BHP - Driving safety forward

Driving safety forward: The role of Control Frameworks Understanding fatal risks. Applying controls. Saving lives.

Overview This handbook equips safety roles, risk roles, Local Control Advisors and interested BHP personnel with practical insights and structured approaches to managing fatal risks in mining environments. Grounded in real incidents and proven frameworks, it brings clarity to control types, incident timelines, and how controls are supported to do their job when needed. The handbook is a reference you can return to - supporting better understanding, stronger controls, and safer work.

Contents

Introduction

Why is this safety program needed?

1

What is vehicular energy?

4

What is so dangerous about vehicles and their energy while moving?

5

Vehicle vs environment

7

Vehicle vs vehicle

9

Vehicle vs person

11

Understanding control strategy

Incident timeline: Pre-event, stable, metastable, unstable, damage, post-event

13

Types of controls

15

How effective are the different types of controls?

16

Incorporating the types of controls

17

How it all works together

19

Designing the framework

The goal of a Control Framework: to prevent and/or reduce fatalities

21

How do we come up with a global Control Framework?

23

What does the future look like at BHP

25

“

Why is this safety program needed? Despite advances in technology and safety protocols, fatalities continue to occur across mining operations globally. This safety program exists to address those persistent risks with a more structured, consistent, and effective approach. Persistent vehicle-related fatalities Analysis of mining fatalities in international mining from 2004 to 2024 shows clear, repeated patterns. Serious incidents continue to occur.

Relying solely on technology without the right human processes and oversight leads to gaps in safety.”

Tackling the pattern: Why a Control Framework is essential We know the top 3 damaging energies causing fatalities. Now the question is, how do we change that pattern? Industry experience shows that isolated or ad-hoc controls are not enough. To make a real difference, we need a structured Control Framework — one that ensures the right controls are not just present, but effective. What the industry has learned Global mining safety initiatives, such as EMESRT and the ICMM Maturity Framework, have shown that: • control measures must be part of a connected system, not one-off fixes • effective controls need to be designed, implemented, verified, and continuously improved • technology alone isn’t enough — success depends on human processes, oversight, and culture.

These may seem rare or unpredictable events - but they are recurring patterns. That means they can be prevented.

This approach helps sites move away from reactive solutions and toward proactive, preventative safety systems.

Fatal patterns: The 3 damaging energies behind mining fatalities Together responsible for 78% of nearly 800 fatal mining incidents (since 2004).

Understanding the types of energy that cause harm in mining is critical to preventing repeat tragedies. Most single-fatality mining incidents over the past 20 are the result of three main energy types.

Select each energy type below to explore how it causes harm and see real mining examples.

Why this program matters

Vehicular energy 30%

Gravitational energy 35%

Machine energy 13%

In this handbook, we’ll start by focusing on vehicular energy , the second most common cause of fatalities in mining (but the most common at BHP).

The other two damaging energies, gravitational and machine energy will be explored later.

Fatal incidents still happen — and they follow familiar patterns.

Past approaches have lacked structure, consistency, and integration.

A proven, global model helps control risk at every level, from equipment to behaviour to culture.

1

2

What is vehicular energy?

From patterns to prevention: The control identification and development process

This model outlines how BHP is building global Control Frameworks, moving from understanding the hazard, to identifying controls, and finally embedding those controls within a mature, proactive system.

Damaging energy provided by powered and rolling movement of a whole vehicle or machine on wheels, tracks or rollers (light vehicles, underground and surface heavy mobile equipment, travelling cranes etc.). This includes mobile equipment moving in “vehicle mode”. It excludes slewing of booms or other slewing or luffing motions.

Applying the framework: Controlling vehicular energy

When we talk about vehicular energy in this Control Framework, we’re referring to a broad range of vehicle types, not just haul trucks or site vehicles. For the purposes of this Control Framework, vehicles include:

Passenger vehicles

Highway goods vehicles

Non-heavy mobile equipment

Heavy mobile equipment

Trailers

Control Framework Defined and targeted controls to prevent, or reduce the chance of, an incident sequence progressing to a fatality.

“ This is about more than ticking a box—it’s about putting controls in place that actually work.”

“ Understanding the range of vehicle types involved is essential for identifying the right controls. Each category carries different risks, and the framework helps us match controls to those risks effectively.”

3

4

What is so dangerous about vehicles and their energy while moving? Vehicles are a central part of mining operations, but they also represent one of the most serious hazards. Even at low speeds, their mass and movement generate kinetic energy that can cause devastating outcomes when not properly controlled.

