Changing a system without silently weakening its barriers

Identify which part of the risk argument changes

The CAA guidance on maintaining bow-tie models calls for revisiting threats, controls, escalation factors and consequences as conditions change. For a maritime engineering review, describe the proposed change in physical and functional terms before deciding which diagram boxes are affected. A changed part number is less informative than a changed response time, energy source or failure position.

The change can affect the threat, the barrier or the consequence model. Higher transfer flow increases the challenge; a slower final element changes response; a different material can change the consequence after release. Several may change together. Keeping the original threat frequency and consequence assumptions solely because the barrier name is unchanged can conceal the main effect.

Follow dependencies beyond the modified item

HSE’s plant-change guidance notes that effects can reach parts of the plant remote from the modification. In a generic ship example, an electrical change can alter several protective functions through common supply or distribution. A fluid-system change can alter pressure, temperature or available capacity at consumers beyond the replaced component.

Trace material, energy, signal and human-action interfaces. If two previously separate protective functions are connected to one new support, their drawing may still show two boxes while their dependency has changed. A barrier review should identify the shared failure path and reconsider any numerical independence credit. Component compliance alone does not demonstrate that the new arrangement preserves the original system argument.

Test the whole response against its deadline

Consider an invented protective chain with 7 s for sensing, 3 s for logic and 8 s until its final action completely stops the relevant inflow. Assume these intervals occur in series, and the defined physical deadline is 22 s after the initiating condition. The original total is 18 s, leaving a 4 s margin under those assumptions.

A replacement final element takes 14 s to achieve the same cessation. It might satisfy an isolated procurement requirement of no more than 20 s, yet the chain now takes 7 + 3 + 14 = 24 s and misses the system deadline by 2 s. The example demonstrates an interface mismatch. None of its numerical limits is a vessel operating requirement or an instruction to adjust protective settings.

Check changes to the consequence challenge

For a separate volume illustration using those times, assume constant inflow 0.020 m³/s until complete cessation at 18 s. The modelled incoming volume is 0.360 m³. Now suppose a proposed operating change increases that inflow by 20% to 0.024 m³/s while cessation takes 24 s. The corresponding volume is 0.576 m³, an increase of 60%, not merely 20%.

These values assume full constant inflow until the stated final stop; a gradual reduction within the same stop time cannot increase that bound. Additional downstream inventory, drainage, continuing sources and actual flow transients are excluded and would need separate treatment. The calculation shows how two modest changes can interact in one barrier-demand model. It does not calculate safe containment capacity or an acceptable spill.

Compare assumptions, not only documents

A useful before-and-after comparison identifies the original assumption, evidence, proposed change and resulting evidence need. If the assumption was adequate flow under a specified pressure difference, a replacement certificate at another test condition leaves a gap. If the assumption was a recognizable alarm cue, a changed display may affect the human part of the barrier even though its hardware still operates.

Document titles can remain the same while the underlying condition changes. Conversely, a drawing revision may be purely editorial and leave the physical argument intact. Evaluate the actual effect rather than treating all document changes as equal. Retain the technical rationale so that the scope of the review is understandable and the relevant evidence can be located later.

Model the temporary state explicitly

HSE’s organizational-change guidance distinguishes the intended end state from risks during the transition. The same distinction is useful when mapping barriers during a machinery change. Installation, testing and restoration can each have a different available set of protective functions from the final arrangement.

A temporary bypass, alternate connection or reduced staffing arrangement needs its own defined scope and duration within the applicable authorization process. The bow-tie should reflect which barrier assumptions remain valid during that state. Labelling the change temporary does not make its consequences smaller, and the eventual permanent improvement does not compensate automatically for a period in which a required function is absent.

Evaluate compensating measures by their actual function

A proposed additional watch or inspection may detect a developing condition, but it must have relevant cues, access, time and an effective response to influence the scenario. Its relationship to the impaired barrier matters. A person reading the same failed indication does not provide a distinct information path simply because the task is described as manual monitoring.

If a compensating measure depends on the same utility or inaccessible location as the impaired control, its benefit may be limited by the same cause. Describe its function and evidence as carefully as those of the original barrier. Do not assign a numerical risk-reduction factor from the label alone, and do not let the bow-tie itself serve as permission to operate in the temporary state.

Demonstrate restoration at the correct boundary

Restoration means reaching the intended configuration and demonstrating the required protective function, including interfaces affected by the work. Removing a temporary marker or closing a change record does not prove that a bypass has been removed, the correct logic reinstated or the delivered output recovered. The evidence should correspond to the actual changed path.

Where a test cannot cover the full service condition, identify its limitation and the complementary evidence. Record residual findings separately from completed work. A change can be physically installed while the assurance argument remains incomplete. Keeping those states distinct prevents administrative progress from silently becoming a claim that all protective assumptions are satisfied.

Update the risk model so the next change starts from reality

After the change is established, the bow-tie, dependency records, performance requirements, operating information and assurance tasks should tell a consistent story. Retain the previous rationale and the reasons for revisions rather than overwriting the history with a new green status. The next assessment needs to know which assumptions changed and what evidence supports the present arrangement.

The contribution of a bow-tie to change review is traceability: from the proposed physical or operational difference to the threat, barrier, dependency and consequence it can affect. It complements the appropriate engineering and management processes. Its quality is demonstrated by the important interactions it makes visible, including temporary-state limits, rather than by the number of approvals attached to a diagram.

Sources

• Reviewing and maintaining BowTie models · UK CAA · Source check date: 2026-10-07
• Plant modification / Change procedures · UK HSE · Source check date: 2026-10-07
• Organisational change · UK HSE · Source check date: 2026-10-07