EH-9404 Issue No. 4, April 1994 Occupational Safety Observer
APRIL 1994
Occupational Safety Observer
Pattern of Discrepancies Cited:
UNSAFE WORK PRACTICES PROMPT SHUTDOWN
Management is legally responsible for providing a workplace
free from recognized hazards. Accordingly, prudent managers
assess the safety programs of their contractors frequently and
direct appropriate corrective actions. This article illustrates
how management can use its legal prerogative to issue "stop work"
orders to enforce compliance with safety regulations.
The situation
In mid-1993, the Strategic Petroleum Reserve site at Saint
James Terminal, Louisiana, hired a small, local company to
refurbish storage tanks used for the temporary storage of
petroleum products. The storage tanks are enclosed with floating
roofs, with capacities ranging from 200,000 to 400,000 barrels.
Each tank is approximately 40 feet high, with a diameter of up to
300 feet.
The contractor was tasked to remove all oil sludge sediments
from the tanks and wash the interior surfaces with solvent. The
contractor was then instructed to inspect the tanks, to conduct
nondestructive testing, to repair any defective areas, to
sandblast rusted areas, and, finally, to prime and paint all tank
surfaces. Because tanks are enclosed structures, the atmosphere
was considered potentially hazardous and all inside work
activities were expected to comply with confined space
regulations (29 CFR 1910.146).
During routine inspections between July and December 1993,
site management issued eight safety violation reports, citing the
contractor for incidents such as failure to use respiratory
protection and working on the roof of the tank without using
harnesses to protect workers against falls. A management review
of these violations concluded that a pattern of deficiencies had
been established, and questioned the contractor's commitment to
providing a safe work environment. Management further concluded
that a condition of imminent danger existed.
Management then notified the contractor that no additional
work would be authorized without the specific permission of the
site manager. The contractor was instructed to retrain all
workers on safety procedures, to provide a written corrective
action plan to resolve all previously identified safety
discrepancies, and to develop and implement a proactive plan to
prevent recurrence of similar safety violations. The contractor
complied with these instructions and was subsequently authorized
to return to work.
Lessons learned
This set of circumstances suggests the following lessons
learned relative to management's role in establishing an
effective safety standard:
-- Management is legally responsible for safety in the
workplace, and this responsibility cannot be delegated. Before a
task is begun, it is management's responsibility to ensure that
required safety programs are in place and that all contractors
comply with established requirements. Managers should establish
aggressive inspection programs to evaluate the safety practices
of all contractors. Moreover, managers should recognize that
small firms often maintain only the minimum safety resources
required for a given task.
-- The underlying goal of safety programs is to prevent
accidents and incidents. Although dramatic corrective actions,
such as a stop work order, are often taken in response to a major
accident, a stop work order may be equally necessary to correct a
series of small violations. In this case, management properly
determined that, based on a pattern of discrepancies, dramatic
corrective action was justified.
Although floating-roof tanks for crude oils aren't covered
by OSHA regulations, 29 CFR 1910.119, "Process Safety Management
of Highly Hazardous Chemicals," does require contractors to
comply with OSHA safety requirements for hazardous atmospheres
inside tanks. This standard also serves as a model for managing
these hazards.
Reference
ORPS HQ--SPR-SJ-1993-0006
Glass Shatters:
BIOASSAY PROCEDURE CAUSES FIRST-DEGREE BURNS
In December 1993 at Rocky Flats Plant, a lab technologist
sustained first-degree acid burns to her chin and neck when a
glass column containing a 50-percent nitric acid solution
shattered during a routine bioassay.
Before beginning the procedure, the technologist washed and
inspected the column for cracks, but observed no imperfections.
When the bioassay was being performed, the acid solution did not
flow through the column because of a blockage. The technologist
unsuccessfully attempted to clear the blockage by inserting a
glass rod into the top of the column. She then applied air
pressure manually with a rubber bulb. Unable to withstand the
pressure, the column shattered and splashed the acid solution
onto the victim's face and neck.
Another incident
In September 1993, the Observer reported a similar incident
in which a glass vessel ruptured because of overpressurization.