Real-world consequences At BHP, serious vehicle incidents have included: • trucks veering off-road and overturning • vehicles striking fixed structures in low visibility • operators or pedestrians being hit due to blind spots • dozers and excavators going over or partly over edges.

These aren’t rare cases, they are typical examples of how uncontrolled energy leads to harm.

Why controlling energy matters A range of controls have been developed for vehicles, from those that act early to reduce the chance of an incident, through to those that act during a crash to protect people and save lives. Controls built into modern vehicles, particularly those that activate during impact, have already saved many thousands of lives.

The impact of kinetic energy When a vehicle moves, it stores kinetic energy. If that energy is suddenly exchanged with a person (inside or outside a vehicle) - through a collision, rollover, or impact, it becomes damaging energy.

This energy can: • harm people inside vehicles during collision, rollover or impact • strike people nearby • crush infrastructure or equipment.

Interrupt the energy before it causes damage - or reduce it so it can’t.

“ Energy doesn’t have to be high-speed to be fatal. Even slow-moving heavy

vehicles can kill if the energy isn’t controlled.”

What makes vehicular energy dangerous?

If not controlled early, it becomes difficult or impossible to stop.

It’s powerful and often underestimated.

Sudden release Energy becomes dangerous if control is lost.

Damaging energy If not managed, this energy can crush, strike, or overturn with fatal consequences.

Kinetic energy A moving vehicle has energy based on its speed and weight.

It builds quickly - even at low speeds, when size and mass is large.

Effective controls manage or interrupt this energy before it causes fatal harm.

5

6

Vehicle vs. environment

This type of incident happens when a vehicle interacts dangerously with its surroundings, such as going over an edge, rolling over, or hitting natural features, infrastructure, or wildlife. These incidents often involve: • rolling over • driving off a slope or drop • crashing into trees, rocks, buildings, or other structures.

When fatal, it’s usually the driver or passenger of the vehicle who is killed.

Select for examples from recent incidents.

Common patterns Vehicle vs environment incidents often follow recognisable patterns. These include:

Controls that work To help prevent vehicle vs environment incidents, these controls have been proven effective.

Rollover events often triggered by sudden shifts (like sharp turns, equipment movement, or uneven terrain).

Falls into unseen hazards like soft ground collapse, voids beneath the vehicle, or hidden bodies of water.

Edge protection systems like physical barriers, berms, or bunds.

Cameras and mirrors that improve driver visibility when reversing or turning.

Speed limiters and alarms to manage vehicle control in risky terrain.

Driving over edges such as reversing too far, working near crushers or bins, or failing edge barriers.

Loss of control due to low visibility, unstable terrain, or slippery conditions.

Edge detection alerts including proximity sensors or alarms.

In-vehicle monitoring such as GPS positioning and rollover warning systems.

Operator distraction alerts

to keep attention on surroundings.

Collisions with fixed structures including barriers, walls, or roadside objects.

Safe zone awareness supported by systems like geofencing.

These controls help prevent rollovers, stop vehicles from going over edges, and reduce the severity of crashes with fixed surroundings.

These scenarios typically result in the vehicle hitting something in its surroundings, with severe consequences.

7

8

Vehicle vs. vehicles

These incidents involve one vehicle crashing into another. They can happen across a range of different speeds and scenarios, such as during:

• reversing • merging • turning • or when one vehicle is stationary.

Select for examples from recent incidents.

Common patterns Vehicle to vehicle incidents often follow certain patterns. These include:

Controls that work To help prevent vehicle to vehicle incidents, these controls are effective.

Merging or crossing paths at junctions, intersections, or during overtaking. Rear-end or blind approach collisions especially when tailing too closely.

Vehicle movement from a stop contacting another nearby vehicle.

Reversing cameras and mirrors to improve visibility during low-speed manoeuvres.

Defined parking and traffic separation zones keep vehicles apart when stationary or moving.

Park brake systems including automatic application to prevent rollaways.

Loss of control due to operator error, mechanical failure, or runaway vehicles.

Proximity detection systems and vehicle separation alerts to avoid contact in tight spaces.

Autonomous braking systems especially those with pedestrian or vehicle detection.

Attachments or loads sticking out into another vehicle’s path.

Vehicle movement from a stop contacting another nearby vehicle.

Intersection visibility enhancements to reduce blind spots at crossings.

Operator alerts for distraction or fatigue to support safe decision making.

These controls reduce the likelihood of misjudged movement, contact during reversing, and detecting nearby vehicles.

These patterns can occur in both high speed and low-speed environments and often involve limited visibility or misjudged spacing.

