The Bow-tie Analysis Process

HEMP in a nutshell

The Shell Hazards and Effects Management Process.

The risk process for identifying and managing HSE Risks that is applied in the Shell group is the Hazards and Effects Management Process (HEMP). HEMP is a structured and systematic analysis methodology involving the Identification, Assessment and Control of hazards and the Recovery from effects caused by a release of the hazards. All four components are essential for proper hazard management.

The identification of the existing control measures allows the assessment of their suitability. In other words: “Are the controls in place good enough to minimize the risk to a level to levels that are acceptable and ‘As Low As Reasonably Practicable’ - ALARP?”

There is an expectation by governments and society that companies incorporate hazards and effects management into their business.

The four basic steps of HEMP are: identify, assess, control and recover. These steps are inherent in many existing HSE processes and activities. It involves assessment of HSE impacts over the life cycle of the activity on people, on the environment, on assets and on company reputation. This assessment is particularly important in order that the appropriate controls can be developed and implemented to manage or avoid the hazard or significant environmental impact.

The HSE Risk Assessments are documented in hazard register within the HSE Case and these are used as the primary tool for the identification and assessment steps of the hazards and effects management process. The HSE Risk assessments consider HSE hazards.

Identification of environmental aspects is important as well. These are any element of the activities, products or services that can interact with the environment. This includes both adverse and beneficial impacts. The identification of adverse environmental aspects is particularly important in order that the appropriate controls can be developed and implemented to avoid significant environmental impact.

HEMP is an iterative process. The four components (identify, assess, control and recover) may partially overlap or may have to be carried out more than once. The steps involved in HEMP process are:

Step 1: Hazard Identification

An experienced team reviews the hazard checklist to identify those hazards, which are relevant to the product or activity throughout its total life cycle or parts thereof (ensuring that interfaces between parts are covered). This new list is the start of the Hazards and Effects Register.

The hazards and effects register contains the following information:

• Activity
• Hazard
• Description / sources of the hazard;
• Location details
• the top event (unwanted accident) which takes place when the hazard is released;
• consequences (effects) which could occur if the top event is allowed to escalate unchecked;
• the risk potential of the hazard from the Shell Canada Risk Assessment Matrix,
• the means by which the hazard is controlled, either by preventing its release or limiting its effects or the reference to the relevant bow tie.

Step 2: Iden Identification of Hazard Release Scenarios

tification The experience of the team is used to identify the hazard release scenarios (how the hazard is released from the process), and the worst credible consequences of that release

Step 3: Assessment of Risks

For each hazard release scenario, the team identifies the credible consequences and assesses each of these for risk potential using a qualitative risk assessment tool developed by Shell. Similar hazards are grouped wherever practicable to ensure that an overview is maintained of the range of potential major hazards.

The tool used to determine the potential risk of the identified credible consequences is the Shell Risk Assessment Matrix (RAM). In applying this matrix to determine risk potential, it is essential that the team have the proper experience (history) and knowledge of the specific hazard release scenario being considered and the consequences of any past events in order to frame the potential risk as accurately as possible. The RAM allows for assessment of potential risks using a qualitative assessment process of the worst credible consequence to People (P), assets (A), environment (E) or reputation (R). These are plotted on the RAM to come up with a risk potential ranking of High (red), Medium (yellow) or Low (blue). The Shell Risk Assessment Matrix is illustrated in the following Figure.

All of the hazards identified, together with consequences and risk potential ratings, are then documented in the Hazard and Effects Register discussed above. Risk Assess Assessment ment The Risk Matrix is used in plotting the risk for the various hazards. These are assessed against the measures in frequency of their actual occurrences whether within the Company or in the industry. The seriousness in consequences of these threats occurring is the other dimension, and both frequency and seriousness form the basis in deciding whether the risks are red, yellow, or blue. So, with the RAM we apply experience of events or incidents in the past to assess risks in the future.

The four basic steps of a RAM assessment are :

• Identify the potential consequences (using credible scenarios).
• Estimate the severity of each potential consequence (in terms of People, Assets, Environment, Reputation).
• Estimate the likelihood of potential consequence (using past experience).
• Estimate the risk rating.

Risk Matrix

Step 4: Identification of Threats that may Release a Major Hazard

Based on the RAM assessment, those HSE hazards that are yellow or red are further analyzed using detailed bow-tie methodology For each of these major hazards, threats (circumstances and situations) are identified which could release the hazard and which potentially could lead to a hazardous event (top event) i.e. the release of the hazard. The bowtie development process and methodology is discussed in further detail in the next section.

Step 5: Control and Recovery

For each threat the evaluation team considers whether sufficient controls are in place to prevent the hazardous (top) event from occurring. For red risks possible escalation factors are investigated and controlled if considered feasible. However, a hazardous event could occur despite the controls present, so recovery preparedness measures are identified which mitigate the consequences, bring the situation under control and restore the original situation. These measures included emergency response measures and contingency plans. The level of detail with which the controls are assessed is commensurate with the level of the risk posed by the hazard.

Step 6: Maintaining the Integrity of Controls and Recovery Preparedness Measure Measures

It is essential that controls and recovery preparedness measures are maintained and kept intact. To ensure this, the evaluation team assesses whether a the HSE management system is in place and that HSE critical tasks and activities have been identified and assigned to responsible individuals or departments to manage specific barriers on the bowtie.

The Bow-tie Analysis Process,

The Bowtie Used for Major Hazard Analysis

As discussed above, those HSE hazards which are classified as yellow or red are further analyzed using detailed bow-tie methodology. The following illustrates the Bowtie Model that is used. The left hand side of the diagram can be viewed as a ‘fault tree (causal) analysis’ and involves those threats associated with the hazard and the controls, called barriers, associated with each threat. Ideally the threat barriers should be sufficient such that the hazard is not released and the ‘top event’ does not occur.

However no such controls can be assumed to be 100% reliable, and so it is required that ‘recovery preparedness measures’ are in place to mitigate the effects of a hazard’s release and to aid recovery from the top event. The right hand side of the diagram can be considered as a hazard ‘event tree (consequence) analysis‘ and involves recovery preparedness measures.

The centre of the bow-tie is commonly referred to as the ‘top event’, this is the release of the hazard. There may also be ‘escalation factors’ which serve to reduce the effectiveness of the threat barrier or recovery preparedness measure, with associated ‘escalation factor controls’.

During the application of HEMP, a bow-tie is constructed for each yellow and red hazard. The Bowtie evaluation team also ensures that HSE critical tasks and activities have been identified and assigned to responsible individuals or departments to manage the specific barriers identified on the bowtie.

Posted in: Chemical Engineering Processing

Share |