text: Tripod Beta User Guide Index 1. Introduction ...................................................................................................................................... 3 2. Background and application............................................................................................................... 3 3. Basic incident causation theory ........................................................................................................... 3 4. Human Behaviour Theory ................................................................................................................... 4 5. Tripod Beta and Human Behaviour. ..................................................................................................... 6 6. Tripod Beta analysis .......................................................................................................................... 9 7. Learning and feedback .....................................................................................................................17 Annex 1: Glossary ...............................................................................................................................19 Annex 2: Tips for Tripod tree construction and quality checking ................................................................ 20 Annex 3: Errors, Violations and their Preconditions ...................................................................................21 Annex 4: Basic Risk Factor (BRF) Definitions ........................................................................................... 22 Annex 5: Tripod Beta Tree Symbols ........................................................................................................23 Annex 6: Tripod Beta tree rules............................................................................................................. 24 Annex 7: Tripod Beta and BowTie ......................................................................................................... 29 Annex 8: Worked example of Tripod Beta Tree .......................................................................................31 Annex 9: Performing an Investigation .................................................................................................... 38 Annex 10: Previously used terminology .................................................................................................. 48 Annex 11: Consequences for individuals .................................................................................................49 2 Tripod Beta User Guide 1. Introduction Tripod-Beta, which utilises this theory, is a system for conducting incident analysis during the investigation itself. Each Company has its own particular way of conducting This enables investigators and analysts to systematically and its business, i.e., its own 'organisational culture'. Within comprehensively: the organisational culture reside a number of processes or systems, e.g. Health Safety and Environment Management • Direct and refine their fact finding System, and Quality Management System. • Confirm the relevance of their fact gathering, • Highlight avenues of investigation pointing to the One element in these systems will be a process for 'Incident identification of underlying causes. Investigation, Analysis and Reporting' whose purpose is to • Identify and resolve any logical anomalies whilst the identify why things went wrong so that they can be corrected investigation is still active and and future losses and business interruptions prevented. • Produce a definitive report The steps in this process start with an initial fact finding followed by detailed investigation, testing and analysing Tripod analysis can be applied to all types of business facts and assumptions, and formulating corrective actions incidents, including, but not limited to, those relating to: to improve the management system and organisational culture that allowed the incident to occur. • Environmental impacts • Financial losses In the Tripod Beta methodology the investigation process • Harm to peoples' safety and health is iterative with the analysis process. From the preliminary • Production losses investigation report, possible Tripod Beta models of the • Security lapses incident are produced which leads to further investigation • IT failures and fact finding which in turn leads to a validation and • Damage to a company's reputation refinement of the model. This continues until all relevant • Quality short coming facts have been identified and the Tripod Beta tree accurately • Project delays and losses reflects the incident. The Tripod theory and application is easy to understand. The result is a saving in time and effort, a deeper and more Its application in an incident analysis requires skills and comprehensive analysis and a clearer understanding of the experience in the application of Tripod Beta to arrive at failures that must be addressed in order to make significant optimal results. Training up to the level of accredited Tripod and lasting improvements in incident prevention. Beta practitioner is available. Management teams being presented with the results of an analysis benefit from a short The methodology is supported by software that provides presentation on the Tripod theory before being presented the means to collect and assemble the facts from the the results and committing to remedial actions. investigation and to manipulate them on screen into a graphical representation of the incident and its causes. A draft incident report can be generated for final editing 3. Basic Incident Causation Theory using a word processing package. (Instructions on the use of the software are contained in the 'Tripod-BETA Software.) Incidents occur when inadequate or absent barriers fail to prevent the things that can cause harm to escalate to undesirable consequences. The barriers can be of different 2. Background and application types e.g. related to design, systems, procedures, equipment etc. The barriers are put in place and kept in place by people The Tripod theory originated from research undertaken with the competence to do so, in line with standards and in the late 1980s and early 1990s into the contribution of specifications. Incidents happen when people make errors human behavioural factors in accidents. The research, by the and fail to keep the barriers functional or in place e.g. Universiteit Leiden and the Victoria University, Manchester, people doing the wrong thing or people not doing what they was commissioned by Shell International. should do. 3 Tripod Beta User Guide Source of harm Barriers Source of harm Ill-conceived Mistake or Intention/ violation plan Work Undesirable Environment consequences Undesirable consequences However, some actions that are based on the right plan also go wrong. These we call 'Slips' and 'Lapses'. A slip is when people intend to do one action but perform another one instead. When people forget to do something, this is called a lapse. Slips, lapses and mistakes are usually categorised as human error The steps in an incident investigation are to identify: Everybody suffers from lapses and slips but often their • the chain of events from the cause of harm to the likelihood is increased by situations that negatively affect outcome; the undesirable consequences human functioning. Examples are tiredness, lighting and • the barriers that should have stopped the chain of noise levels, and sudden changes to routines, illogical events design. We can reduce these slips and lapses by improving • the reason for failure of each of the barriers the circumstances e.g. by eliminating the "Human Error Inducing Situations". Usually these situations are the result Most incident investigation techniques deal with the chain of someone else's ill-conceived plan. of events and the barriers that failed. Often this results in addressing symptoms and immediate causes of failure. Human Source Error of harm Few techniques deal systematically with the analysis of the Inducing Situations Correct reasons for failure of the barrier and development of actions Intention/ plan Slip or lapse addressing the underlying causes. Ill-conceived Intention/ plan Undesirable consequences 4. Human Behaviour Theory Mistake or violation When trying to understand why a person has done something incorrectly, people often explain it as simply "human error", or as part of their personality. This is Despite efforts to control error-enforcing situations some unhelpful and often wrong. errors will always occur. These can create disasters if the system is dependent on few barriers in which a slip or To learn from the consequences of the actions of other lapse causes the last remaining barrier to fail. Therefore it people, and to understand why they took such actions, is essential to always make sure that there is an adequate it is necessary to look at the bigger picture, i.e. a "system number of effective barriers. perspective". There is a human behaviour model, which helps, to explain why people act the way they do. To reduce the likelihood of incidents the focus should be on ill conceived plans because they cause barriers to fail In incidents people have usually acted the way they intended, directly through mistakes and violations. Indirectly they they just didn't get the consequences they expected. create situations in which slips and lapses are more likely to A person's mental plan was not clear or ill conceived, happen, or result in systems in which a lapse or slip cause the resulting in a mistake and/or a violation. A barrier was last remaining barrier to fail. So, intentions and plans form broken and an incident happened. the basis for our acts and behaviour - our human errors. 4 Tripod Beta User Guide Source of harm Undesirable consequences Understanding how people develop the intention or plan is Answers to these simple questions are always based on peoples' therefore essential to understand and combat incidents. perceptions of the world and their beliefs about how the world works rather than facts. In hindsight best intentions can be Before people do anything, their brain creates a mental wrong! In every incident people thought they were doing the plan, i.e. an intention. Often it is not realised that is actually right thing based on their beliefs and perceptions at the time. how the brain is working. Before an intention to act can be For them, their perceptions are their reality. formed, the brain needs to ask three simple questions about, Gap, Outcome and Power. Let's look at the answers in a simple example of somebody spotting an unsafe act that could result in a person seriously The Gap question: Is there a gap between the current injuring himself. situation and how the person wants it to be? Let's quickly think about an incident that has already The Outcome Question: Is there a reason to do something? happened. A mechanic loses part of his foot when the winch "What's in it for me?" Will it be beneficial e.g. get reward he was repairing started to rotate. or recognition? Will I be disciplined if I do not follow the rules? Is it more fun or pleasant etc.? Gap The winch needed to be repaired quickly Outcome He expected to be commended for a quick The Power Question: Does the person have the ability to repair of essential equipment make something happen? Is it within that person's power to Power He was a good mechanic and had worked start it and complete it? like that before Another example of the Gap, Outcome and Power questions for somebody spotting an unsafe act. Question Answers Gap? Potential for an incident Outcomes • A warm thank you for pointing out the hazard when intervening? • Recognition by others for a good intervention • Satisfaction of having prevented injury • Frustration if intervention is not appreciated or effective Outcomes when • Bad feelings when an incident happens that could have been prevented not intervening? • Comments by others that you should have intervened Power? • I am sure that the potential for an incident is high • I have intervened before or • I feel that I am not senior enough to intervene effectively • I do not have the competence to fully assess whether this is not safe 5 Tripod Beta User Guide Because people are basically social animals, past experiences 5. Tripod Beta and Human Behaviour and contacts with other people have a major influence on the way they currently act. Family, friends and many others 5.1 Tripod and Human Behaviour make up the influencing environment, which through The aim of Tripod Beta is to establish: our past experiences affects our beliefs and perceptions and hence how we act. It leads people to act the way they do, 1. What was the sequence of events? believing they are doing something that is acceptable. 2. How did it happen, what barriers failed? 3. Why did the barriers fail? Within a work environment, colleagues and supervisors have a strong influence. Peoples' experiences with them, Tripod Beta distinguishes itself from other incident and previous bosses, i.e., what they say and do, affects investigation and analysis methods through the Human perceptions, which indirectly but significantly influences Behaviour model that is used to analyse the reasons for the way people act at work. failure of a Barrier. For an incident investigation the whole "system" in In Tripod Beta, an incident is shown as a series of trios, i.e. which a person is working needs to be understood. For the agent of a change, the object changed and the resulting example if someone breaks a rule, the reason why must be incident event. The trios descibe what happened. The failed understood. Barriers are also shown in the trios, i.e. how it happened. We know their past experiences led to their beliefs about what they should do, so the question should be asked "what was the role of others in the influencing environment?" This can take many forms, for example: • What they thought others expected them to do? • What others were doing or not doing at the same time? • Previous experience of interventions, and • The consequences of past actions and feedback from previous similar situations? People can see themselves in this influencing environment either as management, a colleague, a supervisor, or direct The human behaviour model is used to more deeply report. This means everyone had a role to play in the overall understand why the barriers failed. A "Tripod causation "system" which led to the person acting the way they did. To path" is traced back in time from each failed or missing prevent incidents it is necessary to look deeper to understand barrier to its Underlying Cause. exactly why someone did what they did, and not just stop at blaming a person's attitude. In the Tripod approach to analysing incidents, when a Barrier fails it is a result of a slip or lapse, or an intentional Tripod incident analysis is aimed at understanding act by a person or group of people. Identifying these acts is these perceptions and beliefs and how the influencing only the first step. Next the context, or mindset, in which environment and past experiences have created them. an action is taken, has to be identified and understood. This is referred to as a Precondition. Effective avoidance of all incidents, not only a repeat of the last one, starts by understanding the environment and The Preconditions are the reasons someone believed there taking action to change it. was a need to do something, why they thought there was a good reason for doing it the way they did, and why they believed they would be able to do it successfully. 6 Tripod Beta User Guide { Answering these questions leads to the start of considering The figure illustrates a Tripod causation path leading to a the real Underlying Causes of the Preconditions, which are Failed Barrier. The Barriers are directly linked to Immediate often common causes of many incidents. These Underlying Causes, (and their unsafe acts), Preconditions and Underlying Causes have often been in the "system" for a long time, Causes. Sub-standard acts describe HOW the Barriers failed lying unnoticed and hidden. and the Underlying Causes WHY the barriers failed. Each Failed Barrier will have its own causation path. They are often the result of actions and decisions of managers and colleagues who make up the influencing environment. More detail on the three elements of the chain, the immediate cause, the precondition and the underlying For all incidents it is necessary to understand which parts cause are given below. of the influencing environment led to the Preconditions that influenced the person to act the way they did. If the incident 5.2 Immediate Causes (Sub-standard acts and was work related then it is under management control and Technical failures) means managers and colleagues had a role to play, therefore 'Immediate Causes' are the failures close to the incident the underlying causes should link back to the actions and (i.e. in time, space or causal relationship) that defeat the decisions taken as part of the business management system. barriers. These are the actions of a person, or group of people - categorised as sub-standard acts in Tripod terminology. By Using the human behaviour model with the Tripod identifying the person, or group, that made the error, it is incident analysis methodology helps to clearly identify possible to analyse their beliefs and perceptions that created both the Immediate and Underlying Causes. It also makes the error. the conclusions more personal because managers and colleagues can see their role in creating the environment Technical failures of barriers can also occur due to that led to the incident. conditions such as over stress, corrosion or metal fatigue. Human action is always the cause of these failures, e.g. Everyone should try to understand the unintended wrong material selected, overloading, lack of corrosion consequences their actions have on the beliefs and inhibitors, lack of maintenance etc. perceptions of others. Once it is understood how people unintentionally influence others they can help create an influencing environment that promotes safe behaviour. 