is not necessarily very precise, but may still be a help in performing risk analyses in practice.
The hazardous event is a central concept in the bow‐tie model of risk analysis, which is described in Section 2.3.4 (i.e. after the examples).
Example 2.3 (Hazardous events)
A hazardous event was defined as an event that may cause harm, and it was suggested to use the first abnormal event as the hazardous event. The following examples illustrate this:
1 (1) An object dropping from a crane. The process of lifting itself is completely normal and is not considered a hazardous event. If, on the other hand, the object that is lifted starts falling, it is definitely an abnormal situation.
2 (2) A car driver losing control of the car. Driving is a very common and normal activity, but if the driver loses control of the car while driving, the situation may develop into a serious accident with severe consequences.
3 (3) An aircraft engine stopping during flight. It should be fairly obvious that this is an abnormal situation. Most commercial planes have two engines and are able to land without problems with one engine not working. It is still reasonable to classify this as a hazardous event in a risk analysis.
4 (4) A person slipping when climbing a ladder. Climbing a ladder is normal, but if the climbing person slips, she may lose her balance and fall off the ladder, with potentially serious consequences. On the other hand, she may be able to regain her hold and balance again, avoiding an accident. A hazardous event will therefore not necessarily always lead to an accident.
In all these examples, some prerequisites need to be in place for the event to occur. In the case of the car, control can only be lost if the car is driving, dropped objects are only possible if something has been lifted, the aircraft engine stopping is critical only during flight, not on the ground. This is an indication that hazardous events on their own not necessarily are critical but need to occur in a context where a hazard is present.
Example 2.4 (Crane operation)
A crane is used to lift heavy elements on a construction site. The lifting operation has several hazards. One of these is the potential energy of a lifted element. This hazard is an intrinsic hazard of the lifting operation because it is not possible to lift anything without creating potential energy. The potential energy can be released, for example, if the hazardous event “chain breaks” occurs. This event leads to “uncontrolled fall of the element.” The consequence of the fall depends on where the element falls down – if there are people or important equipment (i.e. assets) in the area. The concepts used in this example are shown in Figure 2.1 .
2.3.4 The Bow‐tie Model
The bow‐tie model for risk analysis is shown in Figure 2.2 . An identified hazardous event is placed in the middle of the figure, with the causes shown on the left side and the consequences on the right side. The figure indicates that various hazards and/or threats may lead to the hazardous event and that the hazardous event may in turn lead to many different consequences. Various barriers are usually available between the hazards/threats and the hazardous event, and between the hazardous event and the consequences. The model in Figure 2.2 is called a bow‐tie model because it resembles the bow tie that men sometimes use in place of a necktie with a formal suit. The bow‐tie model is a useful illustration of both conception and analysis of risk.
Many of the concepts that are introduced in this section can be illustrated in the bow‐tie diagram. An accident scenario, involving the identified hazardous event, is shown as a path from left to right. The sequence of events is started by an initiating event and is terminated by a specific end event that causes an end state. The end state will lead to consequences for one or more assets. The path of the accident scenario is diverted (i.e. changes state) by the action of barriers and hence, the steps of the path indicate the presence of barriers. All the possible accident scenarios involving the specified hazardous event can, in principle, be represented in the same bow‐tie diagram. If we are able to identify all relevant hazardous events, we can, in principle, identify and describe all relevant accident scenarios by using bow‐tie diagrams. This makes the bow‐tie model a practical and efficient tool for risk analysis.
2.3.5 End Event and End State
In the same way that we define initiating events as the start of the accident scenarios, we often use the term “end event” or “end state” to signify the end of the accident scenario. Defining this is not any easier than defining the initiating event.
Definition 2.10 (End event)
An identified event that represents the end of a defined accident scenario.
This definition does not specify what the end of the scenario is. In the same way as with initiating events, it is up to the analyst to decide where and when the scenario ends. When the end event occurs, the system enters a state that we call the end state. This end state is used as a basis for establishing the consequence spectrum for the accident scenario.
2.3.6 A Caveat
The initiating event, the hazardous event, and the end event are all problematic concerning where to locate them in an accident scenario. The initiating event may be the least problematic, but as seen from the comment after Definition 2.8 , it is not always obvious how and where to start an accident scenario.
The end event and the following end state may be the most important part of an accident scenario and is often used as a name for the scenario, such as “fire in process area 1” or “collision with train on same track.” As illustration, consider a potential fire in the process plant. Should we define the end state of the accident scenario as (i) a fire is ignited, (ii) a significant fire is ongoing, or (iii) the fire has been extinguished? In many risk analyses, the end state is set as soon as a state is initiated that inevitably – if not stopped – will cause harm to some assets. For the scenario above, this means that the end state is defined as “fire is ignited.” When this end state is present, a number of safeguards, or barriers, are usually activated to stop the development of the end state and/or to protect the assets. The consequences of the accident scenario are then determined by the capability and reliability of these barriers. Where to set the end state depends on the study object and on what is deemed by the risk analyst to be practical.
The hazardous event is purely an analytical concept and may
