One question
Write the same question under every barrier: what would stop this working? The answers are not failures but conditions: overdue maintenance, deliberate bypass, wrong setting, untrained user, an alarm nobody can hear over the noise.
The triple structure
| Barrier | Escalation factor | Secondary barrier |
|---|---|---|
| Gas detector | Calibration overdue | Calibration schedule and record |
| Automatic interlock | Bypassed for maintenance | Bypass permit and reinstatement check |
| Operator intervention | Only one person left on shift | Minimum manning rule |
| Fire suppression | Low water main pressure | Pressure monitoring and alarm |
Why it is the most valuable part
Barriers rarely break in an instant; they weaken first. Incident reviews return the same picture almost every time: the barrier was there, but it had been degrading for months and nobody was measuring it. The escalation factor column is what turns a bowtie from a drawing into a maintenance programme.
The shared factor trap
If one escalation factor keeps reappearing under several barriers, it has become the biggest risk on the diagram. "Maintenance team understaffed" showing under four barriers means those four barriers are really one.
Where they are drawn
An escalation factor hangs off the barrier, not on the threat line. Placed on the threat line it inflates the diagram, and worse, it breaks the link between a barrier and the thing that weakens it.