7 Tripod Beta User Guide 5.3 Preconditions information available at the time may prove to be fallible Preconditions are the environmental, situational or with time. The potential adverse effects of decisions may not psychological 'system states' or 'states of mind' that promote be fully appreciated or circumstances may change that alter Immediate Causes. In simple terms the precondition can be their likelihood or magnitude. found by asking why the person or group of persons that caused the failure had the belief or perception that their act The incident producing potential of these Underlying Causes was more or less what was expected of them, commendable, may lay dormant, (i.e. latent or "hidden" failures), within an unavoidable or just normal. organisation for a long time and only become evident when identified by an analysis of an incident. See also Annex 3 for further information on the relation between immediate causes and preconditions. Examples of Underlying Causes Examples of Preconditions • Balance in production/ maintenance budgets • Downsizing without change control • Inattention (I didn't notice I did something wrong.) • Inherently deficient procedures • Unfamiliarity / over-familiarity (I have always done • Inadequate competence standards/ training it this way and believed that was correct) • Uncontrolled modifications • Haste (I believed it had to be done quickly) • Inadequate preventive maintenance policy • Stress (I didn't realise that I was trying to do too much and could not cope) • Misperception (I misread, misheard or 5.5 Classification of Underlying Causes misinterpreted the information sent to me.) Based upon incident investigation studies Tripod research • Lack of direction (Nobody told me how to do it so I has classified underlying causes into eleven Basic Risk did it the way I believed to be suitable) Factors (BRFs), which provide a comprehensive risk • Competing demands (I thought that what I did had management picture that is valid across a diversity of priority over what I didn't do.) industry activities. Each BRF category represents a • Ignorance (I didn't know that what I did was wrong.) distinctive area of management activity where the solution • Complacency (I now everything about this and of the problem probably lies. (See Annex 4 for a complete always do it correctly.) list and definitions.) • Poor motivation (Nobody cares whether it is done or not.) Some of these BRFs reach back over the development history • Personal crisis (I was preoccupied on a major of the organisation (e.g. incompatible goals and organisational problem at home.) failures); others assess the current quality of its specific functions (e.g. design, maintenance, procedures, etc.). 5.4 Underlying Causes The BRF classification of underlying causes identified All identified failures should be corrected, but addressing in any one incident has limited value in isolation, but the Immediate Causes may only have a localised effect. the combination of data from a large enough number of Underlying Causes have a more widespread influence on incidents can provide an insight into the overall risk status of the integrity of an operation because they will defeat many the operation. Therefore the classification of the underlying barriers. Accordingly, measures to prevent Underlying causes is optional in Tripod Beta. Causes are likely to have the greatest beneficial impact in incident prevention. It is also possible to classify the underlying causes in accordance with the elements of the management system Underlying Causes are deficiencies or anomalies that create involved with the incident. the Preconditions that result in the Immediate Causes of incidents. Management decisions often involve resolution of conflicting objectives. Decisions taken using the best 8 Tripod Beta User Guide 6. Tripod Beta analysis information gaps that help the investigation team to cover the incident in sufficient depth and breadth to understand 6.1 Overall Investigation and Analysis Process the full circumstance. The objective of an incident investigation and analysis is to identify and correct the Immediate and Underlying causes The overall process is illustrated in the road map in the figure that created, or contributed to, an incident and so prevent its and explained more fully below. future recurrence. 1. Initial findings: Concentrates on the incident site The modern and systematic approach in achieving this is and its immediate surroundings, gathering the facts to first create conceptual possible models that describe the concerning the event and its consequences. incident. This is based on information provided in an 'Initial 2. Initial Tripod Beta model: The core model of a Tripod Incident Report' and on how it is believed the incident Beta tree defines the incident mechanism in terms of occurred. Evidence is then collected and assessed to test, Agents, Objects and Events. modify and eventually arrive at a true model of the incident. 3. Fact gathering: Further evidence is gathered through interviews, documentation reviews, research. Physical This approach is used in a Tripod Beta analysis. The analysis evidence relating to Papers, Parts and Positions is is a concurrent activity with the investigation and uses gathered first and the model reshaped before further information from the investigation to construct the model, interviews are conducted with the People involved. i.e. the "Tripod Beta Tree". The classification and linkage of 4. Organising facts: Facts can be organised to develop a tree elements represent the cause-effect logic of the incident. timeline or Sequentially Timed Event Plot (STEP). Construction of the tree highlights investigation leads and 2. Create Initial Tripod Beta Model(s) 1. 3. What happened? - Investigation Construct TB Tree(s) Gather Facts, i.e. Initial Findings of - Papers INCIDENT Incident - Parts How did it happen? - Positions Brainstorm Barriers - People 4. Organise Facts (eg STEP) 6. Further Investigation - Papers - Parts - Positions - People 5. Tripod Beta Analysis YES What happened? - Revise TB Tree Issue incident Further report with How did it happen? Investigation / recommended NO Validate Barriers Analysis actions needed? Why did it go wrong? Identify Causes 9 Tripod Beta User Guide 5. Detailed analysis: Completion of the Tripod tree. The team of experts formed to conduct the detailed, (Level Failed or missing management measures (Barriers) 2), investigation and analysis, review this local report and are added to the core model in the second phase of from it construct a Tripod Beta "Core" diagram. Tripod Beta tree building. Only then does the thorough investigative work commence to test this model. Further 6.2.2 Core Diagram Basics investigations, studies and research may be required to The first task in the analysis is to construct the initial core come to an understanding of underlying causes. The diagram (s), i.e., the series of trios representing the incident. final phase of a Tripod Beta tree is to plot Tripod causal This is based on the initial information already known about paths for each failed or missing Barrier, leading from the incident and before gathering evidence or interviewing Immediate Causes to Underlying Causes. Remedial people by the Tripod Beta team. It is possible at this stage actions are subsequently defined and reported. that, as all the facts are not known, more that one model, or 6. Review and reiteration: A draft report is presented to scenario, of the incident will be produced. management to enable a critical discussion followed by a decision on the adequacy of the analysis. The core diagram is created by a brainstorming desktop exercise that utilises the experience of the Tripod Beta This sequence is the Tripod recommended approach. Step Incident Analysis team (hence the importance of forming the 2, the development of the initial Tripod Beta model, can right team). Active involvement of the investigation team in help to focus from the beginning on the relevant issues. For the preparation of this initial core diagram and agreement on organisational reasons e.g. the unavailability of a Tripod the representation of the incident mechanism will provide the facilitator during the first days, this approach cannot always team with a common focus for the conduct of the investigation. be followed in which case steps 3 and 4 can be done without Any identified missing or unclear information is noted to be the initial Tripod tree. Tripod Beta model development is pursued as part of the subsequent investigation. then initiated and completed in step 5. 6.2.3 Main Elements of the Core Diagram The traditional approach for performing an incident The core of a Tripod analysis resulting from an investigation investigation, as available from many sources, is documented is a 'tree' representation of the incident mechanism, in Annex 9. It covers steps 1,3 and 4 of the road map and describing the main incident event and other significant information on preparing and initiating an investigation, events that occurred before or afterwards. The diagram securing evidence, performing interviews etc. comprises a number of linked 'trios', each containing three elements or 'nodes': an Agent of Change, an Event, and The development of the Tripod Beta three is outlined in an Object. Other names can be given to these three sections 6.2, 6.3 and 6.4. Development of remedial actions elements, e.g.: and review by management are discussed in section 6.6 and 6.7 respectively. • Hazard, Event, Target • Trigger, Event, Object 6.2 What happened (Building Tripod Beta "Core" • Threat, Event, Object diagram) Event 6.2.1 Initial Investigation In incident investigation terms an event is a happening, Most organisations that have a robust incident investigation a 'change of state', whereby an object is adversely affected and analysis process also have at least two levels of (or threatened) by an Agent of Change. In the Tripod Beta reporting, i.e. model all events have 'potential' injury, damage or loss 'penalties' and some have 'actual' penalties. Examples of • Level 1 - Initial Findings of Incident - normally main events include: produced locally • Level 2 - Detailed Investigation and Analysis - • Crash of an IT System conducted by experts • Missed project milestone • Shut down of a production line 10 Tripod Beta User Guide • Breach of security chemical materials, radiation, explosives, flammable and • Failure of a piece of machinery explosive materials, liquids and gases • Failure to win a contract • Biological agents (e.g. animals and insects or micro- organisms) Specifically, typical main events in Oil and Gas industry are • Conditions that are life threatening e.g. such as lack of associated with loss of control or containment or unexpected oxygen, smoke, fumes, water (as a drowning medium) contact e.g.: • Ergonomic conditions (such as noise, light, work station layout, etc.) that could lead to stress or physical • hydrocarbon gas release strain injury • oil spill • Natural phenomena such as wind, rain, waves, • contact with hot pipe earthquakes etc. • contact with electric current • explosion Agents of Change that are not sources of energy but are still a • fall driving force of change and may require a more imagination • collision to identify include: Agent of Change • Computer viruses An Agent of Change is an entity with the potential to change, • Workplace stress harm or damage an object upon which it is acting. It can • Late delivery of project material be an energy source, material condition, change of plan etc. • Delayed payment of an invoice that causes or has the potential to cause injury, damage or • Batch of faulty material from which components loss. Agents of Change that are an obvious energy source are were made relatively easy to identify, e.g.: Object • Energy sources such as, extreme heat / cold, electricity, The Object is the item changed, or potentially changed by materials under pressure, items at height, energy of an "Agent of Change". Examples of Objects are: movement (kinetic), toxic, corrosive and carcinogenic Objects Actual or Potential harm IT System Malfunction or system non operational Project Plan Missed milestone with cost and time overrun implications People Injury or damage to health (employees or third parties) Financial Target Cash flow, Profit, Revenue Product Quality Failure of product in market Assets Damage to plant or equipment - loss of material - disruption or shutdown of operation - damage to third party assets. Environment Damage or contamination - severe nuisance. Reputation Adverse media attention - public concern, protest - prosecution - business restriction - reactive legislation, loss of clients. Production Schedule Non achievement of production targets System integrity Breakdown of business processes. 11 Tripod Beta User Guide 6.2.4 Building the Core Diagram the Object to change its state or condition to that described Main Event as the Event". The 'Main' Event, the 'Prior' and 'Subsequent' Events, along with their associated Agents and Objects, are then Prior Events identified. When the Agent or the Object was the outcome of a prior event, another Agent and Object combination needs to be included in the scope of the investigation. For example, if the Agent main event was fire damage to equipment, the event causing the Agent (fire) needs to be accounted for. The core diagram & Event Object TIME Agent A typical core diagram is built starting with the main incident event i.e. the one that caught the initial attention & Event t Agent by the harm that was immediately caused. The Agent and Object Potential Object are placed to the left of the event, and joined by lines TIME Potential & Event & Event or trajectories. would show two Agent - Object - Event constructions. If ct Object the presence of the flammable material was itself caused by another event (e.g. a pipe leak), a further Agent/ Object TIME TIME Agent combination would need to be identified. Agent & Event & Potential Event & Potential Designating the flammable material as an Object is worth Event Object a mention. The normal convention is always to regard, say, Object TIME hydrocarbon gas as an Agent. However, in the context of TIME this model it is necessary to consider the 'fire' event. The TIME fire was the result of a chemical reaction when heat (the ignition source) was applied to the flammable material. The Agent flammable material suffered a change of state (combustion), therefore in this specific context it was an 'Object'. tential Potential vent & Event Object It should also be noted that 'fire' features as both an Event and an Agent. In the Tripod-Beta model this is represented TIME by a combined 'Event-Agent' node. Similarly, an event creating an Object is represented as an 'Event-Object'. In logic terms, the trio can be explained as an AND gate where both the Agent and Object have to be present for the actual Event to occur. If a barrier exists in either one of the two pathways, then the Agent and Object do not come into contact and the Event that could have happened without effective barriers does not happen. This is called a "Potential Event" (this is illustrated in the logic diagrams shown). The below "logic" diagram of the trio is simplified in Tripod Beta and is illustrated below. The wording used when describing the trio is that, "The Agent of Change acts on 12 Tripod Beta User Guide As the core diagram is being constructed all Agent and Object are usually missed if the initial core diagram is simplified 'end nodes' should be examined for possible prior events. too early in the investigation. When no prior events are evident, the Agent or Object end node represents a logical limit to the investigation scope. 