EH-9411 Issue No. 11, 1994 November Occupational Safety Observer
In This Issue
Complacency Leads to Danger ......................................1
Rescue Plans Must Be Effective ...................................2
Changeout Guidance Developed .....................................3
Lineman Electrocuted .............................................4
Worker Exposed to Noise of Explosion .............................7
Improper Lockout/Tagout
Complacency Leads to Danger
In early March 1994, the Advanced Test Reactor at the Idaho National
Engineering Laboratory underwent a scheduled outage to prepare for maintenance
and for major replacement of core components. As part of that preparation,
the work plan indicated that a 250-volt DC electrical breaker supplying power
to the reactor safety rod drives be locked and tagged in the open
position.
The Incident
Based on work control documents, the operator who performed the lock-and-tag
procedure determined that the electrical breaker should be locked in the open
position. The operator erred, locking the breaker in the closed position,
after which he physically challenged the plastic lockout device to ensure
that the breaker could not be moved. Compounding his error, he tagged the
breaker as open and subsequently entered the "locked open" information into
the log. Although procedures require independent verification of
lockout/tagout activities, a second operator performing the verification
failed to find the discrepancy.
On the next day the work scope changed, requiring that power be available to
the safety rod drive system, which in turn would allow selected safety rods
to be fully withdrawn. The new work control document specified that the
recently installed danger tag and lockout device be cleared from the breaker
(which was supposed to be locked open) and that another tag and lockout
device be installed--this time with the breaker locked in the closed
position. A third operator, performing this procedure, discovered and
reported the original lockout/tagout error. Management instructed this
operator to complete the lock-and-tag process with the breaker closed. The
operator installed the devices correctly, but he didn't physically challenge
the lockout device to ensure that it was firmly attached or that the breaker
would not open.
Line management and DOE were notified of the occurrence, and all tagouts
performed during the outage by the first two operators were checked to
identify any other errors. Orders issued that evening required that the two
operators attend a day-shift critique of the incident. Both operators were
prohibited from participating in lock-and-tag activities until the root cause
for the previous day's errors could be evaluated.
Despite these instructions, the two operators returned to the breaker to
review the incident. The operator who installed the original lock and tag
noticed the new danger tag, but he didn't realize that the lockout device had
been removed and reinstalled. To demonstrate to his colleague that the
plastic lockout device was securely attached and wouldn't open, he challenged
the device, which detached from the breaker handle and opened the breaker.
This action released a safety rod from its fully withdrawn position to a
fully inserted position. No damage occurred as a result of this action.
Causes
A critique held the next day determined that the direct causes of this
off-normal event were inattention to detail and lack of rigor during
verification. The operator who performed the original lock and tag may have
been confused by past practice, wherein the breaker in question was often
locked and tagged in the closed position. The second operator failed to
verify that the breaker was locked and tagged in accordance with the work
documents. The two operators had worked together for many years and may have
shared a sense of trust in each other's performance. The second operator
placed more emphasis on ensuring that the correct breaker had a lock and tag
installed than on ensuring that the breaker was in the correct position.
The critique also indicated that administrative controls were deficient.
Specifically, management lacked a policy providing uniform direction to all
operators on how to verify that lockout devices would prevent a change of
position for energy isolation devices. This situation contributed to the
third operator's failure to confirm that the breaker would not open.
The critique found no deficiency in the lockout devices. As verified by the
first operator, the lockout device prevents actuation of the breaker and
can't be easily detached. No change in the type of electrical locking device
is necessary, but additional administrative guidelines are needed to ensure
that devices are securely attached when locks and tags are installed.
Lessons Learned
o Management must ensure that the actual configuration of a lock-and-tag
operation is rigorously compared with specified requirements. An
established method for checking the task performed against documented
requirements will decrease the likelihood of performing a task
incorrectly. Workers should be trained to detect all credible errors for
each operation.
o Lockout devices should be verified as secure at the time of initial
lockout, thereby ensuring that these devices can't be easily
detached.
o Once work has begun on a system that has been danger-tagged and locked
out, the lockout device must never be challenged.
OSHA regulations provide considerable guidance on this subject. For example,
29 CFR 1910.147(c)(5)(ii)(C) states: "Lockout devices shall be substantial
enough to prevent removal without the use of excessive force or unusual
techniques, such as with the use of bolt cutters or other metal cutting
tools."
Reference
ID--EGG-ATR-1994-0005
Water Rescues
Rescue Plans Must Be Effective
Water rescue plans must include special provisions to ensure that rescue
operations are conducted effectively. A Massachusetts construction firm was
recently fined by OSHA for relying on a rescue plan that was impractical, if
not unworkable.
