ships in service training material risk assessment analysis tools 2009

Ships in Service Training Material

Risk Assessment Analysis Tools

2009

What is the potential event

What can bethe consequences

What can bethe causes

Risk Assessment

Ships in Service Training Material A-M CHAUVEL

What are the actual control measures

What can be done

What is the risk

General Method

- Pareto- Preliminary hazard- Job safety- Quantitative risk- Qualitative risk- What if- Fault tree- Event tree- Bow tie- Failure mode and effects- Hazard and operational


Risk Assessment Tools Analysis

( PAR )( PHA )( JSA )( QRA )( qRA )( WIF/SWIF )( FTA )( ETA )( BTA ) ( FMEA )( HAZOP )

Scope of Application of the Tools

Pareto

ChecklistPreliminary hazard (PHA)

What if (WIF or SWIF )

Failure mode and effects (FMEA)

Hazard and operability (HAZOP)

Fault tree (FTA)

Event tree (ETA)

Bow tie Diagram (BTA)

Tools

X

X

X

X

X

X

X

X

X

X

X

X

x

Hazardidentification

Risk screening

Risk Assessment


Risk Assessment Toolsused in

combination during Workshop


1 - Pareto

2 - Checklist

3 - Preliminary hazard (PHA)

4 - What if (WIF or SWIF)

5 - Failure mode and effects (FMEA)

6 - Hazard and operability (HAZOP)

7 - Fault tree (FTA)

8 - Event tree (ETA)

9 - Bow tie Diagram (BTA)

X

X

X

X

X

X

3, 10,

8, 7, 6,

3, 4, 10, 3, 8,

10, 3,

7, 5,

2,

2, 8, 5

7, 2,

7 & 8

Risk assessment toolsnumber

AloneWith other

tools(Number)


10 - Change analysis (CA) X 1, 3, 4, 8,

Risk Assessment Tools Usage


Just because we know how to do a jobdoesn't mean that we do it safely.

Risk Analysis Tools

Example:An airplane is a safety critical system.

As one level of analysis, a pilot must complete a pre-flight checklist before flight to ensure

that the plane is working properly.


Checklists

Despite their simplicity,checklists are a form of

Quality & Safety Analysis.

This checklist is a simple form of Safety Analysis.

They are generally useful where a problem is well understood, and examination rather than system analysis is the goal.


Checklists

1.0 Define theActivity orthe System

6.0 Subdivide the elements of the

activity or system( If necessary )

3.0 Subdivide theSystem or Activity

for analysis

4.0 Gather orcreate relevant

checklists

5.0 Respond to theChecklistquestions

2.0 Define thepotential hazards

7.0 Use the results in decision making

Checklists


Process

Checklists


- Possibly miss some potential problems.

- Traditionally provides only qualitative information.

Activity Level 1 Level 2 Level 3 Level 4

C1- Chemical, biological and radiation hazard control referenceInformationavailability andknowledge.

No knowledge or use of referencedata.

Data available and used by supervisorwhen needed.

Additional standards have been requested when necessary. Employees and supervisors able todemonstrate an understandingof the material.

Data posted and followed where needed. Additional standards havebeen promulgated, reviewed with employees involved and posted.

C2- Flammable andexplosive materials control.

Storage of materialsdo not meet fireregulations.

Some storage facilities meet minimum fire regulations.

Storage facilities meetminimum fire regulations.

Handling practices alsomeet minimum regulatory requirements.

.

In addition to “Good”,Storage facilities exceed the minimum fire regulations. A strong policy is in evidence relative to the control of the handling, storage and use offlammable/explosive materials.

NoYes

NoYes

NoYes

NoYes

NoYes

NoYes

NoYes

NoYes

Limitation

http://www.addictivepuzzles.com/


Preliminary Hazard Analysis

Risk Analysis Tools


Preliminary HazardProcess

RISKASSESSMENT

1.0 Define theActivity orthe System

3.0 Conductreview

2.0 Precise thecategories of

accident and theaccident severity

4.0 Use the resultsin decision making


Brief description Title ( Portion of the System/Sub-system/ Operational Phase covered by this analysis):

Probability Interval:5 years

System Number:

Date:

Analysis: I: InitialR: Revision A: Addition

Hazard Description

RiskBefore

Haz

ard

targ

et

Ris

k

Co

de

Pro

bab

ilit

y

Sev

eri

ty

Prepared by/date: Hazard target : P- Personnel, E- Equipment

T- Down time, R- Product, V- Environment

Preliminary Hazard Worksheet

Hazard(PotentialAccident)

CauseMajor

effects

Severity(AccidentCategory)

Corrective or PreventiveMeasures suggested

Fuel oil spill

Ship motionaway fromthe transferterminalduringbunkering

Release offuel oil intothe waterway, resulting in significantenvironmentalimpact

2

Consider installing mooring tensionmeters with alarms to indicate ship motion during bunkering

LNG fireor explosion

Loss ofventilationin thecompressorroom

Potential forexplosion & large fire withfatalities

1

Consider providing an alarm thatindicates when the ventilation fanin the compressor roomshuts down

Area :Drawing number :

Meeting date :Team members :


Preliminary Hazard ReportExample


Brief description Title ( Portion of the System/Sub-system/ Operational Phase covered by this analysis):

Probability Interval:

System Number:

Date:

Analysis: I: InitialR: Revision A: Addition

Hazard Description

RiskAfter

Description of Control measuresRiskBefore

Identify countermeasures by appropriate code letter (s):D: Design alterationS: Safety device

E: Engineering safety featureW: Warning device

P: Procedures / training Ris

k

Co

de

Pro

bab

ilit

y

Sev

eri

ty

Haz

ard

targ

et

Ris

k

Co

de

Pro

bab

ilit

y

Sev

eri

ty

Prepared by/date: Approved by/date:

Preliminary Hazard Analysis

Hazard target : P- Personnel, E- Equipment

T- Down time, R- Product, V- Environment


Job Safety Analysis

Risk Analysis Tools

Japanese Style for Abandon Ship

Day one of the JHAJapanese Hemorrhoid Association's annual cruise...”

