Access the bowtie templates

• internal business use only
• written consent is required if you wish to use the models outside of your organisation
• the models should only be used for the purposes in which they are designed
  (i.e. for safety management within your organisation)

• The CAA remains the intellectual owner of the models
• Please refer to copyright notice

You acknowledge that the models have not been developed to meet your individual requirements and that it is your responsibility to ensure that they meet your requirements

On the left hand side of Webviewer click on the bowtie file allowing the different models to expand in a list showing the Significant Seven.

Click again on one of the Significant Seven and the individual models within that category will appear. By clicking on an individual model this bowtie will appear in the Webviewer window allowing you to navigate accordingly.

Bowtie navigation can be enhanced by using the available toolbar.

You can:

• zoom in and out of the bowtie,
• make the bowtie full screen,
• expand levels to easily view the content of the model,
• choose the display profile (to see the "additional information" on the threats and controls (e.g. effectiveness etc))
  and
• save the bowtie models to your personal computer.

The Webviewer toolbar offers two different saving formats,

• a picture image of a single bowtie
  or
• a download of the whole bowtie case file containing all of the bowties (for BowTie XP users only).

When saving a picture image please be aware that it will only save what is shown on the screen at the time of saving therefore if you want to save the escalation factors on a model, you need to ensure expansion level 6 is chosen.

Before accessing and using the bowtie models and documentation, please ensure that you read the full licence agreement and agree to the conditions of use.

The scope of the Significant Seven Bowtie project is focused around the risks which contribute towards to the Significant Seven for UK CAT fixed wing operations (classed as large aircraft (greater than 5700kg MTOW)). The operating environment and equipment considered is quite generic and UK oriented.

Aircraft operators can be expected to encounter operating environments outside the scope of the bowtie templates during international operations and these conditions are an example of issues that should be addressed when customising the bowties.

The Significant Seven bowtie templates provide a reasonably high level overall system perspective. It should be expected that specific areas of concern to specific operators will benefit from the self development of additional bowties that target those issues.

The templates have been classed as core or supplementary. See the information on how the bowtie templates were created for details.
The core bowties have been fully completed with all eight elements and have been assessed with additional information being allocated to the elements where the supplementary bowties have been partially completed for you to complete. These models also require assessing based on your own operation.

The core bowties are:

• Loss of Control: 1.1 Aircraft upset (human performance)
• Runway Excursion: 2.1 Inability to stop within distance (landing operations)
• CFIT: 3.1 Terrain separation deteriorating below normal requirements (arrival or departure (general))
• Runway Incursion: 4.1 Incorrect presence of aircraft on protected area (ground operations)
• Airborne Conflict: 5.1 Close proximity with another aircraft (Class A airspace)
• Ground Handling: 6.1 Outside mass and balance envelope (Loading operations)
• Fire: 7.1 Hidden area fire (aircraft electrical systems)

Focus on Operational Safety

• The bowtie templates are primarily concerned with operational safety scenarios. This is reflected in the various diagram elements.
  
  
• For example, consequences identify events that have primarily a negative safety outcome rather than solely commercial or environmental outcomes.

Level of Detail in Threats and Consequences

• The threats and consequences seek to be of a sufficiently high level to include the often broad scope of the issues involved within a reasonable number of bowties, yet specific enough to provide useful and relevant operational insights.

Threat Significance

• It should be taken as a given that the scale of the problem described in the Threat is significant.

For example, when reading a threat description such as 'mis-set reference speed' leading to a top event such as 'aircraft upset', you should consider that the mis-set is greater than one or two knots.

Training and Proficiency

• Controls associated with basic training on equipment, procedures, rules and regulations are not generally included in the bowties. They are considered as part of the umbrella bowtie models except for where specific attention within a bowtie template was required.

Regulator Oversight

• Controls associated with the assurance of adequate standards via regulatory oversight are not generally included in the bowties.

They are considered as part of the umbrella bowtie models except for where specific attention within a template was required (e.g. where the only significant control identified was regulatory).

Aircraft and Equipment Types

• The bowtie templates are not aircraft or equipment type specific.
• Aircraft operators should customise the elements as required reflecting the type of equipment in use.

Umbrella Bowties

The benefit of escalation factors identified in the bowtie is to provide exclamation marks to identify specific problem areas. A simple repetition of generic escalation factors on every control would not meet that goal and would degrade many of the benefits provided by the bowtie methodology.

In order to address generic issues three high level 'Umbrella Bowties' were developed which present a basic, high-level overview of the issues:

• Technical Factors
• Human Factors
• Environmental Factors

Where 'generic' escalation factors are considered to be a specific concern to a specific control, they have been included in order to highlight the issue. When customizing the bowtie template, these factors should be added or removed as appropriate to the particular operation.

