EH-9306 Issue No. 6, June 1993 Occupational Safety Observer
JUNE 1993
Occupational Safety Observer
Tunneling Accident
Fatal Accident at Superconducting Super Collider
Experienced work crews are often given substantial freedom to
accomplish their tasks. However, as a recent incident at the
Superconducting Super Collider (SSC) site shows, even experienced workers
need training, procedures to follow, and management oversight to ensure
that their work practices are safe. This article presents selected
findings from the investigation into a fatality at this DOE site.
The accident
On January 29, 1993, an employee of a construction subcontractor was
fatally injured during the construction of a tunnel at the SSC near
Waxahachie, Texas. The work crew was using a tunnel-boring machine that
erects tunnel liner segments as it bores. During the erection of a
precast concrete tunnel liner segment, the mechanical arm that held the
segment in place unexpectedly retracted and a 6,400-pound concrete liner
segment fell. A worker who was underneath the segment was pinned to the
tunnel-boring machine by the segment and was fatally injured.
The investigation
A DOE Type A investigation was conducted to determine the root causes
and contributing factors in this accident. The reason the arm retracted
could not be definitively established, but the investigation yielded a
number of important findings.
The accident occurred during the day shift and involved a work crew
that had several years' experience working together in tunneling
operations. Perhaps as a consequence of the crew's years of safe
operations, its members received no job-specific training when they
began work on the SSC tunnel, even though they were working at a new site
with new equipment. One worker had been trained by the tunnel-boring
machine manufacturer on how to operate the equipment. Another worker (who
was receiving on-the-job training on operating the equipment) was at the
controls when the fatal accident occurred.
Work crews were given a great deal of autonomy in developing their
own methods for digging the tunnel and installing the tunnel liners. The
investigation revealed that the day and night crews used different methods
for installing the tunnel liners. The day crew's technique put workers at
risk by positioning them under the partially erected liner segments;
the technique used by the night crew avoided this risk. Neither crew was
governed by formal procedures for the work being done. The accident
investigation report notes that verbal statements were made to the effect
that "there was no reason for procedures because the crew was experienced
and had worked together on [another] tunneling project . . . for at
least six years."
The investigation also revealed that the tunnel crews were subject to
very little management oversight. It is unclear whether managers knew
that the two crews were using different methods for doing the same work.
Occupational Safety OBSERVER Page 2
Lessons learned
This incident offers several general safety lessons for other DOE
sites:
o Workers should receive formal training any time they work with
new equipment or take on new assignments. Members of this crew
had a great deal of experience with tunneling, but they were new
to the equipment and the site.
o Clear procedures are necessary to ensure that work practices are
consistent and safe. In this incident, the lack of procedures
allowed two shifts to develop different methods for the same job,
one of which was inherently risky.
o Managers are responsible for overseeing the safety of their work
sites, no matter how much they trust their crews. It is the job
of all managers -Ä DOE, contractor, and subcontractor -Ä to know
who's doing what, what's going on, and what the safety
implications are.
Remember: Experience does not guarantee safety!
Followup
Fatality at Oak Ridge K-25 Site
In the February 1993 issue of the Observer, we described an accident
that occurred at the Oak Ridge K-25 Site on Saturday, November 14, 1992.
The accident occurred when a polyethylene tank was being lifted during a
hoisting and rigging operation. One of the straps supporting the tank
broke. The tank fell, fatally injuring one of the workers who was
guiding it into place. Our earlier coverage of the incident focused on
safety guidelines for hoisting and rigging; in this issue, we will
highlight some of the findings identified in the Type A Accident
Investigation (AI) Board Report.
The investigation
The AI board found a number of root causes and contributing factors
related to this incident.
First, schedule pressure emphasized production and compromised
safety. Workers faced a regulatory-driven compliance schedule, and work
on the K-25 waste disposal project was behind schedule. Confronted with
such time constraints, contractor management proposed process improvement
modifications, including the installation of two tanks designed to improve
the efficiency of the sludge dewatering system. Because of the pressure
of the schedule, the tanks were to be installed as soon as they arrived.