Risk Analysis JSA and not JHA



Job Safety

RISKASSESSMENT

Process

1- Select a job for analysis

4- Developcountermeasures

2- Break job down into basic

work elements3- Scrutinizeeach element

- Workers must adopt harmful postures in order to handle loads.

- Workers are expected to lift loads which are too heavy. - Objects are not designed for ease of handling. - Workplaces are poorly designed (including work stations). - Work systems are poorly designed.

How Handling Injuries Occur ?


These injuries often occur because :


Job Safety Worksheet

Platform: I.D: Location:

Field Superintendent: Analysis made by:

Task: Loading and unloading truck

Personnel Protective Equipment required and/or recommended:

Sequence of basic job steps: Potential accidents or hazards:

1

X

Recommendation to eliminateor reduce potential hazard:



Deck Officer: Location:

Security Officer: Analysis made by:

Task: Unloading the ship

Personnel Protective Equipment required and/or recommended:

Sequence of basic job steps: Potential accidents or hazards:

1

X

Recommendation to eliminateor reduce potential hazard:


Job Safety WorksheetUnloading the ship

Please,Would you do an exercise on that subject?

1- Define the nature of the cargo.

2- Step by step identify activities and potential possible hazards.

3- What are the safety remedies you will recommend?

Location Room : :Task, Job : Written by:Revision #:

Date:Revision date:

Protective Personal Equipment ( PPE) required for entry in the local: Safety glassesNon -porous shoes

Long TrousersHard hat

Available Safety Equipment: Nearest fire extinguisher:Nearest shower:

Nearest telephone:Nearest eyes wash fountain:

Nearest safety material :Nearest ….:

Nearest first aid kit:

Hazard Level: Medium LowHigh

Sequences of Steps Potential HazardRecommendationsafety procedures

Add PPErequired

Start-up Procedure

Run Time Procedure

Emergency Shutdown




Job Safety WorksheetLocation Date

Task:

Team members:

New: Revised: JSA#:

Leader:Analyzed by:Reviewed by:Approved by:

Specific rules and procedures to be followed:

Sequence of basic job steps Potential accidents or hazardsRecommendations to eliminate orreduce potential hazards

Safety Equipment required to do the job:

Hard hats?Safety shoes,Safety glasses?Cotton gloves?

Work vests?Safety harness?Face shields?Goggles?

Barricades?Fire extinguishers?Lock-out/tag-out?Work permit?

_________?_________?_________?_________?

Articles of the convention

Regulation I

Minimumrequirementsfor seafarers

to workon a ship

Regulation II

Conditionsof

employment

Regulation III

Accommodationrecreational

facilities,food andcatering

Regulation IV

Health protection welfare,

medical careand socialprotection

Regulation V

Complianceand

enforcement

PART A : mandatoryPART B : recommendations


ILO-MLC Convention: 2006

One other simple toolfor scoring risk at work

Job Safety AnalysisKinney Method

A Qualitative Method for scoring Risk at workKinney Method


R (Risk score ) = L x P x C

L (Likelihood of the event)

P (Period of exposure to the hazard)

C (Consequences of the event)

L ( Likelihood of then event )W = 0.1 = Highly unlikelyW = 0.2 = Practically impossibleW = 0.5 = Possible but unlikelyW = 1 = UnlikelyW = 3 = LikelyW = 6 = Very likely

P ( Period of exposure to the hazard )B = 0.5 = Very rare Once per year or lessB = 1 = Rare- A few times per yearB = 2 = Unusual - Once per monthB = 3 = Occasional- Once per weekB = 6 = Frequent- DailyB = 10 = Continuous- Constant


Kinney Method

C ( Consequences of the event )E = 1 = Negligible injuriesE = 3 = Minor injuriesE = 7 = Major injuriesE = 15 = Fatal (1 death)E = 40 = Disaster, more than one death

R ( Risk score ) = L x P x CR < 20 No attention required20 < R < 70 Attention required70 < R < 200 Required actions200< R < 400 Corrective actions requiredR > 400 Stop activities


Kinney Method


Using Monogram

Kinney Method

Exposure

Might well beexpected ofsome time

Likelihood

Quite possiblycould happen

Unusualbut possible

Remotelypossible

Conceivable but very unlikely

Practicallyimpossible

Very rareYearly orless

UnusualOnce permonth

FrequentDaily

Continuous

Tie

Lin

e

Kinney Method (Monogram)

Exposure Possibleconsequences

Risk score


Likelihood


Unusualbut possible

Remotelypossible





FrequentDaily

Continuous

Fatality>$ 100 000

damage

ManyFatalities

>$ 10 millionsdamage

Minor first aid case

>$ 100damage

Disability>$ 1 000damage

Catastrophe

Disaster

Very serious

Serious

Important

Noticeable

Very high riskConsider discontinuing operation

Substantial riskCorrection required

Possible riskAttention required

RiskPerhaps acceptable8

10

20

100

200

300

400500

40

60

80

Tie

Lin

e


Exposure Possibleconsequences

Risk score


Likelihood


Unusualbut possible

Remotelypossible





FrequentDaily

Continuous

Fatality>$ 100 000

damage

ManyFatalities

>$ 10 millionsdamage

Minor first aid case

>$ 100damage

Disability>$ 1 000damage

Catastrophe

Disaster

Very serious

Serious

Important

Noticeable

Very high riskConsider discontinuing operation

Substantial riskCorrection required

Possible riskAttention required


10

20

100

200

300

400500

40

60

80

Tie

Lin

e

Kinney Method


Kinney Method

From risk score tojustification score

Shall we invest to prevent an accident ?

