63 templates
Risk & Reliability diagram templates
Fault trees, bowties, reliability blocks, barriers, failure analysis.
DFD — Patient Portal (PHI)
Level-1 flow of a patient portal across public internet, a portal DMZ and the clinical PHI network, balancing 14 nodes against 17 flows and listing all 10 boundary crossings as the attack surface.
Data flow diagramDFD — Card Authorisation (PCI DSS)
Level-2 decomposition of card capture, tokenisation, authorisation and settlement, with the PCI cardholder data environment drawn as a trust zone so the 9 flows that enter or leave CDE scope are enumerated.
Data flow diagramDFD — Housing Benefit Claim
A citizen benefit claim from identity verification to Bacs payment across four trust zones, counting the 8 crossings between citizen internet, the public digital service, cross-government APIs and restricted case working.
Data flow diagramRBD — Fly-by-Wire Pitch Channel
Triplex air data, duplex flight control computers and two independent hydraulic-plus-actuator lanes over a year of utilisation, ranking which redundancy actually moves the loss-of-pitch-control number.
Reliability block diagramRBD — Hospital Medical Oxygen Supply
HTM 02-01 style piped oxygen supply with a warm-standby chain from VIE to reserve vessel to emergency cylinder manifold, plus duplicated alarm panels, computing annual supply reliability.
Reliability block diagramRBD — Autonomous Vehicle Perception Chain
Five hundred operating hours of an AV safety chain: redundant supplies, a 2-of-3 sensor vote in which the camera slot is itself a pair, hot-standby perception compute and dual brake actuation.
Reliability block diagramGRAFCET — Lift Car Door Interlock
The safety sequence a lift door cannot be certified without: dwell, close, and the alternative divergence on the closing step that sends a photo-eye or door-edge trip to a re-open step and back to the dwell timer, so the interlock is only made when the closed limit and the lock both prove.
GRAFCET / SFCGRAFCET — Signalised T-Junction Stages
The stage sequence of a signal-controlled T-junction, with the intergreen made a step of its own so the all-red is a state rather than a delay, an alternative divergence that serves the pedestrian phase only on demand, and a lamp-fault branch that drops the junction to fail-safe flashing amber.
GRAFCET / SFCLadder - Two-Hand Press Anti-Tie-Down
Five rungs of two-hand control where both buttons are made inside the 500 ms concurrency window (a TP pulse at 180 ms) and the ram is correctly permitted on rung 4 -- then a maintenance mute rung writes Ram_Solenoid a second time and silently overrides it, the duplicate destination flagged alongside a light-curtain tag examined by a contact that nothing in the program writes.
Ladder logic (PLC)Bowtie — LPG Storage Loss of Containment
COMAH-style bowtie for a 68-tonne LPG bullet: 0.43 loss-of-containment opportunities a year cut to a 0.0231/yr top event, ranking the independent high-level fill trip as the most critical barrier on site and flagging its proof-test bypass as an unmanaged escalation factor.
Bowtie riskBowtie — Wrong-Dose Medication on an Acute Ward
Ward-level bowtie for injectable medicines: 60 dosing errors a year reduced to 5.04 wrong doses reaching a patient, ranking the bedside barcode scan twice as critical as the smart-pump drug library and leaving 97.9% of the inherent harm removed.
Bowtie riskBowtie — Dropped Object from a Drilling Derrick
Offshore DROPS bowtie for tools and tubulars handled 30 m above the drill floor, turning 3.65 release opportunities a year into 0.353/yr of falling objects and ranking the tool-tethering policy above every inspection regime on the rig.
Bowtie riskBowtie — Fall from Height on Steel Erection
Construction bowtie for operatives working 12 m above ground on open steel: 4.3 exposures a year reduced to 0.49 falls, ranking the PASMA-trained tower assembler above the safety netting and flagging its green handover tag as uncontrolled.
Bowtie riskFault Tree — Reactor Decay Heat Removal
Loss of decay heat removal after a reactor trip: two redundant paths, a two-of-three auxiliary feedwater vote and an INHIBIT gate for the fouled service-water strainer, quantified over a one-year mission.
