EH-9407 Issue No. 7, July/August 1994 Occupational Safety Observer
JULY/AUGUST 1994
Occupational Safety Observer
NEAR-MISS ELECTROCUTION RESULTS IN SAFETY STAND-DOWN
In April 1994, during a planned power outage by Fernald Environmental
Restoration Management Corporation (FERMCO), an electrician was nearly
electrocuted while performing circuit testing. Although power to the feeder
system for the unit where the electrician was working was initially turned
off, it was turned on just before he connected cables to perform the test.
Because he was wearing appropriate protective gear, the accident was not
fatal.
The Incident
The sitewide power outage was planned to prepare for replacement of
one of four main feeder systems. The units involved in this incident
were the main electrical substation and unit substations for the water
treatment plant (feeders 2 and 3) and the boiler plant (feeder 1).
During previous work, subcontractor personnel had locked and tagged
the feeders for the unit substations; these were removed for site
electrical maintenance personnel to test open circuits so that
electrical arcing would not occur when the system was re-energized.
Locks and tags were in place at the main substation but were not
placed by the electricians performing tests at the unit substations.
This would permit single-key removal of the main substation locks and
tags. Testing was conducted while the lines were de-energized. The
supervisor of the operation was located at the main substation and
carried two radios with different frequencies for communicating with
construction and electrical crews. Electricians at the water
treatment plant (feeders 2 and 3) finished their testing and radioed
to the supervisor at the main substation that they were done. The
supervisor cleared locks and tags for feeders 1, 2, and 3 and
announced over the radio that the feeders were being re-energized.
The crew at the boiler plant did not receive this message and
continued testing. The result was an electrical arc when the
electrician tried to connect a lead to the fuse holder at the boiler
plant unit substation. Fortunately, the worker was not injured
because he was wearing high-voltage gloves and safety glasses; other
workers at the same location were not similarly protected. Rather
than use the radio, the crew leader at the boiler
plant drove to the main substation to report the incident. Meanwhile,
the electrical arc had tripped the breaker for feeder 1 at the main
substation. Because this is fairly common after an outage, personnel
at the main substation followed procedure and re-energized the
breaker, since they had not been notified of the incident at the
boiler plant.
Assessment
This incident illustrates several considerations for team-based jobs.
First, the pre-job briefing did not include all workers who would be
involved in the planned work. DOE 5480.19, "Conduct of Operations,"
specifically requires a pre-job briefing to preclude such incidents.
Also, the lock and tag procedure was not properly followed by the
unit substation electrical workers--their locks and tags should have
been placed at the main substation to preclude single-key
re-energizing. Both of these procedures are specified in DOE and OSHA
requirements. Several other subtle aspects of this incident suggest
additional changes to improve team-based job procedures. The first of
these relates to the use of two radios by the supervisor at the main
substation. This complicated arrangement apparently resulted in
confusion about (1) whether construction crew or electrical workers
were reporting, and (2) which radio he should use to communicate with
the electrical crew. Since the crew at the boiler plant did not get
the message that the feeder was being re-energized, it is probable
that either the message was delivered over the wrong radio or
excessive voice traffic on the channel obscured the message. Another
issue related to the radio confusion is the procedure used to
acknowledge and verify communications. When the supervisor heard the
radio message that testing was completed, he understood it to mean
that testing at both the water treatment plant and the boiler plant
was finished. A simple acknowledgment and verification procedure for
communication would have indicated that the message came from the
water treatment plant and not the boiler plant. Similarly, when the
supervisor announced that he was re-energizing the feeders,
acknowledgment and verification responses from the electricians at the
unit substations would have indicated that work was not yet complete
at the boiler plant. Finally, the incident should have been reported
by radio. Although interference can affect radio communications and
workers may be reluctant to broadcast news of an incident publicly, it
is crucial that incidents such as this be reported immediately.
The crew leader at the boiler plant delayed the reporting and recovery
process by driving to the main substation to report the incident.
This allowed the re-energizing of a breaker that had tripped because
testing was still in progress, and could have led to further
incidents. In addition to these lessons regarding team performance,
this incident points out the importance of wearing proper personnel
protective equipment (PPE) when working on circuits. The worker
involved in the incident had followed procedure by wearing gloves and
safety glasses even though he was working on a "de-energized" circuit.
Several of his co-workers were not wearing PPE; had they been more
directly involved in the incident, the results would have been more
serious.
