BowTie Manager, step by step

Open the site address and choose Sign in. You land on the barrier health dashboard. The top menu holds everything else: Studies; Registers (Barriers, SCEs, Actions, Import); Reports; and, for Org Admins, Administration. You only see what your role allows.

1. Dashboard is your start page; the logo also brings you back here.
2. Facility narrows every figure to one installation.
3. Each tile opens the matching list: impaired barriers, overdue tests, exposed lines or overdue actions.
4. The bell shows new notifications. The building icon beside it switches organisation, if you belong to more than one.

If you are a member of more than one organisation, you choose one after signing in and can switch at any time. Each organisation's data is kept completely separate.

The person icon at the top right opens your account menu.

1. Your roles in this organisation, and its code. Roles can apply to the whole organisation or to one facility.

My profile changes your name, job title, phone and password, and signs you out on other devices. Sign out returns you to the product page.

Account menu → Two-factor authentication. Scan the QR code with an authenticator app (Microsoft Authenticator, Google Authenticator, Authy, 1Password…) and enter the 6-digit code it shows. Keep the recovery codes you are given in a safe place.

Your Org Admin can make two-factor sign-in compulsory for everyone. The same code is asked for when you sign electronically, for example to approve a study.

Administration → Settings sets how the whole organisation works.

1. Study document number format: for example {ORG}-{FAC}-BT-{SEQ:4}. Numbers are assigned automatically to new studies.
2. Daily summary e-mail: the time each person's summary is sent, in your timezone.
3. Security: require two-factor sign-in for everyone, and sign out after a period of inactivity.
4. Method: whether you use safety-critical elements (SCEs), whether an overdue proof test makes a barrier unhealthy, and whether a second Org Admin must activate a new risk matrix.

Switching SCEs off hides them everywhere for your organisation but keeps the data, so switching them on again brings it all back.

Administration → Users. Type the e-mail address, name and job title, pick one or more roles, then choose Send invitation. The person receives an e-mail link (valid for 7 days) to choose a password.

1. Invite someone: a role can apply to every facility or to just one.
2. Roles: change a member's roles at any time.
3. Edit: correct the name, job title, phone or e-mail address. A new address must be confirmed from that inbox before it takes effect.
4. Seats: active and invited members count towards your plan.

The roles: Org Admin runs the organisation; the Facilitator / Study Lead builds studies; the Reviewer comments; the Approver signs off; the Barrier Owner keeps barrier condition up to date; the Viewer reads only.

Administration → Facilities. Each installation (FPSO, platform, terminal, plant) has a code used in document numbers, its own timezone if needed, and its areas (modules, decks) with their systems.

1. The facility: its code is fixed once document numbers have been issued.
2. Areas and systems can be chosen on a study, and systems can be linked to hazards.

Administration → Picklists holds your own vocabulary: hazard categories, barrier types, effectiveness, criticality, SCE groups, action priorities, study team roles and facility types. Custom fields add your own fields to studies and other records.

Items in use are never deleted. Untick Active to hide an item from new choices; the records that already use it keep it.

Administration → Risk matrix. Define likelihood and severity levels (3 to 7 each), consequence categories with their severity descriptors, the risk levels with their tolerability, and who may accept each level. The preview updates as you type.

1. A new version starts as a draft copy of the current one.
2. Work through the sections: likelihood, severity, categories, risk levels and cells.
3. Activate with your electronic signature once the checks pass (with a second Org Admin, if your settings require one).

Studies keep the matrix version they were created with, so approved studies never change. A draft study can be moved to the new version from its page.

Studies lists every study you can see, with its status, number of bow ties and facilitator.

1. New study (Facilitators and Org Admins).
2. Search by title or document number, or filter by facility and status.
3. Open a study from its document number.

Choose the facility, give the study a title, pick the facilitator and describe the scope and objectives.

1. The facility decides who can see the study and the facility code in the document number.
2. A clear title, e.g. "FPSO Alpha Utilities — Major Accident Hazard Bow Ties".
3. Create study: the document number is assigned and the active risk matrix is attached.

The study page holds everything about the study: its bow ties, its details (title, area, scope, objectives, your custom fields), the workshop team and the sessions held, and the workflow.

1. Bow ties: add one per top event, under a hazard.
2. Open editor shows the diagram.
3. Worksheet shows the same bow tie as a table.