Risk score

Very high risk

Substantial risk

Definite risk


10

20

100

200

300

400500

40

60

80

Justificationfactor

$300

$3 000

$30 000

$300 000

$1 000 000

Smallreduction

More effective

Eliminate

Riskreduction

Costs forcorrection

10%

25%

50%

75%

100%

Highlyworthwhile

Justified

Of doubtfulmerit

2

60

40

20

10

6


Tie

Lin

e


Risk score

Very high risk

Substantial risk

Definite risk


10

20

100

200

300

400500

40

60

80

Justificationfactor

$300

$3 000

$30 000

$300 000

$1 000 000

Smallreduction

More effective

Eliminate

Riskreduction

Costs forcorrection

10%

25%

50%

75%

100%

Highlyworthwhile

Justified

Of doubtfulmerit

2

60

40

20

10

6


Tie

Lin

e

Kinney Method


Qualitative Risk Analysis

Risk Analysis Tools

The most widely used analytical approach in risk assessment: - Probability data is not required. - Only estimated potential loss is used.

Most qualitative risk analysis methodologies make use of a interrelated elements:

- Hazards or Threats. - Asset Vulnerability. - Controls measures (Countermeasures).

Qualitative Risk Analysis



5.0 Classify each event according its

probability of occurrence

3.0 Repeat the evaluation to each step of the activity or process

1.0 Identify all potential hazards linked to the

activity or process

6.0 Determinate if the risk is

acceptable or not

2.0 Evaluate the risks link in regard to hazards

for the first step

7.0 Use the results indecision making

4.0 Classify each event according its

potential consequences

Qualitative Risk AnalysisProcess

1- Rank the severity of consequences.

2- Rank the “probability” of an incident or an accident occurrence

3- Use matrix to determine if risk is acceptable and…

4- Repeat as necessary for all phase hazard / target combinations.


Qualitative Risk AnalysisThe steps in assessing risk are :


1- Rank Severity of Consequences

Category

Consequences

ICatastrophic

IICritical

IIIMarginal

IVNegligible

PersonnelIllnessInjury

Death

Several injuryor severe

occupationalillness

Minor injuryor minor

occupationalillness

No injury orillness

EquipmentLoss (€)

> 1M

250Kto1M

1Kto

250K

<1K

DownTime

> 4 months

2 weeksto

4 months

1 dayto

2 weeks

<1day

AssetsLoss

EnvironmentalEffect/Impact

Long-term (5 years or greater) or requiring

> €1 M to correct and/or in penalties

Medium-term(1-5 yrs)or requiring €250K- 1M

to correct and/orin penalties

Short-term(<1 yr)or requiring €1K- 250K

to correct and/orin penalties

Damage readily repairedor requiring <€1Kto correct and/or

in penalties

Valuesas for

equipmentloss

Matrix table


2- Rank the “probability” of an incident or an accident occurrence

3- Use matrix to determine if risk is acceptable and…




Level

F

E

D

C

B

A

DescriptiveWord

Frequent

Probable

Occasional

Remote

Improbable

Impossible

Definition

Likely to occur repeatedlyin system life cycle

Likely to occur several timesin system life cycle

Likely to occur sometimesin system life cycle

Not likely to occur in system life cycle, but possible

So unlikely it can be assumedoccurrence may not be experimented

Physically impossible to occur


2- Rank Probability of occurrence


2- Rank the “probability” of anIncident or an accident occurrence

3- Use matrix to determine if risk is acceptable





3- Is Risk Acceptable ?

I- Catastrophic

II- Critical

III- Marginal

IV- Negligible

Severity ofconsequences A

ImpossibleB

ImprobableC

RemoteD

OccasionalE

ProbableF

Frequent

Probability of Occurrence of each individual event

Imperative tosuppress riskto lower level

Operation requires writtenlimited waiver endorsedby management

Operationpermissible

Personnel must not be exposed to hazards in both zones

Probability of the event

Veryunlikely

UnlikelyMay

happenLikely

Certain orimminent

1 2 3 4 5

Delay only 1 1 2 3 4 5

Minor injury 2 2 4 6 8 10

Major injury 3 3 6 9 12 15

Single fatality 4 4 8 12 16 20

Multiple fatality 5 5 10 15 20 25

Potentialconsequences

Potential risk analyzed : (an Injury , Fatality… )


Qualitative Risk AssessmentS

eve

rity

Likelihood

Veryunlikely

UnlikelyMay

happenLikely

Certain orimminent

Probability ofthe event

1 2 3 4 5

Minor injury 2 4 6 8 10

Major injury 3 6 12 15

Single fatality 4 8 12 16 20

Multiple fatality 5 10 15 20 25

Delay only

Impact

Se

veri

ty

Likelihood

9

( For individual event )

Qualitative Risk Assessment


Example of matrix :

Riskestimation

Qualitativescore

Moderate7 to 10

High11 to 16

Very high17 to 25

Low1 to 6

Risk Assessment ( Matrix 5x5 )


Interpretation of the risk


Vulnerability to threat

Veryhigh

High Moderate Low

4 3 2 1

Devastating 4 12 8 4

Severe 3 9 6 3

Noticeable 2 6 4 2

Minor 1 3 2 1

Impactof loss

Potential risk analyzed :

12

8

4


16

Risk Assessment ( Matrix 4x4 )Identification of the level of risk

Risk rating interpretationQualitative

score

These risks are moderate.The countermeasures should be plannedand implemented in the near future

3 to 7

These risks are low.The implementation of countermeasures may betaken in consideration, but are of less urgencythan the above risks

1 to 2

These risks are high.The countermeasures should be implementedas soon as possible

8 to 16


Interpretation of the riskRisk Assessment ( Matrix 4x4 )

Devastating 4

Severe 3

Noticeable 2

Minor 1


Risk Assessment ( Matrix 4x4 )Identification of the level of risk

Vulnerability to threat

Veryhigh

High Moderate Low

4 3 2 1

12 8 4

9 6 3

6 2

3 2 1

Impactof loss

Potential risk analyzed :

12

8

4


16

4

Risk rating interpretationQualitative

score

These risks are moderate.The countermeasures should be plannedand implemented in the near future

These risks are low.The implementation of countermeasures may betaken in consideration, but are of less urgencythan the above risks

1 to 2

These risks are high.The countermeasures should be implementedas soon as possible

8 to 16


Interpretation of the riskRisk Assessment ( Matrix 4x4 )

3 to 7


2- Rank the “probability” of an accident’s occurrence

3- Use matrix to determine if risk is acceptable

4- Repeat as necessary for all phase hazard & target combinations.




