Tripod Beta

User Guide

# & 5 "
Index

1. Introduction....................................................................................................................................... 3

2. Background and application............................................................................................................... 3

3. Basic incident causation theory............................................................................................................ 3

4. Human Behaviour Theory.................................................................................................................... 4

5. Tripod Beta and Human Behaviour....................................................................................................... 6

6. Tripod Beta analysis........................................................................................................................... 9

7. Learning and feedback......................................................................................................................17

Annex 1: Glossary................................................................................................................................19

Annex 2: Tips for Tripod tree construction and quality checking................................................................. 20

Annex 3: Errors, Violations and their Preconditions....................................................................................21

Annex 4: Basic Risk Factor (BRF) Definitions............................................................................................ 22

Annex 5: Tripod Beta Tree Symbols.........................................................................................................23

Annex 6: Tripod Beta tree rules............................................................................................................. 24

Annex 7: Tripod Beta and BowTie.......................................................................................................... 29

Annex 8: Worked example of Tripod Beta Tree........................................................................................31

Annex 9: Performing an Investigation..................................................................................................... 38

Annex 10: Previously used terminology................................................................................................... 48

Annex 11: Consequences for individuals..................................................................................................49

2
Tripod Beta User Guide
1. Introduction Tripod-Beta, which utilises this theory, is a system for
conducting incident analysis during the investigation itself.
Each Company has its own particular way of conducting This enables investigators and analysts to systematically and
its business, i.e., its own ‘organisational culture’. Within comprehensively:
the organisational culture reside a number of processes or
systems, e.g. Health Safety and Environment Management • Direct and refine their fact finding
System, and Quality Management System. • Confirm the relevance of their fact gathering,
• Highlight avenues of investigation pointing to the
One element in these systems will be a process for ‘Incident identification of underlying causes.
Investigation, Analysis and Reporting’ whose purpose is to • Identify and resolve any logical anomalies whilst the
identify why things went wrong so that they can be corrected investigation is still active and
and future losses and business interruptions prevented. • Produce a definitive report
The steps in this process start with an initial fact finding
followed by detailed investigation, testing and analysing Tripod analysis can be applied to all types of business
facts and assumptions, and formulating corrective actions incidents, including, but not limited to, those relating to:
to improve the management system and organisational
culture that allowed the incident to occur. • Environmental impacts
• Financial losses
In the Tripod Beta methodology the investigation process • Harm to peoples’ safety and health
is iterative with the analysis process. From the preliminary • Production losses
investigation report, possible Tripod Beta models of the • Security lapses
incident are produced which leads to further investigation • IT failures
and fact finding which in turn leads to a validation and • Damage to a company’s reputation
refinement of the model. This continues until all relevant • Quality short coming
facts have been identified and the Tripod Beta tree accurately • Project delays and losses
reflects the incident.
The Tripod theory and application is easy to understand.
The result is a saving in time and effort, a deeper and more Its application in an incident analysis requires skills and
comprehensive analysis and a clearer understanding of the experience in the application of Tripod Beta to arrive at
failures that must be addressed in order to make significant optimal results. Training up to the level of accredited Tripod
and lasting improvements in incident prevention. Beta practitioner is available. Management teams being
presented with the results of an analysis benefit from a short
The methodology is supported by software that provides presentation on the Tripod theory before being presented
the means to collect and assemble the facts from the the results and committing to remedial actions.
investigation and to manipulate them on screen into a
graphical representation of the incident and its causes.
A draft incident report can be generated for final editing 3. Basic Incident Causation Theory
using a word processing package. (Instructions on the use of
the software are contained in the ‘Tripod-BETA Software.) Incidents occur when inadequate or absent barriers fail
to prevent the things that can cause harm to escalate to
undesirable consequences. The barriers can be of different
2. Background and application types e.g. related to design, systems, procedures, equipment
etc. The barriers are put in place and kept in place by people
The Tripod theory originated from research undertaken with the competence to do so, in line with standards and
in the late 1980s and early 1990s into the contribution of specifications. Incidents happen when people make errors
human behavioural factors in accidents. The research, by the and fail to keep the barriers functional or in place e.g.
Universiteit Leiden and the Victoria University, Manchester, people doing the wrong thing or people not doing what they
was commissioned by Shell International. should do.

3
Tripod Beta User Guide
 Source
of harm
Barriers
Source
of harm Ill-conceived
Mistake or
Intention/
violation
plan
Work Undesirable
Environment consequences

Undesirable
consequences
However, some actions that are based on the right plan also
go wrong. These we call ‘Slips’ and ‘Lapses’. A slip is when
people intend to do one action but perform another one
instead. When people forget to do something, this is called
a lapse. Slips, lapses and mistakes are usually categorised as
human error
The steps in an incident investigation are to identify:
Everybody suffers from lapses and slips but often their
• the chain of events from the cause of harm to the likelihood is increased by situations that negatively affect
outcome; the undesirable consequences human functioning. Examples are tiredness, lighting and
• the barriers that should have stopped the chain of noise levels, and sudden changes to routines, illogical
events design. We can reduce these slips and lapses by improving
• the reason for failure of each of the barriers the circumstances e.g. by eliminating the “Human Error
Inducing Situations”. Usually these situations are the result
Most incident investigation techniques deal with the chain of someone else’s ill-conceived plan.
of events and the barriers that failed. Often this results
in addressing symptoms and immediate causes of failure. Human Source
Error of harm
Few techniques deal systematically with the analysis of the Inducing
Situations
Correct
reasons for failure of the barrier and development of actions Intention/
plan
Slip or lapse

addressing the underlying causes. Ill-conceived

Intention/
plan
Undesirable
consequences

4. Human Behaviour Theory Mistake or

violation

When trying to understand why a person has done

something incorrectly, people often explain it as simply
“human error”, or as part of their personality. This is Despite efforts to control error-enforcing situations some
unhelpful and often wrong. errors will always occur. These can create disasters if the
system is dependent on few barriers in which a slip or
To learn from the consequences of the actions of other lapse causes the last remaining barrier to fail. Therefore it
people, and to understand why they took such actions, is essential to always make sure that there is an adequate
it is necessary to look at the bigger picture, i.e. a “system number of effective barriers.
perspective”. There is a human behaviour model, which
helps, to explain why people act the way they do. To reduce the likelihood of incidents the focus should be
on ill conceived plans because they cause barriers to fail
In incidents people have usually acted the way they intended, directly through mistakes and violations. Indirectly they
they just didn’t get the consequences they expected. create situations in which slips and lapses are more likely to
A person’s mental plan was not clear or ill conceived, happen, or result in systems in which a lapse or slip cause the
resulting in a mistake and/or a violation. A barrier was last remaining barrier to fail. So, intentions and plans form
broken and an incident happened. the basis for our acts and behaviour - our human errors.

4
Tripod Beta User Guide
 Source
of harm

Undesirable
consequences

Understanding how people develop the intention or plan is Answers to these simple questions are always based on peoples’
therefore essential to understand and combat incidents. perceptions of the world and their beliefs about how the world
works rather than facts. In hindsight best intentions can be
Before people do anything, their brain creates a mental wrong! In every incident people thought they were doing the
plan, i.e. an intention. Often it is not realised that is actually right thing based on their beliefs and perceptions at the time.
how the brain is working. Before an intention to act can be For them, their perceptions are their reality.
formed, the brain needs to ask three simple questions about,
Gap, Outcome and Power. Let’s look at the answers in a simple example of somebody
spotting an unsafe act that could result in a person seriously
The Gap question: Is there a gap between the current injuring himself.
situation and how the person wants it to be?
Let’s quickly think about an incident that has already
The Outcome Question: Is there a reason to do something? happened. A mechanic loses part of his foot when the winch
“What’s in it for me?” Will it be beneficial e.g. get reward he was repairing started to rotate.
or recognition? Will I be disciplined if I do not follow the
rules? Is it more fun or pleasant etc.? Gap The winch needed to be repaired quickly
Outcome He expected to be commended for a quick
The Power Question: Does the person have the ability to repair of essential equipment
make something happen? Is it within that person’s power to Power He was a good mechanic and had worked
start it and complete it? like that before

Another example of the Gap, Outcome and Power questions for somebody spotting an unsafe act.
Question Answers
Gap? Potential for an incident
Outcomes • A warm thank you for pointing out the hazard
when intervening? • Recognition by others for a good intervention
• Satisfaction of having prevented injury
• Frustration if intervention is not appreciated or effective

Outcomes when • Bad feelings when an incident happens that could have been prevented
not intervening? • Comments by others that you should have intervened

Power? • I am sure that the potential for an incident is high

• I have intervened before
or
• I feel that I am not senior enough to intervene effectively
• I do not have the competence to fully assess whether this is not safe

5
Tripod Beta User Guide
Because people are basically social animals, past experiences 5. Tripod Beta and Human Behaviour
and contacts with other people have a major influence on
the way they currently act. Family, friends and many others 5.1 Tripod and Human Behaviour
make up the influencing environment, which through The aim of Tripod Beta is to establish:
our past experiences affects our beliefs and perceptions and
hence how we act. It leads people to act the way they do, 1. What was the sequence of events?
believing they are doing something that is acceptable. 2. How did it happen, what barriers failed?
3. Why did the barriers fail?
Within a work environment, colleagues and supervisors
have a strong influence. Peoples’ experiences with them, Tripod Beta distinguishes itself from other incident
and previous bosses, i.e., what they say and do, affects investigation and analysis methods through the Human
perceptions, which indirectly but significantly influences Behaviour model that is used to analyse the reasons for
the way people act at work. failure of a Barrier.

For an incident investigation the whole “system” in In Tripod Beta, an incident is shown as a series of trios, i.e.
which a person is working needs to be understood. For the agent of a change, the object changed and the resulting
example if someone breaks a rule, the reason why must be incident event. The trios descibe what happened. The failed
understood. Barriers are also shown in the trios, i.e. how it happened.

We know their past experiences led to their beliefs about #BSSJFS
UIBU
TIPVME

IBWF
TUPQQFE
UIF

what they should do, so the question should be asked “what BHFOU
PG
DIBOHF

was the role of others in the influencing environment?” This "HFOU
PG

DIBOHF
can take many forms, for example:
*ODJEFOU
• What they thought others expected them to do? &WFOU

• What others were doing or not doing at the same time?

0CKFDU
• Previous experience of interventions, and
• The consequences of past actions and feedback from
#BSSJFS
UIBU
TIPVME

previous similar situations? IBWF
QSPUFDUFE
UIF

PCKFDU

People can see themselves in this influencing environment

either as management, a colleague, a supervisor, or direct The human behaviour model is used to more deeply
report. This means everyone had a role to play in the overall understand why the barriers failed. A “Tripod causation
“system” which led to the person acting the way they did. To path” is traced back in time from each failed or missing
prevent incidents it is necessary to look deeper to understand barrier to its Underlying Cause.
exactly why someone did what they did, and not just stop at
blaming a person’s attitude. In the Tripod approach to analysing incidents, when a
Barrier fails it is a result of a slip or lapse, or an intentional
Tripod incident analysis is aimed at understanding act by a person or group of people. Identifying these acts is
these perceptions and beliefs and how the influencing only the first step. Next the context, or mindset, in which
environment and past experiences have created them. an action is taken, has to be identified and understood. This
is referred to as a Precondition.
Effective avoidance of all incidents, not only a repeat of
the last one, starts by understanding the environment and The Preconditions are the reasons someone believed there
taking action to change it. was a need to do something, why they thought there was
a good reason for doing it the way they did, and why they
believed they would be able to do it successfully.

6
Tripod Beta User Guide
 4PVSDF
PG
IBSN

6OEFTJSBCMF
DPOTFRVFODFT

#BSSJFS
UIBU

6OEFSMZJOH
$BVTF
{ 1SFDPOEJUJPO *NNFEJBUF
$BVTF
TIPVME
IBWF
TUPQQFE
UIF
JODJEFOU

Answering these questions leads to the start of considering The figure illustrates a Tripod causation path leading to a
the real Underlying Causes of the Preconditions, which are Failed Barrier. The Barriers are directly linked to Immediate
often common causes of many incidents. These Underlying Causes, (and their unsafe acts), Preconditions and Underlying
Causes have often been in the “system” for a long time, Causes. Sub-standard acts describe HOW the Barriers failed
lying unnoticed and hidden. and the Underlying Causes WHY the barriers failed. Each
Failed Barrier will have its own causation path.
They are often the result of actions and decisions of managers
and colleagues who make up the influencing environment. More detail on the three elements of the chain, the
immediate cause, the precondition and the underlying
For all incidents it is necessary to understand which parts cause are given below.
of the influencing environment led to the Preconditions that
influenced the person to act the way they did. If the incident 5.2 Immediate Causes (Sub-standard acts and
was work related then it is under management control and Technical failures)
means managers and colleagues had a role to play, therefore ‘Immediate Causes’ are the failures close to the incident
the underlying causes should link back to the actions and (i.e. in time, space or causal relationship) that defeat the
decisions taken as part of the business management system. barriers. These are the actions of a person, or group of people
- categorised as sub-standard acts in Tripod terminology. By
Using the human behaviour model with the Tripod identifying the person, or group, that made the error, it is
incident analysis methodology helps to clearly identify possible to analyse their beliefs and perceptions that created
both the Immediate and Underlying Causes. It also makes the error.
the conclusions more personal because managers and
colleagues can see their role in creating the environment Technical failures of barriers can also occur due to
that led to the incident. conditions such as over stress, corrosion or metal fatigue.
Human action is always the cause of these failures, e.g.
Everyone should try to understand the unintended wrong material selected, overloading, lack of corrosion
consequences their actions have on the beliefs and inhibitors, lack of maintenance etc.
perceptions of others. Once it is understood how people
unintentionally influence others they can help create an
influencing environment that promotes safe behaviour.

7
Tripod Beta User Guide
5.3 Preconditions information available at the time may prove to be fallible
Preconditions are the environmental, situational or with time. The potential adverse effects of decisions may not
psychological ‘system states’ or ‘states of mind’ that promote be fully appreciated or circumstances may change that alter
Immediate Causes. In simple terms the precondition can be their likelihood or magnitude.
found by asking why the person or group of persons that
caused the failure had the belief or perception that their act The incident producing potential of these Underlying Causes
was more or less what was expected of them, commendable, may lay dormant, (i.e. latent or “hidden” failures), within an
unavoidable or just normal. organisation for a long time and only become evident when
identified by an analysis of an incident.
See also Annex 3 for further information on the relation
between immediate causes and preconditions. Examples of Underlying Causes

Examples of Preconditions • Balance in production/ maintenance budgets

• Downsizing without change control
• Inattention (I didn’t notice I did something wrong.) • Inherently deficient procedures
• Unfamiliarity / over-familiarity (I have always done • Inadequate competence standards/ training
it this way and believed that was correct) • Uncontrolled modifications
• Haste (I believed it had to be done quickly) • Inadequate preventive maintenance policy
• Stress (I didn’t realise that I was trying to do too
much and could not cope)
• Misperception (I misread, misheard or 5.5 Classification of Underlying Causes
misinterpreted the information sent to me.) Based upon incident investigation studies Tripod research
• Lack of direction (Nobody told me how to do it so I has classified underlying causes into eleven Basic Risk
did it the way I believed to be suitable) Factors (BRFs), which provide a comprehensive risk
• Competing demands (I thought that what I did had management picture that is valid across a diversity of
priority over what I didn’t do.) industry activities. Each BRF category represents a
• Ignorance (I didn’t know that what I did was wrong.) distinctive area of management activity where the solution
• Complacency (I now everything about this and of the problem probably lies. (See Annex 4 for a complete
always do it correctly.) list and definitions.)
• Poor motivation (Nobody cares whether it is done
or not.) Some of these BRFs reach back over the development history
• Personal crisis (I was preoccupied on a major of the organisation (e.g. incompatible goals and organisational
problem at home.) failures); others assess the current quality of its specific
functions (e.g. design, maintenance, procedures, etc.).