Management Response
When DOE and FERMCO management investigated the incident, it was
determined that nonessential activities should cease until all
workers could complete a thorough review of Fernald safety policies.
All FERMCO employees were instructed to suspend their routine
activities and conduct safety inspections and housekeeping activities
on May 2 and 3. At the same time, managers and supervisors from
FERMCO's Remedial Support Operations, Waste Programs, and
Environmental Safety and Health Divisions joined senior management and
representatives in a day-long discussion of safety issues. On
Tuesday, May 3, hourly employees who were directly involved in cleanup
operations participated in all-day working sessions. Members of
Fernald's Safety First Team, the Union-Company Safety Committee, and
other facilitators helped employees review the FERMCO Employee Safety
Handbook and complete a questionnaire on safety hazards. Employees
also discussed those operations that have the highest potential risk
and identified potentially unsafe work areas. The work sessions
concluded with planning for resumption of work that had been
suspended during the stand-down. Eight Independent Safety Review
teams began work on May 4 on safety reviews of potential high risk
activities. The teams had received orientation on May 2 and 3
regarding the nature of the incident and the procedure the teams would
be using for their reviews. Transcripts from the facilitated
stand-down sessions were given to each team to use in their respective
reviews. The teams immediately began the review process by walking
down the project, interviewing the workers, and reviewing procedures.
The team findings were split into two categories: those that had to
be fixed immediately before the activity could be resumed, and those
that should be considered in the longer term by management. Work on
specific operations resumed as the review teams determined them to be
safe. At press time, the Independent Safety Review teams were
concluding their activities. A report is being prepared summarizing
the activity and containing recommendations that did not require
immediate resolution but still warrant management attention. Longer
term plans will be developed at Fernald over the next few weeks in an
effort to increase safety awareness, to improve safety procedures, and
to indoctrinate all personnel with the need to conduct all tasks
safely. We commend site and program managers for understanding the
seriousness of this near miss, its implications, and the need to
address safety culture and procedures.
Lessons Learned
Procedures for pre-job briefings and proper lock and tag should be
followed meticulously. Communication complications for job
supervisors should be minimized when safety-critical tasks are being
performed.
A program of training in formal communications for safety-critical
tasks should be developed. The need to report incidents without delay
should be emphasized.
Reference
ORO--FERM-FEMP-1994-0023
LESSONS FROM INDUSTRY: Company Struggles to Improve Safety Culture
"The only way we're gonna quit horsing around and start making
progress is if we accept that the problem is in this room. I'm part
of the problem, and you're part of the problem." That is what David
Pritchard told a roomful of his employees recently. Pritchard is
president of Alyeska Pipeline Service Company, which operates the
Alaska pipeline. The problem he spoke of was Alyeska's poor record on
safety and the environment, a record that has brought Alyeska to the
attention of, among others, the United States Congress, the Bureau
of Land Management (BLM), the Department of Labor, the Department of
Transportation, the Federal Bureau of Investigation, and the CBS
television program 60 Minutes. Alyeska's record is rooted in its poor
safety culture. The situation illustrates the importance of
management attitudes in ensuring safety and the drastic actions needed
to correct a safety culture that has become dangerously deficient.
The Problem
Alyeska was formed in the 1970s as a consortium of seven companies to
build and operate the Alaska pipeline. Alyeska employs 1,300 workers
directly, plus hundreds of contract workers throughout the state who
tend the 800-mile pipeline and the Valdez terminal. Alyeska has been
involved in controversy since its inception. During construction,
Alyeska was dogged by questions about the quality of welds in the
pipeline. Even before operations began, within one 3-day period the
pipeline suffered two large leaks and an explosion in a pump house
that killed one worker. In 1989, the company was criticized for its
handling of the Exxon Valdez oil spill. More recent allegations
against Alyeska have involved harassment of whistleblowers and
unresolved safety deficiencies. The company has been particularly
embarrassed over its alleged harassment of Chuck Hamel, a vocal
environmental critic. According to testimony before Congress, Alyeska
and a private security agency embarked on an elaborate $1-million plan
to film and wiretap Hamel, open his mail, and search his garbage.
This plan also involved setting up a fake environmental firm, with
security agents masquerading as employees.