In each instance, the injured technologist wore personal
protective equipment (PPE), was properly trained, and followed
standard laboratory practices. In both cases, the glass vessels
themselves constituted the unpredictable element. Even though
inspection of a vessel may indicate that it is intact, the
fragile nature of glass and the chance of an unperceived
imperfection make failure of the vessel difficult to predict.
A reassessment of these incidents suggests that using
plastic rather than glass containers could provide a partial
solution to this problem. However, the conditions that caused
the rupture should also be addressed. Too much pressure can
result from operator error or inadequate safety awareness, as
well as from faulty materials or unforeseen circumstances. These
issues require constant review and training so that appropriate
laboratory procedures for mixing, handling, and storing corrosive
or hazardous materials are followed.
Wearing PPE appropriate to the task is also essential to
safety. A full face shield, used in conjunction with protective
gloves and apron, might have prevented the acid burn incident at
Rocky Flats.
Lessons learned
When dealing with hazardous materials, "forewarned is
forearmed." Always expect the unexpected when working with
glassware and chemicals, and follow the precautions suggested
below:
-- Understand the hazards of the chemicals you're working with,
and be aware of safety limits.
-- Establish frequent training in proper methods for handling
hazardous materials, and know the physical limitations of their
containers.
-- Consider alternative techniques and materials--for example,
when appropriate, substitute plastic for glass.
-- Use PPE to maximize its effect, and work in accordance with
established safety procedures.
OSHA requirements specified in 29 CFR 1910.1450 establish
guidelines for developing a chemical safety plan for
laboratories. Such a plan should include procedures for the type
of operations in which these incidents occurred.
Reference
RFO--EGGR-SUPPORT-1993-0027
Four Injuries:
SLIPS AND FALLS
Four workers have recently been injured in seemingly minor
falls. These accidents illustrate the danger associated with
descending stairs or climbing on equipment.
The accidents
On November 12, 1993, a Building Safety Services technician
at Brookhaven National Laboratory fell while performing a
radiological contamination survey. When the accident occurred,
he was wearing Tyvek anticontamination coveralls and plastic
booties. The booties had been borrowed from another working
group, and the technician was unfamiliar with their use. He was
also performing an unfamiliar task. Consequently, he was not
wearing rubber shoe covers over the booties to provide extra
traction. While descending a stairway to a basement, he slipped
and fell. He was slightly injured and his Tyvek suit ripped,
allowing the clothing underneath to become contaminated. There
was no contamination to his skin, however, and he returned to
work the next day. After the incident, management distributed a
memo about the dangers of walking in plastic booties.
An employee at the Hanford Plutonium Finishing Plant was
more seriously injured on January 4, 1994, when he slipped and
fell while descending an interior stairway. Because his hands
were full, he did not use the handrail. He broke three bones in
his ankle, was hospitalized overnight, and required surgery. The
stairwell was well lighted, and there were no objects on the
stairs that could have caused him to trip or slip.
A third accident occurred at the Nevada Test Site on
November 18, 1993, just past midnight. A firefighter beginning
his shift was performing a routine inspection of a fire truck.
He fell as he stepped off the truck, striking his shoulder on the
concrete floor. There was no grease or oil on the floor, and
investigators concluded that he simply let go of the handrail too
soon. He returned to work the next week, but his shoulder injury
required surgery, which was performed 2 months after the
accident. Firefighters at the Nevada Test Site no longer perform
truck inspections at night.
The fourth accident occurred at Lawrence Livermore National
Laboratory on December 17, 1993. A worker descending an outside
stairway missed a step and fell. Although he was only two steps
from the bottom, he twisted his ankle and later required surgery
at a local hospital. The ORPS report attributed the accident to
"inattentiveness on the part of the employee combined with human
error." The report indicates that the stairwell was properly
lit, the stair treads were made of a nonslip grating, the stairs
were checked daily for leaves and debris, and the worker's
eyesight was good.
