This paper describes an approach to standardizing proactive incident investigation to failed or impaired barriers and risk management. Whilst many will agree that the Oil and Gas (O&G) and process industries have been very successful in improving occupational safety, improvements in process safety management are lagging. Process Hazard Assessments has become a recognised tool to assess process design and production operations around the world even though they have a tendency to concentrate on the design phase only, rather than considering all aspects of the integrity of operating systems in the total life cycle of the asset. In response, barrier management based on the BowTie model is being widely promoted in the O&G industry to understand operational risk in more detail and influence potential results. The structured approach of the BowTie forces an assessment of how well all initial threats are being controlled and how well prepared the organisation is to mitigate consequences should things start to go wrong in the total life cycle of the asset. It highlights the direct link between the controls (preventive and corrective) and the management systems. But how can risk based on the performance of these process safety barriers be managed? In general barriers are not fully reliable. They have common causes of failure (i.e. human factor, organisational deficiencies, etc.), there are paradigm shifts in barrier expectations (i.e.shallow water vs deep water drilling) and multiple barriers are required to assure to acceptance level of risk. In the event of a major process safety incident, the scenario is investigated in-depth and the failures of the barriers are analysed by utilising methods such as 5-why, TRIPOD, SCAT, etc. The lessons learned include optimising barriers and defining missing barriers. From a preventive point of view, however, it is even more important to investigate failed barriers individually as Tier 3 or Tier 4 incidents as defined in the API-754. This paper reviews the process and results of such an effort. The author has utilised this method for O&G operating companies and discusses the lessons learned from this experience. Based on the results from this application, it is shown that the BowTie method in combination with incident analyses on barriers can be adapted for understanding and monitoring barrier performance and how to influence barrier performance.

Process Hazard Assessments is a recognized tool for assessing process design and production operations around the world. However, the methodology utilized to assess hazards range from standard HAZID, HAZOP and SIL workshops to complex consequence models (computational fluid models). In most cases the workshops can be based on the number and experience of the professionals present and the level of detail and time allowed for the assessment. Process Hazard Assessments also tend to concentrate on risks typically encountered in the design phase and not the total life cycle of the asset.The BowTie methodology offers a structured approach for assessing how well all initial threats are being controlled and how prepared an organization is to mitigate consequences should things go wrong. It highlights the direct link between (preventive and corrective) controls and management systems, which include operational management systems, Health, Safety and Environment management systems, and asset integrity management systems.The BowTie methodology has to date not been widely utilized in the determination of leading and lagging Key Performance Indicators for the operational risk management systems, despite the availability of this methodology for several decades. To encourage using the methodology, an approach has been developed to determine the leading and lagging Key Performance Indicators utilizing BowTie's. This paper reviews this process and presents different experiences and lessons learned from applying the method within (petro)chemical and pipeline companies. Based on the results, recommendations are made and conclusions drawn about how the BowTie method can best be adapted for determining leading as well as lagging Key Performance Indicators. Objective and structure of paperThe objective of the paper is to determine leading and lagging Key Performance Indicators (KPI's) using the BowTie methodology and then assess the relevance of the selected KPI's as early warnings for major incidents. In this paper the definition of a major incident is an incident that has resulted in multiple fatalities and/or serious damage possibly beyond the asset itself and initiated by a loss of containment, a major structural failure or a loss of stability. Major incidents are relatively infrequent compared to occupational safety incidents. The KPI's for major incidents are based only on rare occurrences and may not yield in sufficient data to manage future major incidents easily.

Proper estimation of Safety Integrity Level (SIL) depends largely on accurate estimation of Safety performance in terms of average Probability of Failure on Demand, (PFDavg). For complex architectures of logic solvers, sensors, and valves, this can be calculated by distinguishing combinations of subsystems with basic (K-out-of-N) KooN approach for identical components. In the case of the typical configurations of valves for a burner management systems with non-identical subsystem configurations the KooN approach does not apply. Hence, it becomes an issues to calculate the correct safety performance since some of the established methods give too optimistic results due to lack of Common cause Failure information and data on non-identical components or sub-systems. This paper formulates a Markov model for determination of average probability of failure on demand for non-identical components and also proposes a more conservative lowest failure rate approach and maximum beta factor contrary to pragmatic minimum or average beta for correct estimation of average probability of failure on demand. It can be deduced that the measure of safety performance for components or subsystems with unequal failure rates depends largely on common cause failure, but a single beta factor is not appropriate to model the commonality of the failure. The result revealed that both geometric mean and lowest failure rate approaches result in different values with the lowest failure rate being the most conservative and optimistic result.