EH-9404 April 1994 Occupational Safety Observer APRIL 1994 Occupational Safety Observer Pattern of Discrepancies Cited: UNSAFE WORK PRACTICES PROMPT SHUTDOWN Management is legally responsible for providing a workplace free from recognized hazards. Accordingly, prudent managers assess the safety programs of their contractors frequently and direct appropriate corrective actions. This article illustrates how management can use its legal prerogative to issue "stop work" orders to enforce compliance with safety regulations. The situation In mid-1993, the Strategic Petroleum Reserve site at Saint James Terminal, Louisiana, hired a small, local company to refurbish storage tanks used for the temporary storage of petroleum products. The storage tanks are enclosed with floating roofs, with capacities ranging from 200,000 to 400,000 barrels. Each tank is approximately 40 feet high, with a diameter of up to 300 feet. The contractor was tasked to remove all oil sludge sediments from the tanks and wash the interior surfaces with solvent. The contractor was then instructed to inspect the tanks, to conduct nondestructive testing, to repair any defective areas, to sandblast rusted areas, and, finally, to prime and paint all tank surfaces. Because tanks are enclosed structures, the atmosphere was considered potentially hazardous and all inside work activities were expected to comply with confined space regulations (29 CFR 1910.146). During routine inspections between July and December 1993, site management issued eight safety violation reports, citing the contractor for incidents such as failure to use respiratory protection and working on the roof of the tank without using harnesses to protect workers against falls. A management review of these violations concluded that a pattern of deficiencies had been established, and questioned the contractor's commitment to providing a safe work environment. Management further concluded that a condition of imminent danger existed. Management then notified the contractor that no additional work would be authorized without the specific permission of the site manager. The contractor was instructed to retrain all workers on safety procedures, to provide a written corrective action plan to resolve all previously identified safety discrepancies, and to develop and implement a proactive plan to prevent recurrence of similar safety violations. The contractor complied with these instructions and was subsequently authorized to return to work. Lessons learned This set of circumstances suggests the following lessons learned relative to management's role in establishing an effective safety standard: -- Management is legally responsible for safety in the workplace, and this responsibility cannot be delegated. Before a task is begun, it is management's responsibility to ensure that required safety programs are in place and that all contractors comply with established requirements. Managers should establish aggressive inspection programs to evaluate the safety practices of all contractors. Moreover, managers should recognize that small firms often maintain only the minimum safety resources required for a given task. -- The underlying goal of safety programs is to prevent accidents and incidents. Although dramatic corrective actions, such as a stop work order, are often taken in response to a major accident, a stop work order may be equally necessary to correct a series of small violations. In this case, management properly determined that, based on a pattern of discrepancies, dramatic corrective action was justified. Although floating-roof tanks for crude oils aren't covered by OSHA regulations, 29 CFR 1910.119, "Process Safety Management of Highly Hazardous Chemicals," does require contractors to comply with OSHA safety requirements for hazardous atmospheres inside tanks. This standard also serves as a model for managing these hazards. Reference ORPS HQ--SPR-SJ-1993-0006 Glass Shatters: BIOASSAY PROCEDURE CAUSES FIRST-DEGREE BURNS In December 1993 at Rocky Flats Plant, a lab technologist sustained first-degree acid burns to her chin and neck when a glass column containing a 50-percent nitric acid solution shattered during a routine bioassay. Before beginning the procedure, the technologist washed and inspected the column for cracks, but observed no imperfections. When the bioassay was being performed, the acid solution did not flow through the column because of a blockage. The technologist unsuccessfully attempted to clear the blockage by inserting a glass rod into the top of the column. She then applied air pressure manually with a rubber bulb. Unable to withstand the pressure, the column shattered and splashed the acid solution onto the victim's face and neck. Another incident In September 1993, the Observer reported a similar incident in which a glass vessel ruptured because of overpressurization. In each instance, the injured technologist wore personal protective equipment (PPE), was properly trained, and followed standard laboratory practices. In both cases, the glass vessels themselves constituted the unpredictable element. Even though inspection of a vessel may indicate that it is intact, the fragile nature of glass and the chance of an unperceived imperfection make failure of the vessel difficult to predict. A reassessment of these incidents suggests that using plastic rather than glass containers could provide a partial solution to this problem. However, the conditions that caused the rupture should also be addressed. Too much pressure can result from operator error or inadequate safety awareness, as well as from faulty materials or unforeseen circumstances. These issues require constant review and training so that appropriate laboratory procedures for mixing, handling, and storing corrosive or hazardous materials are followed. Wearing PPE appropriate to the task is also essential to safety. A full face shield, used in conjunction with protective gloves and apron, might have prevented the acid burn incident at Rocky Flats. Lessons learned When dealing with hazardous materials, "forewarned is forearmed." Always expect the unexpected when working with glassware and chemicals, and follow the precautions