Lessons learned
These accidents indicate that slips and falls are common in
the workplace and can be dangerous--three of the four victims
required surgery. These accidents also indicate that you don't
have to fall very far to hurt yourself--one victim fell a
distance of only two steps. Data from the National Safety
Council indicate that just over 17 percent of all industrial
accidents are falls. Indeed, many fatal falls occur from heights
of less than 6 feet.
The first accident could have been prevented had the worker
been properly trained in the use of plastic booties, and the
second accident might have been avoided if the worker's hands had
not been full. More significantly, all four accidents
demonstrate the need for care when descending stairs and when
stepping on or off elevated surfaces.
References
CH-BH-BNL-BNL-1993-0030
RL--WHC-PFP-1994-0001
NVOO--REEC-EHD5-1994-0001
SAN--LLNL-LLNL-1993-0080
500-Ton Rock Slab Falls:
MINING ACCIDENT KILLS WORKERS
Without warning, a 500-ton slab of rock recently fell from
the roof of a mine, killing two workers. The accident occurred
on September 9, 1993, in a Virginia limestone mine where unsafe
roof conditions had previously been identified by mine workers
and their supervisor. As described in this article, the accident
was ultimately attributed to management's failure to provide
adequate oversight and to control dangerous conditions.
The incident
The accident occurred in an area of the mine where workers
were involved in blasting operations. Normal mining practice
after blasting is to clear away loose rock from the floor and to
remove any "scale" remaining on the walls, face, and roof.
Various techniques are employed for these operations. At this
mine, buckets were used to hoist crews to the roof area, where
pry bars were used to "bar down" the loose material. (Pry bars
can be up to 4.1 meters long and can be used to exert
considerable leverage.) During hand-scaling operations at the
accident site, a hairline seam in the roof was spotted by the
scalers, who in turn reported the seam to their foreman. Company
policy dictated that the foreman be contacted to decide what
course of action should be followed--for example, whether further
scaling, drilling, or blasting operations should be attempted.
The scaling crew and the foreman (five or six people) then
attempted to bar down the rock. Because these efforts failed,
crew and foreman alike believed that the area was safe. No
further attempts were made to dislodge the rock or to reinforce
the roof--for example, with ceiling bolts.
At the time the accident occurred, two workers were
operating a jumbo drill to bore "rounds" (blast holes) into the
rock face of the excavated chamber in which the hairline seam had
been found. Sometime during the drilling operation, a rock slab
measuring approximately 120 x 22 x 9 feet broke loose and fell,
crushing both the workers and their equipment. The accident,
depicted in the illustration took place at some point between
2:10 p.m. and 4:10 p.m. (The exact time is not known because no
one else was present.)
The Mine Safety and Health Administration (MSHA) conducted
an investigation and attributed the accident to management's
failure to assess conditions accurately and to implement
appropriate actions for supporting or removing the rock slab
after hand-scaling proved ineffective.
In addition to finding management at fault, MSHA officials
recommended that the mining company consider using a mechanical
scaler and that closer attention be paid to spot bolting. The
company was also directed to modify its training program to
educate miners about preventive measures, including
identification of hazardous conditions like those associated with
this tragedy.
Lessons learned
This industrial accident suggests several lessons that are
applicable to DOE operations, including the following:
-- Work conditions and potentially dangerous situations must
always be thoroughly assessed. When a proper job hazard analysis
is conducted, hazards associated with planned work activities can
be identified--and minimized--before work begins.
-- Pre-job planning and independent review of workplace hazards
are necessary to ensure safety. Those who actually perform the
work are sometimes too close to the job to recognize potential
hazards.
-- Workers who observe potential hazards should promptly
communicate these conditions to management, which in turn should
act to resolve or mitigate those hazards.
Many conclusions can be drawn from this accident. First and
foremost, management has an obligation to respond to worker
concerns about safety. In this case, one group of workers
brought a potentially unsafe condition to the attention of
management--a condition that was never adequately resolved.
Subsequently, other workers entered the area expecting safe
working conditions and instead were met with death.