The Incident
In May 1993, the construction firm of Daniel O'Connell's Sons began work on
the Memorial Bridge, which spans the Connecticut River and connects the
Massachusetts towns of Springfield and West Springfield. On July 2, 1993,
workers were removing steel brackets from exposed concrete support beams.
When a carpenter was unable to remove the brackets while standing in a basket
suspended from a crane, he consulted a foreman. The two subsequently
decided that someone would have to walk out on the beam and attach a line to
the brackets, which could be lifted by a crane.
The carpenter donned the necessary safety equipment for the job--a life vest,
a safety harness, and a lanyard. The carpenter intended to attach the other
end of the lanyard to reinforcing bars that protruded from the concrete. When
he stepped onto the beam, he stubbed his toe, lost his balance, and fell into
the river--50 feet below. He sustained minor scrapes as he fell but was not
seriously injured. When he surfaced, he yelled that he was all right,
indicating that his co-workers shouldn't dive in after him.
Because the company's rescue skiff was kept in a trailer locked in a shed, a
police officer at the scene volunteered the services of a police boat. The
site supervisor accepted the offer without attempting to retrieve the skiff.
By the time the police boat reached the carpenter, he had been floating
downstream in a strong current for about 20 minutes.
OSHA Citation
After this incident, OSHA fined Daniel O'Connell's Sons $35,000 for violating
29 CFR 1926.106(d), which requires that "at least one lifesaving skiff shall
be immediately available at locations where employees are working over or
adjacent to water." (The fine was upheld by an administrative law judge but
is currently being reviewed.)
OSHA argued that because the skiff at the job site was locked in the shed, it
couldn't be accessed and launched in a timely manner. Although the company
kept skiffs in the water or at the water's edge at other sites, management
feared vandalism at this particular location and kept the skiff where it
would be safe. In the event of an emergency, the skiff could have been
launched by towing the trailer to a launch ramp half-a-mile away or by
launching it from the bridge by crane. OSHA concluded that both methods were
unsatisfactory.
The procedure for launching the boat via the ramp required 8 minutes, which
OSHA considered an optimistic estimate--the truck used to haul the boat was
also used for other purposes and might be unavailable. Traffic on the bridge
was heavy, which could further delay the truck. Moreover, no one was
designated to drive the truck, and the boat could not be launched unless the
supervisor--who would pilot the boat--was present.
Launch by crane was equally problematic. There was only one crane on the
bridge, and workers had not practiced using it to launch the boat. Further,
workers did not have a plan for getting rescue personnel into the boat once
it was in the water.
The U.S. Department of Labor classified this violation of 29 CFR 1926.106(d)
as "willful." Daniel O'Connell's Sons was aware of the requirement to have
the skiff "immediately available" and had been warned, before the job began,
by Massachusetts job safety officials that the skiff should be at the water's
edge.
Lessons Learned
As this incident demonstrates, the best "rescue plan" is one that implements
precautions and prevents the need for a rescue. Tasks performed near bodies
of water, however, should always include plans for rescuing workers from the
water. Requirements for safety belts, lanyards, and lifelines (29 CFR
1926.104); safety nets (29 CFR 1926.105); and guardrails (29 CFR 1910.23) may
also be relevant. The necessary precautions for water rescue plans are stated
in 29 CFR 1926.106, which requires the following:
o *Use of U.S. Coast Guard-approved life jackets when there is a danger
of drowning,
o *Inspection of jackets for defects before and after each use,
o *Provision of ring buoys (with at least 90 feet of line) spaced at
intervals of 200 feet or less, and
o *Ready access to a lifesaving skiff.
Effective rescue plans should be developed for other situations as well,
especially for confined spaces (see "Dead Heroes Don't Make Good Rescuers" in
the July-August 1994 issue of the Observer). Effective use of safety
equipment, such as safety harnesses and lanyards, can negate the need for
rescue operations. Should a rescue situation arise, however, a good rescue
plan can make the difference between life and death.
Toxic Gas Cylinders
Changeout Guidance Developed
On April 15, 1994, about 20 pounds of chlorine were accidently released from
the chlorination system for the potable water supply at Argonne National
Laboratory-West (ANL-W). As a result, 40 workers were exposed, 1 of whom
required hospitalization (see "Workers Exposed to Chlorine Gas," July-August
1994 issue of the Observer). A Type A Accident Investigation Board
determined that, among other deficiencies, procedures that might have
prevented the event did not exist. Although site procedures dealt
generically with safe cylinder changeout, procedures specifically for
chlorine cylinders had not been developed.