6.3 How did it happen? (Identifying the Barriers) A business must manage its risks to protect it from potential Subsequent Events harm. An incident means there have been failures in risk The main Event may not be the final event in an incident. management measures, (i.e. barriers), and an investigation Subsequent Events may be added in a similar manner to needs to identify these barriers so that their reasons for prior Events, to account for escalation or Events during failure can be addressed. recovery. Different Objects can be shown separately. To complete the model of HOW the incident happened, The figure illustrates damage and injury resulting from a fire Barriers have to be identified which, had they been in place, incident. Note that the burn victim becomes an 'object' for should have prevented the subsequent Events from occurring. the septic environment in which the burns exist. This may These can be Barriers that were in place, but failed, and those seem a novel concept, but, particularly in field operations, that should have been in place, but were missing. Initially a septic environment can exacerbate the injury if they are barriers can be defined as Failed Barriers but after the not treated promptly and effectively. Recovery measures investigation when more information is known, these could for injured persons may involve rescue, stabilisation at be reclassified as Missing or Inadequate Barriers the incident scene and transportation to an appropriate medical centre, all of which involve additional risk. Events Identification of Barriers requires knowledge of the process such as rescue and recovery operations immediately after and the facility where the incident occurred. An organisation injury or harm has occurred should always be considered that has properly identified its risks should have Barriers as a potential investigation lead. The last Event could be a documented and in place. Many of these Barriers can usually 'potential' Event, (i.e., where no harm actually occurred), if be found in the management system for the activity under an associated Barrier had not failed. review. Risk Assessments prior to job execution (JRA, JSA, JHA) may have identified additional Barriers, documented Construction of the core diagram is critical in an e.g. in the Permit to Work. A thorough examination of incident investigation. The diagram sets out the scope the operation, including design aspects where appropriate, of the investigation, the Agent, Object and Event 'end and all relevant documentation is required to ensure that nodes' indicating points where no further investigation all barriers that could have prevented the incident are is considered necessary. The different trajectories indicate considered. where effective risk management barriers would have prevented events or consequences. Usually 2 to 5 Agent- In an investigation it may help to draft 'specification Object-Event trios are enough to describe most incidents. questions' relevant to the incident: Opportunities for the next step, the identification of barriers • What Barriers should have prevented the exposure of the Agent of Change? • What Barriers should have protected the Object from the Agent of Change? Barriers should be seen in the context of the incident being investigated. For example, in an incident where crude oil has been spilled causing pollution, the Barriers for secondary containment of the spillage will be relevant whereas those Barriers for fire fighting, in context of the incident, will not. 13 Tripod Beta User Guide Risk management barriers relevant to a specific incident to test the incident model scenario(s) against the emerging are located on one, or both, of the trajectories in the facts conduct the investigation, (e.g. evidence gathering core diagram. For convenience, Barriers guarding or and interviews, as described in Section 4 below). In this containing the Agent of Change are shown on the Agent- process the incident model may change but at all times a Event trajectory and those protecting the Object show on models exist which can be validated or modified further the Object-Event trajectory. until it is fully validated as accurately modelling the incident. Barriers which were originally classified as Failed The figure shows how these Barriers are added to the 'core Barriers are now confirmed, removed or reclassified. In diagram'. other words, the investigation and analysis processes are iterative and run concurrently. The time spent in team discussion to agree on the core diagram, incident scope and barriers is important. Once defined, the investigation team can focus on why barriers failed. Duplication of team efforts can be avoided and facts tested for relevance against an agreed incident 'model'. 6.4 Why did the barriers fail? (Identify Causes) The next task is to establish the Immediate Causes and pathways to Underlying Causes for each failed or missing The next figure illustrates the first part of an incident 'model' Barrier. These pathways will include, as appropriate: with risk management barriers located on appropriate Immediate Causes, Preconditions and Underlying Causes. trajectories in the core diagram. It is a representation of See chapter 4 for the human behaviour theory and WHAT happened in an incident and HOW it happened. guidance to determine these pathways. Knowing WHAT happened and HOW is only part of the Although some failed or missing Barriers may have causes investigation. Even if the failed and missing Barriers are in common, they can be investigated individually using reinstated, the Underlying Causes of failure will remain. the Tripod model of causality. To make more effective recommendations to avoid similar incidents, the reasons WHY these Barriers failed must be Failed Barriers established. The most common causal path is where an Underlying Cause creates a Precondition. This in turn creates the Validate Failed Barriers Immediate Cause of a Barrier to fail. The Immediate Having identified what barriers should have been in place Cause can be a sub-standard act by a person or a sub- but assumed to have failed, the next task is for the team standard condition. Object Barrier Event Agent AGENT Object Barrier Barrier Event Event Agent Barrier Barrier Object Agent Barrier Time 14 Tripod Beta User Guide Underlying Immediate Cause Pre-condition Cause Many Many Many One One One Failed Barrier There is usually a one to one relationship between the nodes "Failed Barrier" and "Immediate Cause", and a many to one relationship between "Precondition" and "Immediate Completing the Tripod Beta Tree Cause". (The relationship between Precondition and To complete a Tripod-Beta tree the facts relevant to the Immediate Cause is not causal but probabilistic which is incident have to be identified from those gathered by the indicated via a dotted line in the diagram below.) There investigation team and then connected according to the is also a many to many relationship between Underlying conventions of the Tripod Beta tree model. This is done Cause and Precondition. These relationships are illustrated in parallel to the investigation activity and should involve in the figure. Occasionally it may be effective to have one discussion between investigation team members. Immediate Cause linked to several failed barriers. The facts of the investigation will need to be classified, (e.g. In some instances the full causal chain: (i.e., Immediate Agents, Failed Barriers, Preconditions etc.,) during tree Cause - Preconditions - Underlying Cause), does not construction, but the investigation team should initially be apply, e.g. when the Underlying Causes, (and their concerned more with the facts themselves, rather than with remedial actions), are outside the domain of the company's the classifications. This may generate discussion between management system. However, they could be in the the team to come to a common understanding of what the company's "policy" domain on influencing elements outside facts mean in terms of understanding the incident. their control, e.g. Governments, Regulation Bodies, Third Parties, etc. In such instances the full causation path is Barrier Summary shown in the Tripod Beta Tree and with an appropriately The relationships between the different Barrier nodes and worded action on the Underlying Cause aimed at exerting the other nodes in the Tripod Beta model are shown in this influence. Figure below. Missing /Inadequate Barriers and Failed Barriers where no sub-standard act exists are rare. The Missing / Inadequate Barriers most valuable part of a Tripod Beta analysis is related to Sometimes, albeit rarely, a Missing / Inadequate Barrier identifying and analysing sub-standard acts by people is identified. By definition, it does not have an Immediate involved in the incident. Cause or Precondition. These types of Barriers are usually due to inadequate planning, design. They are only Unplaced Facts classified as missing/ inadequate if no Immediate Cause Not every fact gathered is relevant to the understanding of can be identified. an incident. Especially at the start of an investigation, the gathering of information is along a broad front and not until Effective Barriers the pattern of the incident sequence and causal chains emerges In a Trio containing an Effective Barrier, (in either Agent- will the team concentrate on areas known to be relevant. Event or Object-Event path), the Event did not take actually place and would be classified as a "Potential Event" or a Some facts relating to the work environment may be "Near Miss". This is illustrated in the figure below. necessary to improve the understanding of any readers of the incident report who are not familiar with the location Effective Barriers indicate how close the situation was to or operation. However, when a fact is seen to be irrelevant to a far more serious incident and that only this 'last' single understanding the incident, it should be discarded. barrier was preventing this incident from happening. 15 Tripod Beta User Guide 6.5 The tripod tree involved in completing these items. Each failed or missing The Tripod-Beta 'cause and effect tree' is the combination Barrier and Underlying Cause should have at least one of the WHAT, HOW and the WHY models. The figure recommendation. demonstrates how the Tripod causation paths are connected to each failed barrier. An investigation tree with a more complex core would have more 'nodes' but the linkage of tree elements Underlying Cause Precondition follows the same principles. Repetition of Underlying Causes Immediate Cause can be avoided by linking more than one Preconditions to Precondition one Underlying Cause. Agent Failed Barrier Event The aim of the Tripod-Beta tree is to provide a suitable set of Object concepts - a 'framework' - so that the investigation team can Failed Barrier make explicit the various failures contributing to a particular incident. Underlying Immediate Precondition Cause Cause An overview of the Tripod Beta symbols is in Annex 5. Annex 6 presents the rules for constructing a Tripod Beta tree e.g. allowed and forbidden combinations of events, Failed Barriers agents, objects, barriers, immediate and underlying causes, To ensure the area where an incident occurred is safe and and preconditions. A worked example of a Tripod Beta tree is to enable operations to begin as soon as possible, actions provided in Annex 8. recorded against Failed Barriers are already likely to have been taken before the incident report is issued. However, 6.6 Remedial actions these actions are recorded in the report plus any others that The last items required to complete the tree are action should be taken locally and which may have been originally items addressing identified failures and classification of the overlooked. underlying causes. The investigation team should be fully 16 Tripod Beta User Guide Underlying Causes Management should have the opportunity to check the Actions assigned to Underlying Causes are aimed at appropriateness of the recommendations and feed back their correcting 'shortcomings in the management system. comments and endorsements to the team. This is particularly These will normally require more resources to undertake and important for recommendations regarding Underlying longer to complete than those assigned to Failed Barriers. Causes. The resolution of Underlying Causes is usually a longer term project and endorsement by management implies SMART Actions that resources for implementing the recommendation will be Recommended actions need to be credible. Each recommen- provided. In view of their experience and deeper and broader dation should be clearly appropriate to the failure or deficiency understanding of management systems, senior management and should be discussed and agreed with an action party. could well identify issues and/or recommendations overlooked by the investigation team. If this is the case, the Management should be convinced that if they endorse the incident report should be amended to include this additional recommendation some positive change will result. Moreover, information and re-issued. actions should be 'SMART', i.e. 7. Learning and Feedback Specific: relate to a clearly identified action to be taken which is understood and agreed by the action taker. 7.1 Feed Back to Risk Assessment Learning from incidents is essential if future incidents and Measurable: the results of taking action can be measured in losses arising from the same Underlying Causes are to be some way and close-out verified. prevented. Tripod investigation and analysis is a major part of the overall "Learning from Loss" process. Appropriate: specifically addresses a Failed Barrier or Underlying Cause identified in the report. Every company has its own incident reporting and investigation process but the main stages of this process are Realistic: able to obtain the level of change reflected in the expected to be similar to the following: recommended action, (knowing the resources and capacities at the disposal of the organisation). • Emergency Response, (level depends on severity of the incident), treatment of any injured persons, containment Time based: stating the time period in which the action must of incident. be completed. • Making incident location safe and protecting evidence • Initial registration of incident and informing regulatory The recommended actions assigned, especially to Underlying authorities as appropriate. Causes, should not be "out of reach" of an organisation to • Assess potential harm of incident and deciding level of complete nor should they consolidate the "status quo". The investigation and analysis. opportunity should be taken to 'stretch' an organisation • Appoint team leader and form incident investigation and to complete them with the aim of making incremental analysis team improvements in the business culture. • Conduct investigation and analysis (using Tripod in this instance) Action items should be developed by those in the affected • Define actions and write report. organisation albeit under the guidance of the Tripod Beta • Dissemination of lessons learned Practitioner. Also the party with the action should agree it • Monitor completion of actions before is formally recorded. • Feedback to risk assessments 6.7 Senior Management Review and Action Plans The purpose of investigation and analyses is prevention The incident report represents the team's effort, and team through learning. Therefore the dissemination and feedback members should satisfy themselves that their findings and to the pro-active risk assessments is essential if the overall recommendations are correctly presented to the appropriate Incident Management process is to be a "closed loop" system. management level. 17 Tripod Beta User Guide This is illustrated in the figure which also shows information This will require: being fed back into risk assessments from Near Miss analysis • a powerful Incident Reporting database with an and Audits. effective data structure, • a knowledgeable operator who will be able to seek the 7.2 Differing Levels of Incident Reporting, right information from the database and interpret the Investigation and Analysis findings and draw conclusions Not all incidents require the formality, depth and • accurate data entry into the database thoroughness of a Tripod Beta investigation and analysis. From this holistic and systematic approach, the deep learning For minor severity and low risk incidents, the extent of the gained from Tripod Beta investigations and analyses will be investigation and analysis is likely to be limited to simply supplemented by the information obtained from the more entering the incident details into the company's Incident numerous but less severe incidents. Reporting System, and taking local corrective actions. At the other extreme, all incidents rated at the higher risk areas of a risk matrix or which have caused significant actual harm, will justify the full Tripod Beta investigation and analysis process as explained in this manual. This analysis will identify both the local remedial actions as well as those to correct the deeper systemic failings in the business. By ensuring there is a systematic and logical approach to collecting incident information for all levels of incident investigation, reporting and analysis, it will be possible to integrate them and draw additional conclusions and learning from the knowledge thereby created. Such analysis will include, but not be limited to, trend and "comparison" analysis. 