Preventing serious injuries and fatalities

In the year before the spiral conveyor injury, Harrowgate Foods Inc.'s recordable injury rate had fallen for the third year in a row. Most of the remaining injuries were minor: cuts from bread knives, sprains from lifting trays, a few burns at the ovens. Leaders had reasonably concluded that the company was getting safer. Then a worker nearly lost his arm. When Elena went back through the year's near miss and first aid records, she found four earlier events at the spiral and two at other conveyors that could easily have ended the same way. None had been treated as serious, because nobody had been seriously hurt.

This lesson is about the difference between preventing injuries in general and preventing serious injuries and fatalities, often abbreviated SIF. It explains why falling injury rates do not guarantee falling fatality rates, how to identify events with serious potential, and how to focus leadership attention and controls where they matter most.

The triangle that misled a century

In 1931, the American safety engineer Herbert Heinrich published a ratio based on insurance records: for every major injury, there were about 29 minor injuries and 300 no-injury accidents. His accident triangle, sometimes called the safety pyramid, became one of the most influential ideas in the history of safety. The usual interpretation was that if you reduce the minor events at the bottom of the triangle, you will automatically reduce the serious ones at the top, because they share the same causes.

For decades, organizations managed safety on that assumption. They worked hard on slips, trips, cuts and strains, saw their total injury rates fall dramatically, and expected fatalities to fall in step. They did not. In both Canada and the United States, total recordable injury rates fell steeply from the 1990s onward, while the number of workplace fatalities fell much more slowly and in some years rose. The US Bureau of Labor Statistics counted 5,070 fatal work injuries in 2024, a rate of 3.3 per 100,000 full-time equivalent workers. The Association of Workers' Compensation Boards of Canada counted 1,056 accepted fatality claims across Canada in 2023. Those figures include occupational disease and are not directly comparable, but in both countries hundreds of serious and fatal events still happen each year in workplaces with good overall injury rates.

What changed the thinking

In the 2000s and 2010s, researchers and safety leaders looked more closely at the data. Work by Thomas Krause and colleagues at a consulting firm, by the Campbell Institute at the US National Safety Council, and by many large companies found that only a small fraction of minor injuries and near misses, often cited as roughly a fifth, had the potential to cause a serious injury or fatality. A twisted ankle on a flat floor and a fingertip cut from a bread knife share few causes with a worker caught in a conveyor or struck by a forklift. Reducing the first group does little to prevent the second.

The events that predict serious harm are the ones with SIF potential: events where, if circumstances had been slightly different, someone could have been killed or seriously injured. The spiral conveyor near misses were in this group. The bread knife cuts were not.

Precursors and high-energy hazards

If SIF events have different causes from minor events, what are they? The answer most organizations have adopted focuses on energy. Serious injuries usually involve the release of large amounts of energy: gravity, motion, mechanical, electrical, pressure, temperature or chemical. A worker falls from height, is struck by a moving vehicle, is caught in machinery, contacts a live conductor or is exposed to a toxic atmosphere. The Edison Electric Institute, working with researchers and utilities, developed an energy-based safety classification that uses a simple threshold: an event has high SIF potential if a high-energy source was present and direct control was absent.

SIF precursors are situations where a high-energy hazard is present and the controls that should protect people are missing, weak or bypassed. Common SIF precursors in food manufacturing and distribution include:

• work on machinery that is not isolated and locked out, including sanitation and clearing jams;
• forklifts and pedestrians sharing space without separation;
• work at height without fall protection, such as on top of trailers, mezzanines and racking;
• entry into confined spaces such as tanks, silos, mixers and pits;
• ammonia refrigeration systems, steam and pressurized systems;
• live electrical work and arc flash exposure;
• loading docks, where trailers can creep, tip or pull away;
• driving, the leading cause of work-related fatalities in both countries.

Life-saving rules

Many organizations single out a short list of rules for the activities that cause most fatalities, sometimes called life-saving rules, cardinal rules or critical controls. The International Association of Oil and Gas Producers published a widely copied set, and many mining, energy and manufacturing companies use their own. The idea is that these few rules are absolute: they are explained thoroughly, made easy to follow, checked often and enforced consistently.

Harrowgate Foods Inc.'s leadership team, with the safety committee, chose eight life-saving rules based on the company's own high-energy hazards: lock out before you reach in; keep pedestrians and forklifts apart; tie off or stay behind a guardrail above the fall height; permit before entering a confined space; test before you touch electrical equipment; chock and restrain trailers before entering; follow the ammonia procedure; and wear a seatbelt and never use a phone while driving. Each rule came with the engineering and equipment needed to make it easy to follow, such as the new disconnects, dock restraints and pedestrian walkways.

