The bowtie safety analysis methodology has been widely used by aviation regulators [1, 2] and operators [3]. This is owed to the simplicity it offers in constructing, representing and analyzing risks and mitigation measures. The bowtie methodology is centered around a hazard (a condition that can cause loss of life of equipment) and a top event (an undesired event), coupled with a prevention and a recovery branch. In the prevention branch one can find threats, with consequences placed on the recovery branch. The measures used for the prevention of a threat or the recovery of control before a consequence occurs, are defined as barriers. Furthermore, escalation factors are risk-increasing conditions acting upon barriers belonging either on the prevention or recovery branch. The escalation factors themselves can be deterred by introducing barriers. The construct of the methodology and its constituent elements are illustrated in Figure 1.
Bowtie Analysis in Accident and Incident Investigations
The bowtie methodology can be found in aviation accident and incident investigation reports [4,5]. However, its use by aviation accident investigation bodies has not been systematic, despite the potential standardization benefits it can bring to the analysis process and the structuring of the produced investigation report. Similarly to other processes in aviation, the standardization of investigation reports can foster international dissemination, and, consequently, augment our ability to learn from accidents and incidents. Bowtie can also be used as a tool for meta-analysis of information and data contained in accident investigation reports. This is exemplified with the following simple case study.
A Case Study
A report recently published by the Australian Transport Safety Bureau (ATSB) [6] offers an opportunity to examine how bowtie can be implemented for the analysis and presentation of technical issues. This report deals with a Robinson R22 helicopter accident, which became uncontrollable due to the failure of a tail rotor pedal, attributed to a pre-existing fatigue crack [6]. The failed part is shown in Figure 2, with the location of the fracture indicated by the blue box.
1. Visual inspection on the helicopter-installed pedals, every 100 hours;
2. Visual inspection on removed pedals, every 2,200 hours or 12 years, during an overhaul;
3. Magnetic particle inspection (MPI) on removed pedals, also during an overhaul (every 2,200 hours or 12 years).
An escalation factor degrading barrier #3 (MPI inspection on removed pedals) has also been identified, related to the fact that the maintenance manual does not describe the type of inspection that needs to be performed to verify the non-existence of cracks. The lack of communication in maintenance manuals is a well-known precondition for errors [8, 9]; in this case has led to a differing process in maintenance organizations. In particular, field service centers perform visual inspection of the pedal, while the manufacturer’s factory performs the more comprehensive MPI [7]. Two barriers associated with the escalation factor are assigned here, one stemming from the maintenance organization (MPI applied as part of the organization’s process) and one related to the engineering judgement that may be exercised by the technical/engineering deciding the type of inspection (MPI or visual inspection). The case study’s bowtie is presented in Figure 3.
The ATSB investigation report [7] lists two contributing factors for the accident, neither referring to the effect of the maintenance documentation (as identified from the bowtie analysis). Nevertheless, a safety action from the manufacturer is included in the ‘safety action’ section of the report. This corrective introduces in the maintenance documentation an MPI for the tail rotor pedals at every 2,000 hours (during overhaul) [7]. Effectively, since the MPI becomes a mandatory task, this change:
• Removes the escalation factor identified from the bowtie analysis (Figure 3), and
• Makes redundant the visual inspection of the pedals during overhaul. The revised, following the implementation of the safety action, bowtie graph is provided in Figure 4.
Conclusion
The bowtie methodology can provide a means for analyzing aviation accidents and incidents, focusing on specific matters of interest (such as the technical matters examined in the case study). The resulting analysis becomes a visual representation of factors (threats) leading to unwanted events (top event) and possible mitigating measures (barriers).
The case study presented here has shown that the bowtie methodology has the capacity to act as a meta analysis tool for an accident investigation report. This functionality has proven useful to identify a contributing factor missing from the ATSB report. Moreover, it has illustrated how a post-accident investigation change (safety action) may have an influence on contributing factors (removal of an escalation factor) and mitigating measures (redundancy of a barrier).
