With the publication of the new Tripod Beta user guide, the Stichting Tripod Foundation and Energy Institute look at how industry can get to the root causes of incidents. Stuart King, EI Technical Products Manager – Human Factors and Safety Management, explains.
Between 1980 and 2000, Shell funded world-class research into the behavioural aspects of risk management. During that period research tools like Tripod, Bow Tie, and Hearts and Minds were developed, which today are used by a large number of organisations worldwide. The first task was to answer a seemingly impossible question: Can the causes of incidents and accidents be predicted before the incident occurs? Startlingly, the answer is – at a high level, ‘Yes’. The management of risk can best be thought of as the implementation of ‘barriers’ that block the potential negative consequences of a hazard. Incidents are caused by the failure of these barriers and are almost always due to ‘human error’.
This concept was popularised by James Reason's Swiss cheese model of incident causation in 1991. Today, barrier-based risk management is the foundation on which our industry manages its operations.
However, people do not 'err' in a social vacuum. Their behaviour is heavily influenced by the situation and their state of mind. These situational and psychological preconditions are in turn created by, or have never been identified and managed out of the system, by the organisation. Organisational deficiencies are often the true underlying causes of incidents. If we can identify the organisational deficiencies, we can try to prevent incidents before they happen.
By 1996 this concept had been developed into the Tripod Delta survey tool, which is still being used successfully to help companies understand the underlying causes before incidents occur (contact the EI for more information).
Following Piper Alpha, it was realised that an investigation and analysis tool was required t]hat would help the investigator uncover the underlying causes of incidents. Tripod Beta was born, alongside the Bow Tie methodology (in fact, both tools were developed by the same team) and with the advent of Microsoft Windows 3.1, incidents could be easily modelled graphically on a computer.
What is Tripod Beta?
Tripod Beta is a visual methodology for analysing incidents and accidents, helping the investigator to consider the human factors and directing them towards the underlying causes. Tripod Beta is now 20 years old, and since 1998 has been publicly available. Furthermore, following a partnership between the EI and the Stichting Tripod Foundation, Tripod Beta is more visible globally. The methodology is used in The Netherlands as the investigation technique of choice for the regulator, the Dutch Safety Board. Tripod is also used by major organisations in the Far East, Canada and other parts of the world, as well as by Shell globally. It is estimated that over a third of all incident and accident investigation methodologies in use today are Tripod Beta or Tripod derived.
Tripod Beta is one of the few incident analysis methodologies to be scientifically validated. Furthermore, the 'Life-Saving Rules', which were adopted and expanded by the International Association of Oil and Gas Producers (OGP) based on their annual occupational safety data, were originally based on Tripod Beta analysis of fatal incidents (http://www.ogp.org.uk/ publications/safety-committee/ life-saving-rules/).
At the heart of Tripod Beta is the Swiss cheese model of incident causation. Incidents can be modelled as a series of events, each one leading to the next. Each event is the coming together of two things - a hazard/agent (eg a source of energy) acts on and changes an object (a person, fuel, equipment). This agent/object/ event combination is called a 'trio' and each trio leads to the next, creating a simple tree of what happened. Most incidents can be modelled in only two to five trios. However, organisations should have identified 'barriers'(the layers of Swiss cheese in Reason's model) to prevent each trio from having taken place. In a 'typical' incident modelled by three trios, there are at least three barriers to prevent the incident - each representing an opportunity to stop the incident in its tracks.
Barriers are functions that, if enacted, would have prevented the next event from happening. They are not always human actions (eg, an automatic cut-off valve) but they often are.
For example, a high level alarm is not a barrier; but an operator reacting to a high level alarm and shutting off the flow into a tank is. Even if a barrier is purely mechanical, humans are responsible for designing, installing and maintaining them. How an incident happened is 'because the barrier failed' and the barrier failed alm|ost exclusively due to a 'human failure' - an error (such as a slip, lapse or mistake) or a violation of a rule or procedure. Sometimes these human failures are made by designers or managers months before the incident. But usually errors are made at the front line, immediately before the incident.