BowTie methodology
&
Copyright © 2012 IP Bank BV
What is…
Examples of…
Why…
BowTie in steps
Set of bowties, now what?
BowTie methodology
Copyright © 2012 IP Bank BV
What is
Bowtie risk assessment?
Copyright © 2012 IP Bank BV
Bowtie history
1979
1988
90’s
00’s
Copyright © 2012 IP Bank BV
Bowtie today
Oil & Gas
Chemical
Energy
Mining
Aviation
Rail transport
Maritime
Construction
Medical
Financial
Government
IT
Copyright © 2012 IP Bank BV
Afriqiyah Airways
Air New Zealand
Air France
Airways New Zealand
Air Service Gabon
AirTanker Services Limited
American Airlines
Amsterdam Schiphol Airport
ArkeFly
Ascent Flight Training
Avinor
Belfast City Airport
Bizjet Aircraft and Helicopters Management
Boeing Defense UK
Bristow Helicopter
Britair France
British Airways
Canadian Base Operators
Civil Aviation Authority UK
Civil Aviation Authority Singapore
CASA - Civil Aviation Safety Authority
CHC Helicopter
Christchurch International Airport
Civil Aviation Authority UK
Corendon Dutch Airlines
DGAC
ERA Helicopters
FAA
Finnair
Finnish Commuter Airlines
Flair Air
Flight Safety Foundation
Freebird Airlines
Hong Kong Civil Aviation Department
HOP Brit Air
Italfly
Irish Aviation Authority
Japan Airlines
Jayrow Helicopters
Jazeera Airways
JetStar
Kelowna Flightcraft
KLM Royal Dutch Airlines
KLM UK
London City Airport
Malaysian Airlines
Manchester Airport
MHS Aviation
Military Aviation Authority UK
Nayak Aircraft Services
Noordzee Helikopters Vlaanderen
Norwegian Air
Norwich Airport
Oman Air
Pegasus Airlines
Qantas
Royal Australian Air Force Australia
Royal Air Force UK
Royal Netherlands Aeronautical Association
Ryanair
SFS Aviation
Singapore Air Transport Training College
Shell Aircraft
International
Skyline
Helicopters
SkyWest Airlines
SmartLynx
Airlines
Turkish Airlines
UK Air Accident
Investigation
Board
Vancouver Island
Helicopters
Copyright © 2012 IP Bank BV
Cooperation with regulators
3 questions:
 Do we understand what can go wrong?
 Do we know what our systems are to prevent this from happening?
 Do we have information to assure us they are working effectively?
Copyright © 2012 IP Bank BV
Bowtie’s parents
Fault tree
Event tree
Copyright © 2012 IP Bank BV
Connect them
Copyright © 2012 IP Bank BV
Barrier thinking
Copyright © 2012 IP Bank BV
Barrier thinking
Hazard
Losses
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Barrier thinking
Hazard
Losses
Barriers
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Barrier thinking
Equipment failure
Human Factors
Poor planning
Fatigue
Etc.
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Communicative version
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
“Safety barriers are physical and/or nonphysical means planned to prevent, control, or
mitigate undesired events or accidents.”
Snorre Sklet (2006). Safety barriers:
Definition, classification, and performance.
Journal of Loss Prevention in the Process
Industries, 19(5):494–506
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Quan Qual
Goal: Calculate probability or frequency
Goal: Communicate
Scope: Mainly design phase
Scope: Operational risk management
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Examples of
Bowtie risk assessment
Copyright © 2012 IP Bank BV
Road transport
Intoxicated
driving
Driver loss of
attention (due to
phone, controlling
radio, fatigue,
eating etc.)
