Skip to content
finalstate.aiThe Cell Is Not a Decision
009Atlas

009ONE CELL, ONE CASE

The Cell Is Not a Decision

An illustrative solvent tank moves from a marked cell to a decision record: rule, owner, price, scenario. Its controls and loss estimates remain unverified; the colour supplies no permission to operate.

The marked matrix cell routes an illustrative solvent tank into review; the case stays open.A schematic matrix has likelihood increasing upward and severity increasing rightward. Its lower-right cell is marked. A route leads to the same tank used throughout the article. No calibrated probability bins or approval are shown.LikelihoodSeverityCase open
Schematic triage and fictional tank. The marked cell identifies a case for review; its position supplies no numerical loss estimate.

RULE FIRST

Establish the rule before trading cost against risk

A tank leads to an open rule book with the rule and reason for stopping still unanswered.The tank remains unchanged while an applicable-rule record opens beside it. A separate question marks the missing reason for stopping. The illustration assigns no tolerability region and grants no permission.Rule?Reason?
HSE, Reducing risks, protecting people (2001), §§121–127, pp. 42–44. Its current regulatory framework is not dutyholder guidance.
  • A tolerable region still requires assessment and control
  • Broadly acceptable does not remove reasonably practicable duties

The applicable requirements come first. In Great Britain, HSE's tolerability framework distinguishes unacceptable risk from risk that is tolerable only under conditions including ALARP: as low as reasonably practicable. It also requires periodic review. This is an illustration of that framework, not a legal determination for a particular tank.

REOPEN THE INPUTS

A category has discarded information

A marked cell remains intact while separate probability and loss questions are attached to an evidence record.The same lower-right matrix cell is shown with unchanged orientation. New input requests are drawn as open records labelled Probability? and Loss?; no values emerge from the cell.LikelihoodSeverityProbability?Loss?
Cox, Risk Analysis 28(2), 2008, pp. 497–512, publisher abstract: poor resolution and range compression. The figure requests evidence; it does not infer it.
  • Specify what the probability refers to
  • Trace consequence estimates to evidence and assumptions

Cox describes how cases can share a rating while their probabilities and consequences differ. That range compression prevents a reviewer from recovering the tank's loss distribution from its cell. Reopen the underlying evidence: time period, exposure, failure pathways, consequences and uncertainty.

Escalating a case leaves its acceptance unresolved

A useful triage instrument can direct attention without settling a spending decision. A reviewer still needs grounds to approve a control, request more evidence or withhold acceptance. A completed form still needs evidence.

TEST THE NEXT CONTROL

What would the proposed trip change?

A proposed trip sits across the tank feed path. Questions for reduction and sacrifice remain open.A tank feed pipe is unchanged when a candidate trip is introduced across it. The barrier is a proposal, not a demonstrated success. Reduction? and Sacrifice? appear together beneath the control; no marker moves into a safer region.Trip?Reduction?Sacrifice?
Gross-disproportion account: HSE, Reducing risks, protecting people (2001), Appendix 3 §§1–5, pp. 62–63, discussing Edwards v NCB (1949). Tank application is illustrative.
  • Proposed control: independent high-level trip
  • Reduction and sacrifice still require evidence
  • The dutyholder must justify the decision

Consider an independent high-level trip intended to stop feed before overfilling. Establish its expected reduction, failure modes, independence and maintenance needs, alongside money, time and disruption. Where the reasonably practicable test applies, HSE's account asks whether that sacrifice is grossly disproportionate to the risk reduction. It supplies no universal multiplier.

GIVE BARRIERS OWNERS

The barrier needs an owner and evidence

A selected bowtie path runs from overfill through a proposed trip to loss of containment, then through spill containment toward fire. The trip has missing ownership and test evidence.The hazard is identified separately as stored flammable solvent. Both barrier bars cross the horizontal causal path exactly. An owner-and-evidence request is attached to the preventive trip, and a power-loss escalation factor points to that control rather than to the top event. Other threats, consequences and recovery-control assurance are outside this sparse illustration.SolventLoss ofcontainmentOverfillTripBundFireOwner?Evidence?Power loss
CAA, “How does bowtie work?”, definitions of hazard, top event, controls and escalation factors. Adapted from its aviation method to an illustrative tank path; no completeness or effectiveness claim.
  • Check who owns the trip and its test evidence
  • Check the recovery control and what can defeat it
  • A diagram cannot establish either control's effectiveness

The hazard is stored flammable solvent. Loss of containment is the top event: control over that hazard has been lost. In the CAA's bowtie method, preventive controls sit before this event; recovery controls act afterward to reduce the chance or severity of consequences. An escalation factor can weaken a control. The bund shown here provides secondary containment around the tank. This selected overfill-to-fire path omits other threats and consequences.

STATE THE LOSS ASSUMPTIONS

The model must supply what the cell cannot

Fixed step graph of an invented annual-loss distribution: 0.1 percent above zero until €3M, 0.01 percent from €3M until €25M, and zero from €25M onward.The horizontal axis is the annual-loss threshold in millions of euros, from 0 to 30. The vertical axis is the annual chance P(L > x), on a linear scale from 0 to 0.12 percent. Strict exceedance drops at €3M and €25M; open and filled endpoint marks show the values at the jumps. The €2M and €20M queries are not loss masses. No appetite line is invented.Annual P(L > x)00.05%0.10%0.12%0102030Loss threshold x (€M)
Illustrative assumptions, not observations or a calibrated risk assessment. The fixed graph represents annual total loss, not loss conditional on an incident. Money alone does not capture all safety consequences.
  • P(L > €2M) = 0.1% per year
  • P(L > €20M) = 0.01% per year
  • No appetite boundary or accepted position has been supplied

Suppose a toy model for this tank assigns these mutually exclusive annual total losses: €0 with probability 99.9%; €3M with 0.09%; €25M with 0.01%. They sum to 100%. The resulting strict exceedance function is P(L > x): it steps down at €3M and €25M. These invented inputs illustrate the calculation, not the facility's risk.

