Industrial risk rarely follows a single, straightforward path. A hazardous material or source of energy may be present for years without an incident. What matters is how control could be lost and whether the safeguards can prevent or limit the resulting harm.
Bow-Tie Analysis connects hazards, threats, a top event, consequences, and safety barriers in one visual model. It helps HSE managers, engineers, and operations teams understand where protection exists and where weaknesses need attention.
What Is Bow-Tie Analysis?
Bow-Tie Analysis is a structured risk assessment and communication method that maps how threats can lead to loss of control over a hazard and how that loss of control could develop into harmful consequences.
The diagram resembles a bow tie: threats and preventive barriers appear on the left, the top event sits at the centre, and mitigative barriers and consequences appear on the right.
It answers five practical questions:
- What hazard are we managing?
- What could cause control over that hazard to be lost?
- Which barriers can prevent that loss of control?
- What could happen if prevention fails?
- Which barriers can prevent escalation or reduce harm?
Within a wider process safety program, this approach helps connect detailed engineering findings with operational decisions.
Understanding the Complete Bow-Tie Risk Pathway
1. Hazard: What Has the Potential to Cause Harm?
The hazard is the source or condition with the potential to cause harm, such as flammable material under pressure, toxic chemicals or hazardous mechanical energy. Its presence does not mean an incident has occurred; the objective is to maintain control over it.
2. Threats: What Could Cause Loss of Control?
A threat is a credible direct cause of the top event. For a containment scenario, threats might include corrosion, excessive pressure or incorrect operation. Each threat should describe a specific pathway rather than a vague label such as “equipment problems”.
3. Preventive Barriers: What Stops the Top Event?
Preventive barriers interrupt the pathway between a threat and the top event. Their suitability depends on the scenario and the function they must perform.
A pressure-protection function, for example, may act against an overpressure threat. An alarm requires a defined, feasible response to provide protection. Inspection and maintenance often support barrier performance rather than acting as separate barriers themselves.
4. Top Event: Where Is Control Lost?
The top event is the point where control over the hazard is lost. For a system containing flammable material, this could be loss of containment. It is distinct from later consequences such as fire damage or injury.
5. Mitigative Barriers: What Limits Escalation?
Mitigative barriers act after the top event. They can reduce the likelihood of a particular consequence or limit its severity. Depending on the scenario, examples may include release detection linked to isolation, fire protection or evacuation arrangements.
Where personnel protection depends on escape routes, muster areas or rescue arrangements, escape, evacuation & rescue analysis (EERA) can support a more detailed assessment of those arrangements.
6. Consequences: What Could Happen Next?
Consequences are the harmful outcomes that could follow the top event, including injury, equipment damage, environmental harm and operational disruption. Separate consequence pathways help teams identify which safeguards address each outcome.
A Simple Bow-Tie Analysis Example
Consider a pipe carrying a pressurised flammable liquid. The table below is an illustrative scenario, not an Aura Safety project case study or a complete engineering design.
| Element | Illustrative example |
| Hazard | Pressurised flammable liquid within the pipe. |
| Threat | Internal corrosion reduces the pipe wall thickness. |
| Preventive barrier | An effective corrosion-control measure appropriate to the service, supported by inspection and corrective action. |
| Top event | Loss of containment from the pipe. |
| Mitigative barrier | Release detection linked to effective isolation to limit the released inventory. |
| Consequence | A release that ignites and causes injury, equipment damage or shutdown. |
| Escalation factor | Loss of the power supply needed by the detection-and-isolation function. |
| Escalation-factor control | A suitable backup supply with checks to confirm its availability, where required by the design. |
A full study would examine additional threats and consequences separately. Each proposed safeguard must be checked against actual operating conditions, equipment design and the time available for it to act.
Barrier Effectiveness: The Question Behind the Diagram
A barrier label does not establish that the safeguard works. For each important barrier, the team should ask:
- Function: What exactly must it prevent or mitigate?
- Performance: Can it act effectively within the required time?
- Dependencies: Does it share power, sensors, utilities or people with another barrier?
- Assurance: What inspection, testing or operating evidence confirms its condition?
- Ownership: Who is responsible for maintaining it and addressing impairment?
Two controls should not automatically be treated as independent protection if one shared failure can defeat both. Likewise, a procedure should identify the action, responsible person and conditions needed for successful execution.
What Are Escalation Factors in Bow-Tie Analysis?
Escalation factors are conditions that weaken or defeat a particular barrier. They explain why protection could become ineffective, rather than simply repeating that the barrier might fail.
For example, detector contamination could impair release detection. An appropriate inspection and cleaning activity may help manage that degradation mechanism.
