Your Bowtie Diagram Has No Time Axis
Most risk tools produce a score. The bowtie produces an explanation, which is why it has survived.
What does a bowtie diagram show?
The structure is simple enough to draw on a whiteboard, which is part of its strength.
In the middle sits the top event — the moment control is lost. Not the injury. The loss of control that makes injury possible.
On the left are threats, each with preventive barriers between it and the top event. On the right are consequences, each with recovery barriers that limit harm once control has gone.
The method is widely credited to work at the University of Queensland in the late 1970s, taken into industrial practice by Shell in the early 1990s in the aftermath of Piper Alpha. It is now set out jointly by the Center for Chemical Process Safety and the Energy Institute.
What makes it good is that it forces specificity. You cannot draw a vague barrier. Each one has to be a thing that exists, that someone owns, and that would actually stop this threat.
Why it reads better than the Swiss cheese model
James Reason's Swiss cheese model made the key idea famous: accidents happen when holes in successive defences line up. It is a brilliant explanatory metaphor and a poor working document.
The bowtie takes the same idea and makes it operational. The slices become named barriers. The holes become escalation factors — the specific conditions that defeat a specific barrier — each of which can carry its own barrier in turn.
That is the step from metaphor to management. You can assign an owner to a barrier. You cannot assign an owner to a hole in a slice of cheese.
What does a bowtie diagram miss?
A bowtie is a statement about a moment. It is almost always drawn in a workshop, agreed, published, and then referred back to for years.
Meanwhile every barrier on it is subject to the ordinary pressures of a working site.
A physical barrier gets moved for access during a shutdown and comes back narrower. A procedural barrier survives on paper while the shift that actually runs has found a quicker way. A competence barrier degrades through turnover, with nobody deciding anything. A detection barrier is switched off because it was alarming too often.
None of those are failures of intent. Most are someone solving a real problem in front of them.
The barrier is still on the diagram. That is the whole difficulty — the diagram cannot tell you it has changed.
This is Rasmussen's drift in a different frame, the same movement that opens the gap between the procedure and the practice. The bowtie specifies a system's defences at full strength and then has no way to represent them at partial strength.
How is barrier degradation usually found?
Honestly: by sampling.
Audits, inspections, walk-rounds, permit checks, periodic verification: what HSG65 calls active monitoring. These are good practices and they are what the guidance asks for — CCPS and the Energy Institute are explicit that a bowtie is only useful if barrier effectiveness is monitored rather than assumed.
But a quarterly audit tells you about the day of the audit. An annual verification tells you about that week. In between, the organisation is holding a picture of its defences that was accurate once.
HSE's HSG254 makes the same argument from the indicator side. For every lagging measure there should be a leading one checking the barrier it depends on — and it goes further, warning against indicator sets that measure only the easy barriers.
What would make it better
Treat barrier condition as a separate field from barrier existence. Most bowties record that a barrier is present. Fewer record when it was last verified, by whom, and against what. That single column changes the conversation from "do we have a barrier" to "how old is our confidence in it".
Write escalation factors for the realistic defeats, not the exotic ones. The barrier is rarely defeated by the dramatic scenario. It is defeated by access, by time pressure, by a temporary arrangement that stayed, by alarm fatigue.
Review the bowtie when the work changes, not on a cycle. New plant, new contractor, a change in volume or shift pattern. Those are the moments barrier assumptions quietly stop being true.
Be honest about which barriers you can actually see. Some barrier conditions are visible continuously — a physical segregation either is or is not in place, and whether people are using it as intended is observable. Others are only knowable by asking. Separating the two tells you where your real blind spots are, and most organisations have never drawn that line.
The useful question
A bowtie answers what stands between this threat and this harm? That is a good question and the method answers it better than anything else available.
The question it cannot answer is the one that matters on any given Tuesday: of the barriers on this diagram, which are intact right now?
You can get closer to that than most sites currently do. Not by redrawing the bowtie more often, but by deciding, barrier by barrier, how you would know — and accepting that where the answer is "we would not", the barrier is doing less work than the diagram suggests.
A bowtie drawn in January describes January. Everything after that is an assumption, and assumptions are worth labelling as such.
Common questions
What is a bowtie diagram in health and safety?
A risk analysis diagram with a top event — the moment control is lost — in the centre. Threats sit on the left, each separated from the top event by preventive barriers. Consequences sit on the right, separated from the top event by recovery barriers. It shows, specifically, what stands between a hazard and harm.
What is the difference between a bowtie and the Swiss cheese model?
The Swiss cheese model is an explanatory metaphor: accidents occur when holes in successive defences align. A bowtie makes the same idea operational by naming each defence as a barrier with an owner, and naming the conditions that defeat it as escalation factors. One explains; the other can be managed from.
What is an escalation factor?
A condition that defeats or degrades a specific barrier — access requirements during maintenance, time pressure, alarm fatigue, a temporary arrangement that becomes permanent. Escalation factors can carry their own barriers, which is how a bowtie represents the holes in Reason's model.
What is a top event?
The point at which control over a hazard is lost, rather than the injury that may follow. Placing the top event correctly is the hardest part of drawing a useful bowtie, because the natural instinct is to put the harm there instead.
How often should a bowtie be reviewed?
A change in the work is a better trigger than a date — new plant, a new contractor, a change in volume or shift pattern. The guidance from CCPS and the Energy Institute is clear that a bowtie is only useful if barrier effectiveness is actually monitored, rather than assumed to persist from the workshop that produced the diagram.
References
- Center for Chemical Process Safety and Energy Institute (2018) Bow Ties in Risk Management: A Concept Book for Process Safety
- Health and Safety Executive, Developing process safety indicators (HSG254) — barrier-based leading and lagging indicators
- Health and Safety Executive, Managing for health and safety (HSG65)
- Reason, J. (1990) Human Error; (1997) Managing the Risks of Organizational Accidents — the Swiss cheese model
- Rasmussen, J. (1997) "Risk management in a dynamic society: a modelling problem", Safety Science 27(2/3)
- Cullen, W.D. (1990) The Public Inquiry into the Piper Alpha Disaster
This piece starts from the ideas set out in How We Think About Safety.
Wondering what a camera would see at your gate? Request a Safety Mapping — one camera, two weeks, at no cost.