Course Tab

During the 1980’s and 1990’s Shell funded research by Leiden and Manchester Universities. The work done by the late prof. Willem Waggenaar and prof James Reason led to the development of:

  • The Swiss Cheese Model,
  • Bow Tie diagrams,
  • Hearts and Minds tool kit
  • Tripod Delta, and
  • Tripod Beta.


They are all based on the same underlying principles, and together, provide a comprehensive, cohesive suite of tools.

Tripod Beta has been validated in a wide range of industries and has been in use for more than 25 years.

Shell’s life saving rules, which were derived from the analysis of many Tripod Beta investigations, have been adopted by many organisations.

In 1998, Shell transferred the copyright of the Tripod Beta methodology to the Stichting Tripod Foundation (STF), a charitable body governed by Dutch law.

The Foundation's purpose is to promote best practice in the understanding and prevention of incidents through the use of Tripod Beta.

In 2012 the Foundation partnered with the Energy Institute in the UK to help achieve this.


The Stichting Tripod Foundation accredits:

  • training courses,
  • exams,
  • trainers,
  • practitioners,
  • assessors.


Since 1998 the Tripod Beta community has further developed:

  • the process,
  • the software,
  • the training material.


Many companies in many industries are now following Shell’s lead and using Tripod Beta to learn from incidents.


Oh – and about the name Tripod Beta - one of the early accident causation diagrams had three corners, which led to the name Tripod – named by Jop Groeneweg after a Gabonese three-legged dog that he saw on a field trip.

Tripod Beta analysis explained

  • Corporate objectives are achieved by controlling the business.
  • Theses objectives might be related to: production, quality, return on investment, impact on the environment, safety, health etc.
  • One aspect of achieving these objectives will be to avoid unwanted events.
  • Unwanted events are avoided by controlling the hazards that cause the harm and/or defending the things that could be harmed.
  • If an unwanted event does occur then it is logical to assume that there is something wrong with the controls.
  • These controls are identified, implemented and maintained by the Company's mangement systems.
  • Tripod Beta is designed to reveal the controls that are: missing, inadequate or failed.
  • Tripod Beta also provides a control framework for managing the investigation so that the work will be: efficient, systematic, thorough, repeatable (i.e. two teams investigating the same incident will arrive at the same findings).
  • The following diagrams show the steps involved:

Fig 1. Tripod Beta - end event.

Guidelines for describing the final event EPEX

  • It is usual to start with the end event and work back.
  • The end event is the reason for the investigation.

Fig 2. Tripod Beta - timeline

  • Show time running from left to right.
  • Show the events that led directly to the incident.

Describing a sequence events prior to compiling Tripod Beta core trios EPEX
Fig 3. Tripod Beta - trios.

  • Split each event into what was harmed and what did the harming.
  • This diagram is similar to a horizontal cause v effect diagram.
  • Not all the events from figure 2 have been shown.
  • Event "ladder tilts and throws painter off balance" has been split into two events "ladder tilts ...." and "painter falls ....."
  • Splitting events promotes a better understanding of the incident.
  • Work with detailed trees in the early stage of the investigation.
  • Trees can be expanded and collapsed to aid the investigation team and report reader.

Sequence of Tripod Beta core trios showing direct cause of accident EPEX
Fig 4. Tripod Beta - barrier analysis.

  • Each leg in the diagram is examined to see if there is a way in which this "path" could be blocked - i.e. with a barrier.
  • The barriers chosen should comply with "good practice".
  • Had anyone of the barriers been effective the end result would not have happened.

Barriers placed within sequence of Tripod Beta core trios EPEX
Fig 5. Tripod Beta – the immediate cause.

  • Examine each barrier in turn to determine how it was defeated.
  • Failed barriers are always defeated by a substandard act, never by an unsafe condition.
  • Identify the perpetrator of the substandard act; not to apportion blame but be able to move on to the next stage of the investigation 

Immediate cause of barrier failing within Tripod beta core trios EPEX
Fig 6. Tripod Beta - human behaviour model

  • Categorise the substandard act to narrow the search for preconditions (performance influencing factors).
  • In the example given the substandard act is 'painter stepped off ladder to one side and from second rung.
  • The ladder use guideline says 'step straight back from bottom rung'.
  • To properly understand why the painter did what he did it is important to consider the possibilities e.g. 1) he knew about the ladder use guideline but, in the heat of the moment, he forgot (lapse), or  2) he did not know about the ladder use guideline (knowledge based mistake), 3) he knew about the ladder use guideline, remembered what to do but chose not to do it (violation).
  • Investigation can go wrong at this point e.g. sending the painter on a ladder use course if it's a violation, or cautioning him if it was a genuine lapse of memory. 

