Thoughtfully Conduct Bowtie Analysis in Aviation SMS

Aviation safety management systems (SMS) focus strongly on:

• hazard identification,
• risk analysis and assessment;
• development and monitoring of risk controls; and
• continuous improvement of the SMS.

As a means to achieving that end, it’s becoming increasingly clear that bowtie analysis has become a popular risk management tool in aviation SMS. Yet, the bowtie is not practical for every aviation service provider with an SMS.

Who should use the bowtie?

When should the bowtie analysis be performed?

Related Aviation SMS Bowtie Articles

• What, Why, and How to Use Bowtie Analysis in Aviation SMS
• How to Do Bowtie Analysis in Aviation SMS – 5 Step Walkthrough
• 3 Ways You’re Not Using the Bowtie in Aviation SMS

Based on a dozen years of empirical evidence from monitoring SMS implementations around the world, helicopter operators in the petroleum and gas industry with more than 100 employees use the bowtie analysis more than any other aviation industry segment. This is undoubtedly due to the influence of SMS auditors from the oil and gas industry.

What Is Bowtie in Aviation SMS?

In many ways, bowtie analysis in aviation SMS is the culmination and integration of previously distinct elements of risk management, namely:

• Risk assessment;
• Safety case;
• The Reason Model;
• Risk controls; and
• Key Performance Indicators.

A completed bowtie succinctly summarizes all of the main elements and concerns about an aviation hazard in a way that a report would take pages to get the same information across. Moreover, as the use of the bowtie becomes more of a staple in airport SMS, airline SMS, and aviation SMS in general, it’s necessary to form rules and continuity in conducting the bowtie for these primary reasons:

1. Maintain the integrity of bowtie analysis across the aviation industry (if each organization has its own rules, its bowties are of little use to other organizations with different bowtie analysis rules);
2. Setting standards ensure consistent and therefore reliable inter-organizational bowtie analysis;
3. Management's decision-making processes are not unduly hampered by inconsistent bowtie analysis reports that detract, rather than add value to fact-based decision making; and
4. Reduce common frustrations from safety managers new to bowtie analysis as they learn to "control their urges" to over-analyze hazard risk scenarios to a point of absurdity.

Best Practices Performing Aviation SMS' Bowtie Analysis

Below are 7 simple rules (or best practices) for bowtie analysis that one can expect to solidify the effectiveness of more advanced aviation risk management efforts in your SMS. To be most effective, I encourage you to first ensure you understand the difference between:

• Hazards;
• Risks; and
• Control measures (risk controls).

Many safety managers who have not had formal aviation SMS training become confused about hazards, risks, and risk controls once we start digging into the weeds. Please don't think this is a bad thing if you haven't had the opportunity to take aviation SMS training. Aviation SMS training budgets become strained, especially in smaller operations.

When I started developing aviation SMS databases over a dozen years ago, I thought everyone intuitively understood the difference between hazards and risks. Risk controls? I had a general idea and believed these terms were easy, intuitive concepts that anyone with English as their first language would understand.

But I was wrong. I didn't originally come from the aviation industry and this is true for many other safety professionals. They may start in another industry segment and have either the wrong or slightly twisted perception of these risk management definitions. If you have any doubts or want a quick refresher, please review the above links to risk management articles. They are not just for beginners.

Have You Read

• Difference between Hazards, Risks & Control Measures in Aviation SMS
• Difference between Reactive, Predictive and Proactive Risk Management in Aviation SMS
• How to Evaluate and Justify a Risk Control in Aviation SMS

1 – Be Thorough About Asking Why With Bowtie Root Causes

Without question one of the most common mistakes of bowties is that the “But why?” question is not asked enough. When you shortchange your “But why” questions, it usually leads to the following:

• Miss out on interim events; and
• False root causes.

When a bowtie doesn’t express the primary root causes (i.e. the relevant threats) and the actual flow of events, it is worthless. The best approach is to be childlike when you are looking for root causes. But how do you actually know when you have arrived at a root cause? A good rule of thumb is that when you arrive at the answer, “Because it is,” it’s a good indication you have a root cause.

For example. Say you lose control of your car (primary event). But why? Flat tire. But why was the tire flat? Ran over a nail. But why? Because it was on the road. And to that, there is no clear answer except that the nail was simply there.

2 – Be Explicit Cause/Event (and Human Error Is Specific)

Both controls and events/causes need to be specific. In addition to not asking “But why?” enough, another common mistake is that weak controls are often misidentified as being root causes. For example, instead of “lack of training”, which is actually a weak control, the root cause would simply be Human Error.

And on this note, others have also pointed out the fact that Human Error is a GOOD root cause and should be used where appropriate. How specific is specific enough or too specific? There’s no clear definition of “specific enough”, but as long as your event or root cause gets across the main idea that leads to further consequences then good enough.

For example listing “Texting on cell phone” as a root cause in a car crash is probably less useful than “Distraction” as a root cause because the latter indicates what the former implies, and Bowtie causes/events should always be explicit. You could also list something like, “Distraction: using a cell phone” because it gets across both main ideas of being distracted by a cell phone.

Whether you want to add the extra tidbit of information to your causes (e.g. the “using a cell phone” part) really depends on how relevant the particular threat could be to other situations. If it doesn't add value - don't include it.

3 – Root Causes Need to Be Active

One way we can tell the difference between a weak control and a root cause is that, in general, weak controls are passive contributors. For example “lack of training” is a poor root cause because it is not actively working in the situation.

The trick here is that you should be very suspect of any root cause that is a negative statement, such as the “lack” of something. When I see great bowtie analysis root causes, they often begin with active verbs like “Collapse of...”, “Accumulation of...”, “Failure to...”