In addition, project planning and management were less than adequate,
further contributing to the accident. On a routine basis, work activities
Occupational Safety OBSERVER Page 3
that were to be conducted at the site during the weekend were planned the
previous Wednesday. Because of a delay in delivery, the tanks did not
arrive at the site until Friday, and their installation was not
included in the published schedule of activities for the weekend of
November 14, 1992. Consequently, as stated in the investigation report,
"[contractor] management had no planning mechanism to react to the late
delivery of the tanks." It was decided to install the tanks without a
formal work plan, and without a job safety analysis. All work directions
were given orally, leading to uncertainty about worker and management
roles, responsibilities, and oversight functions.
Improper selection of rigging equipment also contributed to the
accident. The investigation report notes that "planning for any hoisting
or rigging operation involves the selection of proper equipment." Proper
equipment is equipment that is designed for a specific job and verified to
be in good condition. Several equipment deficiencies were involved in
this accident:
o Tie-down straps were inappropriately used as lifting slings.
o One of the tie-down straps had a 0.6-inch tear. This strap
should have been removed from service.
o Workers were positioned beneath the load. Because tending lines
were not used to maneuver the suspended load, workers had to
place themselves under the tank to guide it into place.
o A telescopic-boom forklift was used for a job that required a
crane.
Lessons learned
This incident suggests a number of points that should be of interest
throughout the DOE complex, including the following lessons learned:
o Safety should be the first priority, even when you're facing
schedule pressures. As the investigation board points out,
"Schedule pressure must be managed with an emphasis on worker
safety and health as well as protection of public safety and the
environment."
o Job planning is essential to ensure safety. With proper job
planning, the workers might have known the hazards posed by the
job and the safest way to position the tank. They might also
have been able to ensure that appropriate equipment was
available.
o The right equipment should be used for each job. If the right
equipment is not readily available, workers should take the time
to acquire it. Managers should ensure that jobs are planned and
equipment is maintained so that the appropriate gear will be
available.
Occupational Safety OBSERVER Page 4
Piper Alpha, Part 1
Disaster on Off-Shore Oil Platform
The worst accident in the history of off-shore oil exploration
occurred in the North Sea on July 6, 1988, when the Piper Alpha oil
drilling and production platform exploded and was consumed by fire. One
hundred and sixty-seven workers perished. Oil production in
the field was resumed in February 1993 after having been suspended for 5
years. This month and next month, the Observer will review several
aspects of the Piper Alpha disaster. Although this accident occurred on
an oil platform, it provides useful lessons for DOE -- the accident was a
result of errors in processes that are very similar to processes that
occur daily throughout the DOE complex.
We begin by examining a primary cause of the disaster Ä reliance on
informal lockout/tagout and shift turnover practices that prevented
critical information regarding an out-of-service valve from being
communicated to the incoming shift.
Because of the magnitude of the disaster, many witnesses died and
much of the physical evidence was destroyed. The account that follows,
which is based on the British government's recently released two-volume
inquiry, is a reconstruction of the events based on the best evidence
available.
The explosion
On the morning of July 6, 1988, maintenance workers on Piper Alpha
began what should have been a routine task Ä the removal of pressure
safety valve (PSV) 504. Piper Alpha had some 300 pressure safety valves,
each of which had to be recertified every 18 months. PSV 504 was located
in an area known as C module and was fitted into the piping system that
handled condensate, a naturally occurring light hydrocarbon liquid that is
a component of petroleum production. Specifically, PSV 504 was located
downstream of condensate injection pump A, which was shut down for other
maintenance, although that work had not begun. Condensate injection pump
B was operating in its place, pumping condensate to the main oil line, and
supplying condensate to fuel the generators that provided electrical power
to Piper Alpha.
Workers removed PSV 504 and, as per standard practice, fitted blind
flanges to seal the openings in the condensate pipe (see the diagram on
page 4) (Diagram not available on SPSM, see original Occupational Safety
Observer for June, 1993, for copy of diagram). The workers tested PSV 504
and, once the tests were successfully completed, attempted to arrange for
a crane to lift the valve back into place. The crane was unavailable, so
the workers, after consultation with control room staff, agreed to suspend
the work for the evening. It was about 6:00 p.m.