Categories of human behaviour errors mistakes violations EPEX
Fig 7. Tripod Beta - preconditions

  • Preconditions - also known as "performance influencing factors" (PIFs) are the workplace conditions that led to the sub standard act.
  • It is important to know the perpetrator of the substandard act to positively associate the preconditions with the imediate causes. 
  • In this particular instance the painter was under pressure to compete the job before the rains came and furthermore he had never been told about the ladder use guidelines.
  • Note the line between the preconditions (blue box) and the immediate cause (grey box) is dotted.
  • This is to show that it is not a direct cause v effect relationship i.e. the painter will not always perform a substandard act if these two PIFs are present.
  • It is a Bayesian relationship i.e. the preconditions increase the likelihood of the substandard act. 

Preconditions or performance influencing factors leading to immediate cause in Tripod Beta diagram EPEX
Fig 8. Tripod Beta - flawed operational controls

  • Flawed operational controls (systems) cause the preconditions
  • Operational controls (systems) enable the workforce to produce goods or services; they also enable the workforce to install and maintain barriers preventing unwanted events.
  • Examples of operational controls are: permit to work procedures, management of change procedures, plant operating instructions, provision and use of workplace equipment policy etc.
  • Operational controls spell out what needs to be done and how to do it.
  • In this example we are saying that: 1) the task was not planned correctly i.e. whoever did the planning did not take into account the weather forecast, and 2) the ladder use guideline is failing in that the painter did not know about it.

Underlying cause, performance influencing factors, preconditions, immediate cause, failed barrier, Tripod Beta, accident causation path, EPEX
Fig 9. Tripod Beta - flawed management controls

  • Management controls equip and prepare the workforce to carry out the operational controls e.g. competence assurance scheme, document control, organisational arrangements (reporting relationships, roles and responsibilities), communication, provision of resources)
  • In this case the investigation team found that management controls are flawed in that: 1) supervisors choose to ignore the task planning process.
  • The problem here is that the custodian or owner of the task planning system is not seeking confirmation that it is being followed and not promoting adherence to the system.
  • And 2) the ladder use guideline is adequately defined but no one is seeking assurance that it is followed or promoting it's use.

Underlying cause, performance influencing factors, preconditions, immediate cause, failed barrier, Tripod Beta, accident causation path, EPEX

  • In the above example Tripod Beta would prompt the investigation team to seek out more preconditions i.e. is substandard performance rewarding in some way e.g. a bonus payment to finish on time, or is the desired performance punishing e.g. the supervisor complains if the job is not completed on time.
  • And, in the second precondition, was the job given to the right person.

Tripod Beta - underlying cause

  • Underlying causes should identify the system flawed AND the way in which it is flawed.
  • In the example the systems are: 1) task planning and 2) Ladder use guidelines.
  • In both cases in the example the system documente clearly state what needs to be done in the workplace.
  • But, do the documents clearly state how the system will be managed e.g. who will disseminate the requirements, who should audit the process, etc.

Tripod Beta - remedial actions

  • Actions should be taken about the failed barriers before operations are resumed - one accident is more than enough.
  • The aim is to maintain risks to "as low as reasonbly possible" so, in the short term, expensive temporary barriers may need to be implemented.
  • Actions should also be taken to remove the negative influences in the workplace i.e. preconditions.
  • However, unless the fundamental underlying causes are corrected, any actions taken to improve the preconditions will be short lived.
  • Dealing with underlying causes will bring about long lasting, far reaching improvements
  • Forget about taking actions at the immediate cause - they all sound like exhortations e.g. try harder, pay more attention, be more careful.
  • Identifying the root causes is often the easiest part in engineering improvements
  • There are two more things to be done: 1) deciding what to do about the flawed systems, and 2) doing it.

​The five steps in learning from accidents:

  1. WHAT happened i.e. what was the sequence of events leading directly to the accident?
  2. HOW did it happen i.e. what barriers should have prevented the incident but were either missing or failed?
  3. WHY did it happen i.e. why did the barriers fail?
  4. DECIDING what to do.
  5. DOING IT.

