EH-9411 Issue No. 11, 1994 November Occupational Safety Observer In This Issue Complacency Leads to Danger ......................................1 Rescue Plans Must Be Effective ...................................2 Changeout Guidance Developed .....................................3 Lineman Electrocuted .............................................4 Worker Exposed to Noise of Explosion .............................7 Improper Lockout/Tagout Complacency Leads to Danger In early March 1994, the Advanced Test Reactor at the Idaho National Engineering Laboratory underwent a scheduled outage to prepare for maintenance and for major replacement of core components. As part of that preparation, the work plan indicated that a 250-volt DC electrical breaker supplying power to the reactor safety rod drives be locked and tagged in the open position. The Incident Based on work control documents, the operator who performed the lock-and-tag procedure determined that the electrical breaker should be locked in the open position. The operator erred, locking the breaker in the closed position, after which he physically challenged the plastic lockout device to ensure that the breaker could not be moved. Compounding his error, he tagged the breaker as open and subsequently entered the "locked open" information into the log. Although procedures require independent verification of lockout/tagout activities, a second operator performing the verification failed to find the discrepancy. On the next day the work scope changed, requiring that power be available to the safety rod drive system, which in turn would allow selected safety rods to be fully withdrawn. The new work control document specified that the recently installed danger tag and lockout device be cleared from the breaker (which was supposed to be locked open) and that another tag and lockout device be installed--this time with the breaker locked in the closed position. A third operator, performing this procedure, discovered and reported the original lockout/tagout error. Management instructed this operator to complete the lock-and-tag process with the breaker closed. The operator installed the devices correctly, but he didn't physically challenge the lockout device to ensure that it was firmly attached or that the breaker would not open. Line management and DOE were notified of the occurrence, and all tagouts performed during the outage by the first two operators were checked to identify any other errors. Orders issued that evening required that the two operators attend a day-shift critique of the incident. Both operators were prohibited from participating in lock-and-tag activities until the root cause for the previous day's errors could be evaluated. Despite these instructions, the two operators returned to the breaker to review the incident. The operator who installed the original lock and tag noticed the new danger tag, but he didn't realize that the lockout device had been removed and reinstalled. To demonstrate to his colleague that the plastic lockout device was securely attached and wouldn't open, he challenged the device, which detached from the breaker handle and opened the breaker. This action released a safety rod from its fully withdrawn position to a fully inserted position. No damage occurred as a result of this action. Causes A critique held the next day determined that the direct causes of this off-normal event were inattention to detail and lack of rigor during verification. The operator who performed the original lock and tag may have been confused by past practice, wherein the breaker in question was often locked and tagged in the closed position. The second operator failed to verify that the breaker was locked and tagged in accordance with the work documents. The two operators had worked together for many years and may have shared a sense of trust in each other's performance. The second operator placed more emphasis on ensuring that the correct breaker had a lock and tag installed than on ensuring that the breaker was in the correct position. The critique also indicated that administrative controls were deficient. Specifically, management lacked a policy providing uniform direction to all operators on how to verify that lockout devices would prevent a change of position for energy isolation devices. This situation contributed to the third operator's failure to confirm that the breaker would not open. The critique found no deficiency in the lockout devices. As verified by the first operator, the lockout device prevents actuation of the breaker and can't be easily detached. No change in the type of electrical locking device is necessary, but additional administrative guidelines are needed to ensure that devices are securely attached when locks and tags are installed. Lessons Learned o Management must ensure that the actual configuration of a lock-and-tag operation is rigorously compared with specified requirements. An established method for checking the task performed against documented requirements will decrease the likelihood of performing a task incorrectly. Workers should be trained to detect all credible errors for each operation. o Lockout devices should be verified as secure at the time of initial lockout, thereby ensuring that these devices can't be easily detached. o Once work has begun on a system that has been danger-tagged and locked out, the lockout device must never be challenged. OSHA regulations provide considerable guidance on this subject. For example, 29 CFR 