Good Practices Workshop
Lessons learned from the accident were discussed at an August 2-4, 1994,
complex-wide workshop held in Idaho Falls. Participants familiar with
maintenance and operations issues, including several individuals from private
industry, identified good practices to be used in developing procedures for
safely changing cylinders that contain chlorine or other gases.
One speaker experienced with chlorine water treatment systems claimed that up
to 95 percent of all leaks from chlorine cylinders occur during installation,
changeout, or handling. Adherence to safe practices and proper procedures
during these evolutions could eliminate the risk of such leaks. Participants
identified basic elements of a safe chlorine cylinder changeout
operation--including precautions, changeout activities, and ongoing
maintenance--that would provide a starting point for developing suitable
procedures.
Precautions. Several precautions should be taken to ensure safety before
changeout begins. First and foremost, management must ensure that only
trained and qualified operations and maintenance personnel are assigned to
perform changeouts. Workshop participants developed basic good practices
that should be included in safety and operations training for affected
personnel (see the "Safe Practices for Chlorine Cylinder Changeout" insert in
this issue). At ANL-W, for example, site personnel who work near toxic
gases should be familiar with the characteristics, properties, and hazards
associated with those gases. (Material safety data sheets provide this
information.) In addition, knowledge of first-aid techniques and emergency
responses for uncontrolled leaks of each toxic gas present can help offset
potential negative consequences.
Operations training is necessary to ensure that personnel have an appropriate
level of knowledge and skill for changing out gas cylinders safely. Workshop
participants identified several elements that should be part of a training
program for changing out cylinders of toxic gases. Operators should have
general operating experience; understand how related systems function; and be
familiar with related operational tests, failure modes, and the location and
operation of alarm systems. As part of this training, system walkdowns and
procedure walkthroughs are crucial.
A number of additional precautions to ensure safety around chlorine gas
cylinders were suggested by workshop participants, including the
following:
o *Limit accessibility to cylinders by securing them in locked
areas;
o *Wear appropriate personnel protective equipment, including full-face
respirators, long-sleeved shirts, leather gloves, and hard hats;
o *Always use the buddy system during changeouts;
o *Never use lubricants on gas cylinder parts; and
o *Provide the emergency response team with information about the time and
location of planned changeouts for chlorine and other toxic gas
cylinders.
Changeout Activities. Before changeout begins, a written work order should
be issued. At ANL-W, investigators determined that although the incident
involved a hazardous operation, the fact that work on chlorine systems was
"nonnuclear"--and thus not consided as particularly risky--led to the use of
informal operational procedures. This situation was identified as a
contributing cause of the accident. A formal work control system would
ensure that job-related hazards are assessed before work begins and that only
qualified personnel will perform the changeout procedure.
General procedures for gas cylinder changeout may not always be adequate to
address the specific hazards associated with cylinder evolutions for
particular toxic gases. For this reason, workshop participants identified a
series of safe practices that would provide a sound basis for changing out
specific types of gas cylinders (see insert). These practices apply to
activities such as verifying that the cylinder is indeed empty, disconnecting
the cylinder, and connecting the replacement cylinder.
Ongoing Maintenance. Workshop participants also discussed ongoing
maintenance of toxic gas systems. Individual comments emphasized the
importance of using manufacturers' recommendations to formulate maintenance
plans. Participants noted that maintenance personnel are exposed to many of
the same hazards as operators and should therefore have the same level of
hazard awareness training. Periodic response testing of toxic gas alarm
sensors is also necessary to ensure operability and accuracy. Finally,
personnel at chlorine water treatment plants should participate with industry
groups (e.g., the American Water Works Association) to discuss mutual
concerns related to operating experience and equipment problems.
Lessons Learned
The ANL-W accident illustrates the following lessons related to handling
and storing toxic gas cylinders:
o *Access to toxic gas systems should be restricted to personnel who are
specifically qualified to work on or near these systems.
o *A formal work control system should be required for toxic gas cylinder
changeouts.
o *General procedures for gas cylinder changeout should address the
hazards associated with cylinder changeouts for specific gases.
o *Personnel should wear appropriate personal protective equipment during
cylinder changeouts.
o *Safe practices should be identified and proper procedures should be
implemented to reduce the risk of leaks during toxic gas cylinder
changeouts.
o *A general inspection of the toxic gas system station should be
accomplished during each cylinder changeout for potential operational or
maintenance deficiencies.
o *Rescue capabilities, including appropriate medical resources, must be
preplanned and exercised.
