What a bow-tie diagram shows
A bow-tie diagram combines a fault tree on the left and an event tree on the right into one picture. Its shape, wide on both sides and narrow in the middle, gives the method its name. Because it fits one major accident scenario on a single page, a bow-tie is understood by operators and managers as easily as by engineers.
| Element | What it means | Example |
|---|---|---|
| Hazard | Something with the potential to cause harm | Hydrocarbons under pressure |
| Top event | The moment control over the hazard is lost | Loss of containment |
| Threat | A cause that can lead to the top event | Internal corrosion |
| Consequence | An outcome after the top event | Jet fire |
| Preventive barrier | Stops a threat before it reaches the top event | Corrosion inspection |
| Mitigative barrier | Stops or limits a consequence | Gas detection with emergency shutdown |
| Escalation factor | A condition that makes a barrier fail | A gas detector in bypass |
How to build a bow-tie, step by step
Build bow-ties in a workshop with operations, maintenance and technical staff. The workshop is where most of the value is created, because people discover how each barrier really works on site.
- Pick a major accident scenario from your HAZID, HAZOP or safety report.
- Define the hazard and the top event. Be specific: "loss of containment from separator V-101" is far more useful than "process incident".
- List the threats. Each one should be able to cause the top event by itself.
- List the consequences that can follow the top event.
- Place the barriers on each threat line and each consequence line, in the order in which they act.
- Add escalation factors for barriers that can be defeated, with the controls that protect against them.
- Give every barrier an owner and a reference to the system or procedure that delivers it.
That last step is easy to skip, yet it is the one that turns a nice diagram into something the site can actually manage.
When is a barrier a real barrier?
A well-known pitfall in bow-tie analysis is that everything gets drawn as a barrier. Training shows up as a barrier. So do "procedures" and "competent staff". They matter, but they support a barrier; they do not stop a scenario by themselves.
The 2018 guidance from CCPS and the Energy Institute, Bow Ties in Risk Management, gives a cleaner test. A barrier has to be able to stop the scenario, or one branch of it, without help from other barriers. It must not fail for the same reason as the threat or as the other barriers on that line. And you must be able to check its condition through inspection, testing or observation.
A barrier usually has three parts: detect, decide and act. A high-high pressure trip detects with a transmitter, decides in the safety logic solver and acts by closing a valve. If one of the three parts is missing, you are looking at a barrier element, not at a complete barrier.
From barriers to SECEs and performance standards
Safety and Environmental Critical Elements (SECEs) are the parts of an installation whose failure could cause or contribute to a major accident, or whose purpose is to prevent or limit one. Pressure relief systems, emergency shutdown valves, gas detection and fire water pumps are typical SECEs.
The bow-tie makes the link visible: each hardware barrier is delivered by one or more SECEs. For each SECE, a performance standard then describes what it must achieve. Many operators structure performance standards around four criteria:
| Criterion | Question it answers | Example for an ESD valve |
|---|---|---|
| Functionality | What must it do? | Close fully on demand |
| Availability | How often must it be ready? | Available except during planned testing |
| Reliability | How likely is it to work on demand? | Meets the PFD from the SIL verification |
| Survivability | Must it work during the event? | Remains operable during a fire for the required time |
A verification scheme then checks that the performance standards are met over time, through inspection, testing and maintenance records.
Using bow-ties in safety cases and daily operations
For offshore oil and gas operations in the EU, Directive 2013/30/EU on the safety of offshore oil and gas operations requires a report on major hazards that describes the safety and environmental critical elements. For onshore sites with large quantities of dangerous substances, Directive 2012/18/EU (Seveso III) requires a major accident prevention policy and, for upper-tier establishments, a safety report. In the Netherlands, Seveso III is implemented through the Besluit risico's zware ongevallen 2015 (Brzo 2015) and related legislation. Bow-ties are a widely used way to show in these documents how major accident risks are controlled.
Where bow-ties really earn their keep is in daily operations. When barrier status is visible, a site can see which barriers are degraded, for example a bypassed detector or an overdue relief valve test, and decide on compensating measures before a scenario develops. Bow-ties also make Management of Change sharper: if a change touches a barrier, the bow-tie shows which major accident scenarios are affected.
Bow-tie, HAZOP and LOPA compared
The three methods answer different questions, so most high-hazard sites use all of them at different moments.
| Method | Main purpose | Typical output |
|---|---|---|
| HAZOP study | Find deviations in a detailed design | Worksheet with causes, consequences, safeguards and actions |
| LOPA | Check if safeguards reduce risk enough | Mitigated frequency and SIL target |
| Bow-tie analysis | Visualise and manage barriers for major accidents | Barrier overview linked to SECEs and performance standards |
You do not have to choose between them. HAZOP finds the scenarios, LOPA tells you how much protection each one needs, and the bow-tie keeps those barriers in front of the people who operate and maintain them. Read more about my support with major hazard management, safety cases and barrier management.
Frequently asked questions
Is bow-tie analysis qualitative or quantitative?
Bow-tie analysis is mainly qualitative. It shows how barriers relate to threats and consequences. When numbers are needed, the scenarios on the bow-tie can be quantified with LOPA or a full quantitative risk assessment.
What is an escalation factor in a bow-tie?
An escalation factor is a condition that makes a barrier fail or less effective, such as a bypassed trip or a detector out of service. It is shown on the barrier it affects, together with the controls that protect against it.
What is a SECE?
A Safety and Environmental Critical Element (SECE) is a part of an installation whose failure could cause or contribute to a major accident, or whose purpose is to prevent or limit one. Each SECE has a performance standard that describes what it must achieve.
How many barriers should a bow-tie have?
There is no fixed number. What matters is that every barrier passes the tests of being effective, independent and auditable. A line with two real barriers is stronger than a line with five items that only support a barrier.
Note: this article is general information, not engineering advice for your specific installation. Standards and legislation are referenced as they apply at the date of publication. For decisions on your plant, involve a qualified engineer who knows your process and your company risk criteria.
Process Safety, Process and Project Engineer with over 12 years of experience across Oil & Gas, Petrochemical and Food & Feed. MSc Sustainable Process & Energy Technologies (TU Delft), Certified Functional Safety Engineer and HAZOP Chairman.