suggested below: -- Understand the hazards of the chemicals you're working with, and be aware of safety limits. -- Establish frequent training in proper methods for handling hazardous materials, and know the physical limitations of their containers. -- Consider alternative techniques and materials--for example, when appropriate, substitute plastic for glass. -- Use PPE to maximize its effect, and work in accordance with established safety procedures. OSHA requirements specified in 29 CFR 1910.1450 establish guidelines for developing a chemical safety plan for laboratories. Such a plan should include procedures for the type of operations in which these incidents occurred. Reference RFO--EGGR-SUPPORT-1993-0027 Four Injuries: SLIPS AND FALLS Four workers have recently been injured in seemingly minor falls. These accidents illustrate the danger associated with descending stairs or climbing on equipment. The accidents On November 12, 1993, a Building Safety Services technician at Brookhaven National Laboratory fell while performing a radiological contamination survey. When the accident occurred, he was wearing Tyvek anticontamination coveralls and plastic booties. The booties had been borrowed from another working group, and the technician was unfamiliar with their use. He was also performing an unfamiliar task. Consequently, he was not wearing rubber shoe covers over the booties to provide extra traction. While descending a stairway to a basement, he slipped and fell. He was slightly injured and his Tyvek suit ripped, allowing the clothing underneath to become contaminated. There was no contamination to his skin, however, and he returned to work the next day. After the incident, management distributed a memo about the dangers of walking in plastic booties. An employee at the Hanford Plutonium Finishing Plant was more seriously injured on January 4, 1994, when he slipped and fell while descending an interior stairway. Because his hands were full, he did not use the handrail. He broke three bones in his ankle, was hospitalized overnight, and required surgery. The stairwell was well lighted, and there were no objects on the stairs that could have caused him to trip or slip. A third accident occurred at the Nevada Test Site on November 18, 1993, just past midnight. A firefighter beginning his shift was performing a routine inspection of a fire truck. He fell as he stepped off the truck, striking his shoulder on the concrete floor. There was no grease or oil on the floor, and investigators concluded that he simply let go of the handrail too soon. He returned to work the next week, but his shoulder injury required surgery, which was performed 2 months after the accident. Firefighters at the Nevada Test Site no longer perform truck inspections at night. The fourth accident occurred at Lawrence Livermore National Laboratory on December 17, 1993. A worker descending an outside stairway missed a step and fell. Although he was only two steps from the bottom, he twisted his ankle and later required surgery at a local hospital. The ORPS report attributed the accident to "inattentiveness on the part of the employee combined with human error." The report indicates that the stairwell was properly lit, the stair treads were made of a nonslip grating, the stairs were checked daily for leaves and debris, and the worker's eyesight was good. Lessons learned These accidents indicate that slips and falls are common in the workplace and can be dangerous--three of the four victims required surgery. These accidents also indicate that you don't have to fall very far to hurt yourself--one victim fell a distance of only two steps. Data from the National Safety Council indicate that just over 17 percent of all industrial accidents are falls. Indeed, many fatal falls occur from heights of less than 6 feet. The first accident could have been prevented had the worker been properly trained in the use of plastic booties, and the second accident might have been avoided if the worker's hands had not been full. More significantly, all four accidents demonstrate the need for care when descending stairs and when stepping on or off elevated surfaces. References CH-BH-BNL-BNL-1993-0030 RL--WHC-PFP-1994-0001 NVOO--REEC-EHD5-1994-0001 SAN--LLNL-LLNL-1993-0080 500-Ton Rock Slab Falls: MINING ACCIDENT KILLS WORKERS Without warning, a 500-ton slab of rock recently fell from the roof of a mine, killing two workers. The accident occurred on September 9, 1993, in a Virginia limestone mine where unsafe roof conditions had previously been identified by mine workers and their supervisor. As described in this article, the accident was ultimately attributed to management's failure to provide adequate oversight and to control dangerous conditions. The incident The accident occurred in an area of the mine where workers were involved in blasting operations. Normal mining practice after blasting is to clear away loose rock from the floor and to remove any "scale" remaining on the walls, face, and roof. Various techniques are employed for these operations. At this mine, buckets were used to hoist crews to the roof area, where pry bars were used to "bar down" the loose material. (Pry bars can be up to 4.1 meters long and can be used to exert considerable leverage.) During hand-scaling operations at the accident site, a hairline seam in the roof was spotted by the scalers, who in turn reported the seam to their foreman. Company policy dictated that the foreman be contacted to decide what course of action should be followed--for example, whether further scaling, drilling, or blasting operations should be attempted. The scaling crew and the foreman (five or six people) then attempted to bar down the rock. Because these efforts failed, crew and foreman alike believed that the area was safe. No further attempts were made to dislodge the rock or to reinforce the roof--for example, with ceiling bolts. At the time the accident occurred, two workers were operating a jumbo drill to bore "rounds" (blast holes) into the rock face of the excavated chamber in which the hairline seam had been found. Sometime during the drilling operation, a rock slab measuring approximately 120 x 22 x 9 feet