Skip to content
flowss
Start freeChecking your session
Bowtie risk templates

Bowtie — Runway Incursion at a Controlled Aerodrome

Aerodrome safety bowtie covering pilot, driver and controller threats: 6.8 incursion opportunities a year cut to 0.43/yr on the runway, ranking illuminated stop bars above surface movement radar and the go-around above every other recovery barrier.

Bowtie riskOperations & OpsBowtie risk syntax docs
Template previewBowtie risk
Runway incursion — controlled aerodromeHAZARDAircraft and vehicles sharing the manoeuvring areaTHREATSPREVENTIVE BARRIERSRECOVERY BARRIERSCONSEQUENCESStop bar lamps unserviceable inlow visibilityLow-visibility proceduresrequire a follow-meReadback and hearback ofthe crossing clearance70% · detectionStop bars at every runwayholding point85% · controlAirside driving permitwith annual recurrent test60%Surface movement radarwith incursion alerts80% · detectionAlert suppressed during asoftware updateRunway occupancy stripdiscipline in the tower65% · controlConflict alert on theelectronic strips75% · detectionGo-around initiated by thelanding crew80% · recoveryVisual acquisition by thedeparting crew50% · recoveryRunway end safety areameeting ICAO dimensions60% · mitigationRescue and firefighting onscene within 3 min55% · recoveryContingency plan using thesecondary runway50% · recoveryPilot misreads the taxiclearance and crossesthe hold3.5/yr → 0.1575/yrVehicle driver enterswithout an ATCclearance2.2/yr → 0.176/yrController clears adeparture onto anoccupied runway1.1/yr → 0.0963/yrRunway collision withmultiple fatalitiessev 5 · risk 0.2149High-speed rejectedtake-off andexcursionsev 4 · risk 0.3094Airport closure andnetwork disruptionsev 2 · risk 0.4298Unauthorisedentry onto anactive runway0.4298/yrtop-event frequencyTop event0.4298/yrinherent 6.8/yrResidual risk0.954inherent 74.8Risk reduction98.7%threat side 93.7%Barriers113 threats · 3 consequencesDominant threatVehicle driver enters without an ATC cl…41% of the top eventResidual risk 0.954 against an inherent 74.8 — the barriers remove 98.7% of it. 2 things are probably not what was meant — every path and every escalation factor was checked.Barrier criticality — residual risk if that one barrier were removed1. Stop bars at every runway holding point+1.98 ×3.12. Surface movement radar with incursion alerts+1.56 ×2.63. Go-around initiated by the landing crew+0.8595 ×1.94. Readback and hearback of the crossing clearance+0.8158 ×1.95. Conflict alert on the electronic strips+0.641 ×1.76. Airside driving permit with annual recurrent test+0.5861 ×1.6FindingsConsequence "Airport closure and network disruption" rests on ONE barrier. Defence in depth is the claim a bowtie is drawn to make, and a single barrier is a single point of failure: the day it fails is the day the consequence …Escalation factor "Alert suppressed during a software update" degrades barrier "Conflict alert on the electronic strips" and nothing is holding it off. The 75% credited to that barrier — and every figure computed from it — assu…Each of the 3 consequences is credited the full top-event frequency of 0.4298/yr — the model here is that one top event produces all of them, so the residual score of 0.954 adds 3 outcomes to one event. That is right when they …

Make it your own.

title "Runway incursion — controlled aerodrome"
hazard "Aircraft and vehicles sharing the manoeuvring area"
top "Unauthorised entry onto an active runway"
unit "/yr"

threat "Pilot misreads the taxi clearance and crosses the hold" likelihood: 3.5 {
  barrier "Readback and hearback of the crossing clearance" effectiveness: 0.7 type: detection
  barrier "Stop bars at every runway holding point" effectiveness: 0.85 type: control {
    escalation "Stop bar lamps unserviceable in low visibility" {
      control "Low-visibility procedures require a follow-me"
    }
  }
}

threat "Vehicle driver enters without an ATC clearance" likelihood: 2.2 {
  barrier "Airside driving permit with annual recurrent test" effectiveness: 0.6
  barrier "Surface movement radar with incursion alerts" effectiveness: 0.8 type: detection
}

threat "Controller clears a departure onto an occupied runway" likelihood: 1.1 {
  barrier "Runway occupancy strip discipline in the tower" effectiveness: 0.65 type: control
  barrier "Conflict alert on the electronic strips" effectiveness: 0.75 type: detection {
    escalation "Alert suppressed during a software update"
  }
}

consequence "Runway collision with multiple fatalities" severity: 5 {
  barrier "Go-around initiated by the landing crew" effectiveness: 0.8 type: recovery
  barrier "Visual acquisition by the departing crew" effectiveness: 0.5 type: recovery
}

consequence "High-speed rejected take-off and excursion" severity: 4 {
  barrier "Runway end safety area meeting ICAO dimensions" effectiveness: 0.6 type: mitigation
  barrier "Rescue and firefighting on scene within 3 min" effectiveness: 0.55 type: recovery
}

consequence "Airport closure and network disruption" severity: 2 {
  barrier "Contingency plan using the secondary runway" effectiveness: 0.5 type: recovery
}