The purpose of rating control effectiveness is to highlight areas of strength and weakness within the context of how a particular hazard and its associated threats and consequences are managed.

The effectiveness ratings assigned to the bowtie templates were made using the following assumptions:

• That the control is actually in place and functioning as might be typically encountered (e.g. if the control is a piece of equipment, it is assumed to be installed/ available).
  
  
• The rating is based on how the control might typically be encountered not according to the best possible effectiveness e.g. whilst a control may be rated as poor in the bowtie template, that is not to say that it does not have the potential to be better than poor given adequate resourcing and effort.
  
  
• The party having ownership of the control is a UK entity (e.g. international operations and operators introduce a degree of complexity to the control effectiveness rating process that is not possible to cover in the bowtie templates. 

The effectiveness rating in the bowtie template is intended to be a starting point for further evaluation. Individual operators should modify the effectiveness ratings as required, according to their specific operational environment.

Taxonomy and display

The following taxonomy is used to define the various effectiveness ratings:

• Very Good (dark green)
• Good (light green)
• Poor (orange)
• Very Poor (red)
• Un-assessed (yellow) 

This is shown in block colour across the extra information text box below the control.

Control types illustrate the high level grouping based on the type of control, this helps illustrate what type of weak spots there are and whether there is an over-reliance in the safety system e.g. over-reliance on training or proficiency controls surrounding a particular risk.

Taxonomy and display

The following taxonomy is used to define the various control types:

• Policy/Procedure: For controls that rely primarily on a person to perform a particular action according to a pre-determined procedure or policy which may be based on regulation
  
  
• Engineered devices: for controls that rely primarily on technical equipment such as FMS, TCAS, TAWS or interlocks on thrust levers.
  
  
• Training/ proficiency: for controls that seek to assure an action is performed to a certain standard.
  
  
• Human sensory: for controls where a human's sight/hear/taste/smell/touch is used outside of procedures.

The information is displayed as a text box below the control.

Controls can be identified according to their function within the bowtie. These 'functions' are shown on the bowtie templates to provide clarity for the end user as well as appreciating where efforts are concentrated on (e.g. is there more we can do to eliminate the threat as the majority of control are preventative?)

Taxonomy and display

The following taxonomy is used to define the various control functionalities:

• elimination
• prevention
• reduction
• mitigation 

The information is displayed as a text box below the Control in block colour (black background with white writing).

Not all controls will have the same importance with regard to the management of a specific threat. Within the bowtie templates, differentiation has been achieved based on two types of criticality definitions: 'standard controls' and 'critical controls'.

Similar to control effectiveness ratings, the bowtie template criticality ratings provide a starting point for further evaluation.

Future Possibilities

An additional definition included in the criticality taxonomy is 'future possibility'. This identifies a control that may not be currently available to the aviation industry at large but one that is expected to become commonly accessible (usually a technology driven, engineering type of control).

The purpose is to help 'future proof' the bowties to some extent, by identifying controls on the safety management horizon.

Taxonomy and display

The following taxonomy is used to define the various criticality types:

• High Criticality (red)
• Standard Criticality (grey)
• Future Possibilities (white textured) 

The control "tab" depicted in the diagram is coloured (the top "tab" pinning the control to the threat/consequence/escalation line). 

Somewhat similar in concept to identifying criticality for the controls, identifying exposure to the threats can add value to the bowtie by highlighting areas of greater concern overall. This technique has been applied to the bowtie templates.

Taxonomy and display

The following taxonomy is used to define the exposure:

• Constant Exposure - where the potential to be exposed exists throughout the majority of every flight e.g. Flt Crew failing to follow an ATCO instruction;
  
  
• Commonly Exposed - where the potential to be exposed is likely to be once or twice during every flight e.g. incorrect takeoff configuration selected;
  
  
• Limited Exposure (yellow) - where the potential to be exposed is likely to be less frequent e.g. conducting an NPA. 

The threat exposure is depicted within the threat element and is coloured.

This feature has been used to identify the industry sector with the most significant and direct influence over the effectiveness of a particular control, such as:

• Aerodrome Operator
• Aircraft Operator
• ANSP (Air Navigation Service Provider)
• Approved Design Organisation
• Handling Agent
• Manufacturer
• Misc. Third Party
• MRO (Maintenance Repair Organisation)
• Regulator 

The information is displayed as a text box below the control. 

