STEP BY STEP OF USE OF THE RAM

IDENTIFY HAZARD

IDENTIFY POTENTIAL CONSEQUENCES

1 (from credible hazard release scenarios)

ESTIMATE SEVERITY OF EACH POTENTIAL

CONSEQUENCE
2
(People, Assets, Environment, Reputation)

ESTIMATE LIKELIHOOD OF POTENTIAL

3 CONSEQUENCE (past experience)

ESTIMATE THE RISK RATING

4
BEWARE OF Industry RAM MIS-USE
• There are no frequency values on the Industry RAM
– likelihood is NOT quantified

• There is no cost value attributed to human life on the Industry

RAM
– risk to people and assets are considered separately

• The Industry RAM considers credible and realistic hazard release

scenarios and allows for a qualitative assessment of their
potential for release
– control measures are not included when risk rating – unmitigated risk
– RAM risk rating does not change if control measures are installed - risk can
NOT move from right to left because impacts / benefits of additional
control measures can’t be correlated to the historical data that was used to
estimate likelihood; Residual risk, with controls installed and functioning, is
determined using other quantitative tools (I.e. LOPA, QRA)
BEWARE OF Industry RAM MIS-USE
• The use of the Industry RAM is as a Qualitative SCREENING tool only
• it indicates the potential severity of a scenario and prompts further work to manage
hazards and demonstrate ALARP
• If more detailed risk analysis, including residual risk analysis, is required, there
are other tools. (e.g. BowTie Analysis, HAZOP, QRA, LOPA, etc.)

Make the analysis credible – put effort into understanding

and mitigating the risk, NOT into arguing a lower risk rating
 Step 4 – Identify Red and Yellow Risks
• BowTie analysis for red risks with
ALARP determination by threat line
CONSEQUENCES INCREASING LIKELIHOOD

• Site discretion for yellow risks (i.e. A B C D E

SEVERITY

Environment

Reputation
Never Heard of in Has Has Has

People, Asset, Environment or

People
heard of in the Industry happened in happened at happened

Assets
the Industry the the Location more than
Organisation or more than once per

Reputation)
or more than once per year at the
once per year in the Location
year in the Organisation
Industry
No injury or No No effect No

– Industry Engineering Standards 0 health

effect
damage impact

(DEP’s, DEM’s), Vetted Industry, 1

Slight injury
or health
effect
Slight
damage
Slight
effect
Slight
impact

Industry or Government Technical 2

Minor injury
or health
Minor
damage
Minor
effect
Minor
impact

Standards (covering Threats to effect

Major injury Moderate Moderate Moderate

Consequence controls);
3 or health damage effect impact
effect
PTD or up Major Major Major
4 to 3 damage effect impact

– Hazard Control Sheets with ALARP

fatalities
More than Massive Massive Massive

determination
5 3 fatalities damage effect impact

– Model or mini-Bowtie with site or

business specific interpretation and
ALARP determination

Blue risks are assumed to be at ALARP, if the facility or business has a properly functioning HSSE MS (as
assessed by external audit).
Red and
Red risks:
Yellow Risks in LPG
Yellow risks:
• 1 Slip/trip/fall in LPG office or plant
• 2 Customer site engineering
• 1 Bulk truck loading • 3 Cylinder handling
• 4 Vehicle colliding with staff
• 2 Product receipt
• 5 Cylinders falling from pallets in transit
• 3 Bulk delivery to customers • 6 Chemical products (solvent, paint…)
• 7 Cylinder filling
• 4 Road transport • 8 Use of hand tools
• 9 Personnel at height
• 5 Marine transfer • 10 Equipment falling from height
• 11 Low voltage electricity
• 6 Assault • 12 Cleaning products
• 13 Electrostatic electricity
• 7 Filling hall – equipment with rotating parts
• 14 Flares
• 8 Structural integrity of storage • 15 Confined space
vessels/tanks • 16 Unstenched LPG
• 17 Sabotage outside plants
• 9 Delivery to packed customers • 18 Personnel below grade
• 19 Bottled gases under pressure
• 20 Cylinder/tank maintenance
• 21 Air under high pressure
• 22 Railcar loading
Step 5 - Identification of Barriers (the
Control and Recovery Measures)
• CONTROLS prevent the threat from releasing the hazard to cause the Top
Event.
• RECOVERY MEASURES reduce or mitigate the risk that the top event leads to
the consequences

