BOWTIE
Bow-tie Risk Analysis
CCPS · Energy Institute · ICAO SMS · Aviation Safety Frameworks

A bow-tie diagram places a single top event at the centre, with threats that can cause it on the left and consequences that can follow on the right, and explicit barriers on every pathway. It is the most widely used graphical method for communicating how a hazard is controlled in aviation, oil & gas, and process industries.

Overview of the framework

The bow-tie combines a fault-tree-like analysis of causes with an event-tree-like analysis of consequences into a single picture. In the centre sits the top event — the loss of control over a hazard (for example, "loss of separation" or "runway excursion"). To its left, branches describe each credible threat that could trigger the top event; to its right, each plausible consequence. Preventive barriers sit between threats and the top event; recovery barriers sit between the top event and each consequence. Escalation factors show how specific conditions can defeat a barrier, and controls on those escalation factors close the loop (CCPS & Energy Institute, 2018).

The technique was popularised by Shell in the late 1980s and refined in ICI, Shell's Tripod, and the CCPS Bow Ties in Risk Management concept book. In aviation it underpins much of the ICAO Safety Management Manual (Doc 9859, 4th ed.), EUROCONTROL's ARMS event risk classification, and Flight Safety Foundation guidance.

Threat A Threat B Threat C TOP EVENT Cons 1 Cons 2 Cons 3 Threats Preventive barriers Recovery barriers Consequences
Figure 1 · Classic bow-tie — threats and consequences meet at the top event; barriers on each pathway control the flow.

When to use it

Typical applications

  • Communicating risk to operational crews and boards — a picture that non-experts can read.
  • Demonstrating defence-in-depth for a major accident hazard.
  • Linking controls to MOCs, competency, and audit findings (barrier-based management).
  • Structuring incident reports — which barrier failed, which held.

Aviation relevance

  • ICAO Doc 9859 SMS hazard register: bow-ties per operational hazard.
  • EUROCONTROL ARMS/ERCS event risk classification.
  • Airline & ANSP runway incursion / loss-of-separation safety cases.
  • Maintenance & ramp hazards (FOD, ground handling, hangar fire).

Benefits

  • Communicates at a glance. Non-specialists can read a bow-tie with minimal training, making it effective for pilot briefings and board-level risk review.
  • Barrier-based. Ties controls, performance standards, and owners to explicit threats and consequences — traceable through audits.
  • Scalable. Works at single-site operational level or as a portfolio summary across many hazards.
  • Integrates with other methods. Compatible with fault trees (under threats), event trees (under consequences), and HAZOP outputs.
  • Supports learning. After an event, the same diagram shows which barriers held and which did not.
  • Drives ownership. Each barrier has a named owner; each escalation factor a control — accountability is visible.
  • Widely tooled. Software support (BowTieXP, Bowtie Master, RiskPoynt) is mature and used across aviation operators.
  • Regulatory fit. Aligns cleanly with ICAO/EASA SMS expectations for hazard registers and safety cases.

Limitations

  • Qualitative by default. Standard bow-ties express barrier strength by adjective or colour, not probability — quantitative bow-ties need additional data.
  • Single-event framing. Each diagram sits around one top event; systemic interactions between events can be missed.
  • Linear causality. Like fault and event trees, bow-ties assume one thing leads to another and can miss non-linear socio-technical effects (cf. STAMP, FRAM).
  • Barrier illusion. Listing a barrier is not evidence it works — without a performance standard and monitoring, the picture can overstate protection.
  • Scope creep. Teams can produce bow-ties so detailed that no one reads them; discipline on level of abstraction is required.
  • Weak on latent conditions. Organisational drivers are often relegated to escalation factors rather than made primary.
In short A bow-tie is the communication workhorse of modern SMS. Use it whenever you need a single, readable picture of how a hazard is controlled — but back it with a hazard register, performance standards for each barrier, and a systemic method (STAMP, FRAM) when the hazard is genuinely complex.

References (APA 7)

Center for Chemical Process Safety & Energy Institute. (2018). Bow ties in risk management: A concept book for process safety. Wiley.

de Ruijter, A., & Guldenmund, F. (2016). The bowtie method: A review. Safety Science, 88, 211–218.

Lewis, S., & Smith, K. (2010). Lessons learned from real-world application of the bow-tie method. AIChE Spring Meeting — 6th Global Congress on Process Safety.

International Civil Aviation Organization. (2018). Doc 9859 Safety management manual (4th ed.). ICAO.

EUROCONTROL. (2013). ARMS methodology for operational risk assessment in aviation organisations. EUROCONTROL.

Hollnagel, E. (2004). Barriers and accident prevention. Ashgate.

Further reading

Delvosalle, C., Fievez, C., Pipart, A., & Debray, B. (2006). ARAMIS project: A comprehensive methodology for the identification of reference accident scenarios in process industries. Journal of Hazardous Materials, 130(3), 200–219.

Kirwan, B. (2011). Incident reduction and risk migration. Safety Science, 49(1), 11–20.

Pitblado, R., Fisher, M., Nelson, B., Fløtaker, H., Molazemi, K., & Stokke, A. (2016). Concepts for dynamic barrier management. Journal of Loss Prevention in the Process Industries, 43, 741–746.

Flight Safety Foundation. (2020). Bow-tie analysis primer for business aviation.