4.4.2. Consequences for Different Stakeholders

There are two main stakeholders in this situation: (i) the MRO service provider, and (ii) the airline company and its passengers. The stakeholders are linked in a cascade of consequences [7]. A missed defect during borescope inspection can propagate from minor consequences for the MRO service provider and engine owner, towards catastrophic consequences for the airline, passengers and cabin crew; see Figure 5. For each link in the consequence chain, a new Bowtie risk assessment can be performed and a diagram drawn, tailored to the focus of the affected stakeholder.

**Figure 5.** Cascading consequences with different stakeholders.

Immediate Consequences for the MRO Service Provider

The consequences for the MRO provider include additional costly and time-consuming repairs or improvement processes, and reputational damage. An overview of possible consequences is given in Table 3 below.

**Table 3.** The 6M categories for immediate consequence for the MRO service provider with description and example.


Subsequent Consequences for the Airline

In the airline situation, the effect of a defective part in an engine has a different set of consequences, as shown in Table 4. These can reach from less critical gate returns and flight delays, to engine failure during flight operation with the potential to cause accidents or harm to passengers and cabin crew.


**Table 4.** The 6M categories for subsequent consequences for the airline with description and example.

4.4.3. Combined Threat and Consequence Structure Using 6M

The combined threat and consequence structure of the Bowtie diagram applying 6M is presented in Figure 6 below. The diagram illustrates the structure of the concept and that there is no limit for the number of threats in each category. It provides a systematic guide to identify threats and consequences. Furthermore, a threat of an M category does not necessarily result in a consequence of the same category.

**Figure 6.** Bowtie with threats and consequences structured based on the 6M approach.

### *4.5. Barrier Structures Using 6M*

### 4.5.1. Generic 6M Barrier Structure

One limitation of Bowtie is that barriers are not presented in a time or process following manner [7]. This limitation, however, allows grouping the barriers based on their nature and following the 6M

categorisation, without changing the overall Bowtie structure. Providing this 6M structure for barriers supports and structures the brainstorming sessions, which will remain an essential part of the element identification process. The framework is presented below—see Figures 7 and 8—and shows one barrier per category. It should be noted that each of these barriers is a representation for all barriers of its type. There may be threat or consequence paths that have no barriers of one or more 6M categories, whereas they may have multiple barriers of another category. A description and example of each barrier category can be found in Table 5. For more barrier samples please refer to the case study below.


