Master Major Accident Hazards with Visual Bowtie Risk Analysis
The modern, blazing-fast platform for process safety, risk assessment, and dynamic barrier management.
Model hazards, track critical safety controls, simulate operational degradation, and collaborate live across engineering teams.
Every Bowtie model follows a clear, logical progression—from the normal operational energy source to the barriers that prevent loss of control and mitigate downstream consequences.
Step 01Top Center of Diagram
The Hazard: Define the Source of Energy or Harm
What is a Hazard? A Hazard is a normal operation, activity, stored energy, or substance that has the inherent potential to cause harm if control is lost. It is not the accident itself—it is the energy or material your facility manages every day.
In Bowtie RISK, you start by naming the Hazard (including operating parameters like pressure, voltage, or inventory). The Hazard node anchors the top-center of your canvas, and complex diagrams can even contain multiple Hazard clusters.
Example: High-Pressure Hydrocarbon Gas (120 bar)Example: Pressurized Ammonia Storage Tank
Step 02Central Knot of the Bowtie
The Top Event: The Exact Moment Control Is Lost
What is a Top Event? The Top Event is the pivotal moment when control or containment over the Hazard is lost—after preventive barriers have failed, but before catastrophic damage has occurred.
In Bowtie RISK, the orange-bordered Top Event card links directly beneath the Hazard at the center of the diagram. Every Threat on the left feeds into its left connector pin, and every Consequence (Outcome) on the right branches out from its right pin.
Example: Loss of Primary Containment (Gas Release)Example: Loss of Aircraft Separation
Step 03Left Wing — Proactive Side
Threats: Identify Credible Initiating Causes
What is a Threat? A Threat is a specific, independent cause or mechanism that can release the Hazard and directly trigger the Top Event if unchecked.
Click + Threat in the floating pill toolbar to add cause branches on the left side of the Top Event. Bowtie RISK automatically balances vertical spacing and draws orthogonal connection pathways into the Top Event.
What is an Outcome? Outcomes (also called Consequences) are the worst-case safety, environmental, asset, or operational impacts that result if the Top Event is not mitigated.
Select the Top Event and click + Outcome in the pill menu. Red consequence pathways branch out to the right, creating the signature two-winged Bowtie geometry.
Preventive & Recovery Barriers: Build Defense in Depth
What is a Barrier?Preventive Barriers (left wing) stop a Threat from reaching the Top Event.
Recovery / Mitigative Barriers (right wing) activate after the Top Event to minimize or block catastrophic Outcomes.
Click the + button on any Threat or Outcome card (or + Barrier in the toolbar). In the Element Inspector panel, assign Responsible Role, Effectiveness rating, Time-to-Barrier, and Holding Time (seconds)—or link to a reusable Global Master Element.
Preventive: Subsurface Safety Valve (HIPPS)Recovery: IR Gas Detection & Deluge Curtain
Step 06Barrier Vulnerability & Assurance
Escalation Factors & Mitigations: Protect Your Barriers
What are Escalation Factors & Mitigations? An Escalation Factor (Defeat Factor) is a real-world condition that can cause a Barrier to fail or degrade when needed. A Mitigation is the secondary safeguard or maintenance routine that keeps that Barrier healthy.
Click the + button on any Barrier card (or + Escalation Factor in the toolbar) to branch downward, then click + on the Escalation Factor (or + Mitigation) to attach the assurance controls that prevent barrier defeat.
Escalation Factor: Mineral Scale Jams Valve StemMitigation: Weekly Automated Partial-Stroke Test
Step 07Live Time-Based Stress Testing
Situation Runner™: Simulate Threats & Barrier Hold Times
Why Simulate a Bowtie? Static diagrams can hide timing gaps. Situation Runner™ lets your team trigger initiating Threats and watch in real time how long each Barrier holds before containing the event—or breaching into downstream consequences.
Click the ▶ Situation Runner button in the top navigation bar, select an initiating Threat in the floating HUD, and press ▶ Run Situation to watch live countdown timers, barrier challenges, and propagation particles across the canvas.
Live Countdown Timers (Hold Time in Seconds)Synced Across All Collaborators in Real Time
Enterprise Capabilities
Engineered for Reliability, Speed & Collaboration
Built from scratch with a native Rust backend and zero-dependency web frontend to eliminate lag and maximize security.
Rust-Powered High Performance
Sub-millisecond API response times, instant startup, minimal memory consumption, and complete memory safety. No heavy runtime dependencies.
Real-Time Multi-User Collaboration
Google Docs-style live co-authoring. See live cursor positions, active element focus, and remote collaborator edits instantly across team sessions.
Situation Runner™ Simulator
Stress-test operational safety. Degrade barriers, simulate ESD valve failures, monitor time-to-barrier countdowns, and train teams for live emergency drills.
Reusable Global Elements Catalog
Create standardized safety barrier libraries. Update a barrier specification once and synchronize instances across your facility diagrams.
Audit History & Version Snapshots
Immutable append-only change logs. Track every alteration by user email and timestamp with single-click snapshot revert and per-diagram undo/redo.
