Adding information that examines how the controls may be degraded is an area where the bowtie excels. It allows for the inclusion of a level of detail entirely appropriate to the management of controls. In bowtie these are known as escalation factors.
In our driving a car on a busy motorway example, an escalation factor would be the driver lacking the knowledge of how to counteract the tyre blow out, therefore the driver not appreciating the need to steer into the skid to keep control.
Definitions
A condition that leads to increased risk by defeating or reducing the effectiveness of controls (a control decay mechanism).
Controls are seldom 100% effective and history teaches us that they do fail. We need to give consideration and understand the factors that cause this to happen.
An escalation factor is a condition that leads to increased risk by reducing the effectiveness of controls. An escalation factor cannot directly cause the top event or consequence rather it increases the likelihood that the scenario will progress because the associated control will be degraded or fail.
Guiding principles
Escalation factors need to be credible and significant.
Incorporate lessons learned from incidents and accidents. Safety occurrence reports normally identify ‘contributory factors’.
Escalation factors should not cause the top event (in this case they would be threats).
Traps and tips
- Trap: Escalation factor descriptions that are too generic or vague e.g. ‘radio does not work’.
- Tip: Escalation factors should define how or why the control is degraded. They should identify the credible cause of the failure.
- Trap: Extensive use of escalation factors can make the size of the diagram vastly unmanageable, and this significantly impacts ease of use and readability. Adding escalation factors that are hypothetically possible but in reality are not a problem adds avoidable complexity.
- Tip: Ask: Is it really an issue? If yes, include it as an escalation factor.
- Trap: Escalation factors that only state the negative of the control. The mere negative of a control as an escalation factor should be avoided - it adds no useful information e.g. control: ‘conflict visually detected by driver’; escalation factor: ‘conflict not visually detected by driver’.
- Tip: Escalation factors should define how or why the control is degraded (e.g. ‘low visibility conditions prevents visual detection by driver’).
- Trap: Generic escalation factors. Avoid generic escalation factors, as the result will usually be an explosion in the diagram size without adding any value.
- Tip: For escalation factors which are considered to be a significant risk when working on a higher-level generic issue, it is advised to bowtie that issue separately (e.g. hazard: ‘fatigue’; top event: ‘personnel suffering fatigue to the extent that they do not perform to the expected standard’).
