Bowtie Analysis – An Effective Risk Management Hindustan Petroleum Corporation Limited Corporate HSE Department By Murthy V S S Malyala Manager –HSE

Contents Risk analysis –background Incidents in Oil Industry Bowtie – a visual risk evaluation tool Terminology Development of Bowtie Case study – Gas fired Pipe heater explosion modelling Barriers for controlling incidents Barrier Effectiveness End users of Bowtie Better than other Hazard identification Techniques

Risk Analysis Risk = Probability X Consequence

Vapor cloud explosion ( Explosion during start up) Decades of learning from disasters 3000 fatalities MIC Release 500 fatalities and terminal destroyed Rupture of 8 inch LPG pipeline 167 fatalities and platform destroyed. 28 fatalities and 36 injured Leakage from pump discharge relief valve Bhopal Gas Incident- 1984 Vapor cloud explosion ( Explosion during start up) Mexico (1984) 18 fatalities and 81 injured LPG Leakage – Sampling/ water draining Flixborough (1974) Piper Alpha 1988 Loss – Human & Property Feyzin, France - 1966 Emergency Preparedness MOC Staffing Multiple Failures Work permit system Hazard communication Operating Procedure Assert Integrity Management Of Change Years of learning

Decades of learning from disasters Leakage occurred during maint. work on valve. overfilling of a large storage tank Fatalities 23. Over 130 injured Over filling of column. Jaipur Terminal (2009) Fatalities 15. Over 170 injured Pasadena 1989 Buncefield (2005) Catastrophic failure of heat exchangers Loss – Human & Property 2 fatalities and 8 injured BP Texas (2005) Esso Longford (1998) Operating Discipline Contractor Safety Maintenance practices Operating Discipline Hazard Analysis Assert Integrity Years of learning

Bowtie Analysis The Bow-tie Diagram is a user-friendly, graphical illustration of how hazards are controlled. Bowtie …. A simplified fusion of Fault Tree Analysis and Even Tree Analysis FTA + ETA = Bowtie Effective risk management is only possible if people are assigned responsibilities for controls via HSE-Critical Tasks Visible links are made to HSE-critical systems and competencies Bowtie methodology demonstrates not only what controls are in place today and their effectiveness Used in Oil & gas , Aerospace, Railways

Bowtie analysis for high risk Activities ALARP

Bowtie Analysis

Bowtie Analysis

Terminology Top event - no catastrophe yet but the first event in a chain of unwanted events. Threats - The top event can be caused by (sufficient or necessary causes). Consequences - The top event has the potential to lead to unwanted consequences. Barriers - Preventive or mitigate measures taken to prevent threats from resulting into the top event. Escalation factor - a condition that defeats or reduc es the effectiveness of a barrier.

Bowtie analysis – Development Describe unwanted event for the Bowtie Knot Determine scope of analysis – operational boundries Identify threats that could cause the event Identify possible consequence of the event Select the optimum set of control to manage the causes and consequence of the event Identify failure mode for important control Determine items for control assurance management

Case Study - Simple Pipe still Heater

Case Study – Gas fired Pipe Heater Explosion Threats Consequence

Threats Preventive Barriers Unwanted Event

Threats Preventive Barriers Unwanted Event

Threats Preventive Barriers Unwanted Event

Threats Preventive Barriers Unwanted Event

Top event Mitigation barriers Consequence

Complete Bowtie Diagram

Swiss cheese model –Hazard -Barriers– Incident

Barriers in accident prevention

The Hierarchy of Hazard Control Methodology

Increased reliability Barrier system Increased reliability 1. Accountability 2. Detect – Decide - Act 3. Safety Critical Task 4. Safety Critical Equipment

Simple application - Bowtie - Car Incident

Organisations manage risk using ‘barriers’ Swiss cheese model Organisations manage risk using ‘barriers’ Barriers – use of equipment, design of plant (redundancy, overflows, etc.), following rules, procedures, standards …… usually barriers are people doing a job Barriers are ‘functions’ Why incidents happen .

Why do barriers fail? & Weakness in Incident causation path Underlying causes Preconditions Immediate causes Creates That influences the person To take action or inaction That causes barriers to fail That result in Accidents, incidents and business upsets An organisation Error / violation promoting conditions SMS Leadership Culture Performance influencing factors (PIFs) Competence Fatigue Environment Supervision Task Etc. Human action or inaction slips, lapses, mistakes, violations - Human and Organisational Factors

Types of Barrier in Bowtie 1. Detect – Decide - Act 2. Safety Critical Equipment  3. Safety Critical Task 4. Accountability

End users of Bowtie Analysis Bow tie is Visual risk depiction tool for a failure mode situation Technician – Look for Hardware controls –active & passive Supervisor – Look for administrative controls - Health of controls Manager - Identify weak links in controls & monitor Sustained Operational discipline & timely maintenance & Skill development.

Thanks

Questions?

HAZARD IDENTIFICATION Techniques Commonly used : HAZOP- Identifies “process plant” type incidents(time consuming) What If Analysis- Possible outcomes of change(high dependency of skills) FMEA/FMECA-Equipment failure causes (Extremely time consuming) Task Analysis-(JSA ) Maintenance etc, incidents (Does not address process deviations Fault Tree Analysis-Combinations of failures(identified the incident first& difficult to update ) Checklists-questions to assist in hazard identification(no new hazard types are identified) HAZAN -Risk ranking tools are used Dow index OR MOND index