broke loose and fell, crushing both the workers and their equipment. The accident, depicted in the illustration took place at some point between 2:10 p.m. and 4:10 p.m. (The exact time is not known because no one else was present.) The Mine Safety and Health Administration (MSHA) conducted an investigation and attributed the accident to management's failure to assess conditions accurately and to implement appropriate actions for supporting or removing the rock slab after hand-scaling proved ineffective. In addition to finding management at fault, MSHA officials recommended that the mining company consider using a mechanical scaler and that closer attention be paid to spot bolting. The company was also directed to modify its training program to educate miners about preventive measures, including identification of hazardous conditions like those associated with this tragedy. Lessons learned This industrial accident suggests several lessons that are applicable to DOE operations, including the following: -- Work conditions and potentially dangerous situations must always be thoroughly assessed. When a proper job hazard analysis is conducted, hazards associated with planned work activities can be identified--and minimized--before work begins. -- Pre-job planning and independent review of workplace hazards are necessary to ensure safety. Those who actually perform the work are sometimes too close to the job to recognize potential hazards. -- Workers who observe potential hazards should promptly communicate these conditions to management, which in turn should act to resolve or mitigate those hazards. Many conclusions can be drawn from this accident. First and foremost, management has an obligation to respond to worker concerns about safety. In this case, one group of workers brought a potentially unsafe condition to the attention of management--a condition that was never adequately resolved. Subsequently, other workers entered the area expecting safe working conditions and instead were met with death. *The following article was submitted by one of our readers. If you would like to submit an article, contact the Coordinating Editor.* Part 3: STEAM LINE WATER HAMMER: CAUSE AND PREVENTION by Ken Laliberte, Stone & Webster Engineering Corporation The September and October 1993 issues of the Observer reported on lessons learned from a June 1993 fatality at the Hanford Site. The accident occurred when a water hammer caused a valve to fail catastrophically, releasing large amounts of steam into an enclosed underground pit where an employee was working. This article examines two of the lessons learned from the accident: (1) steam system design factors, such as the size, type, and placement of traps, drains, and bypass valves, are critical to safe operation, and (2) operational concepts, such as how sections of the system are taken out of and returned to service, sometimes have to be changed to accommodate the ways and the extent to which the actual design differs from a technical ideal (that is, drain valves and bypass valves not installed where needed). Causes of water hammer Water hammer is defined as the change in fluid pressure in a closed circuit caused by a rapid change in fluid velocity. This pressure change results from conversion of kinetic energy into pressure or conversion of pressure into kinetic energy. Water hammer in steam lines can be caused by (1) gradual accumulation of condensate during normal operation, (2) steamline water entrainment, and (3) introduction of subcooled condensate into steam-filled lines. Unless condensate is removed from low points in the steam main, it gradually accumulates until the condensate so restricts steam flow that a slug of condensate is carried down the main by the steam. The slug of water travels at the speed of the steam (which may be in excess of 100 miles per hour) until it reaches an obstruction like a reducing valve, a temperature regulator, a steam trap, or simply a change in the direction of the steam piping. The slug of water slows suddenly or stops completely, often with disastrous effects on the equipment. Steamline water entrainment is generally caused by opening a steamline isolation valve rapidly, admitting steam into a line that has not been warmed up properly, which causes the steam to condense and form a water slug. A water hammer can also occur when large quantities of subcooled condensate are admitted into a saturated steam space, which most often occurs when an isolated portion of the system is returned to service. The cool water, acting as a heat sink, rapidly condenses steam and causes a vacuum. The vacuum may suck the water into its space at high velocity. A steam hammer can occur when small quantities of condensate are passed into a hot, lower pressure steam space. The subcooled condensate flashes into steam, causing a rapid increase in volume and increasing the pressure equivalent to saturation conditions. This dynamically created pressure may break or damage piping components. Condensate control Controlling condensate accumulation in steam lines (principally through drainage) is critical in preventing water hammers and is accomplished by proper system design and operation. Proper operation depends on having an appropriately sized condensate drain system to prevent condensate accumulation, as well as features such as vents, drains, and bypass valves to provide for safe system startup. Steam traps are the main elements of a drainage system, and for most steam trap applications, thermal efficiency is not the prime objective--safety is. Inadequate drainage is a common cause not only of water hammers, but of damaged controllers and steam traps, as well as leaking joints. Proper draining of mains and care in starting up cold mains not only prevent water hammers, but also improve steam quality and reduce maintenance required on pressure reducing valves, temperature controls, and other automatic steam valves. Liberal steam trap load or safety factors and oversized steam traps do not necessarily provide a safe and efficient design for a steam main drain. A safe and efficient design should include the following: (1) an appropriate method for heat-up; (2) suitable