Knowledge / Risk analysis methods

Bow-tie degradation factors: how barriers lose their intended function

Distinguish a threat from a factor that weakens a specific barrier, connect it to an observable failure mechanism, and avoid double credit for supporting controls.

On this page

A barrier can exist on a diagram while no longer delivering the function the diagram assumes. Its sensor may be obstructed, its power unavailable, its physical capacity reduced or its human response delayed. A bow-tie degradation factor explains how a particular barrier can lose effectiveness. The useful detail is the connection between that factor, the barrier’s required performance and the evidence that would reveal the change.

Start with the barrier function

The UK CAA bow-tie explanation describes escalation factors as conditions that can defeat or weaken a control. The terminology is used here as a general risk-modelling aid, not as aviation requirements applied to ships. Identify the barrier first: what does it prevent or mitigate, where does it act and what result must it produce?

For a generic liquid-transfer scenario, high-level detection with a timely response may protect against overfilling. A separate retaining boundary may limit consequences after loss of containment. The first is not simply a sensor and the second is not simply a painted line. Their actual functions include the necessary sensing, decision, action or physical capacity. Degradation must be tied to those functions.

Distinguish threat, top event and degradation

A threat is a cause that can drive the selected hazard towards its loss-of-control event. A degradation factor weakens a named barrier on that path. If excessive inflow challenges a tank, it can be a threat; a blocked sensing connection can degrade a level-based protective function. Calling both sensor failure and overfill threats without defining the top event can mix different causal levels.

Classification is relative to the model boundary. Loss of electrical power may be a direct threat in a loss-of-propulsion bow-tie and a degradation factor for a powered protective function in another bow-tie. That is not inherently inconsistent. The record should explain the role in each model and preserve the shared physical event when several models are compared.

Use a mechanism, not a generic label

The CAA template guidance cautions against repeating generic escalation factors on every control without identifying specific concerns. For a machinery example, poor maintenance is too broad to explain whether a detector is unavailable, an actuator sticks or the response is delayed. Identify the physical or informational change and the performance quantity it affects.

A useful statement might connect contamination in a sample path to reduced sample flow and delayed arrival at a detector. Another might connect accumulated material inside a retaining space to loss of usable capacity. The causal statement creates a testable question: is the transport delay still within the intended response window, or is the required free capacity actually present? An administrative label alone cannot answer either.

Trace a timing margin through the complete chain

Use an invented response model with three strictly sequential intervals: 20 s until a usable indication, 30 s for the defined decision and 40 s for the final action to become effective. The total is 90 s. If the physical model requires effective action by 100 s, the calculated margin is 10 s. The inputs are examples, not an alarm-response target or crew performance estimate.

If the final action now takes 55 s under the same scenario, total time becomes 105 s and the model misses the deadline by 5 s. Looking only at an indication that still appears after 20 s would miss the degradation. Conversely, if intervals genuinely overlap, the serial sum is not the correct timing model. The bow-tie should point to a timing analysis with justified relationships rather than turn every duration into an independent box.

Separate a degraded state from its average probability

A simple probability illustration can show why occasional severe degradation matters. Suppose, only for this model, the barrier is in its normal state on 90% of comparable demands with failure probability 0.020, and in a degraded state on 10% with failure probability 0.50. Overall failure probability is 0.90 × 0.020 + 0.10 × 0.50 = 0.068.

The degraded state contributes 0.050 of the 0.068 total despite representing only one tenth of the demands. If the barrier is known to be degraded on the current scenario, using the population average 0.068 would be inappropriate; the relevant assumed conditional value is 0.50. A bow-tie colour or inspection completion percentage does not supply those probabilities. They require a separate justified quantitative model if numerical credit is sought.

Invented normal and degraded states occur on 90% and 10% of comparable demands, with conditional failure probabilities.02 and.5. Their failure contributions are.018 and.05, totaling.068. Degraded demands contribute 73.5% of failure mass despite only 10% of demand mass.
Original conditional-mixture diagram. Each stacked bar is independently normalized to its own total: all demands above, all modeled failures below. Equal overall bar lengths do not imply equal probabilities. States are mutually exclusive and exhaustive, with weights referring to comparable demands rather than calendar time. Values are invented, not bow-tie-derived credits. For a known degraded state the conditional .50 applies within this model; substituting the population average .068 answers a different question.

Describe what the degradation control actually does

A control directed at a degradation factor may detect the loss of capability, prevent its development or restore the barrier. Those are different functions. An inspection that finds a blocked line does not by itself clear the line, and a repair record does not by itself establish restored end-to-end response. State the action that follows the finding and the evidence needed to show the intended state.

The support control should not automatically be counted as a second independent protection layer against the original threat. If its only role is to keep the first barrier effective, the two functions are linked. Counting the barrier once at a favourable availability and then multiplying by a separate inspection success can duplicate the same maintenance benefit. The logical relationship should be explicit before quantification.

Look for factors that weaken several barriers

HSE’s control-systems discussion addresses external influences, support and independence of protective equipment. In a generic ship scenario, one environmental condition can affect several controls: heat can challenge nearby cables, loss of a utility can remove several powered functions, and one incorrect configuration can affect more than one channel. Separate diagram boxes do not establish separation of their vulnerabilities.

A degradation-factor register can record every affected barrier rather than repeat unrelated copies of the same cause. This helps identify whether a proposed action restores all affected functions or only one. It also reveals when the monitoring arrangement depends on the utility it is meant to monitor. A healthy-looking display is weak evidence if the path reporting failure can itself disappear silently.

Choose evidence that challenges the mechanism

Evidence should address the causal chain. For a response-time concern, a relevant end-to-end test may provide information that a component self-test cannot. For usable retention volume, actual configuration and accumulated contents matter more than an original geometric drawing alone. For human action, available cues, workload and access matter more than attendance at a training session.

A test also has a scope and date. It may establish performance only at one load, one configuration or one environmental condition. Record what was not challenged, and identify which subsequent changes could invalidate the result. Evidence freshness is therefore linked to the mechanism and configuration, not merely to whether a document remains within an administrative review interval.

Close the loop from finding to demonstrated capability

A meaningful degradation record connects the affected barrier, failure mechanism, observed condition, consequence for performance, responsible action and restoration evidence. If the condition remains unresolved, its effect on the assumed barrier capability should remain visible. Changing a dashboard status without changing or demonstrating the physical function does not repair the barrier.

The method is most useful when it directs attention to specific weaknesses that can be investigated. It should avoid a growing catalogue of generic labels with no observable test. The quality of the bow-tie lies in the traceable connection between hazard control and working capability, including the limits of the evidence, rather than in the number of controls drawn around each barrier.

Sources