Introduction
The Bowtie method is a risk evaluation method that can be used to analyse and demonstrate causal relationships in high risk scenarios. The method takes its name from the shape of the diagram that you create, which looks like a men’s bowtie. A Bowtie diagram does two things. First of all, a Bowtie gives a visual summary of all plausible accident scenarios that could exist around a certain Hazard. Second, by identifying control measures the Bowtie displays what a company does to control those scenarios.
However, this is just the beginning. Once the control measures are identified, the Bowtie method takes it one step further and identifies the ways in which control measures fail. These factors or conditions are called Escalation factors. There are possible control measures for Escalation factors as well, which is why there is also a special type of control called an Escalation factor control, which has an indirect but crucial effect on the main Hazard. By visualising the interaction between Controls and their Escalation factors one can see how the overall system weakens when Controls have Escalation factors.
Besides the basic Bowtie diagram, management systems should also be considered and integrated with the Bowtie to give an overview of what activities keep a Control working and who is responsible for a Control. Integrating the management system in a Bowtie demonstrates how Hazards are managed by a company. The Bowtie can also be used effectively to assure that Hazards are managed to an acceptable level (ALARP).
By combining the strengths of several safety techniques and the contribution of human and organisational factors, Bowtie diagrams facilitate workforce understanding of Hazard management and their own role in it. It is a method that can be understood by all layers of the organisation due to its highly visual and intuitive nature, while it also provides new insights to the HSE professional.
See also The bowtie method and La historia de bowtie.
History
It is said that the first ‘real’ Bowtie diagrams appeared in the (Imperial Chemistry Industry) course notes of a lecture on HAZAN (Hazard Analysis) given at The University of Queensland, Australia (in 1979), but how and when the method found its exact origin is not completely clear.
The catastrophic incident on the Piper Alpha platform in 1988 awoke the oil & gas industry. After the report of Lord Cullen, who concluded that there was far too little understanding of Hazards and their accompanying risks that are part of operations, the urge rose to gain more insight in the causality of seemingly independent events and conditions and to develop a systematic/systemic way of assuring control over these Hazards.
In the early nineties the Royal Dutch / Shell Group adopted the Bowtie method as company standard for analysing and managing risks. Shell facilitated extensive research in the application of the Bowtie method and developed a strict rule set for the definition of all parts, based on their ideas of best practice. The primary motivation of Shell was the necessity of assurance that appropriate risk controls are consistently in place throughout all worldwide operations.
Following Shell, the Bowtie method rapidly gained support throughout the industry, as Bowtie diagrams appeared to be a suitable visual tool to keep overview of risk management practices, rather than replacing any of the commonly used systems.
In the last decade the Bowtie method also spread outside of the oil & gas industry to include aviation, mining, maritime, chemical and health care to name a few.
Methodological parents of Bowtie
While the origin of the Bowtie method itself is unclear, there were other methods which were either at the root of Bowtie thinking, or which came later but can be used to explain the type of thinking. So we do have some idea about what logically preceded the Bowtie.
As already mentioned, there are two things that the Bowtie does. First, the Bowtie analyses chains of events, or possible accident scenarios. The way it does that was inspired by three different methods. The first method is the fault tree which covers the left side of the Bowtie in a different form. Second, the event tree which can be seen on the right side of the Bowtie, but also in a different form than the original event tree. Lastly, causal factors charting, which is most likely the origin of Escalation factors. The following pages will be used to explain exactly what the differences are between the original methods and how the Bowtie uses them.
The second thing the Bowtie does is to identify control measures that an organisation has in place. This type of thinking is more easily explained with the famous Swiss Cheese model by James Reason, which originated in the early nineties.
Fault tree analysis
The fault tree method was created in 1962 and quickly became popular in the nuclear and aviation industry. A fault tree uses Boolean AND/OR gates to model causal relationships between events (the method is mostly used to model the causality of unwanted events, but it is possible to model any kind of causal relationship). The original fault tree was often quantified with failure probabilities, and calculate derived probabilities. The left side of the Bowtie diagram consists of a simplified Fault Tree.
Although the Boolean logic gates in Fault Tree Analysis allow the model to be filled with actual numbers about failure probabilities, and calculate derived probabilities, this information is seldom available due to the costs of testing and human influence on the system. To prevent the focus of the analysis to be diluted by this level of detail, the Bowtie method simplifies the fault trees by removing this possibility, leading to overall better readability of the analysis.
One of the most distinctive Bowtie method items is the Escalation Factor which is used to identify and demonstrate the weaknesses in Controls and hence the system as a whole. These potential failure modes are neglected in Fault Tree Analysis.
Fault trees paint a very detailed picture, which is a strength or a weakness depending on the goal and context of an analysis. If the goal is to exhaustively analyse all possible interactions between forces in an organisation, the fault tree will do that.
Positive:
- High level of detail
- Theoretically possible to quantify
Negative:
- Hard to communicate
- In practice hard to reliably quantify
Event tree analysis
The right side of a Bowtie diagram resembles an Event Tree. However the Bowtie method is not looking for probability or frequency information but rather aiming at how to make sure that the controls ARE working properly and asking the question: “Are we doing enough or should we implement more safety measures?”
The Bowtie method is most often used for the analysis Major Hazard Scenarios in which the consequence spectrum is so bad that the keeping control over these Hazards is of major importance, regardless of the actual probability of the consequences. Fortunately there is little accurate information available about the frequency of these worst-case-scenario consequences.
Causal factors charting
In the Bowtie method causality mapping (similar as in Causal Factors Charting) is found in the relationship between Threats and the Top Event and the Top Event and its Consequences. Another causal path in a Bowtie diagram is between a Control and its Escalation Factor(s). Causal Factors Charting is mainly used for the analysis of incidents whereas the Bowtie method is more appropriate for proactive risk analysis / process hazard analysis. The Bowtie method does not look at one causal factors chain but to all possible causal paths that are associated with a certain Hazard.
Control thinking
In 1990 psychologist James T. Reason proposed the Swiss Cheese metaphor as an accident causation model. Reason hypothesized that hazards are prevented from causing losses by a series of controls, known as controls in the bowtie method. He states that these controls however are never 100% effective. Each control has unintended (inconstant) weaknesses and when these so called ‘holes’ line up a hazard can be released. According to Reason the common causes of the weaknesses in controls can often be found in the organisation (latent failures). E.g. cost & time cutting on maintenance management can eventually lead to the deterioration of the integrity of many hardware controls within a system. In the Bowtie method these weaknesses are defined as Escalation Factors and are important features to fight the illusion of control that organisations sometime tend to have.