Barrier Analysis and Energy-Trace: Finding Failed Defenses
When an incident happens, the question most investigations reach for is "what did the worker do wrong?" That framing produces retraining and reminders, and the same event recurs. Barrier analysis asks a different question: which defenses were supposed to stop this, and why did they fail? That shift — from blaming the last person in the chain to examining the protections that were in place — is what makes barrier analysis one of the more durable methods in incident investigation.
This guide explains how barrier analysis and its energy-trace variant (ETBA) work, when to use them, and how to turn the output into corrective actions that actually hold.
Investigate failed defenses, not failed people. WhyTrace Plus structures your incident investigation around barriers and causes so the corrective action targets the protection that broke — not the worker who was standing near it. Start free with WhyTrace Plus →
What Is Barrier Analysis?
Barrier analysis is a structured investigation method that identifies the controls (barriers) meant to prevent harm, then determines which ones failed, were missing, or were bypassed during an incident. It works from a simple model: harm occurs when an energy source reaches a vulnerable target because the barriers between them did not hold.
This framing comes from the energy-damage model first illustrated by James Gibson in 1961 and developed into a practical accident-prevention framework by William Haddon in 1970. The U.S. Department of Energy formalized the approach under the term Hazard and Barrier Analysis and built it into its MORT (Management Oversight and Risk Tree) program. As of 2026, barrier thinking remains the backbone of how high-hazard industries — energy, oil and gas, aviation, rail — reason about defenses.
The three elements every barrier analysis tracks:
| Element | Definition | Examples |
|---|---|---|
| Energy source / hazard | The thing capable of causing harm | Moving machinery, electricity, stored pressure, gravity, chemicals, heat |
| Target | The person or asset that can be harmed | Worker, bystander, equipment, environment |
| Barrier | A physical or procedural measure that keeps energy in wanted channels or away from the target | Machine guard, lockout/tagout, interlock, PPE, permit-to-work, training, supervision |
The output is not a single root cause. It is a map of which protective layers were present, which were absent, and which were defeated — and that map points directly at what to fix.
Energy-Trace and Barrier Analysis (ETBA): Following the Energy
Energy-Trace and Barrier Analysis (ETBA) is the variant that starts by tracing every form of energy present in a work activity, then asks what barrier controlled each one. Where general barrier analysis can begin from the incident, ETBA begins from the energy inventory — which makes it harder to miss a hazard that did not happen to cause this particular event but could cause the next one.
The method, documented by the U.S. Department of Energy (reference SSDC-29), runs in a defined sequence:
- Identify the energy sources. List every form of energy in the task or system — kinetic, electrical, thermal, chemical, gravitational, pneumatic, hydraulic, radiation, biological. Most serious incidents involve an uncontrolled release of one of these.
- Trace the energy flow. Follow the path each energy source could take from its origin toward a potential target.
- Identify the barriers on each path. Document what was supposed to control or contain that energy.
- Evaluate each barrier. Determine whether it was present, adequate, and functioning at the time of the incident.
- Classify the failure. For barriers that did not work, decide whether they were missing, inadequate, or defeated.
ETBA is especially useful in process and energy environments because it forces investigators to account for energy that did not release this time. A guard that held today but is the only barrier between an operator and a 480-volt bus is a finding worth raising before it becomes an incident report.
Mid-investigation reality check: the value of barrier analysis collapses if the failed-barrier list lives in someone's notebook. WhyTrace Plus keeps the energy sources, barriers, and failure classifications in one structured record your whole team can see. See how it works →
Types of Barriers and How They Fail
Barriers fall into categories that fail in predictable ways, and naming the category sharpens the corrective action. A failure framed as "operator skipped the step" reads very differently when you recognize it as a defeated administrative barrier with no physical backup.
Three broad barrier types, ranked roughly by reliability:
- Physical (hard) barriers — guards, interlocks, barricades, containment, pressure relief. The most reliable because they do not depend on a person choosing to comply. They fail through wear, removal, defeat, or design inadequacy.
- Functional / energy barriers — fuses, relief valves, automatic shutdowns, lockout/tagout. They sit between physical and administrative; reliable when maintained, but defeatable.
- Administrative (soft) barriers — procedures, permits, training, signage, supervision. The least reliable because each one requires a human decision under real conditions. They fail through being unknown, unclear, inconvenient, or routinely bypassed.
