Bowtie analysis is a visual risk assessment method that maps the relationship between threats that could cause an undesired event, the event itself (the “top event”), the consequences that could follow, and the barriers (controls) that prevent or mitigate each pathway. In PlaneConnection, bowtie diagrams are linked to hazard register entries and provide a structured, visual complement to the 5x5 risk matrix.
Methodology
The bowtie diagram gets its name from its shape. The top event sits at the center. Threats fan out to the left, consequences fan out to the right, and barriers are placed on the lines connecting them — forming a bowtie shape.
Threat 1 ──[Preventive Barrier]──╮ ╭──[Recovery Barrier]── Consequence 1
│ │
Threat 2 ──[Preventive Barrier]──┤ ┌────────────┐ ├──[Recovery Barrier]── Consequence 2
├───│ TOP EVENT │───┤
Threat 3 ──[Preventive Barrier]──┤ └────────────┘ ├──[Recovery Barrier]── Consequence 3
│ │
Threat 4 ──[Preventive Barrier]──╯ ╰──[Recovery Barrier]── Consequence 4
| Component | Position | Purpose |
|---|
| Threats | Left side | Causal factors that could lead to the top event if barriers fail. |
| Top Event | Center | The pivotal undesired event — the point where control is lost. |
| Consequences | Right side | Potential outcomes if the top event occurs and recovery barriers fail. |
| Preventive Barriers | Left side (between threats and top event) | Controls that prevent threats from causing the top event. |
| Recovery Barriers | Right side (between top event and consequences) | Controls that mitigate or limit consequences after the top event occurs. |
Threat Identification
Threats are the causal factors on the left side of the diagram. Each threat represents a distinct pathway that could lead to the top event.
| Field | Type | Description |
|---|
description | Text | Clear statement of the threat. |
category | Enum | Classification: human, technical, organizational, or environmental. |
likelihood | Enum | Assessed likelihood: rare, unlikely, possible, likely, or almost_certain. |
order_index | Integer | Display order on the diagram. |
Identify threats by asking: “What could cause this top event?” Use multiple categories to ensure
you capture human factors, technical failures, organizational gaps, and environmental conditions.
Consequence Mapping
Consequences are the potential outcomes on the right side of the diagram. Each consequence represents what could happen if the top event occurs and recovery barriers are insufficient.
| Field | Type | Description |
|---|
description | Text | Clear statement of the consequence. |
severity | Enum | Assessed severity: negligible, minor, major, hazardous, or catastrophic. |
category | Enum | Impact domain: safety, operational, financial, or reputational. |
order_index | Integer | Display order on the diagram. |
Barriers
Barriers are the controls that either prevent the top event from occurring (preventive) or limit the consequences after it occurs (recovery). Barriers are the actionable core of the bowtie analysis.
| Field | Type | Description |
|---|
description | Text | What the barrier does and how it reduces risk. |
barrier_type | Enum | preventive (blocks threats from causing the top event) or recovery (mitigates consequences after the top event). |
barrier_category | Enum | Control classification: engineering, administrative, ppe, or procedural. |
effectiveness | Enum | Current assessment: effective, partially_effective, ineffective, or not_assessed. |
linked_threat_id | Reference | Which specific threat a preventive barrier blocks. |
linked_consequence_id | Reference | Which specific consequence a recovery barrier mitigates. |
cpa_id | Reference | Linked CPA if the barrier is being implemented or verified through a corrective action. |
Barrier Effectiveness Assessment
Barrier effectiveness is assessed on a four-point scale:
| Rating | API Value | Description | Action Required |
|---|
| Effective | effective | Barrier consistently performs as intended. Evidence of effectiveness exists. | Continue monitoring. |
| Partially Effective | partially_effective | Barrier works under some conditions but has known gaps or limitations. | Document limitations. Plan improvements. |
| Ineffective | ineffective | Barrier does not prevent or mitigate the pathway it is assigned to. | Immediate action required — create CPA or replace barrier. |
| Not Assessed | not_assessed | Barrier has not yet been evaluated for effectiveness. | Schedule assessment. |
An ineffective barrier on a high-severity consequence pathway represents an unacceptable risk.
Create a CPA to address the gap immediately (14 CFR 5.55).
Bowtie Statuses
| Status | API Value | Description |
|---|
| Draft | draft | Bowtie created but not yet reviewed or finalized. Threats, consequences, and barriers may be incomplete. |
| Active | active | Bowtie reviewed and in use for ongoing risk management. Barriers are being monitored. |
| Archived | archived | Bowtie no longer actively monitored. The associated hazard may be closed or the analysis superseded. |
When to Use Bowtie vs. 5x5 Risk Matrix
Both the bowtie diagram and the 5x5 risk matrix are available in PlaneConnection. They serve different purposes and are most effective when used together.
| Criterion | 5x5 Risk Matrix | Bowtie Analysis |
|---|
| Purpose | Quantify risk level (severity x likelihood) and determine acceptability. | Visualize causal pathways, consequences, and the specific barriers that manage each pathway. |
| Best for | Initial risk screening, prioritization, residual risk comparison. | Complex hazards with multiple threats or consequences, barrier gap analysis, communicating risk to stakeholders. |
| Output | Risk score and zone (green/yellow/red). | Visual diagram showing threats, barriers, top event, and consequences. |
| Regulatory use | Required for SRM (14 CFR 5.55). | Recommended for complex hazards. Supports 14 CFR 5.53 system analysis. |
| When to add | Every hazard in the register. | High-risk hazards, hazards with multiple causal pathways, or when existing barriers need systematic review. |
Start with the 5x5 matrix to score the hazard. If the risk is in the yellow (ALARP) or red
(Unacceptable) zone, create a bowtie analysis to map the threat and consequence pathways and
identify where barriers are weak or missing.
Linked Records
A bowtie analysis connects to other SMS records:
| Linked Record | Relationship |
|---|
| Risk assessment | The hazard that the bowtie analyzes. |
| CPAs | Corrective and preventive actions implementing or verifying barriers. |
| Investigations | Investigations that identified threats or barrier failures. |
Regulatory Alignment
| Part 5 Section | Requirement | Bowtie Component |
|---|
| 5.53 | System analysis and hazard identification | Threat identification and causal pathway mapping. |
| 5.55(a) | Safety risk analysis | Threat likelihood, consequence severity assessment. |
| 5.55(c) | Risk controls | Preventive and recovery barriers with effectiveness tracking. |
| 5.71 | Safety performance monitoring | Ongoing barrier effectiveness monitoring. |
| 5.97 | SMS records | Bowtie diagrams retained as part of hazard documentation. |
Conduct a Bowtie Analysis
Step-by-step guide to creating a bowtie diagram.
Risk Matrix
Severity and likelihood definitions used alongside bowtie analysis.
Hazard Register
The hazard records that bowtie analyses are linked to.
CPA Lifecycle
How CPAs implement and verify bowtie barriers.
