Process safety bowtie example: loss of containment of flammable hydrocarbon
A complete, worked bowtie analysis example: 5 threats, 5 consequences, and 32 controls — 18 of them critical — around the top event, each carrying effectiveness, degradation factors, and a performance standard.
Open it read-only in the real editor → No sign-in required.
Bowtie Risk Engine writes barriers as controls and the top event as the risk — same method, stricter bookkeeping.
Loss of Containment of Flammable Hydrocarbon
This is the classic major-accident-hazard bowtie: hydrocarbon under pressure, and the handful of engineered and procedural controls that keep it inside the pipe. It is the example most process-safety teams reach for first — and the one auditors know best.
Area. Process plant — hydrocarbon pipework and pressure vessels
Hazard. Uncontrolled release of flammable hydrocarbon (liquid or vapour) leading to fire, explosion, toxic exposure, or environmental damage
Activity. Continuous operations, planned maintenance, and turnaround activities
Top event. Loss of Containment of Flammable Hydrocarbon — the moment control of the hazard is lost, at the knot of the bowtie.
Threats and preventive controls
Supports established practice across CCPS process safety, IEC 31010, and LOPA-informed control selection.
| Threat | Control | Criticality | Effectiveness |
|---|---|---|---|
| Internal corrosion of pipeworkInternal wall thinning of carbon-steel piping caused by sour service, CO2, microbial activity, or oxygenated water ingress. | Risk-Based Inspection (RBI) programme | Critical | High |
| Continuous corrosion inhibitor injection | Standard | High | |
| Material selection (CRA / cladding) | Critical | High | |
| Produced-water dehydration upstream | Standard | High | |
| External corrosion or mechanical damageExternal pitting under insulation (CUI), atmospheric corrosion in splash zones, or third-party impact during civil works. | External coating system | Standard | Medium |
| Corrosion-Under-Insulation (CUI) inspection programme | Critical | Medium | |
| Permit-to-work for civil and excavation activities | Critical | Medium | |
| Overpressure eventProcess upset, blocked outlet, fire-case heat input, or thermal expansion exceeding design pressure of pipework or vessel. | Pressure Safety Valve (PSV) | Critical | High |
| High-pressure trip (SIS) | Critical | High | |
| High-pressure alarm (BPCS) | Standard | Medium | |
| Thermal-expansion relief (small bore PSV) | Critical | Medium | |
| Maintenance / isolation errorIncorrect isolation point, premature break-of-containment, or failure to depressurise/drain before opening pipework. | Permit-to-Work (PTW) system | Critical | Medium |
| Lock-Out / Tag-Out (LOTO) | Critical | High | |
| Double Block and Bleed (DBB) for hazardous services | Standard | High | |
| Toolbox talk and JSEA | Standard | Medium | |
| Vibration-induced fatigueSmall-bore connection (SBC) failure or main-line crack from flow-induced or mechanical vibration. | SBC vibration survey | Critical | High |
| Bracing and clamp design | Standard | High |
Consequences and recovery controls
If the top event happens anyway, these are the controls that limit how bad it gets.
| Consequence | Control | Criticality | Effectiveness |
|---|---|---|---|
| Pool fireIgnited liquid pool below the release point; thermal radiation injures personnel and damages neighbouring equipment. | Gas and flame detection | Critical | High |
| Emergency Shutdown (ESD) system | Critical | High | |
| Deluge / firewater system | Standard | High | |
| Passive fire protection (PFP) | Critical | Medium | |
| Vapour cloud explosion (VCE)Confined or partially-confined ignition of a flammable vapour cloud producing overpressure damage. | Gas and flame detection | Critical | High |
| Ignition control (hazardous-area classification) | Critical | High | |
| Emergency blowdown to flare | Critical | High | |
| Toxic / asphyxiant exposureH2S or hydrocarbon-in-confined-space exposure leading to personnel injury or fatality. | H2S personal detection | Critical | High |
| Emergency escape breathing apparatus (EEBA) | Standard | High | |
| Muster and emergency response | Standard | Medium | |
| Environmental releaseLiquid hydrocarbon reaching soil, surface water, or marine environment. | Bunding and impermeable hardstand | Standard | High |
| Oil-water separator and drainage | Standard | High | |
| Spill response and containment kit | Critical | High | |
| Asset damage and production lossEquipment damage and unplanned production outage following an LOC event, even when injury is avoided. | Fire zoning and segregation | Standard | Medium |
| Business continuity plan | Standard | Low |
| Control | Degradation factor | Degradation control |
|---|---|---|
| Risk-Based Inspection (RBI) programme | Feed composition change (sourness / water cut) | RBI review triggered on any sustained process change |
| Continuous corrosion inhibitor injection | Loss of corrosion-inhibitor injection | Local low-flow alarm and weekly residual sampling |
| Pressure Safety Valve (PSV) | PSV removed from service for bench testing | Spared or bridle installation maintains relief coverage during testing |
| Emergency Shutdown (ESD) system | ESDV bypassed during operations | Bypass key controlled by the shift superintendent only |
| H2S personal detection | Flat battery or skipped bump-test on personal H2S monitor | Daily bump-test gate at the muster point; battery check on issue |
Risk-Based Inspection (RBI) programme
Every control in this template carries this level of detail — this is one of the critical ones.
What it does. API 580/581 RBI study with calculated inspection intervals for each circuit. Wall-thickness monitoring at corrosion monitoring locations (CMLs).
Performance standard — objective. Detect internal wall loss before it reaches the retirement limit, so pipework is repaired or replaced before loss of containment.
A verification criterion. Each circuit has a calculated inspection interval and defined corrosion-monitoring locations (CMLs) per API 580/581.
How it erodes. Inspection intervals extended under outage or budget pressure, CMLs that miss the actual corrosion-active location, and an inspection-data system that lags or loses readings let wall loss reach the retirement limit undetected.
Questions about this template
Is this bowtie example free to use?
Yes. Open it read-only in the real editor with no sign-in and read every control in full. To adapt it to your own operation, start the free 3-month trial — full editor and register, work email, no credit card.
What does the template include?
5 threats, 5 consequences, and 32 controls (barriers) around the top event, plus 5 degradation factors with their own controls, and a performance standard on every control. The control register and audit-ready PDF are generated from the same model.
What standard or framework does it align with?
It follows CCPS process-safety practice and IEC 31010 bowtie guidance, with controls written so a LOPA reviewer can trace each independent protection layer. Adapt the vocabulary to your own safety case.
Can I export it?
Yes — PNG and SVG for slides and reports, JSON for version control, and a multi-page PDF containing the control registers, degradation factors, and performance standards. Trial exports are brand-marked.
Open this bowtie in the editor.
Read every control, criterion, and degradation factor in the live model — then adapt it to your own operation on the free 3-month trial.
More worked bowtie examples
- Aviation SMS bowtie example: loss of separation in controlled airspace
- Cyber security bowtie example: unauthorised access to a customer database
- Medical device bowtie example: unintended drug overdose from an infusion pump
- Reliability bowtie example: critical pump failure causing unplanned shutdown
- Psychosocial hazards bowtie example: uncontrolled exposure to psychosocial hazards
Or start from the template gallery.