Risktec

Bowties – One Solutions

Size Fits All?

risk management and assessment for business

A Presentation by Andy Lidstone, Principal Consultant, Risktec Solutions Limited

CGE Risk Management User Group, London, 5th September 2013

One Size Fits All, London, Sept 2013 / Slide 1

 Today’s session

Bowties are easy to understand but a quality bowtie is

deceptively difficult to build. But does one set of “rules”
for building bowties work for all applications?
This session will examine different approaches for
different applications, e.g. using bowties for LOPA
reviews, Safety Case demonstrations, management
control reviews, simple pictorial communication, etc.
It will explore both the commonalities and differences in
the “rules”, as well as giving delegates an opportunity to
bring along their own bowties and issues for discussion.

One Size Fits All, London, Sept 2013 / Slide 2

 The problem

Escalation Escalation
Factor Factor

Escalation Factor = Escalation

Escalation Factor
Reason why control Factor
may fail Control
Control

Hazard and Hazard Source

Result of hazard Consequence 1

release = Major
Threat 1 Accident Hazard
Recovery
Threat Measure
Control Recovery
Threat
Measure
Control
Top
Threat 2 Consequence 2
1
Threat Threat Event Recovery Recovery
Control Control Measure Measure
Consequence = Worst Case
Escalation of Major Accident

Threat
Threat 3 Threat Control
Threat Controls and Recovery
Recovery
Measures are barriers to prevent
Control the Major Accident and are Measure
provided by HSE Critical Activities Consequence 3
1
Threat = Potential
Recovery
Cause of Hazard Measure
Release

One Size Fits All, London, Sept 2013 / Slide 3

 Basics
Why are you doing it/ What do you want to find
out?/What does the client want?
How to record?
– Flip chart/white board
– Post it notes
– Word/Excel/PowerPoint
– Bowtie software
How much detail?
– Basic bowtie
– Effectiveness
– Tasks
– Elements
– Documents
– SIL ratings
– Others?
One Size Fits All, London, Sept 2013 / Slide 4
 Basic

To allow a rapid review of the issues e.g.

concept design

One Size Fits All, London, Sept 2013 / Slide 5

 Pictorial

One Size Fits All, London, Sept 2013 / Slide 6

 Design/ Safety Case
To show additional information e.g.
– Tasks
– Effectiveness
– Critical elements

One Size Fits All, London, Sept 2013 / Slide 7

 Documents
Hot linked documents as a training aid

FRP 1 Underground
Fall of Ground

Working under
unsecured ground
B5 Process in place for C3 Competency of B6 No access permitted C6 Shift change
assessing ground to be personnel not to enter beyond the area of procedures include
secure in accordance unsecured areas secure ground (as notification of areas of
with Ground Control defined by Ground unsecured ground
District Plan Control District Plan)
Procedure
Procedure Waiting Place
Procedure

Mine Site:
Unauthorised access
Ground Fall
B6 No access permitted
beyond the area of
secure ground (as
defined by Ground
Control District Plan)
Waiting Place
Procedure

At-risk
installation/removal
of supports
A1 Design and selection B9 Installation and C3 Competency based
of equipment to meet removal of ground training and assessment
Ground Control District support performed program includes
Plan according to placement and removal
documented procedures of support
Fall of Ground Plan
Procedure
One Size Fits All, London, Sept 2013 / Slide 8
 Management Systems

Change to Management of Unsafe equipment

equipment Change condition

Failure to
Change to (manage Unsafe work
procedures change) practice

Change to ‘Release of Unnallocated

organisation the hazards’ responsibilities

Hazardous
Electricity Job Injuries

Hot Work Loss of Fires

Control
Work at
of Job Spills
Height
Solvents ‘Release of
the hazards’

One Size Fits All, London, Sept 2013 / Slide 9

 LOPA
To calculate sequence frequencies

Hazard

: Top
Threat Consequence
Event
T1 C1
Enabling Control Control Control Recovery Recovery Recovery Conditional
Factor Barrier B1 Barrier B2 Barrier B3 Barrier R1 Barrier R2 Barrier R3 Modifier
P-EF PFD-B1 PFD-B2 PFD-B3 PFD-R1 PFD-R2 PFD-R3 P-CM