Record the team members (including people from outside the organisation) and each workshop session (date, duration, location, notes): they appear in the study report.

The diagram follows the CCPS / Energy Institute bow tie method: the hazard above the top event, threats on the left with their preventive barriers, consequences on the right with their mitigative barriers. Click any box to open its panel.

1. A threat.
2. A barrier: its header colour is the live condition from the barrier register (green Available, amber Degraded, orange Impaired, red Unavailable).
3. The top event.
4. A consequence, coloured by its residual risk.
5. Add a threat or a consequence. Export as SVG or PNG, or print on A3.

Zoom with + and −, fit with 0, and use Line focus to work on one threat or consequence line at a time. Everything works from the keyboard. If a colleague edits at the same time, you are told and can reload their changes.

Open a threat or consequence to see its barriers in order. Under Add barrier to this line choose how:

1. The line's barriers, in sequence. Reorder them with the arrows.
2. New barrier, From the barrier register (for example entries imported from a CSV file), or Existing barrier, shared from another line of this bow tie.
3. Search the register by tag or name.
4. Add barrier: it is linked to the register entry and shows its live condition.

The barrier panel records what the barrier is and how good it is.

1. Barrier type (passive hardware, active hardware, active hardware + human, active human) and the owner role.
2. The safety-critical element and performance standard it belongs to, its effectiveness and criticality, and any SIF / SIL reference.
3. Barrier quality: is it effective, independent and auditable? Give a justification for each answer.

A barrier that fails any of the three checks is flagged on the diagram, and the study cannot be approved until every barrier has been assessed and justified.

An escalation factor is a condition that defeats or degrades a barrier, for example a SIF left in bypass or an inspection backlog. Add one from the barrier's panel, then add the escalation factor controls that manage it.

1. The escalation factor, hanging below its barrier.
2. Its control.
3. Add EF control: a new control, or an existing one shared from elsewhere in the bow tie.

Use Collapse escalation factors on the toolbar to hide them while you look at the main lines.

Open a consequence to rate it on your risk matrix, with a rationale: per consequence category (People, Asset, Environment, Reputation…) when your matrix rates categories separately, otherwise once overall.

1. Unmitigated risk: no barriers.
2. Residual risk: barriers working to their performance standards.

The level comes from the matrix cell, not from multiplying likelihood by severity. The residual level decides who must accept the risk during review.

The same bow tie as an editable table: one row per barrier, threat by threat, then consequence by consequence. Edit a cell and move on with Tab; Ctrl + Enter saves a text box; Esc undoes an unsaved cell.

1. Show or hide escalation factors.
2. Show or hide the E / I / A (effective, independent, auditable) columns.
3. Print the worksheet.
4. Switch back to the diagram. Both always show the same data.

The worksheet also adds barriers from the register, from the add row under each line.

The Workflow card on the study page lists what is still needed.

1. The checklist: ticks for what is done; crosses for what is missing, with the items involved.
2. Submit for review, once everything marked "Needed to submit" is done. The content becomes read-only.
3. The Study report, and the Excel and CSV exports, are available at every stage.

Reviewers comment on the study as a whole or on any element of it. Comments made in the diagram panels appear here too.

1. Review comments: the facilitator replies to and resolves each one, with a note.
2. Add a review comment: choose the element it is about.

All comments must be resolved before the study can be approved.

Each residual risk must be accepted by the role your risk matrix names for that level, for example High by an Approver and Medium by a Reviewer.

1. Each consequence and category, with its rating and the role who must accept it.
2. Accept appears for the risks your role may accept.

Changing a rating after it has been accepted withdraws the acceptance, so it has to be accepted again.

Accepting risk, approving a study and activating a risk matrix are electronic signatures.

1. Say why the risk is tolerable (for example the ALARP basis, or actions raised).
2. Your password, and the 6-digit code if you use two-factor sign-in.
3. Accept and sign: your name, the date and time, the reason and a hash of what you signed are recorded.

When every check is green, the approver signs the study off.

1. The checklist: everything marked "Needed to approve" must be done.
2. Approve and sign freezes this revision as a snapshot with a SHA-256 hash; an earlier approved revision becomes superseded.
3. Return to draft sends the study back to the facilitator with your reasons.

To change an approved study, use Start new revision: a new draft (B, C… or 1, 2…) is made, and the approved revision stays as it was.