Record what a controlled exercise exposes

Agree the exercise scope and stop criteria before testing a loss-of-containment scenario. Use simulation to examine a missed alarm or delayed handoff. Record the gap before correcting the response, then retest what changed. A rehearsal can expose a response failure. One successful run cannot prove barrier reliability or readiness.

FOUR FIELDS, ONE CASE

Keep the unresolved decision visible

The tank is attached to a four-field decision record: Rule, Owner, Price and Scenario. Every field and the acceptance endpoint remain open.Four labelled lines are assembled beside the same tank, each ending in a question mark. A route reaches an unfilled acceptance endpoint. No checks appear and no automatic approval follows from completing the record.Rule?Owner?Price?Scenario??Accept?
Illustrative decision record. The toy distribution supplies no actual tank estimate, completed control test, rehearsal result or permission to operate.
  • Rule: applicable requirements and reasons for the control decision
  • Owner: accountable people and current barrier evidence
  • Price: loss assumptions, uncertainty and any acceptance boundary
  • Scenario: exercised response, recorded gaps and retest

The dutyholder must justify any decision within the applicable requirements. These fields make its grounds inspectable; they do not authorize operation. In this illustrative case, control evidence, an accepted loss position and a completed rehearsal are still missing. The next question is what it costs to keep watching as conditions change.

Read the transcript

01 · ONE CELL, ONE CASE

A solvent tank appears in a marked cell on the risk screen. The concern is loss of containment. That mark brings the case into review. Whether to install another control or accept the residual risk remains unresolved. Follow this illustrative tank into a decision record. Four fields remain open: rule, owner, price and scenario. No operating permission follows from the colour.

02 · RULE FIRST

Start with the applicable rule. In Great Britain, HSE describes risk that is unacceptable and risk that may be tolerated under conditions, including reduction as low as reasonably practicable. Tolerable still requires assessment, controls and periodic review. The reason for stopping must be documented. A company's willingness to bear a loss cannot override applicable duties. This tank has no established legal classification.

03 · REOPEN THE INPUTS

Now ask what went into the rating. The probability question needs a time period and a defined event. The loss question needs consequences, exposure and uncertainty. Cox's critique of risk matrices includes their poor resolution: quantitatively different risks can receive the same rating. Reopen the evidence. The category cannot recover numbers it discarded.

04 · THE CELL CANNOT CHOOSE

The category can escalate the tank case. Acceptance remains a separate decision. A reviewer may approve a further control, ask for better evidence or withhold acceptance. Even a completed form can contain unsupported estimates and unanswered objections. An accountable person must defend the reasons.

05 · TEST THE NEXT CONTROL

Consider an independent high-level trip intended to stop feed before the tank overfills. Place the proposed trip on that path. Its effectiveness and independence need evidence; naming it does not reduce the estimate. Open the reduction and sacrifice questions together, including maintenance, time and disruption. Where the reasonably practicable test applies, HSE describes gross disproportion between sacrifice and risk reduction, with no universal multiplier. The control decision remains unresolved.

06 · GIVE BARRIERS OWNERS

Keep the hazard separate from the top event. Stored flammable solvent is the hazard. Loss of containment is the top event. Trace overfilling through the proposed trip toward that event. Afterward, secondary containment may limit a spill and its consequences. Attach an owner and test-evidence request to the trip. Then expose a factor such as loss of power that could defeat it. This selected path is incomplete, and neither control is proved effective.

07 · Advertisement · Stability AI Brand Studio

For creative teams, speed only matters if the result still belongs to the brand. Stability AI brings generation and editing tools into production: image, video, audio, 3D, product photography, and campaign assets. Use Brand Studio or deploy through API, cloud, or self-hosted models, with more control over how the work is made.

08 · STATE THE LOSS ASSUMPTIONS

Supply a separate toy annual-loss model for this tank. Assume no loss with probability ninety-nine point nine percent, three million euros with zero point zero nine percent, and twenty-five million with zero point zero one percent. These mutually exclusive outcomes exhaust the model. The annual chance of exceeding two million is one in a thousand; exceeding twenty million is one in ten thousand. The line steps at the possible losses. It comes from these invented assumptions. No appetite boundary has been supplied, and a monetary model alone cannot establish acceptable safety risk.

09 · REHEARSE THE PATH

In a controlled exercise, agree the scope and stop criteria before simulating a missed alarm or delayed handoff. Record the gap before correcting the response. Retest the change and preserve the remaining uncertainty. A rehearsal can expose a response failure. One successful run cannot prove barrier reliability or readiness.

10 · FOUR FIELDS, ONE CASE

Return to the tank with four fields. Rule: applicable requirements and reasons for the control decision. Owner: accountable people and current barrier evidence. Price: loss assumptions, uncertainty and any acceptance boundary. Scenario: the exercised response, recorded gaps and retest. Assemble those grounds for review, then leave the acceptance endpoint open. Our illustrative case still lacks evidence and an accountable decision. Tracking that position as conditions change has a cost of its own.

01 / 10 · ONE CELL, ONE CASE0:00 / 4:58