Launch App
High-Performance Rust Engine • Real-Time Safety Collaboration

Master Major Accident Hazards with Visual Bowtie Risk Analysis

The modern, blazing-fast platform for process safety, risk assessment, and dynamic barrier management. Model hazards, track critical safety controls, simulate operational degradation, and collaborate live across engineering teams.

Launch Bowtie RISK Free How to Build a Bowtie ↓
IEC 31010 / ISO 31000 Bowtie Method
CCPS Barrier Model Architecture
✨ Gemini Flash AI Co-Pilot
Situation Runner™ Time Simulation
Real-Time Multi-User Sync
Step-by-Step Visual Walkthrough

How to Build a Bowtie Diagram in Bowtie RISK

Every Bowtie model follows a clear, logical progression—from the normal operational energy source to the barriers that prevent loss of control and mitigate downstream consequences.

Step 01 Top Center of Diagram

The Hazard: Define the Source of Energy or Harm

What is a Hazard? A Hazard is a normal operation, activity, stored energy, or substance that has the inherent potential to cause harm if control is lost. It is not the accident itself—it is the energy or material your facility manages every day.

In Bowtie RISK, you start by naming the Hazard (including operating parameters like pressure, voltage, or inventory). The Hazard node anchors the top-center of your canvas, and complex diagrams can even contain multiple Hazard clusters.

Example: High-Pressure Hydrocarbon Gas (120 bar) Example: Pressurized Ammonia Storage Tank
Step 1: Defining the Hazard in Bowtie RISK
Step 02 Central Knot of the Bowtie

The Top Event: The Exact Moment Control Is Lost

What is a Top Event? The Top Event is the pivotal moment when control or containment over the Hazard is lost—after preventive barriers have failed, but before catastrophic damage has occurred.

In Bowtie RISK, the orange-bordered Top Event card links directly beneath the Hazard at the center of the diagram. Every Threat on the left feeds into its left connector pin, and every Consequence (Outcome) on the right branches out from its right pin.

Example: Loss of Primary Containment (Gas Release) Example: Loss of Aircraft Separation
Step 2: Placing the Top Event below the Hazard in Bowtie RISK
Step 03 Left Wing — Proactive Side

Threats: Identify Credible Initiating Causes

What is a Threat? A Threat is a specific, independent cause or mechanism that can release the Hazard and directly trigger the Top Event if unchecked.

Click + Threat in the floating pill toolbar to add cause branches on the left side of the Top Event. Bowtie RISK automatically balances vertical spacing and draws orthogonal connection pathways into the Top Event.

Example: Internal CO₂ / H₂S Pipeline Corrosion Example: Thermal Overpressure (Blocked Outlet) Example: Third-Party Dropped Object Impact
Step 3: Adding Threats on the left wing in Bowtie RISK
Step 04 Right Wing — Reactive Side

Outcomes (Consequences): Map Downstream Impacts

What is an Outcome? Outcomes (also called Consequences) are the worst-case safety, environmental, asset, or operational impacts that result if the Top Event is not mitigated.

Select the Top Event and click + Outcome in the pill menu. Red consequence pathways branch out to the right, creating the signature two-winged Bowtie geometry.

Example: Vapor Cloud Ignition / Platform Flash Fire Example: Personnel Toxic Gas Exposure
Step 4: Mapping Outcomes and Consequences on the right wing in Bowtie RISK
Step 05 Left & Right Control Chains

Preventive & Recovery Barriers: Build Defense in Depth

What is a Barrier? Preventive Barriers (left wing) stop a Threat from reaching the Top Event. Recovery / Mitigative Barriers (right wing) activate after the Top Event to minimize or block catastrophic Outcomes.

Click the + button on any Threat or Outcome card (or + Barrier in the toolbar). In the Element Inspector panel, assign Responsible Role, Effectiveness rating, Time-to-Barrier, and Holding Time (seconds)—or link to a reusable Global Master Element.