Platform operations continued normally until 9:45 p.m., when
condensate injection pump B tripped off line. Loss of electrical power
was now a threat: the generators were designed to switch to diesel fuel
should the supply of condensate fail, but this automatic changeover did
not always work. Consequently, operators regarded the trip as "a
situation of some urgency." When condensate injection pump B failed to
restart, the operators decided to return condensate injection pump A to
service. Maintenance personnel agreed that pump A could be reactivated.
Neither the operators nor the maintenance personnel involved in this
discussion were aware that PSV 504 was not in place.
Occupational Safety OBSERVER Page 5
At this point, it becomes more difficult to reconstruct the event.
Evidence presented at the inquiry indicated that condensate injection pump
A was started locally, although no witnesses to this act survived.
Workers in the area heard a noise "like a human scream," which was
probably the screech of flammable high-pressure condensate leaking past
one of the blind flanges. In the opinion of the inquiry, this blind
flange had not been properly tightened. Gas-level alarms sounded in the
control room as an explosive cloud of gas filled C module. At 10:00 p.m.,
C module exploded.
The explosion caused extensive damage and ignited a crude oil fire
that "engulfed the north end of the platform in dense, black smoke." A
second major explosion occurred at 10:20 p.m. and was fueled by oil being
pumped to Piper Alpha from nearby platforms. Piper Alpha was destroyed
and only 61 of the 226 workers aboard survived.
The work permit system
Several factors caused the explosion on Piper Alpha, and several
other factors exacerbated the damage and loss of life that followed. This
month, the Observer will concentrate on the failure to inform the incoming
shift that PSV 504 had been removed.
The inquiry into the disaster examined Piper Alpha's work permit
system, which should have ensured that information about PSV 504 was
passed to the incoming shift Ä but did not. The investigation found "a
number of serious deficiencies of which those on 6 July were merely
specific instances." Among the deficiencies cited were the following:
o A system was not in place to tag or lock out valves consistently,
except during major shutdowns.
o Operators did not discuss active or suspended permits during
shift turnover. An operator would be aware of a permit being
suspended only if maintenance personnel brought it to his
attention during shift turnover.
o Suspended permits were not available in the control room, where
they would be accessible to operators, but were kept in the
safety office.
o Permits were not cross-referenced between jobs. In this
instance, the permit for the work on condensate injection pump A
was not cross-referenced to the permit for PSV 504. Such a
cross-reference would have indicated that condensate injection
pump A should not have been started until PSV 504 was replaced.
The inquiry found that the work permit system "put too high a premium
on informal communications" and that the explosion "can well be understood
against the background of informal and unsafe practices" on Piper Alpha.
Occupational Safety OBSERVER Page 6
Lessons for the DOE complex
The Piper Alpha accident clearly indicates the need for a formalized
lockout/tagout system. The inquiry found that the worker who apparently
started condensate injection pump A, "an experienced and conscientious
man," would not have done so had he known that PSV 504 had been removed.
A lock or tag on the injection pump would have provided that information.
Further, other methods of formal communication that would have
backstopped a lockout/tagout program were absent on Piper Alpha. These
methods of communication help ensure that operators know when equipment is
taken out of or put into service. They may include the following:
o A process should be implemented whereby maintenance personnel
actively inform operations when changes in equipment status
occur.
o Operators should play an active role in lockout/tagout
activities.
o Operators should post such information on a status board in the
control room or in other convenient locations.
o Information on equipment status should be included in a control
room log. Other useful information, such as the operator's lock
number, could also be included in the log.
Surprisingly, there is evidence that some survivors of Piper Alpha
doubted the usefulness of a formal system with these attributes. During
the inquiry, one witness was asked whether work practices on Piper Alpha
relied on informal communication. He testified that they did and defended
workers' reliance on informality: "The communication was very good. That
is the only thing I can say in defense of the system. Communication
between people working on the operations and the maintenance was very
good." However, the accident itself is testimony that informal
communication aboard Piper Alpha was not good enough.
To what extent does your facility rely on such informal
communication?
Forklift Accident
Even Routine Jobs Require Effective Communication
On March 4, 1993, during the routine transfer of radioactive waste
containers at a waste disposal trench, an improperly balanced waste
container fell from a forklift. Although no injuries occurred and the
container remained intact, the situation could have resulted in
serious injury if the container had struck a worker. Further, the
container could have been damaged, resulting in radiological
contamination. A review of the events leading to this occurrence indicate
Occupational Safety OBSERVER Page 7
that a combination of factors was at play: poor communications, a
tendency toward complacency, and inadequate training.