18 Tripod Beta User Guide Annex 1: Glossary Term Description Agent of Change Anything with the potential to change, harm or damage an object upon which it is acting. Barrier A measure which reduces the probability of releasing an Agent's potential for harm and of reducing its consequences. Basic Risk Factors A system for categorising Underlying Causes. An indicator of an aspect of a management system where a failure exists, and by implication where the remedy lies. Core Diagram A Tripod Beta tree containing only the Agent-Object-Event trios. Effective Barrier A barrier that was effective in restoring control or preventing further consequential injury or damage following an actual event. Errors Actions by people which result in the Immediate Cause of a Failed Barrier. Event An unplanned and unwanted happening involving the release or exposure of an Agent of Change. Failed Barrier A Barrier rendered ineffective by an Immediate Cause. Immediate Cause An action, omission or occurrence that causes a barrier to fail. Immediate Causes include sub-standard acts by people and, (by exception), sub-standard conditions where people were not the Immediate Cause of the failure. Immediate Causes occur close to the failed barrier in time, space or causal relationship and negates the Barrier. Incident An event or chain of events which cause, or could have caused injury, illness and/ or damage (loss), e.g., to people, assets, the environment, a business, or third parties. Inadequate A Barrier identified and established by the organisation as a management control measure but which failed, Barrier not due to an Immediate Cause, but due to its inadequacy. (Treated the same way as a Missing Barrier.) Lapse Omission/ repetition of a planned action possibly caused by Memory failure. (Type of human error.) Missing Barrier A barrier identified by the organisation as a management control measure but was not established. (Treated the same way as an Inadequate. Barrier) Object The item harmed (injured, damaged or lost), or changed, caused by an "Agent of Change". Precondition The environmental, situational or psychological 'system states' or 'states of mind' that cause or promote Immediate Causes. Slip Unintended deviation from a correct plan of action caused possibly by attention failure or mistiming. (Type of human error.) Sub-Standard Act An action, error or omission that causes a barrier to fail. An "Immediate Cause" attributable to an erroneous human action. Sub-Standard A technical condition that renders a barrier to fail. An "Immediate Cause" attributable NOT to an Condition erroneous human action. Trios The linked combination of an "Agent of Change", "Object" and "Event". Trios are linked to other trios by a combination node, i.e. Event/ Agent of Change or Event/ Object. Tripod Beta A person who has been formally accredited as being competent to undertake a Tripod Beta Investigation and Practitioner Analysis. Tripod Beta Tree The graphical model used to depict an incident. Underlying Cause The organisational deficiency or anomaly creating the Precondition that caused or influenced the commission of an Immediate Cause. 19 Tripod Beta User Guide Annex 2: Tips for Tripod tree barrier? Only if it is understood who the individuals are can construction and quality checking the precondition be found!!! 14. Does the Immediate Cause describe something that This section provides tips for quality checking of the Tripod happened close in the sequence of happening to Failed analysis. Using an accredited Tripod practitioner will ensure that Barrier? (Close in logic but not necessarily close in time or these quality checks are applied throughout the analysis. location.) 15. Does the Immediate Cause describe an act of doing, or not A. Creating the Core Diagram doing, something? 1. Define the Event first, then the Object which has been 16. There can be only one Immediate Cause for each Failed changed, (as described by the Event), and then the Agent, Barrier? (which acted on the Object to change it). Reasoning to 17. An Immediate Cause and Failed Barrier should be described construct the trio is 'back in time' but diagram timeline is as a "duo". The Immediate cause will be the 'opposite' of a from left to right. Failed Barrier, i.e., if the Barrier is worded positively then 2. Does the Event describe a 'happening' to the Object? the Immediate Cause will be worded negatively. 3. Does the Object describe an item before its condition was changed to that described in the Event? D. Identifying Preconditions 4. Does the Agent describe something that had the potential 18. Does the Precondition explain why the individual thought /ability to change the condition of the Object to that that their act was normal, acceptable or even commendable? described in the Event? 19. Does the proposed precondition have an 'influence' on the 5. Initially, create many Trios to capture as many scenarios behaviour of the person who made the error leading to the as possible. They can be disregarded or 'collapsed' into Immediate Cause that in turn led to the Barrier failing? fewer trios later on when more information emerges from 20. If the proposed precondition was an Immediate Cause of a the investigation. Failed Barrier, rather then an indirect and influencing factor, 6. Normally, a final core diagram contains 2 to 5 trios. then what is being described is not a Precondition. 7. 'Time' moves from left to right, i.e. the tree starts with an Agent and an Object and ends with an Event(s). E. Identifying Underlying Causes 21. Is the Underlying Cause a valid reason for the perceptions B. Identifying Barriers and beliefs, (Preconditions), that led the individual think 8. Check management system, Job Risk Analysis, Permit to that they were doing the right thing or that which was Work, etc. to assess whether all relevant barriers are considered normal, acceptable? considered. 22. Does it represent a failure on 'system level', i.e., its relation to 9. Is a Failed Barrier described such that, had it been effective, the actual event is 'remote' in time and/ or location? it should have prevented the next Event from occurring? 23. Is the organisation in question in the position to take Is it described in specific, and not general, terms, (e.g. the responsibility for the existence of this system failure and is relevant part of a procedure rather than the title of procedure able to improve the situation. (If the organisation does not or type of procedure)? In the later stages of the incident have 'direct responsibility' for this systemic failure, it can analysis, the Barriers may be merged if this creates more never-the-less influence others outside the organisation?) clarity of presentation. 24. Underlying Causes are related to Management Systems. 10. Missing /Inadequate Barriers are rare, but when they do occur, try to identify the human error in planning, design, F. Creating Recommended Actions etc., and make that the Immediate Cause of the Failed 25. Are the actions: Barrier. • SMART, 11. If a single Barrier for a particular Trio cannot be found then • Developed by someone within the organisation, merge that Trio with another one that does contain a Barrier. • Have been agreed by the action party and • Likely to improve the business culture of the company C. Identifying Immediate Causes • Likely to effectively and efficiently solve the problem 12. Has the Immediate Cause led to the failure of a Barrier? • Enduring in that they will be effective for a long time 13. Who is the person or persons that caused failure of the • Extensive in that they are applicable out with the local scene. 20 Tripod Beta User Guide Annex 3: Errors, Violations and their Preconditions The conditions that lead to mistakes are different from those that cause attention failures. Knowing the form of human error helps in the identification of Preconditions. When the Immediate Cause of a failed barrier is due to a sub-standard act, identifying the type of human error which caused it will help in identifying the related preconditions. Preconditions are the environmental, situational or psychological 'system states' or 'states of mind' that promotes was more or less what was expected of them, commendable, Immediate Causes. In simple terms the precondition can be unavoidable or just normal. The table below illustrates found by asking why the person or group of persons that the connection between sub-standard acts and typical caused the failure had the belief or perception that their act preconditions. Error type Description Possible Causes/Preconditions Slip Unintended deviation from a correct plan - Attention failure of action - Mistiming - Distraction from task - Preoccupation with other tasks Lapse Omission/ repetition of a planned action - Memory failure - Change in nature of task - Change in task environment Mistake (rule-based) Intended action inappropriate to the - Sound rule applied in inappropriate circumstances circumstances - Application of unsound rule - Failure to recognise correct area of application - Failure to appreciate rule deficiencies Mistake (knowledge-based) Erroneous judgement in situation not - Insufficient knowledge or experience - immaturity covered by rule - Time/emotional pressures - Inadequate training Unintentional Violations - People not knowing how to apply the - Poor writing Understanding procedures - Complexity - Failure to understand users Unintentional Violations - People acting as if there is no procedure - Poor Training Awareness - Lack of availability on site Routine Violations Rules broken because they are felt to be - Unnecessary rules irrelevant or because people no longer - Poor attitude to compliance appreciate the dangers - Weak supervision Situational Violations - Impossible to get the job done by - Lack of resources (people, equipment, tools) (No-can-do) following the procedures strictly. - Failure to understand working conditions Optimising Violations To get the job done faster, with less - Wanting to do a good job for the "boss" or - (I-can-do-better.) for disturbances etc. by not adhering to rules. company Organisational Benefits Optimising Violations - To get the job done more conveniently or - Personal convenience and opportunities to get more (I-can-do-better.) for to experience a thrill by not adhering to personal satisfaction from the act Personal benefits rules. Exceptional violations Solving problems for the first time and fail - Unexpected situations - no obvious rules to follow good practice - Pressure to solve problems 21 Tripod Beta User Guide Annex 4: Basic Risk Factor (BRF) 7. Incompatible goals (IG) Definitions Failure to manage conflict; between organisational goals, such as safety and production; between formal rules such 1. Hardware (HW) as company written procedures and the rules generated Failures due to inadequate quality of materials or informally by a work group; between the demands of construction, non-availability of hardware and failures due individuals' tasks and their personal preoccupations or to ageing (position in the life-cycle). distractions. The BRF does not include: 8. Communication (CO) Failure in transmitting information necessary for the • error-generating mechanisms due to poorly designed safe and effective functioning of the organisation to equipment Design BRF the appropriate recipients in a clear, unambiguous or • hardware failures caused by inadequate maintenance intelligible form. Management BRF 9. Organisation (OR) 2. Design (DE) Deficiencies in either the structure of a company or the way Deficiencies in layout or design of facilities, plant, it conducts its business that allow responsibilities to become equipment or tools that lead to the misuse or sub-standard ill-defined and warning signs to be overlooked. acts, increasing the chance of particular types of errors and violations. 10. Training (TR) Deficiencies in the system for providing the necessary 3. Maintenance Management (MM) awareness, knowledge or skill to an individual or individuals Failures in the systems for ensuring technical integrity in the organisation. In this context, training includes on the of facilities, plant, equipment and tools, e.g. condition job coaching by mentors and supervisors as well as formal surveys, corrosion barriers and function testing of safety courses. and emergency equipment. 11. Defences (DF) Issues relevant to the execution aspects of maintenance Failures in the systems, facilities and equipment for control are considered in the BRFs: Error-enforcing Conditions; or containment of source of harm or for the mitigation of Procedures; Design; Hardware; Communication. the consequences of either human or component failures. 4. Procedures (PR) Unclear, unavailable, incorrect or otherwise unusable standardised task information that has been established to achieve a desired result. 5. Error-enforcing conditions (EC) Factors such as time pressures, changes in work patterns, physical working conditions (hot, cold, noisy), etc. acting on the individual or in the workplace that promote the performance of sub-standard acts - errors or violations. 6. Housekeeping (HK) Tolerance of deficiencies in conditions of tidiness and cleanliness of facilities and work spaces or in the provision of adequate resources for cleaning and waste removal. 22 Tripod Beta User Guide Annex 5: Tripod Beta Tree Symbols Examples: The following notes should be used in conjunction with the A. An explosion weakens a structure which falls down, definitions in the Glossary (Annex 1) injuring rescue workers. The explosion Event has resulted in a new Agent being created. Event B. A man falls 30 metres into the sea. The fall Event An Event node represents damage, creates a new Object (the man) for an Agent (the sea). injury or loss. Events are the unplanned and unwanted happenings Failed Barrier involving the release or exposure of A Failed Barrier node is shown as Agents. An Event has exactly two letting the Agent or Object to pass inputs i.e. a line from an Agent plus a line from an Object. through a 'gap' in the Barrier thereby The Agent and Object may themselves be combined Event allowing the Agent and Object to and Agent/Object nodes. meet to create the Event. The gap in the Barrier has been caused by an Agent of Change Immediate Cause node. An Agent of Change node represents the presence of a potential to change, Immediate Cause harm or damage an Object upon The Immediate Cause is the action, which it is acting. It has no inputs, omission or technical failure that (i.e. lines, on the left-hand side of caused the Barrier to fail and is the node), and always connects to an Event node, typically therefore directly connected to it. via one or more Barriers. This will always be in partnership Immediate Causes include Sub with the Object that it is changing, damaging or harming. Standard Acts - committed by people - and sub-standard conditions, e.g. equipment / technical failures. There is Object always only one Immediate Cause linked to a Failed Barrier An Object represents the presence of and which represents the cause of the failure. an entity, (e.g. person, equipment, reputation, project schedule), that is Precondition vulnerable to an Agent of Change. It A Precondition causes or increases has no inputs, (i.e. lines, on the left- the probability of the Immediate hand side of the node), and always connects to an Event Cause of a Failed Barrier. An node, typically via one or more Barriers. It will always be in Underlying Cause must be partnership with the Agent that is causing it to be changed, identified for each organisational damaged or harmed. Precondition, but Preconditions such as natural phenomena or other conditions outside the Company's influence may Event and Agent - Event and be end nodes. Object Combination nodes are used to Underlying Cause represent an Event (e.g., damage or An Underlying Cause is the source injury), which goes on to play a further of an organisational Precondition. role in the incident as an Agent or By definition, it will be an 'end Object. Combined nodes will often be node'. There can be many Underling identified in the initial investigation Causes linked to each Precondition. as Events and be changed later when The Basic Risk Factors, (BRFs) or reference to Management Events are chained to describe the System elements are assigned to the Underlying Cause. consequential effect of one Event. 23 Tripod Beta User Guide Missing/Inadequate Barrier Annex 6: Tripod Beta tree rules A Missing Barrier node provides for cases where plans and 6.1 Trios (Agents, Objects, Events) procedures have specified a Barrier but investigation shows A. Agent and 1 object that none was established or that it was in place but was inadequate for the intended role. There are no Immediate Causes for this type of Barrier and it is linked directly to an Underlying Cause. Effective Barrier An Effective Barrier node represents a Barrier that did not fail and provided the successful containment of an Agent or protection of an Object. B. Multiple Agents It is used to model a 'Near Miss' or a branch of an incident tree where further injury, damage or loss was averted. There is no Immediate Cause, Precondition or Underlying Cause nodes linked to it. Narrative Models, being simplifications, cannot embrace the full complexity of the real world. Occasionally there is a need to clarify the connection between two nodes. The Narrative NO - One AEO trio has only one Agent node provides this facility and is shown on the Tripod Beta Tree as C. Multiple objects required. NO - One AEO trio has only one Object 24 Tripod Beta User Guide D. One Agent - Multiple Events 6.2 Missing Barrier A. Underlying Cause This is the case if the Missing Barrier NEVER has been there, but it was reasonable to expect it there. Also it is impossible to identify anybody who should have designed or implemented the Barrier. In cases where the Missing Barrier has been One Agent can affect multiple Objects creating multiple removed (after it has been there previously), or possible Events. to identify who should have designed or implemented the barrier, it is considered a FAILED Barrier. D. One object - Multiple Events B. Multiple Underlying Causes A Missing Barrier may have more than one Underlying Cause. C. An Immediate Cause One Object can be affected by multiple Agents creating multiple Events NO - A Missing Barrier can only be connected to an Underlying Cause. 