9

10

Vehicle vs. person

These are some of the most serious incidents. They happen when a vehicle hits a person (usually on foot) outside that vehicle. The person is usually a: • bystander • someone involved with a vehicle movement task • vehicle passenger or operator after exiting the vehicle.

Select for examples from recent incidents.

Common patterns Vehicle to person incidents often occur when people are in the wrong place at the wrong time, whether the vehicle is in control or not. These patterns are common.

Controls that work To help prevent vehicle to person incidents, these controls have shown to be effective.

Pedestrian proximity detection systems

Reversing cameras and visibility aids helping operators see blind spots.

Motion lockouts preventing vehicles from moving when someone is nearby.

which alert drivers to nearby people.

A vehicle in control hits someone nearby often a bystander or worker not part of the task.

A person is in the vehicle’s footprint such as standing close during loading or reversing.

Parking segregation and separation zones to keep people and vehicles apart.

Autonomous braking systems with pedestrian detection, to stop before contact.

Unexpected movement including rollaways or vehicles not properly secured.

Poor separation where people and vehicles share the same space without clear boundaries.

People entering or exiting vehicles when others are moving nearby.

These work best when combined, giving both people and operators more time and space to avoid dangerous contact.

Clearly defined walkways and physical barriers where possible.

Distraction alerts and operator awareness systems reducing inattention risks.

These incidents usually involve a loss of visibility, awareness, or control, and can be fatal in seconds.

11

12

Incident timeline: Pre-event, stable, metastable, unstable, damage, post-event

“ You can’t control what you don’t anticipate. Effective safety relies on understanding how and when to act across the full timeline.”

Every vehicle incident unfolds over time and each stage offers different opportunities for intervention. By breaking incidents into distinct phases, we can apply the right controls at the right moments to either prevent the incident or reduce its impact. The phases of an incident

Example Operator attends shift pre-start and undertakes pre-shift plans and handover.

Operator prepares new drill pad over several hours, with multiple ripping passes, at various angles but away from open edge.

While reversing, tracks start to move over open edge, unknown to operator.

Dozer moves past tipping point and falls over edge.

Dozer strikes lower level and operator impacts inside of cab.

Operator contacts emergency services and is medically treated.

Pre-event

Stable

Metastable

Unstable

Damage

Post-event

Everything that happens before an incident occurs. This phase may span from months to moments before the event.

Incident has commenced. Situation normal.

Situation is moving out of control but is recoverable.

Situation is out of control and not recoverable.

Damaging energy exchange is occurring.

What happens after the incident, when the damaging energy has already been released.

You’ve now seen how an incident can unfold across each phase of the timeline.

Select each phase in the timeline above to see examples of effective controls for vehicle incidents.

13

14

Types of controls Controls don’t all work the same way. Some act automatically, others rely on people, and some reduce the impact after an incident has already happened. Understanding these control types helps you apply the right tools at the right time. Watch this short video to explore the four types of controls, how they work across the incident timeline, and why support factors are critical to making them effective.

How effective are the different types of controls? Not all controls offer the same level of protection. Some stop incidents completely. Others rely on human action or only help once something has already gone wrong.

Understanding how effective each control type is helps LCAs and site teams understand their Control Framework as a whole.

Control types: Effectiveness vs timing

These are the most effective— automatic, high reliability controls interrupt the incident sequence by themselves.

Interrupt Controls

Still highly valuable, these support early detection but rely on operators to act to interrupt the incident sequence.

Assisted Interrupt Controls

These depend on people recognising and acting to interrupt the incident sequence. They’re simple to apply but inconsistent in outcome.

Human Action Interrupt Controls

“ The best safety systems don’t rely on one layer—they combine multiple types of controls and support factors to interrupt risk, reduce harm, and strengthen outcomes.”

These don’t prevent the incident but reduce the impact or damage. They’re essential in high-consequence environments.

Damage Reduction Controls

15

16

Incorporating the types of controls

“ Effective control strategies combine multiple control types across the incident timeline.

The goal is not just to react but to prevent, interrupt, and protect, all within a system that actually works on site.”

Let’s take a look at how the types of controls act on the timeline.

Incident Sequence (Point of Risk)

Pre-event

Stable

Metastable Unstable Damage Post-event

Interrupt Control Control interrupts sequence by itself.

Assisted Interrupt Control Control interrupts sequence with assisting action from person.

Damage Reduction Control

Control acts by reducing damaging energy exchange with person.

Control acts in Post-Event phase by reducing the time for medical response.

Human Action Interrupt Control Control interrupts sequence when human acts only based on skills, knowledge and perception.

Upstream, away from point of risk and event sequence

Support Factor A system, process or activity, away from an event sequence, that supports or enables Controls to be available and effective when needed. ALL Support Factors are in the Pre-event Phase — but are NOT controls , in their own right.

