What the shape means
The knot of the bowtie is the top event: the moment control is lost — a tank overflows, a line parts, gas escapes. To its left are the threats that lead there and the preventive barriers that stop them; to its right the consequences if the top event occurs and the recovery barriers that limit them.
What counts as a barrier
To be a barrier, three criteria are expected: it must be effective (able to break that path on its own), independent (not failing with another barrier from the same fault) and auditable (its working can be demonstrated). “Being careful” is not a barrier; it cannot be measured or audited.
Types of barrier
- passive hardware (a bund, a wall, a seal),
- continuous hardware,
- active hardware (sensor plus interlock),
- active human (operator intervention),
- active hardware plus human.
Where a human has a role, all three steps must be complete: detect, decide, act. If the alarm sounds but nobody knows what to do, the barrier is incomplete.
Escalation factors
This is the least known and most valuable part of a bowtie: the conditions that weaken a barrier, and the secondary barriers placed against them. “There is a gas detector” is a barrier; “its calibration has lapsed” is an escalation factor; “a calibration schedule and record” is the barrier against it.
Not numerical, but not empty
The method produces no score. What it does open up is a three-dimensional assessment of each barrier: effectiveness, availability and reliability. Critical barriers are taken into a barrier management plan with an owner, a test method and a frequency.