Elimination Has Its Own Hierarchy Of Control
Risk! Engineers Talk Governance Podcast
Season 8, Episode 2
In this episode of Risk! Engineers Talk Governance, due diligence engineers Richard Robinson and Gaye Francis discuss how Elimination Has Its Own Hierarchy Of Control.
They unpack how the traditional hierarchy of controls (elimination, substitution, isolation, engineering, admin, PPE) collapses under WHS legislation into eliminate–prevent–mitigate, and why the elimination step can't be skipped until it's genuinely tested and ruled out. Using real examples, from rockfalls above a Sydney rail line to level crossings, they show that "eliminate" usually means choosing between stopping one activity, stopping another, or re-engineering the interaction entirely, and why that reasoning needs to be documented, not just assumed.
Timestamps:
00:00 – Intro: elimination and its own internal hierarchy of controls
01:03 – The traditional hierarchy of controls explained via a noisy machine example, plus WHS legislation's eliminate–prevent–mitigate structure
03:49 – Why elimination must be properly tested before moving on — illustrated through the Lapstone rockfall case (stopping trains vs a tunnel vs doing nothing)
06:15 – Level crossings as a three-way elimination choice (stop trains, stop cars, grade separation), plus the dam wall and airspace design examples
09:09 – The governance shift: formally documenting why eliminated options were ruled out, and using threat barrier diagrams to test reasonableness
11:31 – Wrap-up, including the Comeng trains example of an elimination option that's valid but cost-prohibitive
If you’d like us to cover a specific topic or have any feedback we’d love to hear from you.
Episode transcript
Megan (Producer) (00:00):
Welcome to Risk! Engineers Talk Governance. In this episode, due diligence engineers Richard Robinson and Gaye Francis discuss how elimination has its own hierarchy of control.
(00:12):
We hope you enjoyed the chat. If you do, please support our work by giving us a rating and subscribing on your favourite podcast platform. And if you'd like more information on R2A, our newsletter and resources, or have any feedback or topic ideas, head to the website, www.r2a.com.au.
Gaye Francis (00:33):
Hi Richard. Welcome to a podcast session.
Richard Robinson (00:33):
Good Morning, Gaye.
Gaye Francis (00:35):
Today we're going to talk about elimination and that it has its own hierarchy of controls and the way that people think about it when they're going through the elimination option. But I thought what we'd do is we go through what people traditionally think of the hierarchy of controls from the code of practice, how it also relates to safety and design, and then the hierarchy of controls in the WHS legislation, but then go to the elimination option.
Richard Robinson (01:03):
Yeah, that's right. And the reason why we talk about the hierarchy in the elimination option, from a criticality viewpoint, that's where you always want to start. So what I thought I'd do, just summarise what the code of practice for OHS/WHS hierarchy of control roughly is within a simple example. So I mean, most people remember we've got the elimination option, then you've got substitution isolation, engineering controls, then you've got admin and then PPE. That's the normal way of thinking about it. And that's been done for what you might call common hazards. A typical common hazard is a noisy machine. And so you don't want to get people hearing damage and you've got a particularly noisy machine around. Well, obviously the elimination option is to either throw the machine out altogether...
Gaye Francis (01:43):
Stop that process.
Richard Robinson (01:44):
Stop that process. Or you could substitute it with a quieter machine, which you could obviously do. You could isolate the machine and that could be done, depending on what you're talking about. If it's a vibration noise, you could isolate it with rubber mounts and things like that. Well, that's probably engineering controls. Or you could put an engineering control in which is typically, let's put an acoustic guard on this thing, just cover it up and just keep the noise inside the box.
(02:09):
Then you can go with the administrative control and administrative control would mean like putting somebody four hours in the noisy environment, four hours in the quiet environment. So the total noise exposure LEQ is 85 dBA, I think is the way it's normally expressed. Which would work. And then you can go with the hearing protection, which obviously is hard to make people wear properly. And you've got to have enforcement procedures and controls and actually quite hard work for the relative effectiveness of it. I mean, one of the reasons why people wear a lot of this stuff in industrial sites, hi vis and things like that, it's not so much because they're actually expecting it to be beneficial, I think. It's more a security thing. If somebody isn't wearing that stuff, who are you and what are you doing here?
Gaye Francis (02:51):
That's an interesting way to look at it. Yes.
Richard Robinson (02:54):
I've seen that done quite a lot.
Gaye Francis (02:55):
You have to have the right gear to be onsite.
Richard Robinson (02:57):
Because if you're just walking between somewhere, there's no noisy machines, there's nothing's going to fall on you. But once you go past that fence, if you're not wearing PPE, you're not one of us.
Gaye Francis (03:07):
Yep, that makes sense.
Richard Robinson (03:09):
Anyway, so that's the way it's traditionally expressed. Now, obviously the Work Health and Safety legislation's got a peculiar hierarchy because it says you've got eliminate, if you can't eliminate, then you reduce. And most people then use the hierarchy of control as that risk reduction.
