A bow-tie diagram shows how a hazardous situation can develop and how barriers can control it. It connects threats to a central event, then connects that event to possible consequences. This helps engineers, operators and managers discuss the same risk pathways.

The diagram also supports a Safety Case by showing where prevention and mitigation measures act. However, a clear diagram is only a starting point. The project still needs evidence that each barrier can perform its required function.

Understand the parts of a bow-tie

Start with the hazard: a source of potential harm, such as stored fuel or energetic material. Define the top event as the point where control of that hazard is lost. Keep this separate from the eventual harm. For example, loss of containment can be the top event; fire and injury can be later consequences.

Threats appear on the left. They are causes that can lead to the top event. Preventive barriers interrupt these pathways. Consequences appear on the right. Mitigation and recovery measures act after the top event to limit harm or support recovery.

A bow-tie combines cause and consequence analysis. It can draw on Fault Tree Analysis and Event Tree Analysis, but a simple bow-tie does not automatically contain their logic or numerical rigour. IEC provides bow-tie analysis resources within its risk assessment guidance.[1]

Generic bow-tie structure. Each pathway needs its own assessment of barrier performance.

Choose the event before selecting barriers

Define the system, activity, operating conditions and boundaries. Then write a precise top event. This determines which measures belong on each side.

For a flammable liquid release, ignition prevention can limit escalation after loss of containment. If the selected top event is a fire, ignition prevention belongs before that event. The barrier has not changed; the event boundary has.

Consider eliminating the hazard before relying on barriers. Where the hazard remains, identify credible threats and consequences. Use operating experience, hazard studies and specialist knowledge. Include operators and maintainers who understand actual working conditions.

Make each barrier specific

Describe the function that stops a threat or limits a consequence. Labels such as training, procedures or physical design are too broad on their own. State the action, equipment or physical feature involved.

For a human response, identify the cue, decision, action and available time. Training supports that response but does not, by itself, complete it. For a technical barrier, identify its required performance, operating limits and dependencies.

Assign an owner and define how the barrier will be inspected, tested and maintained. Link the diagram to operating instructions, maintenance tasks and assurance records. This makes it possible to check whether the barrier remains effective.

Check dependencies and degradation

Two barriers can fail together if they share power, sensors, software, people or maintenance errors. Do not assume independence because they occupy separate boxes.

Identify degradation factors: conditions that can weaken a barrier. Examples include corrosion, overdue testing, poor visibility or unavailable staff. Then identify measures that control these conditions. Keep these supporting measures distinct from barriers on the main event pathway.

There is no general requirement for equal numbers of barriers on both sides. Their selection depends on the hazard, credible scenarios and required risk reduction. Counted boxes do not demonstrate adequate protection.

Use the technique within its limits

Bow-ties help teams explain scenarios, identify gaps, allocate ownership and focus inspections. They are useful when non-specialists need to understand how safety measures work together.

A diagram alone does not calculate risk or demonstrate that risk is acceptable or as low as reasonably practicable (ALARP). Where numerical assessment is needed, use suitable data and methods. Check common cause failures, timing, barrier reliability and uncertainty.

Keep complex scenarios manageable. Separate diagrams may be necessary for different operating modes or top events. Review them when the design, operating conditions or evidence changes.

A naval magazine example

The retained table lists threats, consequences and safeguards for a ship's deep magazine. Its original category names are preserved. SFP means Ships Fire Party; SSFP means Standing Sea Fire Party.

The table calls structural damage the top-level event. For the accompanying teaching diagram, fire or explosion is the central event, and structural damage is a consequence. This keeps the event sequence clear. The listed safeguards are candidates for assessment, not a complete or validated magazine safety design.

Measures such as ventilation, magazine sprays and blast protection need assessment against the specific munitions, ship configuration and operating conditions. A diagram cannot establish their suitability.

Category

Naval magazine example

Top-Level Event

ship structural damage due to fire or explosion in a ship's deep magazine

Threats

ignition source, heat build up, explosive atmosphere

Consequences

personnel injury, structural or material damage, ship loss

Barriers

removal of ignition sources, munitions stored in quiescent state, boundary cooling, remote and local fire detection monitoring, regular physical compartment checks, procedures, anti-static precautions, physical design, restricted access

Controls

Ships Fire Party (SFP) / Standing Sea Fire Party (SSFP), training, compartment ventilation, blow-off plates

Contribution factors

secondary explosions, fire spreads

Contribution controls

not mixing ammunition types, magazine sprays, blast plates, Insensitive Munitions, SFP/SSFP, Damage Control Procedures, Life boats, First Aid Party

Original example table. Category names and listed measures are retained.

Naval magazine teaching example. Selected measures from the source are shown; suitability and dependencies require assessment.

Case study Buncefield and failed protection

On 11 December 2005, explosions and fire occurred at the Buncefield oil storage depot in the United Kingdom. More than 40 people were injured. There were no fatalities.[2]

The investigation described a tank level gauge that stuck and an independent high-level switch that failed to stop filling. Petrol overflowed, formed a vapour cloud and ignited. The report also identified weaknesses in containment and safety management.[3]

A teaching bow-tie can use petrol overflow and loss of containment as its top event. Tank level monitoring and independent overfill protection belong on the prevention side. Measures that limit fire, exposure and environmental spread belong on the consequence side. This is an interpretation of the findings, not a reconstruction of an official investigation diagram.

The practical lesson is to verify barrier performance. Installation checks, functional tests, fault reporting and corrective action must support the protection shown on paper.

Hashtags

#BowTieAnalysis, #SystemSafety, #SafetyEngineering, #RiskAssessment, #BarrierManagement, #SafetyCase, #ProcessSafety, #SafetyAssurance

Sources

[1] IEC Technical Committee 56. Risk assessment standards and bow-tie analysis resources. https://tc56.iec.ch/risk-assessment-standards/

[2] Health and Safety Executive. Buncefield incident overview. https://www.hse.gov.uk/comah/buncefield/

[3] COMAH Competent Authority. Buncefield Why did it happen. See the executive summary and sections on level control, containment and safety management. https://www.icheme.org/media/10706/buncefield-report.pdf