Breath alcohol
ignition interlock
device
Agreeing on a
designated driver
EN Engineer
DR Driver
H01.0 Driving a
vehicle
Lane departure
warning system
No use of phone
policy
EN Engineer
HSE HSE Manager
Induction includes
Distraction
awareness
TR Training
Manager
Crash into other
vehicle or
motionless object
Forward collision
warning system
Slip recovery
competence
VM Vehicle
Manager
DR Driver
Losing control
over the
vehicle
Blowout (tire)
Tyre integrity system
Defensive driving
Pre drive check of
vehicle
MM Maintenance
Manager
DR Driver
DR Driver
Driver impacts
internal of vehicle
Wearing a seatbelt
Airbag
DR Driver
VM Vehicle
Manager
Slippery road
conditions
Vehicle roll-over
Listen to weather
report and adjust
driving schedule
accordingly
Defensive driving
ABS
DR Driver
VM Vehicle
Manager
DR Driver
Roll-over protection
VM Vehicle
Manager
Poor visibility
(external)
Listen to weather
report and adjust
driving schedule
accordingly
vehicle lights are
turned on
Defensive driving
DR Driver
DR Driver
DR Driver
Copyright © 2012 IP Bank BV
Oil & Gas
Internal
Corrosion
Material Selection
and Corrosion
Allowance
Internal Coatings
Cathodic PRotection
Inspection /
Maintenance (Erosion
and Corrosion
Monitoring Program)
Corrosion Inhibition
Program / Chemical
Injection
action 2
Erosion
Fluid Velocity Limited
to Minimize Erosion
Sand Detection and
Monitoring
Equipment / Piping
Designed for MAWP
SSDS (PSH)
PSV (Relief Valves,
Rupture Discs,
Rupture Pins)
Equipment / Piping
Designed for
MAWP/V
SSDS (PSL)
Hydrocarbons in
pipeline
Overpressure
Loss of
Containment
Vacuum
Vacuum Valves /
Vents for
Armospheric
Equipment
Detoriation of
Hoses
Material Selection
and Proper
Installation
action 1
Inspection /
Maintenance of
Hoses
(Hydrocarbon / High
Pressure Service)
External Impact
Copyright © 2012 IP Bank BV
Construction (Project)
Constructive
damage of bridge
Pre-work
construction
inspection
Last-minute
construction
inspection / ability to
adapt maintenance
schedule
Recovery plan
Maintenance
activity on bridge
Jack equipment
failure
Jack equipment
inspection
Deformation of
bridge (outside
tolerance limits)
Incorrect
estimation of turn
around time
Fault analysis
Jacking up test
(before maintenance
starts)
Communication plan
Traffic
disturbance
Constant monitoring
of formation
behavior
Opening
target date &
time not met
Develop &
communicate
alternative route
Reputation
damage
10 hours buffer time
in maintenance
plan/script
Maintenance
plan/script
Incautious
jacking up
Need for
unforeseen
maintenance on
related
construction
Fine
Maintenance
plan/script
Jacking up
competence
Pre-work
construction
inspection
Last-minute
construction
inspection / ability to
adapt maintenance
schedule
Communication plan
Revise planning
other
activities/projects
Delay of other
activities /
projects
Copyright © 2012 IP Bank BV
Rail transport
Copyright © 2012 IP Bank BV
Aviation
1. ATCO issues
incorrect or
incomplete
clearance/
instruction
Constant exposure
A.01
Flt Crew challenge
ATCO clearance/
instruction
Policy/ Procedure
ATCO detects and
recognises their error
whilst listening to the
Flt Crew readback
Policy/ Procedure
CFIT: Large CAT
fixed wing aircraft
- Arrival or
departure
ATCO detects,
recognises and
corrects the potential
terrain conflict via
monitoring
Training/ proficiency
2. Flt Crew
misunderstand
clearance/
instruction
Constant exposure
Terrain
separation
deteriorating
below normal
requirements
A.02
ATCO issues
understandable
instruction using
standard phraseology
Policy/ Procedure
3. Flt Crew mis-set
altimeter pressure
setting resulting in
incorrect actual
altitude (e.g. misset QNH or low
temperature
correction)
Flt Crew request
clarification of
clearance/ instruction
from ATCO if
uncertain of details
ATCO detects and
recognises error or
misunderstanding
during Flt Crew
readback
Policy/ Procedure
Training/ proficiency
Flt Crew adhere to
SOP for correct
setting of altimeter
ATCO detects mis-set
altimeter setting via
Mode S (BAT)
Policy/ Procedure
Engineered devices
Commonly exposed
Copyright © 2012 IP Bank BV
Why
Bowtie risk assessment?
