Tripod Beta is an incident and accident analysis methodology made available by the Stichting Tripod Foundation via the Energy Institute in the UK. The methodology is designed to help an accident investigator analyse the causes of an incident or accident in conjunction with conducting the investigation. This helps direct the investigation as the investigator will be able to see where more information is needed about what happened, or how or why the incident occurred.
Contents
Early development
Tripod Beta was developed by Shell International Exploration and Production B.V. as the result of Shell-funded academic research in the 1980s and 1990s. Such research contributed towards the development of the Swiss cheese model of accident causation, and in the late 1990s and early 2000s, towards the development of the Hearts and Minds safety culture toolkit.
Research originally focused on the causes of accidents, in order to determine whether the causes of accidents could be known before accidents actually occur. This would later become the basis for Tripod Delta. Following the 1988 Piper Alpha disaster, focus within Shell switched from predicting accidents to accident prevention and accident investigation and analysis. Two software-based tools were developed: Bow Tie and Tripod Beta, respectively.
Stichting Tripod Foundation
In 1998, following publicity of Tripod Beta, Shell International Exploration and Production B.V. transferred copyright of the Tripod Beta methodology to the Stichting Tripod Foundation, a charitable body under Dutch law. The Foundation's purpose is to promote best practice in industry through the sensible usage of Tripod technologies to aid in the understanding and prevention of accidents and incidents. In 2012 the Foundation partnered with the Energy Institute in the UK in order to help achieve this. The Energy Institute currently publishes the official guide on using the Tripod Beta methodology. The Stichting Tripod Foundation also accredits approved training courses, and assesses the competence of users of the Tripod methodology. Users who are assessed as competent in Tripod Beta are accredited as 'Tripod Practitioners'.
The methodology
Tripod Beta is a methodology that can be conducted via pen and paper or using specialized software.
The methodology combines a number of theories of accident causation into generating a single model (a 'Tripod tree') of an accident or incident, most notably the Swiss cheese model (barrier-based risk management) and human factors-oriented theories such as GEMS (Generic Error-modelling system).
A Tripod tree is divided into three sections.
What happened?
The sequence of events in an incident are shown in the tree as a series of 'trios', a simple logic (AND) gate that tells how the combination of two events led to an outcome. The outcome can then become an event that can combine with another event to cause a subsequent outcome, and so on.
As the sequence of trios goes forward in time the tree ends when the last incident occurs, but can also take into account what happened after the incident (such as emergency response). Potential events can also be investigated; these are events that did not happen either because of luck or because a 'barrier' prevented it from happening.
As the sequence goes backwards in time, the tree usually begins with the last 'normal' event, i.e. an event that was a normal part of operations. This represents a logical place at which to start investigating an incident, as everything that happened after this was unusual and therefore worth investigating 'what went wrong?'.
A trio has three elements: the event (the outcome, a change in state to an object, such as an injury), the object (the person or thing that was changed/damaged), and the agent of change (the energy, force or hazard that caused change or damage to the object). A logic test is used to ensure the correct identification of these elements: 'Agent of change' acts upon 'object' and results in 'event'. For example, 'Fire' acts upon 'Person' and results in 'Person burnt by fire'.
The Tripod practitioner first models the incident by constructing a series of Trios that explain 'what happened'.
Trees usually have between two and five trios.
How did it happen?
In Tripod theory, accidents are managed through the usage of 'Barriers'. Barriers are functions of a safety management system, such as automated trips, relief valves, etc. that prevent an agent or hazard from causing an unwanted change or incident. Barriers are often people conducting critical tasks (such as responding to alarms) often described by rules and procedures but not necessarily. Accidents are therefore 'allowed' to happen by the failure of one or more of these barriers.
Once the Tripod practitioner has created a series of Trios the next step is to identify the barriers that should have been in place to prevent the incident occurring. This is done for each individual Trio. Only barriers that could have actually mitigated or prevented the next event are considered. Predominantly, 'Failed Barriers' are considered. These are the barriers that should have prevented the incident but failed for various reasons. For example, a barrier to prevent injury in a car is a seat belt; however, this barrier may fail because the driver did not wear a seat belt, or the seat belt mechanism itself was faulty.