*The following article was submitted by one of our readers. If
you would like to submit an article, contact the Coordinating
Editor.*
Part 3:
STEAM LINE WATER HAMMER: CAUSE AND PREVENTION
by Ken Laliberte, Stone & Webster Engineering Corporation
The September and October 1993 issues of the Observer
reported on lessons learned from a June 1993 fatality at the
Hanford Site. The accident occurred when a water hammer caused a
valve to fail catastrophically, releasing large amounts of steam
into an enclosed underground pit where an employee was working.
This article examines two of the lessons learned from the
accident: (1) steam system design factors, such as the size,
type, and placement of traps, drains, and bypass valves, are
critical to safe operation, and (2) operational concepts, such as
how sections of the system are taken out of and returned to
service, sometimes have to be changed to accommodate the ways and
the extent to which the actual design differs from a technical
ideal (that is, drain valves and bypass valves not installed
where needed).
Causes of water hammer
Water hammer is defined as the change in fluid pressure in a
closed circuit caused by a rapid change in fluid velocity. This
pressure change results from conversion of kinetic energy into
pressure or conversion of pressure into kinetic energy. Water
hammer in steam lines can be caused by (1) gradual accumulation
of condensate during normal operation, (2) steamline water
entrainment, and (3) introduction of subcooled condensate into
steam-filled lines.
Unless condensate is removed from low points in the steam
main, it gradually accumulates until the condensate so restricts
steam flow that a slug of condensate is carried down the main by
the steam. The slug of water travels at the speed of the steam
(which may be in excess of 100 miles per hour) until it reaches
an obstruction like a reducing valve, a temperature regulator, a
steam trap, or simply a change in the direction of the steam
piping. The slug of water slows suddenly or stops completely,
often with disastrous effects on the equipment.
Steamline water entrainment is generally caused by opening a
steamline isolation valve rapidly, admitting steam into a line
that has not been warmed up properly, which causes the steam to
condense and form a water slug.
A water hammer can also occur when large quantities of
subcooled condensate are admitted into a saturated steam space,
which most often occurs when an isolated portion of the system is
returned to service. The cool water, acting as a heat sink,
rapidly condenses steam and causes a vacuum. The vacuum may suck
the water into its space at high velocity.
A steam hammer can occur when small quantities of condensate
are passed into a hot, lower pressure steam space. The subcooled
condensate flashes into steam, causing a rapid increase in volume
and increasing the pressure equivalent to saturation conditions.
This dynamically created pressure may break or damage piping
components.
Condensate control
Controlling condensate accumulation in steam lines
(principally through drainage) is critical in preventing water
hammers and is accomplished by proper system design and
operation. Proper operation depends on having an appropriately
sized condensate drain system to prevent condensate accumulation,
as well as features such as vents, drains, and bypass valves to
provide for safe system startup.
Steam traps are the main elements of a drainage system, and
for most steam trap applications, thermal efficiency is not the
prime objective--safety is. Inadequate drainage is a common
cause not only of water hammers, but of damaged controllers and
steam traps, as well as leaking joints. Proper draining of mains
and care in starting up cold mains not only prevent water
hammers, but also improve steam quality and reduce maintenance
required on pressure reducing valves, temperature controls, and
other automatic steam valves.
Liberal steam trap load or safety factors and oversized
steam traps do not necessarily provide a safe and efficient
design for a steam main drain. A safe and efficient design
should include the following: (1) an appropriate method for
heat-up; (2) suitable reservoirs or "collection legs" for
condensate to collect; and (3) properly selected and sized steam
traps that have been properly installed.
The type and size of trap used to drain steam mains will
depend on the heat-up method used in bringing the steam main up
to pressure and temperature. The two methods commonly used are
supervised heat-up and automatic heat-up. Supervised heat-up is
the method most commonly used in large, decentralized facilities,
and is the method described in this article.
Heat-up practices
In supervised heat-up, steam main sections are heated in
sequence, rather than heating the entire system at once. With
manual drain valves installed at all drain points and bypass
valves installed at all steam main isolations, the section of
steam main to be placed in service is drained of accumulated
condensate by using manual drain valves and verifying that the
piping is free of all condensate. After the draining has been
completed, manual drain valves in the steam main section to be
heated are either closed or left open to atmosphere, depending on
the effect steam would have on the surrounding area or equipment.