Bowtie 5.2 'CAT fixed wing aircraft operations whilst airborne in UK Class G airspace'

• Threat 1 'Conflicting CAT traffic' includes three 'parallel' controls regarding to ATCO services e.g. one of those controls would be expected to be in place in any given scenario, not all three.
• CAT traffic represents the 'best case scenario' with regards to the type of traffic that may be encountered in UK Class G airspace (e.g. the maximum depth of controls).
• Threat 2 'Conflicting traffic is a non-radio or transponder equipped sport/recreational aircraft which is not detected by surveillance radar'. This traffic represents the 'worst case scenario' regarding the type of traffic that may be encountered in UK Class G airspace (e.g. the minimum depth of controls).
• Threat 3 'Conflicting traffic is military fast jet traffic' is included in order to highlight another type of traffic that may be difficult to manage from the CAT operator's perspective.

There are of course numerous other types of traffic with varying degrees of technical equipment fit-out and procedural capabilities. Reference should be made to the first threat line when considering which controls would be applicable for the specific case.

Before accessing and using the bowtie models and documentation, please ensure that you read the full licence agreement and agree to the conditions of use.

Controlled Flight into Terrain (CFIT): occurs when an airworthy aircraft under the complete control of the pilot is inadvertently flown into terrain, water, or an obstacle.

General Notes

The structure of the CFIT bowties is such that generic issues related to arrivals and departures are considered in bowtie 3.1 'Large CAT fixed-wing arrival or departure (general)/ Terrain separation deteriorating below normal requirements'.

Issues specific to non-precision or precision approaches have been addressed in their own bowties 3.2 and 3.3 respectively (e.g. both of these bowties should be considered in conjunction with the generic issues).

Bowtie 3.2 'Large CAT fixed wing aircraft - Non-precision approach (especially in IMC or at night)/ Terrain separation deteriorating below normal requirements'.

Circling approaches are included in the NPA bowtie because of their potential threat to safe operations and the exposure level for UK international operators.

Separate controls have been included for detection and fire fighting in some bowties. The function of these controls is 'dependant' e.g. detection in and of itself does nothing to stop a fire; and fire fighting will not commence until the fire has been detected.

The reason for depicting the controls individually is because of the multiple escalation factors for each control. Therefore separate controls are used in order to adequately address the specific escalation factors for each aspect.

Bowtie 7.1 'Aircraft Electrical Systems on large CAT fixed wing aircraft/ Hidden area fire becomes established'

Threat 1. 'Electrical overheat or arcing event (e.g. chaffing or component failure)'

Examples of potential causes include:

• Inappropriate modifications
• Wiring damage during maintenance activities
• Degraded insulation due to the operating environment (e.g. contact with hydraulic fluid, vibration etc)
  Tools being forgotten on the aircraft. etc
• Therefore there are several 'elimination' controls; each has been rated for it's effectiveness in relation to the aspect of the threat that it addresses not for its effectiveness in eliminating the threat entirely.

Bowtie 7.2 'Combustible materials in the cargo compartment on large CAT fixed wing aircraft / Cargo compartment fire'

Threat 6 'Cargo/Baggage exposed to aircraft ignition source (e.g. defective light bulb in hold) and ignites' shows a control relevant to ULD (unit load device) where this control will not be available to those operators who operate bulk loads rather than containerised.

In assigning the accountable industry sector, the bowtie templates have assumed that dispatchers and loaders are under the direct control of the handling agent. Naturally this may not be the case for a specific operator and this should be customised as required.

• The term "manoeuvring area" refers to apron/ramp areas and taxiways
• The term "Ground Service Equipment" refers to equipment used during the aircraft turnaround typically used by a Ground Service Provider (including loaders, refuellers, de-icers, cleaners, caterers, push-back staff etc) such as belt loader, stairs, jetty, de-icing boom etc.
• The term "Pre-departure inspection" is an inspection conducted by anyone within the aviation industry which is completed before the tug is cleared (if appropriate) and the aircraft is under its own power.
• The term "Ground Handling" is an activity which stops when the aircraft is under its own power (unless it is being marshalled)

Bowtie 6.1 'Loading operations for large CAT fixed wing aircraft at UK Aerodromes/ Aircraft significantly outside the operational mass and balance envelope'

Threat 1 'Aircraft loaded in accordance with incorrect load instructions generated by load controller' includes three 'parallel' controls regarding the generation of an accurate load sheet e.g. one of those controls would be expected to be in place in any given scenario, not all three.

• Control effectiveness of 'Aircraft evacuation' and 'Aerodrome Emergency Response Plan'.
  • The effectiveness of these controls is quite variable depending on the particular scenario.

For example they may be quite effective at limiting passenger and crew injuries/ fatalities following a low energy collision scenario, however they may be ineffective in a high energy collision.

