Bow Tie for Risk Assessment

Our updates from Switzerland

Our updates from Switzerland

Bow Tie for Risk Assessment

Diagrams and models improve mental processes and thus often make complex connections of causes and effects understandable. The Bow Tie method provides a model for the documentation and evaluation of risk situations.

February 2020

Figure 1: Representation of a Bow Tie diagram (Source: BOW TIE XP Software, Supplier: CGE RISK MANAGEMENT SOLUTIONS)

Both the causes and the consequences are graphically represented in a diagram. Originally mainly used in the oil and gas industry, the Bow Tie method has rapidly spread to a variety of industrial sectors such as aviation, medicine, mining, IT security, chemical production and many more because it can be easily learned, has many applications and can be understood intuitively as a tool for risk communication. Bow Tie diagrams are a suitable visual tool to keep track of risk management solutions.

A Bow Tie diagram is created by combining two established risk analysis tools, the fault tree and the event tree. Fault trees picture all possibilities that lead to an event. Event trees work inversely, starting with a single event and modelling all its consequences. In Bow Tie, like for a HAZOP scenario, fault and event trees are joined together so that the diagram shows causes and consequences around a central (or top) event (see Figure 1).

In the Bow Tie diagram the barrier concept is applied. This concept became popular in the 1980s with the introduction of the Swiss cheese metaphor by James Reason. Common sense says that every business has its hazards. For example, the hazard in most chemical companies is the extraction or creation of fine chemicals, often with toxic or flammable properties, in reaction vessels often several cubic meters in size. If control on the process is lost, then loss of lives, property, reputation or damage to the environment are likely.  To prevent the hazard from causing harm, an organization introduces barriers. They are sometimes called "controls" or "safety measures". These barriers include all types of measures, both technical and organizational, that reduce the probability of loss of control or the consequences of the hazard. In a Bow Tie diagram, those barriers are represented as “disruptions” in the lines connecting causes and effects. The clear spatial separation of the individual elements and in particular of preventive and reactive barriers, or measures, promotes more structured thinking and also facilitates understanding of the risk as well as the complex interrelations.

Bow Tie diagrams have two mains applications. The first is to visualize previously identified high risk scenarios from existing risk analyses (e.g. a HAZOP study) to improve communication and to facilitate risk based decisions. Situations, where different causes lead to the same event will become visible and thus the higher probability of occurrence of this event will become obvious. The second possible application is the documentation of a risk assessment performed in a team for simple process steps or workflows. The visual representation of the hazard and the existing barriers will increase attention, initiative, creativity and acceptance by the individual team members. The documentation can be done on Excel spreadsheets or by hand on paper. Alternatively, Bow Ties can be created with the support of dedicated softwares, which also offers the possibility to store a multitude of information in the background and to show or hide it as required.

The time needed to generate Bow Ties depends mainly on the complexity and the level of detail of the expected results. Identification of risks can be carried out with the help of the Bow Tie analysis within a small timeframe. For a quantitative risk assessment, on the other hand, the time required for the evaluation is significantly longer, as the data requirements are greater. Bow Tie diagrams are created using 8 essential elements, which should be discussed and defined in the order described below (see Table 1).

Table 1: Description of the functions in the Bow Tie diagram

  • Defines the context and scope of the Bow Tie diagram
  • Describes the desired state or normal operation of this hazard
  • Has the potential to cause damage if control is lost

  • Describes the moment of loss of control over the desired condition
  • Happens before damage occurs and is possible to be recovered
  • Hazards can have multiple top events

  • Is a possible cause for the top event
  • Should lead directly and independently to the top event
  • Is not a failure of a barrier

  • Is a harmful consequence of the top event
  • Leads directly to loss or damage
  • Describes how the damage occurs

  • Is a measure to avoid the threat or prevent the occurrence of the top event
  • Each barrier comprises a component to detect, decide and act
  • Can be a technical or organizational solution or a combination of both

  • Describes a measure to avoid or mitigate the consequences of the top event
  • Each barrier comprises a component to detect, decide and act
  • Can be a technical or organizational solution or a combination of both
  • Difficult to prove their effectiveness, due to often vague predictions of the actual course of events and the extent of the damage

  • Is a condition that weakens or defeats a barrier
  • Should correspond to realistic conditions and be limited to particularly critical barriers

  • Reduces the effect of the degradation factor
  • Describes a measure to maintain the availability of the critical barrier

As with other risk assessment tools, the quality and impact of the Bow Tie diagram can be kept high by applying useful rules and guidelines. As intuitive as the structure of the diagram and the elaboration of causes, consequences and measures may seem, it is particularly important to note that a clear distinction must be made between top events and barriers. A failed safety system does not represent or lead to a Top Event. Instead, the safety system must be inserted as a barrier, to which a degradation factor (escalation factor) can be added, which can reduce the effectiveness or reliability of this barrier. This is a difference to fault and event trees, where this distinction is not made. In general, information should not be duplicated and measures should not be used both as a barrier and as a deviation. It should be considered that it is difficult to depict the dynamic aspect of real systems with Bow Tie diagrams. Thus as soon as new relevant information is available, the Bow Tie diagram should be updated.

A separate Bow Tie diagram is created for each scenario. Therefore, complex non-linear cause-and-effect principles from reality, where each effect can also be a cause for other top events,  can only be depicted to a limited extent.  However, with the help of software support, it is possible to extend the otherwise linear cause-effect representation to more complex overarching relationships with several Bow Tie diagrams by linking them. In addition, advanced features and details can be embedded in the Bow Tie diagram with software support, such as assigning the elements to specific categories, performing risk assessments using a self-defined risk matrix, taking actions and adding quantitative data for the reliability of barriers and probabilities of occurrence of the causes. One example is the "Bow Tie XP" software, which can be obtained from TÜV SÜD Process Safety or directly from our software-owning partner CGE Risk Management Solutions. Non-binding and free "trial versions" can be provided by us on request.

TÜV SÜD Process Safety also offers short and intensive training courses for learning the Bow Tie method and basic training in the use of the Bow TieXP software, as well as the use of the Bow Tie method for your risk studies.

Visualize your risk, manage your safety barriers and make risk-based decisions.


Dr. Tobias Lorenz

[email protected]

Our partner:

Next Steps

Site Selector