Steam should be admitted gradually to the section being
placed in service by slowly opening the bypass valve until flow
through the valve is heard or until the valve is one-fourth open,
whichever occurs first. A slow heat-up will limit stresses in
piping caused by unequal expansion, will minimize erosion due to
high velocity steam and condensate, and will protect auxiliary
equipment.
Draining condensate manually
If the manual drain valves were closed after the piping
section was drained, each drain valve must be reopened until all
condensate is drained and steam is observed, after which the
drain valve can be closed. This process must be repeated for
each drain valve in the steam main section being heated until no
condensate is observed.
The bypass valve should be slowly opened further to increase
steam flow and steam pressure to the section being heated, and
each drain valve should then be opened to drain condensate until
steam is observed. This process should be repeated for each
drain valve until no condensate is observed. Continue in this
manner until the bypass valve is fully open, no condensate is
observed during manual draining, and steam pressure across the
steam main isolation has equalized (as measured by a pressure
gage on both sides of the isolation valve). Finally, the steam
main isolation valve should be opened slowly and the bypass
should be closed.
With the drain valves closed, the steam traps will
automatically remove the condensate that forms under operating
conditions. Therefore, the steam traps are sized to handle only
the normal heat losses at the operating temperature and pressure.
A section of a steam main that lacks drain valves should
never be isolated and then returned to service. Doing so
requires that a section of the main in which condensate has
collected be placed in service with an operational section
containing saturated steam--a situation almost certain to produce
a water hammer.
Either of two alternatives would be preferable. The
preferred method would be to isolate the system at another point
(valve V-2 instead of valve V-1) so as to permit condensate to be
drained manually (valve V-3) before returning the isolated
section to service. If the piping section has been isolated at
valve V-1, an alternative would be to close an additional
isolation valve (valve V-2) downstream to a point where a drain
valve is available (valve V-3), then depressurize and drain this
new isolated section. These precautions will allow the original
isolation valve (valve V-1) to be opened slowly (a maximum of two
turns), admitting and draining the condensate.
System design matters
The importance of proper design--especially regarding
methods for draining condensate and for system startup--for
preventing water hammers in steam systems cannot be
overemphasized. The ideal steam system design has safe operation
of the system as its principal objective. Safety depends on two
key factors: ensuring that proper condensate drainage (manual
and automatic) and bypass valves are provided for all steam main
isolation valves.
The ideal design rarely exists, however--partly because many
steam systems now operating were designed and built some time ago
and do not conform to the design configurations needed to ensure
proper operation. Thus, operating procedures must acknowledge
that design frequently deviates from the ideal and thereby
creates a potentially hazardous situation. Procedures must be
structured in a manner to ensure that startup and operating
routines are safe, and must compensate both for the shortcomings
of the system and the certainty that operating and maintenance
personnel cannot intuitively foresee all possible unsafe
conditions. Only when operating procedures have achieved these
objectives can training programs be developed that can reasonably
be expected to develop attitudes and behaviors that will prevent
serious accidents.
Operations supervisors can use this information to improve
safety for older steam systems at their facilities. Examples
include the following:
-- Walk down all steam systems and document design
deficiencies;
-- Determine how to operate with existing designs and modify
operating procedures accordingly;
-- Request that the system be modified to accommodate potential
operating configurations; and
-- Repair or replace malfunctioning system equipment (steam
traps, valves).
In addition, training should be established for engineering,
maintenance, and operations personnel on how water hammer occurs
in steam lines--including the actions necessary to avoid this
hazard. Severe damage can be avoided if sites ensure that their
steam system designs and operating practices will prevent water
hammer.
*Ken Laliberte is a Principal Engineer with Stone & Webster
Engineering Corporation's (SWEC) Plant Operations & Services
Division. He came to SWEC with over 12 years' experience in the
U.S. Naval Nuclear Power Program. Mr. Laliberte has been with
SWEC for over 14 years and has extensive experience in the
commercial nuclear power industry in startup testing,
engineering, and maintenance.