“Defence in depth” is one of the most repeated phrases in workplace safety, and one of the least examined in practice. The idea is straightforward: layer enough independent barriers between a hazard and a person that no single failure results in harm. What’s less often discussed is what it actually looks like when several of those layers fail on the same day, to the same person, in the same ten minutes.
This article continues a series built around one real investigation, with identifying details changed — the equipment, task, and setting have been fictionalised, but the causation chain is exactly as investigated. The previous article covered the Event itself: a technician fell from a support ledge while tightening a mounting bolt on a pump coupling at a processing plant, sustaining a serious back injury and a fractured rib.
The Active Failures Layer
In Tripod Beta methodology, once the Event is defined, the next layer is Active Failures — the immediate, in-the-moment actions or physical states that directly defeated a specific barrier. This is not yet an explanation. It’s a precise inventory of what didn’t hold, stated as the negative mirror of what should have happened.
In this case, six barriers were meant to be in place. Every one of them failed:
1. Ground-level access. The technician was meant to tighten the mounting bolt from ground level. He climbed onto a support ledge instead, to get more reach.
2. Three points of contact. He was meant to maintain three points of contact while working at height. He had one when he lost his balance.
3. A buddy system. A second person was meant to pass him the mounting bolt. He was working alone.
4. A maintenance platform. A proper working platform was meant to be erected for this job. It wasn’t.
5. Stop-work authority. Anyone present was meant to stop work when the situation looked unsafe. Nobody did.
6. A designated laydown area. The spare pump component was meant to be placed in a designated storage area away from the work zone. It was left on the ground near the machine, for convenience — which is exactly what he struck on the way down.
Why Listing Six Failures Matters More Than Listing One
A single point of failure is relatively easy to explain away as bad luck or an isolated lapse. Six independent barriers failing in the same incident is a different kind of finding entirely — it describes a system where “defence in depth” existed on paper as a list of controls, but none of those controls were independently verified as functioning on the day the job was actually done.
This is also where a common misclassification creeps into investigations that haven’t been trained in the distinction: a procedure, a permit, a training record, or a supervisor’s presence is not itself a barrier. A barrier is the specific positive action — maintaining three points of contact, physically erecting the platform, actually passing the tool instead of leaving someone to reach for it alone. The document or process that’s supposed to produce that action is a control, and a control failing is a different, earlier-stage finding from a barrier failing in the moment.
What This Layer Deliberately Doesn’t Tell You
Six failed barriers describe what didn’t hold. They say nothing about why any of it happened. Every one of the people involved in this chain — the technician, the crew nearby, whoever was meant to check on him — made a decision that felt reasonable to them at the time. That’s not an excuse; it’s the next layer of a proper investigation, and it’s the layer that separates a report that assigns blame from one that actually prevents a repeat.
An investigation that stops here and writes “multiple barriers failed due to non-compliance” has produced an accurate but useless sentence. It describes the what without touching the why — and a corrective action built on that sentence alone almost always defaults to retraining or a disciplinary memo, neither of which addresses whatever made six separate protections all fail on the same job.
The Practical Check
For any recent incident at your own site, count how many barriers were actually meant to be in place before it happened — not how many procedures existed, but how many specific, independent, physical actions were supposed to occur. If the honest count is more than one, and more than one failed, the investigation owes you an explanation for each failure, not a single generic finding covering all of them.
Want your investigation team able to correctly separate barriers from controls, and trace every failure individually? Cikgu Barrier’s Tripod Beta Incident Investigation programme teaches the SPA rule (Specific, Positive, Action) for correctly identifying barriers, and the full causation-chain method for tracing why each one failed. Available in-house and as a public workshop across Malaysia.