Preventive: Subsurface Safety Valve (HIPPS) Recovery: IR Gas Detection & Deluge Curtain
Step 5: Inserting Preventive and Mitigative Barriers in Bowtie RISK
Step 06 Barrier Vulnerability & Assurance

Escalation Factors & Mitigations: Protect Your Barriers

What are Escalation Factors & Mitigations? An Escalation Factor (Defeat Factor) is a real-world condition that can cause a Barrier to fail or degrade when needed. A Mitigation is the secondary safeguard or maintenance routine that keeps that Barrier healthy.

Click the + button on any Barrier card (or + Escalation Factor in the toolbar) to branch downward, then click + on the Escalation Factor (or + Mitigation) to attach the assurance controls that prevent barrier defeat.

Escalation Factor: Mineral Scale Jams Valve Stem Mitigation: Weekly Automated Partial-Stroke Test
Step 6: Adding Escalation Factors and Mitigations in Bowtie RISK
Step 07 Live Time-Based Stress Testing

Situation Runner™: Simulate Threats & Barrier Hold Times

Why Simulate a Bowtie? Static diagrams can hide timing gaps. Situation Runner™ lets your team trigger initiating Threats and watch in real time how long each Barrier holds before containing the event—or breaching into downstream consequences.

Click the ▶ Situation Runner button in the top navigation bar, select an initiating Threat in the floating HUD, and press ▶ Run Situation to watch live countdown timers, barrier challenges, and propagation particles across the canvas.

Live Countdown Timers (Hold Time in Seconds) Synced Across All Collaborators in Real Time
Step 7: Running Situation Runner barrier simulation in Bowtie RISK
Enterprise Capabilities

Engineered for Reliability, Speed & Collaboration

Built from scratch with a native Rust backend and zero-dependency web frontend to eliminate lag and maximize security.

Rust-Powered High Performance

Sub-millisecond API response times, instant startup, minimal memory consumption, and complete memory safety. No heavy runtime dependencies.

Real-Time Multi-User Collaboration

Google Docs-style live co-authoring. See live cursor positions, active element focus, and remote collaborator edits instantly across team sessions.

Situation Runner™ Simulator

Stress-test operational safety. Degrade barriers, simulate ESD valve failures, monitor time-to-barrier countdowns, and train teams for live emergency drills.

Reusable Global Elements Catalog

Create standardized safety barrier libraries. Update a barrier specification once and synchronize instances across your facility diagrams.

Audit History & Version Snapshots

Immutable append-only change logs. Track every alteration by user email and timestamp with single-click snapshot revert and per-diagram undo/redo.

Cost Analysis & PDF Risk Reports

Compare barrier expenditure against effectiveness ratings, attach verification documents to elements, and export high-resolution PNG and PDF reports.

Gemini Flash AI Risk Co-Pilot

Accelerate risk studies with Google Gemini 3.8 Flash. Generate starter diagrams, expand node branches, estimate barrier hold-time parameters, and audit CCPS topology with our 90% token-saving Compact DSL.

✨ Intelligent Risk Engineering · Google Gemini 3.8 Flash

Gemini Flash AI Risk Co-Pilot: Accelerate Workshops from Hours to Seconds

Eliminate blank-canvas paralysis and ensure CCPS & ISO 31000 rigor. Bowtie RISK embeds Google's ultra-fast Gemini Flash reasoning directly into your risk workshops to draft scenarios, suggest missing barriers, estimate simulation parameters, and audit diagram topology in real time.

⚡
Proprietary Compact Topology DSL: Bowtie RISK compresses entire diagram trees into an ultra-dense notation, reducing token consumption by 85% to 93% compared to raw JSON. Paired with a zero-cost SHA-256 SQLite response cache for instant, sub-second responses.
01

Hazard Wizard (Natural Language Scenario to Bowtie)

Describe any operating scenario in plain English. In under two seconds, the AI generates the central Hazard, Top Event, initiating Threats, independent Preventive Barriers, Escalation Factors, Mitigations, and Consequence Outcomes with 5x5 RAM ratings.

