Tripod Beta is an incident and accident analysis methodology made available by the Stichting Tripod Foundation via the Energy Institute. The methodology is designed to help an accident investigator analyse the causes of an incident or accident in conjunction with conducting the investigation. This helps direct the investigation as the investigator will be able to see where more information is needed about what happened, or how or why the incident occurred.
Early development
Tripod Beta was developed by Shell International Exploration and Production B.V. as the result of Shell-funded academic research in the 1980s and 1990s. Such research contributed towards the development of the Swiss cheese model of accident causation, and in the late 1990s and early 2000s, towards the development of the Hearts and Minds safety culture toolkit.
The research was based on the following hypotheses
- Accidents happen because controls fail (now known as the Swiss Cheese model)
- The underlying causes of controls failing are due to underlying causes in the way we manage
- Those underlying causes, metaphorically comparable with 'pathogens' are present long before an accident occurs
- Those 'imperfections' are known by some of the people before the incident occurs
- People are usually well intended, trying to get their task done despite the imperfections in the system.
- If we can identify those failures and take action to remove them we will reduce the probability of accidents
The early research focused on a predictive tool to identify underlying causes of incidents before they occurred rather than an incident investigation methodology This would later become the basis for Tripod Delta.
The incident investigation methodology whilst always part of the research came later around 1990. initial Tripod Investigation followed a tabular approach as graphical program was not yet available
Following the 1988 Piper Alpha disaster and Lord Cullen report in 1990, Shell International created a team to look at Safety management systems and Safety Cases. That team worked until 2004 they developed a number of approaches, the EP forum (later the Oil and Gas Producers Association) guidance on Safety cases was founded on work by that team. The team worked closely with Leiden and Manchester Universities to the understanding of accident causation that had been developed in the 1984-2000 research program.
In 1992 Microsoft released windows version 3.1. That gave the team the ability for the first time to create graphical representations of the theories developed. Two software-based tools were developed: Bow Tie and Tripod Beta, respectively.
Stichting Tripod Foundation
In 1998, following publicity of Tripod Beta, Shell International Exploration and Production B.V. transferred copyright of the Tripod Beta methodology to the Stichting Tripod Foundation, a charitable body under Dutch law. The Foundation's purpose is to promote best practice in industry through the sensible usage of Tripod technologies to aid in the understanding and prevention of accidents and incidents. In 2012 the Foundation partnered with the Energy Institute in the UK in order to help achieve this. The Energy Institute currently publishes the official guide on using the Tripod Beta methodology. The Stichting Tripod Foundation also accredits approved training courses, and assesses the competence of users of the Tripod methodology. Users who are assessed as competent in Tripod Beta are accredited as 'Tripod Practitioners'.
The methodology
Tripod Beta is a methodology that can be conducted via pen and paper or using specialized software.
The methodology combines a number of theories of accident causation into generating a single model (a 'Tripod tree') of an accident or incident, most notably the Swiss cheese model (barrier-based risk management) and human factors-oriented theories such as GEMS (Generic Error-modelling system). as well as the worldwide accepted as a 'mainstream model 'GOP' (Gap, Outcome and Power) by Martin Fishbein and Icek Ajzen, expanding on the 'Theory of Reasoned Action' (TRA) (WIKI)...
A Tripod tree is divided into three sections.
What happened unexpectedly?
An Event in terms of Tripod Beta is the unexpected, unwanted or adverse outcome of a willfully carried out and intended process. The sequence such Events in an incident are shown in the tree as a series of 'trios', a simple logic (AND) gate that tells how the combination of two events led to an outcome. The outcome can then become an event that can combine with another event to cause a subsequent outcome, and so on.
As the sequence of trios goes forward in time, the tree ends when the last incident occurs, but if relevant can also take into account what happened after the incident (such as emergency response).
Potential events may also be investigated; Such Events that did not 'materialize' either because a 'barrier' prevented it from happening, or by sheer 'randomness' which is less likely.
As the sequence goes backwards in time, the tree usually begins with the last 'normal' Event, i.e. an event that was a normal part of ( business) operations.
This represents a logical place at which to start investigating an incident, as everything that happened after this was unusual and therefore worth investigating 'what went wrong?'.
A trio has three elements: the Event (the outcome, a change in state to an object, causing an effect such as an injury), the object (the person or thing that was changed (damaged), and the agent of change (the energy, 'driving' force or hazard that caused change or damage to the object). A logic test is used to ensure the correct identification of these elements: 'Agent of change' acts upon 'object' and results in 'event'. For example, 'Fire' acts upon 'Person' and results in 'Person burnt by fire'.
The Tripod practitioner first models the incident by constructing a series of Trios that explain 'what happened'.
Trees usually have between two and five trios via interconnecting nodes, where either an Event turns into an 'Agent of Change'in a subsequent trio, or an Object at the same time turns into an Event if affected by another Agent of Change.
How did it happen?
