Bow-Tie Diagrams in the process industries

16 July 2018

Within the process industries Bow-Tie diagrams are becoming increasingly popular as a means of displaying hazards, consequences and the barriers, which prevent realisation of the hazard and mitigate the consequence. In this article, John Martin of ABB explains the background to barrier management, the uses and benefits of Bow-Tie diagrams and methods to ensure they are as useful as possible in whatever hazardous cenario they are employed.

The visual impact of Bow-Tie diagrams is very powerful, allowing a rapid and qualitative assessment of the protections against hazard realisation. However, the diagrams have limitations and should be used as part of a comprehensive barrier management strategy in order to maximise effectiveness.

What are Bow-Tie diagrams?

The Bow-Tie diagram itself is a visual representation of hazards, the potential consequence should the hazard be realised, control measures preventing realisation of the hazard and mitigation measures aimed at limiting the severity of the consequence once the hazard has been realised. The control measures and mitigation measures are collectively referred to as “barriers”.

The centre of the bow tie diagram is the “top level” event - this is the significant event that we want to avoid - the hazard - examples might be overfilling of a gasoline storage tank or occurrence of a runaway reaction. On the left hand side of the top level event are the initiating events which begin the journey towards the hazard - these are often referred to as “causes”.

In between the causes and the hazard are the preventive barriers which, if successful, will interrupt the journey from cause to hazard and if unsuccessful will allow that journey to proceed. In effect this side of the diagram is a fault tree without any numerical data. On the right hand side of the diagram are the “consequences” and in between the hazard and the consequences are the mitigation barriers which, if successful, interrupt or mitigate the journey from the hazard to the consequence. This half of the Bow-Tie diagram is effectively an event tree without numerical information. A basic Bow-Tie is illustrated in the diagram below.

How can we maximise the effectiveness of Bow-Tie diagrams?

The process industries operate with inventories of materials which are often large as well as flammable or toxic; furthermore operation at high temperature and pressure is common. The combination of significant hazardous inventory and challenging operating conditions results in the potential to pose risk to both those who work on the process and to those who reside close to the facility. The process industries have been pathfinders in developing procedures for the identification and management of hazards. Bow-Tie diagrams form a part of the tools and techniques currently used to understand hazards and then to put in place effective barriers to control the hazard. It is important to place Bow-Tie diagrams in their correct place in the barrier management process in order to maximise their value and effectiveness.

Steps in the Barrier Management Process

1. Identification of hazards

Hazard identification should be initiated at the earliest stage of design and should continue throughout the life of the asset. Failure to identify hazards which pose a threat to the safety of people or the integrity of the environment means that the hazard cannot be managed. Many organisations will also want to understand how hazards may pose a threat to their ability to continue productive operation of the asset.

For many years HAZOP studies have been used within the process industries to identify hazards. Initially intended as a tool to identify and act on hazards during the detailed design phase, hazard study methodology has been expanded into a system which can be used to identify hazards from earliest concept, through design, commissioning, ongoing operation and for modifications. Other structured approaches such as HAZID (Hazard Identification) and PHR (Process Hazard Review) can also be powerful in identifying hazards when used in the correct phase of the asset life.

Key outputs from any of the structured Risk Review techniques should be:-

* Identification of hazardous event scenarios;

* A statement of the potential consequence should the scenario be realised;

* A summary of the current barriers preventing realisation of the event and mitigating the consequence;

* The review team’s estimate of the risk given the potential consequence and the existing barriers;

* A clear statement of any actions for improvement which the review team wish to generate, in order to reduce risks so that they are tolerable and ALARP (As Low As Reasonably Practicable).

It would be expected that any process with associated significant hazards has an up to date Risk Review based on an appropriate methodology.

2. Barriers preventing and mitigating hazards

The Risk Review should identify the requirement for barriers to protect against or mitigate a hazard, and may also consider the effectiveness of those barriers currently in place - a tank may have a high level trip but if this does not stop flow on the line filling the tank then the trip will be ineffective.

It is at this stage that there is likely to be benefit in preparing Bow-Tie diagrams for some of the important hazards which have been identified. It is important that the diagram is consistent with data generated in the Hazard Identification studies and that the diagram presents the data in a way which is useful to those responsible for managing the hazards – engineers, operators, managers.

