to explain to the workforce,regulator and stakeholders.

This can, however, be mademuch easier with the help of aninteractive graphicalrepresentation. This graphical

In an industry which ismoving further towardsdemonstrable andaccountable riskmanagement, theTHESIS Bow-Tie tool isgaining greateracceptance. Themethodology is provenby track record in theoffshore, process andsecurity risk industriesand the toolcontinuously adapted tosuite the need.THESIS (The Health,Environment, Safety InformationSystem) is a software tool thatcan effectively demonstrate howa facility's Safety ManagementSystem can be implemented. Itassists companies/operators in theanalysis and management of thehazards and risks to which theirbusiness is exposed, andgraphically displays andillustrates the relationshipbetween hazards, controls, riskreduction measures and a

business's HSSE activities.Regulators and stakeholders

across the world are progressivelyexpecting more information to beincluded in the documentationused to demonstrate that anoperation/asset has an effectivesafety management system. Thisis becoming increasingly evidentin the marine industry in the formof equivalent safety cases whichaim to confirm that: all credible hazards have been

identified; appropriate standards have

been set and met; adequate safety features are in

place; all significant assumptions

have been identified, verified and validated;

all instructions, limits and conditions required to maintain operations within specified margins for safety have been met.

In addressing these aims, anumber of documents would betraditionally generated. These

documents inherently becomeincreasingly complicated with theonus on fulfilling the requirementsand the explanation of all theinteractions between thesedocuments becomes more difficult

OPERATIONS REGULATIONS

September 2006 z TANKEROperator 35

The application of THESIS Bow-Ties in marine safetymanagement*

Review

Organisation, Responsibilities, Resources, Standards & Docs.

Hazard & Effects Management Process

Planning & Procedures

Implementation & Monitoring

Policy & Strategic Objectives

Audit

Safety Policy Strategic Objectives & Targets

Organisational Structure & Responsibilities

Management Representatives Resources Competence Contractors Communication Identification of Hazards &

Effects Risk Evaluation Recording of Hazards & Effects Objectives of Performance

Criteria Asset Integrity Procedures & Work Instructions Management of Change Contingency & Emergency

Planning

Monitoring Records Non-Compliance & Corrective

Action Incident Reporting & Follow-Up

Management Review

Internal Audit Independent Audits

ELEMENTS

REQUIREMENTS

Figure 1: Typical elements and requirements of a facility's riskmanagement system

p32-36.qxd 06/09/2006 06:55 Page 4

TANKEROperatorSEPTEMBER 2006 www.tankeroperator.com

barriers, capture system shortfalls and

set remedial action plans define the tasks and personnel

for managing barriers and indeed assign them

set task frequencies assign documentation and

standards populate a risk matrix and

illustrate the risk profile produce reports for use in

supporting documentation eg. safety manual, audit, training, appraisal etc.

THESIS SummaryTHESIS is an application,originally developed by Shell andnow jointly with ABS Consulting.It has been developed based on theBow-Tie concept to visuallydisplay how hazards are controlledand how the risk associated withthem is reduced to As Low AsReasonably Practical (ALARP). Itdocuments the provenance ofinformation and the referencesources from which theinformation is obtained, i.e. it is anideal audit tool.

It is an extremely flexible tooland simple tool whose applicationextends from safety, health andenvironment risk into any aspectof business exposed to hazardsand risks. It is frequently used tobuild management systems fromconcept as well as capture andrefine those that already exist.* By James Phipps, principalrisk consultant, ABS ConsultingLtd (Warrington, UK)

representation has become to beknown as the THESIS bow-tiemethodology. By building in arisk matrix, effectiveness rankingand performance data for thecontrol measures then the bow tiemethodology also becomes a semi-quantitative risk assessment tool.

THESIS Bow-TieMethodology

THESIS can be used todemonstrate how effective amarine facility's safetymanagement system is performingand also to complete gap analyses.A typical management system is aquality management system formanaging risks within a company,to assure the protection of thecompany's people, assets,reputation and for protection ofthe environment the companyoperates within. A typical safetymanagement system wouldcomprise of the elements shown inFigure 1, previous page.

The bow tie can be used todemonstrate how the pertinentsafety management systemelement requirements are metwith respect to the control andmanagement of hazards and risks.

