2.4 Bow-Tie Analysis & Risk Assessment Frameworks

Process safety management relies on both qualitative visual diagrams and quantitative mathematical frameworks to evaluate risk. Bow-Tie Analysis provides a powerful visual model connecting barrier health to major accident scenarios, while Quantitative Risk Assessment (QRA) and the ALARP (As Low As Reasonably Practicable) framework provide the regulatory metrics and cost-benefit criteria necessary to justify safety investments.

1. Bow-Tie Analysis Architecture

A Bow-Tie Diagram is a structured visual methodology that displays an accident scenario from root causes (threats) to final outcomes (consequences), centered around a critical loss of control event (the Top Event).

   THREATS               PREVENTIVE BARRIERS               TOP EVENT              MITIGATIVE BARRIERS            CONSEQUENCES
┌───────────┐      ┌─────────────────────────────┐      ┌───────────────┐      ┌─────────────────────────────┐      ┌───────────┐
│ Threat 1  ├─────►│  Barrier 1A (e.g. Alarm)   ├─────►│               ├─────►│ Barrier 1B (e.g. Deluge)   ├─────►│ Cat 1 Fire│
└───────────┘      └─────────────────────────────┘      │               │      └─────────────────────────────┘      └───────────┘
                                                        │   LOSS OF     │
┌───────────┐      ┌─────────────────────────────┐      │  CONTAINMENT  │      ┌─────────────────────────────┐      ┌───────────┐
│ Threat 2  ├─────►│  Barrier 2A (e.g. Relief V.)├─────►│  (Top Event)  ├─────►│ Barrier 2B (e.g. Firewall)  ├─────►│ Toxic Cloud│
└───────────┘      └─────────────────────────────┘      └───────────────┘      └─────────────────────────────┘      └───────────┘
                                                           ▲         ▲
                                                           │         │
                                                 [ Degradation Factor ]
                                                           │
                                                 [ Degradation Control ]

Core Components of a Bow-Tie Diagram

1. Hazard: A source of potential harm, energy, or dangerous substance inherent to the operation (e.g., 100 tonnes of pressurized liquid propane).
2. Top Event: The point in time when control over the hazard is lost, but before major harm or damage has occurred. It marks the transition from prevention to mitigation (e.g., Loss of containment of propane from storage vessel piping).
3. Threats (Left Side): Credible causes or initiation pathways that can lead directly to the Top Event (e.g., External corrosion, overpressure, thermal stress, vehicle impact).
4. Preventive Barriers (Control Measures): Safeguards placed between a threat and the Top Event designed to prevent the Top Event from occurring (e.g., Cathodic protection, high-pressure trip SIF, pressure relief valve).
5. Consequences (Right Side): Undesirable outcomes resulting from the Top Event (e.g., Unconfined Vapour Cloud Explosion (UVCE), jet fire, off-site toxic exposure, environmental contamination).
6. Mitigative Barriers (Mitigation Measures): Safeguards placed between the Top Event and a consequence designed to reduce the severity or impact (e.g., Water deluge curtain, gas detection ESD system, secondary containment bund, emergency evacuation).

Escalation Factors & Degradation Controls

• Escalation Factor (Degradation Factor): A condition that reduces the effectiveness of a primary barrier (e.g., Corrosion inhibitor pump failure degrading cathodic protection; relief valve isolated for maintenance).
• Escalation Factor Control (Degradation Control): A secondary safeguard designed to manage the escalation factor and preserve primary barrier health (e.g., Routine thickness monitoring, strict valve interlock procedures).

---

2. Quantitative Risk Assessment (QRA) Metrics

Quantitative Risk Assessment (QRA) is a numerical technique used to calculate the risk of major accidents to people and the environment. QRA evaluates two distinct risk perspectives: Individual Risk and Societal Risk.

1. Individual Risk (IR)

Individual Risk is defined as the frequency at which a specific individual, at a fixed geographic location, is expected to sustain a given level of harm (typically death) per year due to plant hazards.

• Individual Risk Contours: Topographical maps drawn around a chemical establishment showing iso-risk contour lines (e.g., $1 imes 10^{-4} ext{ /yr}$, $1 imes 10^{-5} ext{ /yr}$, $1 imes 10^{-6} ext{ /yr}$).
• Location-Specific Individual Risk (LSIR): Risk to an exposed individual present 24/7 without protective clothing.

2. Societal Risk & FN Curves

Societal Risk measures the cumulative risk to groups of people exposed to major hazard events. It evaluates not just individual probability, but the potential for multi-fatality catastrophic events (e.g., Buncefield, Piper Alpha).

Societal risk is plotted on a log-log graph known as an FN Curve:

• Vertical Axis ($F$): Cumulative frequency per year of events causing $N$ or more fatalities.
• Horizontal Axis ($N$): Number of fatalities.

Log Cumulative
Frequency F (/yr)
   10^-2 │ ╲  Intolerable Region
         │  ╲ ─────────────────────────────────
   10^-4 │   ╲      ALARP Region
         │    ╲ ───────────────────────────────
   10^-6 │     ╲   Broadly Acceptable Region
         └────────────────────────────────────── Log Fatalities N
         1        10       100      1000

The FN curve incorporates societal risk aversion: society reacts far more strongly to a single catastrophic event causing 100 fatalities than to 100 separate single-fatality accidents over time.

