Skip to content
Thinking in Diagrams

Risk bow-tie

Strategy & decisionsField guide · Strategy & decisions · 5 of 6

What could release one hazard, what follows, and what barriers stand between?

A risk bow-tie is drawn around the moment control over one hazard is lost: the threats that could cause it on the left, the consequences that could follow on the right, and a barrier across each path between.

Marks

Section titled “Marks”
MarkDrawn asStands forSource
hazarda box above the knot“any agent or operational situation that may cause harm”, with its scale and placeManton et al.
A risk bow-tie's hazard At the top, the hazard: wet tailings behind an earth dam above a village and a river, joined by a plain line down to the top event at the knot: the dam breaches. wet tailings behind an earth damabove a village and a river the dambreaches
top eventa box at the knotthe moment control over the hazard is lostManton et al.
A risk bow-tie's top event The top event at the knot: the dam breaches. Three plain lines run into it from the left, and two leave it to the right. No line has an arrowhead. the dambreaches
threata box at the lefta cause enough by itself to bring about the top eventManton et al.; Boult and McCulloch
A risk bow-tie's threat On the left, a threat: flood water overtops the dam, on a plain line running right to the top event: the dam breaches. flood waterovertops the dam the dambreaches
consequencea box at the rightthe worst credible result if no barrier holdsManton et al.
A risk bow-tie's consequence The top event, the dam breaches, on a plain line running right to a consequence: deaths in the village. the dambreaches deaths inthe village
barriera box across a pathprevention on the left, mitigation on the right; each effective, independent and auditableManton et al.
A risk bow-tie's barrier A plain line, a path from a threat toward the top event, with a prevention barrier across it: water kept off the tailings. water kept offthe tailings
degradation factor and controla box on a side line into a barrier, its control across that linewhat can make a barrier fail, and what guards against it; not in the figureJohnson et al., §2
A risk bow-tie's degradation factor and its control A plain line, a path toward the top event, with a barrier across it: drains kept clear, seepage watched. Below the barrier, a degradation factor, drains blocked, on a side line running up into the barrier, with its control across that line: drains inspected. drains kept clear,seepage watched drains inspected drains blocked
barrier conditiona color on the barrier, or +, 0 or − beside ithow well the barrier works; not in the figure, which is drawn in one colorJohnson et al., §5.1
A risk bow-tie's barrier condition A plain line, a path toward the top event, with a barrier across it: water kept off the tailings; beside the barrier's top right corner, a plus, the barrier working. water kept offthe tailings +
lines of defensethick linesnot in the figure, which is drawn at one widthMoD, §1.1.1

A line with an arrowhead

Section titled “A line with an arrowhead”

A risk bow-tie has no arrowheads: each line is a path that can lead, read left to right, from a threat to the top event and from it to a consequence. An effect relates two quantities, a change in one changing the other; a bow-tie’s path joins events, and a barrier across it stops the path.

A mine’s tailings dam failing

Section titled “A mine’s tailings dam failing”
A mine's tailings dam failing, as a risk bow-tie Read left to right through a knot in the middle. Above the knot, the hazard: wet tailings behind an earth dam above a village and a river, joined by a plain line down to the top event at the knot: the dam breaches. On the left, three threats, each on a line running right to the top event, with a prevention barrier across it: flood water overtops the dam, barrier water kept off the tailings; an earthquake beyond the design, barrier built by the downstream method; seepage erodes the dam, barrier drains kept clear and seepage watched. On the right, two lines run from the top event to two consequences, each with a mitigation barrier across it: barrier sirens and an emergency plan, consequence deaths in the village; barrier emergency storage downstream, consequence a river poisoned far downstream. No line has an arrowhead. wet tailings behind an earth damabove a village and a river the dambreaches flood waterovertops the dam water kept offthe tailings an earthquakebeyond design built by thedownstream method seepageerodes the dam drains kept clear,seepage watched sirens and anemergency plan deaths inthe village emergency storagedownstream a river poisonedfar downstream

Of the tailings dam failures from 1915 to 2016 counted by the International Commission on Large Dams and by David Chambers, overtopping caused 44, earthquakes 27 and seepage 17. At Samarco in 2015 a breach killed nineteen people and the slurry traveled 650 km to the sea; the company had no emergency plan, warning lights or sirens. After the Baia Mare spill of 2000, an international task force chaired by the European Commission insisted on emergency storage.

When to draw one

Section titled “When to draw one”

Draw one where the people who run a hazardous operation need to see, for one hazard, each threat, each consequence and the barriers on every path: the CCPS and Energy Institute committee wrote for operators, maintenance technicians and managers who want “short, clear, preferably visual, overviews”. Outside oil and gas, where it began, the technique suits industries where quantifying the risk isn’t warranted (MoD).

When not to draw one

Section titled “When not to draw one”

Without fault tree or event tree analysis, a bow-tie is not quantified, and whether its barriers are enough is not evaluated (MoD). Johnson et al. warn against too many bow-ties drawn too soon.

Reasoning and polish

Section titled “Reasoning and polish”
  • Reasoning5 of 5
  • Polish4 of 5hazard sketch → safety case
  1. Hazard, top event, threats, consequences and barriers
  2. Barrier owners and types, degradation factors and degradation controls
  3. Barrier effectiveness and condition, independence, and review of degraded barriers
Section titled “Related types”

No type is listed as related to this one.

Sources

Section titled “Sources”