Fault tree (FTA)Fault Tree — Triple Hydraulic Loss
Total hydraulic power loss on a three-system narrowbody over a five-hour leg, where a single common-cause fluid contamination event sits in all three branches and dominates a picture that looks fully redundant.
Fault tree (FTA)Fault Tree — Piped Medical Oxygen
Loss of ward oxygen at an acute hospital: bulk evaporator and emergency manifold in parallel, with the manifold gated by an INHIBIT on unreplaced reserve cylinders, plus three pipeline faults that bypass the redundancy entirely.
Fault tree (FTA)Fault Tree — Total Loss of Vehicle Braking
Dual diagonal hydraulic circuits backed by an electric park brake over 300 driving hours, showing how the shared master cylinder and reservoir turn two independent-looking circuits into one, and the 12 V supply into a common mode.
Fault tree (FTA)Fault Tree — Blowout Preventer on Demand
Subsea BOP failing to seal a well over one section, with the blue and yellow control pods feeding BOTH the shear rams and the annular preventer — a shared gate drawn once and transferred, and the reason the two seals are not independent.
Fault tree (FTA)Decision Tree — Overhaul, Monitor or Run to Failure (Risk-Averse)
A maintenance strategy for a critical pump, minimising 12-month cost with a risk tolerance of $400k: condition monitoring has the lowest expected cost ($81.0k) but its tail of unplanned trips gives it a certainty equivalent of $94.7k, so the risk-averse choice is the planned overhaul (CE $87.6k). Illustrative values.
Decision treeDecision Tree — Buy Flood Cover? (Risk Tolerance)
Why firms insure against negative expected value: going uninsured has the best expected outcome (−$35.4k) but, with a risk tolerance of $250k, a certainty equivalent of −$186.8k, so the risk-averse choice is the high-excess policy (CE −$40.4k) — the switch the tree states outright. Illustrative values.
Decision treeRisk Matrix — Hospital Ward Patient Safety Register (5×5)
A patient safety register for a fictional elderly-care ward on the familiar NHS 5×5 consequence × likelihood matrix with Low, Moderate, High and Extreme bands: controls reduce exposure from 92 to 56 (−39%), and deterioration (10), falls (9), night staffing (9) and insulin errors (8) remain High, above the Moderate appetite, each with an improvement action. Illustrative register.
Risk matrixRisk Matrix — Airline Safety Risk Register (ICAO Tolerability Matrix)
A hazard log for a fictional ATR 72 operator rated on the ICAO Doc 9859 tolerability matrix — cell by cell, not by L×I, with 4B-style risk indices: mitigations bring the two Intolerable hazards, an unstable approach (4B) and wing contamination (3A), down to Tolerable, leaving all eight hazards within the Tolerable appetite. Illustrative register.
Risk matrixRisk Matrix — Offshore Wind Farm Construction and O&M Register
An owner's register for a fictional 1.2 GW offshore wind farm spanning grid, cables, installation, turbines and consents: controls cut exposure from 94 to 51 (−46%), and a delayed grid connection stays High 12 above the Medium appetite, with an interim 400 MW connection offer as the treatment. Illustrative register.
Risk matrixRoadmap — Zero Trust and ISO/IEC 27001 Certification
A security roadmap for a fictional insurer moving to zero trust and certifying to ISO/IEC 27001:2022 within the year, with the Stage 1 and Stage 2 audits as milestones: 15 items (5 done, 3 in progress, 6 planned, 1 at risk) and 2 milestones across five lanes, status date 7 Jul 2027. All 14 dependencies finish before their dependents start — the internal audit and the 93-control Statement of Applicability before Stage 1 — and the longest chain runs from the risk assessment to closing audit nonconformities. Illustrative roadmap.
RoadmapCFD — Vulnerability Remediation Queue
Twelve fortnights of high and critical CVEs from scanner detection to verified closure, where every band widens and the remediation WIP limit of 120 is breached from the third fortnight onwards.
