One Size Fits All, London, Sept 2013 / Slide 1

Risktec Solutions

risk management and assessment for business

Bowties – One Size Fits All?

A Presentation by Andy Lidstone, Principal Consultant, Risktec Solutions Limited

CGE Risk Management User Group, London, 5th September 2013

One Size Fits All, London, Sept 2013 / Slide 2

Today’s session

Bowties are easy to understand but a quality bowtie is deceptively difficult to build. But does one set of “rules” for building bowties work for all applications?

This session will examine different approaches for different applications, e.g. using bowties for LOPA reviews, Safety Case demonstrations, management control reviews, simple pictorial communication, etc.

It will explore both the commonalities and differences in the “rules”, as well as giving delegates an opportunity to bring along their own bowties and issues for discussion.

One Size Fits All, London, Sept 2013 / Slide 3

The problem

Threat = Potential Cause of Hazard

Release

Result of hazard release = Major Accident Hazard

Consequence = Worst Case Escalation of Major Accident

Hazard and Hazard Source

Consequence 1 Consequence 1

Consequence 1 Consequence 2

Consequence 1 Consequence 3

Threat 1

Threat 2

Threat 3

Top Event

Threat Control

Threat Control

Threat Control

Threat Control

Threat Control

Threat Control

Threat Controls and Recovery Measures are barriers to prevent

the Major Accident and are provided by HSE Critical Activities

Recovery Measure

Recovery Measure

Recovery Measure

Recovery Measure

Recovery Measure

Recovery Measure

Escalation Factor

Escalation Factor = Reason why control

may fail

Escalation Factor Control

Escalation Factor

Escalation Factor Control

One Size Fits All, London, Sept 2013 / Slide 4

Basics

Why are you doing it/ What do you want to find out?/What does the client want?

How to record? – Flip chart/white board – Post it notes – Word/Excel/PowerPoint – Bowtie software

How much detail? – Basic bowtie – Effectiveness – Tasks – Elements – Documents – SIL ratings – Others?

One Size Fits All, London, Sept 2013 / Slide 5

Basic

To allow a rapid review of the issues e.g. concept design

One Size Fits All, London, Sept 2013 / Slide 6

Pictorial

One Size Fits All, London, Sept 2013 / Slide 7

Design/ Safety Case

To show additional information e.g. – Tasks – Effectiveness – Critical elements

One Size Fits All, London, Sept 2013 / Slide 8

Documents

Mine Site: Ground Fall

FRP 1 Underground

Fall of Ground

Working under

unsecured ground

B5 Process in place for

assessing ground to be

secure in accordance

with Ground Control District Plan

Procedure

C3 Competency of

personnel not to enter

unsecured areas

Unauthorised access

B6 No access permitted

beyond the area of

secure ground (as

defined by Ground Control District Plan)

Waiting Place

Procedure

B6 No access permitted

beyond the area of

secure ground (as

defined by Ground Control District Plan)

Waiting Place

Procedure

C6 Shift change

procedures include

notification of areas of unsecured ground

Procedure

At-risk

installation/removal

of supportsA1 Design and selection

of equipment to meet

Ground Control District Plan

Fall of Ground Plan

B9 Installation and

removal of ground

support performed

according to documented procedures

Procedure

C3 Competency based

training and assessment

program includes

placement and removal of support

Hot linked documents as a training aid

One Size Fits All, London, Sept 2013 / Slide 9

Management Systems

Management of Change

Failure to (manage change)

‘Release of the hazards’

Change to equipment

Change to procedures

Change to organisation

Unsafe equipment condition

Unsafe work practice

Unnallocated responsibilities

Electricity Injuries

Hazardous Job

Loss of Control of Job

‘Release of the hazards’

Hot Work

Work at Height

Solvents

Fires

Spills

One Size Fits All, London, Sept 2013 / Slide 10

LOPA

Frequency of consequence C1 from threat T1 =

IEF(T1) x P(EF) x PFD(B1) x PFD(B2) x PFD(B3) x PFD(R1) x PFD(R2) x PFD(R3) x P(CM)