5.4 Underlying Causes The BRF classification of underlying causes identified

All identified failures should be corrected, but addressing in any one incident has limited value in isolation, but
the Immediate Causes may only have a localised effect. the combination of data from a large enough number of
Underlying Causes have a more widespread influence on incidents can provide an insight into the overall risk status of
the integrity of an operation because they will defeat many the operation. Therefore the classification of the underlying
barriers. Accordingly, measures to prevent Underlying causes is optional in Tripod Beta.
Causes are likely to have the greatest beneficial impact in
incident prevention. It is also possible to classify the underlying causes in
accordance with the elements of the management system
Underlying Causes are deficiencies or anomalies that create involved with the incident.
the Preconditions that result in the Immediate Causes of
incidents. Management decisions often involve resolution
of conflicting objectives. Decisions taken using the best

8
Tripod Beta User Guide
6. Tripod Beta analysis information gaps that help the investigation team to cover
the incident in sufficient depth and breadth to understand
6.1 Overall Investigation and Analysis Process the full circumstance.
The objective of an incident investigation and analysis is to
identify and correct the Immediate and Underlying causes The overall process is illustrated in the road map in the figure
that created, or contributed to, an incident and so prevent its and explained more fully below.
future recurrence.
1. Initial findings: Concentrates on the incident site
The modern and systematic approach in achieving this is and its immediate surroundings, gathering the facts
to first create conceptual possible models that describe the concerning the event and its consequences.
incident. This is based on information provided in an ‘Initial 2. Initial Tripod Beta model: The core model of a Tripod
Incident Report’ and on how it is believed the incident Beta tree defines the incident mechanism in terms of
occurred. Evidence is then collected and assessed to test, Agents, Objects and Events.
modify and eventually arrive at a true model of the incident. 3. Fact gathering: Further evidence is gathered through
interviews, documentation reviews, research. Physical
This approach is used in a Tripod Beta analysis. The analysis evidence relating to Papers, Parts and Positions is
is a concurrent activity with the investigation and uses gathered first and the model reshaped before further
information from the investigation to construct the model, interviews are conducted with the People involved.
i.e. the “Tripod Beta Tree”. The classification and linkage of 4. Organising facts: Facts can be organised to develop a
tree elements represent the cause-effect logic of the incident. timeline or Sequentially Timed Event Plot (STEP).
Construction of the tree highlights investigation leads and

2.
Create Initial
Tripod Beta Model(s)
1. 3.
What happened? - Investigation
Construct TB Tree(s) Gather Facts, i.e.
Initial Findings of - Papers
INCIDENT Incident - Parts
How did it happen? - Positions
Brainstorm Barriers - People

4.
Organise Facts
(eg STEP)
6.
Further Investigation
- Papers
- Parts
- Positions
- People

5.
Tripod Beta Analysis
YES

What happened? -
Revise TB Tree
Issue incident
Further report with
How did it happen? Investigation / recommended
NO
Validate Barriers Analysis actions
needed?
Why did it go wrong?
Identify Causes

9
Tripod Beta User Guide
5. Detailed analysis: Completion of the Tripod tree. The team of experts formed to conduct the detailed, (Level
Failed or missing management measures (Barriers) 2), investigation and analysis, review this local report and
are added to the core model in the second phase of from it construct a Tripod Beta “Core” diagram.
Tripod Beta tree building. Only then does the thorough
investigative work commence to test this model. Further 6.2.2 Core Diagram Basics
investigations, studies and research may be required to The first task in the analysis is to construct the initial core
come to an understanding of underlying causes. The diagram (s), i.e., the series of trios representing the incident.
final phase of a Tripod Beta tree is to plot Tripod causal This is based on the initial information already known about
paths for each failed or missing Barrier, leading from the incident and before gathering evidence or interviewing
Immediate Causes to Underlying Causes. Remedial people by the Tripod Beta team. It is possible at this stage
actions are subsequently defined and reported. that, as all the facts are not known, more that one model, or
6. Review and reiteration: A draft report is presented to scenario, of the incident will be produced.
management to enable a critical discussion followed by a
decision on the adequacy of the analysis. The core diagram is created by a brainstorming desktop
exercise that utilises the experience of the Tripod Beta
This sequence is the Tripod recommended approach. Step Incident Analysis team (hence the importance of forming the
2, the development of the initial Tripod Beta model, can right team). Active involvement of the investigation team in
help to focus from the beginning on the relevant issues. For the preparation of this initial core diagram and agreement on
organisational reasons e.g. the unavailability of a Tripod the representation of the incident mechanism will provide the
facilitator during the first days, this approach cannot always team with a common focus for the conduct of the investigation.
be followed in which case steps 3 and 4 can be done without Any identified missing or unclear information is noted to be
the initial Tripod tree. Tripod Beta model development is pursued as part of the subsequent investigation.
then initiated and completed in step 5.
6.2.3 Main Elements of the Core Diagram
The traditional approach for performing an incident The core of a Tripod analysis resulting from an investigation
investigation, as available from many sources, is documented is a ‘tree’ representation of the incident mechanism,
in Annex 9. It covers steps 1,3 and 4 of the road map and describing the main incident event and other significant
information on preparing and initiating an investigation, events that occurred before or afterwards. The diagram
securing evidence, performing interviews etc. comprises a number of linked ‘trios’, each containing three
elements or ‘nodes’: an Agent of Change, an Event, and
The development of the Tripod Beta three is outlined in an Object. Other names can be given to these three
sections 6.2, 6.3 and 6.4. Development of remedial actions elements, e.g.:
and review by management are discussed in section 6.6 and
6.7 respectively. • Hazard, Event, Target
• Trigger, Event, Object
6.2 What happened (Building Tripod Beta “Core” • Threat, Event, Object
diagram)
Event
6.2.1 Initial Investigation In incident investigation terms an event is a happening,
Most organisations that have a robust incident investigation a ‘change of state’, whereby an object is adversely affected
and analysis process also have at least two levels of (or threatened) by an Agent of Change. In the Tripod Beta
reporting, i.e. model all events have ‘potential’ injury, damage or loss
‘penalties’ and some have ‘actual’ penalties. Examples of
• Level 1 - Initial Findings of Incident - normally main events include:
produced locally
• Level 2 - Detailed Investigation and Analysis - • Crash of an IT System
conducted by experts • Missed project milestone
• Shut down of a production line

10
Tripod Beta User Guide
• Breach of security chemical materials, radiation, explosives, flammable and
• Failure of a piece of machinery explosive materials, liquids and gases
• Failure to win a contract • Biological agents (e.g. animals and insects or micro-
organisms)
Specifically, typical main events in Oil and Gas industry are • Conditions that are life threatening e.g. such as lack of
associated with loss of control or containment or unexpected oxygen, smoke, fumes, water (as a drowning medium)
contact e.g.: • Ergonomic conditions (such as noise, light, work
station layout, etc.) that could lead to stress or physical
• hydrocarbon gas release strain injury
• oil spill • Natural phenomena such as wind, rain, waves,
• contact with hot pipe earthquakes etc.
• contact with electric current
• explosion Agents of Change that are not sources of energy but are still a
• fall driving force of change and may require a more imagination
• collision to identify include:

Agent of Change • Computer viruses

An Agent of Change is an entity with the potential to change, • Workplace stress
harm or damage an object upon which it is acting. It can • Late delivery of project material
be an energy source, material condition, change of plan etc. • Delayed payment of an invoice
that causes or has the potential to cause injury, damage or • Batch of faulty material from which components
loss. Agents of Change that are an obvious energy source are were made
relatively easy to identify, e.g.:
Object
• Energy sources such as, extreme heat / cold, electricity, The Object is the item changed, or potentially changed by
materials under pressure, items at height, energy of an “Agent of Change”. Examples of Objects are:
movement (kinetic), toxic, corrosive and carcinogenic

Objects Actual or Potential harm

IT System Malfunction or system non operational

Project Plan Missed milestone with cost and time overrun implications

People Injury or damage to health (employees or third parties)

Financial Target Cash flow, Profit, Revenue

Product Quality Failure of product in market

Assets Damage to plant or equipment - loss of material - disruption or shutdown of operation - damage to third
party assets.

Environment Damage or contamination - severe nuisance.

Reputation Adverse media attention - public concern, protest - prosecution - business restriction - reactive legislation,
loss of clients.

Production Schedule Non achievement of production targets

System integrity Breakdown of business processes.

11
Tripod Beta User Guide
 6.2.4 Building the Core Diagram the Object to change its state or condition to that described
Main Event as the Event”.
The ‘Main’ Event, the ‘Prior’ and ’Subsequent’ Events,
along with their associated Agents and Objects, are then Prior Events
identified. When the Agent or the Object was the outcome of a prior
event, another Agent and Object combination needs to be
included in the scope of the investigation. For example, if the
Agent main event was fire damage to equipment, the event causing
the Agent (fire) needs to be accounted for. The core diagram
& Event

Object
"HFOU "HFOU
TIME
&WFOU "DUT
PO &WFOU
Agent
0CKFDU 0CKFDU

A typical core diagram is built starting with the main

incident event i.e. the one that caught the initial attention &
3FTVMUT
JO
Event
t Agent
by the harm that was immediately caused. The Agent and
Object
Potential
Object are placed to the left of the event, and joined by lines TIME Potential
& Event & Event
or trajectories. would show two Agent - Object - Event constructions. If
ct Object
the presence of the flammable material was itself caused
by another event (e.g. a pipe leak), a further Agent/ Object
TIME TIME
Agent combination
Agent would need to be identified.

& Event
&
Potential
Event & as an Event
Designating the flammable material Object is worth
Potential

Object a mention. The normal convention is always to regard, say,

Object
TIME hydrocarbon gas as an Agent. However, in the context of
TIME
this model it is necessary to consider
TIME
the ‘fire’ event. The
fire was the result of a chemical reaction when heat (the
ignition source) was applied to the flammable material. The
Agent flammable material suffered a change of state (combustion),
therefore in this specific context it was an ‘Object’.
tential Potential
vent & Event
Object
It should also be noted that ‘fire’ features as both an Event
and an Agent. In the Tripod-Beta model this is represented
TIME
by a combined ‘Event-Agent’ node. Similarly, an event
creating an Object is represented as an ‘Event-Object’.
In logic terms, the trio can be explained as an AND gate
where both the Agent and Object have to be present for 1SJPS
FWFOU .BJO
FWFOU
the actual Event to occur. If a barrier exists in either 0CKFDU

one of the two pathways, then the Agent and Object do &RVJQNFOU

"HFOU
not come into contact and the Event that could have *HOJUJPO
&WFOU

TPVSDF

'JSF
EBNBHF


happened without effective barriers does not happen. This
is called a “Potential Event” (this is illustrated in the logic &WFOU
"HFOU
'JSF

'JSF

diagrams shown).
0CKFDU

'MBNNBCMF

NBUFSJBM


The below “logic” diagram of the trio is simplified in Tripod
Beta and is illustrated below. The wording used when
describing the trio is that, “The Agent of Change acts on

12
Tripod Beta User Guide
As the core diagram is being constructed all Agent and Object are usually missed if the initial core diagram is simplified
‘end nodes’ should be examined for possible prior events. too early in the investigation.
When no prior events are evident, the Agent or Object end
node represents a logical limit to the investigation scope. 6.3 How did it happen? (Identifying the Barriers)
A business must manage its risks to protect it from potential
Subsequent Events harm. An incident means there have been failures in risk
The main Event may not be the final event in an incident. management measures, (i.e. barriers), and an investigation
Subsequent Events may be added in a similar manner to needs to identify these barriers so that their reasons for
prior Events, to account for escalation or Events during failure can be addressed.
recovery. Different Objects can be shown separately.
To complete the model of HOW the incident happened,
The figure illustrates damage and injury resulting from a fire Barriers have to be identified which, had they been in place,
incident. Note that the burn victim becomes an ‘object’ for should have prevented the subsequent Events from occurring.
the septic environment in which the burns exist. This may These can be Barriers that were in place, but failed, and those
seem a novel concept, but, particularly in field operations, that should have been in place, but were missing. Initially
a septic environment can exacerbate the injury if they are barriers can be defined as Failed Barriers but after the
not treated promptly and effectively. Recovery measures investigation when more information is known, these could
for injured persons may involve rescue, stabilisation at be reclassified as Missing or Inadequate Barriers
the incident scene and transportation to an appropriate
medical centre, all of which involve additional risk. Events Identification of Barriers requires knowledge of the process
such as rescue and recovery operations immediately after and the facility where the incident occurred. An organisation
injury or harm has occurred should always be considered that has properly identified its risks should have Barriers
as a potential investigation lead. The last Event could be a documented and in place. Many of these Barriers can usually
‘potential’ Event, (i.e., where no harm actually occurred), if be found in the management system for the activity under
an associated Barrier had not failed. review. Risk Assessments prior to job execution (JRA, JSA,
JHA) may have identified additional Barriers, documented
Construction of the core diagram is critical in an e.g. in the Permit to Work. A thorough examination of
incident investigation. The diagram sets out the scope the operation, including design aspects where appropriate,
of the investigation, the Agent, Object and Event ‘end and all relevant documentation is required to ensure that
nodes’ indicating points where no further investigation all barriers that could have prevented the incident are
is considered necessary. The different trajectories indicate considered.
where effective risk management barriers would have
prevented events or consequences. Usually 2 to 5 Agent- In an investigation it may help to draft ‘specification
Object-Event trios are enough to describe most incidents. questions’ relevant to the incident:
Opportunities for the next step, the identification of barriers
• What Barriers should have prevented the exposure of
the Agent of Change?
1SJPS
FWFOU .BJO
FWFOUT 4VCTFRVFOU
FWFOU
• What Barriers should have protected the Object from
"HFOU
4FQUJD

&OWJSPONFOU

the Agent of Change?
0CKFDU
&WFOU

0CKFDU

0QFSBUPS

1BSUJBM
EJTBCJMJUZ


0QFSBUPS


Barriers should be seen in the context of the incident
"HFOU &WFOU

0CKFDU

"HFOU
&WFOU

*HOJUJPO
TPVSDF


*HOJUJPO
TPVSDF

0QFSBUPSCVSOFE

'JSF
EBNBHF


being investigated. For example, in an incident where
&WFOU
"HFOU
crude oil has been spilled causing pollution, the Barriers
'JSF


0CKFDU

0CKFDU 'MBNNBCMF
&WFOU

for secondary containment of the spillage will be relevant
'MBNNBCMF
&WFOU
NBUFSJBM



NBUFSJBM

'JSF
EBNBHF


'JSF
EBNBHF


whereas those Barriers for fire fighting, in context of the
0CKFDU

0CKFDU
&RVJQNFOU


&RVJQNFOU

incident, will not.

13
Tripod Beta User Guide
Risk management barriers relevant to a specific incident to test the incident model scenario(s) against the emerging
are located on one, or both, of the trajectories in the facts conduct the investigation, (e.g. evidence gathering
core diagram. For convenience, Barriers guarding or and interviews, as described in Section 4 below). In this
containing the Agent of Change are shown on the Agent- process the incident model may change but at all times a
Event trajectory and those protecting the Object show on models exist which can be validated or modified further
the Object-Event trajectory. until it is fully validated as accurately modelling the
incident. Barriers which were originally classified as Failed
The figure shows how these Barriers are added to the ‘core Barriers are now confirmed, removed or reclassified. In
diagram’. other words, the investigation and analysis processes are
iterative and run concurrently.

"HFOU
The time spent in team discussion to agree on the core
diagram, incident scope and barriers is important. Once
'BJMFE
#BSSJFS
&WFOU defined, the investigation team can focus on why barriers
failed. Duplication of team efforts can be avoided and facts
tested for relevance against an agreed incident ‘model’.
0CKFDU

'BJMFE
#BSSJFS 6.4 Why did the barriers fail? (Identify Causes)

The next task is to establish the Immediate Causes and
pathways to Underlying Causes for each failed or missing
The next figure illustrates the first part of an incident ‘model’ Barrier. These pathways will include, as appropriate:
with risk management barriers located on appropriate Immediate Causes, Preconditions and Underlying Causes.
trajectories in the core diagram. It is a representation of See chapter 4 for the human behaviour theory and
WHAT happened in an incident and HOW it happened. guidance to determine these pathways.