1910.147(c)(5)(ii)(C) states: "Lockout devices shall be substantial enough to prevent removal without the use of excessive force or unusual techniques, such as with the use of bolt cutters or other metal cutting tools." Reference ID--EGG-ATR-1994-0005 Water Rescues Rescue Plans Must Be Effective Water rescue plans must include special provisions to ensure that rescue operations are conducted effectively. A Massachusetts construction firm was recently fined by OSHA for relying on a rescue plan that was impractical, if not unworkable. The Incident In May 1993, the construction firm of Daniel O'Connell's Sons began work on the Memorial Bridge, which spans the Connecticut River and connects the Massachusetts towns of Springfield and West Springfield. On July 2, 1993, workers were removing steel brackets from exposed concrete support beams. When a carpenter was unable to remove the brackets while standing in a basket suspended from a crane, he consulted a foreman. The two subsequently decided that someone would have to walk out on the beam and attach a line to the brackets, which could be lifted by a crane. The carpenter donned the necessary safety equipment for the job--a life vest, a safety harness, and a lanyard. The carpenter intended to attach the other end of the lanyard to reinforcing bars that protruded from the concrete. When he stepped onto the beam, he stubbed his toe, lost his balance, and fell into the river--50 feet below. He sustained minor scrapes as he fell but was not seriously injured. When he surfaced, he yelled that he was all right, indicating that his co-workers shouldn't dive in after him. Because the company's rescue skiff was kept in a trailer locked in a shed, a police officer at the scene volunteered the services of a police boat. The site supervisor accepted the offer without attempting to retrieve the skiff. By the time the police boat reached the carpenter, he had been floating downstream in a strong current for about 20 minutes. OSHA Citation After this incident, OSHA fined Daniel O'Connell's Sons $35,000 for violating 29 CFR 1926.106(d), which requires that "at least one lifesaving skiff shall be immediately available at locations where employees are working over or adjacent to water." (The fine was upheld by an administrative law judge but is currently being reviewed.) OSHA argued that because the skiff at the job site was locked in the shed, it couldn't be accessed and launched in a timely manner. Although the company kept skiffs in the water or at the water's edge at other sites, management feared vandalism at this particular location and kept the skiff where it would be safe. In the event of an emergency, the skiff could have been launched by towing the trailer to a launch ramp half-a-mile away or by launching it from the bridge by crane. OSHA concluded that both methods were unsatisfactory. The procedure for launching the boat via the ramp required 8 minutes, which OSHA considered an optimistic estimate--the truck used to haul the boat was also used for other purposes and might be unavailable. Traffic on the bridge was heavy, which could further delay the truck. Moreover, no one was designated to drive the truck, and the boat could not be launched unless the supervisor--who would pilot the boat--was present. Launch by crane was equally problematic. There was only one crane on the bridge, and workers had not practiced using it to launch the boat. Further, workers did not have a plan for getting rescue personnel into the boat once it was in the water. The U.S. Department of Labor classified this violation of 29 CFR 1926.106(d) as "willful." Daniel O'Connell's Sons was aware of the requirement to have the skiff "immediately available" and had been warned, before the job began, by Massachusetts job safety officials that the skiff should be at the water's edge. Lessons Learned As this incident demonstrates, the best "rescue plan" is one that implements precautions and prevents the need for a rescue. Tasks performed near bodies of water, however, should always include plans for rescuing workers from the water. Requirements for safety belts, lanyards, and lifelines (29 CFR 1926.104); safety nets (29 CFR 1926.105); and guardrails (29 CFR 1910.23) may also be relevant. The necessary precautions for water rescue plans are stated in 29 CFR 1926.106, which requires the following: o *Use of U.S. Coast Guard-approved life jackets when there is a danger of drowning, o *Inspection of jackets for defects before and after each use, o *Provision of ring buoys (with at least 90 feet of line) spaced at intervals of 200 feet or less, and o *Ready access to a lifesaving skiff. Effective rescue plans should be developed for other situations as well, especially for confined spaces (see "Dead Heroes Don't Make Good Rescuers" in the July-August 1994 issue of the Observer). Effective use of safety equipment, such as safety harnesses and lanyards, can negate the need for rescue operations. Should a rescue situation arise, however, a good rescue plan can make the difference between life and death. Toxic Gas Cylinders Changeout Guidance Developed On April 15, 1994, about 20 pounds of chlorine were accidently released from the chlorination system for the potable water supply at Argonne National Laboratory-West (ANL-W). As a result, 40 workers were exposed, 1 of whom required hospitalization (see "Workers Exposed to Chlorine Gas," July-August 1994 issue of the Observer). A Type A Accident Investigation Board determined that, among other deficiencies, procedures