Critical controls and serious injury and fatality prevention

When Margaret Doyle, chair of the board's safety and operations committee, read the summary of the line 3 event, she asked a question that Elena had been expecting. 'How many of these do we have that we do not know about?' The line 3 event had no injury beyond a cut finger. But it was, in the language of HSE-401 Lesson 9 and HSE-407 Lesson 4, an event with serious injury and fatality (SIF) potential: had Ben's glove not torn, the belt could have drawn his hand and arm into the divider.

HSE-401 Lesson 9 introduced SIF prevention, energy-based hazard recognition, life-saving rules and the critical control management approach published by the International Council on Mining and Metals (ICMM) in 2015. This lesson goes deeper, and ties those ideas to HOP. Its argument is simple. If error is normal, then the controls that stand between a predictable error and a death must be designed to work even when someone makes that error, and the company must know, continuously, whether they are in place and working.

Why SIF prevention needs its own approach

HSE-401 explained why reducing minor injuries does not reliably reduce serious ones: different events have different causes, and the controls that prevent a sprain have little to do with the controls that prevent an amputation. HSE-407 showed that injury rates are poor guides to SIF risk. Two conclusions follow for a company like Harrowgate Foods Inc., and for most manufacturers.

First, the effort put into SIF prevention should be targeted at the small number of hazards capable of killing or permanently disabling someone. At Harrowgate Foods Inc. these were identified in HSE-404 and HSE-407 as nine serious hazards, including hazardous energy during maintenance and sanitation, moving machinery, powered mobile equipment, ammonia refrigeration, confined spaces, work at height, and trailer movements at the docks.

Second, for each of those hazards the company needs to know which controls actually prevent the worst outcomes, what those controls must do, and whether they are working today. That is the purpose of critical control management.

Building a bowtie

A bowtie diagram, introduced for investigators in HSE-403 Lesson 9, shows a hazardous event at the center, the threats that could cause it on the left, the consequences on the right, and the controls on each pathway. For critical control management, the bowtie is built for each serious hazard by a team that includes people who do the work.

The steps the Harrowgate Foods Inc. teams followed were:

• Define the hazard and the event precisely: not 'machinery' but 'contact with moving parts of process equipment during sanitation, changeover or maintenance'.
• List the threats, the ways the event could occur: unexpected restart, release of stored energy, reaching into equipment believed to be stopped, bypassed guards.
• List the consequences, from minor injury to death.
• List every existing control on each threat and consequence pathway, as it actually exists, not as the procedure says it should.
• Test each control against the definition of a critical control.
• Identify gaps, where a pathway has no strong control.

What makes a control critical

The ICMM guidance describes a critical control, in summary, as one that is crucial to preventing the event or mitigating its consequences, such that its absence or failure would significantly increase the risk despite the other controls. It also emphasizes that a control must be an object, a technological system or a specific human act, and that general management activities such as training, supervision or a policy are not controls in this sense, though they support controls.

Research led by Matthew Hallowell for the Edison Electric Institute adds a test that fits HOP well. It describes a direct control as one that targets a specific high-energy source, works when installed or applied, and remains effective even when someone makes an unintentional error. A machine guard bolted in place meets this test. A sign saying 'keep hands clear' does not. Lockout meets it once the lock is on the right isolation point and zero energy is verified, which is why the line 3 event, where both of those steps were defeated, was so serious.

Applying these tests to the moving machinery bowtie, the team identified four critical controls on the threat side and two on the consequence side.

Performance standards

For each critical control, the team wrote a performance standard: a short statement of what the control must do, how well, and how the company will know. The standard for zero-energy verification read, in part:

• Objective: confirm before any exposure that every energy source has been isolated at the correct point.
• Performance requirements: the verification must detect an isolation at the wrong point; it must not give a false 'isolated' result when an emergency stop or other interlock is active; it must be done by the person who will be exposed.
• Design features: a dedicated test button at each machine that refuses to run while any emergency stop is latched, with a clear screen message; zero-energy indicators on pneumatic and hydraulic systems.
• Verification: weekly frontline checks, monthly supervisor field verification, quarterly engineering test of the test function itself, annual audit.
• Owner: the maintenance lead at each site.

Writing the standard exposed the weakness behind the line 3 event. Before the event, the only performance requirement for zero-energy verification was 'perform a start test'. Nobody had asked whether a start test could give a false result. Once the requirement was written down, the gap was obvious, and so was the fix.

Verification

A critical control is only as good as the company's knowledge of whether it is working. The CCM loop has verification at its heart.

