Black BowTieXP allows you to record and visualize the actual occurrence of a Top Event. You can analyze and display which controls failed and how they failed in a way that caused the Top Event to occur.

A Black Bowtie can be mapped on top of a regular BowTie, in fact BowTieXP will allow you to map multiple incidents onto your existing BowTie models.

This analysis can be done in existing BowTie diagrams, or you can create a new one for a specific incident. You can map an infinite numbers of incidents into a single case file, allowing you to distill synoptic and relevant reports including overviews about – amongst others – common causes. Black BowTies are basically BowTies that contain Tripod Causation Paths: rather than modeling escalation factors, in a Black BowTie model entire Tripod accident causation paths are modeled. Black BowTies can visualize a specific incident scenario but they are especially useful for showing a set of incident scenario’s that are similar.

The theory behind Black BowTieXP

A distinctive characteristic of a mature safety culture is the will to learn from accidents.
TOPSET, “Prevention by Investigation”

There are several ways to use the BowTie method for Incident Analysis. The most common one (Black BowTie) is currently supported by BowTieXP. Black BowTie theory is based on the Tripod theory. Using the Tripod Causation Path you can not only define how a barrier failed but also why it failed. In this article you will get a first introduction to the concepts used in a Black BowTie.

Incident

As said before, multiple incidents can be mapped into a single file, even into a single hazard. Incidents can also span multiple top events. To keep the information about an incident together, and to record general information about it, we need to define an incident.

Top Event Occurrence

In BowTieXP the actual happening of a Top Event is called: a Top Event Occurrence. This object can be added to the Top Event. It records in detail how the Top Event occurred. Top Event Occurrences can then be assigned to a specific incident and a point in time can be added to place this event on a timeline.

Tripod Causation Path

With Black BowTieXP you can display the actual failure of barriers. This is done using the Tripod Causation Path. The Tripod Causation Path eplains the way controls fail. Each failed control has its own failure path. This path consists of the identification of Active Failures, Preconditions and Latent Failures.

• The Active Failure is the act or event which directly causes the failure of a control.
• The Precondition is the underlying environmental, situational or psychological state or context which made the active failure possible.
• The Latent Failure is the underlying organizational or systemic deficiency that creates the Precondition.

In the next paragraphs we will explain in depth how these elements help you determine what, how and why the Top Event occurred.

Active Failure

The first step of the Tripod Causation Path is the Active Failure. An Active Failure is often described as: the act or event which directly causes the failure of a control. Synonyms that a commonly accepted are: Immediate Causes, Sub-standard Acts and Technical failures.

Examples of Active Failure are:

• Violation of a procedure
• Mistake in operating routine
• Erosion in controls
• Neglecting to wear PPE
• Misinterpretation of signals / instruments
• Using inappropriate tools

Precondition

The second step of the Tripod Causation Path is the Precondition. A Precondition is often described as: the environmental, situational or psychological ‘states’ that promote Active Failures. A Precondition is the context of the Active Failure; the context that facilitates the Active Failure and provides ‘control breaching capacity’.

Examples of Preconditions are:

• Poor ergonomics of controls, tools, and equipment
• Poor condition of equipment, materials, not fit-for-purpose
• Insufficient quality / availability of procedures, instructions
• Physical conditions (weather)
• Psychological conditions of person

Latent Failure

The third step of the Tripod Causation Path is the Latent Failure. Latent Failures are often described as the organizational or systemic deficiencies which create Preconditions.

Latent Failures have a more widespread influence on the integrity of an operation because they can and will defeat many barriers. Accordingly, measures to prevent Latent Failures are likely to have the greatest beneficial impact in incident prevention too.

Examples of Latent Failures are:

• Balanced in production / maintenance budgets
• Downsizing without change control
• Inherently deficient procedures
• Inadequate competence standards and/or training
• Uncontrolled modifications
• Inadequate maintenance policy

Basic Risk Factors

The last step of the Tripod Causation Path is the classification of the Latent Failures. The classification of Latent Failures is based on Basic Risk Factors. Basic Risk Factors are aspects of the management system where failures exist and where possible remedies lie. In total there are 11 Basic Risk Factors (BRFs):

1. Hardware (HW)
2. Design (DE)
3. Maintenance Management (MM)
4. Procedures (PR)
5. Error-enforcing conditions (EC)
6. Housekeeping (HK)
7. Incompatible goals (IG)
8. Communication (CO)
9. Organization (OR)
10. Training (TR)
11. Defenses (DF)

These factors can be gathered in a Basic Risk Profile to show the major organizational flaws.