CDOIF Guidance

150 / 648

Safety and environmental standards for fuel storage sites
Final report
148
36 There may be a number of ‘causes’ that may lead to this event (eg human error, corrosion)
and these are each listed on the left-hand side of the diagram. For each ‘cause’, safety elements
that will serve to prevent or reduce the likelihood of the event are represented as ‘barriers’. These
‘barriers’ may be physical (eg cathodic protection system to prevent corrosion) or procedural (eg
speed limits).
37 If the event does occur, it is likely that there will be a number of possible ‘outcomes’ (eg fire,
explosion, toxic effects, and environmental damage). These ‘outcomes’ are represented on the
right-hand side of the diagram. As with the ‘causes’, safety elements serving to mitigate the effect
of the hazardous event and prevent the ‘outcome’ are listed for each ‘outcome’. Again, these may
be hardware (eg bunding, foam pourers) or procedural (eg ignition control, spill response).
38 Bow-tie diagrams have a number of advantages. They:
provide a visual representation of causes/outcomes/barriers; ■
■
are easily understood and absorbed; ■
■
may be developed in a workshop setting similar to a HAZID; ■
■
may be used to rank outcomes using a risk matrix; ■
■
help identify ‘causes’ with inadequate barriers. ■
■
39 Bow-tie diagrams can be used as a stand-alone qualitative hazard identification tool or as the
first step in a quantified risk assessment. Depending on the software used, the data on a bow-
tie diagram may be output as a hazard register and responsibilities for ensuring that barriers are
effective may be assigned.
Layer of protection analysis (LOPA)
40 In the last ten years or so, LOPA has emerged as a simplified form of quantitative risk
assessment. LOPA is a semi-quantitative tool for analysing and assessing risk. This analytical
procedure looks at the safeguards on a process plant to evaluate the adequacy of the existing
or proposed layers of protection against known hazards. It typically builds on the information
developed during a qualitative hazard evaluation, such as a process hazard analysis (PHA) and
can be used to meet the risk assessment requirements of IEC 61508 and 61511. Significant
scenarios are identified and frequencies are estimated for the worst-case events. Risk categories
are assigned to determine the number of independent protection layers (IPLs) that should be in
place. For a measure to be an IPL it should be both independent and auditable.
ARAMIS
41 A project funded by the European Commission on Accidental Risk Assessment Methodology
for Industries (ARAMIS), in the context of the Seveso II Directive, has recently been completed.
The project aimed to develop a harmonised risk-assessment methodology, to evaluate the risk
level of industrial establishments, by taking into account the accident-prevention tools (safety
devices and safety management) implemented by the operators.
42 The user guide to ARAMIS is available online at and
has the following major steps:
methodology for identification of major accident hazards (MIMAH); ■
■
identification of safety barriers and assessment of their performances; ■
■
evaluation of safety management efficiency to barrier reliability; ■
■
identification of reference accident scenarios; ■
■
assessment and mapping of the risk severity of reference scenarios; ■
■
evaluation and mapping of the vulnerability of the plant’s surroundings. ■
■
43 MIMAH is a standardised systematic approach for the identification of hazards. MIMAH is
complementary to existing methods, such as HAZOP, FMEA, checklists etc and ensures a better
exhaustiveness in terms of hazard- and safety-barrier identification. Bow-ties are the basis of MIMAH
methodology in ARAMIS. LOPA is a means of assessing the performance of the safety barriers.