02

Contextual Branch Expander (✨ AI Suggest)

Click ✨ on any node in your diagram. The AI analyzes upstream triggers and downstream effects to recommend context-aware next-level controls, common degradation mechanisms, and recovery safeguards with auto-balanced canvas placement.

03

Engineering Parameter & RAM Estimator

Estimates physical hold times (seconds), activation delays, and barrier lifespans calibrated for Situation Runner™ time-based simulations, along with Safety Critical Element (SCE) tags, maintenance costs, and Inherent vs. Residual risk scores.

04

CCPS / ISO 31000 Diagram Methodology Auditor

Scans full diagram topology to detect common-cause dependencies, degraded barrier clusters, and unmitigated consequences. Delivers an objective 0–100 quality score with prioritized Critical, Warning, and Optimization recommendations.

Enterprise Data Privacy: API keys are encrypted server-side in SQLite (never leaked to browser clients). Zero customer data is used for model training, and on-premise instances support private corporate API keys or complete air-gapped disabling.
Try AI Co-Pilot Free Explore Situation Runner™ Simulator ↓
✨ GEMINI FLASH RISK CO-PILOT HUD
● FLASH 3.8 ONLINE
USER PROMPT (NATURAL LANGUAGE SCENARIO)
“Offshore High-Pressure Gas Separator: Overpressure rupture leading to flammable vapor cloud explosion in North Sea topsides.”
⚡ DSL: 218 tokens (vs 2,490 json) • 91% saved ✓ SQLite Cache: 0ms
HAZARD (OPERATING ENERGY)
Hydrocarbon Gas Under High Pressure (115 bar, 65°C)
↓
TOP EVENT (LOSS OF CONTROL)
Loss of Primary Containment (Separator Vessel Rupture)
LEFT WING · PREVENTIVE
THREAT Wellhead Choke Failure / Blocked Outlet Line
BARRIER (SCE) HIPPS Fast-Acting Emergency Isolation Valve Hold: 45s • Delay: 1.5s
BARRIER Full-Capacity Spring Relief Valve to Flare Hold: 120s • Delay: 0.5s
RIGHT WING · MITIGATION
RECOVERY Automatic Deluge & Optical Flame Detector Trip Hold: 90s • Delay: 3.0s
CONSEQUENCE Topsides Fire & Blast Overpressure RAM: E5 (Inherent) → C2 (Residual)
94 AUDIT SCORE
✓ High CCPS Methodology Compliance
3 Independent preventive barriers verified · No single point of failure · All SCEs assigned
Dynamic Operational Risk

Situation Runner™: Move from Static Charts to Live Barrier Simulation

Traditional risk assessments sit in binders or static PDF files. Situation Runner turns Bowtie models into an interactive simulation HUD for emergency planning and barrier timing analysis.

  • Simulate Barrier Failures: Toggle any barrier between Normal, Fails on Demand, or Degraded before or during a live run.
  • Real-Time Escalation Timing: Configure time-to-barrier, activation delay, and barrier life in seconds and auto-order barriers along each branch.
  • Multi-Cluster Top Event Scoping: Select which Hazard / Top Event cluster and initiating Threats to test in complex multi-hazard diagrams.
Try Situation Runner in the App
⚡ SITUATION RUNNER™ HUD ● RUNNING (18.4s • 2x)
Top Event: Loss of Primary Containment Threat: CO₂ Corrosion
1. Corrosion Inhibitor Injection BREACHED (FAIL ON DEMAND)
2. Subsea Emergency Shutdown (ESDV) 🛡️ HOLDING (24.6s LEFT)
3. IR Gas Detection & Deluge STANDBY (POST-EVENT)
High-Hazard Sectors

Built for Complex Industrial & Operational Risk

Wherever barrier integrity and hazard visibility matter, Bowtie RISK helps engineering and safety teams map causes, controls, and consequences clearly.

🛢️ Oil, Gas & Petrochemical

Upstream offshore drilling, FPSOs, pipeline networks, LNG terminals, and refineries modeling major accident hazard (MAH) barrier chains.