17

18

How it all works together You’ve explored the four types of controls, seen how they apply across time, and learned how support factors strengthen every layer. Now, let’s bring all the elements together into one view, a clear picture of how a strong control system works across an incident timeline. The strongest systems combine automatic, human, and protective responses - reinforced by people, systems, and support factors that make them work when it counts.

Controls should be present at every phase of an incident

Select each type of control to see examples of the control at every phase.

Interrupt Control Control interrupts sequence by itself.

Real safety is layered. No single control is enough.

Assisted Interrupt Control Control interrupts sequence with assisting action from person.

Support factors: The invisible layer that connects it all

Human Action Interrupt Control Control interrupts sequence when human acts only based on skills, knowledge and perception.

Support factors don’t just sit at one point in time, they strengthen every other control, no matter when it’s used. For example:

Damage Reduction Control

Control acts by reducing damaging energy exchange with person.

Control acts in Post-Event phase by reducing the time for medical response.

Support factors have a “many-to-many” relationship with controls. Every strong control is backed by more than one system and every support factor strengthens more than one control.” “

Training supports pre-event recognition and post-incident response.

Fatigue Management improves operator alertness during every phase.

Maintenance ensures systems like

automatic brakes and alerts actually work when needed.

19

20

The goal of a Control Framework: To prevent and/or reduce fatalities A Control Framework provides more than just a list of safety tools, it offers a structured, consistent way to understand how to eliminate or reduce serious harm.

Why a framework matters

• It helps prioritise controls that are most effective at preventing incidents, rather than just reacting to them.

• It reduces the risk of relying on chance or individual interpretation.

• It provides a common language and method for selecting, applying, and reviewing controls across sites.

Two key goals of any Control Framework

How it helps sites and assets A clear framework offers: • confidence when reviewing and challenging existing controls • clarity when identifying what’s missing or underperforming • a foundation for continuous improvement that’s consistent across operations.

Prevent fatalities Apply high-order, proactive controls, like interrupt and assisted interrupt measures that stop the incident before it happens.

Reduce the severity of outcomes When prevention fails, ensure post-event controls are in place to minimise harm, such as ROPS or rapid medical response systems.

“

The goal is simple, but critical: prevent what you can and be fully prepared to reduce harm when you can’t.”

21

22

How do we come up with a global Control Framework?

“

A Control Framework isn’t based on guesswork. It’s built from evidence, insight, and shared expertise. The goal is to understand real-world risks and match them with structured, effective controls that prevent or reduce serious outcomes. Select the four steps to see how we turn real incidents and insights into structured, site-ready Control Frameworks

We build a Control Framework by combining what we know from data, what we learn from the field, and what we apply through tested tools. That’s how we create something that works where it matters most.”

We start with the real risks 1

We use proven models and tools 2

3

We collaborate with people on the ground

and adapt 4

We test, review,

23

24

What does the future look like at BHP • Control Frameworks to be adopted globally. • Controls to be checked by people close to the “point of risk” so we know that controls are present when they are needed and will do the job when they are needed. • Support Factors will be checked away from “the point of risk” so that frontline workers can get on with their work, and other roles make sure the support factors are doing their job. • Many of these checks we already do, so it won’t be more work, it will just be clearly “visible” in how we work.

Support factors: Always essential

While not rated on the same effectiveness scale, support factors are critical to the success of every control. Training, communication, and system health all determine how reliably controls perform.

What does this mean for us?

Prioritise high-order controls (like interrupt systems) wherever possible.

Ensure damage reduction controls are always in place —but never relied on alone.

Introducing Cube Cube is a digital platform currently in development at BHP. It’s designed to help teams identify, visualise, and implement the right controls, so that safety is measured by the presence of those controls, not just the absence of injuries. Cube supports scenario-based control mapping, vehicle-specific applicability, and future frontline verification. Once all features are available, it will:

Use assisted and human action controls as layers, not substitutes.

Strengthen all controls with support factors that boost awareness, capability, and system uptime.

CUBE.BHP.COM

“

Help check whether controls are in place and ready.

Visualise the timeline of controls across event phases.

The most effective controls act early and automatically. But no single control is enough — layering controls across time and type is what creates real protection.”

Provide implementation plans and track control realtime health.

Support learning and integration with risk frameworks.

25

26

You’ve explored the risks, the control types, and the structure behind a strong, layered safety system. Bring this to life, challenging weak controls, supporting strong ones, and building confidence across your site. The framework is here. The tools are in our hands. Now it’s time to put them into action.