BOW-TIE

What is BOW-TIE?

BOW-TIE (bowtie analysis) is a visual risk management method that shows, around a single unwanted event, which causes can lead to it, which consequences can follow and which barriers prevent or limit them. The name comes from the shape of the diagram: the top event sits in the middle, threats with preventive barriers on the left and consequences with mitigating barriers on the right, which together look like a bow tie. The method is widely used in high-hazard sectors such as chemicals, oil and gas, aviation, mining and energy, and increasingly to connect process safety with OT cybersecurity.

🧠 How does a bowtie analysis work?

A bowtie describes one scenario from start to finish. You start with the hazard, name the moment at which control is lost, and work outwards from there: to the left (how can it go wrong?) and to the right (what happens next?).

The split between preventive and mitigating is the same one you see in mitigating measures: on the left you reduce the likelihood, on the right the impact. The idea builds on James Reason’s Swiss cheese model: an accident only happens when every barrier on one line fails at the same time.

🕰️ Where does the bowtie method come from?

The earliest form is attributed to the chemical company ICI, which used this kind of diagram in the late 1970s; course notes from a 1979 lecture at the University of Queensland are often cited. The exact origin is not fully documented.

Shell’s main aim was assurance that the same risk controls were in place in all of its operations worldwide. From there the method spread to aviation, mining, shipping, rail and healthcare. In 2018 the UK Ministry of Defence reported that five of the six duty holders responsible for military flying had committed to using bowties in their air safety management system.

🛡️ What makes a measure a real barrier?

A common mistake in bowties is drawing everything that “helps” as a barrier. The CCPS and Energy Institute concept book therefore sets strict requirements:

• Effective - the barrier can stop the scenario on its own (left) or substantially limit the consequence (right)
• Independent - the barrier does not fail through the same cause as the threat or another barrier on the same line
• Auditable - its performance can be tested and demonstrated during an audit
• Complete - an active barrier contains all three elements of detect, decide and act; an alarm without a defined operator response is therefore not yet a barrier

These requirements closely resemble the criteria for an independent protection layer in LOPA. A measure that does not meet these requirements is called a safeguard in the concept book: useful, but not a barrier. In this approach, training, procedures, supervision and maintenance are not barriers on the main pathway either. They belong with the degradation controls: they keep the real barrier working.

🎯 What does a bowtie look like in practice?

Take a chemical reactor with the top event overpressure in the reactor vessel. Each row in the tables is a separate pathway with its own barriers.

On the right-hand side, many organisations also draw emergency response and recovery as barriers. That is acceptable as long as the measure demonstrably detects, decides and acts, and is exercised regularly; a plan that only sits on a shelf is not a barrier.

Degradation factors attach to the barriers. The safety function weakens if someone bypasses it during maintenance; the high-pressure alarm weakens if operators are caught in an alarm flood. The degradation controls are then a bypass procedure with formal authorisation, and alarm management in line with ISA-18.2. A cyberattack on the safety PLC is another such degradation factor; segmentation and access control in line with IEC 62443 are the matching controls.

🛠️ How do you build a bowtie?

1. Choose the hazard and top event - phrase the top event as loss of control (“overpressure in vessel R-101”), not as a consequence (“explosion”) or a cause (“valve failure”).
2. Reuse existing analyses - take threats from HAZOP, FMEA or incident investigations so you do not start from scratch.
3. Name threats and consequences - each threat must be able to lead to the top event on its own.
4. Place barriers per pathway - test each measure for effectiveness, independence and auditability; anything that fails becomes a degradation control.
5. Add degradation factors and controls - think of bypasses, overdue maintenance, human error and cyber threats.
6. Assign owners - each barrier gets a responsible role and a test interval.
7. Keep the bowtie current - link barriers to inspections, failures and change management so that the diagram shows the actual state.

For quantitative support, you then take the most important threat lines into LOPA. That analysis shows whether the barriers together deliver enough risk reduction, or whether an extra safety function with a given SIL is needed under IEC 61511.

