Bow-tie diagram

Rumours that the model originated in training materials used in ICI have existed for many years. The actual origin (as written by the originator of the bow-tie model) is as follows.

The model first appeared on a blackboard at the then Ballarat College of Advanced Education (BCAE) in Victoria, Australia. BCAE is now called Federation University.[3]

The model was used as a teaching aid to explain an aspect of the Generalised Time Sequence Model (GTSM). The GTSM describes the structure of the process leading to damage. See [4] chapter 3.

This occurred in the first presentation of a course, the Graduate Diploma of Occupational Hazard Management, in either 1979 or 1980. This course was an early approach to considering safety at a tertiary level. During an Accident Phenomenology class the meaning of the GTSM was being explained to a group of students. The GTSM includes the simple point that when something goes wrong (an Event) there is a Reason/Mechanism for it and afterwards there is Result/Outcome. It is the Result/Outcome that leads to observable Consequences (damage, injury, loss). With a little reflection it is clear that the same Event could have various different Reasons/Mechanisms for occurring and various different Results/Outcomes. The students stared blankly when this point was made using lozenge shapes connecting Mechanism to Event to Outcome to Damage.

A second attempt to explain this was made, using a small circle in the middle of the board (a change from the square normally used), to represent the Event. Individual possible Reasons/Mechanisms were then added as small circles on the left of the Event and therefore earlier on the time-line. Each was joined to the Event circle by a separate line. The model was explained using a fall as the example Event - one circle for slips, another for trips, another for knockdowns... and so on. When you subject this to careful analysis there is actually of the order of ten of these Mechanisms. The Event was defined as the point in time when control is lost over the potentially damaging properties of the gravitational potential energy of the person falling - in short "a fall begins".

It was evident this communicated very well to the students and so the graphic was continued on the right hand side of the Event to represent the Results/Outcomes. There are four basic ones for a fall:regained stability; arrested fall; complete fall to ground; complete fall to another level. As I finished a voice said "that looks like a bow-tie!” On inspection, it bore a remarkable similarity and it was clear it communicated very effectively to the students.

The presentation concluded by making two points: 1. Each Outcome pathway could result in either damage, injury or loss and of different magnitudes. This reflects a point made by Rowe [5] 2. Control measures can be applied to each possible Reason/Mechanism as well as to each possible Result/Outcome pathway, in order to intervene in the process.

In that group were students from ICI in Melbourne, Australia. Given the subsequent attribution of the origin of the model (as above) it is reasonable to presume that these students took the graphic and used it, without acknowledging its source.

Because of its success that graphic has been used in numerous industry courses given over the years as well as in a manual on "accident investigation". As an example, one of these courses was to a group of safety people from the petrochemical industry - the refinery in Altona, Victoria, Australia. It has also been used in courses for engineers and others on risk analysis methods in various industries in Australia, Saudi Arabia, India, Thailand and South Africa.

The historical context of this needs to be understood. “Accidents” and Heinrich [6] were all there was in the general mind space in the late 1970s. Haddon's [7] refutation of accident theory and the development of the energy damage model [4] had not had any effect on practitioners.

Eric Wigglesworth, [8] and Derek Viner were collaborating on syllabus topics suited to post graduate study.

Royal Dutch Shell is considered to be the first major company to successfully integrate bow-ties into their business practices.[2]

The following explanation of Bow-ties is written by the originator of the model. Explanations have been given by others that have a different understanding of the model, possibly based knowingly or not on accident and their cause concepts. See as an example the two diagrams.

Example of the layout of a bow-tie diagram

The fact that scientific effort benefits greatly from a focus on "process" is well known in the geological and biological sciences, as was noted by Haddon.[7] The GTSM was consequently developed as a generalised process model. The Bow-tie model is a simplified extract of this model.

Haddon had also pointed out the significance of energy sources in this process. One of his co-researchers JJ Gibson [9] had made this point earlier. Swust [10] mentions an even earlier paper on this by Deblois in 1927.

Further insight into the structure of process leading to damage is given by Rowe’s seminal work [5] and also that of Jean Surry, a Canadian industrial engineer and academic . Rowe modelled Outcome pathways following an event, although defining the event in an unsatisfactory and uncharacteristically circular manner as "what resulted in Outcomes" and Outcomes as "what followed an event". Jean Surry showed elegantly how Outcomes involving human decision-making could be modelled, although she didn’t call it Outcome.

Rowe’s event can be objectively defined (given the fact that energy is necessarily involved in damage) as "the point in time when control was lost of the potentially damaging properties of the energy source of interest". The resulting model is not only comprehensive (there is a finite number of energy forms) but also objective and so suitable for scientific and hence engineering application.