Bow-ties depict the relationshipbetween hazards, threats, barriers,escalation factors, controls,consequences, recoverypreparedness measures andcritical tasks (Figure 2, above).

This has been an area of fault orweakness in many organisations -using this method can help todisplay all the interactions and

links that are often found to beloosely related over a number ofvarious documents.

Essentially a bow-tie is acombination of the traditionallyused fault and event trees,whereby the fault tree constitutesthe left hand side of a bow-tie andthe event tree the right hand side.

What a bow-tie presents inaddition however, are the'barriers' in place that prevent'threats' from releasing a hazardand 'recovery preparednessmeasures' that reduce the severityof the hazard consequences.

Critical TasksOnce the threats, consequences,escalation factors and all controlshave been identified, supportingtasks to ensure that the integrityof each barrier, control andrecovery preparedness measure ismaintained need to be assigned.These are termed Critical Tasks,and are required to be performed,undertaken or executed byresponsible and competentpersons. Such tasks couldinclude: Design Tasks; Inspection and Maintenance

Tasks; Operational Tasks; and Administrative Tasks.

Assigning Personnel toCritical Tasks

Once the critical tasks are defined,personnel are assigned theresponsibility for the execution ofthe tasks. Such persons are

identified from the organisation atthe time of undertaking the workand should remain, at the least, ata supervisory level. Theprocedures and standardsnecessary to support that task arecaptured at the same time.

The advantage of adopting theTHESIS approach is that it is anextremely powerful representationof the hazard analysis and riskmanagement processes that isreadily understood at all levels inan organisation; bow-ties can beused in the boardroom as well asin a tool box talk.

Case ExampleFigure 3 illustrates arepresentation of one of the manyhazards that faces a cargocontaining vessel at sea.

The left hand side of the bow-tie shows a number of possiblethreats that could potentiallyrelease hazardous cargo and thusproduce the top event. Someengineered and proceduralbarriers have been put in placehere to illustrate typicalprotection measures that wouldprevent the threat from releasingthe hazard. Escalation factorshave been expanded in Figure 3to show the controls put in placeto manage the escalation factor.

The right hand side illustratesthe consequential outcomes of thetop event. Recovery measuresare not illustrated further.

It is possible within the 'casefile' to also:- capture the integrity of

OPERATIONS

TANKEROperator z September 200636

Escalationfactors Control of

escalationfactor

Barriers topreventthreat

Control ofescalation

factor

Escalationfactors

Consequences

Recoverypreparedness

measuresThreat

that couldreleasehazard

Activities & tasks

= HSE-critical task

Top event Consequences

Consequences

Haz

ard

Figure 2: A typical bow-tie display

Consequence

Personnel injury/fatality

Consequence

Hull flooding. Potential for

loss of stability

Consequence

Fire/explosion

Consequence

Discharge at sea.

Pollution

H-01.S01 Hydrocarbons

Loc.: Sea

TE: Loss of

containment cargo

tanks (Sea)

p/v breaker: Common IGS line

Daily inspection and maintenance

program (E-116)

P/V breaker. Common IGS line

Monthly inspection program (E116,

E480). Precautions during cold

weather.

Coating protection on ballast and

cargo tanks, cathodic protection to

ballast tanks

Pressure/vacuum relief valve

Locking arrangements

Escalation Factor

Failure or freezing of p/v

breaker

Maintenance of locking arrangements

High and high-high level alarms

Classification society surveys will

monitor wastage and remedial actions

taken if limits exceeded. Strength

analysis (CAP) as per current new

building criteria.

Pressure indicator: Common IGS line,

CCR. Monitoring of repeater in bridge

Escalation Factor

Failure of locking

arrangements

Escalation Factor

Failure of repeater of

pressure indicator

Threat

Corrosion

Procedures to allow for cargo

expansion: tanks to be filled 98% of

their capacity.

Regular maintenance. Pre-operational

inspections, certification and company

form E116, E490.

Threat

Thermal expansion of

cargo

Threat

Failure of p/v

arrangement

Figure 3: A partially expanded THESIS Tow Tie for a Loss of CargoContainment

TO

p32-36.qxd 06/09/2006 06:55 Page 5

jphippsa