Bowtie analysis and critical control management

The bowtie diagram is one of the clearest ways to show how a major accident can happen and what stands in the way. It was developed in the oil and gas industry in the late 1980s and 1990s, popularized by Shell after the Piper Alpha disaster, and is now used in mining, aviation, health care, utilities and many other sectors. A bowtie combines a simplified fault tree on the left with a simplified event tree on the right, joined at a central event. HSE-103 showed the shape. This lesson explains how to build a bowtie properly, how to judge the barriers on it, and how bowties feed critical control management, the approach the International Council on Mining and Metals (ICMM) recommends for preventing fatal events.

The parts of a bowtie

At the centre is the top event: the moment control is lost over a hazard, such as "loss of containment of hydrocarbon from the pipeline", "vehicle collision with a pedestrian" or "loss of control of suspended load". The hazard itself, such as the hydrocarbon under pressure, sits above the top event. On the left are threats: the causes that could lead to the top event, such as corrosion, external impact or overpressure. On the right are consequences: the outcomes if the top event happens, such as fire, explosion, toxic exposure or environmental damage.

Between threats and the top event are prevention barriers, which stop a threat from causing the top event. Between the top event and consequences are mitigation barriers, which reduce or stop the escalation to each consequence. Escalation factors are conditions that can make a barrier fail, such as poor maintenance, and escalation factor barriers are the controls that protect against them. Each barrier can be linked to an owner, an activity that keeps it working and a performance standard.

Choosing the top event and hazard

Choosing the right top event is the most important decision. It should be a loss of control, not a consequence and not a cause. "Fire" is usually a consequence; "corrosion" is a threat; "loss of containment" is the top event between them. A top event that is too broad, such as "process safety incident", makes the diagram vague; one that is too narrow, such as "flange leak on line 4", makes it trivial. Organizations usually build bowties for their major accident hazards or material unwanted events, the handful of events that could cause fatalities or catastrophic damage.

What counts as a barrier

Not everything that sounds like a control is a barrier. The Center for Chemical Process Safety and the Energy Institute's guidance on bowties define a barrier as something that can, on its own, stop a threat from developing into the top event or stop the top event from developing into a consequence. To do that, a barrier must detect the condition, decide what to do and act. A pressure safety valve detects overpressure, decides (it opens at its set point) and acts (it relieves). A gas detector alone only detects; with an alarm, a trained operator and a shutdown valve it becomes a complete barrier.

Training, procedures, maintenance and inspection are usually not barriers by themselves; they support barriers and appear as barrier activities or escalation factor controls. A common error is to list "training", "PPE", "procedures" and "supervision" as barriers on every threat line, making the bowtie look well protected when the real barriers are thin. Each barrier should also be independent of the threat and of the other barriers on the same line.

Judging barrier quality

Once the barriers are in place, the team judges each one. Is it effective, meaning that, if it works, it stops the sequence? Is it independent of the threat and of other barriers? Is it auditable, meaning its condition can be checked? What is its current condition: is it maintained, tested and working? Many bowtie software tools allow each barrier to be rated, for example as good, adequate or poor, and colour-coded. A line with two poor barriers is a priority even if the bowtie looks complete.

Critical control management

A bowtie becomes a working tool when its most important barriers are actively managed. The ICMM Critical Control Management good practice guide (2015) and its implementation guide describe a process. Identify the material unwanted events, the events with fatal potential. Build a bowtie for each. Select the critical controls: those that are crucial to preventing the event or reducing its consequences, and whose absence or failure would significantly increase risk. For each critical control, define its objective, its performance requirements, the activities that keep it working, who is accountable and how it will be verified. Then verify regularly in the field and report the results to management.

Critical controls are usually few, typically three to ten per material unwanted event. They are chosen because they are effective, independent and essential, not because they are easy to check. Verification uses critical control checklists done by supervisors and workers in the field: is the guard in place, is the gas detector bump-tested, is the exclusion zone established? Failures are reported and acted on immediately, and trends are reviewed by senior management. This turns the bowtie from a diagram on a wall into a living system.

Strengths and limits

Bowties are excellent for communication. A single page shows managers, supervisors and workers how a major event could happen and what they must keep working to prevent it. They link the technical analysis to everyday activities and accountabilities. But a bowtie is not a calculation. It does not show how likely the top event is, how reliable each barrier is or whether the barriers are enough. For that, the bowtie should be supported by HAZOP to identify threats, LOPA or fault tree analysis to check sufficiency, and good barrier data. A bowtie built without those inputs can look reassuring while hiding weak barriers.

In Canada, bowties and critical control management are used widely in mining, oil sands and pipelines. The Canada Energy Regulator's management system requirements expect companies to identify hazards and manage controls, and many operators use bowties for this. The Mining Association of Canada's Towards Sustainable Mining program and provincial mining regulations also encourage the approach for fatal hazards.

Building a bowtie in a workshop

Bowties are best built in a facilitated workshop with operations, maintenance, engineering and safety people, using results from HAZOP and incident history as inputs. The usual order is hazard, top event, threats, consequences, prevention barriers, mitigation barriers, escalation factors and their controls, then barrier owners and activities. A good facilitator limits the number of threats and consequences to the important ones, typically three to eight of each; a bowtie with 25 threats is unreadable and usually means the top event is too broad or the threats are really barrier failures.

Once complete, the bowtie should be reviewed by people who were not in the workshop, especially frontline supervisors, to check that it reflects how the site really operates. It should be updated after incidents, when barriers change and at the same interval as the related hazard studies.

Bowtie software can also record barrier condition from inspections and incident investigations, so that the diagram shows in colour which barriers are degraded. When investigators find that a barrier failed in an incident, they should update the bowtie and ask whether the same barrier is weak on other lines or at other sites. Used this way, the bowtie links risk assessment, verification and learning from incidents into one picture.