# Bow Tie vs Tripod Beta: choosing the right barrier model > BowTie is the **prospective** barrier-based risk assessment tool — what could go wrong and which barriers we rely on. Tripod Beta is the **retrospective** barrier-based investigation methodology — what did go wrong and which barriers failed. Most mature HSE programmes run both. RISKOPILOT generates both from the same incident narrative in under five minutes. **URL:** https://riskopilot.com/learn/bowtie-vs-tripod-beta **Last reviewed:** 2026-06-22 **Author:** RiskoPilot Editorial Team (HSESKILLS Ltd) **Reading time:** 11 minutes **License:** CC BY 4.0 — attribute to RiskoPilot --- ## TL;DR | Dimension | BowTie | Tripod Beta | |---|---|---| | Tense | Prospective (future, hypothetical) | Retrospective (past, actual) | | Question answered | Which barriers stand between threats and the top event? | Which barriers failed and why? | | Atomic unit | Threat → barrier → top event → barrier → consequence | Agent–Hazard–Target (HET) trio with barrier classification | | Output | Barrier register + safety-case artefact | Causal tree + organisational GFT profile | | Regulator role | COMAH / Seveso III / OSHA PSM safety cases | ISO 45001 §10.2, IOGP Report 456 incident reports | | Industries | Oil & gas, chemicals, aviation, rail, nuclear | Same — plus mining (often paired with ICAM) | | Time to build | 2–4 days workshop per top event | 8–16 analyst hours per incident (≈5 min with RISKOPILOT) | | Failure mode if misused | Static shelf-art barrier register | Fictional causal tree disconnected from operations | If you take one thing from this guide: **they are not alternatives**. BowTie is a risk-assessment artefact; Tripod Beta is an investigation methodology. Mature HSE programmes use the Tripod Beta output to update the BowTie barrier-health ratings after every serious incident. --- ## 1. Same DNA, different tense Both methodologies descend from James Reason's Swiss-cheese model: catastrophic events occur when latent weaknesses align across multiple defensive barriers. The difference is the verb. - **BowTie models the future.** Given a top event (e.g. *loss of containment*), what threats could trigger it, what preventive barriers stand in the way, what consequences follow if it occurs, and what recovery barriers reduce severity. - **Tripod Beta models the past.** Given an event that did occur, which barriers were challenged, which failed, and which latent organisational General Failure Types caused each barrier failure. The shared barrier vocabulary is what makes them complementary. A BowTie barrier register and a Tripod Beta tree can reference the same physical, procedural and organisational defences. --- ## 2. The BowTie diagram, decoded ```text Threat 1 ──┐ ┌── Consequence 1 Threat 2 ──┤ [Preventive TOP Recovery] ├── Consequence 2 Threat 3 ──┘ barriers EVENT barriers └── Consequence 3 │ │ Escalation Escalation factors factors ``` Each preventive barrier blocks a threat path to the top event. Each recovery barrier reduces a consequence path. Escalation factors are conditions that degrade a barrier (fatigue, ageing, training gap). The diagram is auditable, regulator-friendly, and used as the master safety-case artefact in oil & gas, chemicals, aviation, rail and nuclear. A mature BowTie carries metadata on each barrier: function, type (hardware, human, procedural), criticality, owner, performance standards, and current health rating (green/amber/red). The register is the operational heart of barrier-based safety management. --- ## 3. The Tripod Beta tree, decoded Tripod Beta starts from the same top event but works backwards. The atomic unit is the **Agent–Hazard–Target (HET) trio**: an agent (energy or substance) interacts with a target (person, asset, environment) because a barrier between them failed. Each barrier failure is then classified against one of eleven General Failure Types (GFTs): ```text GFT-1 Hardware GFT-7 Communication GFT-2 Design GFT-8 Organisation GFT-3 Maintenance Mgmt GFT-9 Training GFT-4 Procedures GFT-10 Incompatible Goals GFT-5 Error-Enforcing GFT-11 Defences GFT-6 Housekeeping ``` A typical Tripod Beta investigation surfaces 20–40 HET branches and 5–9 distinct GFTs — none of which are "human error". The methodology refuses to terminate at the human; every operator action is preceded by an organisational condition that made the action plausible. --- ## 4. When to use which — a four-question filter ```text 1. Are you assessing a hazard that has NOT occurred? YES → BowTie. (Tripod Beta has nothing to investigate.) 