By accessing and using the bowtie models and documentation you are agreeing
to follow the conditions of use.
A summary of these terms is shown below.
You acknowledge that the models have not been developed to meet your individual requirements and that it is your responsibility to ensure that they meet your requirements
Webviewer requires Microsoft Silverlight to operate. This is a free add-on which is available
online. If this is unavailable to you, please contact your own IT department for assistance.
Webviewer allows you to navigate around the bowtie in an interactive way providing the facility
to save the files in either BowTie XP format ((.btf) – only available if you have BowTie XP
installed) or in an image format (.png). Different formats of the models are available in the
On the left hand side of Webviewer click on the bowtie file allowing the different models to expand in a list showing the Significant Seven.
Click again on one of the Significant Seven and the individual models within that category will appear. By clicking on an individual model this bowtie will appear in the Webviewer window allowing you to navigate accordingly.
Bowtie navigation can be enhanced by using the available toolbar.
The Webviewer toolbar offers two different saving formats,
When saving a picture image please be aware that it will only save what is shown on the screen at the time of saving therefore if you want to save the escalation factors on a model, you need to ensure expansion level 6 is chosen.
Click the button on the toolbar that has four arrows to display a full screen view of the
Before accessing and using the bowtie models and documentation, please ensure that you read the full licence agreement and agree to the conditions of use.
The scope of the Significant Seven Bowtie project is focused around the risks which contribute towards to the Significant Seven for UK CAT fixed wing operations (classed as large aircraft (greater than 5700kg MTOW)). The operating environment and equipment considered is quite generic and UK oriented.
Aircraft operators can be expected to encounter operating environments outside the scope of the bowtie templates during international operations and these conditions are an example of issues that should be addressed when customising the bowties.
The Significant Seven bowtie templates provide a reasonably high level overall system perspective. It should be expected that specific areas of concern to specific operators will benefit from the self development of additional bowties that target those issues.
The templates have been classed as core or supplementary. See the information on how the bowtie templates were created for details.
The core bowties have been fully completed with all eight elements and have been assessed with additional information being allocated to the elements where the supplementary bowties have been partially completed for you to complete. These models also require assessing based on your own operation.
The core bowties are:
For example, when reading a threat description such as 'mis-set reference speed' leading to a top event such as 'aircraft upset', you should consider that the mis-set is greater than one or two knots.
They are considered as part of the umbrella bowtie models except for where specific attention within a template was required (e.g. where the only significant control identified was regulatory).
The benefit of escalation factors identified in the bowtie is to provide exclamation marks to identify specific problem areas. A simple repetition of generic escalation factors on every control would not meet that goal and would degrade many of the benefits provided by the bowtie methodology.
In order to address generic issues three high level 'Umbrella Bowties' were developed which present a basic, high-level overview of the issues:
Where 'generic' escalation factors are considered to be a specific concern to a specific control, they have been included in order to highlight the issue. When customizing the bowtie template, these factors should be added or removed as appropriate to the particular operation.
The purpose of rating control effectiveness is to highlight areas of strength and weakness within the context of how a particular hazard and its associated threats and consequences are managed.
The effectiveness ratings assigned to the bowtie templates were made using the following assumptions:
The effectiveness rating in the bowtie template is intended to be a starting point for further evaluation. Individual operators should modify the effectiveness ratings as required, according to their specific operational environment.
The following taxonomy is used to define the various effectiveness ratings:
This is shown in block colour across the extra information text box below the control.
Control types illustrate the high level grouping based on the type of control, this helps illustrate what type of weak spots there are and whether there is an over-reliance in the safety system e.g. over-reliance on training or proficiency controls surrounding a particular risk.
The following taxonomy is used to define the various control types:
The information is displayed as a text box below the control.
Controls can be identified according to their function within the bowtie. These 'functions' are shown on the bowtie templates to provide clarity for the end user as well as appreciating where efforts are concentrated on (e.g. is there more we can do to eliminate the threat as the majority of control are preventative?)
The following taxonomy is used to define the various control functionalities:
The information is displayed as a text box below the Control in block colour (black background with white writing).
Not all controls will have the same importance with regard to the management of a specific threat. Within the bowtie templates, differentiation has been achieved based on two types of criticality definitions: 'standard controls' and 'critical controls'.
Similar to control effectiveness ratings, the bowtie template criticality ratings provide a starting point for further evaluation.
An additional definition included in the criticality taxonomy is 'future possibility'. This identifies a control that may not be currently available to the aviation industry at large but one that is expected to become commonly accessible (usually a technology driven, engineering type of control).
The purpose is to help 'future proof' the bowties to some extent, by identifying controls on the safety management horizon.
The following taxonomy is used to define the various criticality types:
The control "tab" depicted in the diagram is coloured (the top "tab" pinning the control to the threat/consequence/escalation line).
Somewhat similar in concept to identifying criticality for the controls, identifying exposure to the threats can add value to the bowtie by highlighting areas of greater concern overall. This technique has been applied to the bowtie templates.
The following taxonomy is used to define the exposure:
The threat exposure is depicted within the threat element and is coloured.