🔄 How does a bowtie differ from HAZOP, LOPA and fault trees?

You can think of a bowtie as a simplified fault tree on the left and an event tree on the right. The difference is that a bowtie usually stays qualitative and is drawn by the team in a workshop.

🔐 How do you use a bowtie for OT cybersecurity?

In OT convergence, the bowtie bridges process safety and cybersecurity. There are two common approaches:

• Cyber as a degradation factor - on the existing process safety bowtie you mark which barriers are digital (SIS, alarm system, SCADA) and what happens if an attacker disables them. The TRITON malware targeted exactly such a barrier in 2017.
• Cyber as its own bowtie - with a top event such as “attacker gains control of the control network”, threats such as phishing or an infected maintenance laptop, and barriers such as network segmentation, firewalls and backups.

That connection is also formally required. Since its 2016 edition, IEC 61511 has required a security risk assessment of the SIS, and in a risk assessment under IEC 62443-3-2 you can use existing process safety analyses to determine the consequences of an attack. For Seveso establishments, which must demonstrate a safety management system, a bowtie shows that digital barriers in the defence in depth design are under control as well.

✅ What are the benefits and pitfalls?

Benefits:

• Visual and easy to understand - operators, management and regulators see in one picture how a risk is controlled
• Prevention and mitigation - both sides of the scenario appear side by side
• Basis for barrier management - barriers get owners, test intervals and a current status
• Evidence for compliance - useful in audits and safety reports
• Broadly applicable - the same approach works for quality, environment, information security and risk-based maintenance

Pitfalls:

• Vague top event - “fire” or “failure” produces a bowtie in which everything and nothing fits
• Paper barriers - training or procedures on the main pathway give a false sense of safety
• Coupled barriers - two barriers that use the same sensor are not independent
• Static diagram - a bowtie that is not updated after changes or incidents quickly loses its value

❓ Frequently asked questions

What is a top event in a bowtie?

The top event in a bowtie is the moment at which control over a hazard is lost, for example overpressure in a vessel or a release of gas. It is not yet the damage itself: the consequences sit on the right of the diagram. A well-chosen top event makes clear which barriers must work before and after it.

Is training a barrier in a bowtie analysis?

In the CCPS approach to bowtie analysis, training is not a barrier on the main pathway, because training on its own does not stop a scenario. Training is a degradation control: it keeps a real barrier, such as an operator responding to an alarm, working reliably.

Is a bowtie qualitative or quantitative?

A bowtie is essentially a qualitative method that gives a clear overview of causes, barriers and consequences. For quantitative statements about likelihood and risk reduction, you combine the bowtie with LOPA, a fault tree or an event tree.

Which software is used for bowtie diagrams?

The best-known package for bowtie diagrams is BowTieXP, originally developed by the Dutch company CGE Risk Management Solutions and part of Wolters Kluwer since 2020. Simple bowties can also be drawn with general diagramming software, but specialist tools link barriers to owners, audits and incidents.

Can a bowtie also be used for cybersecurity?

A bowtie also works for cybersecurity, for example with the top event “attacker gains access to the control network”. In OT environments it is especially valuable to show cyberattacks as degradation factors on process safety barriers, so that safety and security teams discuss the same scenario.

How many bowties does a plant need?

A plant needs one bowtie per major hazard or top event, not a single bowtie for the whole site. In practice you start with the scenarios with the most severe consequences from the HAZOP or risk assessment and expand from there.

📌 In summary

A bowtie analysis shows in a single diagram how an unwanted event can arise, what its consequences are and which independent barriers prevent or limit them.

The method, which originated at ICI and was popularised by Shell after Piper Alpha, is strong in communication and barrier management. Take the scenarios from HAZOP, support the risk reduction with LOPA and include cyber threats as degradation factors, so that the bowtie shows the real state of your barriers in a converged IT/OT environment too.