Frequency of consequence C1 from threat T1 =

IEF(T1) x P(EF) x PFD(B1) x PFD(B2) x PFD(B3) x PFD(R1) x PFD(R2) x PFD(R3) x P(CM)

One Size Fits All, London, Sept 2013 / Slide 10

 Rules

To achieve consistency
Set basic expectations
Must be fit for purpose(s)
Must be communicated
May cover e.g.
– Approach
– Attendees
– Acceptance criteria
– Effectiveness ratings/scorings

One Size Fits All, London, Sept 2013 / Slide 11

 Rigid Rules
“There shall be three barriers between a threat and the top event”
For all frequencies of threat?
Is inspection a separate barrier to maintenance?

“Barriers shall be fully functional to stop the consequence from occurring”

Is a gas detection system fully functional?
What about the emergency response plan?

“A single barrier can function as either a prevention or mitigation barrier

but not both”
What about a tank farm bund?
 Prevents access and impacts
 Limits extent of spills

One Size Fits All, London, Sept 2013 / Slide 12

 Potential Problem Areas

Barrier independence
Use of escalation factors
Effectiveness and Acceptability
Level of detail
Human error

One Size Fits All, London, Sept 2013 / Slide 13

 Dependency
If controls are dependent, there is less defense
Dependent barriers

Top
Threat Barrier Barrier Barrier Barrier Event

Threat Barrier Barrier

What counts as dependency?

– Same person?
– Same systems?
– Common services?
Separate bowtie for common areas?
One Size Fits All, London, Sept 2013 / Slide 14
 Use of Escalation Factors

Adds local failure cases

Can get very repetitive
Use for barrier general failures?

Activity 3.01 – Maintain

and test isolation
valves

One Size Fits All, London, Sept 2013 / Slide 15

 Effectiveness and Acceptability

Gut feel
1 to 3, 1 to 5
Numerical
SIL

One Size Fits All, London, Sept 2013 / Slide 16

 Level of Detail

To represent
as a threat or
a separate
bowtie?

One Size Fits All, London, Sept 2013 / Slide 17

 Representing Human Error

Explicit claims on operator actions

One Size Fits All, London, Sept 2013 / Slide 18

 Using Tasks

Who? What? Why? How?

Can also dig deeper e.g. competency
3.3.1 Maintenance and Perform maintenance, testing and calibration of critical rig instrumentation • Manufacturer's Instructions Completed maintenance
testing of critical systems (including hand held/portable systems) and all associated • SAP Workorder records
instrumentation equipment and protective systems in accordance with Noble maintenance
procedures. Includes
- drilling system instrumentation e.g. level indicators, pressure gauges,
string weight indicators, zone management system etc.
- marine systems e.g. navigation, radar, consoles and control stations,
current monitors, anemometers
- watertight door indicators, bilge sensors
- crane boom angle and weight indicators
- crane AOPS and MOPS systems
- gantry crane photo-cell and motion alarms
- bulk storage system level gauges and alarms
- fire, smoke and heat detectors and fire&gas panel alarms
- Emergency Shutdown systems
- communications systems, including PA/GA
- CCTV
- UPS systems
One Size Fits All, London, Sept 2013 / Slide 19
 Human Error Threat

Allows for review of specific areas of

operation at a general level

One Size Fits All, London, Sept 2013 / Slide 20

 Human Error Bowtie

Looking at how common causes of human

error are managed across the facility

One Size Fits All, London, Sept 2013 / Slide 21

 Human Factors Assessment

Looking at each barrier for potential

weaknesses due to unsafe acts, latent
failures etc.

One Size Fits All, London, Sept 2013 / Slide 22

 Summary

What do you actually want to

achieve?
Rules to guide rather than mandate
Start simple, but ask questions to aid
level of detail

One Size Fits All, London, Sept 2013 / Slide 23

 Contact details

Contact: Andy Lidstone

Tel: +44 (0) 1925 611200
Email: andy.lidstone@risktec.co.uk
Web: www.risktec.com

One Size Fits All, London, Sept 2013 / Slide 24