Bowtie analysis provides a visual way to connect the causes of a major accident event with the preventive and mitigative controls intended to manage it. When used well, it helps engineering and operations teams move beyond a list of hazards and focus on the controls that matter most.
For process facilities, Bowties are particularly useful for major accident hazards such as loss of containment, fire, explosion, toxic release, overpressure and loss of well control. They can also provide a bridge between design risk studies and operational control assurance.
What is a Bowtie analysis?
A Bowtie places a top event in the centre. Threats that can cause the top event are shown on the left, while consequences that may follow are shown on the right. Preventive barriers sit between threats and the top event; mitigative barriers sit between the top event and consequences.
The shape resembles a bow tie, which gives the method its name. The visual format is simple, but the quality depends on defining the scenario correctly and distinguishing true barriers from general management activities.
Hazard, top event and consequence are different
A common Bowtie problem is mixing these concepts. The hazard is the source of potential harm, such as pressurised hydrocarbon inventory. The top event is the point where control of that hazard is lost, such as loss of containment. The consequence is what may happen afterwards, such as flash fire, jet fire, explosion, environmental impact or personnel injury.
Keeping these definitions separate helps the team place controls on the correct side of the Bowtie and avoid circular logic.
How to identify credible threats
Threats are causes that can lead directly toward the top event. For loss of containment, examples may include corrosion, overpressure, vibration fatigue, impact, seal failure, incorrect isolation, material degradation or human error during maintenance.
Threat descriptions should be specific enough that the preventive barriers can be tested. “Mechanical failure” is often too broad. “External corrosion causing wall loss below minimum thickness” gives the team a clearer basis for identifying inspection, coating, cathodic protection or replacement controls.
What qualifies as a barrier?
A barrier should interrupt the pathway between a threat and the top event or between the top event and a consequence. Examples include pressure protection, shutdown functions, mechanical integrity controls, gas detection, emergency isolation, blowdown, fire protection and physical separation.
Statements such as “competent personnel” or “good engineering practice” may be important supporting elements, but they are not always sufficiently defined to function as a barrier. The Bowtie should identify the specific control and, where useful, the activities that maintain its performance.
Preventive barriers
Preventive barriers act before loss of control. Depending on the threat, they may include design pressure margin, corrosion management, inspection, process control, high-pressure shutdown, equipment protection systems, isolation design or procedures for critical operations.
The same barrier should not be shown against every threat unless it genuinely acts on each pathway. Barrier mapping should reflect the physical scenario rather than make the diagram look complete.
Mitigative barriers
Mitigative barriers act after the top event to reduce the likelihood or severity of consequences. Examples include gas and fire detection, emergency isolation, depressurisation, drainage, firewater, passive fire protection, separation distances, emergency response and evacuation arrangements.
Mitigation should be tied to the specific consequence. A gas detector may support isolation before a release escalates, while firewater may mitigate certain fire consequences but does not prevent ignition.
Escalation factors and controls
An escalation factor is a condition that can weaken or defeat a barrier. For example, a gas detector may be less effective if coverage is inadequate, a shutdown valve may fail if proof testing is overdue, or an emergency response barrier may be weakened by blocked access.
Escalation controls help maintain the barrier despite those challenges. Including them can make the Bowtie a useful tool for operational assurance rather than only a workshop diagram.
How Bowtie relates to HAZID and HAZOP
HAZID and HAZOP often provide the hazard scenarios from which Bowties are developed. HAZID identifies broad major hazards, while HAZOP examines detailed deviations and safeguards.
The Bowtie can consolidate this information around a major accident event and show how different controls contribute to prevention and mitigation. It should not replace the detailed scenario logic in the underlying studies.
How Bowtie relates to LOPA
A Bowtie may show several barriers, but that does not mean each qualifies for numerical credit in LOPA. LOPA has specific criteria for Independent Protection Layers and applies them to a defined cause-consequence pair.
Our article on IPLs and Risk Reduction Factors explains why a barrier can be valid on a Bowtie without necessarily receiving LOPA credit.
Critical controls and performance standards
For major accident events, organisations often identify a subset of barriers as critical controls. These controls may require performance standards defining what the barrier must do, its required availability, inspection or testing requirements, ownership and assurance activities.
This turns the Bowtie into a framework for verifying that important controls remain effective during operations. The value comes from linking the visual model to real equipment, procedures and maintenance systems.
Bowties for brownfield modifications
When a modification changes equipment, operating conditions or safeguards, existing Bowties should be reviewed to determine whether threats, top-event likelihood, consequences or barriers have changed. A Management of Change process can use the Bowtie to identify which critical controls are affected.
This is especially useful where the physical modification seems small but changes the performance of an existing protection layer.
Avoiding overcomplicated Bowties
Bowties become difficult to use when every minor cause and every procedural detail is displayed. The diagram should remain focused on credible threats, significant consequences and meaningful barriers. Supporting detail can be held in barrier registers, performance standards or linked documents.
A concise Bowtie that operations can understand is usually more valuable than an extremely complex diagram that only the workshop team can interpret.
Using Bowties through the asset lifecycle
During projects, Bowties can inform design decisions and highlight critical barriers. During operations, they can support barrier assurance, incident review, management of change and communication of major accident risk.
They also help connect engineering assurance with operational risk management. XGEN’s article on engineering reviews and better technical decisions discusses the wider value of turning technical checks into actionable project decisions.
Process safety support
Pro Engineers provides process safety support across HAZID, HAZOP, LOPA, functional safety and related risk studies. Our focus is on making the control logic clear and traceable so the output can support both design and operation.
For assistance with Bowtie development, barrier review or integration with existing hazard studies, contact Pro Engineers.