Explanation
The Tripod method, usually called Tripod Beta in practice, assumes that an incident happens because protective barriers fail, and that those barriers fail for reasons that lie deeper than the action of one employee. You work with three questions. What happened: you put the events in order. How could it happen: you determine which barriers should have prevented it and which were missing or failed. Why did they fail: you work that out for each barrier.
For each failed barrier you distinguish three layers. The immediate cause is the action or event that made the barrier give way. The preconditions are the circumstances that provoked that action, such as time pressure, fatigue or poor tools. The underlying or latent causes are the organisational weaknesses that were already there, such as unclear procedures, too little training, postponed maintenance or conflicting goals. For that last layer the method uses a fixed list of eleven categories.
The difference from the 5 Whys method (see root cause analysis) lies in the structure. With 5 Whys you follow one line of reasoning. That is fast and suits small incidents. Tripod forces you to look at several barriers and to draw latent causes from a fixed list, so you do not stop at the first plausible explanation. The price is time and practice: the method is meant for serious, complex or recurring incidents.
The method originated in the oil and gas sector, with research commissioned by Shell, and builds on James Reason's Swiss cheese model. You aim measures at two places: at the barriers themselves, which is quick and local, and at the underlying causes, which takes more work but yields the most. You choose which method to use yourself, unless a client asks for a specific one.
Example from practice
During loading, a pallet falls from a forklift right next to an employee, with no injuries. In this example the analysis shows that the loading zone was not cordoned off (missing barrier), that the driver was working under time pressure (precondition) and that the schedule structurally allows too little loading time (underlying cause). The measures therefore go beyond instructing the driver again.
© 2026 BrydgeOne. General information, not legal or other professional advice. No rights can be derived from this explanation.