The incident
The incident involved containers of radioactive waste. These
containers measured 4 x 4 x 8 feet and weighed approximately 1,000 pounds.
One of these containers fell while being transferred from a flatbed truck
to a disposal trench. Normally, containers are moved one at a time, but,
in this case, the forklift driver was attempting to move two at once. The
two containers were not adequately balanced, and one container fell to the
ground while the forklift was moving from the truck to the trench.
Reportedly, the driver asked the spotter if everything was OK and received
an OK call in response. What actually transpired was that the spotter
assumed the driver knew how the lift looked and knew what he was doing.
So, the driver was relying on the spotter for good information, while the
spotter thought the driver didn't really need his assistance.
During post-occurrence meetings, the forklift driver admitted that he
knew better than to try to lift two containers at once, but that he
thought he could get away with it this time. The spotter said that he
should have stopped the lift, but assumed the driver was aware of
how the load was balanced. Both workers exhibited a certain level of
complacency, which in turn may have resulted from the routine nature of
the task. In addition, the driver's relative lack of experience on the
particular forklift being used may have contributed to the incident.
He had received his training on a smaller forklift.
Lessons learned
A combination of poor communications, complacency, and inadequate
training created a situation that could have resulted in serious injury or
radiological release. This incident suggests the following lessons
learned:
o Remind workers that even routine tasks require attention to
safety. Routine jobs may encourage complacency in job
performance, which reduces safety consciousness.
o Use formal words and signals contained in site procedures for
team communications. Spotters should not assume that drivers are
always fully aware of the situation. If a spotter has a concern,
he should warn the driver -Ä that's why the spotter is there.
o Design training to mirror operations as much as possible Ä in
this case, hands-on experience with the equipment to be found in
actual operations. The forklift driver might not have made his
error had he been trained on the type of forklift he used.
Occupational Safety OBSERVER Page 8
Cutting Torch Ignites Vapors
Chemical Tank Explosion
Inattention to safety procedures when working in an environment where
flammable liquids have been stored can produce devastating results. The
following incident, which was clearly preventable, demonstrates the price
of such inattention to safety.
The incident
On September 8, 1992, employees of, and contract workers for, a
Kansas City, Missouri, chemical distribution company were preparing empty
bulk chemical storage tanks (20,000-gallon capacity) for relocation on
company property. The above-ground metal tanks, which normally contained
liquid chemicals, were semi-permanently installed on concrete support
pads. The tanks were interconnected by steel catwalks that allowed easy
access to gauge hatches located on top of the tanks. The gauge hatches
allow the level of liquid in the tank to be measured. The tanks had
previously been used to store a variety of chemicals, including flammable
liquids.
Before any of the tanks could be relocated, the connecting catwalks
and ladders had to be removed. Because the catwalks and ladders were
welded to the tanks, their removal required the use of a cutting torch.
Four workers (two company employees and two contractors) were in the
process of cutting away these fixtures with an oxygen-acetylene
torch when a tank exploded. The explosion propelled the tank approximately
30 feet into the air. Two company employees and one contractor directly
involved in the cutting operation were killed. The fourth worker, who was
acting as the "fire watch," was injured.
Results of the investigation
OSHA investigators speculated that the explosion was caused when
sparks from the cutting torch ignited combustible fumes that were venting
through a faulty gauge cover seal on the tank. The tank that exploded had
been used to store ethanol. Although the tank had been drained of its
contents, it had not been properly cleaned and inerted. Inspection of
other tanks revealed that gauge hatch covers had been modified in a manner
that had undermined the effectiveness of the vapor seals. Although the
workers were known to have taken combustible gas indicators to the job
site, it could not be determined whether the indicators were used
correctly (if at all) at the time of the accident. Investigators found
that neither the company nor the contractor had adequately trained their
respective employees. In addition, procedures for conducting "hot work"
(welding and cutting torch) operations at the site had not been
established.