Tripod Beta will reveal the failed barriers and root causes

Tripod Beta, with it's clear cause v effect reasoning and graphical representation, will help in: 1) engaging with stakeholders in deciding what needs to be done, and 2) winning hearts and minds to do it.


  • Tripod Beta is a rigorous, systematic, and thorough process.
  • There are rules to be learnt so training will be required however, on the positive side, 1) the process can be audited, 2) a shallow investigation is easily spotted, and 3) two different investigators are likely to arrive at the same findings.
  • The visual representation of the analysis i.e. the Tripod Beta Tree, helps investigators to piece together the evidence in a way that: 1) aids understanding, 2) promotes insights, and 3) suggest lines for further enquiry. 
  • The process reduces time and effort in investigating and analysing incidents since the on-going analysis provides direction for the investigation
  • The graphical representation of the entire incident aids communication and improves understanding within the investigation team and with the report reader.
  • Investigator 3 produces concise and consistent incident reports.
  • Leads to improvements that are far reaching, and long lasting.
  • Produces reports that are robust to challenges since the process is scientifically founded and operationally proven.

How benefits achieved:

  • Concepts and terminology – are consistent with those used in proactive risk management hence the time it takes to become proficient in Tripod Beta is reduced. It also enables the findings from Tripod Beta to be easily linked to your risk management processes.
  • Human behaviour – Human errors of some kind cause the vast majority of incidents. Tripod Beta identifies these errors but these are seen as the start of finding the cause of the incident and not the end. 
  • Line of Enquiry – Tripod Beta’s, help features, and checklists focuses the investigator’s line of enquiry so that an investigation requires less time and is more thorough. Also, managers are more confident that remedial actions will be effective.
  • Reports – These are easy to read and understand and are compiled automatically by the Tripod Beta software. These reports include the graphical representation of the incident, (Tripod Beta Tree).  Managers, who may have to read several reports a month, find the consistent format and layout a big help.
  • Management Systems - Categorisation of Underlying Causes of incidents by elements of the management system, e.g. ISO 9001, ISO 14001, OHSAS 18001, aids identification of shortcomings in these systems and also those responsible for their remedial action.
  • Categorisation of all elements within the Tripod Beta tree:
    • Categorising underlying causes enables findings from many incidents to be combined so that remedial actions can be based on several incidents instead of one. 
    • Other nodes in the Tripod Beta tree can also be categorised enabling analysis of many incidents, e.g. trend analysis, comparative studies, evaluating past improvement initiatives thereby providing further learning and remedial actions.
    • Categorising nodes allows incident reports to be compared with other reports, e.g. audits, management reviews, inspections, unsafe act auditing etc. This enables cross validation of business processes and the consolidation of findings from many sources into a cohesive, overall improvement plan.
  • Minor & Major Incidents – The Tripod Beta concepts and principles are appropriate for both minor and major incidents so only one incident investigation process is required.
  • Neither James Reason or Willem Wagnaar (the two professors who led the research teams who were working on what came to be known as Tripod) coined the phrase “Swiss Cheese Model”
  • James Reason, in his book The Human Contribution, says, “I didn’t invent the label Swiss Cheese Model though I am eternally grateful to the person or people who did. I have two suspects for the role of inventor: Dr Rob Lee, then director of the bureau of Air Safety Investigation in Canberra, and Captain Dan Maurino, the human factors specialist at ICAO in Montreal.
  • The model evolved and it was only the later versions that took on the Swiss cheese appearance.
  • Figure 5 shows the Swiss Cheese Model within the Tripod Beta format


Figure 1 Evolution of the Swiss cheese model - the mid 1980's


Figure 2 Evolution of the Swiss cheese model - the late 1980s


Figure 3 Evolution of the Swiss cheese model - the early 1990's


Figure 4 Evolution of the Swiss cheese model – the late 1990's

  • This last version is shown on the front cover of “Managing the Risks of Organizational Accidents” and is the version that most accurately represents the Tripod Beta methodology.


Figure 5 Evolution of the Swiss cheese model - evolves into Tripod Beta

  • Figure 4 has evolved into a practical, root cause analyis tool.
  • This format enables a sequence of events to be shown as a string of trios.
  • The OBJECT is shown as a separate entity rather than assumed within the description of the losses.
  • This also enables a distinction to be made between barriers that control the AGENT OF CHANGE and barriers that defend the OBJECT.