The distinction is practical: a threat can directly cause the top event, while an escalation factor undermines a barrier on a defined pathway. Escalation-factor controls should address the specific weakness identified.
Bow-Tie Analysis vs. HAZOP, HIRA, and QRA
These methods address different questions and can complement one another.
| Method | Primary focus | Typical output |
| HAZOP | Process deviations, their causes, and consequences. | Study worksheets recording safeguards and recommendations. |
| HIRA | Hazard identification and assessment of associated risks. | Hazard register, risk evaluation, and control actions. |
| QRA | Numerical evaluation of risk using scenario frequencies and consequences. | Quantified risk estimates and risk profiles. |
| Bow-Tie Analysis | Threat-to-consequence pathways and the barriers acting on them. | Scenario diagrams with barrier information and identified weaknesses. |
A HAZOP study can provide process scenarios for further barrier analysis.
Similarly, hazard identification & risk assessment (HIRA) can help establish which hazards need closer examination.
Where a decision requires numerical risk estimates, quantitative risk assessment (QRA) provides a different level of evaluation. A qualitative bow-tie diagram alone does not establish numerical risk reduction or demonstrate that risk is acceptable.
How to Develop a Bow-Tie Analysis
- Define the scope and hazard. Set the equipment, activity and operating boundaries.
- Define the top event. Identify a clear loss-of-control event.
- Identify credible threats. Use available study findings, operating knowledge and incident learning.
- Map preventive barriers. Explain how each control interrupts its threat pathway.
- Identify consequences. Separate the credible harmful outcomes.
- Map mitigative barriers. Show how each safeguard prevents escalation or reduces harm.
- Review weaknesses and dependencies. Identify escalation factors and suitable controls.
- Assign ownership and actions. Record responsibilities, unresolved gaps and follow-up requirements.
Engineering, operations, maintenance and HSE personnel should contribute the knowledge relevant to the scenario. The result should represent actual conditions, with proposed improvements clearly distinguished from existing safeguards.
Why Bow-Tie Analysis Helps Business Decision-Makers
A bow-tie diagram gives different teams a shared view of a specific risk. Operations personnel can see which controls must remain available; maintenance teams can understand why particular equipment matters; and managers can review weaknesses requiring resources or action.
This supports communication without removing the need for the detailed engineering evidence behind the diagram.
Common Bow-Tie Analysis Mistakes
- Confusing the hazard, top event and final consequence.
- Listing vague controls without explaining how they interrupt a pathway.
- Counting supporting activities as independent barriers without justification.
- Overlooking shared dependencies or credible barrier degradation.
- Showing proposed safeguards as though they already exist.
- Creating diagrams too complicated for the intended audience.
- Failing to review the analysis after relevant operational changes.
Bow-Tie Analysis and the Barrier Management Lifecycle
The value continues after the workshop. Barrier information can inform testing, inspection, maintenance, training and the management of operational changes.
Review the analysis when changes to equipment, materials, procedures or staffing affect the scenario. Incidents, near misses and evidence of barrier impairment can also reveal a need to update the model.
The objective is to keep the risk picture aligned with how the facility operates.
When Should an Organization Consider Bow-Tie Analysis?
Bow-Tie Analysis can help when a significant hazard has several initiating threats or consequence pathways, when teams need clearer communication of study findings, or when barrier weaknesses require a coordinated review.
It is particularly useful for asking whether safeguards have a defined purpose, an accountable owner and evidence of continued effectiveness. The study scope should reflect the significance and complexity of the scenario.
Bow-Tie Analysis Support from Aura Safety
Aura Safety offers Bow-Tie Analysis as part of its process-safety services.
Mapping the connections between threats, loss of control and consequences can help your team identify where safeguards need closer examination.
Planning a study or reviewing an existing risk scenario? Contact us to discuss the required scope with Aura Safety & Risk Consultants.
Frequently Asked Questions
The main elements are the hazard, threats, preventive barriers, top event, mitigative barriers and consequences. Escalation factors and their controls add detail about barrier vulnerabilities.
A hazard has the potential to cause harm. The top event is the loss of control over that hazard. Flammable material in a pipe is a hazard; its loss of containment is a possible top event.
Preventive barriers act before the top event to stop it occurring. Mitigative barriers act afterwards to reduce the likelihood or severity of particular consequences.
No. HAZOP examines process deviations systematically. Bow-Tie Analysis maps selected scenarios and their barriers. Findings from one method can inform the other.
A basic qualitative diagram does not calculate incident frequency or numerical risk reduction. Quantification requires additional data, assumptions and an appropriate analytical method.
Review it when relevant changes or new evidence affect the hazard, threats, consequences or safeguards, and as part of the organisation’s established review arrangements.