25 Tripod Beta User Guide D. An Immediate Cause and Precondition D. An Immediate Cause, Multiple Preconditions and Underlying Causes NO - A Missing Barrier can only be connected to an Underlying Cause. 6.3 Failed Barrier A. An Immediate Cause, A Precondition and an Underlying Cause E. An Immediate cause, without an underlying Cause This is very exceptional; only case created by other, B. Precondition and underlying Causes (uncontrollable) parties. If this is used in a tree, explain why. NO. A Failed Barrier must be linked to an Immediate Cause. C. Multiple Immediate Causes Preconditions and Underlying Cause NO. There can only be ONE Immediate Cause connected to a Failed Barrier 26 Tripod Beta User Guide 6.4 Inadequate barrier 6.5 Preconditions A. An Underlying Cause A. An Immediate Cause This is the case where a Barrier is in proper condition, but See also 6.4.3 a), c) and d). not able to prevent the release of the Agent or protect the Object effectively. (E.g., a fence is in tact but built too low B. Multiple Immediate Cause so that people can climb over it.) Also it is impossible to identify anybody who should have designed or implemented the Barrier. This is called an INADEQUATE Barrier. It is depicted by the same symbol as a Missing Barrier. B. Multiple Underlying Causes C. An Underlying Cause An Inadequate Barrier may have more than one Underlying Cause See also 6.4.3 a), c) and d). D. Multiple Underlying Cause 27 Tripod Beta User Guide 6.6 Underlying Causes C. Multiple Missing Barriers A. A Precondition D. Inadequate Barriers See also 6.4.3 a), c) and d). B. Multiple Preconditions C. A Missing Barrier 28 Tripod Beta User Guide Annex 7: Tripod Beta and BowTie BowTie, Fault Tree and Event Tree A BowTie diagram is a simplistic representation of a combined Fault Tree and Event Tree, as shown below. (The red lines depict the trajectory of a particular incident.) Fault Tree Fault Tree Event Tree 29 Tripod Beta User Guide BowTie BowTie, and Tripod Beta Tree A series of faults, Events and Failed Barriers, lead to the Whilst the BowTie risk assessment and the Tripod Beta "Top Event", (or "Main Event" using Tripod Beta terms), incident analysis methodologies are based on the same via a specific incident trajectory. After the Top Event, harm scientific principles, there is not necessarily a direct one to was caused by a subsequent Event and a Failed Barrier along one relationship between the entities within them. However, the specific incident trajectory. The consequences could reviewing the appropriate BowTie risk assessment(s) have been more severe but, in the case shown below, the associated with an incident could help identify Barriers incident progression was stopped by an Effective Barrier in the Tripod Beta Tree. The simple relationship between and the last and End Event shown on the Tripod Beta Tree a BowTie and a Tripod Beta Tree is shown in below. being a Potential Event. 30 Tripod Beta User Guide Annex 8: Worked example of Tripod • The search was extended to other locations off the Beta Tree designated route, and the vehicle and driver were eventually located at 1830. The vehicle had left the Introduction road and rolled over and the supervisor had suspected In this annex a fictitious incident is used to provide an example spinal injuries. of the development of a Tripod tree. It should be realised that • The injured man was evacuated by the field ambulance a Tripod Beta analysis, as shown in a tree, is a model of a to the field first aid post and from there to the base complex incident. There is not a single correct model of any hospital. The view of the doctors is that the injuries incident and this annex shows one good example of a vehicle will probably result in permanent disability, and that accident. The event could be modelled in a different ways. the attempts by local population to extract him from However, different models should still identify the similar the vehicle while waiting for the rescuers to find him key barriers and underlying causes. Any modelling process is likely to have been a major factor contributing to aims to simplify a complex situation to aid understanding. the severity of the injury. The victim was conscious and had taken notice of the time and made a mental The Incident calculation of the time by which he could expect the A driver has been involved in a vehicle incident and has rescue team to show up. When they did not show up badly injured his back. You are tasked with leading an at the expected time he became nervous and allowed investigation into this incident. local villagers to get him out of the vehicle. • Examination of the vehicle and the site indicate that Initial Investigation only one vehicle was involved, and that there were no Visits by the investigation team members to the incident indications of a tyre blow-out or other catastrophic site, the production centre in the area and the base hospital technical failure. establish the following facts: The Core Diagram • The driver was delivering goods to a remote location. The core diagram focuses on what happened. If there is • He left the Area Production Centre on schedule at 0800 evidence at this stage of why any of the events happened it hours. According to his posted Journey Management should be ignored for the time being. The start is the Main plan, he was due to return to the Centre at 1230. Event - why the incident is being investigated. • His failure to return was not reported until 1500. A search was initiated at 1630 along the route he had indicated in his Journey Management Plan without success. 31 Tripod Beta User Guide Main Event: Driver with back injury Prior event: Tyres hit shoulder of road The injury is a rational start point in this case. The initial The new Object (vehicle stability) and the new Agent (tyres hit Event-Object-Agent (EOA) trio is straightforward; the shoulder of the road) are now examined to determine whether Event is Driver with back injury. The Object is the Driver they were the result of prior Events. No further investigation and the Agent is the Roll over of vehicle. leads are identified for the Object, the stability of the vehicle. The Agent, tyres hitting shoulder of the road is a result of Subsequent event: Permanent disability from spinal deviating from the intended straight course which is caused injury by lack of control of the vehicle e.g. by the driver falling asleep Determine whether there were prior or subsequent Events that at times. A convex road and side winds create forces for the need to be accounted for. Note the qualification 'that need to vehicle to drift of the road when not properly controlled. be accounted for'. Prior event: Vehicle on the road Start with the Event. Not every driver with spinal injury The new agent is therefore Sideways forces on vehicle from side suffers permanent disability, and medical advisers have winds and convex road surface. implicated failures in rescue and aftercare. The permanent disability from spinal injury is depicted as a Subsequent Event, No further investigation leads are identified for the new the (potential for) Incorrect extraction of the driver is the agent Agent as side winds and convex roads are normal. Remains to to change Driver with back injury - who is the Object. Note consider whether Vehicle on road is preceded by another trio. that the agent Incorrect extraction of driver should no be seen It is found that the need to transport goods is the Agent for the as an event; it has not yet happened and can be prevented by safely parked vehicle in parking lot, the object, to be result in an the barriers. To make this clear the words (potential for) can Event-Object Vehicle on the road. be added. The Core diagram is now complete, comprising five linked Prior event: Roll-over of vehicle trios. It defines the limits that have been established for the Now consider the Object in the Main Event trio. Was the investigation, prior and subsequent to, the 'Main Event'. driver present as a result of some prior event? In this example the driver was engaged on legitimate operational activities Barriers with his back resting against the seat; this is normal and needs Ten trajectories have been defined in the core diagram, no further explanation. A similar question is posed to the representing the conceptual paths bringing the Agents and Agent in the Main Event trio. Was the rollover the result of Objects together, resulting in the identified Events. The some prior event? Clearly the roll over is an abnormal situation investigation must now identify the Barriers that should that needs to be accounted for, so there is a prior event. The have acted on these trajectories to prevent the Events from Object is the vehicle stability which was changed when the occurring. If any of these Barriers had been effective, the tyres hitting the shoulder of the road. sequence of events would have been interrupted causing the 32 Tripod Beta User Guide outcome to be different. For the discussion the tree is broken would have prevented the crashed vehicle to be on the road into two parts, the first part dealing with the events after the at all. Secondly, during the Journey Management discussion vehicle started to roll over and the second part dealing with prior to departure the Journey Manager is supposed to the events leading to the roll over. assess whether the assigned driver is fit to drive and stop the driver if the driver himself states that he is not rested or The investigators need to examine each trio separately, the Journey Manager suspects that the driver is not rested applying their knowledge of the operational process, and fit. investigating further if necessary to identify what barriers had been established: The next barrier is about the driver being on the road. Not being rested and alert does not necessarily mean that the • To control the Agent vehicle cannot be controlled. Initially the driver was alert but • To protect the Object. after a while he occasionally dozed off. A continued Alert and Correct steering would have prevented the accident. Once Consider the primary injury. The driver's back was injured the vehicle hit the shoulder of the road the driver woke up when the vehicle rolled over. There were no barriers in place again and should have steered his vehicle onto the road in a to stop the motion of the vehicle once it started to roll. One controlled manner as taught in training courses. barrier only could have protected the driver's back (preventing back injury or reducing the seriousness): the use of a seatbelt. At this moment one should consider the entire tree again In the subsequent trio two barriers could have prevented and check whether anything else could have stopped the the situation of the driver to aggravate and develop into a sequence of events. This is best done as a team effort. The permanent disability. They relate to the timely location of HSE Case, procedures and instructions that relate to this the victim by an immediate response and effective search by incident should be considered to make sure that all barriers a team that knew where to look. Each of these barriers could mentioned in there have been reflected in the tree. have reduced the time to find the victim prior to incorrect extraction from the vehicle. Now we consider the second part of the tree. The vehicle on the road could have been prevented in two ways. Firstly the urgency of the load could have been investigated by the logistics planners which would have led to the conclusion that the goods could have been combined with a large truckload which was planned to leave the following day. During the investigation it was discovered that there was no urgency for the goods to be delivered instantly. This consideration 33 Tripod Beta User Guide Tripod Causation Paths Underlying Cause 1 Each of the seven failed barriers has a Tripod causation path: Fitness and resting of drivers has not been addressed in the journey management procedure and has not been considered • The Immediate Cause that defeated the barrier. as an issue. The Journey Management Plan procedures have • The Precondition(s) that caused or promoted each weaknesses in many respects. Immediate Cause, • The Underlying Cause(s) that created each Precondition 2 Precondition. The Journey Manager has no other choice then to use the Although in some cases there may be shared causes, these driver that is available. He beliefs that the job cannot wait paths can be investigated independently from each other. and there are no other drivers available at that moment. So he decided that the job has to be done by the driver that is Barrier: Combining loads with other loads available Immediate Cause Journey Manager misses opportunity to combine loads. This Underlying Cause 2 is a knowledge based mistake that has become common place. See above under "combining loads" There is a need to look at system to get correct information to the individual in an understandable manner Barrier: Alert and correct steering Immediate Cause Precondition Driver fades out on and off behind the wheel. A lapse and The Journey Manager believed that an urgent delivery possible violation of "pull off and stop" policy. was required as stated on the requisition. Although he had noticed that almost all requests for transport came with an Precondition 1 "immediate" status he did not enquire what "immediate" Drivers should be informed that adequate sleep is important meant. to ensure alertness, and that many serious road traffic accidents are caused by sleepiness. The other fact that Underlying Cause drivers should know is that sleep is the only remedy against Communications between Journey Manager and the sleepiness. Taking a 20 minute nap combats sleepiness customers left to be desired. Usually the customers ask effectively. This driver was convinced that he was doing for immediate delivery because it is their experience that the right thing by rushing for his delivery and not allowing sometimes loads take weeks to be delivered if not specified himself a nap. He believed that immediate service was as "immediate". Simple phone calls or regular meetings to expected from him and he tried to keep himself awake by discuss delivery issues do not take place. singing, loud radio and chewing gum. Barrier: Stop Non-Rested driver Underlying Cause 1 Immediate Cause The company does not provide Advanced Driving Courses Journey manager does not stop the non-rested driver. for its drivers in which knowledge about the relation between A violation on the rules that would appear to be routine. safe driving and driver alertness is addressed. Culture and organisational issues that encourage this need to be investigated. Precondition 2 Driver beliefs that even with a couple of hours of sleep he Precondition 1 can drive safely. He has done this before and so far has been Journey Managers have a responsibility to verify that able to complete his trips without accidents. He considers it drivers are competent, physically fit for the job and rested. as a weakness to admit that he has sleeping problems and However, this is usually not done and the Journey Manager feels that he may loose his job. assumes that every driver on his doorstep is competent and rested. He has never been told about the need to check the Underlying Causes 2 suitability, fitness and alertness of drivers and it is not stated There are not enough drivers for the number of trips required in any of the manuals that were issued to him. so sometimes drivers arrive home late and have to start very 34 Tripod Beta User Guide early to get cargo loaded. Together with travel between the Underlying Causes yard and his home he frequently has less than 8 hours at Management failure to ensure that their policies are correctly home during which he has to wash, eat, socialise and sleep. communicated and interpreted. (Communication). Local The company does not maintain any control over the length culture stimulates risk taking, "macho driving" etc. and of time in-between duties (work-life balance). Company discourages compliant behaviours. does not provide Advanced Driving Courses in which the need for regular deep sleep is explained. Barrier: Effective search Immediate Cause Barrier: Correct reaction on hitting shoulder of Search team was delayed in finding the car because route that the road driver should take was not documented or communicated. Immediate Cause A violation of the journey management process. Driver overreacts when waking up and over steers vehicle This is mostly an instinct reaction that is difficult to resolve Precondition by training. Search team were unaware of exact location of the accident. Precondition Underlying Cause Driver beliefs he is a good driver and while waking up he Failure by the owner of the Journey Management Plan to does not take a conscious action; there is hardly a thought ensure that those operating under the Journey Management process. The prime reaction is to get back on the road as Plan were adequately trained and competent in their quickly as possible (rather than slowing down and gently use e.g. with respect to discussing the route to be taken, steering back onto the road). documenting the route and stressing the importance of not deviating from the route without clear communication with Underlying Cause the home base. The company does not provide Advanced Driving Courses for its drivers in which skills in regaining control is practised such that they become routine. Barrier: Use of seatbelt Immediate Cause Driver failed to use seat belt. In a statement to the investigation team he maintained that this was a 'one off' lapse caused by his being preoccupied with his task. Further interviews with relevant staff suggest that the requirement to wear seat belts was insufficiently stressed during induction. In the country where the incident happened seat belts are not required by law, and many newcomers were under the impression that it was a strong Company recommendation but not a requirement. A violation that appears to be routine. Precondition The local Safety Induction Trainer incorrectly interpreted management policy relating to seat belts. This lead to the use of seatbelts not seen as part of 'driving safety culture' and whereas most drivers in the area consider the use of seatbelts as "childish" the driver concerned in this incident also preferred not to use a seatbelt. 