Risk Analysis Tools


“What-if” Analysis

- 1 Postulate potential problems that may result in accidents or affect system performance.

“What-if” is a brainstorming approach that uses broad, loosely structured questioning to :

- 2 Ensure that appropriate safeguards against those problems are in place.


“What-if” Analysis (WIF)

Generally applicable for almost every type of risk assessment application, especially those dominated by relatively…

Most common uses

Occasionally used alone, but most often used to supplement other structured techniques (especially checklist).

…simple failure scenarios.

http://feustsolo.musicblog.fr/images/gd/1127424102.gif

1.0 Define theSystem or

Activity

5.0 Subdivide the elements of the System or Activity

(If necessary)

3.0 Subdivide theSystem or Activity

for analysis

4.0 Generate What-if questions for each element of theSystem or Activity

6.0 Respond to thequestions“What-if”



2.0 Define theproblems

for the analysis


Process



Answers

- Immediate effect on vessel condition…

- Potentially leading to an accident…

- Actual safeguards will fail…

Questions

- What if a specific accident occurs?

- What if a specific system fails?

- What if a specific human error occurs?

- What if a specific external event occurs?

- …

“What-if” AnalysisImmediate

system condition

Reduced air flow through the compressor, affecting its performance

What if…

1- The intake air filter begins to plug

Ultimateconsequences

Inefficient compressor operation, leading to excessive energy use and possible compressor damages.

Low or no air flow to equipment, leading to functional inefficiencies and possibly outages.

Summary of the “What-if” Review of a Vessel’s Compressed Air System

2- Someone leaves a safety valve open

High air flow rate through the open valve to the atmosphere

Low or no air flow to equipment leading to functional inefficiencies and possibly outages.

Potential for personnel injury from escaping air or blown debris.

Small drain line would divert only a portion of the air flow, but maintaining pressure would be difficult.


Safeguards

Pressure/vacuum gauge between the compressor and the intake filter.

Annual replacement of the filter.

Rain cap and screen at the air intake

Recommendations

Make checking the pressure gauge reading part of someone’s weekly round ORReplace the local gauge with low pressure switch that alarms in a manned area.


The Structured What - If checklist (WIFT) technique is a method of identifying hazards based on the use of brainstorming.

WIFT is a more structured form of analysis, which may be seen as a less rigorous but it is a quicker alternative to HAZOP.

WIFT an alternative to HAZOP:



• It is very flexible, and applicable to any type of installation, operation or process, at any stage of the lifecycle.

• It uses the experience of operating personnel as part of the team.

• It is quick, because it avoids repetitive consideration of deviations.

The Strengths of SWIFT are:



• As it works at system level: - Some hazards may be omitted, - It is difficult to audit.

• Adequate preparation of a checklist in advance is critical for the quality of the review.

• Its benefit depends on the: - Experience of the leader and - Knowledge of the team.

The Weaknesses of SWIFT are :




- Likely to miss some

potential problems.

- Difficult to audit for

detail elements.

- Traditionally provides only

qualitative information.

Limitations


AccidentCause


Root Cause

Cause

Cause

Cause

Risk Analysis Tools

Used to search the root cause

in Accident Investigation

AccidentCause


Root Cause

Cause

Cause

Cause

Risk Analysis Tools

Used to reach the potential causes

of an Accident

The 5 Whys analysis is a simpler form ofFault Tree analysis for investigations of

specific accidents as opposed to

chronic problems.

It is a technique use to identifiesroot causes of the eventby asking the questionwhy events occurred or

conditions existed.

The “5 Whys”


The causes ofthe event

are identifiedby asking

the questionsuntil

they become absurdor because we have

no more ideasabout the problem.

Why…?Where arethe roots


Root Cause AnalysisThe “5 Whys”

From Top

To roots

“5 Whys” Principles


Top Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

RootCause

Why ?

Why ?

Why ?

Why ?Why ?


Top Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

Sub-Eventcondition

RootCause

Sub-Eventcondition

Sub-Eventcondition

RootCause

5

3

2

1

4 Sub-Eventcondition

RootCause

Why ?

Why ? Why ?

Why ?

Why ?Why ?

Why ? Why ?

Why ?Why ?

“5 Whys” Principles


1. "Why the robot stop?" The circuit is overloaded, causing a fuse to blow.

2. "Why the circuit overloaded?" There was insufficient lubrication on the bearings,

so they locked up.

3. "Why the insufficient lubrication on the bearings?" The oil pump on the robot is not circulating sufficient oil.

4. "Why the pump not circulating sufficient oil?"

The pump intake is clogged with metal shavings.

5. "Why the intake clogged with metal shavings?" Because there is no filter on the pump.

“5 Whys” A case

Ship sunk?Ship sunk? Collision

Lack of attention of the deck officer

Collision?Collision?

Lack of attention?Lack of attention? Alcohol level in his blood

Alcohol?Alcohol? Celebration prior watchkeeping

Celebration?Celebration? Radio told him “he is father”

The master let him take over the bridge ?

The company did not plan his shore stay period for the birth of his child?


Why ?

Why ?

Why ?

Why ?

Why ?

Why ?

- Brainstorming is time consuming.

- Results are not reproducible or

consistent.

- Some root causes may not

be identified.

“5 Whys”


Limitations


Resulting sub-events and conditions should be at or near the root causes of the event.