Figure 6 How the Swiss cheese model aligns with Tripod Beta


  • The chain represents the barrier.
  • The barrier description explains what the chain does.
  • Each link in the chain is a safety critical activity that contributes to establishing and maintaining the barrier.
  • The number of links in the chain depends on the complexity of the barrier.
  • Links can represent something technical e.g. an alarm signal.
  • Links can also be behavioural e.g. operator stops pump on hearing alarm.
  • If one safety critical activity is sub standard then that particular link fails and the chain parts allowing the hazard trajectory to pass.
  • The immediate cause describes how a particular link in the chain failed.
  • There can be many underlying causes each one is shown by a hole
  • The UC that contributed to the incident under investigation are shown as square “windows of opportunity”.

The Stichting Tripod Foundation (STF) is a non profit making organisation registered in the Netherlands as a charity.

The STF was set-up by Shell International in 1998, to act as custodians of the Tripod methodology.

The Foundation’s objectives are to:

  1. develop and maintain the Tripod Intellectual Property;
  2. acquire, develop and maintain methods to promote safety;
  3. provide funds for Tripod research;
  4. provide funds for research into safety management;
  5. make available knowledge, experience and results of research to Tripod users, and
  6. liaise with other organisations worldwide with similar objectives.


In 2012, the Stichting Tripod Foundation partnered with the Energy Institute (EI) to help meet its objectives further.


Charity registration number: Kamer van Koophandel: 28080441,          BTW registration number: 808277753B01


The current board members are:

  • Sally Martin – Chairperson (Shell)
  • Tony Gower-Jones – Secretary (Centrica)
  • Willem Peuscher – Treasurer (Shell)
  • Prof Jop Groeneweg – Research and development (Leiden University)
  • Dr Robin Bryden – (Shell)
  • Razif  Mohd Yusoff- (Shell)
  • Des Hartford – (BC Hydro)
Learn From Incidents: Accreditation


The Stichting Tripod Foundation (STF) controls the quality of all aspects of Tripod.

They have an accreditation scheme for:

This diagram gives some indication of the incremental increase in knowledge and skill between each level.

Progressing from associate practitioner to practitioner does not involve acquiring a lot of new knowledge but it does need a big increase in skill i.e. practice and experience.

Tripod Beta is deceptive in that it appears to be a very simple process however; it takes a lot of practice to produce good reports.

All practitioner and trainer certification is done through the Energy Institute.

Learn From Incidents: Who should be accredited

Who should be accredited

Primarily those involved in accident investigation and analysis should become Accredited Tripod Practitioners. Your reports will be regarded as being more creditable if the person who has written them has been assessed by a respected, independent organisation.

And it provides a degree of assurance that the investigation and analysis has been done properly.

Learn From Incidents: The accreditation process

The accreditation process

To become an Accredited Practitioner you must be able to:

  1. demonstrate an understanding of the Tripod Beta methodology by gaining a pass mark in the knowledge assessment; normally taken at the end of an accredited training course and,
  2. achieve a pass grade with two of your own Tripod Beta incident investigation reports.

Immediately after the course your trainer will send your marked exam paper to the Energy institute who, in turn send an Associate Practitioner’s Certificates to successful candidates.

They will also explain the next step regarding submitting two accident investigation reports.

The whole process, from taking the exam to achieving practitioner accreditation, can take several months.

There is a fee, payable to the Energy Institute, to cover administration and the cost of having your two reports evaluated by an accredited assessor.

If a report does not meet the required standard, the assessor will provide an explanation on how the report needs to be improved.

The candidate can resubmit a revised report.

Vehicle rollover in remote desert region

Oil and gas exploration and production

Road transport

This is the case study from EI/STF's Tripod Beta - guidance on using Tripod Beta in the investigation and analysis of incidents, accident and business losses.

This is quite a complicated incident and is probably not a good example for those new to the Tripod Beta format.

Machine operator cuts hand


Using power tools and machines

This accident has been taken from HSG245 (Investigating accidents and incidents). In the HSE's book the accident has been analysed using "why because" methodology.

Go to to download a copy of HSG245.

The example available here uses Tripod Beta - you may wish to compare the two.

Passenger accident at Brentwood station 28 January 2011


Third party activity

This accident has been taken from the Rail Accident Investigation Branch19/2011 report.

Go to to download the full report

No new analysis has been done in this Tripod Beta version available here. It has only been provided to show an alternative way of displaying the findings.

Asia barge incident


Working on live plant

This accident analysis is the basis for a training video.

See for a copy of the video

The video is a few years old hence some of the descriptions of the diagram elements do not comply with current advice