A Bowtie diagram that shows two separate barriers against the same top event is meant to represent defence-in-depth: if one layer fails, the other still holds. That promise depends entirely on a condition that’s easy to draw correctly and easy to verify incorrectly — that the two barriers are actually independent of each other.
Two Barriers, One Sensor
At a chemical storage tank farm, an overfill scenario was protected by two barriers on the Bowtie: a high-level alarm and an automatic high-level trip that closed the inlet valve. Both were drawn as separate recovery barriers, each with its own line on the diagram. Both were fed by the same level transmitter.
When that transmitter failed and froze on a stable reading while the tank continued filling, the alarm had nothing to sound on, and the trip had nothing to act on. Both barriers went silent at the same moment, for the same underlying reason.
The subsequent report reconstructed a window of several minutes between the transmitter’s failure and the eventual overflow, and concluded that the control room operator “had time to notice and intervene.” The report did not ask what, specifically, the operator had available to notice the fault with — both instruments he would have relied on were reporting the same false-normal reading, from the same dead source.
The Independence Test
Bowtie methodology applies two tests to every barrier before it counts as a genuine layer of protection. The first asks whether the barrier is Specific — does it perform one defined, demonstrable function. The second asks whether it is Independent — can it function without relying on another system or condition being correct first.
Independence is not established by drawing two lines on a diagram. It is established by tracing what each barrier actually depends on to function, and checking whether a single failure could disable more than one of them at once. Two barriers that both depend on the same sensor, the same transmitter, the same person, or the same procedure are not two independent layers. They are one layer with two labels — and the diagram’s promise of defence-in-depth is not being delivered in practice, even though it appears to be on paper.
Why This Failure Mode Is Hard to Catch
Common cause failure is dangerous specifically because it is invisible under normal operating conditions. Both barriers function correctly on every day the shared component works. The gap only becomes visible at the exact moment the shared component fails — which is also the exact moment both barriers are needed simultaneously.
A Bowtie review that checks whether each barrier exists and functions, without tracing what each barrier’s function actually depends on, will not catch this pattern. The review needs to ask a different question for every pair of barriers on the same pathway: is there a single failure mode — one sensor, one person, one power supply, one procedure — that could take out more than one of these at once?
CIMAH 1996 and Layered Protection
Under the Control of Industrial Major Accident Hazards Regulations 1996 (CIMAH), major hazard installations in Malaysia are expected to demonstrate genuine layered protection against major accident scenarios — not protection that exists on the safety case document while sharing a structural vulnerability that most reviews never trace back far enough to find. A safety case that lists two independent barriers, where both in fact depend on the same instrument, does not meet the substance of CIMAH’s layered-protection expectation even if it satisfies the letter of having two barriers documented.
What Gets Missed When the Investigation Blames the Operator
Blaming an operator for not intervening during a window when both of his available instruments were reporting the same incorrect information isn’t just an unfair conclusion — it treats a structural instrumentation gap as a vigilance problem. No amount of additional training changes what a control room operator can perceive when the only two sources of information available to him have both failed from the same cause.
Checking Your Own Bowtie for This Pattern
For every pair of barriers on the same pathway in your facility’s Bowtie diagrams, ask a specific question: if I traced each of these barriers back to what it depends on to function — sensor, transmitter, person, power source, procedure — would I find a single point that both depend on? If yes, the number of independent layers of protection you actually have is one, not two, regardless of how the diagram reads.
Want to build Bowtie diagrams that catch common cause failures before an incident does? Cikgu Barrier’s Barrier Management: Bowtie Analysis program teaches teams how to rigorously test barrier independence — not just barrier existence — including CIMAH compliance for major hazard facilities. Available in-house and as a public workshop across Malaysia.