More detailed evaluation may be necessary

to reach management system root causes.

Judgment and experience are key factorsin selecting the right level of evaluation and

to achieve the completeness of results.

The “5 Whys”


Conclusions

The results are not reproducible or consistent, but the application is auditable.

Twovertebrascrushed

Fall 1st. stepof the ladder

Climbthe ladder

Dizziness

Lossequilibrium

Installthe ladder

MedicalShoes onboth feet

Feelconfident

Both feetoperated

Walk withoutshoes

Sugarlevel

Request tolook at thewall paper

Fungicontamination

Airconditioneddefective

High Temp.& Humidity

Sleepingeffect

Anti paintreatment

Carpethygiene

Overweight


“5 Whys” A case


Risk Analysis Tools

http://whisperingcraneinstitute.files.wordpress.com/2007/02/dancin-tree.jpg

A technique that visualize

how logical relationships exist between :


Fault Tree (FTA)

Equipment failures Human errors

External events

-when combined- cause a specific incident/accident.

Developed first in the aerospace industries.Have found uses in many other areas,

most recently in software analysis.

Fault tree operate by :

- Developing a list of the faults that can occur in a system and

- Attempting to trace them back to their root causes.


Fault Tree

While this method can be used to show complicated interactions,

it is still subject to overlooking some aspects of the system as the answers are mostly enumerated.

It is advisable to combine this methodwith another approach

to ensure the completenessof the analysis.


Fault Tree

Creating a Fault Tree


9- Identifycausal factors

1- Define event of interest

7- Stop branchdevelopment

6- is branchcredible?

8- Is modelsufficientlydeveloped?

5- Use data toDetermine

credibility of branches

2- Define nextlevel of the tree

3- Develop questionsto examine

credibility of branches

4- Gather data toanswer questions

Yes

Yes

No

No

Generally applicable for almost every typeof risk assessment dominated byrelatively complex combinations

of these events.

But, used most to :

- Understand the causal factors of an event. - Determine the potential root causes

of the event.


Fault TreeMost common uses

5.0 Solve thefault tree for thecombinations of

events contributingto the event

7.0 Performquantitative analysis

If necessary

3.0 Define the tree structure

4.0 Explore eachbranch in successive

levels of details

6.0 Identify importantdependent failure

potentials and adjustthe model appropriately


Fault Tree

2.0 Define thetop event

for the analysis


1.0 Define theSystem

Process

Fire orExplosion

Externalhazards

Contact orcollision

Flooding …

F1 F2 F3 F4

OrAndEvent BEvent A

B2B1A2A1

Event trees For consequences

Incident/Accident

categories

IncidentSub-categories

F1 - Engine roomF3 - Accommodation

………

Faults trees for direct cause and initiating events


Risk Contributing FactorFault Tree

Fault Tree


Projectorlamp

shutdown

Power outage

Unresolvedlamp failure

Inadvertentshutdown

Wiringfailure

Basic lamp

failure

No spare lamp

Internal

External

Operator error

Unplug

And

Or

Fault Tree


Projectorlamp

shutdown

Power outage

Unresolvedlamp failure

Inadvertentshutdown

Wiringfailure

Basic lamp

failure

No spare lamp

Internal ExternalOperator

errorUnplug

And

Or

Cupleaks

Wrongparticlesize

Wrongmaterialexpansionrate

Lowdensity

Improper wallthickness

Deflection forceratio too high

Stackingdamage

Stacking stop heightincorrectly specify

Punctured

Excessporosity

Wrong particle size

Wrong material expansion rate

OrAndLegend :

Fault Tree


Fault Tree

Engine failsto operate

Basicfailure of the

propeller

Basicfailure of the

engine

Contaminatedfuel in bunker

tanks

Onboard fuelcleanup system

fails

Fuel supply to engine is

contaminated

Vessel losespropulsion

Enginestops

And

Or

Enginecontrol failure

Enginefailure

Bearingfailure

Fuelsupply failure

Gate : And

Gate : Or

Ships in Service Training Material BRENNAN & PEACHEY


Enginefailure

Bearingfailure

Fuelflow failure

Contaminatedfuel

Fuelsupply failure

Gate : And

Gate : Or


Exercise


ExerciseCompletethe tree

Risk Analysis Tools

The Causes

Fuelsupply failure

Contaminatedfuel

Fuelfilter failure


Enginefailure

Bearingfailure

Bunker fuelLeak from

heating coils Water

condensationMechanical

failureElectrical

failure

Fuelflow failure

Contaminatedfuel

Fueltank failure

Fuelpump failure

Fuel supplypipe failure

Fuelsupply failure

Gate : And

Gate : Or


- Narrow focus. - Art as well as science.

- Quantification requires significant expertise.

- Narrow focus. - Art as well as science.

- Quantification requires significant expertise.


Fault TreeLimitations



Risk Analysis Tools


Event Tree (ETA)

A technique that develops models of thepossible outcomes of an initiating event.

The models explore how: - Safeguards,

- External influences, - Lines of assurance (LOA),

affect the path of the event chains.


Event Tree

Applicable for almost any type

of risk assessment but,

used most effectively to

events where

multiple safeguards are in place

as protective features

to avoid escalation.

Most common uses

1.0 Define theSystem or Activity

6.0 Summarizeresults

3.0 Define LOA and physicalphenomena

4.0 Defineaccident

scenarios

5.0 Analyze accidentsequence outcomes


Event Tree

2.0 Define theInitiating event


Process


Event Tree Terminology

Initiating event :

The occurrence of some failure with the potential to produce an undesired consequence. An initiating event is sometimes called

an incident.

Line of assurance (LOA) :

A protective system or human actionthat may respond to the initiating event.

The following terms are commonly used in ETA


Event Tree Terminology

Branch point :

Graphical illustration of (usually) two potential outcomes when a line of assurance is

challenged.

Accident sequence or scenario :

One specific pathway through the event tree from the initiating event to an undesired

consequence.