35 Tripod Beta User Guide Barrier: Rapid Mobilisation of Search Team Underlying Cause 2 Immediate Cause Management does not enforce regular exercises at random Is a failure by Duty Manager to initiate a search operation moments to check functioning of the Emergency Response within target time (Journey Management Procedures call System and to stress the need to adhere to duty procedures. for search to be mounted within 45 minutes of overdue alert). In this case it took 75 minutes. Vehicle design: Further investigation established that the vehicle design Precondition 1 was essentially 'fit for purpose' with respect to occupant The control room staff occasionally had to attend to outdoor protection. The Procurement Department have in place duties during which they could not always be contacted. specifications for the vehicle the company should buy and Control room staff just did what was expected from them this particular vehicle had done extremely well in crash and did not express any concerns to there boss that they tests. Rollover damage resulting in vehicle write-off is a may not be able to respond quickly to emergencies when comparatively rare event (fewer than one in 20 vehicles attending to their outdoor duties. is damaged to this extent in a rollover). Previous studies indicate that attempting to avoid this damage by special Underlying Cause 1 vehicle design or modification would not be feasible. Shortage of operators due to cost cutting drive in combination with a lack of courage of operators to speak up Recommended Action when they cannot meet all demands put on them (afraid of Recommendations are now required addressing each of the being sacked with the next cost cutting round). Failed Barriers (vehicle design now excluded), specifying actions that will restore the barriers at least on a temporary Precondition 2 basis, and addressing the eleven identified Underlying The emergency response team attended the party to Causes. celebrate the 40 anniversary of the communications officer with coffee and cakes. 36 Tripod Beta User Guide 37 Tripod Beta User Guide Annex 9: Performing an Investigation rapidly with time, (often on purpose e.g. clean up or restart operations), and delayed investigations are usually not as Introduction conclusive as those performed promptly. It is imperative to learn from incidents, which have created loss (or potential loss), if the chances of these losses recurring Categories of Evidence are to be minimised. Therefore, a systematic investigative Susceptibility of evidence to breakage, distortion or loss, i.e. approach, thorough pre-investigation planning and the its fragility, is important. pooling of experience and expertise wherever possible within the organisation, is vitally important. This annex provides Evidence can be obtained from anyone or anything that details of that approach. provides knowledge about the mishap. A common and convenient classification of evidence is known as the four Basics P's. This, in order of decreasing durability, (i.e. the least durable last), is as follows: Qualities of an Effective Investigator Effective investigations depend heavily on a disciplined Papers are most durable and harder to change, however approach and also on the attributes of the investigator, i.e., they may be overlooked or altered. • Integrity to be above any influences that may distort Parts are still durable but subject to pilferage, corrosion, information. Fact-finding requires truthful disclosures. marring and misplacement. • Objectivity and an open mind to avoid premature conclusions and also to be receptive to evidence Positions are evidence of physical relationships and contrary to hypotheses. Opinions need to be sequences. Post-contact positions are less durable as things secondary to the information revealed by the objective are moved by emergency response crews and others involved evidence. in the incident. They may also be subject to cleanup or a • Perseverance to trace "symptoms" back to underlying desire for a rapid return to production operations. causes. (Tracing the roots of deficiencies into the management systems can be a painstaking task.) People are sources of eye or ear witness testimony to the pre- • Curiosity and a persistent desire to know more and contact, contact and post-contact phases. This is the least question thoroughly. durable type of evidence as peoples memories fade quickly • To be observant and having an eye for detail in with time and can become increasingly unreliable. However detecting the unusual, out of place, etc. where evidence of the other parts has been previously • Imagination to see alternative states or conditions and collected, the People evidence becomes more in the nature compare with the actual that can then stimulate the of corroboration. Interviews should still be conducted soon search for better evidence. after the incident. • Humility to consider and recognise the experience, ideas and observations of others. Initiating the Investigation • Intuition to recognise valid ideas that emerge from the The first step in the investigation and analysis process is collected data and to recognise a simple solution to a to decide on its extent, i.e., intensity, formality, timescale, complex problem. reporting levels, etc. In order to maximise the organisations • Tact and patience in revealing and using critical and opportunity to learn, near misses with high potential sensitive information. severity and consequences should also be investigated, and Investigative skills in examination of parts, photography, as thoroughly as those where harm did actually occur. mapping and recording, etc are important but generally secondary to the above qualities. This classification of incidents is normally based on: Timing A. The actual severity level of harm caused and/or An investigation should be carried out as soon as possible B. The potential harm that could have resulted from the after an incident. The quality of evidence will deteriorate incident and the likelihood of it happening. 38 Tripod Beta User Guide "Near misses" are classified, using a risk matrix, as "High". • Records of instructions / briefings given on the "Medium" and "Low Risk" Incidents. Actual incidents are particular event or job being investigated; based on a categorisation of severity levels of harm. • Location plans; • Organisation chart; and From the classification of the incident the Investigation • Product information. team leader is appointed. The higher the severity, (or risk for "near misses"), of the incident, the more senior the team Fact Finding leader is likely to be. Evidence gathering Plan Investigation Team members are then appointed. The process of gathering information and evidence involves As the investigation proceeds it may be necessary to change the following steps: team members or co-opt specialists for specific inputs and advice. 1. Collecting physical evidence (identifying, documenting, inspecting and preserving relevant Terms of reference for the incident investigation and analysis material) are issued which, for example, include: 2. Collecting documentary evidence 3. Collecting human evidence (locating and interviewing • A clear understanding of the current situation; witnesses) • The roles, requirements and accountabilities of all 4. Examining organisational concerns, management team members; systems and line management oversight • The scope of the investigation and its boundaries; • A clear understanding of the deliverables and key Initial Actions and Observations milestones, e.g., start, interim report, final report; The conduct of the investigation follows a number steps • The requirements to validate findings; beginning with the initial actions and observations and • The final report format; and then followed by the detailed examination and recording • The need for actions on failed and missing barriers and of evidence. also those to correct underlying causes. The investigator should not overlook concern for own Pre-Investigation Planning safety and that of others in the haste to respond. Determine Due to the fragility of site evidence planning for on-site priorities as early as possible on entering the scene, however, readiness ensures a well coordinated and rapid response do not approach until it is safe to do so. to incidents. A standard "ready to go" list of equipment required to conduct investigations of different types of Decide on priorities such as, controlling site access or seeking incident would be useful. more assistance. Emergency services may have necessarily interfered with the scene in the removal of injured or other Such items could include for example; camera, first aid, parts and in order to bring the situation under immediate clipboard, audio recorder, graph paper, recording forms, control, prior to your arrival. This is an example of the tape measure, barrier tape, sample containers and evidence fragility of evidence. bags, identification tags, mirror, torch, etc. Protective equipment to meet universal precautions in the handling or The scene may well be confused particularly if a spectacular contact with human body fluids is also essential. event has occurred. Site evidence is the most transitory and disappears first. Witnesses may be lost in a crowd or leave Before visiting the incident location, appropriate background the site. Items and materials may be removed. information should be obtained and could include: Much of the site evidence is short-lived hence it is important • Procedures and standards for the type of operation to act quickly to collect it. Rough sketches and photographs involved; and careful visual observation will be vital in later • Risk assessments related to the incident; reconstruction. 39 Tripod Beta User Guide The initial identification should include: planning and individual responsibilities. The investigation could establish the extent to which these procedures and • the people involved (injured and witnesses); instructions were understood and acted upon as this could • equipment and tools involved (in use, on stand-by and indicate the effectiveness of training and supervision. secured or standing); • materials (in use, ready for use and stored in the area); The role and functions of management systems must • environmental factors (weather, lighting levels, heat, be considered when collecting and reviewing evidence. noise). These can be used to develop questions that will guide evidence collection and analysis of the management system Recording the Incident Scene (Position) at all levels. Important facts can be gained from observations made at the scene of the incident, particularly if the location is kept Documentation is a vital source of evidence in examining is undisturbed. However, rescue operations or the presence and comparing the 'actual' and 'expected' performance of of residual hazards may necessitate moving some of the systems and people. Documentary evidence may exist in a equipment, but, if possible, the site should be kept "as is" variety of forms and locations as indicated below. until at least a preliminary investigation has taken place. • Automatic recording devices; voice recordings, work Photographs, both colour still and video as appropriate, instructions, should be taken to record the physical relationships, e.g. • Management policies between people, tools, and equipment involved in the • Procedures and standards incident. The position of valves, switches, recorders etc, • Risk assessments and studies should be recorded. • Purchasing documents • Maintenance routines and records Sketches should be made and include any reference • Personnel records measurements of distances, angles, locations. • Related incident reports • Work assignment and instructions, electronic and Physical Evidence ( Parts) paper. This phase begins after the more fragile evidence of positions • As-built drawings is recorded. Physical evidence includes the condition of • Inspection records such items as; tools, equipment; materials; hardware, plant • Audit reports facilities; scattered debris, liquids and possibly gases, etc. • Log books • Tachograph records Normally physical evidence should not be removed until witnesses have been interviewed, as visual reference can As with the collection of "parts" data, it is important to stimulate their memory. determine how the documentation relates to improving understanding of the incident process. The investigator Items need to be systematically labelled, collected, protected, need not be an expert in the aspect under study however the preserved, evaluated and recorded. required knowledge can be obtained from the appropriate personnel and system specifications. A log should be kept of location, date, time and description of evidence and controlled by signature transfer i.e. a chain In many cases the identification of relevant documentary of custody. records becomes evident as a result of the iterative process of evidence collection and analysis. Documentary Evidence (Papers) Documentation is the least susceptible type of evidence to A factor to consider during an investigation is recent change. loss, distortion or compromise, and may provide information It has often been found that some change occurred prior to an relevant to the investigation. For example, written incident which, combining with other causal factors already instructions and procedures may provide evidence of pre- present, served to initiate the incident. Changes in personnel, 40 Tripod Beta User Guide organisation, procedures, processes and equipments should The Interviewer be investigated, particularly the hand-over of control and Witnesses are greatly influenced by the personality instructions, and the communication of information about and mannerisms of the interviewer. Many have had the change to those who needed to know. uncomfortable experiences with higher level managers and staff officials and distrust their motives. Conducting Interviews (People) The interviewer should present a neat, neutral appearance. Introduction He should be relaxed, receptive, objective and adaptable, Following the collection of the positions, parts and papers listening to what the witness says. He should make the evidence, interviews with witnesses should be carried out as witness feel that he wants to talk with him and time is not soon as possible after the incident. Whilst the intervening a factor. time and discussions with others can influence a person's recollection of events, the interviewer's knowledge of the Attributes of the Interviewer evidence from the other 3 P's can beneficially influence the Positive Interviewer attributes include: outcome of the interview. A. Respect which is communicated through a caring The value of a witness's input can be greatly influenced by manner and taking an interest in the interviewee. Using the style of the interviewer whose main task is to listen to the appropriate tone of voice, inquiring after their comfort witness's story and not to influence it by making comments and wellbeing communicates respect and value. or asking leading questions. This requires patience and understanding. B. Empathy by the interviewer putting himself in the interviewee's shoes and recognising how they may be An investigation team is often seen in a prosecuting role, feeling etc. and witnesses may be reluctant to talk freely if they think they may incriminate themselves or colleagues. C. Genuineness, i.e. being honest and open with the interviewee An investigator is not in a position to give immunity in return for information but must try to convince interviewees of D. Relaxed manner and approach which can help put the purpose of the investigation and the need for frankness. the interview at ease. It should be stressed that the investigation is not seeking to apportion blame but is attempting to understand the E. Receptive listener which involves an appropriate mix reasons for the failures which caused the incident so that of nonverbal signals (nodding, facial expressions, they can be corrected and future such incidents prevented. leaning forward etc) that visually display interest as well as the verbal skills of questioning and It is important for the interviewer to have terms of reference paraphrasing to check for understanding. regarding his role and responsibilities. These should be formulated by the body overseeing the investigation. F) Objectivity which requires the interviewer to be aware of any prejudice, presumptions or bias that From a Tripod Beta perspective, the investigator is could interfere with their listening. establishing the exact nature of the Immediate Causes that resulted in failed barriers, the human errors which caused G) Adaptability, i.e. flexibility to adapt to changed the sub-standard acts and the 'influencing' conditions that arrangements, modified schedules and shifting promoted the human errors. Once these influencing factors observations of what happened. have been identified, the emphasis of the investigation moves to interviewing those associated with the underlying H. Preparedness to be clear on the information being causes and the weaknesses in the management system which sought and in a systematic manner rather than in an created them. ad-hoc' or 'take it as it comes' approach. 