**4. Results**

### *4.1. Consistent Interpretation of Relationship between Hazard and Top Event*

Regarding the inconsistency of usage of the hazard and top event, we propose the following categorisation.

Format A: In cases where the scope of analysis is limited to one situation, the correspondence between hazard and the top event is not problematic. If the Bowtie diagram is too large, it may be represented as multiple smaller diagrams, providing the hazard and top event are used in the same way. The case study presented in this paper follows this approach.

Format B: The top event may have multiple hazard dimensions. In which case the top event should be consistent across all the diagrams, while the hazard changes. The hazard thus corresponds to a di fferent contextualisation for the same top event; see Figure 3.

**Figure 3.** Consistent top event with multiple hazard dimensions.

Format C: A hazard may have di fferent top event dimensions. Each dimension may represent a di fferent step in a process. Figure 4 provides an example for human factors in di fferent areas of the maintenance process.

**Figure 4.** Hazard investigation with di fferent top events.

We propose that the Bowtie analyst should decide beforehand how the problem is to be structured, and select one of the above formats, and then use it consistently throughout the analysis. This has the potential to avoid some of the inconsistencies seen in practice.

### *4.2. Proposal to Use 6M Structure*

The challenge with selecting the most suitable categorisation was that Bowtie contains di fferent risk elements including hazards, root causes (threats), consequences, barriers and controls. For each of these elements, di fferent approaches and categorisations exist. Some are suitable to categorise risks (causes and e ffects), but less suitable for categorising barriers. Hence, we decided to choose a risk categorisation that works for both risks (threats and consequences) and means of risk prevention and mitigation (barriers).

The 6M approach was seen as most suitable for the planned research and case study for the following reasons. First of all, the 6M approach was chosen due to the familiarity of the Bowtie and the Ishikawa diagram, with both being a cause and e ffect diagram. The 6M has already been successfully applied to structure such a diagram [23]. Secondly, it has been successfully applied outside the manufacturing environment such as health care [69,70], managemen<sup>t</sup> [71], and education [72]. Moreover, the 6M categorisation was well known at our industry partner, as the cause and e ffect diagram from Ishikawa is part of the measure phase of the DMAIC, a continuous improvement process often used in Six Sigma and know by industry practitioners [73]. The 6M structure can be used for both vertical categorisation of the threats and consequences, as well as horizontal categorisation of barriers.

The 6M aligns with other categorisations presented in the broader literature in Section 2.3 including the five accident categories used by IATA [53], and the four main risk categories by Lester [44]. Both are quite similar and a terminology adjustment, following the 'category starts with the letter M' concept, would make these categories match the selected 6M approach.

### *4.3. Integration of 6M with Bowtie (Contextualisation)*

The MRO environment di ffers to the manufacturing environment, and hence the original 6M structure by Ishikawa required modification. The contextualisation was carried out in the light of organisational quality factors that influence the maintenance and inspection result. In a production environment, the measurement category commonly includes the inspection and measurement of the parts to check if they meet the quality requirements. However, in an inspection environment the 'measurement' category can overlap with 'machine' and 'method', since the inspection tool and followed processes would fit into all three categories. The measurement category was therefore less useful to apply in an inspection environment. Instead of the 'measurement' category, we included 'management', which is one of the additional categories from the 8M approach by Burch et al. [58] and aligns to the work by Gwiazda [74] and Vaanila [73]. This was carried out as it matches the area under investigation being the highly regulated aviation and maintenance industry (see below) [75,76]. Management refers to organisational and regulatory factors. The other category from the 8M we could have chosen was maintenance, but since we wanted to investigate risks in a maintenance

environment, maintenance as a threat and a hazard at the same time would have caused problems with the consistency of the Bowtie structure.

In Table 1 below, we demonstrate how the categories and their interpretation may change according to the industry. This is demonstrated based on three examples, namely manufacturing, maintenance and health care. The latter was chosen to demonstrate the integration to a quite different industry.


### *4.4. Threats and Consequence Structure Using 6M*

### 4.4.1. Threat Structure in MRO

We started with integration of the 6M structure for the threats. A description of each category together with an example is given in the Table 2 below.


**Table 2.** The 6M categories for threats with description and example.
