Coverage geometry, not device health. A detector reporting healthy tells you the device works — not that the hazard is covered.

Your safety case was written for a plant that no longer exists in that form. Equipment has moved. Units have been modified. Detectors have been isolated, replaced, or left in place while the hazard they were covering shifted three metres. The design intent is still on file. Whether it still describes the plant is a different question.

What this pillar does

• Fire and gas detection coverage with gap analysis — where the protection actually reaches, and where it does not
• Barrier availability and impairment monitoring — which barriers are degraded or bypassed right now, not at the last audit
• Dynamic coverage intelligence — coverage recalculated as the plant, the equipment and the hazard sources change
• Version-controlled safety governance dashboards — every change traceable to who, when and why
• Evidence-backed compliance proof — the documentation an auditor asks for, produced from live data

Coverage analysis

Coverage assessment is performed against Shell DEP 34.11-20 coverage analysis methodology alongside the facility's own governing standards. Independent HSE analysis of fire and gas detection performance has found 36–69% of releases going undetected by installed detection systems.

Source: UK Health and Safety Executive, Research Report RR672, Accident statistics for fixed offshore units on the UK Continental Shelf — detection performance analysis.

Who delivers what

Barrier Intelligence develops the platform — its products are Assure3D and AssureLive. Fortis EI integrates it with your fire and gas system, your instrumentation and your existing safety documentation, and supports it through the lifecycle.

Functional safety fails in the middle of the lifecycle, not at the start. The SIL study was done properly. The SIS was built to it. Then five years of modifications, bypasses, deferred proof tests and personnel changes accumulated, and the question "is this loop still achieving the SIL it was assessed at" became genuinely difficult to answer.

Across the lifecycle

• Hazard and risk assessment, and SIL determination
• Safety requirement specifications written to be verifiable, not just approved
• SIL verification — probability of failure on demand, architectural constraints, systematic capability
• Proof-test interval review and proof-test procedure development
• Safety lifecycle audit and revalidation against IEC 61511 and IEC 61508
• Fire and gas philosophy and detection layout, including coverage assessment per Shell DEP 34.11-20 coverage analysis
• Management of change support for the safety documentation that MOC is outrunning

Who does this work

Led by Dr. Satheesh Kumar, author of Mastering Fire and Gas Detection Systems and holder of a seat on the ISA84 standards committee — WG7, and informational member of WG10, Digitalization of the Safety Lifecycle. WG10 matters here: it is the committee working on exactly the problem this pillar and Pillar 01 address together.

Digitalising the safety lifecycle

Most functional safety work still runs on spreadsheets and flat files: the SIL calculation in one workbook, the SRS in a document, the cause-and-effect matrix in a third place, and no link between them when something changes. Fortis EI deploys aeShield to move that work onto a data-centric platform — SIL verification, PHA, LOPA, lifecycle management and instrument testing in one model, with templates for SIL calculations, SRS, cause-and-effect matrices and test plans so a change is made once and carried everywhere it appears.

The commercial argument is the one that lands with a project director: flat-file execution costs manhours twice, once to produce the deliverable and again to reconcile it after every modification. A data-centric approach is what makes IEC 61511 compliance repeatable across a portfolio rather than re-argued on every project.

Most methane numbers in this industry are calculated, not measured. Emission factors multiplied by counts, submitted with a reporting level that acknowledges the estimate. That worked while nobody checked. OGMP 2.0 asks you to climb toward measurement-based reporting, and satellite observation means a number that does not match reality is now visible to people outside your organisation.

Measure it, then reduce it

This pillar has two halves and both matter. Measurement gives you a defensible number. Reduction changes it. A programme that only reports is a compliance cost; a programme that measures and then acts on what it finds recovers product that was going to atmosphere.

Methane tracking

Built on the MPS molecular property spectrometer sensor from NevadaNano: 15-year factory calibration with no field calibration required, compliant with OGMP 2.0 and EPA requirements. That removes the recurring field calibration burden that quietly determines whether a monitoring programme survives its second year.

Gas recompression and methane capture

Mobile recompression replaces venting and flaring during pipeline maintenance. Instead of blowing a section down to atmosphere or to the flare, the gas is captured, recompressed and returned to service. The emission is avoided and the product is retained — the clearest case in the portfolio where the environmental and commercial arguments are the same argument.

Carbon accounting

• Empirical energy and carbon accounting with blockchain-based environmental attribute certificates
• Aligned to ISO 14067 and ISCC-PLUS
• Scope 1, 2 and 3 unified, with predictive analytics and audit-ready documentation

Partners in this pillar

NevadaNano for MPS gas detection. Changing Planet Solutions for sustainability and emissions monitoring. CleanConnect.ai for the ProveZero certificate layer.

The moment a facility connects its control network to anything — a historian, a remote support link, a wireless layer, a cloud analytics platform — it inherits a security problem that IT tooling was not built for. In OT you cannot patch on a Tuesday, you cannot reboot to apply a change, and availability outranks confidentiality. The safety instrumented system in particular must be protected in a way that does not compromise the thing it exists to do.

What we cover

• OT asset discovery and inventory — what is actually on the network, which is rarely what the drawings say
• Zone and conduit design aligned to IEC 62443
• Network segmentation between IT, OT and the safety instrumented system
• Secure remote access for vendors and remote support
• Continuous OT network monitoring and anomaly detection
• Security lifecycle support — a one-time assessment does not survive the next project

Why this sits next to functional safety, not inside IT

A compromised safety system is a process safety event with a different root cause. Assessing OT security alongside the safety lifecycle — the same engineers reading the same P&IDs, cause-and-effect matrices and SIS architecture — produces findings an IT-led assessment does not reach.

The technology behind this pillar

Delivered with Protocol Automation Technologies, who have built industrial software for manufacturing and infrastructure since 1994. Their stack matters here because OT security and OT connectivity are the same problem seen from two sides: proOPC handles device connectivity and OPC UA/DA, proSCADA and proMES sit at the control and execution layers, proConnect bridges IT and OT, and the industrial cyber security line protects that boundary rather than bolting protection on afterwards.

Fortis EI integrates this with the safety instrumented system and the fire and gas layer, so segmentation is designed against the actual cause-and-effect architecture rather than a network diagram alone.