Bowtie diagram

The diagram takes its name from its shape: threat lines fan in from the left, consequence lines fan out to the right, and the knot in the middle is the top event — the moment control of the hazard is lost. Between each threat and the top event sit the preventive barriers that stop the event happening; between the top event and each consequence sit the recovery barriers that limit the damage when it does.

The format was popularised in the oil and gas industry after the Piper Alpha disaster, when operators needed a way to show — not just assert — that every major-accident hazard had a credible set of controls. It has since spread to aviation safety management, healthcare, cyber security, reliability engineering, and workplace health and safety, because the shape works for any risk where prevention and mitigation both matter.

A bowtie is deliberately qualitative. It does not calculate a probability; it makes the control picture legible enough that engineers, operators, auditors, and executives can all read the same page and ask the same question: which of these barriers actually works, and how would we know? That question leads directly to barrier effectiveness, degradation factors, and performance standards.

For a worked picture of all of this on a real scenario, open the process safety bowtie example — five threats, five consequences, and thirty-two controls around a loss of containment of flammable hydrocarbon.