Bowties in process safety auditing Mireille Busque - ERM Insert then choose Picture select your picture. Right click your picture and Send to back. Copyright 2015 by ERM Worldwide Limited and/or its affiliates ( ERM ). All Rights Reserved. No part of this work may be reproduced or transmitted in any form or by any means, without prior written permission of ERM.
Process Safety Auditing Auditing is a vital part of a PSM program Demonstrate compliance with company expectations and processes Ensure suitable safeguarding measures in place Identify deficiencies in compliance or safeguarding measures. Needs to be systematic and independent. Must be relevant to the site hazards 2
Different types of audit Compliance-centred Regulatory Corporate Management systems Hazard-centred Focussed on particular hazards Safeguards necessary to control hazards 3
Audit protocol But developing an audit protocol can be problematic Process safety hazards may vary from site to site or from time to time Consequences of accident may vary and therefore different safeguards required One size does not fit all for a varied portfolio of assets Audit must consider safeguards important to prevent or mitigate site-specific process safety hazardous events 4
Using Bowties in Process Safety Auditing So how can you: Identify process safety measures relevant to particular sites? Account for local concerns and vulnerabilities? Leave a legacy of increased process safety awareness
Some bowtie concepts Various distinct causes of the top event A physical situation with a potential for harm Realistic worstcase outcomes of the top event HAZARD THREAT - 1 BARRIER - 1.1 BARRIER 1.2 CONSEQUENCE - A BARRIER - A.1 BARRIER A.2 THREAT - 2 BARRIER - 2.1 BARRIER 2.2 Location: TOP EVENT CONSEQUENCE - B BARRIER - B.1 BARRIER B.2 THREAT - 3 BARRIER - 3.1 BARRIER 3.2 ESCALATION BARRIER 6 ESCALATION BARRIER Measures to prevent a top event due to a particular threat PREVENTION The scenario which represents losing control of the hazard Measures to mitigate the consequences of a top event MITIGATION Conditions which could cause barrier to fail
Safety Cases Bowtie diagrams have many different uses: 8
Deep understanding of barrier operation els, equipment, piping, valves, flanges, seals) PC001 Pressure Vessels PC002 Heat Exchangers PC001 Pressure Vessels PC002 Heat Exchangers PC001 Pressure Vessels PC002 Heat Exchangers Overfilling of Drums Internal Corrosion External Corrosion Field operator regularly walking around Seal Leak Detection and Venting System ER009 Process Control & Alarms Impact Damage (Vehicle) Detection Systems DS002 Security Systems PC001 Pressure Vessels PC002 Heat Exchangers PC001 Pressure Vessels PC002 Heat Exchangers PC001 Pressure Vessels PC002 Heat Exchangers PC001 Pressure Vessels PC002 Heat Exchangers Earthquake/ subsidence Dropping/ Swinging Objects ER009 Process Control & Alarms PC001 Pressure Vessels PC002 Heat Exchangers PC001 Pressure Vessels PC002 Heat Exchangers PC001 Pressure Vessels PC002 Heat Exchangers Flange Management Program Main/Plant Roads Integrity as per Specification Structural Integrity SI001 Structures Structural Integrity SI001 Structures Climate Extremes (eg Heavy Rain, Strong Wind) Shutdown Systems ER009 Process Control & Alarms Pile and foundation integrity Structural Integrity SI001 Structures Periodic statutory inspection of pressure vessels Storm drains system Plant Design according to BOD and Environmental Loads Specifications Lightning PC007 Relief System (PRV, PSV, etc) Shutdown Systems Lightning protection system including earthing and bonding for buildings and tall structures as per IEC 62305 (e.g.telecommunication Tower, flare stack, columns) Structures and foundations Designed/ Constructed to Specified Safe Operating Limits Structural Integrity SI001 Structures Ignition Control IC005 Electrical Earthing Continuity (Earth Bonding) Integrity of Cranes, Mechanical Handling Equipment and Appliances Structural Integrity SI001 Structures Internal explosion inside vessel during start-up Structural Integrity SI003 Heavy Lift Cranes and Mechanical Handling Equipment Entire system is air free using N2 before introducing hydrocarbons Catalyst changing activities Ignition Control IC007 Inert Gas 01.03 LPGs (e.g. C3/C4 cuts, Raffinate 1, 2 & 3) Ignition Control IC003 Certified Electrical Equipment SI005 Road vehicles Hazardous Area Classification Detection Systems DS001 Fire & Gas Detection Ignition Control Emergency Shutdown System SD006 Emergency Shutdown Valves (ESDV) ER004 Communication Systems Detection Systems DS001 Fire & Gas Detection Emergency Shutdown System Shutdown Systems SD006 Emergency Shutdown Valves (ESDV) PS006 Passive Fire Protection ER004 Communication Systems SD009 Utility Air Centralized Shutdown Emergency Systems Fire Services (CEFS) and external agencies response Spill team Containment and Accidential Chemical Containment (ACC) Drainage System SD009 Utility Air Emergency Power System and UPS ER005 Uninterruptable Power Supply (UPS) ER007 Emergency Power Protection Systems Waste