A fixed gas detector at a gas-processing facility sat on a monthly calibration schedule for over a year. It passed every check. It was logged as compliant on every audit. When a flange gasket failed during a routine changeout, the detector read normal for six minutes before anyone smelled gas manually.
This is a composite scenario, built from patterns seen across LNG and gas-processing sites in Malaysia — no single company, site, or individual is identified. But the pattern itself is common enough to be worth examining directly, because it exposes a gap that most maintenance and inspection programmes in Malaysia don’t test for: the difference between a barrier that’s compliant and a barrier that’s verified.
What the Calibration Schedule Actually Tested
The monthly calibration check on that detector tested one thing: whether the sensor responded correctly to a reference gas at a fixed concentration, delivered directly to the sensor head. That’s a legitimate test, and it’s the test most calibration programmes are built around. It confirms the device functions.
What it never tested was whether the detector’s physical placement — its position relative to the dominant airflow pattern for that unit — actually put it in the path of a real leak from the equipment it was meant to protect. A detector can pass a calibration test perfectly and still sit somewhere a leak plume would never reach it in a survivable amount of time. Calibration confirms the sensor works. It says nothing about whether the sensor is positioned to detect the failure it exists to catch.
Compliant Is Not the Same as Verified
This distinction matters because “compliant” and “verified” get treated as synonyms in a lot of Malaysian HSE practice, and they aren’t. A compliant barrier has a maintenance record, a test log, and a pass mark on the last audit. A verified barrier has all of that, plus evidence that it’s actually positioned, rated, and maintained to intercept the specific failure mode it’s meant to stop — not just functioning in isolation.
The gap between the two rarely shows up in routine operation, because most barriers are never actually tested against a real event — only against a reference test designed to be repeatable and auditable. It shows up exactly once: when the real failure happens, and the barrier either catches it or doesn’t.
How a Bowtie Diagram Forces the Verification Question
This is the specific gap barrier-based risk management — Bowtie analysis — is built to close. A Bowtie diagram doesn’t just list a gas detector as a control measure and move on. It requires the detector to be drawn as a barrier sitting in a specific position between a specific threat (in this case, a flange gasket failure releasing gas) and a specific top event (loss of containment reaching a hazardous concentration in an occupied area).
Once a barrier is drawn that way, two questions become unavoidable, in a way they aren’t when the same barrier is just a line item in a maintenance schedule or a HIRARC control column:
Does this barrier’s position actually align with the threat it’s meant to catch? A detector’s location relative to airflow, elevation, and the specific equipment it’s protecting has to be justified, not assumed. If the diagram forces you to draw the line from threat to barrier to top event, a barrier sitting outside that line is visibly wrong — not buried in a spreadsheet where a green “compliant” cell looks the same regardless of position.
What could degrade this barrier without failing its routine test? In Bowtie terms, this is an escalation factor — a condition that quietly reduces a barrier’s real-world effectiveness without ever showing up as a failed calibration. Airflow patterns changing after nearby equipment modifications. A detector rated for a different gas mixture than what’s actually present at that unit. These conditions can exist for years without a single failed test, because the test was never designed to catch them.
Why This Matters Beyond Gas Detection
The same pattern applies to almost any barrier that gets reduced to a pass/fail maintenance check: relief valves tested for set pressure but not flow capacity under the actual failure scenario, fire dampers tested for closure but not for the specific fire load they’re meant to contain, isolation procedures verified as “followed” without checking whether the isolation point actually covers every energy source involved. In every case, the barrier passes its test and still isn’t verified against the specific threat it exists to stop.
Ini bukan soal patuh kepada jadual penyelenggaraan sahaja — ia soal sama ada halangan itu benar-benar berada di tempat yang betul untuk menghalang kegagalan sebenar. A maintenance-compliant barrier and a verified barrier are not automatically the same thing, even when the paperwork looks identical.
Making Barrier Verification Standard Practice
Closing this gap doesn’t require replacing existing maintenance and calibration programmes — those remain necessary. It requires adding one layer on top: for every barrier considered critical, someone has to be able to answer, in specific terms, what threat this barrier is positioned against, and what would need to change for that barrier to stop working despite passing its routine test.
That question is exactly what a Bowtie diagram is built to force — not as a one-time documentation exercise, but as a way of thinking about every critical barrier in a facility. A barrier that only exists as a row in a spreadsheet can look perfectly compliant while sitting nowhere near the failure it’s meant to catch. A barrier drawn on a Bowtie has to justify its position, every time.
Want your critical barriers tested against real failure modes, not just routine maintenance checks? Cikgu Barrier’s Bowtie Analysis training teaches HSE teams in Malaysia how to map threats, barriers, and escalation factors so that every critical control is verified against the specific failure it exists to stop — not just logged as compliant. Available in-house and as a public workshop.