that might have prevented the event did not exist. Although site procedures dealt generically with safe cylinder changeout, procedures specifically for chlorine cylinders had not been developed. Good Practices Workshop Lessons learned from the accident were discussed at an August 2-4, 1994, complex-wide workshop held in Idaho Falls. Participants familiar with maintenance and operations issues, including several individuals from private industry, identified good practices to be used in developing procedures for safely changing cylinders that contain chlorine or other gases. One speaker experienced with chlorine water treatment systems claimed that up to 95 percent of all leaks from chlorine cylinders occur during installation, changeout, or handling. Adherence to safe practices and proper procedures during these evolutions could eliminate the risk of such leaks. Participants identified basic elements of a safe chlorine cylinder changeout operation--including precautions, changeout activities, and ongoing maintenance--that would provide a starting point for developing suitable procedures. Precautions. Several precautions should be taken to ensure safety before changeout begins. First and foremost, management must ensure that only trained and qualified operations and maintenance personnel are assigned to perform changeouts. Workshop participants developed basic good practices that should be included in safety and operations training for affected personnel (see the "Safe Practices for Chlorine Cylinder Changeout" insert in this issue). At ANL-W, for example, site personnel who work near toxic gases should be familiar with the characteristics, properties, and hazards associated with those gases. (Material safety data sheets provide this information.) In addition, knowledge of first-aid techniques and emergency responses for uncontrolled leaks of each toxic gas present can help offset potential negative consequences. Operations training is necessary to ensure that personnel have an appropriate level of knowledge and skill for changing out gas cylinders safely. Workshop participants identified several elements that should be part of a training program for changing out cylinders of toxic gases. Operators should have general operating experience; understand how related systems function; and be familiar with related operational tests, failure modes, and the location and operation of alarm systems. As part of this training, system walkdowns and procedure walkthroughs are crucial. A number of additional precautions to ensure safety around chlorine gas cylinders were suggested by workshop participants, including the following: o *Limit accessibility to cylinders by securing them in locked areas; o *Wear appropriate personnel protective equipment, including full-face respirators, long-sleeved shirts, leather gloves, and hard hats; o *Always use the buddy system during changeouts; o *Never use lubricants on gas cylinder parts; and o *Provide the emergency response team with information about the time and location of planned changeouts for chlorine and other toxic gas cylinders. Changeout Activities. Before changeout begins, a written work order should be issued. At ANL-W, investigators determined that although the incident involved a hazardous operation, the fact that work on chlorine systems was "nonnuclear"--and thus not consided as particularly risky--led to the use of informal operational procedures. This situation was identified as a contributing cause of the accident. A formal work control system would ensure that job-related hazards are assessed before work begins and that only qualified personnel will perform the changeout procedure. General procedures for gas cylinder changeout may not always be adequate to address the specific hazards associated with cylinder evolutions for particular toxic gases. For this reason, workshop participants identified a series of safe practices that would provide a sound basis for changing out specific types of gas cylinders (see insert). These practices apply to activities such as verifying that the cylinder is indeed empty, disconnecting the cylinder, and connecting the replacement cylinder. Ongoing Maintenance. Workshop participants also discussed ongoing maintenance of toxic gas systems. Individual comments emphasized the importance of using manufacturers' recommendations to formulate maintenance plans. Participants noted that maintenance personnel are exposed to many of the same hazards as operators and should therefore have the same level of hazard awareness training. Periodic response testing of toxic gas alarm sensors is also necessary to ensure operability and accuracy. Finally, personnel at chlorine water treatment plants should participate with industry groups (e.g., the American Water Works Association) to discuss mutual concerns related to operating experience and equipment problems. Lessons Learned The ANL-W accident illustrates the following lessons related to handling and storing toxic gas cylinders: o *Access to toxic gas systems should be restricted to personnel who are specifically qualified to work on or near these systems. o *A formal work control system should be required for toxic gas cylinder changeouts. o *General procedures for gas cylinder changeout should address the hazards associated with cylinder changeouts for specific gases. o *Personnel should wear appropriate personal protective equipment during cylinder changeouts. o *Safe practices should be identified and proper