Water Treatment facilities Protection Systems PS001 Deluge Systems PS009 Sprinkler Systems Environmental Impact ER008 Manual Fire Fighting Equipment Emergency Power System and UPS ER005 Uninterruptable Power Supply (UPS) ER007 Emergency Power ER001 Temporary Refuge/ Primary Muster Areas ER002 Escape & Evacuation Routes ER003 Emergency/ Escape Lighting ER004 Communication Systems Protection Systems ER001 Temporary Refuge/ Primary Muster Areas Bowtie diagrams have many different uses: Process Equipment and Piping Systems Operated within Specified Safe Operating Limits ystems Designed/ Installed/ Commissioned to Specified Safe Operating Limits [Design Basis] Process Upset (e.g. over-pressure, over temperature) Process Equipment and Piping Systems Operated within Specified Safe Operating Limits Instrument Protective Function, Instrumented Protection System and Emergency Shutdown Systems (ESD) Process Equipment and Piping Systems Designed/ Installed/ Commissioned to Specified Safe Operating Limits [Design Basis] Process Monitoring Control System with operator intervention [Control room operator operates the plant according to standard operating procedures using the information from DCS (SOP)] SD001 Emergency Shutdown (ESD) Control System Overpressure Protection System and Relief System Process Equipment and Piping Systems Operated within Specified Safe Operating Limits Instrument Protective Function, Instrumented Protection System and Emergency Shutdown Systems (ESD) Process Equipment and Piping Systems Designed/ Installed/ Commissioned to Specified Safe Operating Limits [Design Basis] Process Monitoring Control System with operator intervention [Control room operator operates the plant according to standard operating procedures using the information from DCS (SOP)] SD001 Emergency Shutdown (ESD) Control System Corrosion Monitoring and RBI Corrosion Protection System (N2 blanketing of V-301) Process Equipment and Piping Systems Operated within Specified Safe Operating Limits (Corrosion Allowance and Material Selection) Process Equipment and Piping Systems Designed/ Installed/ Comissioned to Specified Safe Operating Limits (Corrosion Allowance, Material Selection and vessel linings as directed by licensors) Process Equipment and Piping Systems Operated within Specified Safe Operating Limits (Coating Integrity) Process Equipment and Piping Systems Designed/ Installed/ Comissioned to Specified Safe Operating Limits (Coating Integrity) & 3) Preventive maintenance of pumps and replacement of seals based on condition of seals Area Demarcation between Process and non-process facilities Perimeter fence to prevent access to site by unauthorized vehicles Corrosion Monitoring and RBI Insulating gasket between dissimilar materials All flange are fitted with inner ring, spiral wound gasket Safety distance between roads and process equipment Operational control of ignition sources (e.g. Hot Work Permit, Vehicle entry restrictions etc) Flame/Flammable Gas Detectors to init Dete Ignition Control: Lightning protection system for buildings and tall structures (e.g.telecommunication Tow All vehicle movements in process areas are subjected to permit to work system or controlled by procedures if routine Occupied buildings (OSB) designed for blast load and fire Emergency telecommunication system (e.g. dedicated hotline, PAGA) Operational control of ignition sources (e.g. Hot Work Permit, Vehicle entry restrictions etc) Centralized Emergency Fire Services (CEFS) and external agencies response team Flame/Flammable Gas Detectors to initiate Alarms with operator to verify and initiate shutdown if appropriate Passive Fire Protection System Firewater (Fire proofing Spray for System steel structures (including Ring supporting Main/Other HC vessels Distribution and piperacks) System, Deluge valves and Water Spray System) Escape evacuation and rescue facilities including escape route, emergency Fire/ explosion lighting escalation and wind mitigated sock by safety distance between process units and manned populated areas Detection by field operator and use of Manual Call Points with operator acknowledgement (no detection equipment) Ignition Control: Lightning protection system for buildings and tall structures (e.g.telecommunication Tower, flare stack, columns) as per IEC requirement Manual/Portable Firefighting Equipment operated by MTBE emergency response team (including fire hydrants, fire water monitors, mobile foam cart) SD001 Emergency Shutdown (ESD) Control System Control of Ignition sources (e.g. Earthing and Bonding Equipment, Vehicle/ Equipment Spark Arrestors, Thermal Insulation for high temperature explosed surfaces) PS002 Explosion Protection including Blast Barriers and Venting Provisions IC005 Electrical Earthing Continuity (Earth Bonding) PS005 Firewater Ringmain and Other Distribution Systems RAPID SCCU Facilities: Loss of Containment - U3420 MTBE - L and V IC005 Electrical Earthing Continuity (Earth Bonding) IC008 Miscellaneous Ignition Control Components, Vehicle/ Equipment Spark Arrestors, Thermal