Reliability bowtie example: critical pump failure causing unplanned shutdown
A complete, worked bowtie analysis example: 5 threats, 4 consequences, and 23 controls — 8 of them critical — around the top event, each carrying effectiveness, degradation factors, and a performance standard.
Open it read-only in the real editor → No sign-in required.
Bowtie Risk Engine writes barriers as controls and the top event as the risk — same method, stricter bookkeeping.
Critical Pump Failure Causing Unplanned Shutdown
A rotating-equipment bowtie for critical service: bearing failure, cavitation, seal failure, process upset, and ageing assets, against the production, secondary-damage, and safety consequences of an unplanned trip. The control summary shows which few controls carry the machine.
Area. Critical-service rotating equipment — main feedwater / boiler-feed / process-charge pumps
Hazard. Sudden mechanical failure of a critical pump leading to forced production outage, downstream damage, and lost revenue
Activity. Continuous duty operations with installed standby
Top event. Critical Pump Failure Causing Unplanned Shutdown — the moment control of the hazard is lost, at the knot of the bowtie.
Threats and preventive controls
Speaks RCM and asset-integrity practice: failure modes as threats, maintenance strategy as barriers.
| Threat | Control | Criticality | Effectiveness |
|---|---|---|---|
| Bearing failurePremature bearing wear or seizure due to lubrication breakdown, contamination, mis-alignment, or inadequate cooling. | Continuous vibration monitoring (online) | Critical | High |
| Lubrication management programme | Standard | High | |
| Precision alignment after maintenance | Standard | High | |
| Bearing temperature monitoring | Critical | High | |
| Cavitation / NPSH starvationInsufficient suction pressure causing cavitation, eroding impeller and seals, reducing pump head and ultimately disabling the unit. | Low-suction-pressure trip | Critical | High |
| Hydraulic system design margin | Standard | High | |
| Anti-vortex baffles in suction vessels | Standard | Medium | |
| Mechanical seal failurePremature failure of single or dual mechanical seals leading to leak, fire risk, and loss of pumping capability. | API 682 seal plan and flush system | Critical | High |
| Seal-pot and barrier-fluid monitoring | Standard | High | |
| Spare seals stocked per criticality | Standard | Medium | |
| Upstream process upsetOff-spec feed, surge, or flashing causing pump to operate outside design envelope. | Discharge flow control with low-flow protection | Critical | Medium |
| Casing temperature monitoring | Standard | High | |
| Aging-asset wear-outEnd-of-life cumulative damage — fatigue, erosion, casting defect propagation — beyond inspection-driven response. | Reliability-Centred Maintenance (RCM) programme | Standard | High |
| Asset replacement and overhaul plan | Standard | Medium |
Consequences and recovery controls
If the top event happens anyway, these are the controls that limit how bad it gets.
| Consequence | Control | Criticality | Effectiveness |
|---|---|---|---|
| Unplanned production outageForced outage of the production unit from minutes (auto changeover) to days (cold restart with damage repair). | Installed standby pump (auto-start) | Critical | High |
| Duty/standby rotation programme | Standard | High | |
| Critical spares (rotating assemblies) | Standard | High | |
| Secondary damage to coupled equipmentPump failure damages coupling, gearbox, motor, baseplate, or downstream pipework requiring extended repair. | Protective trips (over-current, over-temperature, over-vibration) | Critical | High |
| Torque-limiting / disconnect coupling | Standard | High | |
| Safety event from leak / firePump leak ignites, exposing personnel, or releases hazardous fluid leading to injury or environmental impact. | Gas / leak detection in pump area | Critical | High |
| Local fire protection (deluge / extinguisher) | Standard | High | |
| Financial impact and contractual penaltyLost production margin, overtime/repair costs, contractual delivery penalties, and insurance impact. | Business continuity / take-or-pay management | Standard | Low |
| Property and business-interruption insurance | Standard | High |
| Control | Degradation factor | Degradation control |
|---|---|---|
| Lubrication management programme | Lubricant contamination via breathers or dirty top-up containers | Desiccant breathers, sealed top-up transfer, and oil-analysis trending |
| Asset replacement and overhaul plan | Capital deferral of overhaul or replacement | Risk-cost evidence presented to the capital committee |
| Installed standby pump (auto-start) | Common-cause failure of duty and standby pumps | Segregated suction and power supplies, verified in availability study |
Continuous vibration monitoring (online)
Every control in this template carries this level of detail — this is one of the critical ones.
What it does. Permanently installed accelerometers feeding into a condition-monitoring platform with ISO 10816 alarm bands.
Performance standard — objective. Detect developing bearing degradation early through continuous vibration monitoring so intervention precedes failure.
A verification criterion. Permanently installed accelerometers feed a condition-monitoring platform with ISO 10816 alarm bands.
How it erodes. A failed or debonded accelerometer, a broken data link to the CM platform, and alarm bands left at defaults instead of ISO 10816 values for the machine class let bearing degradation develop without an alarm.
Questions about this template
Is this bowtie example free to use?
Yes. Open it read-only in the real editor with no sign-in and read every control in full. To adapt it to your own operation, start the free 3-month trial — full editor and register, work email, no credit card.
What does the template include?
5 threats, 4 consequences, and 23 controls (barriers) around the top event, plus 3 degradation factors with their own controls, and a performance standard on every control. The control register and audit-ready PDF are generated from the same model.
What standard or framework does it align with?
It translates RCM thinking into barrier form: failure modes become threats, the maintenance strategy becomes preventive controls with condition-monitoring criteria, and the operational response becomes recovery. ISO 10816 vibration zones appear where they belong — in the performance standards.
Can I export it?
Yes — PNG and SVG for slides and reports, JSON for version control, and a multi-page PDF containing the control registers, degradation factors, and performance standards. Trial exports are brand-marked.
Open this bowtie in the editor.
Read every control, criterion, and degradation factor in the live model — then adapt it to your own operation on the free 3-month trial.
More worked bowtie examples
- Process safety bowtie example: loss of containment of flammable hydrocarbon
- Aviation SMS bowtie example: loss of separation in controlled airspace
- Cyber security bowtie example: unauthorised access to a customer database
- Medical device bowtie example: unintended drug overdose from an infusion pump
- Psychosocial hazards bowtie example: uncontrolled exposure to psychosocial hazards
Or start from the template gallery.