Bow Tie vs Tripod Beta: choosing the right barrier model

1. Same DNA, different tense

Both methodologies descend from James Reason's Swiss-cheese model: catastrophic events occur when latent weaknesses align across multiple defensive barriers. Where they differ is the verb. BowTie models the future — given a top event (e.g. loss of containment), what threats could trigger it, what preventive barriers stand in the way, what consequences follow if it occurs, and what recovery barriers reduce severity. Tripod Beta models the past — given an event that did occur, which barriers were challenged, which failed, and which latent organisational General Failure Types caused each barrier failure.

2. The BowTie diagram, decoded

Threat 1 ──┐                                ┌── Consequence 1
Threat 2 ──┤  [Preventive  TOP   Recovery]  ├── Consequence 2
Threat 3 ──┘   barriers   EVENT  barriers   └── Consequence 3
                  │                  │
              Escalation         Escalation
              factors            factors

Each preventive barrier blocks a threat path to the top event. Each recovery barrier reduces a consequence path. Escalation factors are conditions that degrade a barrier (fatigue, ageing, training gap). The diagram is auditable, regulator-friendly, and used as the master safety-case artefact in oil & gas, chemicals, aviation, rail and nuclear.

3. The Tripod Beta tree, decoded

Tripod Beta starts from the same top event but works backwards. The atomic unit is the Agent–Hazard–Target (HET) trio: an agent (energy or substance) interacts with a target (person, asset, environment) because a barrier between them failed. Each barrier failure is classified against one of eleven General Failure Types (GFTs) — Hardware, Design, Maintenance Management, Procedures, Error-Enforcing Conditions, Housekeeping, Communication, Organisation, Training, Incompatible Goals, Defences. A typical investigation surfaces 20–40 HET branches and 5–9 distinct GFTs — none of which are "human error".

4. When to use which — a four-question filter

1. Are you assessing a hazard that has NOT occurred?
   YES → BowTie. (Tripod Beta has nothing to investigate.)

2. Are you investigating an incident that HAS occurred?
   YES → Tripod Beta. (BowTie has no causal logic.)

3. Are you building a major-accident safety case (COMAH, Seveso, OSHA PSM)?
   YES → BowTie is the regulator-expected artefact for each major-accident hazard.

4. Are you closing the loop after a serious incident?
   YES → Run Tripod Beta, then refresh the affected BowTie barrier health ratings.

5. How they integrate inside RISKOPILOT

From a single incident narrative, RISKOPILOT generates the Tripod Beta tree (causal model), a BowTie diagram showing exactly which preventive and recovery barriers were challenged and which failed, a STEP chart sequencing every actor, a GFT organisational profile, prioritised recommendations tied to specific barrier failures, and a 12-section PDF ready for ISO 45001 §10.2 and IOGP Report 456 submission. The BowTie becomes the post-incident barrier-health snapshot; the Tripod Beta tree becomes the causal record. Both are traceable back to sentences in the original narrative.

6. Common mistakes

• Treating BowTie as an investigation tool. BowTie has no causal logic — it shows which barriers exist, not why they failed. Investigating with BowTie alone reproduces the same blind spots as 5 Whys.
• Treating Tripod Beta as a risk-assessment tool. Tripod Beta needs an actual event. Using it speculatively produces a fictional tree that doesn't map to operational reality.
• Letting the BowTie barrier register go stale after incidents. Each Tripod Beta investigation should trigger a barrier-health review on the corresponding BowTie. If you don't close that loop, the BowTie becomes shelf-art.
• Confusing escalation factors with GFTs. Escalation factors degrade a barrier (e.g. fatigue). GFTs explain why the degradation persisted at organisational level (e.g. GFT-10 Incompatible Goals — production pressure suppressed fatigue reporting).