Charges have been made indicating that Alyeska treated its own
employees no better if they called attention to safety or
environmental deficiencies. Five quality control inspectors have sued
Alyeska, claiming that they were ordered to ignore safety violations
and were harassed and intimidated if they did not. Some were even
fired. Alyeska has denied the charges, although a company
spokesperson could not deny that harassment has ever occurred. The
spokesperson maintained that the harassment charges were subjective
and therefore difficult to resolve. One inspector involved in the
suit alleged that quality control has been so poor that the current
condition of the pipeline cannot be determined. In testimony before
Congress, another inspector said that Alyeska management "deliberately
sacrificed its own system of safety-related checks and balances in
favor of profit and [that management] has systematically attempted to
circumvent government-mandated quality assurance/quality control
requirements." Other allegations have involved drug abuse and use of
untrained workers.
Audit Findings
Further investigation substantiated many of the inspectors'
complaints. An audit sponsored by the Bureau of Land Management
found "a lack of properly maintained and calibrated equipment, lack of
professional standards and criteria for inspection, lack of inspection
recordkeeping and documentation, inadequate inspector certification
and training, inadequate inspection regime, and inadequate inspection
of pipe girth welds. The audit also found that Alyeska had no
earthquake control program and cited numerous electrical safety
violations. In fact, Alyeska has admitted to 4,300 electrical code
violations at its Valdez terminal alone. According to a recent
article in The Wall Street Journal, the number of electrical
violations is actually much higher: 37,000 electrical violations at
the Valdez terminal and 8,000 more violations throughout the pipeline.
The Journal predicts that "tens of thousands" more will be found as
Alyeska continues a government-required overhaul of the pipeline.
Many of these violations are in the grounding system; electricians
have received shocks of up to 130 volts while working on panels that
should not conduct current at all. The BLM auditors place the blame
for many of these problems at management's doorstep. Accident
prevention was not a priority of upper management and therefore was
not a priority of middle management or "the majority of workers." The
BLM director also harshly criticized Alyeska for its "adversarial" and
"apparently cavalier" attitude.
Alyeska's Solution
Resolution of the ongoing lawsuits can be expected to be slow.
Whistleblowers can be motivated by a genuine desire to rectify safety
deficiencies, or simply by anger at their employers for unrelated
reasons. Employers may be attempting to suppress complaints by
legitimate whistleblowers, or they may merely be attempting to deal
with difficult employees. Whatever the case, however, one thing is
clear--something is wrong at Alyeska. David Pritchard has admitted as
much. Shortly after assuming his position as president in April 1993,
he told an employee conference, "We've kind of been lurching from one
crisis to the next.--That's got to change." Pritchard agreed that the
problems with quality control and whistleblowing have been symptoms of
management problems. The oil companies that owned Alyeska asserted so
much control over operations that Alyeska management didn't feel in
control, but it also didn't feel accountable. This attitude pervaded
the entire organization--managers gave orders that subordinates were
expected to follow without question, even when they thought that
safety might be threatened. These problems were exacerbated by
management's emphasis on production over safety and by frequent
turnover among managers. A crucial step in overcoming these problems
is to empower workers and to give them authority that cuts across
traditional department lines. Under the old system, if workers found
a safety deficiency that required an equipment modification, they
reported it to the engineering department (if they decided to report
it at all). Engineering would study the problem and then pass it to
the finance department, who would decide whether to pay for the
repair. The period from identification to repair could take 5 months
or longer. Now, each team of workers is being given the authority
and a budget to fix such problems quickly, and the team will be held
accountable if their solution does not work. Alyeska has also
instituted what they call "360-degree reviews." Under this system,
supervisors are reviewed by their peers and subordinates as well as by
their superiors. Dave Pritchard shared the results of his 360-degree
review with an audience of upper managers, confessing that he was not
as good a leader as he thought. Alyeska is also streamlining its
bureaucracy, emphasizing the importance of pleasing "stakeholders."
Under the old culture, production mattered most. Now, management is
emphasizing that the public, regulators, and Alyeska's own employees
also have a stake in the way the company operates.
Lessons for the DOE Complex
Alyeska has embarked on an ambitious effort to resolve some serious
problems. It is too early to tell whether they will succeed. In any
case, Alyeska's situation offers some important lessons for the DOE
complex:
-Management's attitude and agenda have a huge effect on safety. At
Alyeska, safety was disregarded because management failed to emphasize
its importance (over production goals).
-Efforts to improve a deficient safety culture can be difficult and
disruptive. However, a deficient safety culture must be rectified
before an organization can expect to improve its safety performance.
-Middle management can best respond to safety issues when given the
autonomy to do so. Middle management at Alyeska did not feel
empowered or motivated to address safety issues.