41 Tripod Beta User Guide Negative Interviewer attributes include: The Interviewee Interviewees can be identified as : A. The commanding type interviewer may frighten the interviewee into silence by his officious manner and generally • Principal witnesses - persons actually involved in the interrogates rather than interviews. This mannerism may incident, also induce a witness to forget detail or feel pressed to give • Eyewitnesses - persons who directly observed the some information when he really has no certain facts or incident or the conditions immediately preceding or knowledge. following the incident, • General witnesses - those with knowledge about the B. The proud, overly confident interviewer overestimates activities prior to or immediately after the incident. their personal ability to obtain information. Consequently, they accept the first statements on any aspect as complete Attributes of an Interviewee and factual because they believe they would instantly People do not fall into neat, constant categories but may recognise any erroneous or incomplete information. have some aspects of each under differing circumstances during the interview. The following distinctions of possible C. The overly-eager interviewer induces errors and character types may be useful for an interviewer to observe contradictions in evidence through tendencies toward the interviewee through; however, they must be 'held loosely' excessive questions, and/or leading questions. Their anxious so as to not fall into the trap of 'pigeon holing people'. manner usually results from being eager to get to analysis and conclusions. Extrovert The extrovert can be a very convincing interviewee. They D. The timid interviewer appears to the interviewee as can be positive in their responses, adamant about their willing to grab the least bit of information and run. Their observations, conclusions and suggestions. They can be manner raises doubts in the interviewee as to whether delighted to have the attention brought to them by virtue producing information will serve any useful purpose, so the of their witness. Their evidence may not be as correct as it interviewee may respond with superficial comment. appears. E. The prejudicial interviewer reacts to aspects of the Introvert interviewees dress and mannerisms. They tend to stereotype The introvert can appear to seemingly be a poor interviewee. the interviewee at first contact and hear only what they They may be unsure of facts and indecisive in responses. expect to hear. They may also impart resentment over the Interviewing them may seem a waste of time but they might incident that has taken them from important work and have the most important information. involved him in investigation. Suspicion Conflicts of Interest The suspicious interviewee may be reluctant to get involved. Conflict of interest may exist where the interviewer realises They tend to hate publicity and may overly guard their that they are not able to be independent/objective because privacy and resent being questioned. They probably will of some past or present commitment to the organisation, decline to give a written statement. They may question the branch involved, the section or an individual involved the use of information, the possibility of appearing before in the incident. company executives and the value of investigations etc. They may tend to discourage the interviewer before they The primary obligation is to collect the evidence for the reveal the information they possess. team in an objective manner. Where any member of a team assesses that they cannot operate objectively, because of Illiterate some past or present relationship, (positive or negative), they The illiterate interviewee presents a delicate situation. They should discuss this with the Team Leader immediately. may appear timid and hesitant, to cover the illiteracy, or decline to give a statement for this reason. If their command of language is limited, they may feign lack of knowledge of 42 Tripod Beta User Guide the incident to cover there fear of shame should they make Assessing personal state errors in grammar or expression. It will need compassion Given the possible impact on personal state it is important and patience to draw out the testimony. for the Interviewer to be observant both visually and in their listening for indications of physical, emotional and/or Prejudice mental symptoms. Any assessment of such symptoms will The prejudiced interviewee is ill suited to give testimony. Even be done through the 3 components of a message: when honest and not personally involved, they may believe the company, the government, a supervisor or another worker Word content who they are prejudiced against is always wrong. They may Listening to the actual language/words used that may in make corresponding assumptions and conclusions that blind indicate emotional or mental issues. their observations and distort the testimony. Vocal content Such behaviour may be identified by allegations like "I tried Listening to the tone, emphasis, volume, intonation etc that to tell 'them' but nobody ever listens to me" or that "he/she may indicate emotional or mental issues. never does anything right." The interviewer can't ignore the prejudiced testimony but will have difficulty determining Non-verbal content how much of it is valid. Watching for body language that would indicate any physical, emotional or mental issues. Excitable The excitable interviewee tends to exaggerate, elaborate Interview Preparation and distort evidence. Witnessing the incident is the most exciting thing that has happened to them so they tend to Requirements provide information in volume. They tend to be basically Interviewing is about confirming the physical evidence so it honest but stretch facts and embellish what they recall to fill is necessary to identify. knowledge gaps to overflowing. • What is being looked for to confirm or refine the Reticent developing incident model. The reticent or 'know-nothing' interviewee is the one • Who needs to be interviewed to gather the identified as a prime witness who insists they do not know information. and did not see anything. Allocation of Interviewers Hostile or Devious Interviewers should be matched to interviewees on the basis The devious interviewee may distort their testimony to of the abilities and experience of the team members. For avoid personal implication or unfavourable reflection on an example, if an Engineer is to be interviewed and there is an associate. They may also alter their evidence in an attempt Engineer on the team it may be best to link then together. to divert an interviewer from an area where a malpractice unrelated to the incident may have occurred. The hostile Allot time, dates and locations interviewee may hold back to avoid implication. An interviewee must be comfortable and at ease and, if an interview at the incident scene is not practical or is Impact on personal state undesirable, it is preferable to conduct the interview in a Following a stressful incident in the workplace it is common neutral or unthreatening location. for those involved, both directly and indirectly, to experience some physical, emotional and/or mental symptoms. These The executive offices, or even the supervisor's office, are not may include physically shaking, disturbed sleep, vivid neutral grounds to most interviewees. A small classroom, memories or flashbacks, strong emotions including agitation, waiting room, or library room will be more satisfactory sadness (tearful), anger, or just feeling flat. It is NORMAL and productive for interviews. Privacy is essential and to have these sorts of reactions and the interviewee can be the first interview should be a single interviewer to single provided with suggestions to help cope. interviewee discussion with a designated note-taker sitting a 43 Tripod Beta User Guide short distance from the interview. (See below; Recording the B. What happened questions? Interview.) Research has shown this to be the best approach, Interviewers should avoid using the question 'why' as leading to most accurate testimony. its constant use makes the interviewee feel as if they are being grilled. An alternative is to use 'how' or 'because' as Conducting the Interview follows: Introduction A friendly, understanding, and compassionate manner in a • Why are you finding it difficult at work? = How is it respectful and relaxed atmosphere can put the interviewee difficult at work for you? at ease. Politeness and patience are critical as first contact • Why did you do that? = You did that because? is made. Setting the scene The interviewer will be clear about the information to be The interviewer should explain the nature of the collected and should commence with the open question investigation by telling the interviewee what the 'What happened?". interviewer's position is and why the incident is being investigated. Also, the interviewee should be informed It is important to ask 'what happened' rather than 'why' that the purpose of the interview is to identify problems because asking 'why things happened' tends to inadvertently and not apportion blame. They should also be told that push the interviewee to 'interpretation/assessment/story/ they will have the opportunity to review the draft report assumption' rather than staying with the actual observations before it is published. of the event. Questioning C. Control questions A. Open and closed questions: During the interview, the interviewer should introduce Closed questions are those that can only be answered by 'control' questions to ensure accuracy of statistical data 'yes' or 'no'. as well as permit subsequent evaluation of the reliability of information supplied by the interviewee. The control This type of questioning is useful for obtaining or establishing questions should include those to ascertain for example. definite facts, e.g. Did you see this happen? - Yes - Was it dark outside? - No • Time and location of the incident, • Environment: - weather, lighting, temperature, noise, The closed question can also be used to guide or direct distractions, concealment. Include pre-incident, the conversation in a particular direction as follows: Was incident and post incident periods by specific question , the operator wearing PPE? This question has allowed the • Positions of people, equipment, material and interviewer to direct the conversation to the topic of PPE. If their relationships to pre-incident, incident and the interviewee answers 'yes' the interviewer would follow post incident events. Include the position of the with the open question 'what PPE was being worn?' interviewee. Open questions are those aimed at exploring another D. Statements rather than questions person's thoughts, ideas and observations. They are asked to Too many questions can make a person feel grilled and gather information and use the key words of: using statements can provide some respite as follows: • When did you start to see that happening? • 'So, your friend was badly hurt - I can imagine that • Where were you standing at the time? might have triggered off some strong emotions for you' • What was he saying when that occurred? • 'I understand that the concern about the boiler was • How did you contact the supervisor? raised at a recent safety meeting' 44 Tripod Beta User Guide Clarification could cause their recollection of events to become disjointed During an interview the interviewer may be confused or with vital points forgotten as a consequence. uncertain about what the interviewee is saying, and it is important to gain clarification. It can be useful to have a designated note-taker sitting a short distance from the interview. This allows the interviewer A way to seek clarification is to paraphrase what it was to focus on the interviewing task and also provides a thought the interviewee said. This involves reflecting back corroborative party. to the interviewee what they have just said but in the words of the interviewer. This serves three important purposes. Concluding the Interview The question, "Is there anything we missed or is there • It lets the interviewee know that the interviewer has something you want to share with us?" Should be asked. been listening. This may bring out an issue that has not been covered in • It allows the interviewer to check the accuracy of the the interview or give the person being interviewed the listening. opportunity to go back to a question that, on reflection, • It allows the interviewee to hear what they have feels was not adequately answered or that the answer may been thinking from another person who can give have been misunderstood. perspective on the issue and help them clarify if this is really what they think or not. Also, questioning the interviewee for suggestions on prevention of the incident is a good method to close the Alternatively the interviewer could simply ask the interviewee interview after other questioning has been exhausted. It to repeat their point as follows, e.g. is an area best left until the end of the interview because it asks the interviewee to draw conclusions, including 'I'm not sure I followed what you just said. Could you go inferences and giving opinions, thus changing the tone of over that again?' the interview from the fact-finding exercise. Non Verbal Communication The question has several values. The credibility of an interviewee may be assessed through the window of 'non-verbal language' or 'body language'. • It stimulates the individual to think incident / loss Considerable research is now available and various prevention. connections have been made to suggest what various gestures • It provides a reservoir of ideas for the interviewer to may be communicating. This subject is beyond the scope of draw from in his corrective action plan. this manual but further reading on it should be undertaken • It may lead the interviewer to an area of management to enable more effective interviews to be undertaken. deficiency the interviewee was deliberately avoiding for fear of repercussions. Recording the Interview • It reaffirms the purpose of the interview in the mind The interviewer cannot and should not rely on his memory of the witness and will promote further co-operation. of information provided by the interviewee. Asking permission or stating that notes will be taken should be Interviews should always be ended with thanks for the explained up front. interviewee's time and co-operation, plus an invitation to contact the interviewer should they remember any other Notes will help the interviewer keep the interview organised observations about the incident. and provide an accurate record for review for analysis. The interviewer can promote additional co-operation Note taking should be unobtrusive so it is not distracting by specifically mentioning some facts or suggestions the to the mental train of the interviewee. They should record interviewee has given that appear to be of particular value. essential points of evidence, but neither verbatim nor so This communicates that the interviewer was interested and extensive that the natural pace and flow of the interview really took note of what the interviewee had said. is affected. Forcing an unnatural pace on the interviewee 45 Tripod Beta User Guide Additional Interviews Agent-Object-Event Trios After the interview the findings should be reviewed and The Tripod Beta methodology links AOE trios to describe checked with the investigation team to see that all items have the sequence of events before and after the main event in an been addressed and all questions answered. The information incident. The Tripod Beta software records the date/time of gained should corroborate the physical evidence. these events and so establishes the sequence of events of an incident. As Tripod Beta methodology is an iterative process