In Tripod theory, accidents are managed through the usage of 'Barriers'. Barriers are ( intended) functions of a (safety) management system, such as automated trips, relief valves, etc. that prevent an Agent of Change or hazard from causing an unexpected change or incident. Barriers are often people's actions (interventions) conducting critical tasks (such as responding to alarms) often described by rules and procedures but not necessarily.
Incidents are therefore 'allowed' to happen by the ineffectiveness at this particular point in time of one or more of these barriers.
Once the Tripod practitioner has created a series of Trios the next step is to identify the barriers that should have been in place to prevent the incident occurring. This is done for each individual Trio. Only barriers that could have actually mitigated or prevented the next event are considered. Predominantly, 'Failed Barriers' are considered. These are the barriers that should have prevented the incident but failed for various reasons. For example, a barrier to prevent injury in a car is a seat belt; however, this barrier may fail because the driver did not wear a seat belt, or the seat belt mechanism itself was faulty.
'Missing Barriers' (barriers that should have been in place according to 'best practice' but had not been established by the organisation), 'Inadequate Barriers' (barriers that functioned as intended but could not achieve the required function to prevent the incident; for example, a seat belt will only prevent serious injury under certain circumstances) and 'Effective Barriers' (barriers that succeeded in preventing the subsequent event) are also considered. If the analysis is modelling a 'Potential Event', unless the event was only prevented through sheer luck, there will be one or more Effective Barrier within the incident trajectory. For example, a seat belt functions to prevent the death of the driver.
Why did it happen?
Once the investigator has identified the sequence of events, and the Failed-, Missing-, and Inadequate- Barriers, the next step is to understand the causes of these being ineffective when needed.
Immediate causes
In Tripod theory, barriers fail because of human action or inaction. This may be human action directly related to the barrier functionality (such as the driver not wearing the seat belt), but may also be indirect, such as a failure during the design or installation of the barrier, or the failure of management to consider implementing the barrier. This human action or inaction is called the 'Immediate Cause'. This is the substandard act or human error. Often, when (non-Tripod) investigations determine that the cause of an accident was due to human error, in Tripod-terms this would relate to the immediate cause only.
Preconditions
The reasons for substandard acts and human error cannot always be definitively known, however it is known that human errors have situation or psychological precursors. These 'Preconditions' are aspects of the working environment that are likely to have contributed towards the substandard action or inaction. For example, typical Preconditions may be: fatigue due to improper work-life balance; perception that a guard is not required, loss of situation awareness, improper motivation, poor supervision; rushing in order to complete a job quickly; noisy or dark environment; confusing procedures, incorrect understanding of work objective, etc.
Through interviews and investigation the investigator is able to identify a number of Preconditions that likely contributed towards the substandard action.
Underlying causes
In Tripod theory, Preconditions represent aspects of the working environment that organisations should try to manage, usually via good leadership, safety culture, and a well-documented and implemented (safety) management system. For example: fatigue of the workforce can be managed by adequate shift rotas, and policies on shift length and overtime; rushing in order to complete a job quickly can be managed by leaders not sending conflicting messages that prioritize productivity over safety, etc. These weaknesses or failures of leadership, culture or management systems are the underlying causes of accidents and incidents. They help create, or fail to correct, the Preconditions.
The investigator looks for evidence of management system-level failures that created or failed to control the Preconditions. For example, this may be ambiguously worded, or lack of, written policy, unclear management-level responsibilities, apparent lack of visibility of leadership, ineffective risk management processes, etc. Tripod Beta encourages the investigator to consider these aspects of the incident.
Importantly, Tripod Beta placed great emphasis on identifying the Underlying Causes of accidents and incidents because, whilst many aspects of an accident (such as the sequence of events, Barriers and Preconditions) may be quite specific to a particular accident or incident, Underlying Causes will be non-specific to an accident and likely will be the cause of, or potential cause of, many different accidents and incidents, even those that seem completely unrelated.
Recommendations
The outcome of a Tripod Beta analysis are usually a number of recommendations for improvements within the organisation in order to prevent the same or other incidents occurring. Recommendations may or may not be formed by the person investigating.
Recommendations focus only on two aspects of the Tripod analysis: the Barriers and the Underlying Causes.
It is important to strengthen or reinstate the barriers so that the particular operation that was investigated can continue. Recommendations for improving Barriers are to prevent the same (or similar) incident happening and may involve fixing equipment or putting in place extra checks and additional independent barriers where barriers overly rely on human performance.
As Underlying Causes can be causal in many different types of incident, tackling the Underlying Causes may have the greater benefit in the long-term at preventing multiple incidents. Recommendations to tackle Underlying Causes are often aimed at management system level and are sometimes much harder to implement.
Recommendations are not made for other aspects of the incident (such as the Immediate Causes) as such recommendations will be unlikely to be effective at preventing further incidents. For example, recommendations for improving Immediate Causes (the substandard actions) often focus on retraining or punishing the person involved, which will be unlikely to prevent other people making the same error in future.