-Teams authorized to act across functional lines can address safety
issues quickly. Traditional, bureaucratic organizations often respond
too slowly to pressing safety problems.
Effective safety efforts depend on worker input. Workers are often
the most knowledgeable about day-to-day safety issues and the most
motivated to correct them.
CONDUCT OF OPERATIONS: Workers Exposed to Chlorine Gas
When conduct of operations requirements are not applied as rigorously
to nonnuclear activities as they are to nuclear programs, we become
more vulnerable to accidents. The following account demonstrates how
this vulnerability translates to personnel injuries.
The Incident
On April 15, 1994, at Argonne National Laboratory-West (ANL-W), a
plant services employee (alternate tool crib operator) attempted to
remove the yoke and regulator from what he believed to be an empty
chlorine cylinder. About 20 pounds of chlorine gas were released.
Because of the location of the release, 900 employees were evacuated
from the facility in approximately 9 minutes: 40 employees were
exposed to the chlorine gas; 20 employees were transported to the
regional medical center; and one employee (the alternate tool crib
operator) was hospitalized overnight. No permanent injuries were
reported.
Pre-Accident Events
The ANL-W alternate tool crib operator (the operator) in Building 753
received a telephone call from a materials controller (MC) in the
supply warehouse requesting the location of a chlorine cylinder
scheduled for changeover. The operator called the vacationing tool
crib operator (TCO) to request directions regarding the changeover of
the empty and full cylinders. The TCO told him that there were two
cylinders located at Building 754 and to get the empty cylinder
surveyed for radioactive contamination ("green-tagged") by a health
physicist in preparation for removal from the site. By 10:00 a.m.,
the survey was completed. However, the health physicist had surveyed
and green-tagged both cylinders. The health physicist noted that the
cylinder with the yoke and regulator showed 90 pounds of chlorine
remaining; the other cylinder was empty. Because of poor
housekeeping, the chlorine vendor could not drive directly to the
chlorine cabinet; construction materials blocked the delivery route.
The vendor (whose timely presence might have prevented the ensuing
events) was forced to take an alternate, longer route to the cabinets.
Before the vendor arrived at the building, the operator opened the
chlorine cabinet doors and examined the cylinders in the cabinet. The
left cylinder was capped, and the right cylinder was equipped with a
yoke and regulator attached to the cylinder valve. The MC indicated
that the cylinder with the regulator attached would have to be capped
before shipment. Using an adjustable wrench from the cabinet floor,
the operator began to loosen the yoke-retaining screw. At 10:27 a.m.,
just as the vendor was getting out of his vehicle, the operator
loosened the yoke-retaining screw until the cylinder seal was broken,
thus releasing chlorine gas. In trying to remove the regulator, he
had failed to close the cylinder valve first. The chlorine gas
sprayed him in the face; he inhaled the gas before he could move away
from the cabinet. He complained of chlorine inhalation symptoms; his
airways were burning and he had difficulty breathing. The MC told him
the gas was poisonous and that he should go to the dispensary for
treatment. The MC then ran to the paint shop nearby and called the
emergency notification system to report the chlorine gas release.
After the release, the chlorine plume spread and was entrained in the
fresh air intake system of Building 785 (located about 4 feet above
ground level at about 100 feet from the chlorination cabinet),
exposing 13 people to the chlorine gas. Additional personnel were
exposed in Buildings 753 and 798 in a similar manner. During the
ensuing site evacuation, employees were directed to evacuate before
being told which routes to take. As a consequence, they were exposed
as they passed through the chlorine plume. A total of 40 persons were
exposed, 20 of whom were treated for chlorine inhalation symptoms.
Two HAZMAT team members suited up with full protective clothing and
entered the area at 11:01 a.m. As they approached the chlorine
source, they used Draeger tubes and a photo-ionization detector to
monitor for airborne chlorine concentrations. The only detectable
chlorine levels were within 5-10 feet of the chlorine cabinet. The
cylinder valve was secured by the HAZMAT team, stopping further
releases, 41 minutes after the release.
Post-Accident Events and Analysis
The Accident Investigation Board found that the operator was not
authorized to conduct chlorine cylinder-related operations and that he
had received no training in this area. In addition, there was no
written, approved procedure for this activity, nor was there a system
safety analysis or a specific job safety analysis performed. Several
findings were noted, most of them related to DOE 5480.19, "Conduct of
Operations":
1. Procedures that might have prevented this event did not exist.
2. Personnel training and understanding of job-specific functions performed
by the tool crib alternate were insufficient.