As noted by Viner ([4]) ideas in the nuclear risk field ([5]) and those driven by engineer’s needs to solve problems associated with the cold war and the space race (Fault Tree Analysis and Event Analysis) occurred separately but at similar times. On reflection, the engineering methods lacked a theory for deriving an Event of interest. Adding Energy to the equation benefits those analytical methods.

The GTSM creates a unifying theory that joins energy damage and risk theory with the work of risk engineers: Fault Tree Analysis; Event Analysis (what Rowe would have called Outcome Analysis). It's more simple extract, what is now universally known as the Bow-tie model, captures the essence of this, but only if the Event is defined in a manner that has scientific meaning.

Bow-ties contribute to the identification, description and understanding of the different types of Risk that can arise in a given situation/facility/production process. The benefit of this is that Risk control measures can be comprehensively identified. The organisational value of this is to be found in the efficient documentation that results and its contribution to organisational memory, without which Risk can never be truly managed.

Where damage Risks are analysed the Event is defined in energy terms, as the point in time when control is lost over the potentially damaging properties of the energy source. This is because of the physical reality that damage is always due to the influence of a form of energy on the susceptible object.

In a general sense energies are one type of Threat. While energy threats result in damage/injury and associated losses/costs, non-energy threats result directly in losses/costs with no intervening damage. In general an Event can be defined as the point in time when control is lost over the potentially damaging or loss-producing effects of a Threat to which the susceptible asset is subject. An asset is anything of value to the organisation and Threats may be energy-based or not.

With this definition of what an Event means it is possible to develop a comprehensive and exhaustive list of Risks to be understood and assessed. Without this definition it is not and the result becomes indistinguishable from the application of accident ideas: Risks multiply in number uncontrollably and the matter of risk management becomes an unnecessary problem due to complexity and lack of clarity.

For example, pressurised fluids (pressure = energy expended (or work done) per unit volume to achieve that pressure above atmospheric pressure) are of necessity contained. If containment is breached (the Event)there is a Result/Outcome that involves some or all of noise, pressure wave, possible flying debris and loss of fluid. These Outcomes (the right hand side of the diagram) result in Consequences in the form of damage from pressure wave and flying debris and the loss of the fluid. These Consequence have Values which can be the costs of repair/rehabilitation, replacement of lost fluid etc.

Containment breaches (the left hand side of the diagram) can arise for a limited number of possible Reasons/Mechanisms. For example structural degradation (abrasion, corrosion, fatigue, external impact, application of other forces and the like), overpressure of a healthy structure, inadvertent opening or other failure modes of valves etc.

When these possible Mechanisms and Outcomes are understood the engineer can ensure that control measures exist to intervene in these possible parts of the processes.

A left hand (Mechanisms) side example: corrosion potential can be minimised by material used in the containment vessel; external and internal surface coatings, internal and external chemical exposures, vessel inspection (internal and external), wall thickness measurements. Some are concerned with design and commissioning, others with condition monitoring.

A right hand side (Outcomes) example: nearby structures are designed to withstand modelled pressure waves. This is concerned with plant design and with control over plant developments.

A similar but usually more simple understanding of where no damage threats can be developed. For example: loss of power to the production unit, failure of supply of raw materials, loss of labour (strike etc), loss of licence to operate etc.

It is for this reason that the various tools that are available to users of the bow-tie show "barriers" on the left hand and right hand arms of the Bow-tie. These are more appropriately called control measures. The only point in knowing what the left and right hands look like is to be able to understand the variety of control measures that need to be in place and maintained. Very few of these are actually "barriers".

Not all ideas that purport to be Bow-tie diagrams are based on these ideas. See for example the adjacent diagrams.

A simplified bow-tie for network theory in risk assessment.

One shows Triggers arising from hazards and threats and causing hazardous events. The right hand side had direct pathways to Consequences rather than to pathways that lead to Consequences. There is a difference. The other diagram shows no obvious relationship to the Bow-tie diagram envisaged here.

A common criticism made of models of the process leading to damage is that they are linear. See, for example[11]

One could argue that any process model must be linear as the laws of thermodynamics essentially make it clear that what has happened is in the past and what will happen in the future. A fall cannot occur without a reason. Animals and plants and coastal landforms are all here because of the preceding genetic and geological processes of which they are the latest manifestation.

Clearly the political, social, legal, financial, organisational, interpersonal, behavioural milieu that forms the nature of the world in which we live and which influences the likelihood of damaging energy transfers is by no means linear. Nevertheless, the energy transfer process that is influenced by these is.

A number of useful software is available in industry, these are:

Bowtie Master (cloud based) [12]

BowtieXP (local only) [13]

Bow-ties have been used in a set of various disciplines, which for example includes:

• Network theory with network theory in risk assessment
• Information security with cyber security risks[14]
• Chemical engineering[15]
• Risk consulting[16][17]
• Aviation[18]