Cost Analysis & PDF Risk Reports
Compare barrier expenditure against effectiveness ratings, attach verification documents to elements, and export high-resolution PNG and PDF reports.
Risk AI Multi-Model Engine
Accelerate risk studies with Risk AI—supporting Microsoft Copilot, Google Gemini, Anthropic Claude, OpenAI ChatGPT, and xAI Grok. Generate starter diagrams, expand node branches, estimate barrier hold-time parameters, and audit CCPS topology with our 90% token-saving Compact DSL.
✨Intelligent Risk Engineering · Risk AI (Copilot · Gemini · Claude · ChatGPT · Grok)
Risk AI: Accelerate Workshops from Hours to Seconds
Eliminate blank-canvas paralysis and ensure CCPS & ISO 31000 rigor. Bowtie RISK's built-in Risk AI lets administrators connect their choice of the top 5 AI APIs (Microsoft Copilot, Google Gemini, Anthropic Claude, OpenAI ChatGPT, or xAI Grok) directly into risk workshops to draft scenarios, suggest missing barriers, estimate simulation parameters, and audit diagram topology in real time.
⚡
Proprietary Compact Topology DSL: Bowtie RISK compresses entire diagram trees into an ultra-dense notation, reducing token consumption by 85% to 93% compared to raw JSON. Paired with a zero-cost SHA-256 SQLite response cache for instant, sub-second responses.
01
Hazard Wizard (Natural Language Scenario to Bowtie)
Describe any operating scenario in plain English. In under two seconds, the AI generates the central Hazard, Top Event, initiating Threats, independent Preventive Barriers, Escalation Factors, Mitigations, and Consequence Outcomes with 5x5 RAM ratings.
02
Contextual Branch Expander (✨ AI Suggest)
Click ✨ on any node in your diagram. The AI analyzes upstream triggers and downstream effects to recommend context-aware next-level controls, common degradation mechanisms, and recovery safeguards with auto-balanced canvas placement.
03
Engineering Parameter & RAM Estimator
Estimates physical hold times (seconds), activation delays, and barrier lifespans calibrated for Situation Runner™ time-based simulations, along with Safety Critical Element (SCE) tags, maintenance costs, and Inherent vs. Residual risk scores.
04
CCPS / ISO 31000 Diagram Methodology Auditor
Scans full diagram topology to detect common-cause dependencies, degraded barrier clusters, and unmitigated consequences. Delivers an objective 0–100 quality score with prioritized Critical, Warning, and Optimization recommendations.
Enterprise Data Privacy: API keys are encrypted server-side in SQLite (never leaked to browser clients). Zero customer data is used for model training, and on-premise instances support private corporate API keys or complete air-gapped disabling.
CONSEQUENCETopsides Fire & Blast OverpressureRAM: E5 (Inherent) → C2 (Residual)
94AUDIT SCORE
✓ High CCPS Methodology Compliance
3 Independent preventive barriers verified · No single point of failure · All SCEs assigned
Dynamic Operational Risk
Situation Runner™: Move from Static Charts to Live Barrier Simulation
Traditional risk assessments sit in binders or static PDF files. Situation Runner turns Bowtie models into an interactive simulation HUD for emergency planning and barrier timing analysis.
Simulate Barrier Failures: Toggle any barrier between Normal, Fails on Demand, or Degraded before or during a live run.
Real-Time Escalation Timing: Configure time-to-barrier, activation delay, and barrier life in seconds and auto-order barriers along each branch.
Multi-Cluster Top Event Scoping: Select which Hazard / Top Event cluster and initiating Threats to test in complex multi-hazard diagrams.
Wherever barrier integrity and hazard visibility matter, Bowtie RISK helps engineering and safety teams map causes, controls, and consequences clearly.
🛢️ Oil, Gas & Petrochemical
Upstream offshore drilling, FPSOs, pipeline networks, LNG terminals, and refineries modeling major accident hazard (MAH) barrier chains.
✈️ Aviation & Aerospace
Flight operations, air traffic management, airport ground safety, and Safety Management System (SMS) hazard bowties.
⛏️ Mining & Heavy Industry
Tailings dam management, underground slope stability, heavy vehicle separation, and hazardous material haulage controls.
Structured around the established Bowtie methodology (IEC 31010 / ISO 31000 risk assessment techniques and CCPS barrier guidelines) to support PHA workshops, safety cases, and internal audits.
Overcoming Implementation Challenges
Traditional bowtie analysis software often stalls due to steep learning curves, isolated desktop files (.btf), and expensive per-seat licenses. Bowtie RISK solves implementation friction with instant browser onboarding, real-time collaboration, and zero desktop installations.
100% Data Sovereignty · Self-Hosted & Air-Gapped Ready
Run Your Own Private Instance On-Premise
Need strict control over sensitive safety cases, proprietary hazard registers, or internal operational risk data? While our public demo workspace at app.bowtierisk.com is hosted on Railway as a free community resource, Bowtie RISK is compiled into a single, self-contained Rust binary so your team can run a dedicated, private instance on your own infrastructure.