Flow metrics (CFD)DFD — Outsourced Payroll Bureau
Level-1 model of a bureau running payroll for client employers, drawing the bureau processing zone, HMRC's gateway and the BACS submission path as separate trust zones around special-category pay data.
Data flow diagramFault Tree — Metro Signalling Loss
Loss of movement authority on a CBTC metro line over a year, where a shared trackside radio segment sits inside both the primary and the fallback branch and is the tree's only single-point failure.
Fault tree (FTA)Fault Tree — Vaccine Cold Chain Excursion
Temperature excursion of a pharmacy vaccine fridge over a year, gating the alarm-response branch by an INHIBIT on out-of-hours cover and exposing the door-ajar cut set that no compressor redundancy touches.
Fault tree (FTA)Fault Tree — Offshore Turbine Unavailability
Loss of export from a single offshore wind turbine over a year, combining drivetrain and converter faults with an array cable branch and a two-of-three pitch system vote that keeps the rotor controllable.
Fault tree (FTA)Bowtie — Signal Passed at Danger
Barrier-based analysis of a SPAD on a suburban route, ranking the route conductor and the two TPWS installations as the most critical barriers and leaving 98.9% of the inherent risk removed.
Bowtie riskBowtie — Ransomware on a Hospital Network
Flat-dialect bowtie for encryption of clinical systems at an acute trust, where credential stuffing rather than phishing drives 64% of the top event and conditional access ranks as the most critical barrier.
Bowtie riskBowtie — Undeclared Allergen in a Ready Meal
Food safety bowtie for undeclared allergen reaching a retail ready meal, ranking barcode reconciliation at the packing line as the one barrier whose removal multiplies residual risk almost fourfold.
Bowtie riskRBD — Radiotherapy Treatment Chain
One year of a linear accelerator bunker treated as a delivery chain, where the magnetron, multileaf collimator and single treatment couch are strictly in series behind a duplex record-and-verify system.
Reliability block diagramPetri Net — Level Crossing Interlock
Interlock model of an automatic half-barrier crossing where the protecting signal can only clear once the barriers are proved down and the crossing is proved clear.
Petri NetsSOX Key Control Testing Cycle
Scoping through walkthrough, sampling by control frequency and deficiency severity to the audit committee report.
MermaidBusiness Continuity Invocation (Card Payments)
States a payment processor moves through when authorisation success rate degrades, including regulator notification past the two-hour RTO.
MermaidEnhanced Due Diligence on a Correspondent Bank (PlantUML)
EDD triggered by nested payment alerts, running through Wolfsberg questionnaire, sanctions screening and an MLRO exit decision.
PlantUMLHAZOP Guideword Deviations (PlantUML Mindmap)
Guideword-by-guideword deviations for a continuous stirred tank reactor feed node, the way a HAZOP team works through it.
PlantUMLPayment Segregation of Duties (D2)
Requisition to bank release with the segregation-of-duties rules that stop a preparer authorising or a payables clerk editing vendor bank details.
D2Wind Turbine Gearbox FMEA (Graphviz)
Causes, failure modes, effects and detection controls for a wind turbine gearbox with risk priority numbers on the cause links.
Graphviz (DOT)Fourth-Party Concentration Risk (Graphviz)
A bank's tiered vendors and their subcontractors, exposing a single cloud region sitting behind three of four tier-one services.
Graphviz (DOT)Value at Risk Backtest (Plotly)
Thirty days of clean trading P&L against the 99 percent one-day VaR line, with the three breaches marked as exceptions.
PlotlyOperational Loss Severity by Event Type (Plotly)
Three years of operational losses grouped by Basel event type on a log severity axis, where internal fraud is rare but heavy-tailed.
PlotlyRisk Register Heat Matrix (Vega-Lite)
Counts of open risks in each likelihood by impact cell, coloured by the product score so the board sees where the register clusters.
Vega-LiteNear-Miss Reporting Trend (Vega-Lite)
Six months of near-miss reports at a surface mine stacked by potential severity, where rising volume with falling severity is the good news.
Vega-LiteMotor Claims Leakage (Sankey)
Monthly motor claims spend split into controlled and leaked routes, isolating GBP 2.56m of a GBP 11m book as addressable leakage.
