Skip to content
Final StateThe Cell Is Not a Decision
VOL. I  ·  NODE 009▢  ATLAS

ONE CELL, ONE CASE

The Cell Is Not a Decision

For a serious cell, replace the verdict with four fields: rule, owner, price, scenario.

A loss-of-containment cell routed to a case card whose rule, owner, price, and scenario are blank.The opener fixes one applied case and keeps it constant while four missing decision fields are completed.ONE CELL · ONE CASE5 × 5 TRIAGEREDTANK CASELOSS OFCONTAINMENTCATEGORYRARESEVERERULE—OWNER—PRICE—SCENARIO—ROUTED FOR REVIEWNOT DECIDED4 FIELDS STILL OPEN

RULE FIRST

First field: what rule permits the team to stop reducing risk?

Loss-of-containment case routed from a red cell into an ALARP stopping-rule record.The first applied field replaces colour with a documented test for whether another control is reasonably practicable.TANK CASELOSS OF CONTAINMENTPROBABILITYSEVERITYGOALARP RULENEXT CONTROL?EXPECTEDREDUCTION?SACRIFICE?RECORD WHYSTOPCELL ROUTES THE CASERULE GOVERNS NEXT MOVE
Applied ALARP rule; legal and instrument lineage is documented in node 102.
  • The red cell triggers review; it supplies no stopping rule
  • Test each further control against expected reduction and sacrifice
  • The duty-holder records why stopping is justified

For this tank, the rule is ALARP: consider the next control unless its sacrifice is grossly disproportionate to the risk reduction. The source and legal lineage stay with the instrument owner.

PRICE THE CASE

Second field: what loss profile is the organization accepting?

The applied tank cell opened to show annual-frequency and loss magnitudes that its rare-catastrophic labels hide.Illustrative bounds show why the price field cannot be copied from the cell colour.ONE CELL HIDESORDERS OF MAGNITUDESAME “RARE”ROW10^-310^-6×1000 APARTCATASTROPHICCOLUMNEUR100MEUR10B×100 APARTCATEGORY SURVIVESDISTANCE DOES NOT
Illustrative values showing range compression; mechanism after Cox, Risk Analysis 28(2), 2008, pp. 497-512.

Open the tank's cell before pricing it. Range compression explains why the category cannot preserve the magnitudes a serious acceptance decision needs.

  • The same rare row can hide 10⁻³ and 10⁻⁶ annual odds
  • The same catastrophic column can hide €100M and €10B losses
  • The case needs a modeled tail and an explicit appetite boundary

A category can escalate the case. It cannot accept the case.

Keep the distinction operational: the grid found the tank worth attention. The accountable decision begins only when its rule, owner, price, and scenario can be inspected. Node 102 retains the matrix critique and source apparatus.

TEST THE NEXT CONTROL

Run the rule against a concrete control

ALARP test applying the gross-disproportion rule to an independent high-level trip on the tank.The applied comparison records the proposed control, expected reduction, sacrifice, and duty-holder's reason.COLOUR VERSUS RULEINTOLERABLETOLERABLEIF ALARPBROADLYACCEPTABLEGROSSDISPROPORTIONTESTRISKSACRIFICETEST EACHNEXT CONTROLDUTY-HOLDER RECORDSWHY STOP
Gross-disproportion test after Edwards v. National Coal Board [1949] 1 KB 704; tolerability framing after UK HSE.
  • Candidate control: an independent high-level trip
  • Estimate the reduction in the loss-of-containment path
  • Record cost, disruption, uncertainty, and the reason to install or stop
  • The duty-holder owns the justification

The point is not to chant ALARP but to test the next measure. The tank case now has a rule and a recorded control decision; node 102 carries the full gross-disproportion source.

GIVE BARRIERS OWNERS

Third field: who proves each barrier still works?

  1. 01Threats: overpressure, seal failure, impact
  2. 02Top event: loss of containment
  3. 03Consequences: release, fire, outage
  4. 04Every preventive and mitigating barrier gets an owner and test date

The tank's bowtie makes ownership inspectable. An unowned trip, stale seal inspection, or untested isolation valve is now a finding, not a colour.

Bowtie diagram unfolding one red risk cell into threats, barriers, a top event, consequences, owners, and test dates.The figure maps threats through preventive barriers into a top event and out through mitigating barriers, with owner, test date, and a named rehearsal scenario.BARRIERS NEED OWNERSTHREATSPRESSUREHALE 03/26SEAL FAILOKAFOR 05/26IMPACTLIU 01/26PREVENTTOP EVENTTANK LEAKCONSEQUENCESRELEASEVOSS 04/26FIREOUTAGESATO 02/26MITIGATENO OWNERSCENARIOREHEARSE LOSS PATHOWNER + TEST DATE

PUT APPETITE IN MONEY

The price field is a curve, not a colour

Loss exceedance curve replacing a risk-matrix cell with one line and an appetite threshold.The figure plots annual loss against chance of exceeding it, marks 10 percent above EUR2M and 1 percent above EUR20M, then draws an appetite line to ask whether the curve stays below it.ILLUSTRATIVELOSS-EXCEEDANCE CURVEANNUAL LOSSCHANCE OF EXCEEDING€2M€20M10% ABOVE €2M1% ABOVE €20MAPPETITE LIMITDOES RISK CROSSAPPETITE?
Illustrative loss-exceedance curve; the €2M/€20M points are worked examples, not observed data.