3. The use of lessons learned from similar non-nuclear incidents within the
Department was inadequate.
4. Oversight of the nonnuclear operations performed by ANL-W and the DOE
area office was deficient.
Some of the existing conditions that contributed to this event were as
follows.
Incomplete Procedures. A specific procedure for chlorine cylinder
exchanges did not exist. The site procedures provided the basis for
safe changeout of cylinders in general; no specific procedure for
changeout of chlorine cylinders existed.
Cylinder Condition Tags Not in Use. The ES&H Manual establishes
requirements for the disposition of gas cylinders; among these is the
requirement that personnel use visual clues, in the form of the "Full
- In Use - Empty" tag, to mark the cylinders. In this accident, the
empty cylinder did not have the required "Empty" tag attached, and
interviews indicated that neither workers nor management were aware of
the requirement. The tags were not available from supply stores, and
discussions with supply management staff revealed that they did not
know they were required to stock the tags. Insufficient Hazard
Awareness Training. Had the operator been trained, he would have
understood the hazardous chemical requirements and procedures.
Because he was an unauthorized and unqualified worker, he took actions
that were inappropriate. Although the ES&H Manual establishes
responsibilities and requirements for the hazard communication
program, and employees who work with hazardous materials must receive
hazard-specific training, the investigators found that there was no
hazard-specific training for chlorine. The unqualified worker used an
unacceptable, ad hoc procedure. Inadequate Procurement Process.
Industrial hygiene staff approval is required for the purchases of
heavy metals, carcinogens, explosives, or highly toxic materials (such
as fluorine, chlorine, cadmium, beryllium) at the site. The
procurement process did not perform the specified industrial hygiene
review. Poor Management Feedback Processes. DOE oversight has been
focused primarily on nuclear and radiation-related safety programs.
Oversight has not considered industrial safety of utility systems as
significant safety risks. As a result, the DOE organizations
responsible for oversight had not reviewed the implementation and
effectiveness of safety management programs related to utility
systems. Lack of Controlled Access. The chlorine cabinet doors were
not locked by plant operators and the contents of the cabinet
(chlorinator system and chlorine cylinders) were accessible to
unauthorized personnel. A knowledgeable person could have stopped the
unauthorized worker's access. Root Cause. The accident analysis
identified the following as a fundamental shortcoming, which, if not
corrected, could lead to a recurrence of this or a similar event. The
root cause of the chlorine release was the failure of management
systems. This failure includes overlooking the chlorine risk at
ANL-W, not incorporating or implementing sitewide safety procedures in
job-specific procedures, and not feeding back to management the
implemention of work control activities.
Lessons Learned
-Where highly hazardous chemicals must be used, managers need to
ensure that comprehensive safety management programs are in place to
prevent accidents and to deal effectively with incidents.
-Managers should review conduct of operations for nonnuclear
activities to ensure that the same level of rigor applied to nuclear
activities is applied to nonnuclear activities.
-Emergency response plans need to be complete and fully exercised for
toxic gas emergencies to identify and eliminate weaknesses and
deficiencies.
-Management oversight should include thorough reviews of the site
and/or facility nonnuclear operations, as well as the physical site.
NEWPROCEDURES DEVELOPED: Waste Drum "Blows Its Top"
In April 1994, two waste transportation storage and disposal workers
at the Oak Ridge Y-12 plant were removing the band closure on the lid
of a 55-gallon drum containing mixed waste. As it released, the metal
drum lid blew approximately 14 feet into the air. This reaction was
caused by pressure that had built up over time as the organic
materials decayed inside the container, creating methane gas. No one
was injured, and no contaminants escaped.
The Accident
The materials inside the drum were contaminated gloves, filters, and
rags; and polychlorinated biphenyls (PCBs). All of the contaminated
materials had been placed in plastic bags that were taped shut before
being placed inside the drum. Although the pressure in the container
had built up over several weeks, the drum had not deformed or shown
any outward signs of changing pressure. After the lid was blown into
the air, technicians assigned to the building notified the area
supervisor and the Y-12 Plant shift supervisor. The shift supervisor
then notified Health Physics personnel and Plant Safety staff.
Because the drum contained radioactive materials and other dangerous
chemicals, a radiological survey was conducted immediately on everyone
who was nearby when the accident occurred, as well as throughout the
area where the drums were stored and the area where the lid landed.