✈️ Aviation & Aerospace

Flight operations, air traffic management, airport ground safety, and Safety Management System (SMS) hazard bowties.

⛏️ Mining & Heavy Industry

Tailings dam management, underground slope stability, heavy vehicle separation, and hazardous material haulage controls.

⚡ Energy & Power Generation

thermal & renewable generation, hydrogen storage, high-voltage substations, and turbine trip barrier verification.

🧪 Chemical & Manufacturing

Process Hazard Analysis (PHA) workshops, loss of containment modeling, and preventive/recovery barrier documentation.

🏥 Healthcare & Bio-Safety

Clinical safety pathways, infection prevention barriers, and high-consequence laboratory containment workflows.

Operational Risk & Barrier Governance

Bowtie Software for Operational Risk & Barrier Tracking

Bridge the divide between risk workshops, safety engineering, and day-to-day barrier ownership.

Operational Risk Management

Transform passive risk registers into interactive visual barrier models. Track barrier effectiveness, assign responsible roles, attach verification files, and simulate barrier degradation.

Standard Bowtie Methodology

Structured around the established Bowtie methodology (IEC 31010 / ISO 31000 risk assessment techniques and CCPS barrier guidelines) to support PHA workshops, safety cases, and internal audits.

Overcoming Implementation Challenges

Traditional bowtie analysis software often stalls due to steep learning curves, isolated desktop files (.btf), and expensive per-seat licenses. Bowtie RISK solves implementation friction with instant browser onboarding, real-time collaboration, and zero desktop installations.

100% Data Sovereignty · Self-Hosted & Air-Gapped Ready

Run Your Own Private Instance On-Premise

Need strict control over sensitive safety cases, proprietary hazard registers, or internal operational risk data? While our public demo workspace at app.bowtierisk.com is hosted on Railway as a free community resource, Bowtie RISK is compiled into a single, self-contained Rust binary so your team can run a dedicated, private instance on your own infrastructure.

  • Zero External Cloud Dependencies: Runs 100% offline inside corporate intranets, air-gapped industrial networks, or private cloud VPCs with embedded SQLite (bowtie.db), atomic JSON workspace persistence, and local file attachments.
  • Single Docker Container or Native Binary: Deploy in seconds on Linux, Windows Server, macOS, or Kubernetes with a persistent data volume (DATA_DIR=/app/data) and under 50 MB of RAM overhead.
  • Built-In Instance Admin Portal: The first user to sign up on a fresh on-premise deployment is automatically promoted to Instance Administrator—unlocking user management, CSV bulk provisioning, company directory controls, and internal SMTP configuration.
  • Your Own Backup & Security Policies: Pair your on-premise volume with your organization's existing disk encryption, automated snapshot backups, reverse proxy TLS, and corporate firewall rules.
Open On-Premise Portal & Get License Key Try Cloud Instance First
on-premise-deploy.sh — bash
# 1. Build the App-Only On-Premise container image
$ docker build -f Dockerfile.onprem -t bowtierisk-onprem:latest .

# 2. Run on your internal server with BOWTIE_MODE=onprem
$ docker run -d --name bowtierisk \
  -p 8000:8000 \
  -e BOWTIE_MODE=onprem \
  -e DATA_DIR=/app/data \
  -v /srv/bowtierisk/data:/app/data \
  --restart unless-stopped \
  bowtierisk-onprem:latest

# 3. Activate your .btlic license key in Admin Console
✓ App-Only On-Premise mode active (no marketing pages)
✓ Automatic online updates & offline .btupdate ready
Runtime Rust / Axum (Single Binary)
Storage Engine Embedded SQLite + JSON
Network Mode 100% Offline / Air-Gapped
License MIT Open-Source
Got Questions?

Frequently Asked Questions

Everything you need to know about Bowtie RISK, deployment models, methodology alignment, and live simulation.

What is the Bowtie Risk Methodology?

