ModulesBowtie AnalysisProcess Safety
A bowtie that stays true after the workshop.Built from your HAZOP, checked against it, proven where you track barriers.
For process safety engineers and operations leads: import scenarios from HAZOP & LOPA or start from a blank page, then publish versions the crew can read. The HAZOP is never changed by the diagram.
| Threat line | Barriers |
|---|---|
T1 · Steam valve TV-201 fails open, outlet blockedHAZOP-0007 · scenario 2.1 | PAHH-201, operator isolates steamAlarm and response · Not assessed · BE-0014 · R1 verification 71 days overdue PSV-201 relief to flareRelief device · In place · BE-0012 · verified 3 Oct 2026 · next due 3 Oct 2027 |
T2 · Cold start-up below minimum design metal temperatureAdded in this bowtie | Start-up warming procedureProcedure · In place |
T3 · Liquid overfill into the vapour headerHAZOP-0007 · scenario 2.4 | ESD valve XV-201 closesShutdown · Impaired · Stroke time 18 s at last test, target 12 s |
| Consequence | Barriers |
|---|---|
C1 · Jet fire at the vessel | Deluge DV-201Fire protection · Not in place · BE-0016 · R2 failed on 21 Oct 2026, not restored |
C2 · Vapour cloud drifts toward the control room |
One bowtie, three views. An example diagram; the fields are the product’s, the values illustrative.
Where it connects
On the same loop: Barrier Management, Permit to Work, Emergency Preparedness & Response and 38 more modules in one workspace.
Method note
Declared state, or proven state? Both schools are right.
A workshop knows things no test record holds. A test record knows things no workshop remembers.
Leandro · Founder, UProcess
One school has the team declare each barrier’s condition, because the people who run the plant know which alarm everyone ignores. The other will show only what records prove, because a declared state is an opinion that ages the day it is written.
So each barrier can carry the team’s word, or the plant’s proof.
- DeclaredThe team sets In place, Impaired, Not in place, Out of service or Not assessed. Impaired, Not in place and Out of service need a note.
- ProvenLinked to a Barrier Management element, the box shows the status its proof records produce, with the reason.
Where Bowtie Analysis usually breaks
Four places a good bowtie goes wrong, and what the diagram does about each.
Training is drawn as a barrier.
Quality reviews of asset bowties keep finding degradation controls, such as training and procedures, drawn on the line as if they were barriers.
Source: Boult, Rowe and McCulloch, IChemE Hazards 30
In UProcess A barrier named like a management-system activity raises a check, with the offer to move it under a degradation factor as a control.
Check 2 · T2
Start-up warming procedure
Reads like a management-system activity. Procedures belong under a degradation factor.
Factor: “Without start-up warming procedure” · control: Start-up warming procedure
A valve is drawn alone.
The authors of the CCPS–EI bowtie guidance list lone equipment, a fire pump or an ESD valve, drawn as a barrier with no detect, decide and act behind it.
Source: Johnson, Manton, Cowley and Scanlon, IChemE Hazards 28
In UProcess Active barriers record detect, decide and act. A missing part, a threat line resting on one barrier, or a line with none each raises a check you can dismiss with a note.
ESD valve XV-201 closes · Shutdown
- Detects
- Not recorded
- Decides
- Not recorded
- Acts
- XV-201 closes
Check 3: an active barrier must detect, decide and act.
The diagram says in place. Nobody checked.
In HAZOP and LOPA a barrier is assumed to work as intended. The CCPS–EI method adds what those studies lack: tracking the barrier’s condition.
Source: Manton et al., IChemE Hazards 27
In UProcess Each barrier carries a declared state, with a note when it is less than in place. Linked to a Barrier Management element, the box shows the status its proof records produce.
T1 · barriers
The HAZOP moves on. The bowtie does not.
Auditors using bowties note that the basis of safety changes over time, and that weaknesses often come from ageing equipment and poor management of change.
Source: Anderson et al., IChemE Hazards 26
In UProcess Imported elements keep a snapshot of their HAZOP source. When it changes, the element shows “Source changed” with both values, and you take the new text, keep yours, or detach it.
Source changed · T3
- In the bowtie
- Liquid overfill into the vapour header
- In HAZOP-0007 now
- Level control LV-202 fails, liquid overfill into the vapour header
- Changed
- Text
Take the changeKeep this bow-tie’s textKeep without source
Credit and PFD always follow the HAZOP. Only text can be kept.
Bowtie BT-0004
| Version | Published | By | Note | Added | Edited | Removed | States changed |
|---|---|---|---|---|---|---|---|
| 1 | 22 Oct 2026 | Sarah Mitchell | Imported from HAZOP-0007, nodes 2 and 3 | 14 | 0 | 0 | 0 |
| 2 | 29 Oct 2026 | Sarah Mitchell | Mitigation side after the fire review | 3 | 2 | 1 | 1 |
| 3 | 4 Nov 2026 | David Chen | XV-201 impaired after stroke test | 0 | 1 | 0 | 2 |
The record an auditor asks for.
A bowtie is evidence when you can show which version the crew was briefed on.
- Published versions, read-only, each with who published it, when and a note.
- A history of every change, by person and day.
- Each imported element’s HAZOP source, what changed and what was decided.
- Every dismissed check, with the note that dismissed it.
What’s in a bowtie
- Structure
- One hazard and one top event; threat and consequence lines; barriers in order on each line; degradation factors and their controls.
- Barriers
- Type from your company list, detect, decide and act, owner, critical flag, declared state with a note.
- Sources
- Threats from HAZOP causes, consequences from HAZOP consequences, barriers from the scenario’s safeguards, each kept as a snapshot.
- Checks
- Eight quality checks, from a line with no barrier to a top event that reads like a consequence. They suggest; they never block.
- Versions
- One draft you edit, and published versions that never change.
Questions
Do I need a HAZOP to draw a bowtie?
No. Start from a blank page, or import scenarios from HAZOP & LOPA and edit the copy.
Does editing the bowtie change our HAZOP?
No. The bowtie keeps a copy and a link. Changes flow one way, and only when you take them.
Does the bowtie calculate risk?
No. Frequencies and PFDs belong to LOPA. The bowtie shows the HAZOP’s credit as a snapshot.
Can a barrier start an action?
Yes. A barrier, a degradation factor or a line can start an action in Action Tracking, and shows its open actions.