T C
H C R O
H O E N
R S
A N C
Z
E E
T TOP EVENT O
A A Q
R V
R T O E U
D L R E
S Y N
C
E
Step 5 – Identification of Barriers
Documentation of Yellow RAM Risks in a Hazard Control Sheet
Hazard Con trol S heet - W orkin g at Heig ht
1.4 M aintenance Activities and C ritical Business HSE Critical Activity/
Processes Responsible Position
H AZ AR D C O N T R O L SH E ET N o: 4 •These M aintenance Activities support the barriers • Vehicle planned m aintenance

H azard G roup: P ersonnel w orking at height H azard C o n seq u en ce: P ersonal injury/fata lity above (I.e Preventative M aintenance and Inspection) program m e /Fleet M anager
as a consequence of a fall from height •Use of approved
Location /Hazard So u rce/Descrip tio n: D uring w ork by staff or contractor or at cu stom er Applicable Critical Business Processes include: contractors/M aintenance M anager
location •Use of inspected ladders/scaffold
Com petency etc./ O perations
A ssessm ent of haza rd /top even t: Loss of C ontrol/F all from height while w orking on asset or Contractor M anagem ent
fall from height while d elivering to custom er tank causing serious injury or fatality - P4 B Perm it to W ork
(m inim um for Shell- your experience m ight m ake this a C or a D likelihood)

T hreats: References:
 W orking on heig ht for cleaning, painting or m aintenan ce on storage tanks with
im proper protection (tie-off, w orking platform s etc.) Local R egulatory Standards:
 Loading trucks or rail cars Business /C ustom er Standards and Procedures
Shell Standards ( DEP's, D EM 's), HSE C F requirem ents if applicable ( AD D SPE CIFIC
 D elivery to custom er tanks REFER EN CES)
 U nsecured or substandard lad ders, handrails, pla tform s, scaffolds etc.
 H um an Error R evision: 0 Authorized by: Asset M anager, Responsible
M anager; HS SE M anager
B arriers and H SE C ritical Activities:
1.1 C ontrol in design H SE C ritical Activity/
R esp o n sib le Po sitio n
 D esign and operational use requirem ents for
• •N ot to use ladders for w ork at ADDITION AL R IS K REDU CTIO N IS T HE M EASUR E ARE
Ladders, Scaffoldin g , Platform s height > 1 .5 m etres/ D rivers- M EASUR E FO R CO NSID ER ATION CREDIBLE / DISPRO PO RTIO NATE
 V eh icles fitted w ith su ita ble ladders for delivery O perators PRAC TICABLE? RESO UR CE S
needs •U se of approved ladders/ R eseller (Yes / N o) REQ U IR ED TO
 B ottom loading a t depots/term inals M anager a nd C ontracts IM PLEM ENT?
m anagem ent (Yes / N o)
•Apply S hell D E P/D E M for Bottom 1. All working at heights > 1.5 m etres Yes No
Loading design / S hell E ng ineering scaffolds or platform s to be used
2. R eview of contracts for HSSE content Yes No
3. Introduce Ladder checks Yes No
4. Proactively encourage custom ers to Yes No
1.2 C ontrol in operation H SE C ritical Activity/ provide safe access to storage tanks
R esp o n sib le Po sitio n 5. Ban the use of portable ladders in the No Yes
•Signs to be placed during work at heig ht with •D rivers/opera tors aw are of ha zard organisation
scaffolding instructed in safe use of la dders
•Follow Loading / delivery procedures for working on and w ork on top of trucks/rail cars Is the Risk AL ARP? – Y /N No
Loading Racks and o n to p of trucks and rail cars /D rivers/O perators
•D river applies D e livery and
loa din g Procedure/D river Com m ents:
•D river T rainin g a nd C om petency/ Based on the exam ples of addition control m easures above item s 1-4 are achievable and
Shell Business rep would represent ALARP once im plem ented. Item 5 is currently not practicable due to the
widespread use of portable ladders during m aintenance / delivery.
1.3 Recovery M easu res: H SE C ritical Activity/
R esp o n sib le Po sitio n
 Initiate response to em ergency •Em ergency response plans and TEAM M EM BERS
M ETHO D USED
 V eh icles fitted w ith first a id kits training /S hell. C arriers/Resellers Expertise Nam e
•Staff and contractor to use x Experience/Judgm ent HSE:
incid ent case m anagem ent/ B ulk  Cost-Benefit Engineering:
Fuels m anager/C RT ST L/R esellers  Q uant. Assessm ent O perations:
 O ther Other:

Remember… this is basically a

paper Bowtie….
BARRIERS Escalation
Left Hand Side:
PREVENT
Right Hand Side:
MITIGATE
Escalation
Factor Factor

A Barrier is the common term for controls, recovery measures Escalation

Hazard
Escalation

and escalation factor controls that prevent a threat from being

Factor Factor
Control Control
& Consequence
released and then causing the consequences. Threat
Hazard Source 1
1
A measure which reduces the probability of realising a hazards
potential for harm and of reducing its consequence.
Threat Consequence
Top Event
Barriers can be hardware (which are called Critical Equipment 2 2
Barriers) or human intervention (which are called Critical Human
Barriers) or be a combination of these. Threat Control
3 Consequence
RM 3

HSE Critical Activities (Engineering, Maintenance,

Operations etc.)
HSE Critical Business Processes
HSE Critical Equipment List
CONTROLS Escalation
Factor
Left Hand Side:
PREVENT
Right Hand Side:
MITIGATE
Escalation
Factor
Escalation Escalation
Factor Hazard Factor
Control Control
&

• Controls are barriers that

Consequence
Hazard Source 1
Threat

prevent threats from releasing

1

the hazard. Threat

2
Top Event
Consequence
2

• Controls sit between Threats Threat Control

and the Top Event, on the Left

3 Consequence
RM 3

Hand Side of the BowTie. HSE Critical Activities (Engineering, Maintenance,

Operations etc.)
HSE Critical Business Processes
HSE Critical Equipment List

Control Examples:
 Design Controls (e.g. guards, level alarms, automatic trips etc.)
 Operation Intervention Controls (e.g. Operating within defined process envelop
etc.)
 Management System Processes are not barriers (e.g. Management Of Change, Technical
Integrity Management etc.) They are Critical Business Processes in HSE MS. Following these
processes can be a barrier; These are typically shown as supporting Activities /Processes to
a design or operations barrier on the bowtie.
RECOVERY MEASURE (RM) Escalation
Left Hand Side: Right Hand Side:
Escalation
PREVENT MITIGATE
Factor Factor

• Recovery Measures are barriers Escalation

Factor
Control
Hazard
&
Escalation
Factor
Control
Consequence

that limit the consequences arising Threat

Hazard Source 1

from the top event (mitigate)

1

Consequence

• RM’s sit between the Top Event and

Threat
Top Event 2
2

the possible Consequences on the Threat Control

Right Hand Side of the BowTie. 3

RM
Consequence
3

HSE Critical Activities (Engineering, Maintenance,

Operations etc.)
HSE Critical Business Processes
HSE Critical Equipment List

RM Examples:
 Design (e.g. Spill containment, dikes, automatic water spray, ignition control,
etc.)
 Operations (e.g. Operations intervention, rescue team response)
 Management System Processes are not barriers (e.g. Emergency Response Management
etc.) They are Critical Business Processes in HSE MS. Following these processes can be a
barrier; These are typically shown as supporting Activities /Processes to a design or
operations barrier on the bowtie.
ESCALATION FACTOR
Left Hand Side: Right Hand Side:
Escalation Escalation
PREVENT MITIGATE
Factor Factor
Escalation Escalation
Factor Hazard Factor
Control Control
& Consequence
Hazard Source 1
Threat
1

Threat Consequence
Top Event 2
2

Conditions or situations that defeat or

impair Design Barriers (Controls or
Threat Control
3 Consequence

Recovery Measures).
RM 3

HSE Critical Activities (Engineering, Maintenance,

Operations etc.)
HSE Critical Business Processes
HSE Critical Equipment List

Escalation Factor Examples:

 Abnormal operating conditions (e.g. operating outside design envelope, loss of power or
steam etc.)
 Environmental variations (e.g. extreme weather that could affect instrumentation)
 Barrier temporarily impaired or removed
 Escalation factors are typically shown on Design (Critical Equipment ) Barriers on your
Bowtie.
 People not doing what’s expected (i.e. by procedure or critical process) should not be
shown as an escalation factor. These are critical activities that are not being done which can
result in the potential failure of this barrier….. => GAPS!!… so you need to ensure that these
essential human activities are captured in your HSSE critical activities for that barrier!!
Step 5 – Identification of Barriers
Summary
Examples of Controls, Recovery Measures RECOVERY MEASURES
CONTROLS Reduce the
Risk that the Threat will Reduce the Risk That the
Release the Hazard Top Event Leads to the
Consequences

Emergency
Design Standards Load Plan Response

Community
Relations
Planning

Blast Resistant
Modules
Access Control Antilock Braking
System
BARRIER HIERARCHY
Controls and Recovery Measures hierarchy, in order of preference:

– Elimination – inherently lower impact on HSE (safety, environment, reputation, health,

social)

– Minimisation / Substitution – using different materials/techniques/equipment with

lower impact on HSE

– Isolation / Separation

– Engineering Controls – (prevention & mitigation)

– Procedures

– Personal Protective Equipment

EXAMPLE:
Follow the step by step approach of
BowTie Analysis for “Falling From Height”
Output document: Bowtie or Hazard Control Sheet
BowTie Analysis for “Falling From Height”
The Hazard Release Scenario

• Maintenance and repair of instrumentation of an

above ground vessel in a process area from a
scaffold.
• While carrying out a similar activity last year,
another company location experienced an incident
where a scaffold partially collapsed causing the
contractor to fall resulting in fatal injuries.
BowTie DEVELOPMENT –STEP BY STEP
Identify
• Hazards Identify Hazards
Personnel at height
• Top Events
• Consequences Identify Top Event
• Threats Loss of Control (Fall)
• Controls Identify Consequences
• Recovery Measures Fatality RAM: P4C
• HSE Critical Activities Identify Threats
Human error
Evaluate and document Wind
• The Validity and effectiveness of the Barriers for each Obstacles
Slippery surfaces
threat and consequence (ALARP).
 Poor job design
• List all actions in a Remedial Action Plan that are  Etc.
required to achieve ALARP.
BowTie DEVELOPMENT –STEP BY STEP
Identify
• Hazards Identify Controls in place
• Top Events  Design of Non-slip surfaces,
railings and guards
• Consequences
 Operation: Follow procedures
• Threats
for working at heights (e.g. non-
• Controls slip boots, wearing fall
protection, etc.)
• Recovery Measures
• HSE Critical Activities
Identify Recovery Measures in
place
Evaluate and document
 Design: Platforms at approved
• The Validity and effectiveness of the Barriers for each intervals and/or fall arrest
threat and consequence (ALARP).  Operation: First Aid

• List all actions in a Remedial Action Plan that are  System: Implement Emergency
Response
required to achieve ALARP.
BowTie DEVELOPMENT –STEP BY STEP
Identify
• Hazards Evaluate and document

• Top Events  Assess quality of controls and

recovery measures
• Consequences
 Assess overall level of Barriers -
• Threats #, type, quality, confidence
• Controls  Identify shortfalls of Barriers,
• Recovery Measures assign teams to develop more
barriers
• HSE Critical Activities
 Document and integrate Barriers
and HSE Critical Activities to HSE
Evaluate and document mgmt system and business
processes (I.e. MOC, Technical
• The Validity and effectiveness of the Barriers for each Integrity management, JHA etc.)

threat and consequence (ALARP).

• List all actions in a Remedial Action Plan that are

required to achieve ALARP.
 Example “Falling From Height”
Proper work
Surfaces
Bad Weather Follow Permit
Wind requirements
(tie -off, stop
work in bad
weather)
Personnel at
Work Planning
Height
process

Inspection

Loss
Slippery Personnel Injury
Work
of
Fatality
Surfaces Non -Slip Control P4D
Boots
(Fall) Design - Fall Arrest First aid;
Non -Slip Platforms; equip ERP
Warning Surfaces
signs

Work Planning
process

Follow Permit
Poor Work requirements
(tie -off, stop
Platform
work in bad
weather)

Design;
Scaffolds