Bowtie 6.2 'Ground operations for large CAT fixed wing aircraft at UK Aerodromes / Significant ground damage undetected prior to aircraft commencing take-off'.

When assessing the effectiveness of the controls within this bowtie consider how effective the controls are regarding composite aircraft.

The threat "Ground service equipment/ vehicle impacts and damages parked aircraft" contains many "impact and damage detected" controls. These controls are conducted by many different people during pre-departure inspections. It is worth noting in the escalation factors (which need to be added) that the objectives for those different people differ and whilst they are expected to notice damage, each inspection is focused on different areas of the aircraft for different purposes.

Definitions

Loss of Control

Loss of aircraft control or deviation from intended flight path in-flight.

Upset

While specific values may vary among aircraft types, the following unintentional conditions generally describe an airplane upset:

• pitch attitude greater than 25 deg. nose up
• pitch attitude greater than 10 deg. nose down
• bank angle greater than 45 deg
• within the above parameters, but flying at airspeeds inappropriate for the conditions.

Safety intelligence

Refers to the use of various data sources (e.g. FDM, Safety reports, LOSA etc.) to identify analyse and respond to safety issues.

General Notes

Phase of flight

• Events on or very close to the runway, have been captured as loss of directional control events in the runway excursion bowties.

'Loss of Control' includes:

• Externally generated aircraft upset events; and
• Deviation from the intended flight path, which may be due to mishandling or to the aircraft's inability to maintain normal flight
  (e.g. following a multiple engine failure).

The Top Event

"Aircraft unintentionally deviates from normal in-flight parameters (aircraft upset)" should be considered to be applicable to both scenarios.

Effectiveness rating for 'Upset recovery' controls

The control effectiveness rating for 'upset recovery' is quite variable depending on the particular scenario. For example the Flight Crew recovery response to a low speed upset in day VMC may be very good however the same Flight Crew might not perform the recovery manoeuvres so effectively from a scenario such as an inverted attitude at night.

The effectiveness rating has been weighted towards the latter example as it is more likely to lead towards the catastrophic consequence of an unrecoverable loss of control.

Definitions 

• Go-Around: a manoeuvre that results when a pilot decides to abort an approach or landing. 

General Notes 

Future control: Transport Aeroplane Landing Performance Assessment (TALPA)

TALP will be a methodology which all manufacturers, aircraft operators and ultimately all ATC agencies will use as a reference point when assessing a runways surface condition.

It becomes the starting block for determining the required landing distance shortly before landing.  It is a simplified and more logical approach to the in flight calculation of landing performance than currently employed.

Bowtie 2.1 'Large CAT fixed wing aircraft - Landing operations / Inability to make a stop within the expected landing distance requirement' 
 

Control effectiveness of 'Aircraft evacuation' and 'Aerodrome Emergency Response Plan'.

• The effectiveness of the controls 'aircraft evacuation' and 'aerodrome emergency response plan' are quite variable depending on the particular scenario.
  
  For example they may be quite effective at limiting  passenger and crew injuries/ fatalities following a low energy collision scenario, however they may be ineffective in a high energy collision. 
• Landings resulting in a runway excursion were considered to tend more towards the low energy scenario and the effectiveness ratings were made accordingly.

Definition

Runway incursion

Any occurrence at an aerodrome involving the incorrect presence of an aircraft vehicle or person on the protected area of a surface designated for the landing and takeoff of aircraft.

General Notes

Where direct reference is available for a diagram element to EAPPRI (version 2) (European Action Prevention Plan Runway Incursion), the reference has been included for your information. Please note the document link is not live.

Control effectiveness ratings are for a typical UK aerodrome with the majority of operations being CAT type.

Bowtie 4.1 'Large CAT fixed wing aircraft operating on the ground in or close to the protected area of an active runway/ Incorrect presence of aircraft on the protected area'.

Recovery controls (to the right of the top event) are related with detection and avoidance manoeuvring controls being dependant (e.g. detection will be of no value unless avoiding action is taken).

Control effectiveness of 'Aircraft evacuation' and 'Aerodrome Emergency Response Plan'.

• The effectiveness of these controls is quite variable depending on the particular scenario.
  For example they may be quite effective at limiting passenger and crew injuries/ fatalities following a low energy collision scenario, however they may be ineffective in a high energy collision.
• Runway incursion collisions were considered to tend more towards the high energy scenario and the effectiveness rating 'poor' was made accordingly e.g. despite a potentially perfect response by the aerodrome operator/ RFFS, the ability to mitigate the scale of the injuries/ fatalities is may be extremely limited.