between investigation and analysis, further interviews are likely, e.g. Specialist Support Studies to find further information or resolve points of conflict in Incidents of a technical or complex nature often require the evidence. specialist input and further studies to determine the causes of failures. Establishing the Sequence of Events Being able to state the location of people, equipment Major outbreaks of disease, aircraft crashes, crane failures, and materials as an incident unfolds, assists with cross plant explosions, IT system crashes, are examples of such validation of evidence and identification of gaps. It is incidents where specialist advice will probably be required. important to recognise that gaps are often inevitable due to This should be rapidly identified and the specialists involved the retrospective nature of the investigative process but the early in the investigation. absence of data at certain points should not be allowed to delay the investigation. Specialist disciplines available depend on the factor under study, for example; occupational hygienists; ergonomists; A number of techniques are available to help the investigators chemists; physicists; engineers, accountants, doctors, etc. to make sense of the data gathered, e.g. Timeline; Sequentially Timed Event Plot (STEP); Tripod Beta Agent- A wide variety of sophisticated techniques are available Object-Event trios; for the detection and analysis of substances and materials. Commercial laboratories and universities are potential Timeline sources of technical support for undertaking the detection This is simply a list of events in chronological order and is and analysis of substances and materials. useful in that it can be readily compiled. However, it does have a limitation of not providing visibility of the spatial Evidence Development relationships involved. The following provide a range of techniques for guiding the detailed collection and development of the evidence. This Sequentially Timed Event Plot (STEP) can provide further insight into the process, fill gaps in the A STEP is a means of assembling the facts obtained in a data and reveal areas for further investigation. structured manner. It identifies the actions and events of key "actors" in the incident and plots them against time. The ultimate purpose of these different approaches is to gain The "actors" can be people, vehicles, items of equipment, a clear understanding of the incident mechanism, failed/ equipment parameters, etc. The scale of the time axis is missing barriers, and the event sequence, and thus provide normally not linear but varies to suit the interval between further input to the Tripod Beta analysis. events. Each event is described in terms of date/time, actor, and action. A. Re-enactment is a last resort technique due to the real risk of recurrence. It should be used only when: A STEP diagram is often helpful in the first attempt at constructing the AEO trios in a Tripod Beta tree. i. There is no alternative way of gaining the information, ii. It is necessary to observe first hand the step-by-step An example of a STEP Diagram is shown in on the process, next page. iii. It is essential to verify key facts, or resolve conflicts in testimony. 46 Tripod Beta User Guide The person involved in the incident demonstrates the actions Resolving Conflicts taken leading up to the event. (It may be helpful to have an It is not unusual for witnesses to give differing accounts of expert in the process as an observer.) In the first run the an incident. Human memory can be unreliable and, even motions are acted out and explained step-by-step without if not motivated by self protection, or other subjective moving any controls, parts or materials. arguments, one person's recollection of an incident can differ from another person's in important details. After the process is understood each step is repeated in slow motion but only with approval before moving any Faced with conflicting witness statements, investigators components or barriers. The last step prior to the incident should look for the similarities between the statements and must not be repeated. commonality with other evidence. The objective is to use the evidence to understand the incident and not prove the B. Reconstruction is an advanced technique which uses accuracy of individual statements, nor apportion blame. models to analyse the events of the incident. These can be examined for characteristics of failure modes and effects, This is best dealt with by having access to evidence of sequences of contact and energy transfer. Positions, Parts and Papers before the interviews are conducted. The reconstruction technique may involve reassembly and repositioning of damaged parts, sometimes using scaffolding, moulds or props. Scars, marks and impact points can be matched to assess points and intensities of impacts. Reconstructed models also enable tests of different incident scenarios to be carried out. 47 Tripod Beta User Guide Annex 10: Previously used terminology Current Term Previously used Term Agent of Change Hazard Tripod Beta was initially used to analyse Health, Safety and Environmental incidents in the Oil and Gas Industry. Barrier Control and Defence However, some of the terms used caused confusion when Tripod Beta was used to analyse incidents other than HSE, Basic Risk Factors General Failure Types (GFTs) e.g. business interruptions in general, and also in industries Core Diagram Core Diagram outside the Oil and Gas industry. Accordingly some terms have been changed accordingly as shown below. Effective Barrier Effective Control/ Defence Errors Errors Event Event Failed Barrier Failed Control/ Defence Immediate Cause Active Failure Incident Incident Inadequate Barrier Inadequate Control/Defence Lapse Lapse Missing Barrier Missing Control/Defence Object Target Pre- Condition Pre-Condition Slip Slip Sub-Standard Act Unsafe act Sub-Standard Condition Technical failure Trios Trios Tripod Beta Practitioner Tripod Beta Facilitator Tripod Beta Tree Tripod Beta Tree Underlying Cause Latent Failure 48 Tripod Beta User Guide Annex 11: Consequences for individuals Categories of acts A model is available that provides categories into which an Behaviour has consequences act or behaviour can be placed, and guidance on the kind When things go wrong, many analyses do not go far enough. of consequences for each category. When using the model, They seek to identify the error or rule violation that was "the leaders need to exercise judgment both in selecting the cause". But this is seldom the entire issue; human error or category into which a particular act or behaviour fits best, and rule violation is almost always a symptom or manifestation also in deciding the specific consequences to apply. The full rather than any type of "underlying cause". The real model is available from the "Hearts and Minds "programme underlying causes of an incident also need to be revealed in located at http://www.energyinst.org.uk/heartsandminds/. order to improve the management system. Correcting these This annex provides a summarized version which only underlying causes will always prevent many more incidents highlights some possible reasonable consequences to correct than just concentrating on the immediate or direct causes. identified human errors and violations. When an individual makes a wrong decision, or forgets to Disciplinary measures must only be carried out by do some important task, there may be contributory factors line managers in consultation with Human Resource such as a confusing procedure, inadequate supervision or professionals. The model should NOT be used until the distractions (e.g. noise, interruptions). Such 'system' factors incident analysis is completed and the underlying systemic should always be sought and eliminated as far as practicable. causes are understood. The incident analysis must identify However, if an individual has not been trained properly, or the type of error or violation, determine if the undesired has not developed the good practices necessary to perform action is 'routine' or not, and the motivation behind the the task safely, then coaching to improve their competence action (did it benefit the individual or the organisation?). or develop more appropriate working practices should be the norm. The diagram below helps to classify the action. If the error or violation is 'routine' then supervisors and managers further If someone behaves recklessly or breaks a sound and up the line may also not be meeting their responsibilities. well-known rule to gain some personal advantage, then it is They may not be creating a working environment where reasonable that they should recieve appropriate consequences. clear standards are set and where it is ensured that rules However, if someone makes an error, or breaks a rule they and procedures are fit for purpose, capable of being adhered were unaware of, simply blaming the individual is unjust, to and actually followed. If so, then these supervisors and unfair and fails to address the underlying organizational their managers should have this consequence management weaknesses that could continue to contribute to other framework applied to them, as well as to the individual who incidents. Similarly this applies to rules routinely broken, made the error or violated the rule. without comment from the supervisor, or that were plainly impossible to follow and still get the job done. Consequences of acts The tables which follow provide a summary of possible Further, it may be that a person is not suited to a particular consequences for errors and violations. (see next page) type of work, or may become so, even temporarily, due to health or other reasons. In such cases, their fitness to work should be assessed - a change to a different type of work could be considered. 49 Tripod Beta User Guide Human error and violation decision flowchart 50 Tripod Beta User Guide Special recognition or disciplinary measures must only be carried out after consultation with local HR who are the custodians of local policy, practice, consistency, fairness and due process. Behaviour Description of Behaviour Consequences for the Individual Consequences for the Managers of the individual Human Error Human error is a part of life that can rarely be eliminated entirely. Disciplinary actions in line with local practices and guidelines are usually not appropriate when slips, lapses or mistakes have been made, but many things can be done to prevent their (re-)occurrence. Slips and Lapses Actions that did not proceed Coaching on how to spot errors, Coaching in Error Management. as planned e.g. something was what influences the occurrence done twice, the wrong way or a of slips and lapses and the step is forgotten. importance of reporting them to aid detection of trends and underlying causes. Mistake Mistakes are actions that Competence development/ Coaching in Error Management and proceed as planned but do coaching. Competence Management. not achieve their desired end. (Incorrect decision or inadequate plan). Routine Error It is not the first time that this Whole team to receive coaching Coaching in Error Management and Same errors by type of error or mistake has on how to spot errors, what Competence Management. different people happened. influences the occurrence of slips Performance appraisal affected for and lapses and the importance of not addressing clear problems in own reporting them to aid detection of area. trends and underlying causes. Routine Error It is not the first time that Assessment of fitness to work Coaching on Fitness To Work. A personal history this type of error or mistake (abilities and suitability for this of errors – when the has been made by this person. type of job). If appropriate, same errors are not Other people in similar competence development and made by others in situations do not make this coaching, if not consider assigning similar situations error. alternative more appropriate type of work. Unintended A rule or procedure violated Competence development/ Coaching on how to ensure Violation because people were not coaching. procedures are correct, available, and aware of the rule or did not understood. understand it. Situational A job cannot be done if the Coaching on the need to speak-up Coaching on Managing Rule Violation rules are followed. Instead when rules cannot be followed and Breaking. of stopping the job it is done to stop the job until it can be done If this type of situation has occurred anyway and the rule is violated. safely. before performance appraisal is affected for not demonstrating Mild disciplinary action in line commitment to with local practices and guidelines. rule compliance. Organisational The person committing the Coaching on the need to speak-up Performance appraisal is affected Optimising violation thought it was when rules cannot be followed and Coaching on Managing Rule violation better for the company to to stop the job until it can be done Breaking. Optimising for do it that way. The violation safely. If this type of violation has occurred company benefit was committed to improve before there should be formal performance or to please the Mild disciplinary action in line discipline for reckless supervision in supervisor. with local practices and guidelines. creating a culture that encourages this behaviour. 51 Tripod Beta User Guide Special recognition or disciplinary measures must only be carried out after consultation with local HR who are the custodians of local policy, practice, consistency, fairness and due process. Behaviour Description of Behaviour Consequences for the Individual Consequences for the Managers of the individual Personal The person thought it was Formal discipline. Performance appraisal is affected for Optimising better for them personally to do If this has happened before, then not becoming informed about clear Violation it that way e.g. getting a longer formal warning process should be problems Optimising for work break, easier way of doing followed. in own area. personal benefit the job, doing Consider anonymous publication Coaching in using Managing Rule it faster, etc.) of the violation and its Breaking together with team. consequences for worker and their If this type of situation has occurred managers. before performance appraisal is affected for condoning violation or not taking action. The reason for condoning this behaviour should be investigated; the model and flowchart will help determine whether the manager's behaviour was itself an error or violation. Reckless Violation The person committing the Suspension of the activity pending Coaching in how to recognise and deal violation did not think or care further investigation. with such behaviour earlier. about the consequences. Gross Depending on the outcome of the Negligence can be considered a investigation a formal warning or part of this type of violation. other disciplinary action in line with local practices and guidelines. Routine Violation Other people would have Whole team to receive coaching in Performance appraisal may be affected Everybody does it done or do it the same way. using Managing Rule Breaking for not becoming informed about clear like that Checking for this type of problems in own area. violation can be done by using Coaching in Managing Rule Breaking the 'substitution test'. together with team. Substitution Test: Would If this type of situation has occurred a significant proportion of before performance appraisal is individuals with the same affected for condoning violation or not training and experience have taking action. acted in the same way under the same circumstances? Routine Violation The individual has a history Formal disciplinary action in line Coaching in how to recognise A personal history of violation, disregard for the with local practices and guidelines. individual violators. of violations rules and procedures in general, Performance appraisal is affected if it is not just frequent violation of found that violating is condoned or no the rules under investigation. action taken. If there are many routine violations of this type the reason for condoning this behaviour should be investigated, the model and flowchart will help determine whether the manager's behaviour was an error or violation. 52 Tripod Beta User Guide References 1. Groeneweg, J. Controlling the Controllable. More information on Tripod Beta training and Preventing business upsets. Fifth revised edition accreditation and the other Tripod tools like the proactive Global Safety Group Publications, Leiden, 2002. Tripod Delta, the occupational health related Tripod Sigma and the investigation tool Track can be found on 2. Reason, J.T. Human error. Cambridge University www.tripodsolutions.net Press, 1990. 3. Wagenaar,W.A., Groeneweg, J., Hudson, P.T.W. and Reason, J.T. Promoting safety in the oil industry. Ergonomics, Vol. 37, 12, 1994. 4. Papers presented at SPE International Conferences for Health, Safety and Environment in Oil and Gas Exploration and Production: SPE 23293 (1991), SPE 35971 (1996), and SPE 46659 (1998) by authors P.T.W. Hudson, J.A. Doran, A.D. Gower-Jones and G.C. van der Graaf UNRESTRICTED ECCN: Not subject to EAR – No US content Copyright Stichting Tripod Foundation P05334 rev4 – October 2008 53 Tripod Beta User Guide