Knowing WHAT happened and HOW is only part of the Although some failed or missing Barriers may have causes
investigation. Even if the failed and missing Barriers are in common, they can be investigated individually using
reinstated, the Underlying Causes of failure will remain. the Tripod model of causality.
To make more effective recommendations to avoid similar
incidents, the reasons WHY these Barriers failed must be Failed Barriers
established. The most common causal path is where an Underlying
Cause creates a Precondition. This in turn creates the
Validate Failed Barriers Immediate Cause of a Barrier to fail. The Immediate
Having identified what barriers should have been in place Cause can be a sub-standard act by a person or a sub-
but assumed to have failed, the next task is for the team standard condition.

Object

Barrier Event
Agent
AGENT Object

Barrier Barrier
Event Event
Agent

Barrier Barrier
Object Agent

Barrier
Time

14
Tripod Beta User Guide
 Underlying Immediate "HFOU
Cause Pre-condition Cause
'BJMFE
#BSSJFS &WFOU
Many Many Many One One One "HFOU

1PUFOUJBM
0CKFDU
&WFOU
Failed
Barrier
0CKFDU

&GGFDUJWF
#BSSJFS

There is usually a one to one relationship between the nodes

“Failed Barrier” and “Immediate Cause”, and a many to
one relationship between “Precondition” and “Immediate Completing the Tripod Beta Tree
Cause”. (The relationship between Precondition and To complete a Tripod-Beta tree the facts relevant to the
Immediate Cause is not causal but probabilistic which is incident have to be identified from those gathered by the
indicated via a dotted line in the diagram below.) There investigation team and then connected according to the
is also a many to many relationship between Underlying conventions of the Tripod Beta tree model. This is done
Cause and Precondition. These relationships are illustrated in parallel to the investigation activity and should involve
in the figure. Occasionally it may be effective to have one discussion between investigation team members.
Immediate Cause linked to several failed barriers.
The facts of the investigation will need to be classified, (e.g.
In some instances the full causal chain: (i.e., Immediate Agents, Failed Barriers, Preconditions etc.,) during tree
Cause - Preconditions - Underlying Cause), does not construction, but the investigation team should initially be
apply, e.g. when the Underlying Causes, (and their concerned more with the facts themselves, rather than with
remedial actions), are outside the domain of the company’s the classifications. This may generate discussion between
management system. However, they could be in the the team to come to a common understanding of what the
company’s “policy” domain on influencing elements outside facts mean in terms of understanding the incident.
their control, e.g. Governments, Regulation Bodies, Third
Parties, etc. In such instances the full causation path is Barrier Summary
shown in the Tripod Beta Tree and with an appropriately The relationships between the different Barrier nodes and
worded action on the Underlying Cause aimed at exerting the other nodes in the Tripod Beta model are shown in
this influence. Figure below. Missing /Inadequate Barriers and Failed
Barriers where no sub-standard act exists are rare. The
Missing / Inadequate Barriers most valuable part of a Tripod Beta analysis is related to
Sometimes, albeit rarely, a Missing / Inadequate Barrier identifying and analysing sub-standard acts by people
is identified. By definition, it does not have an Immediate involved in the incident.
Cause or Precondition. These types of Barriers are usually
due to inadequate planning, design. They are only Unplaced Facts
classified as missing/ inadequate if no Immediate Cause Not every fact gathered is relevant to the understanding of
can be identified. an incident. Especially at the start of an investigation, the
gathering of information is along a broad front and not until
Effective Barriers the pattern of the incident sequence and causal chains emerges
In a Trio containing an Effective Barrier, (in either Agent- will the team concentrate on areas known to be relevant.
Event or Object-Event path), the Event did not take actually
place and would be classified as a “Potential Event” or a Some facts relating to the work environment may be
“Near Miss”. This is illustrated in the figure below. necessary to improve the understanding of any readers of
the incident report who are not familiar with the location
Effective Barriers indicate how close the situation was to or operation. However, when a fact is seen to be irrelevant to
a far more serious incident and that only this ‘last’ single understanding the incident, it should be discarded.
barrier was preventing this incident from happening.

15
Tripod Beta User Guide
 3BSFMZ
)BQQFOT
6OEFSMZJOH

$BVTF

.JTTJOH
#BSSJFS

*NNFEJBUF
1SF
 6OEFSMZJOH

#BSSJFS 5ZQF $BVTF DPOEJUJPO $BVTF

'BJMFE
#BSSJFS

4MJQ
-BQT
.JTUBLF
7JPMBUJPO

1PUFOUJBM
&WFOU
&GGFDUJWF
#BSSJFS

6.5 The tripod tree involved in completing these items. Each failed or missing
The Tripod-Beta ‘cause and effect tree’ is the combination Barrier and Underlying Cause should have at least one
of the WHAT, HOW and the WHY models. The figure recommendation.
demonstrates how the Tripod causation paths are connected to
each failed barrier. An investigation tree with a more complex
core would have more ‘nodes’ but the linkage of tree elements Underlying
Cause
Precondition

follows the same principles. Repetition of Underlying Causes Immediate

Cause

can be avoided by linking more than one Preconditions to Precondition

one Underlying Cause. Agent

Failed Barrier
Event

The aim of the Tripod-Beta tree is to provide a suitable set of

Object
concepts - a ‘framework’ - so that the investigation team can
Failed Barrier
make explicit the various failures contributing to a particular
incident. Underlying Immediate
Precondition
Cause Cause

An overview of the Tripod Beta symbols is in Annex 5.

Annex 6 presents the rules for constructing a Tripod Beta
tree e.g. allowed and forbidden combinations of events, Failed Barriers
agents, objects, barriers, immediate and underlying causes, To ensure the area where an incident occurred is safe and
and preconditions. A worked example of a Tripod Beta tree is to enable operations to begin as soon as possible, actions
provided in Annex 8. recorded against Failed Barriers are already likely to have
been taken before the incident report is issued. However,
6.6 Remedial actions these actions are recorded in the report plus any others that
The last items required to complete the tree are action should be taken locally and which may have been originally
items addressing identified failures and classification of the overlooked.
underlying causes. The investigation team should be fully

16
Tripod Beta User Guide
Underlying Causes Management should have the opportunity to check the
Actions assigned to Underlying Causes are aimed at appropriateness of the recommendations and feed back their
correcting ‘shortcomings in the management system. comments and endorsements to the team. This is particularly
These will normally require more resources to undertake and important for recommendations regarding Underlying
longer to complete than those assigned to Failed Barriers. Causes. The resolution of Underlying Causes is usually a
longer term project and endorsement by management implies
SMART Actions that resources for implementing the recommendation will be
Recommended actions need to be credible. Each recommen- provided. In view of their experience and deeper and broader
dation should be clearly appropriate to the failure or deficiency understanding of management systems, senior management
and should be discussed and agreed with an action party. could well identify issues and/or recommendations
overlooked by the investigation team. If this is the case, the
Management should be convinced that if they endorse the incident report should be amended to include this additional
recommendation some positive change will result. Moreover, information and re-issued.
actions should be ‘SMART’, i.e.
7. Learning and Feedback
Specific: relate to a clearly identified action to be taken which
is understood and agreed by the action taker. 7.1 Feed Back to Risk Assessment
Learning from incidents is essential if future incidents and
Measurable: the results of taking action can be measured in losses arising from the same Underlying Causes are to be
some way and close-out verified. prevented. Tripod investigation and analysis is a major part
of the overall “Learning from Loss” process.
Appropriate: specifically addresses a Failed Barrier or
Underlying Cause identified in the report. Every company has its own incident reporting and
investigation process but the main stages of this process are
Realistic: able to obtain the level of change reflected in the expected to be similar to the following:
recommended action, (knowing the resources and capacities
at the disposal of the organisation). • Emergency Response, (level depends on severity of the
incident), treatment of any injured persons, containment
Time based: stating the time period in which the action must of incident.
be completed. • Making incident location safe and protecting evidence
• Initial registration of incident and informing regulatory
The recommended actions assigned, especially to Underlying authorities as appropriate.
Causes, should not be “out of reach” of an organisation to • Assess potential harm of incident and deciding level of
complete nor should they consolidate the “status quo”. The investigation and analysis.
opportunity should be taken to ‘stretch’ an organisation • Appoint team leader and form incident investigation and
to complete them with the aim of making incremental analysis team
improvements in the business culture. • Conduct investigation and analysis (using Tripod in this
instance)
Action items should be developed by those in the affected • Define actions and write report.
organisation albeit under the guidance of the Tripod Beta • Dissemination of lessons learned
Practitioner. Also the party with the action should agree it • Monitor completion of actions
before is formally recorded. • Feedback to risk assessments

6.7 Senior Management Review and Action Plans The purpose of investigation and analyses is prevention
The incident report represents the team’s effort, and team through learning. Therefore the dissemination and feedback
members should satisfy themselves that their findings and to the pro-active risk assessments is essential if the overall
recommendations are correctly presented to the appropriate Incident Management process is to be a “closed loop” system.
management level.

17
Tripod Beta User Guide
This is illustrated in the figure which also shows information This will require:
being fed back into risk assessments from Near Miss analysis • a powerful Incident Reporting database with an
and Audits. effective data structure,
• a knowledgeable operator who will be able to seek the
7.2 Differing Levels of Incident Reporting, right information from the database and interpret the
Investigation and Analysis findings and draw conclusions
Not all incidents require the formality, depth and • accurate data entry into the database
thoroughness of a Tripod Beta investigation and analysis. From this holistic and systematic approach, the deep learning
For minor severity and low risk incidents, the extent of the gained from Tripod Beta investigations and analyses will be
investigation and analysis is likely to be limited to simply supplemented by the information obtained from the more
entering the incident details into the company’s Incident numerous but less severe incidents.
Reporting System, and taking local corrective actions.

At the other extreme, all incidents rated at the higher risk

areas of a risk matrix or which have caused significant actual
harm, will justify the full Tripod Beta investigation and
analysis process as explained in this manual. This analysis
will identify both the local remedial actions as well as those
to correct the deeper systemic failings in the business.

5SJQPE
#FUB

3JTL
"TTFTTNFOU

/FBS
.JTT
*ODJEFOU

FH
#PX

5JF
+PC
"VEJUT
"OBMZTJT "OBMZTJT
)B[BSE
"OBMZTJT

'FFECBDL

By ensuring there is a systematic and logical approach to

collecting incident information for all levels of incident
investigation, reporting and analysis, it will be possible
to integrate them and draw additional conclusions and
learning from the knowledge thereby created. Such analysis
will include, but not be limited to, trend and “comparison”
analysis.

18
Tripod Beta User Guide
Annex 1: Glossary
Term Description
Agent of Change Anything with the potential to change, harm or damage an object upon which it is acting.

Barrier A measure which reduces the probability of releasing an Agent’s potential for harm and of reducing its
consequences.
Basic Risk Factors A system for categorising Underlying Causes. An indicator of an aspect of a management system where a
failure exists, and by implication where the remedy lies.
Core Diagram A Tripod Beta tree containing only the Agent-Object-Event trios.

Effective Barrier A barrier that was effective in restoring control or preventing further consequential injury or damage
following an actual event.
Errors Actions by people which result in the Immediate Cause of a Failed Barrier.

Event An unplanned and unwanted happening involving the release or exposure of an Agent of Change.

Failed Barrier A Barrier rendered ineffective by an Immediate Cause.

Immediate Cause An action, omission or occurrence that causes a barrier to fail. Immediate Causes include sub-standard acts
by people and, (by exception), sub-standard conditions where people were not the Immediate Cause of the
failure. Immediate Causes occur close to the failed barrier in time, space or causal relationship and negates
the Barrier.
Incident An event or chain of events which cause, or could have caused injury, illness and/ or damage (loss), e.g., to
people, assets, the environment, a business, or third parties.
Inadequate A Barrier identified and established by the organisation as a management control measure but which failed,
Barrier not due to an Immediate Cause, but due to its inadequacy. (Treated the same way as a Missing Barrier.)
Lapse Omission/ repetition of a planned action possibly caused by Memory failure. (Type of human error.)

Missing Barrier A barrier identified by the organisation as a management control measure but was not established. (Treated
the same way as an Inadequate. Barrier)
Object The item harmed (injured, damaged or lost), or changed, caused by an “Agent of Change”.

Precondition The environmental, situational or psychological ‘system states’ or ‘states of mind’ that cause or promote
Immediate Causes.
Slip Unintended deviation from a correct plan of action caused possibly by attention failure or mistiming. (Type
of human error.)
Sub-Standard Act An action, error or omission that causes a barrier to fail. An “Immediate Cause” attributable to an erroneous
human action.
Sub-Standard A technical condition that renders a barrier to fail. An “Immediate Cause” attributable NOT to an
Condition erroneous human action.
Trios The linked combination of an “Agent of Change”, “Object” and “Event”. Trios are linked to other trios by a
combination node, i.e. Event/ Agent of Change or Event/ Object.
Tripod Beta A person who has been formally accredited as being competent to undertake a Tripod Beta Investigation and
Practitioner Analysis.

Tripod Beta Tree The graphical model used to depict an incident.

Underlying Cause The organisational deficiency or anomaly creating the Precondition that caused or influenced the
commission of an Immediate Cause.

19
Tripod Beta User Guide
Annex 2: Tips for Tripod tree barrier? Only if it is understood who the individuals are can
construction and quality checking the precondition be found!!!
14. Does the Immediate Cause describe something that
This section provides tips for quality checking of the Tripod happened close in the sequence of happening to Failed
analysis. Using an accredited Tripod practitioner will ensure that Barrier? (Close in logic but not necessarily close in time or
these quality checks are applied throughout the analysis. location.)
15. Does the Immediate Cause describe an act of doing, or not
A. Creating the Core Diagram doing, something?
1. Define the Event first, then the Object which has been 16. There can be only one Immediate Cause for each Failed
changed, (as described by the Event), and then the Agent, Barrier?
(which acted on the Object to change it). Reasoning to 17. An Immediate Cause and Failed Barrier should be described
construct the trio is ‘back in time’ but diagram timeline is as a “duo”. The Immediate cause will be the ‘opposite’ of a
from left to right. Failed Barrier, i.e., if the Barrier is worded positively then
2. Does the Event describe a ‘happening’ to the Object? the Immediate Cause will be worded negatively.
3. Does the Object describe an item before its condition was
changed to that described in the Event? D. Identifying Preconditions
4. Does the Agent describe something that had the potential 18. Does the Precondition explain why the individual thought
/ability to change the condition of the Object to that that their act was normal, acceptable or even commendable?
described in the Event? 19. Does the proposed precondition have an ‘influence’ on the
5. Initially, create many Trios to capture as many scenarios behaviour of the person who made the error leading to the
as possible. They can be disregarded or ‘collapsed’ into Immediate Cause that in turn led to the Barrier failing?
fewer trios later on when more information emerges from 20. If the proposed precondition was an Immediate Cause of a
the investigation. Failed Barrier, rather then an indirect and influencing factor,
6. Normally, a final core diagram contains 2 to 5 trios. then what is being described is not a Precondition.
7. ‘Time’ moves from left to right, i.e. the tree starts with an
Agent and an Object and ends with an Event(s). E. Identifying Underlying Causes
21. Is the Underlying Cause a valid reason for the perceptions
B. Identifying Barriers and beliefs, (Preconditions), that led the individual think
8. Check management system, Job Risk Analysis, Permit to that they were doing the right thing or that which was
Work, etc. to assess whether all relevant barriers are considered normal, acceptable?
considered. 22. Does it represent a failure on ‘system level’, i.e., its relation to
9. Is a Failed Barrier described such that, had it been effective, the actual event is ‘remote’ in time and/ or location?
it should have prevented the next Event from occurring? 23. Is the organisation in question in the position to take
Is it described in specific, and not general, terms, (e.g. the responsibility for the existence of this system failure and is
relevant part of a procedure rather than the title of procedure able to improve the situation. (If the organisation does not
or type of procedure)? In the later stages of the incident have ‘direct responsibility’ for this systemic failure, it can
analysis, the Barriers may be merged if this creates more never-the-less influence others outside the organisation?)
clarity of presentation. 24. Underlying Causes are related to Management Systems.
10. Missing /Inadequate Barriers are rare, but when they do
occur, try to identify the human error in planning, design, F. Creating Recommended Actions
etc., and make that the Immediate Cause of the Failed 25. Are the actions:
Barrier. • SMART,
11. If a single Barrier for a particular Trio cannot be found then • Developed by someone within the organisation,
merge that Trio with another one that does contain a Barrier. • Have been agreed by the action party and
• Likely to improve the business culture of the company
C. Identifying Immediate Causes • Likely to effectively and efficiently solve the problem
12. Has the Immediate Cause led to the failure of a Barrier? • Enduring in that they will be effective for a long time
13. Who is the person or persons that caused failure of the • Extensive in that they are applicable out with the local scene.