'Missing Barriers' (barriers that should have been in place according to 'best practice' but had not been established by the organisation), 'Inadequate Barriers' (barriers that functioned as intended but could not achieve the required function to prevent the incident; for example, a seat belt will only prevent serious injury under certain circumstances) and 'Effective Barriers' (barriers that succeeded in preventing the subsequent event) are also considered. If the analysis is modelling a 'Potential Event', unless the event was only prevented through sheer luck, there will be one or more Effective Barrier within the incident trajectory. For example, a seat belt functions to prevent the death of the driver.
Why did it happen?
Once the investigator has identified the sequence of events, and the Failed-, Missing-, and Inadequate- Barriers, the next step is to understand the causes of these being ineffective when needed.
Immediate causes
In Tripod theory, barriers fail because of human action or inaction. This may be human action directly related to the barrier functionality (such as the driver not wearing the seat belt), but may also be indirect, such as a failure during the design or installation of the barrier, or the failure of management to consider implementing the barrier. This human action or inaction is called the 'Immediate Cause'. This is the substandard act or human error. Often, when (non-Tripod) investigations determine that the cause of an accident was due to human error, in Tripod-terms this would relate to the immediate cause only.
Preconditions
The reasons for substandard acts and human error cannot always be definitively known, however it is known that human errors have situation or psychological precursors. These 'Preconditions' are aspects of the working environment that are likely to have contributed towards the substandard action or inaction. For example, typical Preconditions may be: fatigue due to improper work-life balance; perception that a guard is not required, loss of situation awareness, improper motivation, poor supervision; rushing in order to complete a job quickly; noisy or dark environment; confusing procedures, incorrect understanding of work objective, etc.
Through interviews and investigation the investigator is able to identify a number of Preconditions that likely contributed towards the substandard action.
Underlying causes
In Tripod theory, Preconditions represent aspects of the working environment that organisations should try to manage, usually via good leadership, safety culture, and a well-documented and implemented safety management system. For example: fatigue of the workforce can be managed by adequate shift rotas, and policies on shift length and overtime; rushing in order to complete a job quickly can be managed by leaders not sending conflicting messages that prioritize productivity over safety, etc. These weaknesses or failures of leadership, culture or management systems are the underlying causes of accidents and incidents. They help create, or fail to correct, the Preconditions.
The investigator looks for evidence of management system-level failures that created or failed to control the Preconditions. For example, this may be poorly worded, or lack of, written policy, unclear management-level responsibilities, apparent lack of visibility of leadership, ineffective risk management processes, etc. Tripod Beta encourages the investigator to consider these aspects of the incident.
Importantly, Tripod Beta placed great emphasis on identifying the Underlying Causes of accidents and incidents because, whilst many aspects of an accident (such as the sequence of events, Barriers and Preconditions) may be quite specific to a particular accident or incident, Underlying Causes will be non-specific to an accident and likely will be the cause of, or potential cause of, many different accidents and incidents, even those that seem completely unrelated.
Recommendations
The outcome of a Tripod Beta analysis are usually a number of recommendations for improvements within the organisation in order to prevent the same or other incidents occurring. Recommendations may or may not be formed by the person investigating.
Recommendations focus only on two aspects of the Tripod analysis: the Barriers and the Underlying Causes.
It is important to strengthen or reinstate the barriers so that the particular operation that was investigated can continue. Recommendations for improving Barriers are to prevent the same (or similar) incident happening and may involve fixing equipment or putting in place extra checks and additional independent barriers where barriers overly rely on human performance.
As Underlying Causes can be causal in many different types of incident, tackling the Underlying Causes may have the greater benefit in the long-term at preventing multiple incidents. Recommendations to tackle Underlying Causes are often aimed at management system level and are sometimes much harder to implement.
Recommendations are not made for other aspects of the incident (such as the Immediate Causes) as such recommendations will be unlikely to be effective at preventing further incidents. For example, recommendations for improving Immediate Causes (the substandard actions) often focus on retraining or punishing the person involved, which will be unlikely to prevent other people making the same error in future.