The Aviation Risk Model, In the Box: 85 Bow-ties, 682 Barriers, 516 Indicators

Open almost any legacy safety tool and you find the same thing: a blank bow-tie editor, a blank barrier table, and a blank indicator form. The software is a canvas. Before it does anything useful, the airline has to build the entire risk model itself, draw every diagram, name every barrier, define every indicator, and write every scoring rule.

That is not a small task. It is the work of a risk specialist for months, often outsourced to a consultancy. And it has three problems that never go away:

• It rarely finishes. Most safety offices populate a handful of bow-ties for their top hazards and never complete the set. The blank canvas stays mostly blank.
• It is bespoke and hard to audit. Two analysts modelling the same scenario invent two different barrier sets. A regulator cannot tell whether a missing barrier is a real gap or just a naming choice.
• It drifts. A model built by hand in a drawing tool ages the moment someone copies the file. There is no single source of truth and no guarantee the diagram on screen matches the one in the manual.

The configure-it-yourself approach makes the airline pay the modelling cost before it gets any value, and then live with a model that is unique, unaudited, and slowly going stale. eAviora was built to invert that.

eAviora ships the aviation risk model itself, ready on day one and aligned to ICAO method. It is not a canvas to fill; it is a knowledge base to switch on. In the box:

• 85 bow-tie models, one per recognised aviation risk family.
• 1,467 elements, the threats, consequences and escalation factors that make up those diagrams.
• 682 named barriers, the preventive and recovery defences, named once and shared everywhere.
• 183 scenarios, the modelled ways a hazard plays out.
• 11 risk themes, the top-level groupings the whole model rolls up to.
• 516 indicator definitions, Safety Performance Indicators ready to activate.

The whole model is generated from a single master taxonomy workbook. The generator writes checksums, and a test fails the build when the counts a buyer is told and the seed the platform loads disagree. So the 85 bow-ties and 682 barriers one airline starts from are the same as every other airline's: shared and ICAO-aligned.

That shared starting point is what makes the model worth more than a custom one. Because every barrier has a canonical name and every scenario a canonical shape, a rating means the same thing across every record and over time. The airline tailors this model to its operation, and adds hazards of its own, rather than building it from a blank page.

The model is not a reference document that sits beside the work. It is wired into every record. When an occurrence is classified, it maps to a bow-tie family from the 85 in the box, and the diagram comes with its named preventive barriers (the defences left of the top event) and recovery barriers (the defences right of it) already in place.

Barrier rating. On each record, a person rates each barrier the event tested: effective, partially effective, ineffective, or missing. The safety analyst is not inventing barriers; they are assessing the ones the model already names. Anyone reading the record sees which defences held and which failed, and a barrier nobody has assessed reads as not assessed, never as effective.

From a degraded barrier to an action. A barrier rated ineffective or missing is a real, named gap in the operation's defences. A corrective action can be raised against that named defence and stays linked to it, rather than living as a free-text note. The action closes the loop between detecting the weakness and fixing it.

Because the barrier names are shared across the whole library, the same defence rated ineffective on three occurrences is visibly the same defence, a pattern the safety office can act on, rather than three unrelated notes. The shared model is what turns isolated ratings into a picture of where the operation's defences are weakening.

The same in-the-box principle runs the measurement layer. eAviora ships 516 Safety Performance Indicator definitions, not a blank form that asks the airline to define its own indicators, but a ready library to switch on.

Activatable by maturity tier. A new safety office does not need every indicator on the first day, and a mature one wants more of the set. The library is tiered, so an airline turns on a starter set early and expands as its safety management matures, without redefining anything.

Alert levels and control charts, not coloured bars. Active indicators are checked daily against their alert levels. An indicator your team measures itself also reads on a control chart with the Western Electric rules. ICAO Doc 9859 asks for alert levels on each indicator; here they are checked for you. That is the difference between an indicator that alerts when the data truly moves outside its expected envelope and a trend bar that turns amber because this month's number happens to be higher than last month's.

The contrast with the configure-it-yourself tool is the whole point. There, the airline writes every indicator and its alert rules by hand before the tool measures anything. Here, the library is already in the box and ICAO-aligned, so measurement starts early rather than after a year of definition work. See the SMS module for where the bow-ties and indicators live.