Zero External Cloud Dependencies: Runs 100% offline inside corporate intranets, air-gapped industrial networks, or private cloud VPCs with embedded SQLite (bowtie.db), atomic JSON workspace persistence, and local file attachments.
Single Docker Container or Native Binary: Deploy in seconds on Linux, Windows Server, macOS, or Kubernetes with a persistent data volume (DATA_DIR=/app/data) and under 50 MB of RAM overhead.
Built-In Instance Admin Portal: The first user to sign up on a fresh on-premise deployment is automatically promoted to Instance Administrator—unlocking user management, CSV bulk provisioning, company directory controls, and internal SMTP configuration.
Your Own Backup & Security Policies: Pair your on-premise volume with your organization's existing disk encryption, automated snapshot backups, reverse proxy TLS, and corporate firewall rules.
Everything you need to know about Bowtie RISK, deployment models, methodology alignment, and live simulation.
What is the Bowtie Risk Methodology?
The Bowtie method is a visual risk evaluation technique (recognized in IEC 31010 / ISO 31000 and CCPS guidelines) that maps how a Hazard can lead to a Top Event. Threats and preventive barriers sit on the left wing, while consequences (outcomes) and recovery barriers sit on the right wing. Escalation factors and mitigations capture conditions that could weaken a barrier.
What are the common bowtie software implementation challenges?
Most organizations encounter three major bottlenecks with traditional bowtie tools: 1) Desktop file lock-in: diagrams saved in proprietary local files (.btf) create version confusion across teams; 2) Prohibitive licensing & complexity: steep per-seat fees and complex menus limit diagram creation to a handful of specialists; 3) Static diagrams: once drawn, diagrams quickly become static shelfware. Bowtie RISK solves these challenges with a browser-based cloud workspace, Google Docs-style live collaboration, and the Situation Runner™ simulation engine.
How does Bowtie RISK align with ISO 31000, IEC 31010, and process safety frameworks?
Risk standards such as ISO 31000, IEC 31010 (Section B.2.2 Bowtie Analysis), CCPS Bowtie guidelines, and OSHA PSM 1910.119 define methodologies and organizational practices rather than software certifications. Bowtie RISK is purpose-built around those standard Bowtie data structures—allowing teams to document hazards, threats, preventive/recovery barriers, escalation factors, responsible roles, barrier costs, and change histories for their safety and risk governance programs.
How does Bowtie RISK compare to spreadsheets and generic drawing tools?
Spreadsheets obscure multi-branch causal relationships, while generic drawing tools lack bowtie hierarchy rules. Bowtie RISK automatically maintains parent-child barrier chains, auto-balances diagram layouts, orders barriers by response time, synchronizes reusable master elements across diagrams, and simulates barrier failures in real time.
Where is the Bowtie RISK app hosted?
Our cloud application is accessible directly at https://app.bowtierisk.com on both desktop and mobile browsers. You can create an account and start building or sharing Bowtie diagrams immediately.
Can Bowtie RISK be run on-premise or in private clouds?
Yes. Bowtie RISK compiles into a lightweight native Rust binary with embedded SQLite and atomic JSON storage. It can be deployed in a single Docker container inside isolated corporate networks or private cloud VPCs.
What can Risk AI do in Bowtie RISK?
Bowtie RISK incorporates four purpose-built Risk AI workflows supporting the top 5 AI APIs (Microsoft Copilot, Google Gemini, Anthropic Claude, OpenAI ChatGPT, and xAI Grok): 1) Hazard Wizard: Transforms natural-language scenario descriptions into full, CCPS-compliant starter Bowtie models (Hazards, Top Events, initiating Threats, independent Barriers, Escalation Factors, Mitigations, and Consequence Outcomes with 5x5 RAM ratings); 2) Contextual Branch Expander: Suggests context-aware next-level threats, barriers, and mitigations directly from any selected diagram node with automatic canvas layout; 3) Engineering Parameter & RAM Estimator: Automatically computes physical hold times (seconds), activation delays, and barrier life for Situation Runner™ simulations, along with Safety Critical Element (SCE) flags and cost estimates; 4) CCPS / ISO 31000 Diagram Auditor: Analyzes diagram topology to detect common-cause dependencies, degraded barriers, and missing recovery controls with an objective 0–100 quality score and actionable fixes.
How does Bowtie RISK optimize AI token usage and protect proprietary hazard data?
We engineered Bowtie RISK with a proprietary Compact Topology DSL that serializes diagram graphs into a concise structural format—reducing token consumption by 85% to 93% compared to raw JSON. Every request is SHA-256 hashed and cached in embedded SQLite, meaning identical or re-queried prompts consume zero API tokens and resolve instantly. For security, your Risk AI API keys (whether Copilot, Gemini, Claude, ChatGPT, or Grok) are configured exclusively by administrators and stored server-side in SQLite (never exposed to client browsers). In on-premise air-gapped deployments, Risk AI can use private enterprise keys or be disabled entirely with zero external network calls.
Ready to Proactively Eliminate Major Accident Hazards?
Build clearer, interactive Bowtie risk models with your team in minutes—no desktop installation required.