20
Tripod Beta User Guide
Annex 3: Errors, Violations and their )VNBO
#FIBWJPVS
Preconditions
6OJOUFOEFE
*OUFOEFE

"DUJPOT "DUJPOT
The conditions that lead to mistakes are different from those
that cause attention failures. Knowing the form of human
error helps in the identification of Preconditions. When the 4MJQT -BQTFT .JTUBLFT 7JPMBUJPOT

Immediate Cause of a failed barrier is due to a sub-standard #BTJD
FSSPS
UZQFT

act, identifying the type of human error which caused it 6OJOUFOEFE

.FNPSZ
3VMF
CBTFE
4JUVBUJPOBM

will help in identifying the related preconditions. "UUFOUJPO
GBJMVSFT
GBJMVSFT ,OPXMFEHF

CBTFE 0QUJNJTJOH

&YDFQUJPOBM

Preconditions are the environmental, situational or

psychological ‘system states’ or ‘states of mind’ that promotes was more or less what was expected of them, commendable,
Immediate Causes. In simple terms the precondition can be unavoidable or just normal. The table below illustrates
found by asking why the person or group of persons that the connection between sub-standard acts and typical
caused the failure had the belief or perception that their act preconditions.

Error type Description Possible Causes/Preconditions

Slip Unintended deviation from a correct plan - Attention failure
of action - Mistiming
- Distraction from task
- Preoccupation with other tasks
Lapse Omission/ repetition of a planned action - Memory failure
- Change in nature of task
- Change in task environment
Mistake (rule-based) Intended action inappropriate to the - Sound rule applied in inappropriate circumstances
circumstances - Application of unsound rule
- Failure to recognise correct area of application
- Failure to appreciate rule deficiencies
Mistake (knowledge-based) Erroneous judgement in situation not - Insufficient knowledge or experience - immaturity
covered by rule - Time/emotional pressures
- Inadequate training
Unintentional Violations - People not knowing how to apply the - Poor writing
Understanding procedures - Complexity
- Failure to understand users
Unintentional Violations - People acting as if there is no procedure - Poor Training
Awareness - Lack of availability on site
Routine Violations Rules broken because they are felt to be - Unnecessary rules
irrelevant or because people no longer - Poor attitude to compliance
appreciate the dangers - Weak supervision
Situational Violations - Impossible to get the job done by - Lack of resources (people, equipment, tools)
(No-can-do) following the procedures strictly. - Failure to understand working conditions
Optimising Violations To get the job done faster, with less - Wanting to do a good job for the “boss” or
- (I-can-do-better.) for disturbances etc. by not adhering to rules. company
Organisational Benefits
Optimising Violations - To get the job done more conveniently or - Personal convenience and opportunities to get more
(I-can-do-better.) for to experience a thrill by not adhering to personal satisfaction from the act
Personal benefits rules.
Exceptional violations Solving problems for the first time and fail - Unexpected situations - no obvious rules
to follow good practice - Pressure to solve problems

21
Tripod Beta User Guide
Annex 4: Basic Risk Factor (BRF) 7. Incompatible goals (IG)
Definitions Failure to manage conflict; between organisational goals,
such as safety and production; between formal rules such
1. Hardware (HW) as company written procedures and the rules generated
Failures due to inadequate quality of materials or informally by a work group; between the demands of
construction, non-availability of hardware and failures due individuals’ tasks and their personal preoccupations or
to ageing (position in the life-cycle). distractions.

The BRF does not include: 8. Communication (CO)

Failure in transmitting information necessary for the
• error-generating mechanisms due to poorly designed safe and effective functioning of the organisation to
equipment Design BRF the appropriate recipients in a clear, unambiguous or
• hardware failures caused by inadequate maintenance intelligible form.
Management BRF
9. Organisation (OR)
2. Design (DE) Deficiencies in either the structure of a company or the way
Deficiencies in layout or design of facilities, plant, it conducts its business that allow responsibilities to become
equipment or tools that lead to the misuse or sub-standard ill-defined and warning signs to be overlooked.
acts, increasing the chance of particular types of errors and
violations. 10. Training (TR)
Deficiencies in the system for providing the necessary
3. Maintenance Management (MM) awareness, knowledge or skill to an individual or individuals
Failures in the systems for ensuring technical integrity in the organisation. In this context, training includes on the
of facilities, plant, equipment and tools, e.g. condition job coaching by mentors and supervisors as well as formal
surveys, corrosion barriers and function testing of safety courses.
and emergency equipment.
11. Defences (DF)
Issues relevant to the execution aspects of maintenance Failures in the systems, facilities and equipment for control
are considered in the BRFs: Error-enforcing Conditions; or containment of source of harm or for the mitigation of
Procedures; Design; Hardware; Communication. the consequences of either human or component failures.

4. Procedures (PR)
Unclear, unavailable, incorrect or otherwise unusable
standardised task information that has been established to
achieve a desired result.

5. Error-enforcing conditions (EC)

Factors such as time pressures, changes in work patterns,
physical working conditions (hot, cold, noisy), etc. acting
on the individual or in the workplace that promote the
performance of sub-standard acts - errors or violations.

6. Housekeeping (HK)
Tolerance of deficiencies in conditions of tidiness and
cleanliness of facilities and work spaces or in the provision
of adequate resources for cleaning and waste removal.

22
Tripod Beta User Guide
Annex 5: Tripod Beta Tree Symbols Examples:

The following notes should be used in conjunction with the A. An explosion weakens a structure which falls down,
definitions in the Glossary (Annex 1) injuring rescue workers. The explosion Event has
resulted in a new Agent being created.
Event B. A man falls 30 metres into the sea. The fall Event
An Event node represents damage, creates a new Object (the man) for an Agent (the sea).
&WFOU injury or loss. Events are the
unplanned and unwanted happenings Failed Barrier
involving the release or exposure of A Failed Barrier node is shown as
Agents. An Event has exactly two letting the Agent or Object to pass
inputs i.e. a line from an Agent plus a line from an Object. through a ‘gap’ in the Barrier thereby
The Agent and Object may themselves be combined Event allowing the Agent and Object to
and Agent/Object nodes. 'BJMFE
#BSSJFS meet to create the Event. The gap
in the Barrier has been caused by an
Agent of Change Immediate Cause node.
An Agent of Change node represents
"HFOU the presence of a potential to change, Immediate Cause
harm or damage an Object upon The Immediate Cause is the action,
which it is acting. It has no inputs, *NNFEJBUF
omission or technical failure that
$BVTF
(i.e. lines, on the left-hand side of caused the Barrier to fail and is
the node), and always connects to an Event node, typically therefore directly connected to it.
via one or more Barriers. This will always be in partnership Immediate Causes include Sub
with the Object that it is changing, damaging or harming. Standard Acts - committed by people - and sub-standard
conditions, e.g. equipment / technical failures. There is
Object always only one Immediate Cause linked to a Failed Barrier
An Object represents the presence of and which represents the cause of the failure.
0CKFDU an entity, (e.g. person, equipment,
reputation, project schedule), that is Precondition
vulnerable to an Agent of Change. It A Precondition causes or increases
has no inputs, (i.e. lines, on the left- *NNFEJBUF

1SFDPOEJUJPO the probability of the Immediate
hand side of the node), and always connects to an Event $BVTF Cause of a Failed Barrier. An
node, typically via one or more Barriers. It will always be in Underlying Cause must be
partnership with the Agent that is causing it to be changed, identified for each organisational
damaged or harmed. Precondition, but Preconditions such as natural phenomena
or other conditions outside the Company’s influence may
Event and Agent - Event and be end nodes.
Object
&WFOU"HFOU Combination nodes are used to Underlying Cause
represent an Event (e.g., damage or An Underlying Cause is the source
injury), which goes on to play a further 6OEFSMZJOH of an organisational Precondition.
$BVTF
role in the incident as an Agent or By definition, it will be an ‘end
Object. Combined nodes will often be node’. There can be many Underling
&WFOU

&WFOU0CKFDU
identified in the initial investigation Causes linked to each Precondition.
'JSF
EBNBHF


as Events and be changed later when The Basic Risk Factors, (BRFs) or reference to Management
Events are chained to describe the System elements are assigned to the Underlying Cause.
consequential effect of one Event.

23
Tripod Beta User Guide
 Missing/Inadequate Barrier Annex 6: Tripod Beta tree rules
A Missing Barrier node provides
for cases where plans and 6.1 Trios (Agents, Objects, Events)

.JTTJOH
#BSSJFS procedures have specified a
Barrier but investigation shows A. Agent and 1 object
that none was established or that
it was in place but was inadequate for the intended role.
"HFOU
There are no Immediate Causes for this type of Barrier and
it is linked directly to an Underlying Cause. &WFOU

Effective Barrier
An Effective Barrier node 0CKFDU

represents a Barrier that did not

fail and provided the successful
&GGFDUJWF
#BSSJFS
containment of an Agent
or protection of an Object. B. Multiple Agents
It is used to model a ‘Near Miss’
or a branch of an incident tree
where further injury, damage or loss was averted. There is "HFOU

no Immediate Cause, Precondition or Underlying Cause &WFOU

nodes linked to it.

Narrative

 
"HFOU
Models, being simplifications,
cannot embrace the full complexity
/BSSBUJWF of the real world. Occasionally there
is a need to clarify the connection
between two nodes. The Narrative NO - One AEO trio has only one Agent
node provides this facility and is
shown on the Tripod Beta Tree as C. Multiple objects
required.

0CKFDU

&WFOU

0CKFDU

NO - One AEO trio has only one Object

24
Tripod Beta User Guide
D. One Agent - Multiple Events 6.2 Missing Barrier

0CKFDU
 A. Underlying Cause

&WFOU
6OEFSMZJOH
$BVTF

"HFOU

.JTTJOH
#BSSJFS
&WFOU


This is the case if the Missing Barrier NEVER has been there,
but it was reasonable to expect it there. Also it is impossible to
0CKFDU

identify anybody who should have designed or implemented
the Barrier. In cases where the Missing Barrier has been
One Agent can affect multiple Objects creating multiple removed (after it has been there previously), or possible
Events. to identify who should have designed or implemented the
barrier, it is considered a FAILED Barrier.
D. One object - Multiple Events
B. Multiple Underlying Causes

"HFOU
6OEFSMZJOH
&WFOU $BVTF

6OEFSMZJOH
$BVTF
0CKFDU
.JTTJOH
#BSSJFS

&WFOU


A Missing Barrier may have more than one Underlying

Cause.
"HFOU

C. An Immediate Cause

*NNFEJBUF

One Object can be affected by multiple Agents creating $BVTF

multiple Events

.JTTJOH
#BSSJFS

NO - A Missing Barrier can only be connected to an

Underlying Cause.

25
Tripod Beta User Guide
D. An Immediate Cause and Precondition D. An Immediate Cause, Multiple Preconditions and
Underlying Causes

6OEFSMZJOH
1SFDPOEJUJPO
$BVTF
6OEFSMZJOH
1SFDPOEJUJPO
$BVTF

*NNFEJBUF

$BVTF

.JTTJOH
#BSSJFS 'BJMFE
#BSSJFS

6OEFSMZJOH
1SFDPOEJUJPO
$BVTF

NO - A Missing Barrier can only be connected to an

Underlying Cause.

6.3 Failed Barrier 1SFDPOEJUJPO

A. An Immediate Cause, A Precondition and an

Underlying Cause 6OEFSMZJOH
1SFDPOEJUJPO
$BVTF

6OEFSMZJOH *NNFEJBUF
*NNFEJBUF

1SFDPOEJUJPO
$BVTF $BVTF $BVTF
'BJMFE
#BSSJFS
6OEFSMZJOH
1SFDPOEJUJPO
$BVTF

'BJMFE
#BSSJFS

E. An Immediate cause, without an underlying Cause

This is very exceptional; only case created by other,
B. Precondition and underlying Causes
*NNFEJBUF

1SFDPOEJUJPO
$BVTF

6OEFSMZJOH *NNFEJBUF

$BVTF $BVTF

'BJMFE
#BSSJFS

'BJMFE
#BSSJFS
(uncontrollable) parties. If this is used in a tree, explain why.

NO. A Failed Barrier must be linked to an Immediate Cause.

C. Multiple Immediate Causes Preconditions and

Underlying Cause

6OEFSMZJOH *NNFEJBUF

1SFDPOEJUJPO
$BVTF $BVTF

6OEFSMZJOH *NNFEJBUF

1SFDPOEJUJPO
$BVTF $BVTF
'BJMFE
#BSSJFS

NO. There can only be ONE Immediate Cause connected

to a Failed Barrier

26
Tripod Beta User Guide
6.4 Inadequate barrier 6.5 Preconditions

A. An Underlying Cause A. An Immediate Cause

6OEFSMZJOH 6OEFSMZJOH *NNFEJBUF

1SFDPOEJUJPO
$BVTF $BVTF $BVTF

*OBEFRVBUF
#BSSJFS 'BJMFE
#BSSJFS

This is the case where a Barrier is in proper condition, but See also 6.4.3 a), c) and d).
not able to prevent the release of the Agent or protect the
Object effectively. (E.g., a fence is in tact but built too low B. Multiple Immediate Cause
so that people can climb over it.) Also it is impossible to
identify anybody who should have designed or implemented 6OEFSMZJOH 1SFDPOEJUJPO
*NNFEJBUF

$BVTF
$BVTF
the Barrier.

This is called an INADEQUATE Barrier. It is depicted by *NNFEJBUF

$BVTF
the same symbol as a Missing Barrier.

B. Multiple Underlying Causes

6OEFSMZJOH 'BJMFE
#BSSJFS 'BJMFE
#BSSJFS

$BVTF

6OEFSMZJOH C. An Underlying Cause

$BVTF

*OBEFRVBUF
#BSSJFS

6OEFSMZJOH
1SFDPOEJUJPO
An Inadequate Barrier may have more than one Underlying $BVTF

Cause *NNFEJBUF

$BVTF

'BJMFE
#BSSJFS

6OEFSMZJOH 1SFDPOEJUJPO
$BVTF

See also 6.4.3 a), c) and d).