The Bowtie method is a visual risk evaluation technique (recognized in IEC 31010 / ISO 31000 and CCPS guidelines) that maps how a Hazard can lead to a Top Event. Threats and preventive barriers sit on the left wing, while consequences (outcomes) and recovery barriers sit on the right wing. Escalation factors and mitigations capture conditions that could weaken a barrier.

What are the common bowtie software implementation challenges?

Most organizations encounter three major bottlenecks with traditional bowtie tools: 1) Desktop file lock-in: diagrams saved in proprietary local files (.btf) create version confusion across teams; 2) Prohibitive licensing & complexity: steep per-seat fees and complex menus limit diagram creation to a handful of specialists; 3) Static diagrams: once drawn, diagrams quickly become static shelfware. Bowtie RISK solves these challenges with a browser-based cloud workspace, Google Docs-style live collaboration, and the Situation Runner™ simulation engine.

How does Bowtie RISK align with ISO 31000, IEC 31010, and process safety frameworks?

Risk standards such as ISO 31000, IEC 31010 (Section B.2.2 Bowtie Analysis), CCPS Bowtie guidelines, and OSHA PSM 1910.119 define methodologies and organizational practices rather than software certifications. Bowtie RISK is purpose-built around those standard Bowtie data structures—allowing teams to document hazards, threats, preventive/recovery barriers, escalation factors, responsible roles, barrier costs, and change histories for their safety and risk governance programs.

How does Bowtie RISK compare to spreadsheets and generic drawing tools?

Spreadsheets obscure multi-branch causal relationships, while generic drawing tools lack bowtie hierarchy rules. Bowtie RISK automatically maintains parent-child barrier chains, auto-balances diagram layouts, orders barriers by response time, synchronizes reusable master elements across diagrams, and simulates barrier failures in real time.

Where is the Bowtie RISK app hosted?

Our cloud application is accessible directly at https://app.bowtierisk.com on both desktop and mobile browsers. You can create an account and start building or sharing Bowtie diagrams immediately.

Can Bowtie RISK be run on-premise or in private clouds?

Yes. Bowtie RISK compiles into a lightweight native Rust binary with embedded SQLite and atomic JSON storage. It can be deployed in a single Docker container inside isolated corporate networks or private cloud VPCs.

What can the Gemini Flash AI Risk Co-Pilot do in Bowtie RISK?

Bowtie RISK incorporates four purpose-built AI workflows powered by Google Gemini 3.8 Flash: 1) Hazard Wizard: Transforms natural-language scenario descriptions into full, CCPS-compliant starter Bowtie models (Hazards, Top Events, initiating Threats, independent Barriers, Escalation Factors, Mitigations, and Consequence Outcomes with 5x5 RAM ratings); 2) Contextual Branch Expander: Suggests context-aware next-level threats, barriers, and mitigations directly from any selected diagram node with automatic canvas layout; 3) Engineering Parameter & RAM Estimator: Automatically computes physical hold times (seconds), activation delays, and barrier life for Situation Runner™ simulations, along with Safety Critical Element (SCE) flags and cost estimates; 4) CCPS / ISO 31000 Diagram Auditor: Analyzes diagram topology to detect common-cause dependencies, degraded barriers, and missing recovery controls with an objective 0–100 quality score and actionable fixes.

How does Bowtie RISK optimize AI token usage and protect proprietary hazard data?

We engineered Bowtie RISK with a proprietary Compact Topology DSL that serializes diagram graphs into a concise structural format—reducing token consumption by 85% to 93% compared to raw JSON. Every request is SHA-256 hashed and cached in embedded SQLite, meaning identical or re-queried prompts consume zero API tokens and resolve instantly. For security, your Google Gemini API key is configured exclusively by administrators and stored server-side in SQLite (never exposed to client browsers). In on-premise air-gapped deployments, AI features can use private enterprise keys or be disabled entirely with zero external network calls.

Ready to Proactively Eliminate Major Accident Hazards?

Build clearer, interactive Bowtie risk models with your team in minutes—no desktop installation required.

Access App on app.bowtierisk.com Terms & MIT Disclaimer