procedures should be implemented to reduce the risk of leaks during toxic gas cylinder changeouts. o *A general inspection of the toxic gas system station should be accomplished during each cylinder changeout for potential operational or maintenance deficiencies. o *Rescue capabilities, including appropriate medical resources, must be preplanned and exercised. Avoid Hearing Loss Worker Exposed to Noise of Explosion Workers who are subject to constant, loud noise may not realize that their hearing could be damaged by a condition that is far less dramatic and obvious than other workplace hazards. An accidental exposure to the sound of an explosion served as a reminder of the danger posed by noise in the workplace. A Close Call A training course on explosives safety held at Sandia National Laboratories, New Mexico, included a demonstration of an explosive device set off in a specially designed area. Trainers prepared the demonstration and took appropriate steps to ensure that trainees would be protected from noise and projectiles produced by the explosion. Trainers did not take similar steps, however, to ensure that passersby would also be protected. Just as the explosives were detonated, a worker passed an open door that led to the demonstration area. Although he was shielded from projectiles caused by the blast, the noise of the explosion hurt his ears. He immediately reported to the Occupational Safety Medicine Center, where his hearing was checked and found to be normal. A safety official at the scene concluded that the worker had merely been startled: having his hearing checked, however, had been a sensible precaution. This incident was due in large part to chance--the worker had passed the open door just as the explosion occurred. Sandia safety personnel rightly concluded that specific safety measures were required to prevent a recurrence of similar incidents in the future, and they immediately took steps to ensure that blasting areas were secure from inadvertent entry. Noise in the Workplace In this instance, the unsuspecting worker was not injured by the noise of the explosion. Although loud bursts of noise can damage hearing, permanent hearing loss often occurs gradually through constant exposure to noise in the workplace. According to one estimate, 9 million workers may be regularly exposed to noise levels above 85 dB(A) (decibels on the A-weighted scale), the point at which hearing damage can begin to occur. The National Institute for Occupational Safety and Health estimates that, in manufacturing alone, 1 million workers suffer from job-related hearing loss. As the following list demonstrates, hearing loss is not the only danger that can result from exposure to noise: o *Noise can disrupt communication, obscuring alarms, speech, and other sounds. Noise can prevent a worker from hearing a shouted warning. o *Noise can impair the quality of the conduct of work, especially when reading is involved. o *Noise can annoy workers, sometimes leading them to rush a job or causing a breakdown in teamwork. o *Exposure to high levels of noise can cause a temporary hearing loss, known as temporary threshold shift. Temporary tinnitus (a ringing, roaring, or hissing sound in one or both ears) can also occur. o *Prolonged exposure to high levels of continuous noise or bursts of noise (e.g., from a jackhammer) can lead to permanent hearing loss. In some cases, permanent tinnitus can result. OSHA regulations set forth in 29 CFR 1910.95 govern noise exposure in the workplace. 29 CFR 1910.95(c) specifically establishes an action level of 85 dB(A). Workers routinely exposed to 85 dB(A) or above must participate in a hearing conservation program. At a minimum, such programs must include periodic noise monitoring, audiometric testing of exposed workers, use of hearing protection, and worker training on hearing conservation measures. In addition, DOE 5480.4 requires that an 85 dB(A) threshold limit value for noise exposure, established by the American Conference of Gvernmental Hygienists, be observed for all contractor operations. The louder a noise, the shorter the time workers can be safely exposed. Noise above 85 dB(A) is cause for concern. Constant exposure to noise has a cumulative effect over the life of a worker. Other effects--disrupted communication, impaired task performance, and annoyance--can also occur at noise levels below 80 dB(A). Dealing with Noise If you are concerned about the noise level in your work area, a trained safety professional should be contacted. For example, an industrial hygienist can determine whether the work area conforms to 29 CFR 1910.95 and whether noise is likely to have an adverse effect on safety. The preferred method for mitigating the effects of noise--that is, quieting the source--can be accomplished by isolating or dampening noisy equipment, by changing the speed at which equipment operates, or by other mechanical means. If a noise can't be quieted at the source, then it should be enclosed. Materials to shield workers should be installed, or noisy equipment should be moved. (Moving the equipment is the more effective measure against high-frequency noise because low-frequency sounds tend to travel farther.) If noisy equipment can't be moved or isolated, the worker should be physically isolated from its effects; for example, soundproof rooms can be provided. At an absolute minimum, earplugs and earmuffs can be used to protect workers' hearing during a potentially noisy operation. Reference ALO-KO-SNL-TA2IGLOO-1992-0001