The bowtie model consists of different elements that build up the safety risk picture. The safety risk picture revolves around the hazard (something in, around or part of an organisation or activity which has the potential to cause damage or harm) and the top event (the release or loss of control over a hazard known as the undesired system state).
Consideration is then turned to the threats (a possible direct cause for the top event), consequences (results of the top event directly ending in loss or damage) and the controls (any measure taken which acts against some undesirable force or intention).
The controls can be populated on either side of the model showing:
| Left hand side of the model | Right hand side of the model |
|---|---|
|
Preventative measures which eliminate the threat entirely or prevent the threat from causing the top event recovery |
Measures which reduce the likelihood of the consequence owing to the top event being "live" or mitigate the severity of the consequence |
The bowtie model explores the escalation factors (the reasoning to why a control may be defeated or less effective) of all controls allowing the allocation of escalation factor controls. These prevent the escalation factors having an impact on the prevention or recovery controls. Further attributes, such as control effectiveness or criticality can be allocated to the bowtie model to evaluate the safety risk picture as part of an effective SMS.
A further explanation is provided by CGE Solutions.
An everyday example bowtie is shown below to demonstrate this explanation. Further guidance is provided in the next chapter called on “the bowtie elements”.
Provide page feedback
Please enter your comments below, or use our usual service contacts if a specific matter requires an answer.
Fields marked with an asterisk (*) are required.