2. Are you investigating an incident that HAS occurred? YES → Tripod Beta. (BowTie has no causal logic.) 3. Are you building a major-accident safety case (COMAH, Seveso, OSHA PSM)? YES → BowTie is the regulator-expected artefact for each major-accident hazard. 4. Are you closing the loop after a serious incident? YES → Run Tripod Beta, then refresh the affected BowTie barrier health ratings. ``` --- ## 5. How they integrate inside RISKOPILOT From a single incident narrative, RISKOPILOT generates: 1. **Tripod Beta tree** — causal model, every HET trio classified against a GFT, evidence-linked back to source sentences. 2. **BowTie diagram** — post-incident barrier view, showing exactly which preventive and recovery barriers were challenged and which failed. 3. **STEP chart** — sequence of every actor across the timeline. 4. **GFT organisational profile** — distribution across all eleven types, highlighting the dominant systemic weakness. 5. **Prioritised recommendations** — each linked to a specific barrier failure with proposed barrier upgrade. 6. **12-section PDF report** — formatted for ISO 45001 §10.2, IOGP Report 456 and Seveso III submission. The BowTie becomes the post-incident barrier-health snapshot; the Tripod Beta tree becomes the causal record. Both are traceable back to sentences in the original narrative via the built-in evidence matrix. This is what we mean by closing the loop: an incident learning feeds back into the safety case. --- ## 6. Common mistakes - **Treating BowTie as an investigation tool.** BowTie has no causal logic — it shows which barriers exist, not why they failed. Investigating with BowTie alone reproduces the same blind spots as 5 Whys. - **Treating Tripod Beta as a risk-assessment tool.** Tripod Beta needs an actual event. Using it speculatively produces a fictional tree that doesn't map to operational reality. - **Letting the BowTie barrier register go stale after incidents.** Each Tripod Beta investigation should trigger a barrier-health review on the corresponding BowTie. If you don't close that loop, the BowTie becomes shelf-art. - **Confusing escalation factors with GFTs.** Escalation factors degrade a barrier (e.g. *fatigue*). GFTs explain why the degradation persisted at organisational level (e.g. *GFT-10 Incompatible Goals* — production pressure suppressed fatigue reporting). --- ## Frequently asked questions **Is BowTie a replacement for Tripod Beta?** No. BowTie is prospective (risk assessment), Tripod Beta is retrospective (investigation). They solve different problems and most mature HSE programmes run both. **Can I use BowTie diagrams during an investigation?** Yes — as an artefact. RISKOPILOT auto-generates a BowTie from the incident narrative showing exactly which preventive and recovery barriers were challenged. The Tripod Beta tree remains the primary causal model; the BowTie is the barrier dashboard. **Which methodology do regulators expect?** For investigations: barrier-based methodologies (Tripod Beta, ICAM) are named in IOGP Report 456 and accepted under ISO 45001 §10.2 and Seveso III Article 9. For risk assessment: BowTie is the de-facto standard for major-accident-hazard installations in oil & gas, chemicals and aviation. **How long does a BowTie take to build vs Tripod Beta?** A workshop-built BowTie for one top event takes 2–4 days with a facilitator. A Tripod Beta investigation takes 8–16 analyst hours. RISKOPILOT generates both from the same narrative in under five minutes. **Do I need both?** If you operate a major-accident-hazard installation, yes. BowTie tells you what barriers should exist and their health. Tripod Beta tells you which barriers failed and why. Together they close the loop between risk assessment and incident learning. --- ## Related - [BowTie methodology](https://riskopilot.com/methodology/bowtie) - [Tripod Beta methodology](https://riskopilot.com/methodology/tripod-beta) - [5 Whys vs Tripod Beta](https://riskopilot.com/learn/five-whys-vs-tripod-beta) - [GFT — General Failure Types](https://riskopilot.com/methodology/gft) - [Industrial Risk Assessment](https://riskopilot.com/solutions/industrial-risk-assessment) - [Incident Investigation Software](https://riskopilot.com/solutions/incident-investigation-software)