The following terms are commonly used in ETA


Event Tree Scenario & Sequence

FS : Failures of LOALOA : Line of Assurance : Success of LOA

F

S

LOA 2LOA 1 LOA 3

Consequence 4

Consequence 2

Consequence 1

F

S

Initiating

EventConsequence 3

Branchpoint

Branchpoint

Branchpoint

F

S


Replacementstill not OK

ReplacementOK

Replacementstill not OK

ReplacementOK

Charliereplaces

Instructorreplaces

Instructorinept

Charlieunavailable

Spareavailable

No spare available

Projectorlamps fails

F

S

F

S

F

F

FS FailureSuccess


Leak or rupture of piping containing flammable material

X

Yes


AFlammablematerial spill,but no fire

Complete lossof facility ?

No


ExerciseCompletethe tree

Initiatingevent Ignition

preventedPortable fire

extinguishersCO2

systemSea water

system

Accident sequence Outcomes

Fire extinguished with :

Other Line Of Assurance

Initiatingevent Ignition

preventedPortable fire

extinguishersCO2

systemSea water

system

Accident sequence Outcomes

Leak or rupture of piping containing flammable material

D

C

B

A

E

Flammablematerial spill,but no fire

Minor firedamageNo loss of systemavailability

Medium firedamagePotential loss ofSystem availability

Major firedamageLoss of systemavailability

Complete lossof facility

P1

P2

P3

P4

Yes

No

Yes

No

Yes

NoYes

No


Fire extinguished with :

Other Line Of Assurance

Escalation process


Total loss

Fatal impact

No fatal impact

Critical damage

Major damage

Escalation

Minor damage

Scenario


Fire / explosion

Where?

EffectEvent Consequence

Fire / explosion

serious casualty

Accom-

modation

0,20

Machinery spaces0,72

Vehicle

deck0,08 Major damage 0,70

Total loss 0,30

Major damage 0,80

Total loss 0,20

Major damage 0,70

Total loss 0,30

No fatal impact 0,93

Fatal impact 0,07


Fatal impact 0,43


Fatal impact 0,08

Major damage

0,67

Escalation

0,33

Major damage

0,96

Escalation

0,04

Major damage

0,71

Escalation

0,29

Fire / Explosion Scenario


Remains upright 0,88

Fatal impact 0,19

Non-fatal impact 0,81

Slow sinking 0,25

Rapid capsize 0,25

Minor damage 0,5

Major damage 0,5

Remains upright 0,5

Slow capsize 0,12

Minor damage 0,5

Major damage 0,4

Destruction 0,1

Impact only

0,78

Flooding

0,19

Fire

0,03

Fire

0,03

Flooding

0,06

Impact only

0,91

Struck

ship0,5

Striking

ship

0,5

Serious

casualty

0,12

Minor incident

0,88

Collision

under way0,97

Striking at berth

0,03

Collision

incident

Collision Scenario

Below vehicle deck

0,16

Slow sinking 0,2

Rapid capsize 0,1

Remains afloat 0,7

Through hull

0,03

Stern door

0,56

Blow door

0,28

Into bridge / superstructure

0,27

Through open doors

0,19

Through down-flooding openings

0,18

Flooding

incident

Through bow door

0,67

Through stern door

0,03

Slow sinking 0,2

Rapid capsize 0,7

Remains afloat 0,1

Remains afloat 0,8

Side door

0,16

Slow sinking 0,2

Due to wave damage

0,47

Remains afloat 0,8

Slow sinking 0,2

Flooding Scenario

Second levelof safeguardsLOA 2

0,10P Failure

First level of safeguardsLOA 1

Initiatingevent

0.4 /yearFrequency ofInitial event

0,90P Success

0,05P Failure

0,95P Success

Outcome 1 :First level succeededFreq = (0.4)(0.95 ) = 0.380 /year

Outcome 3 :Both level FailedFreq = (0.4)(0.05)(0.10) = 0.002 /year

Outcome 2 : First level FailedSecond level succeededFreq = (0.4)(0.05)(0.90) = 0.018 /year


Event Tree (case 1)

Second levelof safeguardsLOA 2

0,10P Failure

First level of safeguardsLOA 1

Initiatingevent

0.4 /yearFrequency ofInitial event

0,90P Success

0,90P Failure

0,10P Success

Outcome 1 :First level succeededFreq = (0.4)(0.10 ) = 0.04 /year

Outcome 3 :Both level FailedFreq = (0.4)(0.90)(0.10) = 0.04 /year

Outcome 2 : First level FailedSecond level succeededFreq = (0.4)(0.90)(0.90) = 0.32 /year


Event Tree (case 2)


Event Tree

- Limited to one initiating event.

- Can overlook subtle system dependencies.

Limitations



Risk Analysis Tools

Hazardous Event

FAULT TREE( Causes )

Ha

zard

sEVENT TREE

( Consequences )

Es

cala

tio

ns

Sequences of faults & causesleading to a hazardous event

Sequences of events & failures leadingto the escalation of a hazardous event


Bow Tie

IncidentAccident

IncidentsFire or Explosion

Act of piracyAct of terrorist

Equipment failuresShip collision

…

AccidentsPersonnel InjuryPersonnel illness

UnwantedUnwantedEventEvent

Bow Tie


ConsequencesConsequences

SocialLoss of livesLoss of jobs

EnvironmentalAir pollutionWater pollution,…

EconomicLoss of the shipCargo damagesShip damagedShip detentionInsurance PremiumCompany imageBankruptcy

CausesCauses

ManHuman ErrorsPhysical ConditionsQualifications

Machines, Tools& Equipments

Materials & Furniture

Methods & Procedures

ManagementInternal EnvironmentExternal Environment

1

2

3

4

5

6

7

1

2

3

4

5

6

7

1

2

3

4

5

Safety measure

Safety measure

Safety measureSafety measure

Causes OutcomesReactivecontrols

Hazards Proactivecontrols


Bow Tie

UnwantedEvent

Event TreeFault Tree


Failure Mode & Effect Analysis

Risk Analysis Tools

Used primarily for reviews of mechanical and electrical systems,

vessel steering and propulsion systems.