D. Multiple Underlying Cause

6OEFSMZJOH
$BVTF

1SFDPOEJUJPO

6OEFSMZJOH
$BVTF

27
Tripod Beta User Guide
6.6 Underlying Causes C. Multiple Missing Barriers

A. A Precondition 6OEFSMZJOH
$BVTF

6OEFSMZJOH *NNFEJBUF

1SFDPOEJUJPO
$BVTF $BVTF

.JTTJOH
#BSSJFS
.JTTJOH
#BSSJFS

'BJMFE
#BSSJFS

D. Inadequate Barriers
See also 6.4.3 a), c) and d).
6OEFSMZJOH
B. Multiple Preconditions $BVTF

*OBEFRVBUF
1SFDPOEJUJPO

6OEFSMZJOH 1SFDPOEJUJPO
$BVTF

*NNFEJBUF

$BVTF
'BJMFE
#BSSJFS
6OEFSMZJOH 1SFDPOEJUJPO
$BVTF

C. A Missing Barrier

6OEFSMZJOH
$BVTF

.JTTJOH
#BSSJFS

28
Tripod Beta User Guide
Annex 7: Tripod Beta and BowTie
BowTie, Fault Tree and Event Tree
A BowTie diagram is a simplistic representation of a
combined Fault Tree and Event Tree, as shown below.
(The red lines depict the trajectory of a particular incident.)
Fault Tree

Fault Tree

5PQ

&WFOU
(BT
3FMFBTF

5PQ
*ODJEFOU
,FZ #BSSJFST 5ISFBUT PS
FWFOU 5SBKFDUPSZ

Event Tree

9ES /P
)BSN

5PQ

&WFOU 9ES
(BT .O
/P
)BSN
3FMFBTF 9ES

(BT
QPPM
.O

9ES
.JOPS
"TTFU
%BNBHF
.O .JOPS
#VSOT
(BT 9ES
%FUFDUJPO &4% .JOPS
"TTFU
%BNBHF
.O
.JOPS
*OKVSJFT

0QFSBUPS .O
.JOPS
"TTFU
%BNBHF
*OUFSWFOUJPO .VMUJQMF
'BUBMJUJFT
.O
*HOJUJPO .JOPS
&OWJSPONFOUBM
4PVSDFT *NQBDU
*TPMBUFE
'JSF

'JHIUJOH

*ODJEFOU &NFSHFODZ
,FZ $POTFRVFODFT 3FTQPOTF
#BSSJFST 5SBKFDUPSZ

29
Tripod Beta User Guide
BowTie

5PQ

&WFOU
(BT
3FMFBTF

3EQUENCEOFFAULTSANDEVENTSLEADING 3EQUENCEOFEVENTAND&AILED"ARRIERS
TOTHE@UNWANTEDh4OP%VENTv ,EADINGTOESCALATIONANDINCREASINGHARM

+EY "ARRIERS 4HREATS #ONSEQUENCES 4OP%VENT *ODJEFOU

5SBKFDUPSZ

BowTie, and Tripod Beta Tree A series of faults, Events and Failed Barriers, lead to the
Whilst the BowTie risk assessment and the Tripod Beta “Top Event”, (or “Main Event” using Tripod Beta terms),
incident analysis methodologies are based on the same via a specific incident trajectory. After the Top Event, harm
scientific principles, there is not necessarily a direct one to was caused by a subsequent Event and a Failed Barrier along
one relationship between the entities within them. However, the specific incident trajectory. The consequences could
reviewing the appropriate BowTie risk assessment(s) have been more severe but, in the case shown below, the
associated with an incident could help identify Barriers incident progression was stopped by an Effective Barrier
in the Tripod Beta Tree. The simple relationship between and the last and End Event shown on the Tripod Beta Tree
a BowTie and a Tripod Beta Tree is shown in below. being a Potential Event.

4RAJECTORYOF)NCIDENT

5PQ

&WFOU
(BT
3FMFBTF

!GENT

%VENT /BJECT

%VENT !GENT
/BJECT
%VENT !GENT
"ARRIER !GENT
/BJECT "ARRIER %VENT
"ARRIER
"ARRIER
/BJECT

30
Tripod Beta User Guide
Annex 8: Worked example of Tripod • The search was extended to other locations off the
Beta Tree designated route, and the vehicle and driver were
eventually located at 1830. The vehicle had left the
Introduction road and rolled over and the supervisor had suspected
In this annex a fictitious incident is used to provide an example spinal injuries.
of the development of a Tripod tree. It should be realised that • The injured man was evacuated by the field ambulance
a Tripod Beta analysis, as shown in a tree, is a model of a to the field first aid post and from there to the base
complex incident. There is not a single correct model of any hospital. The view of the doctors is that the injuries
incident and this annex shows one good example of a vehicle will probably result in permanent disability, and that
accident. The event could be modelled in a different ways. the attempts by local population to extract him from
However, different models should still identify the similar the vehicle while waiting for the rescuers to find him
key barriers and underlying causes. Any modelling process is likely to have been a major factor contributing to
aims to simplify a complex situation to aid understanding. the severity of the injury. The victim was conscious
and had taken notice of the time and made a mental
The Incident calculation of the time by which he could expect the
A driver has been involved in a vehicle incident and has rescue team to show up. When they did not show up
badly injured his back. You are tasked with leading an at the expected time he became nervous and allowed
investigation into this incident. local villagers to get him out of the vehicle.
• Examination of the vehicle and the site indicate that
Initial Investigation only one vehicle was involved, and that there were no
Visits by the investigation team members to the incident indications of a tyre blow-out or other catastrophic
site, the production centre in the area and the base hospital technical failure.
establish the following facts:
The Core Diagram
• The driver was delivering goods to a remote location. The core diagram focuses on what happened. If there is
• He left the Area Production Centre on schedule at 0800 evidence at this stage of why any of the events happened it
hours. According to his posted Journey Management should be ignored for the time being. The start is the Main
plan, he was due to return to the Centre at 1230. Event - why the incident is being investigated.
• His failure to return was not reported until 1500.
A search was initiated at 1630 along the route he had
indicated in his Journey Management Plan without
success.

1SJPS
FWFOU
1SJPS
FWFOU
1SJPS
FWFOU
.BJO
FWFOU
4VCTFRVFOU
FWFOU

4JEFXBZT
GPSDFT

PO
WFIJDMF
GSPN

XJOE
PS
DPODBWF

SPBE

/FFE
GPS
5ZSFT
IJU

USBOTQPSUBUJPO
TIPVMEFS
PG
HPPET PG
SPBE

7FIJDMF
PO

3PMM
PWFS
PG

UIF
SPBE
WFIJDMF

7FIJDMF
JO
7FIJDMF

QBSLJOH
MPU TUBCJMJUZ %SJWFS
XJUI
CBDL
JOKVSZ

1FSNBOFOU

%SJWFS EJTBCJMJUZ
GSPN

TQJOBM
JOKVSZ
QPUFOUJBM
GPS

*ODPSSFDU

FYUSBDUJPO
PG
ESJWFS

31
Tripod Beta User Guide
Main Event: Driver with back injury Prior event: Tyres hit shoulder of road
The injury is a rational start point in this case. The initial The new Object (vehicle stability) and the new Agent (tyres hit
Event-Object-Agent (EOA) trio is straightforward; the shoulder of the road) are now examined to determine whether
Event is Driver with back injury. The Object is the Driver they were the result of prior Events. No further investigation
and the Agent is the Roll over of vehicle. leads are identified for the Object, the stability of the vehicle.
The Agent, tyres hitting shoulder of the road is a result of
Subsequent event: Permanent disability from spinal deviating from the intended straight course which is caused
injury by lack of control of the vehicle e.g. by the driver falling asleep
Determine whether there were prior or subsequent Events that at times. A convex road and side winds create forces for the
need to be accounted for. Note the qualification ‘that need to vehicle to drift of the road when not properly controlled.
be accounted for’.
Prior event: Vehicle on the road
Start with the Event. Not every driver with spinal injury The new agent is therefore Sideways forces on vehicle from side
suffers permanent disability, and medical advisers have winds and convex road surface.
implicated failures in rescue and aftercare. The permanent
disability from spinal injury is depicted as a Subsequent Event, No further investigation leads are identified for the new
the (potential for) Incorrect extraction of the driver is the agent Agent as side winds and convex roads are normal. Remains to
to change Driver with back injury - who is the Object. Note consider whether Vehicle on road is preceded by another trio.
that the agent Incorrect extraction of driver should no be seen It is found that the need to transport goods is the Agent for the
as an event; it has not yet happened and can be prevented by safely parked vehicle in parking lot, the object, to be result in an
the barriers. To make this clear the words (potential for) can Event-Object Vehicle on the road.
be added.
The Core diagram is now complete, comprising five linked
Prior event: Roll-over of vehicle trios. It defines the limits that have been established for the
Now consider the Object in the Main Event trio. Was the investigation, prior and subsequent to, the ‘Main Event’.
driver present as a result of some prior event? In this example
the driver was engaged on legitimate operational activities Barriers
with his back resting against the seat; this is normal and needs Ten trajectories have been defined in the core diagram,
no further explanation. A similar question is posed to the representing the conceptual paths bringing the Agents and
Agent in the Main Event trio. Was the rollover the result of Objects together, resulting in the identified Events. The
some prior event? Clearly the roll over is an abnormal situation investigation must now identify the Barriers that should
that needs to be accounted for, so there is a prior event. The have acted on these trajectories to prevent the Events from
Object is the vehicle stability which was changed when the occurring. If any of these Barriers had been effective, the
tyres hitting the shoulder of the road. sequence of events would have been interrupted causing the

3PMM
PWFS

PG
WFIJDMF

%SJWFS
XJUI
CBDL
JOKVSZ

%SJWFS

1FSNBOFOU

6TF
PG
TFBUCFMU EJTBCJMJUZ
GSPN

TQJOBM
JOKVSZ

QPUFOUJBM
GPS

*ODPSSFDU

FYUSBDUJPO
PG
ESJWFS

&GGFDUJWF
TFBSDI 3BQJE
NPCJMJTBUJPO

PG
TFBSDI
UFBN

32
Tripod Beta User Guide
outcome to be different. For the discussion the tree is broken would have prevented the crashed vehicle to be on the road
into two parts, the first part dealing with the events after the at all. Secondly, during the Journey Management discussion
vehicle started to roll over and the second part dealing with prior to departure the Journey Manager is supposed to
the events leading to the roll over. assess whether the assigned driver is fit to drive and stop
the driver if the driver himself states that he is not rested or
The investigators need to examine each trio separately, the Journey Manager suspects that the driver is not rested
applying their knowledge of the operational process, and fit.
investigating further if necessary to identify what barriers had
been established: The next barrier is about the driver being on the road. Not
being rested and alert does not necessarily mean that the
• To control the Agent vehicle cannot be controlled. Initially the driver was alert but
• To protect the Object. after a while he occasionally dozed off. A continued Alert and
Correct steering would have prevented the accident. Once
Consider the primary injury. The driver’s back was injured the vehicle hit the shoulder of the road the driver woke up
when the vehicle rolled over. There were no barriers in place again and should have steered his vehicle onto the road in a
to stop the motion of the vehicle once it started to roll. One controlled manner as taught in training courses.
barrier only could have protected the driver’s back (preventing
back injury or reducing the seriousness): the use of a seatbelt. At this moment one should consider the entire tree again
In the subsequent trio two barriers could have prevented and check whether anything else could have stopped the
the situation of the driver to aggravate and develop into a sequence of events. This is best done as a team effort. The
permanent disability. They relate to the timely location of HSE Case, procedures and instructions that relate to this
the victim by an immediate response and effective search by incident should be considered to make sure that all barriers
a team that knew where to look. Each of these barriers could mentioned in there have been reflected in the tree.
have reduced the time to find the victim prior to incorrect
extraction from the vehicle.

Now we consider the second part of the tree. The vehicle

on the road could have been prevented in two ways. Firstly
the urgency of the load could have been investigated by the
logistics planners which would have led to the conclusion that
the goods could have been combined with a large truckload
which was planned to leave the following day. During the
investigation it was discovered that there was no urgency
for the goods to be delivered instantly. This consideration

4JEFXBZT
GPSDFT

PO
WFIJDMF
GSPN
5ZSFT
IJU
TIPVMEFS

XJOE
PS
DPODBWF
PG
SPBE
SPBE
"MFSU
BOE
DPSSFDU
$PSSFDU
SFBDUJPO
PO
3PMMPWFS
PG

TUFFSJOH IJUUJOH
TIPVMEFS
WFIJDMF
PG
UIF
SPBE

/FFE
GPS

USBOTQPSUBUJPO
PG

HPPET

$PNCJOJOH
MPBE
4UPQ
OPOSFTUFE
7FIJDMF

XJUI
PUIFS
MPBET ESJWFS
UP
ESJWF TUBCJMJUZ
7FIJDMF
PO

&WFOU

UIF
SPBE
'JSF
EBNBHF

7FIJDMF
JO

QBSLJOH
MPU

33
Tripod Beta User Guide
Tripod Causation Paths Underlying Cause 1
Each of the seven failed barriers has a Tripod causation path: Fitness and resting of drivers has not been addressed in the
journey management procedure and has not been considered
• The Immediate Cause that defeated the barrier. as an issue. The Journey Management Plan procedures have
• The Precondition(s) that caused or promoted each weaknesses in many respects.
Immediate Cause,
• The Underlying Cause(s) that created each Precondition 2
Precondition. The Journey Manager has no other choice then to use the
Although in some cases there may be shared causes, these driver that is available. He beliefs that the job cannot wait
paths can be investigated independently from each other. and there are no other drivers available at that moment. So
he decided that the job has to be done by the driver that is
Barrier: Combining loads with other loads available
Immediate Cause
Journey Manager misses opportunity to combine loads. This Underlying Cause 2
is a knowledge based mistake that has become common place. See above under “combining loads”
There is a need to look at system to get correct information
to the individual in an understandable manner Barrier: Alert and correct steering
Immediate Cause
Precondition Driver fades out on and off behind the wheel. A lapse and
The Journey Manager believed that an urgent delivery possible violation of “pull off and stop” policy.
was required as stated on the requisition. Although he had
noticed that almost all requests for transport came with an Precondition 1
“immediate” status he did not enquire what “immediate” Drivers should be informed that adequate sleep is important
meant. to ensure alertness, and that many serious road traffic
accidents are caused by sleepiness. The other fact that
Underlying Cause drivers should know is that sleep is the only remedy against
Communications between Journey Manager and the sleepiness. Taking a 20 minute nap combats sleepiness
customers left to be desired. Usually the customers ask effectively. This driver was convinced that he was doing
for immediate delivery because it is their experience that the right thing by rushing for his delivery and not allowing
sometimes loads take weeks to be delivered if not specified himself a nap. He believed that immediate service was
as “immediate”. Simple phone calls or regular meetings to expected from him and he tried to keep himself awake by
discuss delivery issues do not take place. singing, loud radio and chewing gum.

Barrier: Stop Non-Rested driver Underlying Cause 1

Immediate Cause The company does not provide Advanced Driving Courses
Journey manager does not stop the non-rested driver. for its drivers in which knowledge about the relation between
A violation on the rules that would appear to be routine. safe driving and driver alertness is addressed.
Culture and organisational issues that encourage this need
to be investigated. Precondition 2
Driver beliefs that even with a couple of hours of sleep he
Precondition 1 can drive safely. He has done this before and so far has been
Journey Managers have a responsibility to verify that able to complete his trips without accidents. He considers it
drivers are competent, physically fit for the job and rested. as a weakness to admit that he has sleeping problems and
However, this is usually not done and the Journey Manager feels that he may loose his job.
assumes that every driver on his doorstep is competent and
rested. He has never been told about the need to check the Underlying Causes 2
suitability, fitness and alertness of drivers and it is not stated There are not enough drivers for the number of trips required
in any of the manuals that were issued to him. so sometimes drivers arrive home late and have to start very

34
Tripod Beta User Guide
early to get cargo loaded. Together with travel between the Underlying Causes
yard and his home he frequently has less than 8 hours at Management failure to ensure that their policies are correctly
home during which he has to wash, eat, socialise and sleep. communicated and interpreted. (Communication). Local
The company does not maintain any control over the length culture stimulates risk taking, “macho driving” etc. and
of time in-between duties (work-life balance). Company discourages compliant behaviours.
does not provide Advanced Driving Courses in which the
need for regular deep sleep is explained. Barrier: Effective search
Immediate Cause
Barrier: Correct reaction on hitting shoulder of Search team was delayed in finding the car because route that
the road driver should take was not documented or communicated.
Immediate Cause A violation of the journey management process.
Driver overreacts when waking up and over steers vehicle
This is mostly an instinct reaction that is difficult to resolve Precondition
by training. Search team were unaware of exact location of the accident.