This ordering mirrors the hierarchy of controls in ISO 45001 and the U.S. National Safety Council's guidance: elimination and engineering controls (physical barriers) outrank administrative controls and PPE because they do not rely on behavior. When a barrier analysis shows that the only defense between a hazard and a worker was administrative, that itself is a finding.
The four failure modes to classify against:
| Failure mode | What it means | Typical corrective direction |
|---|---|---|
| Missing | No barrier existed for this energy path | Add a barrier — preferably engineering, not a reminder |
| Inadequate | Barrier existed but was too weak, too slow, or wrong type | Upgrade or replace with a higher-order control |
| Defeated | Barrier was bypassed, removed, or overridden | Understand why it was bypassed; redesign so compliance is the path of least resistance |
| Failed | Barrier was present and correct but did not function | Maintenance, inspection, or reliability fix |
The "defeated" row is where shallow investigations stop and good ones begin. A barrier that workers routinely bypass is rarely a discipline problem — it is usually a sign the barrier conflicts with getting the job done.
Try AI-Powered Root Cause Analysis
Once you have mapped the failed barriers, the next move is to ask why each one failed and what countermeasure will hold. That line of questioning — disciplined, repeatable, and tied to evidence — is exactly what an AI-assisted analysis can scaffold, prompting for the conditions behind each defeated or missing barrier instead of letting the investigation settle on "operator error."
Where Barrier Analysis Fits Among RCA Methods
Barrier analysis is one of several root cause analysis methods, and it answers a question the others largely skip: not what caused the event, but what was supposed to stop it. That makes it complementary rather than competing.
A practical comparison:
| Method | Primary question | Strength | Limitation |
|---|---|---|---|
| 5 Whys | What chain of causes led here? | Fast, accessible, good for linear problems | Can stop at a person; misses parallel causes |
| Fishbone (Ishikawa) | What categories of cause contributed? | Organizes brainstorming across 6M categories | Identifies candidates, not proven causes |
| Fault tree analysis | How could this top event occur? | Rigorous, quantifiable for complex systems | Time-intensive; needs expertise |
| Barrier / ETBA | Which defenses failed, were missing, or were bypassed? | Directly maps to controls and the hierarchy of controls | Needs a separate causal method to explain why a barrier failed |
In practice, barrier analysis pairs well with the 5 Whys: the barrier analysis identifies which defense failed, and the 5 Whys digs into why it was missing, inadequate, or defeated. Used together they keep the investigation from blaming the worker while still reaching the systemic cause.
The hierarchy-of-controls lens also makes barrier analysis a natural fit for high-consequence work. Construction is the clearest example. As of 2026, U.S. BLS and OSHA data show the "Fatal Four" hazards — falls, struck-by, electrocution, and caught-in/between — account for roughly 59% of construction worker deaths, with falls alone responsible for about 33.5%. Each of those is fundamentally a barrier story: a missing guardrail, a defeated exclusion zone, an absent lockout, an inadequate trench protection system. Encouragingly, OSHA reported that fatal falls investigated under its National Emphasis Program fell nearly 20% (from 234 to 189) and trench-collapse deaths dropped from 39 in 2022 to 12 in 2024 — outcomes consistent with strengthening physical and functional barriers rather than relying on worker behavior.
Running a Barrier Analysis: A Practical Workflow
A barrier analysis is a working session, not a form to fill in afterward. The most useful versions happen with the people who do the work, mapping defenses against the actual sequence of events.
A repeatable workflow:
- Reconstruct the sequence. Establish what happened in time order, from normal operation to harm. Keep it factual; defer cause statements.
- Identify the energy source and target. Name the energy that caused harm and who or what it reached.
- List every barrier that should have been in the path. Include barriers you expected to exist even if they did not — a missing barrier is a finding, not an omission.
- Evaluate each barrier against three tests. Was it present? Was it adequate for this hazard? Was it functioning at the moment of the incident?
- Classify each failure as missing, inadequate, defeated, or failed.
- Ask why for each failed barrier. This is where a causal method (5 Whys, fishbone) attaches. Stop only when you reach a condition the organization controls — design, maintenance, scheduling, supervision.
- Write countermeasures up the hierarchy. For each gap, ask whether you can eliminate the hazard or add an engineering control before settling for an administrative one. Assign a named owner and a verification date.