An Example of a Bow-Tie Diagram

The Bow-Tie is a means of visually communicating information and it is very important to consider how much information is displayed in the Bow-Tie diagram - the benefit of visual impact can quickly become lost if the Bow-Tie structure becomes too complex or if too much annotation is added so that the diagram becomes unwieldy and cumbersome. A picture may say a thousand words, but a picture which contains a thousand words may have a much reduced impact.

Since the Bow-Tie is visual; when detail is added it is useful to make this visible as well. Proprietary software can be very useful for the construction of the diagrams, as this provides a consistent and professional appearance and may improve the layout of the diagram. Colours may be used to denote the type of barrier or the strength of the barrier.

It might be possible to construct too many Bow-Ties so that either quality suffers, due to lack of time per diagram, or the majority of diagrams are never used, which means effort has been wasted. Therefore before investing time and effort in the construction of the diagrams it is advisable to ask in what way the diagram will be of assistance on the barrier management journey, and it may be decided that bow tie diagrams will only be developed for certain hazards – typically those with the highest potential impact.

The Bow-Tie diagram should display the barriers (preventative and mitigating) between the initial cause and the ultimate consequence. This may provoke some debate around whether or not the quantity and integrity of the barriers is adequate versus the hazard they protect against. It may also be possible to show the nature of the barriers - a very high proportion of barriers requiring human intervention to be effective, for instance reaction to alarms, may be a cause of concern - particularly if they all run through a single individual. For operating plant the Bow-Tie may also be useful for displaying which barriers are currently either compromised or not working at all, and then deciding whether safe operation can continue and whether or not additional temporary barriers are required.

3. Required barrier integrity

The Bow-Tie diagram displays barriers, and may be annotated to give an indication of the barrier integrity. However, determination of either the required or delivered integrity requires other tools, with this being the next stage of the Barrier Management journey.

Risk Reviews should identify current barriers and may suggest the need for additional barriers. It is also necessary to demonstrate that the combination of barriers reduces the risk to a level which is tolerable and ALARP (As Low As Reasonably Practicable). There are a number of well documented methods for this assessment such as Risk Graph, Layer of Protection Analysis (LOPA) and Quantitative Risk Assessment (QRA), which can be used. It is important to select a method with the appropriate level of depth and rigour for the problem being considered - the international standard IEC61511 provides examples of different methods. For Instrumented Protective Systems the IEC standard also provides a generally recognised framework for assigning and managing integrity levels (for instance, SIL 1 will correspond with a Probability of Failure on Demand (PFDavg) of between 0.1 and 0.01).

Once the required barrier integrity has been established, the barrier must be designed to meet this value. In a retrospective study, calculations must be available or carried out on existing equipment to demonstrate that the required level of integrity is achieved, and if this is not the case appropriate modifications must be installed.

4. Maintenance of barriers

Barriers must be maintained so that they continue to provide the required level of integrity and must be tested in order to demonstrate that they are effective and meet specific requirements - for instance, time for a critical automated isolation valve to close. Hence a maintenance and testing regime must be fully documented - for a Safety Instrumented System (SIS) this may form part of a critical maintenance schedule, whilst for barriers relying on human intervention training, procedures and auditing records may be appropriate. It is important that all such records are kept up to date.

Summary

Bow-Tie diagrams can be very useful to engineers, operators and managers for displaying hazards, consequences and barriers, but it is very important to understand that these diagrams must take their input data from structured Risk Review exercises involving all appropriate disciplines and functions. Attempts to short cut this process by generating the Bow-Tie diagram without the output of a structured Risk Review or without the input of key disciplines or functions are likely to result in a very unsatisfactory output and may lead to inaccurate or inadequate Bow-Tie diagrams, or even an absence of diagrams for the most important hazards.

Following the barrier management journey through its stages:-

* Hazard Identification;

* Barrier Identification;

* Determination of Required Barrier Integrity;

* Demonstration of barrier integrity;

provides a structured methodology into which generation of Bow-Tie diagrams can be incorporated. This allows the diagrams to be constructed with confidence in the input data and maximises the likelihood of the diagram being useful in decision making by the end users.

The power of the Bow-Tie diagram is in its visual impact, and so the layout of the diagram and the information to be conveyed must form an important part of the construction of the diagram. A well organised Bow-Tie diagram may be very helpful in qualitatively evaluating the adequacy of barriers either proposed in design or present in an operating plant.

About the author

John Martin is a chemical engineer who has worked in research, design, operations and new process development within the chemical industry. Currently he is a process safety consultant with ABB looking at major accident hazards throughout the process industries.