Copyright © 2012 IP Bank BV
Complexity
Copyright © 2012 IP Bank BV
Incident pyramid
No causality!
• Exploding refineries
• Multiple fatalities
• Heavy personal safety incidents
• Single fatality /disability
• LTI’s
• Slips, trips, falls
Copyright © 2012 IP Bank BV
Copyright © 2012 IP Bank BV
Risk management = safety management?
Personal Safety
Whishful Thinking
Process Safety
Copyright © 2012 IP Bank BV
Risk management = safety management?
Personal Safety
Primary Process
Risk Management
Process Safety
Copyright © 2012 IP Bank BV
First step
Plan
Check / Monitor
Do
BSCAT | Tripod Beta | BFA | RCA
Implement & communicate
the management system
Copyright © 2012 IP Bank BV
ISO 31000
HAZID
Copyright © 2012 IP Bank BV
Establishing the context
the organization articulates its objectives and defines the external
and internal parameters to be taken into account when managing
risk, and sets the scope and risk criteria for the remaining process.
Copyright © 2012 IP Bank BV
Establishing the context
What problem do we want to solve?
Who are the Bowties for?
Which locations will we include?
What can we do in terms of resources (e.g. time,
money)?
Which process, techniques will we use?
When have we succeeded?
Copyright © 2012 IP Bank BV
Zoom‐level
Point in time
Copyright © 2012 IP Bank BV
Zoom level
Copyright © 2012 IP Bank BV
Risk identification
The aim of this step is to generate a comprehensive list of
risks.
Copyright © 2012 IP Bank BV
HAZID as starting point
Pick out the high potential hazards to do a Bowtie on
Copyright © 2012 IP Bank BV
HAZID as starting point
Copyright © 2012 IP Bank BV
Risk analysis
[..] involves developing an understanding of the risk.
Copyright © 2012 IP Bank BV
Bowtie uses
We use it to Structure thinking
We use it for Risk based decision making
We use it for Communication & Training
Copyright © 2012 IP Bank BV
3 very specific advantages of a BowTie
Copyright © 2012 IP Bank BV
1
VS.
Copyright © 2012 IP Bank BV
Risk analysis
Do you have enough barriers?
?
Copyright © 2012 IP Bank BV
2
Proactive or Reactive
Copyright © 2012 IP Bank BV
3
Risk based SMS
Copyright © 2012 IP Bank BV
Understand independencies
What if the Engineering Manager...?
! ! !
Copyright © 2012 IP Bank BV
Risk evaluation
to assist in making decisions,[..] about which risks need
treatment and the priority for treatment implementation.
Copyright © 2012 IP Bank BV
Risk evaluation
What is your risk level?
Copyright © 2012 IP Bank BV
Risk treatment
selecting one or more options for modifying risks, and
implementing those options.
Copyright © 2012 IP Bank BV
The ALARP Obligation
Reduce a risk to a level which is As Low As Reasonably Practicable:
A balance of time, trouble, difficulty & cost.
Cost
Risk
Tolerability Level
Risk Appetite
Copyright © 2012 IP Bank BV
BowTie analysis in 8 steps
Top Event
EF Barrier
Hazard
Threat
Top Event
Threat
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
BowTie analysis
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Step 1. Identify Hazards
Hazard
Activity or state that has the potential to cause harm
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Hazards are…
Hazard
An activity or state, which, in case of failure, can lead to negative outcomes
Activities or states are part of normal business
Often involving energies – what are yours?
‐ Chemical
‐ Kinetic
‐ Gravitational
‐ Nuclear
‐ Thermal
‐ Pressure
‐ Biological
‐?
