Petroleum Development Oman L. L. C. Document Title: Specification for hse cases

10BOW-TIES

The Bow-Tie is a model that represents how a Hazard can be released, escalate, and how it is controlled. It contains the elements required to effectively manage the Hazard such that the risks are tolerable and ALARP. Bow-Ties can also be used to support risk management of non-HSE processes.

1. 
   Identification of the hazard release, escalation and consequence scenarios
   
2. 
   Identification of controls, e.g. barriers and escalation factor controls required to manage the hazards
   
3. 
   Categorisation of controls into Inherent Safety, Safety Critical Element (hardware) or Critical activity (procedures, processes, operator action)
   
4. 
   A clear visual representation to enable the ALARP review to be undertaken
   
5. 
   An aid in the incident review process if occurrence of such a major incident has occurred.
   

ALARP	As Low As Reasonably Practicable (Risk) means that having reviewed all practical alternatives for Major Accident Hazard elimination, Threat Controls and Recovery Measures, further reduction in risk would involve disproportionate cost or resources for the risk reduction achieved.
Barrier	Barriers prevent or reduce the probability of each Threat (left hand side of the bow-tie), limit the extent of, of provide immediate recovery from the Consequences (right hand side of the bow-tie). Barriers may be hardware, such as safety systems (e.g. F&G ESD, etc) or management systems and procedures.
Consequence	Consequences in the bow-tie are a direct result of the Top Event occurring. Indirect consequences, if applicable shall be modelled in a separate bow-tie, Can include potential consequences that have not been heard of in the industry.
Escalation Factor	Factors that defeat, or reduce the effectiveness of a Barrier
Escalation Factor Control	Measures put into place to prevent or mitigate the effects of Escalation Factors.
Hazard	Any situation with the potential for harm to people, environment, asset or reputation e.g. hydrocarbons under pressure, dropped load.
HSE Critical Task	An HSE Critical Task develops, implements or maintains the effectiveness and integrity of a Barrier or Escalation Control Factor in Bow-Ties for Severity 5 or High Risk Hazards. HSE Critical Positions are those that execute HSE Critical Tasks
HSE Critical Position	HSE Critical Positions are those that execute HSE Critical Tasks
Major Accident Hazards (MAH)	Hazards that are classed as High Risk (Red) or severity 5 on the PDO Risk Assessment Matrix. This means any situation with the potential for major consequences (harm) to people, environment, asset and reputation if released.
Recovery Measure	Any measure put in place to manage Consequences and assist recovery from a Top Event.
Risk	The likelihood of a Top Event combined with the severity of the Consequences (The risk is from the Hazard to people, environment, asset and reputation).
Threat	Any action or mechanism that could bring about the unplanned release of a hazard.
Threat Control	Any measure put in place to prevent a Threat being successful.
Tolerable Risk	Tolerable Risks are those that have been reduced to a level where they comply with the applicable laws and regulations, standards, strategic objectives and other agreed Tolerability Criteria.
Top Event	The first thing that happens when a hazard is released. Individual bow-ties shall have a single Top Event.

1. 
   Design (inherent) features, e.g. separation distances, reduction of process pressures, minimisation of leak sources, etc. (depicted blue on the bow-tie).
   
2. 
   Safety Critical Elements (hardware and logic software), e.g. Process Containment Systems, Pressure Relief Valves, ESD, Fire and Gas Detection, Escape & Evacuation Systems, Breathing Protection, etc. (depicted green on the bow-tie)
   
3. 
   Operational Safety Processes, e.g. valve lock out/tag out, breaking containment procedures, permit to work, etc. (depicted yellow on the bow-tie)
   
4. 
   Operational Intervention Tasks, e.g. Plant Monitoring, Alarm Response, Shutdown, etc. (depicted yellow on the bow-tie)
   

1. 
   Effective in preventing the Top Event or Consequence
   
2. 
   Able to prevent a specific Threat from releasing the Hazard
   
3. 
   Verifiable – how shall the effectiveness of the barrier be confirmed?
   
4. 
   Independent of other barriers in the same Threat line, e.g. no ‘common mode failure’.
   

Common barriers or escalation factor controls that appear frequently, e.g. such as those to do with Operator/Human Error, should be modelled using a separate bow-tie to manage the single Threat of ‘Operator/Human Error’.

See Section 14 ‘ALARP demonstration’ for further information.