Ataytis Assurance · Bow-Tie Risk Analysis
Bow-tie validation
The rules a bow-tie is checked against and their severity, the messages they produce and how to fix them, advisories, and what an unfinished bow-tie reports.
Rules
| Rule | Severity |
|---|---|
| Exactly one top event | Error |
| One top event name in a register | Error |
| Every threat path reaches the top event | Error |
| Every consequence path starts from the top event | Error |
| Preventive barriers on the threat side, mitigative barriers on the consequence side | Error |
| Threats on the threat side, consequences on the consequence side | Error |
| Every node is connected to the bow-tie | Error |
| Escalation factors connect to a barrier, and controls to a factor | Error |
| No cycles | Error |
| One hazard, connected to the top event | Warning |
| At least one threat and one consequence | Warning |
| Every threat, and the top event, leads somewhere | Warning |
| A barrier on every threat and consequence path | Warning |
| Every escalation factor has a control | Warning |
| Node and relationship types are recognised | Warning |
None of these stops the bow-tie drawing, so the problem can be seen on the diagram.
Messages and fixes
| Message | Fix |
|---|---|
| Top Event is missing. | Add a row with Node Type Top Event. |
| Top Event occurs 2 times. | Keep one top event per bow-tie. Put separate bow-ties under separate Diagram IDs. |
| This register names 2 top events (Loss of containment, Structural failure). A bow-tie has one. Add a Diagram ID column so each is its own diagram; only "Loss of containment" is drawn. | Give each bow-tie its own Diagram ID, or correct the wording so every row names the same top event. |
| This threat never reaches the top event. Every threat path must run through its preventive barriers to the centre. | Check Connected Node ID along the threat's path. If every threat shows this, the table names the previous node: change Reads as on the Data Mapping tab. |
| This consequence is not reached from the top event. Every consequence path must run out through its recovery barriers. | Check the rows from the top event to the consequence. |
| A threat cannot sit on the recovery side of the top event. | The connections run the wrong way, or the node type is wrong. The same message is shown for a consequence on the prevention side. |
| This barrier sits on the threat side, so it should be a preventive barrier. | Correct the Node Type, or the connections. Writing Barrier lets the visual choose the side. |
| This threat is not connected to the bow-tie. | Connect the node to a path. The message names the node's type. |
| A relationship references "TE ", but the node is stored as "TE". They differ only by spaces — trim the identifier column in Power Query. | Trim Node ID and Connected Node ID. A mismatch that is not only spaces shows A relationship references a node that is not present. |
| An escalation factor must degrade a barrier. Connect it to one with an Escalates relationship. | Set the factor's Connected Node ID to the barrier it weakens. |
| This escalation control does not address any escalation factor. | Set the control's Connected Node ID to its factor. |
| This escalation factor has no control. Barrier degradation is unmanaged unless that is deliberate. | Add a control, or leave the warning if the factor has none. |
| This hazard is not connected to the top event. A bow-tie describes one hazard losing control. | Set the hazard's Connected Node ID to the top event. |
| Hazard is missing. | Add a Hazard row. A register cannot hold one, so there the warning stays. |
| Hazard occurs 2 times. | Keep one hazard per bow-tie. |
| Consequence is missing. | Add the consequences, or leave the warning while the analysis is unfinished. |
| A node does not have the expected number of relationships. | A threat, or the top event, leads nowhere. Give it a Connected Node ID. |
| This threat reaches the top event with no preventive barrier in the way, so nothing on the diagram stops it. Add the barriers that control it, or record that there are none. | Add the barriers. If there are none, the warning is the finding. |
| Nothing stands between the top event and this consequence, so no mitigative barrier limits it. Add the barriers that reduce it, or record that there are none. | Add the barriers. If there are none, the warning is the finding. |
| "Safety barrier" is not a recognised node type. Map it to one under Data Mapping, or the rows using it stay unrecognised. | Map the value under Node type values on the Data Mapping tab. |
| A node is described by rows that disagree about Health, Status; the first row's values are shown. | In a register this is expected on the top event. In an edge list, make the node's rows agree, or slice the table to one snapshot. |
| The diagram contains 4 disconnected components. | Some nodes are not joined to the rest, usually because of an identifier that does not match. |
Names and numbers in these messages come from your data, so yours will differ.
Advisories
| Advisory | Severity | Raised when |
|---|---|---|
| 1 barrier(s) carry no status or health value, so their condition cannot be read from the diagram. | Information | A barrier has neither Status nor Health. |
| Two or more threat lanes share an Order value, so their top-to-bottom position is not deterministic. | Warning | Two threats, or two consequences, have the same Order. In a register, two paths on one side start from the same Order. |
Turn advisories off by setting Diagram → Validation → Advisory diagnostics to Hide advisories. The rules above are still checked.
An unfinished bow-tie
A bow-tie with threats and barriers but no consequences yet draws with no errors. It shows Consequence is missing. and, for the top event, A node does not have the expected number of relationships. Both clear once the first consequence path is added.