This feature has been used to identify the industry sector with the most significant and direct influence over the effectiveness of a particular control, such as:
The information is displayed as a text box below the control.
There are of course numerous other types of traffic
with varying degrees of technical equipment fit-out and procedural capabilities.
Reference should be made to the first threat line when considering which
controls would be applicable for the specific case.
Before accessing and using the
bowtie models and documentation, please ensure that you read the full licence
agreement and agree to the conditions of use.
Controlled Flight into
Terrain (CFIT): occurs when an airworthy aircraft under the complete control of
the pilot is inadvertently flown into terrain, water, or an obstacle.
The structure of the CFIT bowties is such that generic
issues related to arrivals and departures are considered in bowtie 3.1 'Large
CAT fixed-wing arrival or departure (general)/ Terrain separation deteriorating
below normal requirements'.
Issues specific to non-precision or precision
approaches have been addressed in their own bowties 3.2 and 3.3 respectively
(e.g. both of these bowties should be considered in conjunction with the generic
Bowtie 3.2 'Large CAT fixed wing aircraft -
Non-precision approach (especially in IMC or at night)/ Terrain separation
deteriorating below normal requirements'.
are included in the NPA bowtie because of their potential threat to safe
operations and the exposure level for UK international operators.
Separate controls have been included for detection and fire
fighting in some bowties. The function of these controls is 'dependant' e.g.
detection in and of itself does nothing to stop a fire; and fire fighting will
not commence until the fire has been detected.
The reason for depicting
the controls individually is because of the multiple escalation factors for each
control. Therefore separate controls are used in order to adequately address the
specific escalation factors for each aspect.
Threat 1. 'Electrical overheat or arcing event (e.g.
chaffing or component failure)'
Examples of potential causes include:
Threat 6 'Cargo/Baggage exposed to aircraft ignition source (e.g. defective
light bulb in hold) and ignites' shows a control relevant to ULD (unit load
device) where this control will not be available to those operators who operate
bulk loads rather than containerised.
In assigning the accountable industry sector, the bowtie
templates have assumed that dispatchers and loaders are under the direct control
of the handling agent. Naturally this may not be the case for a specific
operator and this should be customised as required.
Threat 1 'Aircraft loaded in accordance with
incorrect load instructions generated by load controller' includes three
'parallel' controls regarding the generation of an accurate load sheet e.g. one
of those controls would be expected to be in place in any given scenario, not
For example they may be quite effective at limiting passenger and crew
injuries/ fatalities following a low energy collision scenario, however they may
be ineffective in a high energy collision.
When assessing the
effectiveness of the controls within this bowtie consider how effective the
controls are regarding composite aircraft.
The threat "Ground service
equipment/ vehicle impacts and damages parked aircraft" contains many "impact
and damage detected" controls. These controls are conducted by many different
people during pre-departure inspections. It is worth noting in the escalation
factors (which need to be added) that the objectives for those different people
differ and whilst they are expected to notice damage, each inspection is focused
on different areas of the aircraft for different purposes.
Loss of aircraft control or deviation from intended flight path in-flight.
While specific values may vary among aircraft types, the following unintentional conditions generally describe an airplane upset:
Refers to the use of various data sources (e.g. FDM, Safety reports, LOSA etc.) to identify analyse and respond to safety issues.
"Aircraft unintentionally deviates from normal in-flight parameters (aircraft upset)" should be considered to be applicable to both scenarios.
The control effectiveness rating for 'upset recovery' is quite variable depending on the particular scenario. For example the Flight Crew recovery response to a low speed upset in day VMC may be very good however the same Flight Crew might not perform the recovery manoeuvres so effectively from a scenario such as an inverted attitude at night.
The effectiveness rating has been weighted towards the latter example as it is more likely to lead towards the catastrophic consequence of an unrecoverable loss of control.
TALP will be a methodology which all manufacturers, aircraft operators and ultimately all ATC agencies will use as a reference point when assessing a runways surface condition.
It becomes the starting block for determining the required landing distance shortly before landing. It is a simplified and more logical approach to the in flight calculation of landing performance than currently employed.
Control effectiveness of 'Aircraft evacuation' and 'Aerodrome Emergency Response Plan'.
Any occurrence at an aerodrome involving the incorrect presence of an aircraft vehicle or person on the protected area of a surface designated for the landing and takeoff of aircraft.
Where direct reference is available for a diagram element to EAPPRI (version 2) (European Action Prevention Plan Runway Incursion), the reference has been included for your information. Please note the document link is not live.
Control effectiveness ratings are for a typical UK aerodrome with the majority of operations being CAT type.
Recovery controls (to the right of the top event) are related with detection and avoidance manoeuvring controls being dependant (e.g. detection will be of no value unless avoiding action is taken).
Read all @UK_CAA
Pilot fined for breaching restricted Glastonbury airspace
3 February, 2017
Did Santa fill your stocking with a new drone?
30 December, 2016
CAA statement on Super Puma EC225LP and AS332L2 Airworthiness Directive
7 October, 2016
Read all News
Mandatory occurrence reporting
7 December, 2016
Guidance for flying drones
17 May, 2016
Offshore helicopter operations
12 December, 2015
Read All Blogs