Understanding the causes of accidents using Tripod Beta

This article first appeared in the October 2014 edition of Petroleum Review as ‘Who causes accidents?’.

With the publication of the new Tripod Beta user guide, the Stichting Tripod Foundation and Energy Institute look at how industry can get to the root causes of incidents. Stuart King, EI Technical Products Manager – Human Factors and Safety Management, explains…

Between 1980 and 2000, Shell funded world-class research into the behavioural aspects of risk management. During that period research tools like Tripod, Bow Tie, and Hearts and Minds were developed, which today are used by a large number of organisations worldwide.

The first task was to answer a seemingly impossible question: Can the causes of incidents and accidents be predicted before the incident occurs? Startlingly, the answer is, at a high level, ‘Yes’. The management of risk can best be thought of as the implementation of ‘barriers’ that block the potential negative consequences of a hazard. Incidents are caused by the failure of these barriers and are almost always due to ‘human error’.

This concept was popularised by James Reason’s Swiss cheese model of incident causation in 1991. Today, barrier-based risk management is the foundation on which our industry manages its operations.

However, people do not ‘err’ in a social vacuum. Their behaviour is heavily influenced by the situation and their state of mind. These situational and psychological preconditions are in turn created by, or have never been identified and managed out of the system, by the organisation. Organisational deficiencies are often the true underlying causes of incidents. If we can identify the organisational deficiencies, we can try to prevent incidents before they happen.

By 1996 this concept had been developed into the Tripod Delta survey tool, which is still being used successfully to help companies understand the underlying causes before incidents occur (contact the tripod@energyinst.org for more information).

Following Piper Alpha, it was realised that an investigation and analysis tool was required that would help the investigator uncover the underlying causes of incidents. Tripod Beta was born, alongside the Bow Tie methodology (in fact, both tools were developed by the same team) and with the advent of Microsoft Windows 3.1, incidents could be easily modelled graphically on a computer.

What is Tripod Beta?

Tripod Beta is a visual methodology for analysing incidents and accidents, helping the investigator to consider the human factors and directing them towards the underlying causes. Tripod Beta is now 20 years old, and since 1998 has been publicly available. Furthermore, following a partnership between the EI and the Stichting Tripod Foundation, Tripod Beta is more visible globally. The methodology is used in The Netherlands as the investigation technique of choice for the regulator, the Dutch Safety Board. Tripod is also used by major organisations in the Far East, Canada and other parts of the world, as well as by Shell globally. It is estimated that over a third of all incident and accident investigation methodologies in use today are Tripod Beta or Tripod derived.

Tripod Beta is one of the few incident analysis methodologies to be scientifically validated. Furthermore, the ‘Life-Saving Rules’, which were adopted and expanded by the International Association of Oil and Gas Producers (OGP) based on their annual occupational safety data, were originally based on Tripod Beta analysis of fatal incidents (http://www.ogp.org.uk/ publications/safety-committee/ life-saving-rules).

At the heart of Tripod Beta is the Swiss cheese model of incident causation. Incidents can be modelled as a series of events, each one leading to the next. Each event is the coming together of two things – a hazard/agent (eg a source of energy) acts on and changes an object (a person, fuel, equipment). This agent/object/ event combination is called a ‘trio’ and each trio leads to the next, creating a simple tree of what happened. Most incidents can be modelled in only two to five trios. However, organisations should have identified ‘barriers’(the layers of Swiss cheese in Reason’s model) to prevent each trio from having taken place. In a ‘typical’ incident modelled by three trios, there are at least three barriers to prevent the incident – each representing an opportunity to stop the incident in its tracks.

Barriers are functions that, if enacted, would have prevented the next event from happening. They are not always human actions (eg, an automatic cut-off valve) but they often are.

For example, a high level alarm is not a barrier; but an operator reacting to a high level alarm and shutting off the flow into a tank is. Even if a barrier is purely mechanical, humans are responsible for designing, installing and maintaining them.

How an incident happened is ‘because the barrier failed’ and the barrier failed almost exclusively due to a ‘human failure’ – an error (such as a slip, lapse or mistake) or a violation of a rule or procedure.  Sometimes these human failures are made by designers or managers months before the incident. But usually errors are made at the front line, immediately before the incident.

Many incident investigation reports commonly cite ‘human error’ as the cause of incidents. However, Tripod Beta does not blame the person who caused the barrier to fail – their action was just the ‘active failure’ or the ‘immediate cause’, not the underlying cause. These people were set-up to fail at some point by the preconditions – the psychological or situational circumstances. These preconditions are often what we consider to be classic human factors issues, such as safety culture, competence, poor supervision, fatigue, workload, complicated tasks, the working environment, etc. Whilst we cannot say that these preconditions definitely caused the human failure, we can be reasonably sure that they increased the likelihood of it happening, and will increase the likelihood of it happening again to someone, somewhere else in the organisation.

Except for rare, unforeseeable natural disasters, preconditions are not random. In fact, they are precisely the human, environmental and operation factors that an organisation’s management system is meant to prevent or manage through the decisions that leaders make, by fostering a good working culture and having a robust process for managing risk. Therefore, the underlying or ‘root’ causes, ie why the incident happened, are actually the failures of the organisation to manage these preconditions.

Why is this important?

Interestingly, the actions taken to prevent an incident recurring should not focus on the individual(s) involved or even on the preconditions. In the short-term, they should focus on improving the barriers in place so that they cannot fail; but in the long-term, the underlying causes must be tackled. Barriers are many and are usually specific to an operation or incident. However, the underlying causes are few (they can be grouped into 11 categories) and are responsible for causing all incidents. If you can fix the underlying causes, you can potentially prevent many more incidents before they happen.

Resources available

Tripod Beta is a non-commercial methodology. It doesn’t require any special software, although commercial software is available. Tripod Beta is promoted by the Stichting Tripod Foundation, a group of volunteers who see barrier-based management of risk as being fundamental to safety performance.

Tripod Beta: Guidance on using Tripod Beta in the investigation and analysis of incidents, accidents and business losses, published by the EI, is available from www.tripodfoundation.com

The Foundation also lists accredited training courses on its website, and has an accreditation system to support and develop the competence of users of the Tripod Beta methodology.

e: tripod@energyinst.org