The Operations BowTie: Why the Explosion Is the Consequence, Not the Top Event

Most Ex BowTies put the explosion at the centre. This one does not. The top event is the plant being operated outside its demonstrated Ex-safe condition, which makes the explosion one possible consequence rather than the starting point. The article works through preventive and mitigating barriers, then focuses on blocking elements, the reasons a barrier can exist on paper and still be useless, such as a 35% inspection backlog or 400 unprioritised findings. It closes on the Point of Intervention: the moment where Operations can still break the chain, and the five controlled outcomes available at that moment.

Infographic depicting a bow-tie risk analysis: preventive measures and possible consequences around a central hazard source, with an industrial plant and a professional in the background.

BowTie - Head of Operations / Ex Compliance
HAZARD: Operation of a plant containing potentially explosive atmospheres and ignition-capable equipment.

TOP EVENT:
The plant is operated outside its demonstrated / documented Ex-safe condition.

The explosion is then one possible consequence - not the top event.
Head of Operations’ critical responsibility

The Head of Operations does not necessarily perform all these technical activities. But Operations must ensure that the barriers exist, are assigned, remain effective and are acted upon.

Note:
- Engineering may design the barrier.
- Inspection may verify it.
- Maintenance may restore it.
- Ex specialists may assess it.
But Operations controls whether the plant continues operating when a barrier is degraded.

The right side of the BowTie
Once the plant has moved outside its demonstrated Ex-safe condition:

TOP EVENT → potential consequences
→ Uncontrolled ignition source → Explosive atmosphere + ignition source coincidence → Fire / explosion → Injury or fatality → Equipment / plant damage → Production shutdown → Regulatory action → Loss of ATEX/Ex compliance evidence → Business/reputational consequences

The mitigating barriers then become:
Detect → Restrict → Escalate → Make safe → STOP → Correct → Verify → Return to service

Examples include gas/dust detection, isolation, shutdown systems, emergency response, temporary operational restrictions, competent Ex assessment and verification before restart. 
The very interesting part:
blocking elements - the BowTie becomes here particularly powerful for the Head of Operations: A barrier can exist on paper and still be practically useless.

For example:

Barrier: Periodic Ex inspection Blocking element: 35% inspection backlog 
Operational question: Who knows this, who accepted it, and on what basis does operation continue?

Barrier: MoC Blocking element: Operations considers equipment replacement “like-for-like” without verification.
Barrier: Competent personnel Blocking element: Only one Ex specialist understands the plant and is unavailable.

Barrier: EPD/HAC Blocking element: The document describes the original design, while the plant has been modified repeatedly.

Barrier: Finding management Blocking element: 400 open findings with no technically justified prioritisation.

That leads to a very strong Head of Operations BowTie principle:

The responsibility is not simply to have barriers. 
It is to know when those barriers are degraded - and decide whether operation may continue.

And this fits perfectly with the EPD ownership message: the system should make barrier status, blocking elements, open findings, changes, competence and operational decisions visible and traceable throughout the plant lifecycle.

A detailed bow-tie assessment diagram for Ex compliance, mapping threats, preventive and mitigating barriers, and potential consequences around a central top event.

Threats are situations that can push the plant toward the Top Event:

TOP EVENT: Plant operated outside its demonstrated/documented Ex-safe condition.
For each threat, I would define an operational outcome and POI - Point of Intervention.

The POI is particularly important because it identifies where the Head of Operations still has an opportunity - and responsibility - to prevent progression toward the Top Event.

See pics in the comment section

There is an important pattern here
Almost every threat has a moment where Operations can still break the chain:
Threat arises → POI → operational decision → barrier/action → safe condition maintained
versus:
Threat arises → missed POI → degradation accepted/unknown → TOP EVENT
That gives us something stronger than a normal BowTie.

The POI is the moment when operational responsibility becomes active.

For example:

Process change Different solvent introduced → POI → Does this affect HAC/inerting/temperature class/material compatibility? → MoC/engineering review → safe operation.

Ex finding Damaged Ex d gland identified → POI → Can this equipment remain energized? → assessment/mitigation/STOP → corrective action.

Missing documentation Certificate/X conditions unavailable → POI → Can suitability actually be demonstrated? → retrieve/verify/escalate → only then accept continued operation.

Operations needs five possible controlled outcomes:
CONTINUE - demonstrated Ex-safe condition remains intact.
CONTINUE WITH CONTROLS - temporary measures are defined, justified, owned and time-limited.
RESTRICT - limit process, equipment, area, activity or operating envelope.
ESCALATE / VERIFY - competent engineering/Ex assessment is required before the decision can be closed.
STOP / ISOLATE - Ex-safe operation cannot be demonstrated or an unacceptable ignition risk exists.

This makes the management logic very clear:
The Head of Operations does not need to personally solve every Ex problem.
But Operations must recognize the Point of Intervention and ensure that the plant does not simply continue through it without a controlled decision.

The Operations BowTie: Why the Explosion Is the Consequence, Not the Top Event

Topic