Tripod Beta

An Event in terms of Tripod Beta is the unexpected, unwanted or adverse outcome of a willfully carried out and intended process. The sequence such Events in an incident are shown in the tree as a series of 'trios', a simple logic (AND) gate that tells how the combination of two events led to an outcome. The outcome can then become an event that can combine with another event to cause a subsequent outcome, and so on.

As the sequence of trios goes forward in time, the tree ends when the last incident occurs, but if relevant can also take into account what happened after the incident (such as emergency response).

Potential events may also be investigated; Such Events that did not 'materialize' either because a 'barrier' prevented it from happening, or by sheer 'randomness' which is less likely.

As the sequence goes backwards in time, the tree usually begins with the last 'normal' Event, i.e. an event that was a normal part of ( business) operations.

This represents a logical place at which to start investigating an incident, as everything that happened after this was unusual and therefore worth investigating 'what went wrong?'.

A trio has three elements: the Event (the outcome, a change in state to an object, causing an effect such as an injury), the object (the person or thing that was changed (damaged), and the agent of change (the energy, 'driving' force or hazard that caused change or damage to the object). A logic test is used to ensure the correct identification of these elements: 'Agent of change' acts upon 'object' and results in 'event'. For example, 'Fire' acts upon 'Person' and results in 'Person burnt by fire'.

The Tripod practitioner first models the incident by constructing a series of Trios that explain 'what happened'.

Trees usually have between two and five trios via interconnecting nodes, where either an Event turns into an 'Agent of Change'in a subsequent trio, or an Object at the same time turns into an Event if affected by another Agent of Change.

In Tripod theory, accidents are managed through the usage of 'Barriers'. Barriers are ( intended) functions of a (safety) management system, such as automated trips, relief valves, etc. that prevent an Agent of Change or hazard from causing an unexpected change or incident. Barriers are often people's actions (interventions) conducting critical tasks (such as responding to alarms) often described by rules and procedures but not necessarily.

Incidents are therefore 'allowed' to happen by the ineffectiveness at this particular point in time of one or more of these barriers.

Once the Tripod practitioner has created a series of Trios the next step is to identify the barriers that should have been in place to prevent the incident occurring. This is done for each individual Trio. Only barriers that could have actually mitigated or prevented the next event are considered. Predominantly, 'Failed Barriers' are considered. These are the barriers that should have prevented the incident but failed for various reasons. For example, a barrier to prevent injury in a car is a seat belt; however, this barrier may fail because the driver did not wear a seat belt, or the seat belt mechanism itself was faulty.

'Missing Barriers' (barriers that should have been in place according to 'best practice' but had not been established by the organisation), 'Inadequate Barriers' (barriers that functioned as intended but could not achieve the required function to prevent the incident; for example, a seat belt will only prevent serious injury under certain circumstances) and 'Effective Barriers' (barriers that succeeded in preventing the subsequent event) are also considered. If the analysis is modelling a 'Potential Event', unless the event was only prevented through sheer luck, there will be one or more Effective Barrier within the incident trajectory. For example, a seat belt functions to prevent the death of the driver.

Once the investigator has identified the sequence of events, and the Failed-, Missing-, and Inadequate- Barriers, the next step is to understand the causes of these being ineffective when needed.

In Tripod theory, barriers fail because of human action or inaction. This may be human action directly related to the barrier functionality (such as the driver not wearing the seat belt), but may also be indirect, such as a failure during the design or installation of the barrier, or the failure of management to consider implementing the barrier. This human action or inaction is called the 'Immediate Cause'. This is the substandard act or human error. Often, when (non-Tripod) investigations determine that the cause of an accident was due to human error, in Tripod-terms this would relate to the immediate cause only.

The reasons for substandard acts and human error cannot always be definitively known, however it is known that human errors have situation or psychological precursors. These 'Preconditions' are aspects of the working environment that are likely to have contributed towards the substandard action or inaction. For example, typical Preconditions may be: fatigue due to improper work-life balance; perception that a guard is not required, loss of situation awareness, improper motivation, poor supervision; rushing in order to complete a job quickly; noisy or dark environment; confusing procedures, incorrect understanding of work objective, etc.

Through interviews and investigation the investigator is able to identify a number of Preconditions that likely contributed towards the substandard action.

In Tripod theory, Preconditions represent aspects of the working environment that organisations should try to manage, usually via good leadership, safety culture, and a well-documented and implemented (safety) management system. For example: fatigue of the workforce can be managed by adequate shift rotas, and policies on shift length and overtime; rushing in order to complete a job quickly can be managed by leaders not sending conflicting messages that prioritize productivity over safety, etc. These weaknesses or failures of leadership, culture or management systems are the underlying causes of accidents and incidents. They help create, or fail to correct, the Preconditions.

The investigator looks for evidence of management system-level failures that created or failed to control the Preconditions. For example, this may be ambiguously worded, or lack of, written policy, unclear management-level responsibilities, apparent lack of visibility of leadership, ineffective risk management processes, etc. Tripod Beta encourages the investigator to consider these aspects of the incident.

Importantly, Tripod Beta placed great emphasis on identifying the Underlying Causes of accidents and incidents because, whilst many aspects of an accident (such as the sequence of events, Barriers and Preconditions) may be quite specific to a particular accident or incident, Underlying Causes will be non-specific to an accident and likely will be the cause of, or potential cause of, many different accidents and incidents, even those that seem completely unrelated.

The outcome of a Tripod Beta analysis are usually a number of recommendations for improvements within the organisation in order to prevent the same or other incidents occurring. Recommendations may or may not be formed by the person investigating.

Recommendations focus only on two aspects of the Tripod analysis: the Barriers and the Underlying Causes.

It is important to strengthen or reinstate the barriers so that the particular operation that was investigated can continue. Recommendations for improving Barriers are to prevent the same (or similar) incident happening and may involve fixing equipment or putting in place extra checks and additional independent barriers where barriers overly rely on human performance.

As Underlying Causes can be causal in many different types of incident, tackling the Underlying Causes may have the greater benefit in the long-term at preventing multiple incidents. Recommendations to tackle Underlying Causes are often aimed at management system level and are sometimes much harder to implement.

Recommendations are not made for other aspects of the incident (such as the Immediate Causes) as such recommendations will be unlikely to be effective at preventing further incidents. For example, recommendations for improving Immediate Causes (the substandard actions) often focus on retraining or punishing the person involved, which will be unlikely to prevent other people making the same error in future.