Precondition Underlying Cause

Driver beliefs he is a good driver and while waking up he Failure by the owner of the Journey Management Plan to
does not take a conscious action; there is hardly a thought ensure that those operating under the Journey Management
process. The prime reaction is to get back on the road as Plan were adequately trained and competent in their
quickly as possible (rather than slowing down and gently use e.g. with respect to discussing the route to be taken,
steering back onto the road). documenting the route and stressing the importance of not
deviating from the route without clear communication with
Underlying Cause the home base.
The company does not provide Advanced Driving Courses
for its drivers in which skills in regaining control is practised
such that they become routine.

Barrier: Use of seatbelt

Immediate Cause
Driver failed to use seat belt. In a statement to the investigation
team he maintained that this was a ‘one off’ lapse caused by
his being preoccupied with his task. Further interviews with
relevant staff suggest that the requirement to wear seat belts
was insufficiently stressed during induction. In the country
where the incident happened seat belts are not required
by law, and many newcomers were under the impression
that it was a strong Company recommendation but not a
requirement. A violation that appears to be routine.

Precondition
The local Safety Induction Trainer incorrectly interpreted
management policy relating to seat belts. This lead to the
use of seatbelts not seen as part of ‘driving safety culture’
and whereas most drivers in the area consider the use of
seatbelts as “childish” the driver concerned in this incident
also preferred not to use a seatbelt.

35
Tripod Beta User Guide
Barrier: Rapid Mobilisation of Search Team Underlying Cause 2
Immediate Cause Management does not enforce regular exercises at random
Is a failure by Duty Manager to initiate a search operation moments to check functioning of the Emergency Response
within target time (Journey Management Procedures call System and to stress the need to adhere to duty procedures.
for search to be mounted within 45 minutes of overdue
alert). In this case it took 75 minutes. Vehicle design:
Further investigation established that the vehicle design
Precondition 1 was essentially ‘fit for purpose’ with respect to occupant
The control room staff occasionally had to attend to outdoor protection. The Procurement Department have in place
duties during which they could not always be contacted. specifications for the vehicle the company should buy and
Control room staff just did what was expected from them this particular vehicle had done extremely well in crash
and did not express any concerns to there boss that they tests. Rollover damage resulting in vehicle write-off is a
may not be able to respond quickly to emergencies when comparatively rare event (fewer than one in 20 vehicles
attending to their outdoor duties. is damaged to this extent in a rollover). Previous studies
indicate that attempting to avoid this damage by special
Underlying Cause 1 vehicle design or modification would not be feasible.
Shortage of operators due to cost cutting drive in
combination with a lack of courage of operators to speak up Recommended Action
when they cannot meet all demands put on them (afraid of Recommendations are now required addressing each of the
being sacked with the next cost cutting round). Failed Barriers (vehicle design now excluded), specifying
actions that will restore the barriers at least on a temporary
Precondition 2 basis, and addressing the eleven identified Underlying
The emergency response team attended the party to Causes.
celebrate the 40 anniversary of the communications officer
with coffee and cakes.

36
Tripod Beta User Guide
 $PNQBOZ
EPFT
%SJWFS
EPFT
OPU
%SJWFS

OPU
SFRVJSF
BEW
LOPX
IPX
UP
TUFFS
PWFSTUFFST

ESJWJOH
DPVSTF PVU
PG
USPVCMF WFIJDMF

%SJWFS
EPFT
OPU

LOPX
PG
UIF
OFFE

GPS
B

NJO
OBQ
5PP
GFX
ESJWFST

PO
UIJT
KPC

Tripod Beta User Guide

3FTUJOH
JT
OPU
%SJWFS
CFMJFGT
IF

%SJWFS
GBEFT

DPOUSPMMFE

JT
SFTUFE
XJUI
GFX

POBOEPGG
CFIJOE

%SJWFST
BSF
PODBMM IPVST
QSFUSJQ

UIF
XIFFM
TMFFQ

'JUOFTT
PG
ESJWFST
$IFDLJOH
ESJWFS

OP
JTTVF
JO
KPVSOFZ
PO
mUOFTT
OPU

NOHU
QSPDFEVSF DPNNPO
QSBDUJDF
+PVSOFZ
.OHS
4JEFXBZT
GPSDFT

5ZSFT
IJU
TIPVMEFS

EPFT
OPU
TUPQ
PO
WFIJDMF
GSPN

PG
SPBE
OPOSFTUFE
ESJWFS XJOE
PS
DPODBWF

SPBE
"MFSU
BOE
DPSSFDU
$PSSFDU
SFBDUJPO
PO
3PMMPWFS
PG

TUFFSJOH IJUUJOH
TIPVMEFS
PG
SPBE
WFIJDMF
*OBEFRVBUF

DPNNVOJDBUJPO
#FMJFG
UIBU

BCPVU
VSHFODZ
PG
EFMJWFSZ
DBOOPU

UIF
EFMJWFSZ XBJU
+PVSOFZ
NBOBHFS

NJTTFT
PQQPSUVOJUZ
7FIJDMF
TUBCJMJUZ
UP
DPNCJOF
MPBET
%SJWFS
XJUI


CBDL
JOKVSZ
/FFE
GPS
-PDBM
DVMUVSF

USBOTQPSUBUJPO
PG
TUJNVMBUFT

HPPET h.BDIP
ESJWJOH
%SJWFST
DPOTJEFS
%SJWFS
SFGVTFT
UP

$PNCJOJOH
MPBE
XJUI
4UPQ
OPOSFTUFE
ESJWFS
XFBS
TFBUCFMU
&$ VTF
PG
TFBUCFMUT
BT

PUIFS
MPBET UP
ESJWF
iDIJMEJTIw
7FIJDMF
PO
UIF

&WFOU

SPBE
'JSF
EBNBHF



.BOBHFNFOU

EPFT
OPU
FOGPSDF

7FIJDMF
JO
VTF
PG
TFBUCFMUT
QBSLJOH
MPU
*(
%SJWFS
1FSNBOFOU

6TF
PG
TFBUCFMU EJTBCJMJUZ
GSPN

4IPSUBHF
PG
$POUSPMSPPN
TQJOBM
JOKVSZ
PQFSBUPST
EVF PQFSBUPS
DIBSHFE

UP
DPTU
DVUUJOH
XJUI
PVUEPPS

ESJWF EVUJFT &NFSHFODZ
UFBN

03 NPCJMJTFT
BGUFS

NJOVUFT

.BOBHNFOU &NFSHFODZ
SPPN

EPFT
OPU
FOGPSDF
UFBN
OPU
PO
DBMM

EVUZ
QSPDFEVSFT
EVF
UP
DPNQBOZ

PG QBSUZ
*(

*OFGGFDUJWF
4FBSDI
UFBN
OPU
4FBSDI
UFBN

USBDLJOH
TZTUFN
TVSF
BCPVU
BDUVBM
NBLFT
EFUPVS

GPS
SPBE
JODJEFOU
TJUF CFGPSF
mOEJOH

USBOTQPSU DSBTIFE
WFIJDMF
%'

QPUFOUJBM
GPS

*ODPSSFDU

FYUSBDUJPO
PG

ESJWFS
&GGFDUJWF
TFBSDI 3BQJE
NPCJMJTBUJPO
PG

TFBSDI
UFBN

37
Annex 9: Performing an Investigation rapidly with time, (often on purpose e.g. clean up or restart
operations), and delayed investigations are usually not as
Introduction conclusive as those performed promptly.
It is imperative to learn from incidents, which have created
loss (or potential loss), if the chances of these losses recurring Categories of Evidence
are to be minimised. Therefore, a systematic investigative Susceptibility of evidence to breakage, distortion or loss, i.e.
approach, thorough pre-investigation planning and the its fragility, is important.
pooling of experience and expertise wherever possible within
the organisation, is vitally important. This annex provides Evidence can be obtained from anyone or anything that
details of that approach. provides knowledge about the mishap. A common and
convenient classification of evidence is known as the four
Basics P’s. This, in order of decreasing durability, (i.e. the least
durable last), is as follows:
Qualities of an Effective Investigator
Effective investigations depend heavily on a disciplined Papers are most durable and harder to change, however
approach and also on the attributes of the investigator, i.e., they may be overlooked or altered.

• Integrity to be above any influences that may distort Parts are still durable but subject to pilferage, corrosion,
information. Fact-finding requires truthful disclosures. marring and misplacement.
• Objectivity and an open mind to avoid premature
conclusions and also to be receptive to evidence Positions are evidence of physical relationships and
contrary to hypotheses. Opinions need to be sequences. Post-contact positions are less durable as things
secondary to the information revealed by the objective are moved by emergency response crews and others involved
evidence. in the incident. They may also be subject to cleanup or a
• Perseverance to trace “symptoms” back to underlying desire for a rapid return to production operations.
causes. (Tracing the roots of deficiencies into the
management systems can be a painstaking task.) People are sources of eye or ear witness testimony to the pre-
• Curiosity and a persistent desire to know more and contact, contact and post-contact phases. This is the least
question thoroughly. durable type of evidence as peoples memories fade quickly
• To be observant and having an eye for detail in with time and can become increasingly unreliable. However
detecting the unusual, out of place, etc. where evidence of the other parts has been previously
• Imagination to see alternative states or conditions and collected, the People evidence becomes more in the nature
compare with the actual that can then stimulate the of corroboration. Interviews should still be conducted soon
search for better evidence. after the incident.
• Humility to consider and recognise the experience,
ideas and observations of others. Initiating the Investigation
• Intuition to recognise valid ideas that emerge from the The first step in the investigation and analysis process is
collected data and to recognise a simple solution to a to decide on its extent, i.e., intensity, formality, timescale,
complex problem. reporting levels, etc. In order to maximise the organisations
• Tact and patience in revealing and using critical and opportunity to learn, near misses with high potential
sensitive information. severity and consequences should also be investigated, and
Investigative skills in examination of parts, photography, as thoroughly as those where harm did actually occur.
mapping and recording, etc are important but generally
secondary to the above qualities. This classification of incidents is normally based on:

Timing A. The actual severity level of harm caused and/or

An investigation should be carried out as soon as possible B. The potential harm that could have resulted from the
after an incident. The quality of evidence will deteriorate incident and the likelihood of it happening.

38
Tripod Beta User Guide
“Near misses” are classified, using a risk matrix, as “High”. • Records of instructions / briefings given on the
“Medium” and “Low Risk” Incidents. Actual incidents are particular event or job being investigated;
based on a categorisation of severity levels of harm. • Location plans;
• Organisation chart; and
From the classification of the incident the Investigation • Product information.
team leader is appointed. The higher the severity, (or risk
for “near misses”), of the incident, the more senior the team Fact Finding
leader is likely to be.
Evidence gathering Plan
Investigation Team members are then appointed. The process of gathering information and evidence involves
As the investigation proceeds it may be necessary to change the following steps:
team members or co-opt specialists for specific inputs and
advice. 1. Collecting physical evidence (identifying,
documenting, inspecting and preserving relevant
Terms of reference for the incident investigation and analysis material)
are issued which, for example, include: 2. Collecting documentary evidence
3. Collecting human evidence (locating and interviewing
• A clear understanding of the current situation; witnesses)
• The roles, requirements and accountabilities of all 4. Examining organisational concerns, management
team members; systems and line management oversight
• The scope of the investigation and its boundaries;
• A clear understanding of the deliverables and key Initial Actions and Observations
milestones, e.g., start, interim report, final report; The conduct of the investigation follows a number steps
• The requirements to validate findings; beginning with the initial actions and observations and
• The final report format; and then followed by the detailed examination and recording
• The need for actions on failed and missing barriers and of evidence.
also those to correct underlying causes.
The investigator should not overlook concern for own
Pre-Investigation Planning safety and that of others in the haste to respond. Determine
Due to the fragility of site evidence planning for on-site priorities as early as possible on entering the scene, however,
readiness ensures a well coordinated and rapid response do not approach until it is safe to do so.
to incidents. A standard “ready to go” list of equipment
required to conduct investigations of different types of Decide on priorities such as, controlling site access or seeking
incident would be useful. more assistance. Emergency services may have necessarily
interfered with the scene in the removal of injured or other
Such items could include for example; camera, first aid, parts and in order to bring the situation under immediate
clipboard, audio recorder, graph paper, recording forms, control, prior to your arrival. This is an example of the
tape measure, barrier tape, sample containers and evidence fragility of evidence.
bags, identification tags, mirror, torch, etc. Protective
equipment to meet universal precautions in the handling or The scene may well be confused particularly if a spectacular
contact with human body fluids is also essential. event has occurred. Site evidence is the most transitory and
disappears first. Witnesses may be lost in a crowd or leave
Before visiting the incident location, appropriate background the site. Items and materials may be removed.
information should be obtained and could include:
Much of the site evidence is short-lived hence it is important
• Procedures and standards for the type of operation to act quickly to collect it. Rough sketches and photographs
involved; and careful visual observation will be vital in later
• Risk assessments related to the incident; reconstruction.

39
Tripod Beta User Guide
The initial identification should include: planning and individual responsibilities. The investigation
could establish the extent to which these procedures and
• the people involved (injured and witnesses); instructions were understood and acted upon as this could
• equipment and tools involved (in use, on stand-by and indicate the effectiveness of training and supervision.
secured or standing);
• materials (in use, ready for use and stored in the area); The role and functions of management systems must
• environmental factors (weather, lighting levels, heat, be considered when collecting and reviewing evidence.
noise). These can be used to develop questions that will guide
evidence collection and analysis of the management system
Recording the Incident Scene (Position) at all levels.
Important facts can be gained from observations made at
the scene of the incident, particularly if the location is kept Documentation is a vital source of evidence in examining
is undisturbed. However, rescue operations or the presence and comparing the ‘actual’ and ‘expected’ performance of
of residual hazards may necessitate moving some of the systems and people. Documentary evidence may exist in a
equipment, but, if possible, the site should be kept “as is” variety of forms and locations as indicated below.
until at least a preliminary investigation has taken place.
• Automatic recording devices; voice recordings, work
Photographs, both colour still and video as appropriate, instructions,
should be taken to record the physical relationships, e.g. • Management policies
between people, tools, and equipment involved in the • Procedures and standards
incident. The position of valves, switches, recorders etc, • Risk assessments and studies
should be recorded. • Purchasing documents
• Maintenance routines and records
Sketches should be made and include any reference • Personnel records
measurements of distances, angles, locations. • Related incident reports
• Work assignment and instructions, electronic and
Physical Evidence ( Parts) paper.
This phase begins after the more fragile evidence of positions • As-built drawings
is recorded. Physical evidence includes the condition of • Inspection records
such items as; tools, equipment; materials; hardware, plant • Audit reports
facilities; scattered debris, liquids and possibly gases, etc. • Log books
• Tachograph records
Normally physical evidence should not be removed until
witnesses have been interviewed, as visual reference can As with the collection of “parts” data, it is important to
stimulate their memory. determine how the documentation relates to improving
understanding of the incident process. The investigator
Items need to be systematically labelled, collected, protected, need not be an expert in the aspect under study however the
preserved, evaluated and recorded. required knowledge can be obtained from the appropriate
personnel and system specifications.
A log should be kept of location, date, time and description
of evidence and controlled by signature transfer i.e. a chain In many cases the identification of relevant documentary
of custody. records becomes evident as a result of the iterative process
of evidence collection and analysis.
Documentary Evidence (Papers)
Documentation is the least susceptible type of evidence to A factor to consider during an investigation is recent change.
loss, distortion or compromise, and may provide information It has often been found that some change occurred prior to an
relevant to the investigation. For example, written incident which, combining with other causal factors already
instructions and procedures may provide evidence of pre- present, served to initiate the incident. Changes in personnel,