Related Aviation SMS Root Cause Analysis Articles

• How to Conduct Root Cause Analysis in Aviation SMS
• 3 Methods for Root Cause Analysis in Aviation SMS
• Proactive Risk Management: What Root Causes Say about Management

4 – Perform Bowtie Analysis in 2 Parts

This one is pretty simple. It’s easy to get ahead of ourselves are try and go A (cause) to Z (impact) quickly, without taking the time to follow events step by step through the process.

What this usually looks like is filling out a bowtie in a scattered, random fashion: listing an impact, then a root cause, then maybe the main event, and so on. It’s important to follow the same procedure for creating a bowtie, and it involves:

1. First working from root causes, through subsequent events to the main event; and THEN
2. Working from the main event through each consequence to the final impacts.

Creating bowties in this manner avoids accidental omission of critical steps in the flow of events, listing implicit rather than explicit root causes, making assumptions, and forming wrong conclusions about impacts.

5 – Keep Your Bowtie (Mostly) Number Free

I’m going to hark back to listing the “main idea” of a root cause or event. Numbers – unless used to demonstrate specific financial impacts – add little value to the bowtie analysis. In a plane crash, a “Loss of life” impact is just as good as a “4 deaths” impact, with an added advantage:

• Numbers have the potential to obscure and clutter the main idea.

Loss of life is loss of life, no matter how many people died. Mechanical failure is a mechanical failure no matter how many engines were lost. Adding numbers simply adds more words and more details that make digesting the main ideas that much harder and slower.

6 – Understand Your Goals for Bowtie Analysis

There are many different reasons you might use a bowtie, and be clear about why you are using it. Having clear intentions for conducting a bowtie analysis will help clarify what the most pertinent information is because you are basically answering for yourself, “What am I looking for?” For example, your goal for bowtie analysis might be:

• Demonstrate financial impacts of an accident;
• Understand which threats contributed most to the event;
• Clarify what the primary “Top” event was in a situation.

And so on. Though I don’t see this done, I think an excellent idea would be to write a brief statement of purpose on each bowtie analysis that you do. This descriptive statement will communicate the analysts' original intentions for future reference.

If you are like me, I have trouble remembering why I performed a particular task two weeks later. Not only will the "purpose statement" jog your memory when you review these bowtie analyses in the future, but other managers will more quickly get to the heart of what you are attempting to communicate using the bowtie outputs. When conducting bowties, focus on top events that are related to key performance indicators (KPIs). KPIs are widely communicated among management, and when the bowtie is related to organizational "pain points," then there will be more managerial-level interest in the analyses.

Do We Need to Conduct the Bowtie Analysis?

Frequent bowtie analyses will not be performed without software tools. Bowtie XP is the most popular product on the market for creating bowties. Bowtie XP software is expensive and some aviation service providers, both fixed wing and rotor wing operators, already have subscriptions to Bowtie XP.

Bowtie XP subscriptions were almost always acquired at the suggestion of auditors. These auditors come from the oil and gas industry and use these aviation service providers to ferry oil field workers to and from bases of operations, whether they are remote oil fields inland or on deep sea oil platforms.

There are no SMS regulatory requirements to conduct bowtie analysis. If you are required to have an aviation SMS and still want to perform bowtie analysis, there are some low-cost, commercially available SMS databases with bowtie features. In some cases, the entire SMS database software was less expensive than what I've seen operators pay for Bowtie XP.

I've talked with two safety managers who believed that bowties were required from auditors from their oil and gas clients. This is highly unlikely as a bowtie is a tool to analyze risk and evaluate risk controls. SMS auditors cannot tell you how to comply with a requirement. They can tell you the requirements. But how (and whether) you comply is entirely up to you. Of course, it is generally in the interests of the operator to comply.

The same applies to SMS auditors from civil aviation authorities. They can tell you what needs to be done, and may even provide some guidance on ways they've seen other operators accomplish a task, but there may be alternatives, such as doing a proactive hazard and safety risk analysis using SMS database software.

Auditors should not be dictating methods of compliance. However, operators must choose their battles wisely. When an auditor is "expecting" a bowtie because that is the only way he has ever seen proactive risk analyses performed, then you may simply find it easier to show him a bowtie and be done with it.

Related Aviation SMS Database Articles

• What Is an Aviation Safety Database
• 5 Most Important Things to Know before Buying Aviation SMS Database
• How to Choose the Best Aviation Safety Database Software

Final Thoughts on Bowtie Analysis in Aviation SMS

There are some shortcomings to using a bowtie. You need software to manage them easily. Also, it becomes very easy to spend inordinate time on the analysis.

Sadly enough, I see safety managers creating bowties for the auditors and only the auditors. I know these analyses are essentially of little value to management because they are

• overly detailed; or
• improperly conducted; or
• created for only the auditors with no expectation that other operations managers would ever review them.

The point is that there are alternate ways to analyze hazards, risks, and controls that may be easier and also satisfy the demands of SMS auditors. Before you make this decision, talk to the auditors to confirm that bowties are not required. I doubt that any contract will specifically require bowtie analysis from oil and gas clients.

SMS Pro's Bowtie tool is integrated into its risk management database. There are distinct benefits of having the bowtie tools in your SMS database, including:

• all SMS documentation remains in one system;
• reduced costs from removing the "one-trick-pony" Bowtie software;
• easy and immediate access to documented organizational hazards, risks, and risk controls;
• ability to access information with an Internet connection; and
• integration into other reports, like the hazard register.

If you need an aviation SMS database to manage SMS requirements and also would like to benefit from bowtie analysis, check out these short demo videos. The bowtie tools are available in SMS Pro's Risk Management Solution.

Live SMS Pro Demo

Does it look like we are a good fit to be your SMS Partner? Have questions or would you like to see the system live? Sign up for a live SMS Pro demo.

Last updated March 2024.