A short worked example: a maintenance technician receives a burn from a steam line. The energy source is thermal; the target is the technician's forearm. Expected barriers: a verified isolation and depressurization (functional), a permit-to-work confirming isolation (administrative), and insulation on the line (physical). The analysis finds the insulation was removed during a prior repair and never restored (missing physical barrier), and the permit did not require confirming line surface temperature (inadequate administrative barrier). The corrective action is not "remind technicians to check for hot surfaces." It is to restore insulation and add a verified temperature check to the permit — fixing the barriers, not the person.
Frequently Asked Questions
Q. What is the difference between barrier analysis and ETBA?
Barrier analysis identifies the defenses meant to prevent a specific incident and evaluates which failed. Energy-Trace and Barrier Analysis (ETBA) is a more systematic variant that starts by inventorying every energy source in a task, then traces each one to find the controlling barrier. ETBA is broader because it surfaces hazards that did not cause this incident but could cause the next, making it well suited to process and energy-intensive environments.
Q. Is barrier analysis a root cause analysis method?
Yes, but a specialized one. Barrier analysis tells you which defense failed; it does not, on its own, explain why it failed. Most teams pair it with a causal method such as 5 Whys or fishbone analysis to reach the systemic root cause behind the failed barrier, then write corrective actions against that cause.
Q. How does barrier analysis relate to the hierarchy of controls?
Barriers map directly onto the hierarchy of controls. Physical and functional (engineering) barriers sit higher because they do not depend on human behavior, while administrative barriers and PPE sit lower. A barrier analysis that finds the only defense was administrative is signaling that a higher-order control is needed — which is exactly the prioritization ISO 45001 and NSC guidance call for.
Q. When should I use barrier analysis instead of 5 Whys?
Use barrier analysis when the incident involved an uncontrolled energy release — a fall, a crush, a burn, an electrical contact — and you want to know which protections failed. Use 5 Whys when you need to trace the chain of contributing causes. In most serious investigations you use both: barrier analysis to find the failed defense, 5 Whys to explain it.
Q. What is the most common mistake in barrier analysis?
Stopping at "defeated" barriers without asking why they were bypassed. When workers routinely override or skip a barrier, the cause is almost always that the barrier conflicts with getting the work done — not individual carelessness. The corrective action should make the safe path the easiest path, not add another reminder on top of one that is already ignored.
Key Takeaways
- Barrier analysis reframes investigation from "what did the worker do wrong" to "which defenses failed, were missing, or were bypassed" — which points corrective actions at controls instead of people.
- The energy-damage model (Gibson, Haddon, formalized by the DOE) treats harm as an energy source reaching a target because barriers did not hold; ETBA extends this by inventorying every energy source, not just the one that caused this event.
- Classify each failed barrier as missing, inadequate, defeated, or failed — and treat routinely "defeated" barriers as a design signal, not a discipline issue.
- Barriers map onto the hierarchy of controls; an investigation that finds only administrative defenses is telling you a higher-order engineering control is needed.
- Pair barrier analysis with a causal method like 5 Whys to explain why each barrier failed, then write countermeasures with named owners and verification dates.
Related Resources
| Resource | Description | Best For |
|---|---|---|
| RCA Method Comparison: 5 Whys, Fishbone, Fault Tree, and Bow-Tie | Side-by-side comparison of the major root cause methods, including where barrier and bow-tie analysis fit | Choosing the right method to pair with barrier analysis |
| Human Error and Systems Thinking: Why Blaming the Worker Misses the Point | The framework behind why failed barriers, not failed people, are the right investigation target | Teams moving away from blame-based investigations |
| Incident Trend Analysis: Finding Seasonal and Shift Patterns | How to spot recurring failed-barrier patterns across many incidents | EHS managers turning individual investigations into systemic insight |
Turn failed barriers into corrective actions that hold. WhyTrace Plus structures barrier analysis, root cause analysis, and corrective action tracking in one record — so the protection that broke gets fixed and verified, not just retrained around. Start free with WhyTrace Plus →
Sources:
- Barrier Analysis Analysed in MORT Perspective | SpringerLink
- Origins of energy barrier accident perspective | Systems Safety
- DOE Accident Prevention and Investigation Program | Department of Energy
- What is Barrier Analysis? | ThinkReliability
- Department of Labor encouraged by decline in worker death investigations | OSHA
- Commonly Used Statistics | OSHA