On February 24, 1993, OSHA cited the company for 15 serious alleged
violations and the contractor for 6 serious alleged violations, which
resulted in proposed penalties of $88,450. OSHA defines a "serious"
violation as one that satisfies two conditions: (1) there
was substantial probability that death or serious physical harm could
result from a hazardous condition, and (2) the employer knew or should
have known that the hazard existed.
Occupational Safety OBSERVER Page 9
Lessons learned
A company is responsible for all aspects of safety on its premises.
In this regard, no distinction is made between company employees and
contractor employees. There is a common misperception, perhaps shared by
the chemical company involved in this incident, that contractor
organizations are responsible for safety training and safety-related work
procedures for contractor employees. This assumption is incorrect. Given
the circumstances surrounding this incident, management would be wise to
ensure that contractor and subcontractor procedures are reviewed for
compliance with applicable regulations prior to authorizing the start of
any work.
Job hazard reviews and appropriate "hot work" procedures are required
to ensure awareness and control of all work, planned or in progress.
These procedures should include a permit system ensuring that structures
used to store flammables have been properly cleaned, vented, and tested
before "hot work" is authorized in their vicinity. The company
involved in this incident had no established procedures to provide this
kind of control. Procedures should be periodically reviewed in the field
to ensure that they are adequate and that workers comply with established
requirements.
Management is responsible for ensuring that workers are thoroughly
trained in the hazards associated with assigned tasks and in the
procedures that must be followed. In addition, management is responsible
for ensuring that workers are trained in the proper use of all required
safety-related equipment, such as combustible gas indicators. Appropriate
management controls should exist to ensure that workers are adequately
trained prior to being authorized to work at the job site.
Correction
In the April 1993 Observer, we reported an incident involving a lithium
fire that occurred when workers placed lithium in methanol. Based on the
information in the Occurance Reporting and Processing System (ORPS)
report, the article attributed the fire to a reaction between lithium and
water in the methanol. Hank Collins, a staff scientist at Lawrence
Berkeley Laboratory, contacted us with a correction.
Although lithium and other alkali metals are extremely reactive with
water, they also react with alcohols and other organic compounds that
contain hydroxyl (OH) radicals. Thus, the lithium would have reacted with
the methanol alone, because it is an alcohol. Any water in the methanol
would have exacerbated the reaction, but water is not required for the
reaction to occur.
Alkali metals should not be immersed in water, in compounds such as
alcohols that contain OH radicals, or in other water-soluble solvents that
might become contaminated with water.
Occupational Safety OBSERVER Page 10
DOE Order 5483.1A, dated June 1983, requires DOE compliance with OSHA
regulations, including those listed in the Observer.
The descriptions of the incidents included in this compendium are based on
information available at the time of publication. Articles regarding DOE
incidents are drawn from ORPS reports, accident investigation reports, and
interviews with site personnel. The following ORPS reports were used in
this issue:
Fatal accident at Superconducting Super Collider:
ORPS #HQ--URA-SSCL-1993-0001
29 CFR 1926.800, Underground construction;
29 CFR 1926.21, Safety training and education
Fatality at Oak Ridge K-25 Site:
ORPS #ORO--MMES-K25GENLAN-1992-0094
29 CFR 1910.184, Slings;
29 CFR 1926.251, Rigging equipment for material handling;
29 CFR 1910.178, Powered industrial trucks
Disaster on off-shore oil platform:
29 CFR 1910.119, Process safety management of highly hazardous chemicals;
29 CFR 1910.147, The control of hazardous energy (lockout/tagout)
Even routine jobs require effective communication:
ORPS #RL--WHC-SOLIDWASTE-1993-0012
29 CFR 1910.178, Powered industrial trucks
Chemical tank explosion:
29 CFR 1910.119, Process safety management for highly hazardous chemicals;
29 CFR 1926.351, Arc welding and cutting
The Occupational Safety Observer
is a publication of the
Office of Environment, Safety and Health.
For more information or corrections to the articles in this issue, please
contact:
Douglass Abramson
Operations Management Division (EH-32.1)
U.S. Department of Energy
Telephone: (301) 903-7328
For address changes and mailing list information, please contact:
John Everett
Fax: (206) 528-3552
Telephone: (206) 528-3246