We use necessary cookies to make our website work. We'd also like to use optional cookies to understand how you use it, and to help us improve it.

For more information, please read our cookie policy.

The bowtie model consists of different elements that build up the safety risk picture. The safety risk picture revolves around the hazard (something in, around or part of an organisation or activity which has the potential to cause damage or harm) and the top event (the release or loss of control over a hazard known as the undesired system state).

Consideration is then turned to the threats (a possible direct cause for the top event), consequences (results of the top event directly ending in loss or damage) and the controls (any measure taken which acts against some undesirable force or intention).

The controls can be populated on either side of the model showing:

Left hand side of the model Right hand side of the model

Preventative measures which eliminate the threat entirely or prevent the threat from causing the top event recovery

Measures which reduce the likelihood of the consequence owing to the top event being "live" or mitigate the severity of the consequence

The bowtie model explores the escalation factors (the reasoning to why a control may be defeated or less effective) of all controls allowing the allocation of escalation factor controls. These prevent the escalation factors having an impact on the prevention or recovery controls. Further attributes, such as control effectiveness or criticality can be allocated to the bowtie model to evaluate the safety risk picture as part of an effective SMS.

A further explanation is provided by CGE Solutions.

An everyday example bowtie is shown below to demonstrate this explanation. Further guidance is provided in the next chapter called on “the bowtie elements”.