2.3.3. Human Factors Categorisations

In aviation maintenance and inspection environments, errors can be categorised by their root causes including task, environmental, individual, organisational, and social factors [60]. However, most emphasis is on human factors, since it is generally accepted that humans have caused or contributed significantly to aviation incidents and accidents [61,62]. The two most common categorisations for human factors are the SHEL and PEAR models.

The SHEL model is a conceptual framework proposed by Edwards [63] to classify accident causes in aviation. The four categories are Software, Hardware, Environment, and Liveware. This concept was modified later by Hawkins, who added another 'liveware' component and presented the SHELL model [64,65]. Most recently, organisational factors were introduced by Chang and Wang making it the SHELLO model [66].

For the field of aviation maintenance, Johnson and Maddox developed the PEAR model, an acronym for People, Environment, Actions, and Resources [67]. It helps in categorising human factors and was first applied by Lufthansa.

Both PEAR and SHELL were developed for human risk factors in aviation. The SHELL model only focuses on interfaces within Human Factors (software–human, hardware–human, environment–human, and human–human) [27]. However, it does not include interfaces between the other factors (hardware-software, hardware-environment, and software-environment). Since we were looking for a categorisation covering risk factors and not only the interfaces between them, the SHELL model was not suitable. Similar, the PEAR model focused only on Human Factors and would not provide the universality needed for our purpose.

### *2.4. Limitation in the Methods for Bowtie Construction*

While several approaches exist for Bowtie construction, there is no standard [22,33]. The two main issues are (i) the lack of a standard methodology for systematically identifying Bowtie elements, and (ii) the subjectivity of the process. The latter relates to the subjectivity of the brainstorming method. These issues are interrelated.

Existing methods focus on the diagram construction and bringing the elements into the characteristic bowtie shape, but not on the identification of these elements, i.e., threats, consequences and barriers. This identification is ad hoc. There is a need for a structured methodology to identify threats and consequences and to ascertain barriers without missing important ones.

There is also inconsistency regarding the hierarchy of the hazard and top event. Although it is commonly accepted that the Bowtie construction starts with identifying the hazard, followed by the top event, the hierarchy of these is inconsistent. Some risk assessments followed the top–down approach, whereby multiple Bowties with di fferent top events for the same 'umbrella' hazard were developed, such as the Significant Seven Bowties by CAA UK [4,25]. Others followed the reverse approach and constructed several Bowties with di fferent hazards for the same top event [26]. Still others analysed only one hazard with its top event, whereby the relationship was not problematic [26]. It was found that often the top event is a subjective and pragmatic choice of the risk analyst and that it is rephrased once the Bowtie diagram is completed [19]. This contributes to the inconsistency in the hazard and top event hierarchy.

Most Bowtie diagrams are developed using brainstorming sessions and hence are dependent on the expertise and personal view of the participants and the skills of the facilitator. Although brainstorming encourages creative unbounded thinking, it can be time consuming and sometimes chaotic, which results in an unstructured and incomprehensive approach, and is always subjective. Moreover, the sessions are prone to group dynamics, which can influence the assessment results and may lead to missing important risks [21].
