Skip to content
flowss
Start freeChecking your session
Bowtie risk templates

Bowtie — LPG Storage Loss of Containment

COMAH-style bowtie for a 68-tonne LPG bullet: 0.43 loss-of-containment opportunities a year cut to a 0.0231/yr top event, ranking the independent high-level fill trip as the most critical barrier on site and flagging its proof-test bypass as an unmanaged escalation factor.

Bowtie riskRisk & ReliabilityBowtie risk syntax docs
Template previewBowtie risk
Loss of containment — LPG bullet storageHAZARD68 te of LPG stored as a liquid at 7 bargTHREATSPREVENTIVE BARRIERSRECOVERY BARRIERSCONSEQUENCESInspection deferred to the nextturnaroundDeferral needs integrityengineer sign-offRisk-based inspectionprogramme80% · detectionCathodic protection onthe vessel skirt55%Insulation claddingsealed and drained40%Trip left in bypass after prooftestingIndependent high-leveltrip on the fill valve90% · controlDriver-operated deadmanon the transfer hose50%Crash barrier andbollards around the bund85%Site traffic plan andone-way system45%Dual PSVs on a changeoverspool90%Water deluge on thevessel shell50% · mitigationDetector heads fouled by saltsprayWeekly bump test on theseaward headsGas detection voting 2oo3with automatic ESD85% · detectionIgnition source controlin the hazardous zone60%Blast-resistant occupiedbuildings at 60 m35% · mitigationFixed deluge holding theshell below 200 C70% · mitigationRemote emergencyisolation by the operator55% · controlFlame-retardant PPE andexclusion zone40% · mitigationCOMAH off-site emergencyplan with the LRF50% · recoveryPublic warning siren andshelter-in-place advice45% · recoveryCorrosion underinsulation of thevessel wall0.08/yr → 0.00432/yrOverfilling during aroad tanker delivery0.25/yr → 0.0125/yrVehicle impact on thevessel supports0.04/yr → 0.0033/yrRelief valve fails toreseat after a thermalexcursion0.06/yr → 0.003/yrVapour cloudexplosion in the tankfarmsev 5 · risk 0.004508BLEVE of the storagebulletsev 5 · risk 0.0156Flash fire injuringthe tanker driversev 4 · risk 0.0555Off-site evacuationof the neighbouringestatesev 3 · risk 0.0191Loss ofcontainmentfrom the bullet0.0231/yrtop-event frequencyTop event0.0231/yrinherent 0.43/yrResidual risk0.0947inherent 7.31Risk reduction98.7%threat side 94.6%Barriers174 threats · 4 consequencesDominant threatOverfilling during a road tanker delive…54.1% of the top eventResidual risk 0.0947 against an inherent 7.31 — the barriers remove 98.7% of it. 2 things are probably not what was meant — every path and every escalation factor was checked.Barrier criticality — residual risk if that one barrier were removed1. Independent high-level trip on the fill valve+0.4607 ×5.92. Dual PSVs on a changeover spool+0.1106 ×2.23. Crash barrier and bollards around the bund+0.0766 ×1.84. Risk-based inspection programme+0.0708 ×1.75. Driver-operated deadman on the transfer hose+0.0512 ×1.56. Flame-retardant PPE and exclusion zone+0.037 ×1.4FindingsConsequence "Flash fire injuring the tanker driver" rests on ONE barrier. Defence in depth is the claim a bowtie is drawn to make, and a single barrier is a single point of failure: the day it fails is the day the consequence lands in fu…Escalation factor "Trip left in bypass after proof testing" degrades barrier "Independent high-level trip on the fill valve" and nothing is holding it off. The 90% credited to that barrier — and every figure computed from it — assumes th…Each of the 4 consequences is credited the full top-event frequency of 0.0231/yr — the model here is that one top event produces all of them, so the residual score of 0.0947 adds 4 outcomes to one event. That is right when they happen to…

Make it your own.

title "Loss of containment — LPG bullet storage"
hazard "68 te of LPG stored as a liquid at 7 barg"
top "Loss of containment from the bullet"
unit "/yr"

threat "Corrosion under insulation of the vessel wall" likelihood: 0.08 {
  barrier "Risk-based inspection programme" effectiveness: 0.8 type: detection {
    escalation "Inspection deferred to the next turnaround" {
      control "Deferral needs integrity engineer sign-off"
    }
  }
  barrier "Cathodic protection on the vessel skirt" effectiveness: 0.55
  barrier "Insulation cladding sealed and drained" effectiveness: 0.4
}

threat "Overfilling during a road tanker delivery" likelihood: 0.25 {
  barrier "Independent high-level trip on the fill valve" effectiveness: 0.9 type: control {
    escalation "Trip left in bypass after proof testing"
  }
  barrier "Driver-operated deadman on the transfer hose" effectiveness: 0.5
}

threat "Vehicle impact on the vessel supports" likelihood: 0.04 {
  barrier "Crash barrier and bollards around the bund" effectiveness: 0.85
  barrier "Site traffic plan and one-way system" effectiveness: 0.45
}

threat "Relief valve fails to reseat after a thermal excursion" likelihood: 0.06 {
  barrier "Dual PSVs on a changeover spool" effectiveness: 0.9
  barrier "Water deluge on the vessel shell" effectiveness: 0.5 type: mitigation
}

consequence "Vapour cloud explosion in the tank farm" severity: 5 {
  barrier "Gas detection voting 2oo3 with automatic ESD" effectiveness: 0.85 type: detection {
    escalation "Detector heads fouled by salt spray" {
      control "Weekly bump test on the seaward heads"
    }
  }
  barrier "Ignition source control in the hazardous zone" effectiveness: 0.6
  barrier "Blast-resistant occupied buildings at 60 m" effectiveness: 0.35 type: mitigation
}

consequence "BLEVE of the storage bullet" severity: 5 {
  barrier "Fixed deluge holding the shell below 200 C" effectiveness: 0.7 type: mitigation
  barrier "Remote emergency isolation by the operator" effectiveness: 0.55 type: control
}

consequence "Flash fire injuring the tanker driver" severity: 4 {
  barrier "Flame-retardant PPE and exclusion zone" effectiveness: 0.4 type: mitigation
}

consequence "Off-site evacuation of the neighbouring estate" severity: 3 {
  barrier "COMAH off-site emergency plan with the LRF" effectiveness: 0.5 type: recovery
  barrier "Public warning siren and shelter-in-place advice" effectiveness: 0.45 type: recovery
}