But also Social, Financial, Services, Organisational, etc.
Goal: Setting and defining scope for the bowtie diagram
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Step 2. Define Top Event
Top
Event
The point in time when control over the Hazard is lost
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Top Event
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Step 3. Define Threats
Threat
A possible cause for the Top Event
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Threats
Threats should lead to the Top Event directly and independently
Hazard
Threat
Threat
Threat
Top event
Causally direct, not in terms of time
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Barrier Failures
Can be recognized by terms such as: Lack of, Failure of, absence of… Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Threats
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Step 4. Define Consequences
Consequence
An unwanted event caused by the Top Event
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Damage vs. Events
Injury / fatality
Equipment damage
Environmental damage
Reputation damage
Smoke inhalation / blunt impact
Object impacts live equipment
Oil spill into sea
Go into Risk matrices on Consequences
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Step 5 & 6. Defining Barriers Barrier
Measures taken to prevent or mitigate events
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Barrier Function
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Barriers
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Step 7. Define Escalation Factors
Escalation
Factor
A condition that defeats or reduces the effectiveness of a Barrier
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Escalation Factor
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Four main categories
There are four main Escalation Factor categories:
Human Factors
Mechanical Failures
Abnormal Conditions
Loss of Critical Services
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Step 8. Defining EF Barriers EF Barrier
A Barrier for an Escalation Factor
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Escalation Factor Barrier
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Basic BowTie diagram
Effectiveness
Job titles
Criticalities
Barrier type
Systems
RAM scores
Actions
Documents
Activities
Management System
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
What’s in a .btf?
Threat or Cause
Control or Barrier
Bowtie Diagrams
Very poor
Poor
Unknown
Good
Very Good
Categories
Risk matrices
W‐1.2.01 : Contractor Selection
W‐1.2.02 : Quality Checks
W‐1.2.03 : Pressure Testing
FRM.02 : Approval Form
FRM.04 : Pressure Test Form
FRM.05 : Welding PTW
Management System
Terminology
‐ Quantification models
‐ Incident analysis
‐ Operations (SOOB)
Advanced
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Providing additional information
Job Titles (Accountable person)
Barrier Effectiveness
Barrier Type
Barrier criticality
Activities
Document Links
Actions
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
BowTieXP Metadata
Document links
Actions
Acceptance Criteria
Document links
Actions
Affects
Accountabilities
Sign Off
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
BowTieXP Metadata
Activities
Barrier Types
Effectiveness
Document links
Accountabilities
Actions
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Set of bowties, now what…?
Copyright © 2012 IP Bank BV
Copyright © 2015 IP Bank B.V.
Communication and consultation
Communication and consultation with external and internal
stakeholders should take place during all stages of the risk
management process.
Copyright © 2012 IP Bank BV
Communicating risks
VS.
Copyright © 2012 IP Bank BV
Easy data filtering on the diagram
Intoxicated
driving
Periodic medical
examination for
professional
drivers
Driver loss of
attention (due
to phone,
controlling
radio, fatigue,
eating etc.)