Sankey flowReportable Incident Investigation (Swimlane)
Operator, supervisor, HSE and regulator handoffs from making the scene safe to verifying corrective actions at ninety days.
Swimlane processRegulatory Remediation Programme (PERT)
A skilled-person redress programme whose 128-working-day critical path runs through methodology agreement rather than the data extract.
PERT / CPM networkPharmaceutical Batch Deviation (Fishbone)
Six-M root cause analysis of a tablet batch failing dissolution, spanning operator sign-off, granule hold time and suite humidity.
Fishbone (Ishikawa)Supplier Exposure - Criticality vs Financial Health (Quadrant)
Critical suppliers plotted against financial health, flagging the sole-source foundry and contract steriliser as exit-plan candidates.
Quadrant MatrixDriver Fatigue and Collision Risk (Causal DAG)
Telematics causal structure where shift pattern confounds the hours-driven to collision path and home sleep quality is unmeasured.
Causal DAGCard-Not-Present Fraud (Attack Tree)
Getting card data, defeating step-up authentication and converting to value before chargeback, costed by attacker effort and detectability.
Attack tree (cybersec)Water Treatment Dosing Attack (Attack Tree)
Paths to altering a coagulant dose setpoint at a water treatment works, from vendor VPN compromise to spoofing the residual analyser.
Attack tree (cybersec)Architectural constraints — SFF and hardware fault tolerance (IEC 61508-2 Tables 2 and 3)
The IEC 61508-2 route 1H architectural-constraint lookup — safe failure fraction band by hardware fault tolerance for type A and type B elements — applied to the three subsystems of a knock-out drum level trip, for a SIL verification report.
DMNEvent tree — loss of cooling to an exothermic batch reactor
Quantified event tree analysis of a reactor cooling-water failure, branching on operator response, the SIL 2 emergency quench and the rupture disc, with outcome frequencies that sum back to the initiating event frequency.
Graphviz (DOT)Control assurance from risk to remediation
Links risk treatment to operating evidence, independent testing and verified remediation. Original worked design example; adapt responsibilities, thresholds and assumptions to your system.
Graphviz (DOT)Access recertification with owner and exception handling
Ends with live permission reconciliation rather than treating owner attestation as completed revocation. Original worked design example; adapt responsibilities, thresholds and assumptions to your system.
MermaidCritical vulnerability remediation with independent verification
Require application testing, infrastructure verification and security retest before closing a vulnerability. Editable collaboration with role lanes, decisions and independent parallel checks. Illustrative policy and timing; adapt to local requirements.
BPMN 2.0Privacy impact assessment with mitigation revision
Assess a proposed data use, its necessity and controls, then revise mitigations or stop the proposal if it cannot meet approved requirements. Editable collaboration with role lanes, decisions and a correction and resubmission loop. Illustrative policy and timing; adapt to local requirements.
BPMN 2.0Privileged access recertification with expiry escalation
Obtain a manager recertification response before an illustrative expiry; route missing or invalid attestations to a documented access-control decision. Editable collaboration with role lanes, decisions and an interrupting response timer. Illustrative policy and timing; adapt to local requirements.
BPMN 2.0Third-party outage with vendor restoration deadline
Receive vendor restoration evidence under an internal service clock; route lateness or failed verification to continuity activation. Editable collaboration with role lanes, decisions and an interrupting response timer. Illustrative policy and timing; adapt to local requirements.
BPMN 2.0Change-freeze exception awaiting authority decision
Wait for an authority decision or expiration of a change-freeze exception request; late silence must never authorize the change. Editable collaboration with role lanes, decisions and a response-versus-expiry event race. Illustrative policy and timing; adapt to local requirements.
BPMN 2.0Blue-green service cutover with controlled rollback
Prepare a parallel service, verify migration readiness and shift traffic only after checks; restore the prior state on a failed acceptance decision. Editable collaboration with role lanes, decisions and explicit rollback activities. Illustrative policy and timing; adapt to local requirements.
BPMN 2.0