40
Tripod Beta User Guide
organisation, procedures, processes and equipments should The Interviewer
be investigated, particularly the hand-over of control and Witnesses are greatly influenced by the personality
instructions, and the communication of information about and mannerisms of the interviewer. Many have had
the change to those who needed to know. uncomfortable experiences with higher level managers and
staff officials and distrust their motives.
Conducting Interviews (People)
The interviewer should present a neat, neutral appearance.
Introduction He should be relaxed, receptive, objective and adaptable,
Following the collection of the positions, parts and papers listening to what the witness says. He should make the
evidence, interviews with witnesses should be carried out as witness feel that he wants to talk with him and time is not
soon as possible after the incident. Whilst the intervening a factor.
time and discussions with others can influence a person’s
recollection of events, the interviewer’s knowledge of the Attributes of the Interviewer
evidence from the other 3 P’s can beneficially influence the Positive Interviewer attributes include:
outcome of the interview.
A. Respect which is communicated through a caring
The value of a witness’s input can be greatly influenced by manner and taking an interest in the interviewee. Using
the style of the interviewer whose main task is to listen to the appropriate tone of voice, inquiring after their comfort
witness’s story and not to influence it by making comments and wellbeing communicates respect and value.
or asking leading questions. This requires patience and
understanding. B. Empathy by the interviewer putting himself in the
interviewee’s shoes and recognising how they may be
An investigation team is often seen in a prosecuting role, feeling etc.
and witnesses may be reluctant to talk freely if they think
they may incriminate themselves or colleagues. C. Genuineness, i.e. being honest and open with the
interviewee
An investigator is not in a position to give immunity in return
for information but must try to convince interviewees of D. Relaxed manner and approach which can help put
the purpose of the investigation and the need for frankness. the interview at ease.
It should be stressed that the investigation is not seeking
to apportion blame but is attempting to understand the E. Receptive listener which involves an appropriate mix
reasons for the failures which caused the incident so that of nonverbal signals (nodding, facial expressions,
they can be corrected and future such incidents prevented. leaning forward etc) that visually display interest
as well as the verbal skills of questioning and
It is important for the interviewer to have terms of reference paraphrasing to check for understanding.
regarding his role and responsibilities. These should be
formulated by the body overseeing the investigation. F) Objectivity which requires the interviewer to be
aware of any prejudice, presumptions or bias that
From a Tripod Beta perspective, the investigator is could interfere with their listening.
establishing the exact nature of the Immediate Causes that
resulted in failed barriers, the human errors which caused G) Adaptability, i.e. flexibility to adapt to changed
the sub-standard acts and the ‘influencing’ conditions that arrangements, modified schedules and shifting
promoted the human errors. Once these influencing factors observations of what happened.
have been identified, the emphasis of the investigation
moves to interviewing those associated with the underlying H. Preparedness to be clear on the information being
causes and the weaknesses in the management system which sought and in a systematic manner rather than in an
created them. ad-hoc’ or ‘take it as it comes’ approach.

41
Tripod Beta User Guide
Negative Interviewer attributes include: The Interviewee
Interviewees can be identified as :
A. The commanding type interviewer may frighten the
interviewee into silence by his officious manner and generally • Principal witnesses - persons actually involved in the
interrogates rather than interviews. This mannerism may incident,
also induce a witness to forget detail or feel pressed to give • Eyewitnesses - persons who directly observed the
some information when he really has no certain facts or incident or the conditions immediately preceding or
knowledge. following the incident,
• General witnesses - those with knowledge about the
B. The proud, overly confident interviewer overestimates activities prior to or immediately after the incident.
their personal ability to obtain information. Consequently,
they accept the first statements on any aspect as complete Attributes of an Interviewee
and factual because they believe they would instantly People do not fall into neat, constant categories but may
recognise any erroneous or incomplete information. have some aspects of each under differing circumstances
during the interview. The following distinctions of possible
C. The overly-eager interviewer induces errors and character types may be useful for an interviewer to observe
contradictions in evidence through tendencies toward the interviewee through; however, they must be ‘held loosely’
excessive questions, and/or leading questions. Their anxious so as to not fall into the trap of ‘pigeon holing people’.
manner usually results from being eager to get to analysis
and conclusions. Extrovert
The extrovert can be a very convincing interviewee. They
D. The timid interviewer appears to the interviewee as can be positive in their responses, adamant about their
willing to grab the least bit of information and run. Their observations, conclusions and suggestions. They can be
manner raises doubts in the interviewee as to whether delighted to have the attention brought to them by virtue
producing information will serve any useful purpose, so the of their witness. Their evidence may not be as correct as it
interviewee may respond with superficial comment. appears.

E. The prejudicial interviewer reacts to aspects of the Introvert

interviewees dress and mannerisms. They tend to stereotype The introvert can appear to seemingly be a poor interviewee.
the interviewee at first contact and hear only what they They may be unsure of facts and indecisive in responses.
expect to hear. They may also impart resentment over the Interviewing them may seem a waste of time but they might
incident that has taken them from important work and have the most important information.
involved him in investigation.
Suspicion
Conflicts of Interest The suspicious interviewee may be reluctant to get involved.
Conflict of interest may exist where the interviewer realises They tend to hate publicity and may overly guard their
that they are not able to be independent/objective because privacy and resent being questioned. They probably will
of some past or present commitment to the organisation, decline to give a written statement. They may question
the branch involved, the section or an individual involved the use of information, the possibility of appearing before
in the incident. company executives and the value of investigations etc.
They may tend to discourage the interviewer before they
The primary obligation is to collect the evidence for the reveal the information they possess.
team in an objective manner. Where any member of a team
assesses that they cannot operate objectively, because of Illiterate
some past or present relationship, (positive or negative), they The illiterate interviewee presents a delicate situation. They
should discuss this with the Team Leader immediately. may appear timid and hesitant, to cover the illiteracy, or
decline to give a statement for this reason. If their command
of language is limited, they may feign lack of knowledge of

42
Tripod Beta User Guide
the incident to cover there fear of shame should they make Assessing personal state
errors in grammar or expression. It will need compassion Given the possible impact on personal state it is important
and patience to draw out the testimony. for the Interviewer to be observant both visually and in
their listening for indications of physical, emotional and/or
Prejudice mental symptoms. Any assessment of such symptoms will
The prejudiced interviewee is ill suited to give testimony. Even be done through the 3 components of a message:
when honest and not personally involved, they may believe
the company, the government, a supervisor or another worker Word content
who they are prejudiced against is always wrong. They may Listening to the actual language/words used that may in
make corresponding assumptions and conclusions that blind indicate emotional or mental issues.
their observations and distort the testimony.
Vocal content
Such behaviour may be identified by allegations like “I tried Listening to the tone, emphasis, volume, intonation etc that
to tell ‘them’ but nobody ever listens to me” or that “he/she may indicate emotional or mental issues.
never does anything right.” The interviewer can’t ignore the
prejudiced testimony but will have difficulty determining Non-verbal content
how much of it is valid. Watching for body language that would indicate any
physical, emotional or mental issues.
Excitable
The excitable interviewee tends to exaggerate, elaborate Interview Preparation
and distort evidence. Witnessing the incident is the most
exciting thing that has happened to them so they tend to Requirements
provide information in volume. They tend to be basically Interviewing is about confirming the physical evidence so it
honest but stretch facts and embellish what they recall to fill is necessary to identify.
knowledge gaps to overflowing.
• What is being looked for to confirm or refine the
Reticent developing incident model.
The reticent or ‘know-nothing’ interviewee is the one • Who needs to be interviewed to gather the
identified as a prime witness who insists they do not know information.
and did not see anything.
Allocation of Interviewers
Hostile or Devious Interviewers should be matched to interviewees on the basis
The devious interviewee may distort their testimony to of the abilities and experience of the team members. For
avoid personal implication or unfavourable reflection on an example, if an Engineer is to be interviewed and there is an
associate. They may also alter their evidence in an attempt Engineer on the team it may be best to link then together.
to divert an interviewer from an area where a malpractice
unrelated to the incident may have occurred. The hostile Allot time, dates and locations
interviewee may hold back to avoid implication. An interviewee must be comfortable and at ease and,
if an interview at the incident scene is not practical or is
Impact on personal state undesirable, it is preferable to conduct the interview in a
Following a stressful incident in the workplace it is common neutral or unthreatening location.
for those involved, both directly and indirectly, to experience
some physical, emotional and/or mental symptoms. These The executive offices, or even the supervisor’s office, are not
may include physically shaking, disturbed sleep, vivid neutral grounds to most interviewees. A small classroom,
memories or flashbacks, strong emotions including agitation, waiting room, or library room will be more satisfactory
sadness (tearful), anger, or just feeling flat. It is NORMAL and productive for interviews. Privacy is essential and
to have these sorts of reactions and the interviewee can be the first interview should be a single interviewer to single
provided with suggestions to help cope. interviewee discussion with a designated note-taker sitting a

43
Tripod Beta User Guide
short distance from the interview. (See below; Recording the B. What happened questions?
Interview.) Research has shown this to be the best approach, Interviewers should avoid using the question ‘why’ as
leading to most accurate testimony. its constant use makes the interviewee feel as if they are
being grilled. An alternative is to use ‘how’ or ‘because’ as
Conducting the Interview follows:
Introduction
A friendly, understanding, and compassionate manner in a • Why are you finding it difficult at work? = How is it
respectful and relaxed atmosphere can put the interviewee difficult at work for you?
at ease. Politeness and patience are critical as first contact • Why did you do that? = You did that because?
is made.

Setting the scene The interviewer will be clear about the information to be
The interviewer should explain the nature of the collected and should commence with the open question
investigation by telling the interviewee what the ‘What happened?”.
interviewer’s position is and why the incident is being
investigated. Also, the interviewee should be informed It is important to ask ‘what happened’ rather than ‘why’
that the purpose of the interview is to identify problems because asking ‘why things happened’ tends to inadvertently
and not apportion blame. They should also be told that push the interviewee to ‘interpretation/assessment/story/
they will have the opportunity to review the draft report assumption’ rather than staying with the actual observations
before it is published. of the event.

Questioning C. Control questions

A. Open and closed questions: During the interview, the interviewer should introduce
Closed questions are those that can only be answered by ‘control’ questions to ensure accuracy of statistical data
‘yes’ or ‘no’. as well as permit subsequent evaluation of the reliability
of information supplied by the interviewee. The control
This type of questioning is useful for obtaining or establishing questions should include those to ascertain for example.
definite facts, e.g. Did you see this happen? - Yes - Was it dark
outside? - No • Time and location of the incident,
• Environment: - weather, lighting, temperature, noise,
The closed question can also be used to guide or direct distractions, concealment. Include pre-incident,
the conversation in a particular direction as follows: Was incident and post incident periods by specific question ,
the operator wearing PPE? This question has allowed the • Positions of people, equipment, material and
interviewer to direct the conversation to the topic of PPE. If their relationships to pre-incident, incident and
the interviewee answers ‘yes’ the interviewer would follow post incident events. Include the position of the
with the open question ‘what PPE was being worn?’ interviewee.

Open questions are those aimed at exploring another D. Statements rather than questions
person’s thoughts, ideas and observations. They are asked to Too many questions can make a person feel grilled and
gather information and use the key words of: using statements can provide some respite as follows:

• When did you start to see that happening? • ‘So, your friend was badly hurt - I can imagine that
• Where were you standing at the time? might have triggered off some strong emotions for you’
• What was he saying when that occurred? • ‘I understand that the concern about the boiler was
• How did you contact the supervisor? raised at a recent safety meeting’

44
Tripod Beta User Guide
Clarification could cause their recollection of events to become disjointed
During an interview the interviewer may be confused or with vital points forgotten as a consequence.
uncertain about what the interviewee is saying, and it is
important to gain clarification. It can be useful to have a designated note-taker sitting a short
distance from the interview. This allows the interviewer
A way to seek clarification is to paraphrase what it was to focus on the interviewing task and also provides a
thought the interviewee said. This involves reflecting back corroborative party.
to the interviewee what they have just said but in the words
of the interviewer. This serves three important purposes. Concluding the Interview
The question, “Is there anything we missed or is there
• It lets the interviewee know that the interviewer has something you want to share with us?” Should be asked.
been listening. This may bring out an issue that has not been covered in
• It allows the interviewer to check the accuracy of the the interview or give the person being interviewed the
listening. opportunity to go back to a question that, on reflection,
• It allows the interviewee to hear what they have feels was not adequately answered or that the answer may
been thinking from another person who can give have been misunderstood.
perspective on the issue and help them clarify if this is
really what they think or not. Also, questioning the interviewee for suggestions on
prevention of the incident is a good method to close the
Alternatively the interviewer could simply ask the interviewee interview after other questioning has been exhausted. It
to repeat their point as follows, e.g. is an area best left until the end of the interview because
it asks the interviewee to draw conclusions, including
‘I’m not sure I followed what you just said. Could you go inferences and giving opinions, thus changing the tone of
over that again?’ the interview from the fact-finding exercise.

Non Verbal Communication The question has several values.

The credibility of an interviewee may be assessed through
the window of ‘non-verbal language’ or ‘body language’. • It stimulates the individual to think incident / loss
Considerable research is now available and various prevention.
connections have been made to suggest what various gestures • It provides a reservoir of ideas for the interviewer to
may be communicating. This subject is beyond the scope of draw from in his corrective action plan.
this manual but further reading on it should be undertaken • It may lead the interviewer to an area of management
to enable more effective interviews to be undertaken. deficiency the interviewee was deliberately avoiding for
fear of repercussions.
Recording the Interview • It reaffirms the purpose of the interview in the mind
The interviewer cannot and should not rely on his memory of the witness and will promote further co-operation.
of information provided by the interviewee. Asking
permission or stating that notes will be taken should be Interviews should always be ended with thanks for the
explained up front. interviewee’s time and co-operation, plus an invitation to
contact the interviewer should they remember any other
Notes will help the interviewer keep the interview organised observations about the incident.
and provide an accurate record for review for analysis.
The interviewer can promote additional co-operation
Note taking should be unobtrusive so it is not distracting by specifically mentioning some facts or suggestions the
to the mental train of the interviewee. They should record interviewee has given that appear to be of particular value.
essential points of evidence, but neither verbatim nor so This communicates that the interviewer was interested and
extensive that the natural pace and flow of the interview really took note of what the interviewee had said.
is affected. Forcing an unnatural pace on the interviewee

45
Tripod Beta User Guide
Additional Interviews Agent-Object-Event Trios
After the interview the findings should be reviewed and The Tripod Beta methodology links AOE trios to describe
checked with the investigation team to see that all items have the sequence of events before and after the main event in an
been addressed and all questions answered. The information incident. The Tripod Beta software records the date/time of
gained should corroborate the physical evidence. these events and so establishes the sequence of events of an
incident.
As Tripod Beta methodology is an iterative process between
investigation and analysis, further interviews are likely, e.g. Specialist Support Studies
to find further information or resolve points of conflict in Incidents of a technical or complex nature often require
the evidence. specialist input and further studies to determine the causes
of failures.
Establishing the Sequence of Events
Being able to state the location of people, equipment Major outbreaks of disease, aircraft crashes, crane failures,
and materials as an incident unfolds, assists with cross plant explosions, IT system crashes, are examples of such
validation of evidence and identification of gaps. It is incidents where specialist advice will probably be required.
important to recognise that gaps are often inevitable due to This should be rapidly identified and the specialists involved
the retrospective nature of the investigative process but the early in the investigation.
absence of data at certain points should not be allowed to
delay the investigation. Specialist disciplines available depend on the factor under
study, for example; occupational hygienists; ergonomists;
A number of techniques are available to help the investigators chemists; physicists; engineers, accountants, doctors, etc.
to make sense of the data gathered, e.g. Timeline;
Sequentially Timed Event Plot (STEP); Tripod Beta Agent- A wide variety of sophisticated techniques are available
Object-Event trios; for the detection and analysis of substances and materials.
Commercial laboratories and universities are potential
Timeline sources of technical support for undertaking the detection
This is simply a list of events in chronological order and is and analysis of substances and materials.
useful in that it can be readily compiled. However, it does
have a limitation of not providing visibility of the spatial Evidence Development
relationships involved. The following provide a range of techniques for guiding the
detailed collection and development of the evidence. This
Sequentially Timed Event Plot (STEP) can provide further insight into the process, fill gaps in the
A STEP is a means of assembling the facts obtained in a data and reveal areas for further investigation.
structured manner. It identifies the actions and events of
key “actors” in the incident and plots them against time. The ultimate purpose of these different approaches is to gain
The “actors” can be people, vehicles, items of equipment, a clear understanding of the incident mechanism, failed/
equipment parameters, etc. The scale of the time axis is missing barriers, and the event sequence, and thus provide
normally not linear but varies to suit the interval between further input to the Tripod Beta analysis.
events. Each event is described in terms of date/time, actor,
and action. A. Re-enactment is a last resort technique due to the real
risk of recurrence. It should be used only when:
A STEP diagram is often helpful in the first attempt at
constructing the AEO trios in a Tripod Beta tree. i. There is no alternative way of gaining the information,
ii. It is necessary to observe first hand the step-by-step
An example of a STEP Diagram is shown in on the process,
next page. iii. It is essential to verify key facts, or resolve conflicts in
testimony.