Insulation for high temperature explosed surfaces) Ignition Control IC003 Certified Electrical Equipment Flame/Flammable Gas Detectors to initiate Alarms with operator to verify and initiate shutdown if appropriate Detection by field operator and use of Manual Call Points with operator acknowledgement (no detection equipment) Ignition IC005 Electrical Earthing Contin Fire/ Explosion/ leading to onsite/ offsite personnel injuries/ fatalitie Part of design process Understand hazards Identify Safety Critical Elements Identify Safety Critical Tasks Capture actions and recommendations ALARP demonstration Structure design according to BOD and seismic activities specifications TBE - L and V Piping design to allow flexibility during earthquake activities SD001 Emergency Shutdown (ESD) Control System IC005 Electrical Earthing Continuity (Earth Bonding) ER010 Bunding and Drains (Hazardous and Non-hazardous) ER010 Bunding and Drains (Hazardous and Non-hazardous) ER010 Bunding and Drains (Hazardous and Non-hazardous) IC008 Miscellaneous Ignition Control Components SI005 Road vehicles Lifting Activities are strictly Dedicated controlled Areas by Permit with to suitable Work system foundation for supporting heavy lifting crane Hazardous Area Classification Structural failure for process structures, storage tanks and vessel supports (eg fatigue, corrosion, human error etc) Daily visual inspection by field operator Structures and Foundations Operated within Specified Safe Operating Limits 9 Steam purge of reactor before opening to atmosphere
Communicating hazard management Bowtie diagrams have many different uses: Senior Leaders High-level overview HAZARD BARRIER - A.1 BARRIER A.2 CONSEQUENCE - A BARRIER - B.1 BARRIER B.2 CONSEQUENCE - B Conversation-starter for site visits Context for process safety KPI Workforce Location: TOP EVENT Hazard overview THREAT - 1 BARRIER - 1.1 THREAT - 2 BARRIER 1.2 BARRIER - 2.1 THREAT - 3 BARRIER 2.2 BARRIER - 3.1 BARRIER 3.2 Operational risk assessment Permit risk assessment 10
Bowtie use in various industries "Bowtie is one of many barrier risk models available to assist the identification and management of risk and it is this particular model we have found (and are still finding) useful". We are improving our risk management process through the objective centred bow tie approach. 11 ERM is also using bowties with clients in: Food production Manufacturing Road transport Upstream O&G Downstream O&G Chemicals
Using Bowties in Process Safety Auditing HAZARD THREAT - 1 BARRIER - 1.1 BARRIER 1.2 CONSEQUENCE - A BARRIER - A.1 BARRIER A.2 THREAT - 2 BARRIER - 2.1 BARRIER 2.2 Location: TOP EVENT CONSEQUENCE - B BARRIER - B.1 BARRIER B.2 THREAT - 3 BARRIER - 3.1 BARRIER 3.2 ESCALATION BARRIER ESCALATION BARRIER Bowties provide all information necessary to develop a focussed audit protocol
Using bowties For each barrier on a bowtie Does it actually exist? Is there evidence of a maintenance program? Is the responsible person competent? Is it appropriate for the hazard Is it in good order? 13
Typical application Techniques typically applied to: Large organisations with many sites having similar hazards Single sites with a range of hazards Sites which are at an early stage of process safety maturity May have generic bowties for large organisations Generic bowties must be made local what s different here? May need to develop bowties where none exist Hazard Identification Develop bowties for a couple of hazards Developing bowties in a workshop is the first part of the audit! Gaps or deficiencies often become apparent without even looking at the site. 14
Typical application HAZID and bowtie workshop Provides insight to audit team to identify areas to investigate further Takes site team on a journey of discovery, rather than just presenting findings Bowtie is useful for site to use in training and for raising process safety awareness 15 Audit process split between Process safety safeguards equipment and tasks Management systems eg MoC, PTW
Audit output Findings around: Control strategy Have you got the right controls? Overall control effectiveness Do the controls actually work? Do people know what they have to do to make controls effectiveness? Management systems Do these support the effectiveness of controls? Greater understanding of process safety hazards and the measures necessary to manage them effectively 16
Typical Site Audit 4-5 days 2.5 days 2 days
Advantages of method Focussed: On those systems, tasks and equipment of direct importance to managing process Flexible: To allow the auditor to follow areas of particular concern at each site Educative: Allows sites to understand why findings are important and the potential outcomes of weaknesses 18
Application of method ERM engaged in major programme with manufacturing organisation Sites on all continents Variety of hazards Differing levels of maturity Successful program delivering Understanding of process safety issues across portfolio Increased process safety awareness across sites 19
Available guidance on bowties 20
Questions