Avoid Hearing Loss
Worker Exposed to Noise of Explosion
Workers who are subject to constant, loud noise may not realize that their
hearing could be damaged by a condition that is far less dramatic and obvious
than other workplace hazards. An accidental exposure to the sound of an
explosion served as a reminder of the danger posed by noise in the workplace.
A Close Call
A training course on explosives safety held at Sandia National Laboratories,
New Mexico, included a demonstration of an explosive device set off in a
specially designed area. Trainers prepared the demonstration and took
appropriate steps to ensure that trainees would be protected from noise and
projectiles produced by the explosion.
Trainers did not take similar steps, however, to ensure that passersby would
also be protected. Just as the explosives were detonated, a worker passed an
open door that led to the demonstration area. Although he was shielded from
projectiles caused by the blast, the noise of the explosion hurt his ears.
He immediately reported to the Occupational Safety Medicine Center, where his
hearing was checked and found to be normal. A safety official at the scene
concluded that the worker had merely been startled: having his hearing
checked, however, had been a sensible precaution.
This incident was due in large part to chance--the worker had passed the open
door just as the explosion occurred. Sandia safety personnel rightly
concluded that specific safety measures were required to prevent a recurrence
of similar incidents in the future, and they immediately took steps to ensure
that blasting areas were secure from inadvertent entry.
Noise in the Workplace
In this instance, the unsuspecting worker was not injured by the noise of the
explosion. Although loud bursts of noise can damage hearing, permanent
hearing loss often occurs gradually through constant exposure to noise in the
workplace. According to one estimate, 9 million workers may be regularly
exposed to noise levels above 85 dB(A) (decibels on the A-weighted scale),
the point at which hearing damage can begin to occur. The National Institute
for Occupational Safety and Health estimates that, in manufacturing alone, 1
million workers suffer from job-related hearing loss.
As the following list demonstrates, hearing loss is not the only danger that
can result from exposure to noise:
o *Noise can disrupt communication, obscuring alarms, speech, and other
sounds. Noise can prevent a worker from hearing a shouted warning.
o *Noise can impair the quality of the conduct of work, especially when
reading is involved.
o *Noise can annoy workers, sometimes leading them to rush a job or
causing a breakdown in teamwork.
o *Exposure to high levels of noise can cause a temporary hearing loss,
known as temporary threshold shift. Temporary tinnitus (a ringing,
roaring, or hissing sound in one or both ears) can also occur.
o *Prolonged exposure to high levels of continuous noise or bursts of
noise (e.g., from a jackhammer) can lead to permanent hearing loss. In
some cases, permanent tinnitus can result.
OSHA regulations set forth in 29 CFR 1910.95 govern noise exposure in the
workplace. 29 CFR 1910.95(c) specifically establishes an action level of 85
dB(A). Workers routinely exposed to 85 dB(A) or above must participate in a
hearing conservation program. At a minimum, such programs must include
periodic noise monitoring, audiometric testing of exposed workers, use of
hearing protection, and worker training on hearing conservation measures. In
addition, DOE 5480.4 requires that an 85 dB(A) threshold limit value for
noise exposure, established by the American Conference of Gvernmental
Hygienists, be observed for all contractor operations.
The louder a noise, the shorter the time workers can be safely exposed.
Noise above 85 dB(A) is cause for concern. Constant exposure to noise has a
cumulative effect over the life of a worker. Other effects--disrupted
communication, impaired task performance, and annoyance--can also occur at
noise levels below 80 dB(A).
Dealing with Noise
If you are concerned about the noise level in your work area, a trained
safety professional should be contacted. For example, an industrial
hygienist can determine whether the work area conforms to 29 CFR 1910.95 and
whether noise is likely to have an adverse effect on safety.
The preferred method for mitigating the effects of noise--that is, quieting
the source--can be accomplished by isolating or dampening noisy equipment, by
changing the speed at which equipment operates, or by other mechanical
means.
If a noise can't be quieted at the source, then it should be enclosed.
Materials to shield workers should be installed, or noisy equipment should be
moved. (Moving the equipment is the more effective measure against
high-frequency noise because low-frequency sounds tend to travel farther.)
If noisy equipment can't be moved or isolated, the worker should be
physically isolated from its effects; for example, soundproof rooms can be
provided. At an absolute minimum, earplugs and earmuffs can be used to
protect workers' hearing during a potentially noisy operation.
Reference
ALO-KO-SNL-TA2IGLOO-1992-0001