when two barriers on the same critical threat line are scheduled for verification by the same person within a short window, so that a reviewer can decide whether that overlap is acceptable for that specific pairing. This is a scheduling and review design change, not a hardware investment.
Auditing Your Own Bowtie for This Pattern
For barrier pairs on the same threat line in a facility’s Bowtie diagrams, it’s worth checking not only whether the equipment is shared, but who signed off the most recent verification of each barrier, and when. If the same name appears against both, in the same short window, the diagram’s promise of two independent layers of protection may not be holding in practice — even though every individual line on the diagram is accurate.
A Practical Test for Verification Independence
A useful working rule for facilities auditing their own barrier verification schedules: for any two barriers on the same critical threat line, check whether the same person verified both within a period short enough that a single lapse in attention, a single procedural shortcut, or a single transposition error could plausibly have affected both outcomes. There’s no universal threshold for what counts as “too short” — a two-hour window before shift change, as in this case, is an obvious example, but the underlying question scales to any situation where one person’s judgement or execution is the common thread linking two supposedly independent results. Where that overlap exists on a barrier pair protecting a major hazard scenario, it’s worth deciding deliberately whether the risk is acceptable, rather than discovering the overlap only after an incident forces the question.
Making This Part of Routine Bowtie Governance
Facilities that build barrier-pairing checks into their standard verification scheduling — flagging, at the point of scheduling rather than after an incident, whenever two barriers on the same pathway are assigned to the same technician within a short window — close this gap without needing to add barriers, equipment, or headcount. The change is procedural: a scheduling rule, reviewed periodically alongside the Bowtie diagram itself, rather than a one-time audit finding.
Learn to test barrier independence rigorously — not just equipment independence. Cikgu Barrier’s Barrier Management: Bowtie Analysis program teaches Malaysian HSE teams advanced Bowtie practice, including CIMAH 1996 compliance for major hazard facilities and verification-level independence testing. Register your interest in upcoming public and in-house dates — no cost, no commitment.