Harrowgate Foods Inc. used three layers of verification, each with a different purpose.

• Frontline checks by the people doing the work, at the point of use: is this control here and working right now? These were built into the pre-job brief and the critical step checks from Lesson 8.
• Supervisor verification in the field, using a short checklist for each critical control, done unannounced across all shifts. HSE-407 Lesson 5 described how the lockout verification pass rate was specified.
• Management and engineering verification, including tests of the control's function (does the start test button really refuse to run with a latched stop?), review of verification data, and periodic audits.

A verification is a field check of the real control, not a review of paperwork. The supervisor checking lockout goes to a job in progress, checks that each worker's lock is on each isolation point listed on the placard, and watches the verification. The engineer testing the start test function latches an emergency stop and presses the button.

Luis wanted to show why verification of the strongest controls mattered most. He wrote a simple model of the moving machinery pathway, treating each control as having a probability of failing on demand, and asked what happened to the risk of a serious event when one control quietly degraded.

# How quietly degraded controls change the risk of a serious event
exposures = 12_000      # times per year someone reaches into isolated equipment, all sites
p_start = 0.01          # chance that, during one of those times, someone tries to start the equipment
controls = {            # chance each control fails when needed
    "lockout at correct point": 0.001,
    "valid zero-energy test":   0.01,
    "light curtain at divider": 0.01,
}

def risk(c):
    p = exposures * p_start
    for v in c.values():
        p *= v
    return p

base = risk(controls)
print(f"all controls healthy: {base:.6f} expected serious events per year (1 in {1 / base:,.0f} years)")
for name in controls:
    worse = dict(controls)
    worse[name] = 0.2   # degraded: fails one time in five, and nobody knows
    r = risk(worse)
    print(f"{name:26} degraded: {r:.5f} per year, {r / base:,.0f} times higher")
# before the event: labels unchecked, start test fooled by e-stop, no light curtain
before = risk({"lockout at correct point": 0.005, "valid zero-energy test": 0.5, "light curtain at divider": 1.0})
print(f"conditions before the line 3 event: {before:.2f} per year (about 1 in {1 / before:.0f} years)")

all controls healthy: 0.000012 expected serious events per year (1 in 83,333 years)
lockout at correct point   degraded: 0.00240 per year, 200 times higher
valid zero-energy test     degraded: 0.00024 per year, 20 times higher
light curtain at divider   degraded: 0.00024 per year, 20 times higher
conditions before the line 3 event: 0.30 per year (about 1 in 3 years)

The model was illustrative, and Luis was careful to say the probabilities were rough. But the pattern was clear. With all three controls healthy, a serious event was expected far less than once a century. If any one control quietly degraded, the risk rose twentyfold or more. And under the conditions before the event, with labels unchecked, a start test the emergency stop could fool and no light curtain, a serious event across the company was to be expected within a few years. The point of verification is to find degraded controls before the arithmetic catches up.

Responding to a failed verification

A failed verification is good news in the sense that the company found the problem before someone was hurt. The response at Harrowgate Foods Inc. followed a set pattern.

• Stop the work if the control is not in place, and make it safe.
• Fix the control before work resumes.
• Find out why, using the questions from earlier lessons: what made the gap make sense? Is the same gap present elsewhere?
• Report it through the line, so that the site leadership and, for repeated failures, the executive team see it.
• Count it, so that trends in failed verifications become visible in the indicators described in HSE-407.

Verifications that never fail were treated with suspicion. A supervisor whose lockout checks passed every time for six months was asked to have a colleague from another area verify alongside, and on more than one occasion the second verifier found problems the first had stopped seeing.

Critical controls and HOP

Critical control management can be run in a way that contradicts HOP: as a compliance regime in which failed verifications lead to discipline and frontline checks become another tick-box form. Harrowgate Foods Inc. tried to run it in a way that expressed HOP.

• Design for error. The strongest critical controls are the ones that work even when someone makes a mistake. Where a critical control depended heavily on a human act, the team looked for ways to back it up with design, as with the start test button and the light curtain.
• Involve the workers. Bowties were built with the people who do the work, and frontline checks were designed by them.
• Learn from failures without blame. A failed verification was a finding about the system, investigated with the same questions as any event.
• Fix the work. When verifications showed a control was hard to apply correctly, the response was to change the control or the work, not to retrain and repeat.

Rachel summarized the link for the board: 'HOP says people will make mistakes. Critical control management says we know exactly where a mistake can kill someone, and we make sure there is something there that works even when they do.'