46
Tripod Beta User Guide
The person involved in the incident demonstrates the actions Resolving Conflicts
taken leading up to the event. (It may be helpful to have an It is not unusual for witnesses to give differing accounts of
expert in the process as an observer.) In the first run the an incident. Human memory can be unreliable and, even
motions are acted out and explained step-by-step without if not motivated by self protection, or other subjective
moving any controls, parts or materials. arguments, one person’s recollection of an incident can
differ from another person’s in important details.
After the process is understood each step is repeated in
slow motion but only with approval before moving any Faced with conflicting witness statements, investigators
components or barriers. The last step prior to the incident should look for the similarities between the statements and
must not be repeated. commonality with other evidence. The objective is to use
the evidence to understand the incident and not prove the
B. Reconstruction is an advanced technique which uses accuracy of individual statements, nor apportion blame.
models to analyse the events of the incident. These can be
examined for characteristics of failure modes and effects, This is best dealt with by having access to evidence of
sequences of contact and energy transfer. Positions, Parts and Papers before the interviews are
conducted.
The reconstruction technique may involve reassembly
and repositioning of damaged parts, sometimes using
scaffolding, moulds or props. Scars, marks and impact
points can be matched to assess points and intensities of
impacts.

Reconstructed models also enable tests of different incident

scenarios to be carried out.

4FRVFOUJBMMZ
5JNFE
&WFOU
1MPU

 
QN  
BN 

1#

0OMJOF 4FBM
SFQBJSPO
4FBM
SFQBJS
3FJOTUBMMFE


.JOPS
MFBL
QSJPSJUZ
 EFMBZFE TUBSUFE

#FBSJOH
5SJQQFE

1$

)PU

OPJTZ 3FJOTUBMMFE



0OMJOF SFTMFFWFE
#FBSJOH

5BLFO
PGGMJOF TUBSUFE
JODPSSFDUMZ TFJ[FE
&MFDUSJDBM
UFDIOJDJBO

:PVOH

JOFYQFSJFODFE
3PUBUJOH
FRVJQNFOU

TFDUJPO

%JE
OPU

BEWJTF
1MBOU
.BOBHFS

/PU
JOGPSNFE

PG
QSPCMFN
#PJMFS
GFFE

XBUFSnPX

3FEVDFE

nPX

47
Tripod Beta User Guide
Annex 10: Previously used terminology Current Term Previously used Term

Agent of Change Hazard

Tripod Beta was initially used to analyse Health, Safety
and Environmental incidents in the Oil and Gas Industry. Barrier Control and Defence
However, some of the terms used caused confusion when
Tripod Beta was used to analyse incidents other than HSE, Basic Risk Factors General Failure Types (GFTs)
e.g. business interruptions in general, and also in industries Core Diagram Core Diagram
outside the Oil and Gas industry. Accordingly some terms
have been changed accordingly as shown below. Effective Barrier Effective Control/ Defence

Errors Errors

Event Event

Failed Barrier Failed Control/ Defence

Immediate Cause Active Failure

Incident Incident

Inadequate Barrier Inadequate Control/Defence

Lapse Lapse

Missing Barrier Missing Control/Defence

Object Target

Pre- Condition Pre-Condition

Slip Slip

Sub-Standard Act Unsafe act

Sub-Standard Condition Technical failure

Trios Trios

Tripod Beta Practitioner Tripod Beta Facilitator

Tripod Beta Tree Tripod Beta Tree

Underlying Cause Latent Failure

48
Tripod Beta User Guide
Annex 11: Consequences for individuals Categories of acts
A model is available that provides categories into which an
Behaviour has consequences act or behaviour can be placed, and guidance on the kind
When things go wrong, many analyses do not go far enough. of consequences for each category. When using the model,
They seek to identify the error or rule violation that was “the leaders need to exercise judgment both in selecting the
cause”. But this is seldom the entire issue; human error or category into which a particular act or behaviour fits best, and
rule violation is almost always a symptom or manifestation also in deciding the specific consequences to apply. The full
rather than any type of ”underlying cause”. The real model is available from the “Hearts and Minds “programme
underlying causes of an incident also need to be revealed in located at http://www.energyinst.org.uk/heartsandminds/.
order to improve the management system. Correcting these This annex provides a summarized version which only
underlying causes will always prevent many more incidents highlights some possible reasonable consequences to correct
than just concentrating on the immediate or direct causes. identified human errors and violations.

When an individual makes a wrong decision, or forgets to Disciplinary measures must only be carried out by
do some important task, there may be contributory factors line managers in consultation with Human Resource
such as a confusing procedure, inadequate supervision or professionals. The model should NOT be used until the
distractions (e.g. noise, interruptions). Such ‘system’ factors incident analysis is completed and the underlying systemic
should always be sought and eliminated as far as practicable. causes are understood. The incident analysis must identify
However, if an individual has not been trained properly, or the type of error or violation, determine if the undesired
has not developed the good practices necessary to perform action is ‘routine’ or not, and the motivation behind the
the task safely, then coaching to improve their competence action (did it benefit the individual or the organisation?).
or develop more appropriate working practices should be
the norm. The diagram below helps to classify the action. If the error or
violation is ‘routine’ then supervisors and managers further
If someone behaves recklessly or breaks a sound and up the line may also not be meeting their responsibilities.
well‑known rule to gain some personal advantage, then it is They may not be creating a working environment where
reasonable that they should recieve appropriate consequences. clear standards are set and where it is ensured that rules
However, if someone makes an error, or breaks a rule they and procedures are fit for purpose, capable of being adhered
were unaware of, simply blaming the individual is unjust, to and actually followed. If so, then these supervisors and
unfair and fails to address the underlying organizational their managers should have this consequence management
weaknesses that could continue to contribute to other framework applied to them, as well as to the individual who
incidents. Similarly this applies to rules routinely broken, made the error or violated the rule.
without comment from the supervisor, or that were plainly
impossible to follow and still get the job done. Consequences of acts
The tables which follow provide a summary of possible
Further, it may be that a person is not suited to a particular consequences for errors and violations. (see next page)
type of work, or may become so, even temporarily, due to
health or other reasons. In such cases, their fitness to work
should be assessed - a change to a different type of work could
be considered.

49
Tripod Beta User Guide
Human error and violation decision flowchart

0DDVSFODF
:&4 %JE
UIF
:&4 8FSF
UIF
/0 8IFO
UIF
/0 5IF
QFSTPO
/0 %JE
UIF
QFSTPO
/0 %JE
UIF
QFSTPO
/0 %JE
UIF
QFSTPO

PG
BO
BDUJPO
BDUJPOT
JO
QFSTPO
XBT
DPVME
OPU
HFU
WJPMBUJOH
UIJOL
WJPMBUJOH
UIJOL
WJPMBUJOH
NFBO

VOEFTJSBCMF
QSPDFFE
BT
BDDPSEBODF
WJPMBUJOH
EJE
UIF
KPC
EPOF
JG
JU
XBT
CFUUFS
JU
XBT
CFUUFS
UP
EP
XIBU
UIFZ

FWFOU QMBOOFE XJUI
UIF
UIFZ
UIJOL
UIFZ
GPMMPXFE
GPS
UIF
GPS
UIFN
EJE
BOE
EJEOU

SVMFT
BOE
UIFZ
XFSF
UIF
QSPDFEVSFT
DPNQBOZ
UP
QFSTPOBMMZ
UP
UIFZ
UIJOL
PS

QSPDFEVSFT EPJOH
JU
UIF
CVU
UIFZ
EJE
UIF
EP
JU
UIBU
XBZ EP
JU
UIBU
XBZ DBSF
BCPVU
UIF

DPSSFDU
XBZ KPC
BOZXBZ DPOTFRVFODFT

/0 :&4 :&4 :&4 :&4 :&4 :&4

4MJQ
PS
MBQTF .JTUBLF 6OJOUFO 4JUVBUJPOBM
0QUJNJTJOH
0QUJNJTJOH
3FDLMFTT

UJPOBM
WJPMBUJPO WJPMBUJPO
GPS
WJPMBUJPO
GPS
WJPMBUJPO
WJPMBUJPO DPNQBOZ
QFSTPOBM

CFOFmU CFOFmU

%PFT
UIJT
IBQQFO
PGUFO 8PVME
PUIFS
QFPQMF
IFSF
EP
JU
UIF
TBNF
XBZ
4VCTUJUVUJPO
UFTU

%PFT
UIJT
QFSTPO
IBWF
B
IJTUPSZ
PG
WJPMBUJOH
3PVUJOF
FSSPS 3PVUJOF
WJPMBUJPO

50
Tripod Beta User Guide
 3FXBSE
$PBDIJOH
'PSNBM
%JTDJQMJOF
%JTNJTTBM

Special recognition or disciplinary measures must only be carried out after 'PSNBM
3FXBSE $PBDIJOH %JTDJQMJOF
consultation with local HR who are the custodians of local policy, practice,
consistency, fairness and due process.

Behaviour Description of Behaviour Consequences for the Individual Consequences for the Managers
of the individual

Human Error Human error is a part of life that can rarely be eliminated entirely. Disciplinary actions in line with local
practices and guidelines are usually not appropriate when slips, lapses or mistakes have been made, but many
things can be done to prevent their (re-)occurrence.

Slips and Lapses Actions that did not proceed Coaching on how to spot errors, Coaching in Error Management.
as planned e.g. something was what influences the occurrence
done twice, the wrong way or a of slips and lapses and the
step is forgotten. importance of reporting them
to aid detection of trends and
underlying causes.

Mistake Mistakes are actions that Competence development/ Coaching in Error Management and
proceed as planned but do coaching. Competence Management.
not achieve their desired
end. (Incorrect decision or
inadequate plan).

Routine Error It is not the first time that this Whole team to receive coaching Coaching in Error Management and
Same errors by type of error or mistake has on how to spot errors, what Competence Management.
different people happened. influences the occurrence of slips Performance appraisal affected for
and lapses and the importance of not addressing clear problems in own
reporting them to aid detection of area.
trends and underlying causes.

Routine Error It is not the first time that Assessment of fitness to work Coaching on Fitness To Work.
A personal history this type of error or mistake (abilities and suitability for this
of errors – when the has been made by this person. type of job). If appropriate,
same errors are not Other people in similar competence development and
made by others in situations do not make this coaching, if not consider assigning
similar situations error. alternative more appropriate type
of work.

Unintended A rule or procedure violated Competence development/ Coaching on how to ensure

Violation because people were not coaching. procedures are correct, available, and
aware of the rule or did not understood.
understand it.

Situational A job cannot be done if the Coaching on the need to speak-up Coaching on Managing Rule
Violation rules are followed. Instead when rules cannot be followed and Breaking.
of stopping the job it is done to stop the job until it can be done If this type of situation has occurred
anyway and the rule is violated. safely. before performance appraisal is
affected for not demonstrating
Mild disciplinary action in line commitment to
with local practices and guidelines. rule compliance.

Organisational The person committing the Coaching on the need to speak-up Performance appraisal is affected
Optimising violation thought it was when rules cannot be followed and Coaching on Managing Rule
violation better for the company to to stop the job until it can be done Breaking.
Optimising for do it that way. The violation safely. If this type of violation has occurred
company benefit was committed to improve before there should be formal
performance or to please the Mild disciplinary action in line discipline for reckless supervision in
supervisor. with local practices and guidelines. creating a culture that encourages this
behaviour.

51
Tripod Beta User Guide
 3FXBSE
$PBDIJOH
'PSNBM
%JTDJQMJOF
%JTNJTTBM

Special recognition or disciplinary measures must only be carried out after 'PSNBM
3FXBSE $PBDIJOH %JTDJQMJOF
consultation with local HR who are the custodians of local policy, practice,
consistency, fairness and due process.

Behaviour Description of Behaviour Consequences for the Individual Consequences for the Managers
of the individual

Personal The person thought it was Formal discipline. Performance appraisal is affected for
Optimising better for them personally to do If this has happened before, then not becoming informed about clear
Violation it that way e.g. getting a longer formal warning process should be problems
Optimising for work break, easier way of doing followed. in own area.
personal benefit the job, doing Consider anonymous publication Coaching in using Managing Rule
it faster, etc.) of the violation and its Breaking together with team.
consequences for worker and their If this type of situation has occurred
managers. before performance appraisal is affected
for condoning violation or not taking
action.
The reason for condoning this
behaviour should be investigated;
the model and flowchart will help
determine whether the manager’s
behaviour was itself an error
or violation.

Reckless Violation The person committing the Suspension of the activity pending Coaching in how to recognise and deal
violation did not think or care further investigation. with such behaviour earlier.
about the consequences. Gross Depending on the outcome of the
Negligence can be considered a investigation a formal warning or
part of this type of violation. other disciplinary action in line
with local practices and guidelines.

Routine Violation Other people would have Whole team to receive coaching in Performance appraisal may be affected
Everybody does it done or do it the same way. using Managing Rule Breaking for not becoming informed about clear
like that Checking for this type of problems in own area.
violation can be done by using Coaching in Managing Rule Breaking
the ‘substitution test’. together with team.
Substitution Test: Would If this type of situation has occurred
a significant proportion of before performance appraisal is
individuals with the same affected for condoning violation or not
training and experience have taking action.
acted in the same way under
the same circumstances?

Routine Violation The individual has a history Formal disciplinary action in line Coaching in how to recognise
A personal history of violation, disregard for the with local practices and guidelines. individual violators.
of violations rules and procedures in general, Performance appraisal is affected if it is
not just frequent violation of found that violating is condoned or no
the rules under investigation. action taken.
If there are many routine violations
of this type the reason for condoning
this behaviour should be investigated,
the model and flowchart will help
determine whether the manager’s
behaviour was an error or violation.

52
Tripod Beta User Guide
References
1. Groeneweg, J. Controlling the Controllable. More information on Tripod Beta training and
Preventing business upsets. Fifth revised edition accreditation and the other Tripod tools like the proactive
Global Safety Group Publications, Leiden, 2002. Tripod Delta, the occupational health related Tripod
Sigma and the investigation tool Track can be found on
2. Reason, J.T. Human error. Cambridge University www.tripodsolutions.net
Press, 1990.

3. Wagenaar,W.A., Groeneweg, J., Hudson, P.T.W. and

Reason, J.T. Promoting safety in the oil industry.
Ergonomics, Vol. 37, 12, 1994.

4. Papers presented at SPE International Conferences

for Health, Safety and Environment in Oil and Gas
Exploration and Production: SPE 23293 (1991), SPE
35971 (1996), and SPE 46659 (1998) by authors
P.T.W. Hudson, J.A. Doran, A.D. Gower-Jones and
G.C. van der Graaf

 UNRESTRICTED

ECCN: Not subject to EAR – No US content

Copyright Stichting Tripod Foundation
P05334 rev4 – October 2008

53
Tripod Beta User Guide