Blowout (tire)
Breath alcohol
ignition interlock
device
Lane departure
warning system
Intoxicated
driving
No use of phone
policy
Lane departure
warning system
Induction includes
Breath alcohol
Distraction
ignition interlock
awareness
device
H01.0 Driving
Driving a
H01.0
vehicle
vehicle
Blowout (tire)
Tyre integrity
system
Lack of
Lack of
appropriate
appropriate
equipment
equipment
Agreeing on a
designated driver
Tyre integrity
system
Defensive
driving
Forward collision
warning system
Pre drive check of
Pre drive
check of
vehicle
vehicle
Driver impacts
internal of
vehicle
Wearing a seatbelt
seatbelt
Weekly vehicle
Weekly
vehicle
workshop
checks
workshop checks
Unexpected
manoeuvre
from nearby
vehicle
Keep appropriate
Keep
appropriate
equipment
in stock
equipment in stock
Maintain
Maintain
equipment
equipment
Unexpected
manoeuvre
from nearby
vehicle
Adjust vehicle
mirrors
Defensive driving
Losing
Losing
control over
over
control
the vehicle
vehicle
the
No
No protrusions
protrusions on
on
front
front or
or side
side of
of
vehicle
vehicle
ABS
ABS
Competence
Roll-over in
confined
space
protection
rescue
Slippery road
conditions
Slippery road
conditions
Listen to weather
report and adjust
driving schedule
accordingly
Defensive driving
ABS
ABS
Hitting
Hitting aa
pedestrian/
pedestrian/
cyclist
cyclist
Crash
into
deep
Vehicle
rollwaterover
resulting
in entrapment
Vehicle rollover
Defensive driving
Poor visibility
(external)
vehicle lights are
turned on
Head rest adjusted
to appropriate
height
Driver impacts
internal of
vehicle
vehicle lights are
turned on
Pre-journey
planning
Listen to weather
report and adjust
driving schedule
accordingly
Airbag
Crumple zone
Roll-over
protection
Poor visibility
(external)
Uneven road
surface
Slip recovery
competence
Crash into
other vehicle or
motionless
object
Defensive driving
Design - company
vehcle spec
includes lights
always on
Example: show only data for specific job title
(here: Maintenance Manager)
Copyright © 2012 IP Bank BV
Safety improvements
Copyright © 2012 IP Bank BV
Monitoring and review
Copyright © 2012 IP Bank BV
Monitoring and review
How are your barriers performing?
Copyright © 2012 IP Bank BV
Barrier-based Audits
Q01: (Stock keeping)
“Are the fall protection materials available at the site?”
Q02: (Training)
“Is the personnel competent in the use of the harness?”
Q03: (Procedures)
“Does the personnel know for which tasks the harness must be used?”
Copyright © 2012 IP Bank BV
Monitoring and review
H01.0 Driving a
vehicle
Intoxicated
driving
Slippery road
conditions
Defensive driving
Failed: 0
Missing: 0
Unreliable: 2
Effective: 0
Forward collision
warning system
Slip recovery
competence
Crumple zone
Failed: 0
Failed: 1
Failed: 0
Missing: 0
Missing: 0
Missing: 1
Unreliable: 0
Unreliable: 0
Unreliable: 1
Effective: 1
Effective: 0
Effective: 1
Losing
control over
the vehicle
Wearing a seatbelt
Airbag
Head rest adjusted
to appropriate
height
Failed: 12
Failed: 12
Failed: 1
Missing: 0
Missing: 0
Missing: 0
Unreliable: 0
Unreliable: 1
Unreliable: 0
Effective: 3
Effective: 2
Effective: 0
Crash into
other vehicle or
motionless
object
Driver impacts
internal of
vehicle
Poor visibility
(external)
Defensive driving
Failed: 0
Missing: 0
Unreliable: 2
Effective: 1
Vehicle rollover
Roll-over
protection
Failed: 0
Missing: 1
Unreliable: 0
Effective: 0
Copyright © 2012 IP Bank BV
Incidents
Copyright © 2012 IP Bank BV
Incidents
Copyright © 2012 IP Bank BV
Risk Management Process
Incident analysis
Audits
Inspections
Critical risks
Risk Register
Non critical risks
Bowtie diagram
Operation
Copyright © 2012 IP Bank BV
1. Centralized BowTie Storage
3. Barrier Performance
2. Analyze data
‐
‐
‐
‐
Organizational map
BowTie registers
Barrier Register
Barrier History
‐
‐
‐
‐
‐ Hazid Module
‐ WorkBowTies
Audit data
Incident data
Maintenance data
Permit data
‐ Action Tracking
‐ Wiki documents
4. Platform for Applications
Copyright © 2012 IP Bank BV
Applications
SIR
HAZID
WorkBowTies
Wiki
Copyright © 2012 IP Bank BV