Skip to content
flowss
Start freeChecking your session
Bowtie risk templates

Bowtie — Signal Passed at Danger

Barrier-based analysis of a SPAD on a suburban route, ranking the route conductor and the two TPWS installations as the most critical barriers and leaving 98.9% of the inherent risk removed.

Bowtie riskRisk & ReliabilityBowtie risk syntax docs
Template previewBowtie risk
Signal passed at danger — suburban routeHAZARDTrains operating under lineside signalling at up t…THREATSPREVENTIVE BARRIERSRECOVERY BARRIERSCONSEQUENCESVegetation growth obscures theapproachSeasonal lineside vegetationclearance programmeSignal sighting committeereview of every aspect55% · controlAWS audible warning onapproach75% · detectionTPWS overspeed and trainstop loops85% · controlRest day working accepted tocover shortagesFatigue risk index limitson roster design60% · controlVigilance device withdriver acknowledgement50% · detectionTPWS overspeed and trainstop loops85% · controlApproach locking on theinterlocking90% · controlSignaller competence andworkload assessment45%Route conductor rosteredfor unfamiliar routes70% · controlPre-departure briefing onthe diversionary route40%Reduced overlap granted at acongested junctionRisk assessment and speedrestriction on approachOverlap beyond the signalsized for the line speed80% · mitigationEmergency brakeapplication by TPWS70% · mitigationCrashworthy vehiclestructure andanti-climbers50% · mitigationTrap points sited clear ofrunning lines60% · mitigationLow approach speedenforced by TPWS55% · controlStanding passenger grabpoles and door interlocks35% · mitigationContingency plan withpre-agreed diversions50% · recoveryRail replacement andpassenger information plan40% · recoveryDriver misreads asignal in poorsighting conditions0.9/yr → 0.0152/yrDriver distracted orfatigued on a nightturn0.5/yr → 0.015/yrSignaller replaces thesignal in front of thetrain0.12/yr → 0.0066/yrRoute knowledge lapseafter a diversion0.28/yr → 0.0504/yrCollision with aconflicting movementsev 5 · risk 0.0131Derailment on trappointssev 4 · risk 0.0628Passenger injury inan emergency brakeapplicationsev 2 · risk 0.1133Route blocked andservice suspendedsev 3 · risk 0.0785Train passes asignal atdanger0.0872/yrtop-event frequencyTop event0.0872/yrinherent 1.8/yrResidual risk0.2677inherent 25.2Risk reduction98.9%threat side 95.2%Barriers184 threats · 4 consequencesDominant threatRoute knowledge lapse after a diversion57.8% of the top eventResidual risk 0.2677 against an inherent 25.2 — the barriers remove 98.9% of it. 2 things are probably not what was meant — every path and every escalation factor was checked.Barrier criticality — residual risk if that one barrier were removed1. Route conductor rostered for unfamiliar routes+0.361 ×2.32. TPWS overspeed and train stop loops+0.2642 ×23. TPWS overspeed and train stop loops+0.261 ×24. Approach locking on the interlocking+0.1824 ×1.75. AWS audible warning on approach+0.1399 ×1.56. Pre-departure briefing on the diversionary route+0.1032 ×1.4FindingsConsequence "Passenger injury in an emergency brake application" rests on ONE barrier. Defence in depth is the claim a bowtie is drawn to make, and a single barrier is a single point of failure: the day it fails is the day the consequence lan…Escalation factor "Rest day working accepted to cover shortages" degrades barrier "Fatigue risk index limits on roster design" and nothing is holding it off. The 60% credited to that barrier — and every figure computed from it — assumes the e…Each of the 4 consequences is credited the full top-event frequency of 0.0872/yr — the model here is that one top event produces all of them, so the residual score of 0.2677 adds 4 outcomes to one event. That is right when they happen togethe…

Make it your own.

title "Signal passed at danger — suburban route"
hazard "Trains operating under lineside signalling at up to 75 mph"
top "Train passes a signal at danger"
unit "/yr"

threat "Driver misreads a signal in poor sighting conditions" likelihood: 0.9 {
  barrier "Signal sighting committee review of every aspect" effectiveness: 0.55 type: control {
    escalation "Vegetation growth obscures the approach" {
      control "Seasonal lineside vegetation clearance programme"
    }
  }
  barrier "AWS audible warning on approach" effectiveness: 0.75 type: detection
  barrier "TPWS overspeed and train stop loops" effectiveness: 0.85 type: control
}

threat "Driver distracted or fatigued on a night turn" likelihood: 0.5 {
  barrier "Fatigue risk index limits on roster design" effectiveness: 0.6 type: control {
    escalation "Rest day working accepted to cover shortages"
  }
  barrier "Vigilance device with driver acknowledgement" effectiveness: 0.5 type: detection
  barrier "TPWS overspeed and train stop loops" effectiveness: 0.85 type: control
}

threat "Signaller replaces the signal in front of the train" likelihood: 0.12 {
  barrier "Approach locking on the interlocking" effectiveness: 0.9 type: control
  barrier "Signaller competence and workload assessment" effectiveness: 0.45
}

threat "Route knowledge lapse after a diversion" likelihood: 0.28 {
  barrier "Route conductor rostered for unfamiliar routes" effectiveness: 0.7 type: control
  barrier "Pre-departure briefing on the diversionary route" effectiveness: 0.4
}

consequence "Collision with a conflicting movement" severity: 5 {
  barrier "Overlap beyond the signal sized for the line speed" effectiveness: 0.8 type: mitigation {
    escalation "Reduced overlap granted at a congested junction" {
      control "Risk assessment and speed restriction on approach"
    }
  }
  barrier "Emergency brake application by TPWS" effectiveness: 0.7 type: mitigation
  barrier "Crashworthy vehicle structure and anti-climbers" effectiveness: 0.5 type: mitigation
}

consequence "Derailment on trap points" severity: 4 {
  barrier "Trap points sited clear of running lines" effectiveness: 0.6 type: mitigation
  barrier "Low approach speed enforced by TPWS" effectiveness: 0.55 type: control
}

consequence "Passenger injury in an emergency brake application" severity: 2 {
  barrier "Standing passenger grab poles and door interlocks" effectiveness: 0.35 type: mitigation
}

consequence "Route blocked and service suspended" severity: 3 {
  barrier "Contingency plan with pre-agreed diversions" effectiveness: 0.5 type: recovery
  barrier "Rail replacement and passenger information plan" effectiveness: 0.4 type: recovery
}