Aviation SMS bowtie example: loss of separation in controlled airspace
A complete, worked bowtie analysis example: 5 threats, 4 consequences, and 21 controls — 9 of them critical — around the top event, each carrying effectiveness, degradation factors, and a performance standard.
Open it read-only in the real editor → No sign-in required.
Bowtie Risk Engine writes barriers as controls and the top event as the risk — same method, stricter bookkeeping.
Loss of Separation in Controlled Airspace
A controller-and-cockpit bowtie for the unsafe event every ANSP and operator plans against: two aircraft closer than separation minima. Threats span human performance, equipment, weather, and coordination; recovery leans on TCAS and trained escape manoeuvres.
Area. Approach / terminal manoeuvring area, controlled airspace under ATC
Hazard. Two aircraft penetrating each other's separation minima, leading to mid-air collision risk and TCAS resolution advisories
Activity. Routine IFR operations, terminal sequencing, and approach/departure flows
Top event. Loss of Separation in Controlled Airspace — the moment control of the hazard is lost, at the knot of the bowtie.
Threats and preventive controls
Maps to ICAO Doc 9859 safety-management expectations for hazard identification and risk control.
| Threat | Control | Criticality | Effectiveness |
|---|---|---|---|
| ATC clearance error or deviationController issues a clearance that erodes separation, or an aircraft deviates from a correct clearance (level bust, heading drift, missed level-off). | Short-Term Conflict Alert (STCA) | Critical | High |
| Pilot read-back / hear-back | Critical | Medium | |
| Medium-Term Conflict Detection (MTCD) | Standard | Medium | |
| Controller training and currency | Standard | Medium | |
| Pilot deviation from clearanceLevel bust, track deviation, or unauthorised altitude change due to autopilot mis-set, selected-altitude error, or workload-driven mistake. | Altitude alerter and FMS callouts | Standard | High |
| Crew Resource Management (CRM) cross-check | Critical | High | |
| Surveillance / communication equipment failureRadar coverage loss, transponder failure, or VHF blocking causing controller to lose situational awareness. | Redundant radar coverage and ADS-B | Critical | High |
| Procedural separation fallback | Critical | High | |
| Severe weather causing reroute or holdingConvective weather forces unexpected vectoring, holding, or runway changes that compress sequencing and erode separation. | Strategic flow management | Standard | High |
| On-board weather radar / EFB | Standard | High | |
| Sector-handover or coordination failureLost flight strip, missed coordination call, or incomplete handover between sectors leading to a controller acting on stale information. | Electronic flight strips with mandatory acknowledge | Standard | Medium |
| Standardised handover checklist | Standard | High |
Consequences and recovery controls
If the top event happens anyway, these are the controls that limit how bad it gets.
| Consequence | Control | Criticality | Effectiveness |
|---|---|---|---|
| TCAS Resolution Advisory (RA)Aircraft TCAS issues an RA, requiring pilots to manoeuvre and report to ATC; often coincident with separation loss. | TCAS II 7.1 | Critical | High |
| Pilot RA-compliance training | Standard | Medium | |
| Controller RA acknowledgement procedure | Standard | High | |
| Airprox / safety-event reportReportable proximity event triggering investigation, regulatory review, and possible operational restrictions. | Just-culture reporting environment | Critical | High |
| Independent safety investigation | Standard | High | |
| Mid-air collisionCatastrophic outcome with hull losses and fatalities. | TCAS II 7.1 (final-line) | Critical | High |
| See-and-avoid (visual) | Critical | Medium | |
| Passenger injury from sudden manoeuvreCabin injuries (unsecured passengers, crew, or galley equipment) during avoidance manoeuvre. | Seatbelt sign discipline | Standard | High |
| Cabin-secure procedure | Standard | High |
| Control | Degradation factor | Degradation control |
|---|---|---|
| Short-Term Conflict Alert (STCA) | Degraded radar or Mode-C data quality | Routine Mode-C verification and surveillance-performance monitoring |
| Pilot read-back / hear-back | High RT frequency loading and congestion | Sectorisation and capacity management |
| Redundant radar coverage and ADS-B | Single surveillance source over a busy sector | Documented coverage gaps and annual safety-case review |
Short-Term Conflict Alert (STCA)
Every control in this template carries this level of detail — this is one of the critical ones.
What it does. Ground-based predictive alert in the radar system warning of imminent loss of separation; nuisance-rate kept under 5%.
Performance standard — objective. Give controllers a timely, reliable warning of an imminent loss of separation so a corrective instruction can be issued before minima are breached.
A verification criterion. Alerts are generated with enough look-ahead time (target ≥ 40 s) for the controller to intervene before separation minima are infringed.
How it erodes. Surveillance latency, degraded tracking, or a look-ahead parameter left un-retuned after an airspace or route change shortens effective warning time; tightening the look-ahead to suppress false alerts can quietly push it below the 40 s target.
Questions about this template
Is this bowtie example free to use?
Yes. Open it read-only in the real editor with no sign-in and read every control in full. To adapt it to your own operation, start the free 3-month trial — full editor and register, work email, no credit card.
What does the template include?
5 threats, 4 consequences, and 21 controls (barriers) around the top event, plus 3 degradation factors with their own controls, and a performance standard on every control. The control register and audit-ready PDF are generated from the same model.
What standard or framework does it align with?
It is structured around ICAO Doc 9859 safety-management expectations: hazards, unsafe events, and the barriers your SMS claims. Incidents can be mapped back onto the same threats and controls.
Can I export it?
Yes — PNG and SVG for slides and reports, JSON for version control, and a multi-page PDF containing the control registers, degradation factors, and performance standards. Trial exports are brand-marked.
Open this bowtie in the editor.
Read every control, criterion, and degradation factor in the live model — then adapt it to your own operation on the free 3-month trial.
More worked bowtie examples
- Process safety bowtie example: loss of containment of flammable hydrocarbon
- Cyber security bowtie example: unauthorised access to a customer database
- Medical device bowtie example: unintended drug overdose from an infusion pump
- Reliability bowtie example: critical pump failure causing unplanned shutdown
- Psychosocial hazards bowtie example: uncontrolled exposure to psychosocial hazards
Or start from the template gallery.