Life-saving rules interact with just culture. Because the consequences of breaking them are so severe, the threshold for disciplinary action is lower than for other rules. But the just culture tests still apply: if a life-saving rule is being broken routinely, the first question is why, and what in the system makes it hard to follow.

Critical control management

A more systematic approach, developed in the mining industry after fatal accidents in Australia and promoted by the International Council on Mining and Metals in a 2015 guide, is critical control management. For each potential major unwanted event, such as 'worker caught in conveyor', the organization identifies the critical controls: the few controls that, if absent or failed, would sharply increase the chance of a fatality. Each critical control then has a defined performance standard, an owner, and a regular verification in the field by someone who checks that the control is actually in place and working, not just documented.

At Harrowgate Foods Inc., the critical controls for 'caught in conveyor' were: guarding in place and interlocked; isolation at a disconnect within easy reach; lockout applied and tested before any access; and emergency stops working and accessible. Supervisors verified a sample of these in the field every week, and senior leaders verified some themselves on their walk-arounds.

Classifying events for SIF potential

To learn from SIF precursors, Harrowgate Foods Inc. added a simple question to every incident and near miss report: could this event, under slightly different circumstances, have caused a fatality or a life-altering injury? If yes, the event was classified as SIF potential and received a deeper investigation, a senior leader review and company-wide sharing, regardless of whether anyone was actually hurt.

Elena reclassified a year of events at all three sites to see how the picture changed.

# A year of events at all three sites, classified by actual outcome and SIF potential.
events = [
    # (type, actual outcome, SIF potential)
    *[("cut", "first aid", False)] * 120,
    *[("strain", "recordable", False)] * 14,
    *[("burn", "first aid", False)] * 35,
    *[("conveyor near miss", "none", True)] * 6,
    *[("forklift-pedestrian near miss", "none", True)] * 9,
    *[("dock trailer creep", "none", True)] * 3,
    *[("slip on flat floor", "first aid", False)] * 40,
    *[("caught in conveyor", "lost time", True)] * 1,
    *[("ammonia leak small", "none", True)] * 2,
    *[("fall from trailer", "recordable", True)] * 1,
]
total = len(events)
sif = [e for e in events if e[2]]
hurt_sif = [e for e in sif if e[1] in ("recordable", "lost time")]
print(f"All events: {total}; SIF potential: {len(sif)} ({100*len(sif)/total:.0f}%)")
print(f"SIF-potential events that actually injured someone: {len(hurt_sif)} of {len(sif)}")
from collections import Counter
for kind, n in Counter(e[0] for e in sif).most_common():
    print(f"  {kind}: {n}")

All events: 231; SIF potential: 22 (10%)
SIF-potential events that actually injured someone: 2 of 22
  forklift-pedestrian near miss: 9
  conveyor near miss: 6
  dock trailer creep: 3
  ammonia leak small: 2
  caught in conveyor: 1
  fall from trailer: 1

Only about 9 percent of the year's events had SIF potential, and only 2 of those 22 had actually injured anyone. Under the old system, the other 20 had received little attention because nobody was hurt. They were exactly the events that predicted the spiral conveyor injury. The reclassification also showed that forklift and pedestrian interactions at the distribution center were the largest group of SIF precursors, which moved pedestrian separation to the top of Grace's priorities.

Why culture is central to SIF prevention

SIF prevention depends on culture in three ways. First, it needs reporting: SIF precursors are near misses and hazards, which people only report if it is safe and worthwhile, as covered in lessons 5 and 7. Second, it needs leaders to treat a near miss with serious potential as seriously as an injury, which runs against the natural tendency to relax when nobody was hurt. Third, it needs the organization to resist the comfort of a good injury rate. Deepwater Horizon, discussed in lesson 2, had an excellent personal injury record on the day of the blowout.

In the United States, employers must report work-related fatalities to OSHA within 8 hours, and in-patient hospitalizations, amputations and losses of an eye within 24 hours. Many OSHA standards, including lockout, confined spaces, powered industrial trucks and process safety management for highly hazardous chemicals such as ammonia, target the high-energy hazards behind serious injuries. SIF classification helps an employer act on the warnings before an event reaches the reporting threshold.

Leading on serious risk

SIF prevention changes what leaders pay attention to. At Harrowgate Foods Inc., the monthly operations review now opens with any SIF-potential events from the month, before any production numbers, and the site manager explains what was found and what was done. Senior leaders spend part of every walk-around checking one critical control in the field, for example asking an operator to show how lockout is applied on a mixer, or watching a forklift and pedestrian crossing at shift change. These checks are framed as learning, not policing: the leader's question is whether the control is easy to use and actually used, and what would make it better. Supervisors report that this has changed how they spend their own time, with more attention on the few tasks that could kill someone and less on minor housekeeping findings.