reservoirs or "collection legs" for condensate to collect; and (3) properly selected and sized steam traps that have been properly installed. The type and size of trap used to drain steam mains will depend on the heat-up method used in bringing the steam main up to pressure and temperature. The two methods commonly used are supervised heat-up and automatic heat-up. Supervised heat-up is the method most commonly used in large, decentralized facilities, and is the method described in this article. Heat-up practices In supervised heat-up, steam main sections are heated in sequence, rather than heating the entire system at once. With manual drain valves installed at all drain points and bypass valves installed at all steam main isolations, the section of steam main to be placed in service is drained of accumulated condensate by using manual drain valves and verifying that the piping is free of all condensate. After the draining has been completed, manual drain valves in the steam main section to be heated are either closed or left open to atmosphere, depending on the effect steam would have on the surrounding area or equipment. Steam should be admitted gradually to the section being placed in service by slowly opening the bypass valve until flow through the valve is heard or until the valve is one-fourth open, whichever occurs first. A slow heat-up will limit stresses in piping caused by unequal expansion, will minimize erosion due to high velocity steam and condensate, and will protect auxiliary equipment. Draining condensate manually If the manual drain valves were closed after the piping section was drained, each drain valve must be reopened until all condensate is drained and steam is observed, after which the drain valve can be closed. This process must be repeated for each drain valve in the steam main section being heated until no condensate is observed. The bypass valve should be slowly opened further to increase steam flow and steam pressure to the section being heated, and each drain valve should then be opened to drain condensate until steam is observed. This process should be repeated for each drain valve until no condensate is observed. Continue in this manner until the bypass valve is fully open, no condensate is observed during manual draining, and steam pressure across the steam main isolation has equalized (as measured by a pressure gage on both sides of the isolation valve). Finally, the steam main isolation valve should be opened slowly and the bypass should be closed. With the drain valves closed, the steam traps will automatically remove the condensate that forms under operating conditions. Therefore, the steam traps are sized to handle only the normal heat losses at the operating temperature and pressure. A section of a steam main that lacks drain valves should never be isolated and then returned to service. Doing so requires that a section of the main in which condensate has collected be placed in service with an operational section containing saturated steam--a situation almost certain to produce a water hammer. Either of two alternatives would be preferable. The preferred method would be to isolate the system at another point (valve V-2 instead of valve V-1) so as to permit condensate to be drained manually (valve V-3) before returning the isolated section to service. If the piping section has been isolated at valve V-1, an alternative would be to close an additional isolation valve (valve V-2) downstream to a point where a drain valve is available (valve V-3), then depressurize and drain this new isolated section. These precautions will allow the original isolation valve (valve V-1) to be opened slowly (a maximum of two turns), admitting and draining the condensate. System design matters The importance of proper design--especially regarding methods for draining condensate and for system startup--for preventing water hammers in steam systems cannot be overemphasized. The ideal steam system design has safe operation of the system as its principal objective. Safety depends on two key factors: ensuring that proper condensate drainage (manual and automatic) and bypass valves are provided for all steam main isolation valves. The ideal design rarely exists, however--partly because many steam systems now operating were designed and built some time ago and do not conform to the design configurations needed to ensure proper operation. Thus, operating procedures must acknowledge that design frequently deviates from the ideal and thereby creates a potentially hazardous situation. Procedures must be structured in a manner to ensure that startup and operating routines are safe, and must compensate both for the shortcomings of the system and the certainty that operating and maintenance personnel cannot intuitively foresee all possible unsafe conditions. Only when operating procedures have achieved these objectives can training programs be developed that can reasonably be expected to develop attitudes and behaviors that will prevent serious accidents. Operations supervisors can use this information to improve safety for older steam systems at their facilities. Examples include the following: -- Walk down all steam systems and document design deficiencies; -- Determine how to operate with existing designs and modify operating procedures accordingly; -- Request that the system be modified to accommodate potential operating configurations; and -- Repair or replace malfunctioning system equipment (steam traps, valves). In addition, training should be established for engineering, maintenance, and operations personnel on how water hammer occurs in steam lines--including the actions necessary to avoid this hazard. Severe damage can be avoided if sites ensure that their steam system designs and operating practices will prevent water hammer. *Ken Laliberte is a Principal Engineer with Stone & Webster Engineering Corporation's (SWEC) Plant Operations & Services Division. He came to SWEC with over 12 years' experience in the U.S. Naval Nuclear Power Program. Mr. Laliberte has been with SWEC for over 14 years and has extensive experience in the commercial nuclear power industry in startup testing, engineering, and maintenance.*