: Top Event

Hazard

Threat T1

Enabling Factor

P-EF

Control Barrier B1

PFD-B1

Control Barrier B2

PFD-B2

Control Barrier B3

PFD-B3

Consequence C1

Conditional Modifier

P-CM

Recovery Barrier R3

PFD-R3

Recovery Barrier R2

PFD-R2

Recovery Barrier R1

PFD-R1

To calculate sequence frequencies

One Size Fits All, London, Sept 2013 / Slide 11

Rules

To achieve consistency

Set basic expectations

Must be fit for purpose(s)

Must be communicated

May cover e.g. – Approach

– Attendees

– Acceptance criteria

– Effectiveness ratings/scorings

One Size Fits All, London, Sept 2013 / Slide 12

Rigid Rules

“Barriers shall be fully functional to stop the consequence from occurring”

Is a gas detection system fully functional?

What about the emergency response plan?

“A single barrier can function as either a prevention or mitigation barrier but not both”

What about a tank farm bund?

Prevents access and impacts

Limits extent of spills

“There shall be three barriers between a threat and the top event”

For all frequencies of threat?

Is inspection a separate barrier to maintenance?

One Size Fits All, London, Sept 2013 / Slide 13

Potential Problem Areas

Barrier independence

Use of escalation factors

Effectiveness and Acceptability

Level of detail

Human error

One Size Fits All, London, Sept 2013 / Slide 14

Dependency

If controls are dependent, there is less defense

Threat Barrier Barrier Barrier Barrier Top

Event

Dependent barriers

Threat Barrier Barrier

What counts as dependency? – Same person? – Same systems? – Common services?

Separate bowtie for common areas?

One Size Fits All, London, Sept 2013 / Slide 15

Use of Escalation Factors

Adds local failure cases

Can get very repetitive

Use for barrier general failures?

Activity 3.01 – Maintain and test isolation

valves

One Size Fits All, London, Sept 2013 / Slide 16

Effectiveness and Acceptability

Gut feel

1 to 3, 1 to 5

Numerical

SIL

One Size Fits All, London, Sept 2013 / Slide 17

Level of Detail

To represent as a threat or a separate bowtie?

One Size Fits All, London, Sept 2013 / Slide 18

Representing Human Error

Explicit claims on operator actions

One Size Fits All, London, Sept 2013 / Slide 19

Using Tasks

3.3.1 Maintenance and testing of critical instrumentation

Perform maintenance, testing and calibration of critical rig instrumentation systems (including hand held/portable systems) and all associated equipment and protective systems in accordance with Noble maintenance procedures. Includes - drilling system instrumentation e.g. level indicators, pressure gauges, string weight indicators, zone management system etc. - marine systems e.g. navigation, radar, consoles and control stations, current monitors, anemometers - watertight door indicators, bilge sensors - crane boom angle and weight indicators - crane AOPS and MOPS systems - gantry crane photo-cell and motion alarms - bulk storage system level gauges and alarms - fire, smoke and heat detectors and fire&gas panel alarms - Emergency Shutdown systems - communications systems, including PA/GA - CCTV - UPS systems

• Manufacturer's Instructions • SAP Workorder

Completed maintenance records

Who? What? Why? How?

Can also dig deeper e.g. competency

One Size Fits All, London, Sept 2013 / Slide 20

Human Error Threat

Allows for review of specific areas of

operation at a general level

One Size Fits All, London, Sept 2013 / Slide 21

Human Error Bowtie

Looking at how common causes of human

error are managed across the facility

One Size Fits All, London, Sept 2013 / Slide 22

Human Factors Assessment

Looking at each barrier for potential

weaknesses due to unsafe acts, latent

failures etc.

One Size Fits All, London, Sept 2013 / Slide 23

Summary

What do you actually want to achieve?

Rules to guide rather than mandate

Start simple, but ask questions to aid level of detail

One Size Fits All, London, Sept 2013 / Slide 24

Contact details

Contact: Andy Lidstone

Tel: +44 (0) 1925 611200

Email: andy.lidstone@risktec.co.uk

Web: www.risktec.com