(03:25):
We've noticed that the courts, which we've talked about many times, actually has a hierarchy of three. You eliminate, and if you can't eliminate, then you prevent, and then you can't prevent, then you mitigate and you can break those controls that I just talked into pretty much into those categories. But one of the things we have noticed is because we have this problem all the time, because when we're dealing with critical hazards, we always have to test that elimination option quite thoroughly.
(03:49):
And when you go through that, you sort of discover there is actually a hierarchy of options in the elimination category. And I don't think people think this thing through properly because you really can't go under the WHS legislation to the...
Gaye Francis (04:03):
Prevention options.
Richard Robinson (04:05):
All the reduction options until you've actually properly demonstrated that you've explored the elimination options.
Gaye Francis (04:10):
And I think just as a little aside before we go on to that, that often we see that not being done, especially in safety and design exercises.
Richard Robinson (04:18):
Yeah, it's right at the start.
Gaye Francis (04:20):
But the elimination option is often passed over very, very quickly.
Richard Robinson (04:24):
Well, that's right. Now we've sort of seen this over a long period of time. So I mean, some of the examples in our book, I mean, I don't know that we actually express it that particularly thoroughly. I mean, for example, remember we had the lapstone cutting and they had the rocks being manufactured off the cliff and we were particularly concerned because there's a photograph of a huge rock and we were allowed to publish that and we got permission from the legal authorities and so forth to do that. But there's this huge rock sitting on the track and it's big enough to (throw) a Sydney electric train into Lapstone Gorge. And as we've commented, I think there's probably, what, half of crush loading on, probably 700 people potentially.
Gaye Francis (05:00):
Potentially on the way back.
Richard Robinson (05:01):
And so in the end we got hauled in basically, I won't go through the whole story again, but we actually got hauled in affected by the asset manager with the lawyer's approval to try and resolve the situation. Now most people, when they think of the elimination option, they think of stop whatever you're doing. We've tried this in New South Wales suggesting that they stop running the trains.
Gaye Francis (05:23):
It's not successful.
Richard Robinson (05:25):
In fact, it's actually something of a social disaster.
Gaye Francis (05:28):
True.
Richard Robinson (05:29):
But you've got to explain why you couldn't, it's unreasonable to do it. But then the next option then becomes, well, how do you deal with this thing? Well, there were a number of design solutions, but the most obvious one is you go and put a tunnel in so you don't have this cliff face above you that can manufacture rocks.
Gaye Francis (05:43):
Well, it's the interaction, isn't it? You stop the interaction between the train and the rocks.
Richard Robinson (05:47):
That's right. So you just go into a tunnel and you don't have a problem. Now obviously the stopping the train option wasn't on the table. It got kiboshed pretty quickly. And then you sort of say, okay, well why can't...
Gaye Francis (05:56):
Well, it wasn't SFAIRP, Richard.
Richard Robinson (05:58):
No, it wasn't. Well, neither was putting a tunnel in because by the time you start, everyone can say, well, we could put a tunnel in for that particular cutting. But if you ever happen to deal with Sydney trains, there's got quite a few other cliffs and blue mountains that you have to fret about. So you'd have to start putting tunnels everywhere.
Gaye Francis (06:15):
And so you couldn't implement that as a policy level of control.
Richard Robinson (06:18):
That's correct. But historically in New South Wales, they have implemented a policy level. They've always had grade separation. Victoria never got big on it until recently, but (NSW) had. And I've never actually researched this, but I remember I was talking to somebody in railways in New South Wales and just asked the question. They said, oh, it was all because I think in the 1930s or 40s, I couldn't remember exactly when, but a busload of kids got hit by a train on a level crossing in New South Wales. And the horror of that was so great that the New South Wales government said, "We don't like level crossings." And because they're a lumpier place, getting rid of level crossings was actually easier for them. But as a principle, as a design concept, they just didn't build...
Gaye Francis (06:56):
Level crossings to prevent car and train interactions.
Richard Robinson (07:02):
And in Victoria, because we're basically a flatter place, and that's why we like broad-gauge and so forth and all these other things, we basically, until the traffic buildup was so great that we just couldn't handle it anymore, we didn't get rid of them. But in the hierarchy of control, that's the other thing. I mean, if you've got a level crossing that you don't like, well, what are your options? Stop the trains. That's one elimination option.
Gaye Francis (07:24):
Stop the cars.
Richard Robinson (07:25):
That's the second elimination option. What's the third one? Grade separation. And that actually exists just about everything we've ever done, those options always seem to exist. And I don't think people sort of think through that hierarchy. I've never seen it formally expressed anywhere. Although once you say it, it's sort of....
Gaye Francis (07:46):
Obvious that it follows a hierarchy, as you said.
