By Martyn Ramsden
In the complex world of industrial safety, a “smart bowtie” has nothing to do with dressing for dinner. Stemming as it does from risk assessment and safety case work in the 1980s by the oil and gas industry, the bowtie approach is increasingly used to understand and communicate key risk control measures at a whole range of facilities, from an offshore oil and gas platform to a mine or manufacturing plant.
In our experience, the bowtie provides a visual roadmap to more effective process safety. It can help us, for example, examine the potential causes of a toxic release from a particular vessel and how this could be prevented. It can also ensure a better focus on outcomes – for example an oil spill - and how these could be mitigated. The bowtie diagram provides us with a visual representation of the safeguards required to prevent different causes of a hazardous event and the mitigation measures needed if there is an incident.
In the face of tougher regulation and the growing requirement for what might be termed “living” Safety Cases, the challenge, we find, is to ensure that a bowtie diagram is fit for the task in hand, be it making a case for continuing operations to the regulator or identifying safety critical competencies. As our use of the bowtie approach continues to grow, there is, we believe, a requirement that certain rules need to be followed if a particular bowtie is to be effective and to achieve its desired objective.
With this in mind, here are 10 ERM rules for ensuring an effective (smart) bowtie approach, whatever the facility and operating environment:
Rule 1 – Know what you want to achieve
In using the bowtie to provide an overview of risk measures, simple is generally best. If, for example, we want to gather the detail on safeguarding measures, an overview is insufficient and plenty of additional information is required. Knowing the objective before embarking on the exercise will allow the effective allocation of resources.
Rule 2 – No numbers
The primary purpose of a bowtie is to present a logical, accessible picture of risk management arrangements. By leaving out the numbers we are able to keep the focus on understanding what’s important in relation to a facility or particular operation.
Rule 3 – Losing control of the hazard
A bowtie should help us to identify what are known as “top events” – namely the point at which control of a hazard is lost. So if as part of a Safety Case we’re faced with a hazard such as gasoline in a bulk storage tank, the top event could be “loss of containment”. This is the point at which the tiger gets out of the cage which means plenty of attention to both prevention and mitigation.
Rule 4 –Threats lead to top events
On the left hand side of the bowtie, threats are defined as events or states which could realistically lead to the top event in the absence of any safeguarding measures. These threats should be specific enough to ensure that the safeguards identified are relevant to the threat. For example ‘corrosion’ is a threat which could result in a loss of containment, unless prevented by measures such as painting or injection of corrosion inhibitor. However, painting is only relevant to external corrosion and injection of corrosion inhibitor is only relevant to internal corrosion. Thus, having two threats – internal and external corrosion – would be preferable.
Rule 5 – Top events lead to consequences
Consequences represent a worst case scenario if no mitigation barriers are in place. Thus without the right barriers, a loss of containment of flammable material can ignite, escalate and result in harm to people, the environment and assets. A consequence should be defined to represent the particular harmful outcome that would be prevented by the set of safeguarding measures in place.
Rule 6 – Barriers must do something
This goes to the heart of bowtie analysis. Identify effective barriers and show them as part of the bowtie. The barrier should be specific enough that its intended function can be defined and that its performance can be verified. The term “operator intervention” for example is so vague as to be meaningless whereas “operator shuts down the process” makes more sense and could be tied to a particular procedure and competency requirement.
Rule 7 – Barriers can fail
Safeguarding measures are not perfect and there will be ways in which these can be compromised, referred to as ‘escalations’ in bowtie parlance. However, the bowtie shouldn’t go overboard on including repeated, generic failure mechanisms on barrier after barrier, particularly if these are adequately addressed in, for example, maintenance procedures. The generic threat ‘maintenance failure’ could be applied to practically any barrier and adds nothing to a bowtie except superfluous detail. Specific escalations should be included, together with the specific measures in place to protect against them.
Rule 8 – Human failure is not generic
People make mistakes and take short-cuts, but an effective bowtie diagram needs to be specific, not generic about human error. What is the error? How might a short-cut be taken? This allows specific safeguarding measures to be defined, rather than relying on the tired, generic barriers of ‘training’ and ‘procedure’, neither of which is particularly meaningful or helpful.
Rule 9 – Engage with the people in the know
Bowties should be developed using the expertise of those with relevant knowledge, and be relevant to those who need to know this information – your stakeholders. Only by talking to stakeholders – for example employees at a particular facility - can the bowtie accurately reflect risk on the ground and influence those affected.
Rule 10 – Guidelines, not a straightjacket
Or as George Orwell put it in his rules for clear writing, “Break any of these rules sooner than say anything outright barbarous.” The same applies when we are using a bowtie diagram. We can break any of the rules outlined above if it provides a clearer understanding of how hazards are managed and risks reduced.
The 10 rules listed above are designed to provide guidance in developing useful bowties. Like so many rules, they may be broken when absolutely necessary if this provides extra insight in achieving the desired objectives.
For further information and discussion on any of the issues raised in this article email firstname.lastname@example.org