Registers → Barriers: one entry per physical or organisational barrier of each facility, shared by every study that uses it. The worst condition is listed first.

1. Filter by condition.
2. Filter by tests or restorations due or overdue.
3. My barriers: the ones you own.
4. Each row shows the condition and since when, the restore-by date, the next test (red when overdue), the owner, the SCE and how many studies use it.

Open a register entry. Its page shows the status, where the barrier is assessed, the condition history and the test records.

1. The barrier, its condition, and whether it counts as healthy.
2. Change condition: Available, Degraded, Impaired or Unavailable. Below Available, say what happened, the compensating measures in place and the expected restoration date.
3. Record a test: date, pass or fail and reference. The next due date follows from the test interval.
4. Save condition: every bow tie using the barrier, and the dashboard, update straight away.

People concerned are notified according to their notification settings. Every change is kept in the condition history and the audit log.

Registers → SCEs groups barriers into safety-critical elements (fire and gas detection, ESD, relief system…) with their performance standards. Each SCE's health comes from the live condition of its barriers.

SCEs are optional. If your organisation does not use them, the Org Admin can switch them off in Settings.

Below the tiles, the dashboard shows where attention is needed. It refreshes every two minutes.

1. Barriers not available: worst first, with days out of service, restore-by date and compensating measures. "None recorded" is shown in red.
2. Residual risk profile: how many residual ratings fall in each cell of your matrix.
3. Exposed lines: threat or consequence lines left with fewer than two healthy barriers, with a link to the line in the diagram.

Further down are overdue tests, recent condition changes and overdue actions.

Registers → Actions lists actions raised on studies, bow tie elements, barriers and SCEs. Use the tabs for Open, Overdue, Due in 30 days and Done / cancelled, or My open actions.

1. Raise action here, or with Raise an action on this item in any diagram panel or barrier page.
2. Each action has a number, what it is about, an owner, a due date and a priority.

The owner records progress and marks the work done; the action is then closed out.

1. Mark completed when the work is done, then Close out with a closure note, or Cancel with a reason.
2. Progress notes keep a dated record.
3. Edit or reassign the title, owner, due date or priority.

The bell shows what happened that concerns you: actions assigned or overdue, studies submitted, returned or approved, review comments, and barriers that become unavailable.

1. Open a notification to go straight to the item. Mark all read clears the count.

Account menu → Notification settings. For each kind of event choose: in the app, an e-mail straight away, and / or the daily summary e-mail. You are never told about changes you made yourself.

E-mails come in your organisation's colours, with a button that takes you straight to the item.

Reports opens print-ready pages (use your browser's "Print / save as PDF") and CSV or Excel exports, for the facilities you can access.

1. Organisation reports: barrier register, risk register, actions and studies.
2. Study reports: the full report of each study, or its workbook with one sheet per section.

Every export is recorded in the audit log.

The study report holds the cover and approval, scope, team and sessions, the risk matrix, every bow tie as a diagram and a worksheet, the risk register, the barriers and the actions. Diagrams print on A3 landscape and text on A4.

A report of a study that is not approved is clearly marked "IN REVIEW — not approved" or "DRAFT".

Registers → Import brings in the barrier register, safety-critical elements, or the threats and consequences of a bow tie from a spreadsheet saved as CSV. Download the template, fill it in, choose the file and press Check file.

1. The result of the check: rows that are valid, and rows with problems.
2. Each problem, with its row and column. Download the error report, fix the file and check again.
3. Import: nothing is written until you press it. You can import only the valid rows.

Up to 2000 rows and 2 MB per file. A barrier's condition is never imported: condition changes need a reason and compensating measures.

Administration → Audit log: every change in the organisation, in order, with the old and new values. Filter by action, record type, person or date.

1. Verify integrity: each entry carries the hash of the one before it, so a changed or deleted entry is detected.
2. Download CSV of the filtered entries.

Administration → Data export builds a ZIP of every table as JSON and CSV, with your uploaded files and a manifest of SHA-256 hashes. Use it for your own records, a move to another system, or when you leave the service.

Platform support can see your data only after you approve a request (Administration → Support access), for the hours you approve; you can revoke it at any time.

Administration → Billing shows your plan and what it includes, the seats and facilities in use, and your invoices (view, print or pay online). Your billing details appear on the invoices.