Richard Robinson (07:50):
Yeah. But the other point about it is that stopping things, I mean, if you think something's prohibitively dangerous, you've got to stop it. You might recall, I forget which dam it was, but the tow of the dam wall was moving and the structural engineers, I think, and the dam safety guys thought that they had about a one in 300 year failure, I think, or something like that. And when they actually drained it and had a look, it was sort of a heck of a lot higher than that. And they were all sort of freaking out. But that one there, you have to actually re-engineer it. There's no other option. If you want to have a dam with all this water behind it that I think, I forget which one it was, but several times Port Phillip Bay's volume. If you want to flush the mouth of the Murray out, that would've done it. But a lot of the time, particularly when you're talking about interactions, you're talking about ships and aircraft and things like that, we talk about all these different options, but we never formally think it through and we never formally test it with the group.
Gaye Francis (08:46):
Of stopping the activity.
Richard Robinson (08:48):
Well, stopping the activity and what could you do and replace it with something else? I mean, when we talked about airspace design, you remember Tapau and those sorts of things like that. Obviously banning a particular user that's causing the grief is clearly an option every time. But nobody wants to do that. So it sort of gets thrown in the rubbish bin more or less immediately.
Gaye Francis (09:09):
I think the importance of some of those things now, and some of the examples we're talking about are quite old and potentially before the WHS legislation, but the importance of looking at those items now is you really do have to consider them and articulate why you are not going to do them. So it's a bit more formal. It's becoming a governance process of why you've considered those things and why you don't think that they're SFAIRP. And it often comes down to that utility of conduct, doesn't it?
Richard Robinson (09:38):
Correct.
Gaye Francis (09:39):
What other good things go missing because you adopt that course of action?
Richard Robinson (09:42):
Stopping Sydney trains because rocks could fall on the track is not really possible.
Gaye Francis (09:46):
No.
Richard Robinson (09:47):
And it didn't take much to come to that understanding, I might add. It was sort of self-evident.
Gaye Francis (09:51):
And I think we probably, everyone had it in their mind, but it wasn't articulated in a way and documented in a way.
Richard Robinson (09:58):
We never formally said this isn't practicable. We just moved on to the next option, which was, well, let's put a tunnel in and see how that goes. And everyone looked at each other and said, "Well, do you guys understand how much that's going to cost?" And then we've got to do it for all the other cliff faces and everyone goes, "Oh yeah, we're not going to do it."
Gaye Francis (10:14):
I think that's one of the beauties of the threat barrier diagrams that we use. And by putting all of the controls on the table, and this season is focused at criticality and control, what are all the controls? And that's what the WHS legislation asks you to do. What are all the possible controls and what are reasonable in the circumstances? So in the circumstances, stopping the trains was not considered reasonable.
Richard Robinson (10:39):
No, that's right. But it's like single line track and safe working systems. If you've got crossing loops, I mean obviously from a train efficiency movement and things like that, having two tracks, one going each way up and down, makes life relatively simple. Once you start to have single line track and you've got crossing loops, it suddenly gets really complicated. And if you don't want to have head-ons, go with two parallel tracks. That's really simple. Obviously, if you're talking about Australia and you're talking about going from here to somewhere, that can be having two tracks is very, very expensive. You might notice that they're going to put a train from up central through the Nordic countries and possibly across the Helsinki through the Sulwaki Gap. Because they want to get it done in a hurry, they're going for single line, but they're building it with a theory that it will be dual two-way running.
Gaye Francis (11:27):
Future-proofing, imagine that. <laughs>
(11:31):
So I think what we'd say in this that although you probably haven't formally though it through, there is a hierarchic controls in the elimination option, but we are still seeing the elimination option not being given a lot of thought, especially in safety and design exercises.
Richard Robinson (11:48):
And from a criticality viewpoint and what we understood the OHS Act and WHS legislation to be about.
Gaye Francis (11:55):
From a control viewpoint, you have to consider elimination first.
Richard Robinson (11:58):
And you have to explain why you're not going to do it, and you need to have thought through the option then said why you're not going to do it.
Gaye Francis (12:03):
So elimination, there may be a number of options available for elimination.
Richard Robinson (12:08):
Correct.
Gaye Francis (12:09):
As we've just discussed.
Richard Robinson (12:11):
I mean, I jumped on a comeng trains this morning. They're on the way out and they should be extinct. They've got a lot of problems. And obviously if you want attraction in locking on trains, the elimination option is get rid of comeng trains. But to abruptly do that costs a lot of money.
Gaye Francis (12:27):
And to keep providing the service that you want to provide and all of those sort of things. So there's reasons why it's not done, but you do have to explain why that is the case.
Richard Robinson (12:35):
Yes.
Gaye Francis (12:37):
Alright. Thanks for joining us today, Richard, and we will see you next time.
Richard Robinson (12:42):
Thanks, Gaye.