---

3. The ALARP Framework & Risk Triangles

In UK safety legislation (Section 2 of the Health and Safety at Work etc. Act 1974), duty holders are legally required to reduce risks As Low As Reasonably Practicable (ALARP).

                               ▲
                              /                              /                               / INTOLERABLE                            /   REGION                                /─────────────────                         /                                           /      ALARP          \  <-- Risk tolerable ONLY IF cost of
                       /       REGION          \     further reduction is grossly
                      /                         \    disproportionate to benefit
                     /───────────────────────────                    /     BROADLY ACCEPTABLE      \ <-- Risk is negligible; no further
                   /           REGION              \    action legally required
                  └─────────────────────────────────┘

The Three Risk Tolerability Regions:

1. Intolerable Region: Risk level is unacceptable regardless of financial cost. Operations must cease immediately or fundamental design redesign must occur to shift risk downward.
2. ALARP Region: Risk is tolerable only if further risk reduction is shown to be unfeasible or if the financial cost of implementing further safeguards is grossly disproportionate to the safety benefit gained.
3. Broadly Acceptable Region: Risk is low and negligible. Detailed cost-benefit justifications are unnecessary, though basic good practice must be maintained.

---

4. The Gross Disproportion Test & Cost-Benefit Analysis (CBA)

To demonstrate that a risk has been reduced to ALARP, an operator may conduct a formal Cost-Benefit Analysis (CBA) incorporating the Gross Disproportion Test.

Legal Standard of Gross Disproportion

Established in English case law (Edwards v. National Coal Board, 1949), the legal test establishes that a risk reduction measure must be adopted unless there is a gross disproportion between the sacrifice (money, time, effort) and the safety benefit gained. The burden of proof rests entirely on the employer/operator.

Value of Preventing a Statistical Fatality (VPF)

UK HSE guidance establishes a benchmark monetary value for safety benefits:

• Value of Preventing a Statistical Fatality (VPF): Approximately £2.2M to £2.5M (adjusted for inflation).

Gross Disproportion Factor (GDF)

When calculating ALARP justifications, a multiplier called the Gross Disproportion Factor (GDF) is applied to the safety benefit side of the equation. The GDF accounts for the severity of the hazard and risk level:

$ext{Gross Disproportion Rule}: ext{Cost} > ext{Safety Benefit} imes ext{GDF}$

Where GDF scales with risk level:

• Low / Minor Risk: $ ext{GDF} pprox 2$ to $3$
• High Risk / Major Hazard (COMAH Establishments): $ ext{GDF} pprox 6$ to $10+$

Mathematical CBA Formula

$ext{Safety Benefit (£)} = \Delta ext{Risk (fatalities/yr)} imes ext{Plant Lifetime (years)} imes ext{VPF (£)}$

$ext{Disproportion Threshold (£)} = ext{Safety Benefit (£)} imes ext{GDF}$

If the actual monetary cost of installing the safety measure exceeds the Disproportion Threshold (£), the measure is ruled grossly disproportionate and is not legally required.

---

5. Worked Calculation Example: ALARP CBA

Problem Statement

A chemical operator considers retrofitting an automated gas detection and isolation curtain system around an Upper Tier chlorine storage area.

• Cost of Retrofit: £1,200,000 total capital and maintenance cost over 20-year plant life.
• Baseline Scenario Risk: Without curtain, QRA calculates risk of toxic chlorine cloud causing off-site fatalities at $2 imes 10^{-4} ext{ fatalities/year}$.
• Risk with Curtain: With curtain installed, risk drops to $5 imes 10^{-5} ext{ fatalities/year}$.
• Plant Remaining Lifetime: 20 years.
• VPF Benchmark: £2,200,000.
• Gross Disproportion Factor (GDF): 8 (High major accident hazard).

Step 1: Calculate Annual Risk Reduction ($\Delta ext{Risk}$)

$\Delta ext{Risk} = (2 imes 10^{-4}) - (5 imes 10^{-5}) = 1.5 imes 10^{-4} ext{ fatalities/year}$

Step 2: Calculate Total Lifetime Fatalities Avoided

$ext{Fatalities Avoided} = 1.5 imes 10^{-4} ext{ /yr} imes 20 ext{ years} = 0.003 ext{ statistical lives saved}$

Step 3: Calculate Monetary Safety Benefit

$ext{Monetary Safety Benefit} = 0.003 imes £2,200,000 = £6,600$

Step 4: Apply Gross Disproportion Factor (GDF = 8)

$ext{Disproportion Threshold} = £6,600 imes 8 = £52,800$

Step 5: Compare Retrofit Cost against Disproportion Threshold

• Actual Measure Cost: £1,200,000
• Disproportion Threshold: £52,800

Since £1,200,000 is vastly greater than £52,800 ($ ext{Cost} \gg ext{Threshold}$), installing the retrofit curtain is grossly disproportionate to the safety benefit gained. The operator can only support—not replace—engineering judgment against relevant good practice when arguing ALARP without installing this specific £1.2M system.