Used frequently as the basis for defining and optimizing planned equipment maintenance because the method systematically focuses

directly and individually on equipment failure.

Effective for collecting the informationneeded to troubleshoot system problems.

Failure Modes & Effects Analysis


Most common uses

Like a checklist,but a more organized one.

Once the failure have been listed,the consequences of that failure are listed.

Once these information have been collected,possible countermeasures for

each failure are listed.



Like a checklist but a more organized one.

Once the failure have been listed,the consequences of that failure are listed.

Once these information have been collected,possible countermeasures for

each failure are listed.




Rank them according tothe level of riskthey represent

List of failures

List ofconsequences

List of possiblecontrol measures

This providesFailure Modes & Effects Analysis

What can go wrong ?Function failure

Severity Occurrence Detection

Consequences Prevention?Cause

FMEA Principles

Function or Requirement ?


What can be done ?Countermeasures

Risk analysis

What can go wrong ? - No function - Partial or Degraded function - Intermittent function - Unintended function

How badis it ?

How oftendoes it happen ?

How good is the methodat detecting it ?

What arethe effect ?

How this can be preventedor detected ?

What arethe cause (s) ?

FMEA Principles

What are the functions, features or

requirements ?


What can be done ? - Design changes - Process changes - Special controls - Changes in Procedures or Spec.

6.0 Evaluate potential failure modes

capable ofproducing problems

8.0 Transition of the analysis to anotherlevel of resolution

( if useful )

3.0 Choose the typeof FMEA approach

for the study

4.0 Subdivide the system for analysis

7.0 Performquantitativeevaluation

( if necessary )


FMEA

2.0 Define theproblem

for the analysis


1.0 Define thesystem

5.0 Identify potential failure modes forelements of the

system

Process

ComponentFunction

FailureMode

FailureCause

FailureDetection

End Effect ofFailure

CorrectiveAction

Recom.

Fuel OilPurifier

Electricalfailure

Switchboardfaultor Power generationfault,e.g.. blackout

Alarm channelto ECR forpurifiers failure

-Both purifiers failed

- Possible blackout

- Potential to lead to eventual machinery failure

Re-establishpower supplies

Restart mainengine if stopped

Reset purifieroperation

Service Tankshould be largeenough foradequate periodon full poweroperation.

A separateelectricaldistribution(main / emerge.) isprovided to eachpurifier in theevent of oneswitchboardfailure.

Mechanicalfailure

Loss oflubrication dueto degradedcomponent.

Inadequate orincorrectmaintenance.

IncorrectOperation.

Alarm channelto ECR forpurifiers failure

One purifierfailed,stand by unitavailable

Run up and put stand-by unit on line

Comment :

Human errorcancontributetowards thesefailures




MIL-STD- 1629A


Occurrence (O) - Frequency of the failure.

Severity (S) - Consequences of the failure.

Detection (D) - Ability to detect the failure before it reaches the next step.

FMEA Interpretation


There are three components that help definethe Relative Priority Number concerning failures:

RPN = O x S x D

The 3 components

Minor

Low

Moderate

High

Veryhigh

Effect ofoccurrence

1

2-3

4-6

7-9

10

Rank

Example of Ranking Criteria


Effect ofseverity

RankEffect ofdetection

Minor

Low

Moderate

High

Veryhigh

1-2

3-5

6-7

8-9

10

Veryhigh

high

Moderate

Low

Verylow

1-2

3-4

5-7

8-9

10

Rank

Failure is minor, not more than 2 minutes.Failure will not result / cause the machine down.

Failure will result / cause the machine down less than 25 minutes.This is a remote probability of occurrence during the operation time interval,unscheduled repair needed, quantitative & qualitative of output will be affected. Minor failure frequency is less than 2 times within 1 hour.

An occasional probability of occurrence during operating time interval.Machine down is more than 30 minutes quantity & quality of the output willbe affected. Failure will result / cause disruption to subsequent process.Minor failure frequency is less than 5 times within 1 hour.

Failure will result / cause the equipment damage and unscheduled repairs.Machine down more than 2 hours ( less than 6 hours ), a moderateprobability of occurrence during operating time the failure is minor alarmor stop less than 5 minutes quantity and quality of output will affect,unscheduled repairs need and frequency minor failure is more than 5 timeswithin 1 hour.

Failure will result / cause disruption stop. Machine down is more than 6 hours.This is unlikely probability of occurrence during the operating time interval( Once every 2 months ) or high probability of occurrence during operation.More than 10 times within 1 hour for minor down.

Description

Minor

Low

Moderate

High

Veryhigh

Effect ofoccurrence

1

2-3

4-6

7-9

10

Rank

Occurrence Ranking Criteria


Severity Ranking Criteria


Failure is of a minor nature and would cause the real effect on product.The lead time required from the part is order ( no more 2 hours ) or lookingin store and for installation & repair are completed not more than 15 minutes.

The lead time required from the part is order ( no more 3 hours ) orlooking in store and for installation and repair are completed not morethan 90 minutes.

The lead time required from the part is order ( more than 3 hours ) orlooking in store and for installation and repair are completed morethan 5 hours.

The lead time required from the part is order ( more than 4 hours ) orlooking in store and for installation and repair are completed morethan 12 hours.

Failure will result in the shutting down due to late shipment( more than 2 days ) and no stock keep, or installation and repairingmore than 24 hours.

Description

Minor

Low

Moderate

High

Veryhigh

Effect ofseverity

1-2

3-5

6-7

8-9

10

Rank


Low probability that the defect or equipment warning signals will be detected.More than 6 months

Equipment warning signals will be detected.More than 3 months but less than 6 months.

Equipment warning signals will be detected. Not more than 1 month.

