Tripod Delta: Proactive Approach to Enhanced Safety

Abstract

Summary Tripod Delta (diagnostic evaluation tool for accident prevention) is a checklist-based approach to carrying out safety "health checks." This paper describes the theoretical background of the approach, which is based on a model for understanding the role of human error in accidents. The method for constructing databases from which to make checklists and use of the system to generate remedial safety plans are described. Finally, the implementation is discussed and the status is reviewed. Introduction Tripod is an approach to safety developed by the U. of Leiden and the U. of Manchester in close cooperation with the Shell Intl. Petroleum Mij. B.V.E&P function. Tripod attacks underlying safety problems with special reference to human error, which is seen in failures at both individual and organization levels. A central concept in Tripod is the "latent failure," the potential cause of future accidents. Tripod Delta is a diagnostic tool developed to help identify such underlying problems before latent failures generate active failures (the immediate causes of accidents).This paper describes the background of Tripod Delta, how it operates, and the current status of the system. Accidents, Unsafe Acts, and Underlying Causes. Accidents have a number of immediate causes, many of which have a human origin. For an accident to take place, unsafe human acts must interact with triggering events, such as a breaking cable or a well kick. When the combination circumvents available defenses, the result may be an accident or a near miss. All too often, investigation of an incident focuses on the immediate events and human failures. This concentration on the direct causes (active failures) also often applies to proposals for prevention of future incidents. However, the events leading to accidents do not arise spontaneously. The shortcomings that can be identified after an accident are often present long before as latent failures. The general Tripod model (Fig. 1) in cludes three basic components of the accident process.Accidents happen when defenses are breached.The unfortunate sequence of events involves the combination of one or more unsafe acts in the context of specific triggering conditions (which may themselves be technical or human in origin).Behind the unsafe acts and conditions is a history of causes, classified into a limited set of general failure types (GFT's) shown in Table 1. This restricted set of 11 GFT's has been identified in field studies and from analyses of major accidents. The list was defined by providing a general set of terms adequate to describe latent failures and by distinct ways to remedy the problems identified. The communication GFT, for instance, covers both technical failures (e.g., a poor or nonexistent telephone system or difficult radio communication) and human failures (inability to pass on or to understand messages). The important factor in a potential accident is that the vital information may not be available to the proper people at the right time. Similarly, the hardware GFT refers to the quality and availability of components, tools, and equipment. Problems in any of these areas may lead people to create situations that can lead to hardware failures later, such as accepting corrosion, installing in correct material, or using the wrong tools. The view taken in Tripod is that it is more effective to concentrate on the conditions defined by the GFT's rather than to attempt to stop the unsafe acts as they occur. The GFT's behind the large numbers of unsafe acts and triggering events form a natural and more limited set of targets for improvement. Safety Management and Proactive Approaches. An important starting point in safety management involves identifying the necessary components of good management practice. Shell's Enhanced Safety Management Principles embody such an approach, stressing such factors as the necessity for a firm commitment to safety, line responsibility for safety, and regular audits. Once management systems meet such principles, it generally becomes necessary to determine where attention must be directed. P. 58^