The worked numbers are illustrative, but the decision form is concrete: compare the tank's modeled tail with appetite and make the accepted price visible.

  • Model annual loss against the chance of exceeding it
  • Illustrative points: 10% above €2M; 1% above €20M
  • Overlay the organization's appetite boundary and expose crossings

Fourth field: what failure has the team actually rehearsed?

Run loss of containment from alarm through trip, isolation, evacuation, fire response, and restart. A scenario is not another estimate; it tests whether named owners can execute the path while the cues are bad and the clock is running.

FOUR FIELDS, ONE CASE

The same cell now has a decision record

  • RULE: the recorded test for the next control
  • OWNER: accountable barrier owners and test dates
  • PRICE: modeled loss profile against appetite
  • SCENARIO: the rehearsed loss-of-containment path

Keep the matrix for triage. Close this tank case only when all four fields agree and the accountable owner accepts the residual position; then track how its price moves.

Read the transcript

01 · ONE CELL, ONE CASE

A solvent tank appears as one red cell on the risk screen: rare, catastrophic, loss of containment. That colour has done one useful job. It routed the case into the room. It has not said what further control is required, who proves the barriers work, what loss profile the organization accepts, or which failure path the team has rehearsed. Keep this one cell in view. The rest of the chapter will complete those four fields without pretending the grid completed the decision.

02 · RULE FIRST

Start with the rule. For this tank, the red cell triggers review but supplies no test for stopping. An ALARP decision asks what further control is available, what reduction it is expected to produce, and whether the sacrifice would be grossly disproportionate to that reduction. The duty-holder records the reason to install the measure or to stop. The instrument, legal lineage, and alternatives belong to the frequency-impact source node. Here the rule is applied to one case.

03 · PRICE THE CASE

Now open the price field. The tank's rare row could conceal an annual chance of one in a thousand or one in a million. Its catastrophic column could conceal a hundred-million-euro loss or ten billion. Those values are illustrative bounds, not estimates for a real facility. They show why the case cannot inherit its price from the cell. It needs a modeled loss profile and an explicit appetite boundary.

04 · THE CELL CANNOT CHOOSE

Pause on the distinction. The category can escalate the tank case. It cannot accept the case. That is not an argument to remove the grid from the wall. It is a boundary on the grid's authority. The accountable decision begins only when a reviewer can inspect the rule, owner, price, and scenario attached to this exact hazard. The frequency-impact source node owns the matrix critique. This chapter owns what happens after the route.

05 · TEST THE NEXT CONTROL

Apply the rule to a concrete measure: an independent high-level trip that can stop feed before the tank overfills. Estimate how much it reduces the loss-of-containment path. Record its cost, disruption, uncertainty, and maintenance burden. Then record the reason to install it or the evidence that further sacrifice would be grossly disproportionate. The point is not to chant the acronym. It is to make the next control and the reason for stopping inspectable.

06 · GIVE BARRIERS OWNERS

Open the owner field by pulling the same cell into a bowtie. Overpressure, seal failure, and impact drive toward the top event: loss of containment. Release, fire, and outage spread from it. Put a preventive or mitigating barrier on every path. Then give every barrier an owner and a test date. An unowned trip, a stale seal inspection, or an untested isolation valve is now a finding the organization can act on, not a shade of red.

07 · Advertisement · Stability AI Brand Studio

For creative teams, speed only matters if the result still belongs to the brand. Stability AI brings generation and editing tools into production: image, video, audio, 3D, product photography, and campaign assets. Use Brand Studio or deploy through API, cloud, or self-hosted models, with more control over how the work is made.

08 · PUT APPETITE IN MONEY

Complete the price field with a loss-exceedance curve. Put annual loss along the bottom and the chance of exceeding it up the side. A worked example reads like a sentence: a ten-percent chance of losing more than two million euros, a one-percent chance of losing more than twenty million. Those numbers remain illustrative. Overlay the organization's appetite boundary and expose where the modeled tank-loss curve crosses it. The price is now debatable in money and probability instead of hidden inside a colour.

09 · REHEARSE THE PATH

The fourth field is a scenario. Rehearse loss of containment from the first alarm through the trip, isolation, evacuation, fire response, and restart. Remove one cue. Delay one handoff. Ask whether the named owners can still execute while the clock is running and the information is incomplete. A scenario is not another estimate. It is a test of whether the rule and barriers survive contact with the failure they were meant to control.

10 · FOUR FIELDS, ONE CASE

Return to the same loss-of-containment cell. It now has a stopping rule tested against a concrete control, barrier owners with assurance dates, a modeled loss profile against appetite, and a rehearsed scenario. Keep the matrix for cheap triage. Close the case only when those four fields agree and an accountable owner accepts the residual position. If any field is blank, the cell has still only routed the question. It has not resolved it.

01 / 10 · ONE CELL, ONE CASE0:00 / 5:36