High probability that the defect will be detected more likely and equipmentwarning signals will be detected to detect the existence of a defect.Mostly less than 1 week.

Very high probability that the defect will be detected.Equipment warning signals will be detected.Not more than 1 day.

Description

Veryhigh

High

Moderate

Low

Verylow

Effect ofdetection

1-2

3-4

5-7

8-9

10

Rank

Detection Ranking Criteria

Failure Effect on :Item

identificationFunction

Failuremode

Failurecause

Component orFunctional assembly

Next higherassembly System

Failuredetectionmethod

Switch

InitiatesMotorpowerfunction

Fails toopen

Releasespringfailure

NoneMaintenanceenergy tocircuit relay

Maintainsenergy topower circuitthrough relay

Motor continuesto runSmoke visualwhen powercircuit wireoverheats

Battery # 2( Relay circuit )

Providesrelayvoltage

Fails toprovide adequate power

Depletedbattery

None

Battery getshot anddepletes

Fails to operate relaycircuit

System failsto operate

Motor notrunning

Relay coil

Closesrelaycontactswhenenergized

Coil fails toproduceEMF

Coilshortedor open

Does notclose relaycontacts

Does notEnergizepower circuit

System failsto operate

Motor notrunning

Motor

Providesdesiredmechanical event

Fails tooperate

Motorshorted

Motor overheats

High currentin powercircuit

Overheat PwrCircuit breakerfails to openand switch orrelay fails

Smoke visual




- Examination of human error is limited.

- Focus is on single event initiator of problems.

- Examination of external influences is limited.

- Results dependent on the mode of operation.

LimitationsFailure Modes & Effects Analysis


Hazard & Operability Analysis

Risk Analysis Tools

A methodology for safety analysis that is highly rigorous & precise, involve :

- A system model where each componentis described with a list of attributes

that support the function of a component.

- A list of guide words with well defined meanings is then applied to each attribute to determine

the effect of any deviationfrom the normal operating function.

Hazard Operability



HAZOP : Guide Words

Errors

Other than

Reverse

Less

Consequences

Skip Part of

More

As well as

Out of sequence

Actions

Safeguards


Primarily for identifyingsafety hazards and

operability problems ofcontinuous process systems,

especially fluid and thermal systems.

Also used to review

procedures and sequential operations.

Hazard OperabilityMost common uses

6.0 Developrecommendations

(if necessary)

8.0 Repeat step 5 through 9

for the remaining deviations

3.0 Apply the firstdeviation to item

What are the consequences?

4.0 Identify all of the causes

of the deviation

7.0 Summarize the information collected

for this deviation


2.0 Define thedesign intent

of the item

9.0 Repeat step 3 through 9 for the remaining

items

1.0 Identify theitem

5.0 Identify engineeringand administrative

controls thatprotect the item

HAZOPProcess

Deviation Causes Consequences Safeguards Recommendations

HAZOP review of Barge Filling Operations at a Typical Small Fueling Terminal

Item

1.0 Line from a storage Tank to the Barge Manifold (Including Hose ) Part 2

Reverseflow

No credible causes(maximum level in barge tanks is belowfacility grade level

Typical arrangement had a check valve atthe discharge of theloading pump if a centrifugal pump is used.

1.4

Highpressure

Lower flow ratebecause of adeadheaded pump(see deviation 1.2).

Thermal expansion ofliquid isolated betweenclosed valves.

Potential leak or rupture of the piping (see deviation 1.10)

Regulations specify themaximum allowablepressure for transferoperations.

Relief valve at the discharge of gearpumps (Typically installed).

Lines typically drain tobarge tanks beforevalves are closed,minimizing thepotential for isolatingliquid full times.

Recommendation:

Verify that a reliefvalve is required at thedischarge of positivedisplacement pumpsthat are capable ofdamaging the pipingsystem ( including thetransfer hose) if a deadheading occurs.

1.7


HAZOP Worksheet

Item # Deviation Causes Consequences Safeguards Rcd.

1.1 Missing No missing steps were identified

Step : Review appropriate documents, check logs, etc

1.2 Skip

Communication barrierswith foreign languages

Many inspectors agencieson board do not allowadequate time tocommunicate expectations

Time constraints on vesseltrying to leave port quicklywith commercial pressureto perform rapid inspection

Potential to skip later steps becauseCoast Guard expectations are notcommunicated to the crew, creatingthe potential for accident/injury orloss of commerce

Potential for inexperienced crew toperform the test, with the potentialfor accident or injury later in the test

Potential for loss of commerce dueto delay in passing the inspection/drill

Vessel may be held to aninappropriate standard

Flexibility of the C.G. towork with portions of thecrew, so that otherportion of the crew canwork with other agencies

Standardized C.G.expectations that areconducted/communicatedvery frequently

Minimum of 2 C.G. staffmembers at least one being well trained

1.6Out of sequence

No consequence of interest if performed before the drill

1.5 Less Same as skip


HAZOP Worksheet

Consequence

Project Description:

PossibleCause(s)

Team members:

ExistingSafeguard

Ref # Recommendations

Minutes by:

Action

Pages:

Guideword

AccountabilityActionRef#

Team leader:

Date


HAZOP Worksheet

- A well-defined system or activity is required.

- Time consuming.

- Focuses on one event causing the deviations.


LimitationsHAZOP

Justificationfactor

Highlyworthwhile

Justified

Of doubtfulmerit

2

60

40

20

10

6

Risk score

Very high risk

Substantial risk

Definite risk


10

20

100

200

300

400500

40

60

80

Risk Assessment


Remember…

tools are only tools to help you.

If something is “obvious” it probably doesn’t need a risk assessment to act.

Do not start a new project unless risk analysishas been completed.



Do not start the risk assessment before the intent of the project is clear.


Do not start a risk assessment unless the event of interestis well define and the need recognize by the participants.

ships in service training material risk assessment analysis tools 2009

Documents