No one was found to be contaminated. To notify other organizations
handling waste within the Y-12 Plant about the dangers associated with
pressure building up in waste containers, a "Yellow Alert" was
issued.* A formal investigation of causes and long-term remedial
actions was also initiated.
Lessons Learned
The investigations of the event and steps that can be taken to prevent
future occurrences of this type are still in progress. However,
based on initial findings, some remedial actions have already been
undertaken. At the time of the accident, procedures in place to
protect against pressurization assumed the drum would be deformed or
show other signs of instability or possible danger. In this case,
however, the drum showed no outward signs of pressure buildup, so new
procedures were introduced covering the receipt and inspection of
waste drums at Oak Ridge. In addition, a device was built to release
pressure buildup safely when it is discovered. To determine whether
pressure has built up in a drum, employees are now instructed to
release the band closure slowly and listen for a hiss of escaping gas.
If there is no hiss, they can open the drum normally. If gas is
escaping, the band is retightened and the drum is resealed. A
remote-controlled pressure-relief device developed by plant personnel
is used to open a one-eighth-inch hole in the drumhead. This hole is
sufficient to release any built-up pressure safely. The device is
attached to the top of the container. Using compressed air, the device
punctures the drum top with a single one-eighth-inch hole. To ensure
operator safety, the device is activated remotely 50 feet from the
drum.
DANGEROUS RESCUES: Dead Heroes Don't Make Good Rescuers
On May 11, 1993, employees of several non-DOE contractors were working
at a construction site in Garden City, Idaho, when a trench caved in,
burying one worker. Two workers from DeBest Inc., a plumbing
contractor, heard the trapped man's screams and rushed to his aid.
The rescuers dug frantically for 12 minutes to enable him to breathe;
otherwise, he would have died. Once freed, he was treated for several
injuries, including a collapsed lung. Three weeks after the rescue,
the Occupational Safety and Health Administration (OSHA) cited DeBest
relative to the incident. Although DeBest had not been involved in
digging the trench and the trapped worker had not worked for DeBest,
OSHA found that the rescuers had failed to take adequate precautions
before going to the trapped man's aid. Specifically, OSHA alleged
that (1) DeBest had not properly trained its workers to recognize and
avoid unsafe situations; (2) the rescuers had not put on hard hats
before entering the collapsed trench; (3) the rescuers were working in
an area where water had accumulated; and (4) the rescuers did not
shore the trench properly before entering it. OSHA levied $7,875 in
fines against DeBest. DeBest officials were shocked at the citations.
The actions required by OSHA would have taken time that the victim did
not have--he would have suffocated before the DeBest workers could
rescue him. The incident and charges eventually came to the attention
of Senator Dirk Kempthorne (R-Idaho), who persuaded OSHA to withdraw
the citations and fine. OSHA officials told Kempthorne that OSHA
regulations left them no choice but to fine DeBest. To correct this
flaw in the system, Kempthorne worked with OSHA and introduced
legislation to exempt acts of heroism from OSHA regulation. On March
11, 1994, by a vote of 82-0, the Senate agreed to include the HERO
(Heroic Efforts to Rescue Others) Act as an amendment to the National
Competitiveness Act. The bill is currently in committee, so, at the
Observer's press time, the OSHA regulations still remain applicable.
Rescuers as Victims
The DeBest incident has received much attention in the media and is
often cited as an example of overzealous regulation. However, many
critics ignore the fact that rescue can be very dangerous and that
rescuers often become victims. While the DeBest rescue involved a
cave-in, other types of rescue can be equally or even more dangerous.
Rescue in a confined space is particularly likely to claim the lives
of rescuers, probably because the dangers are not always apparent. The
National Institute for Occupational Safety and Health (NIOSH)
estimates that 42 percent of confined space fatalities involve
rescuers. On May 1, 1993, in La Plata, Maryland, a worker lowered
into a well reported feeling light-headed. In an attempted rescue, a
co-worker lowered into the well also became trapped. When
firefighters arrived at the scene, one of them entered the well
without first putting on an air mask. Although he was not hurt, the
deputy fire chief later acknowledged that it was a mistake to send the
firefighter into the well without proper equipment, even though they
believed the second victim's life was in imminent danger. In fact,
both trapped workers died. (This incident was reported in the August
1993 Observer.) A man cleaning an underground storage tank in
Texarkana, Texas, in May 1993, was overcome by vapors. Two men who
attempted to save him were also overcome. All three men died. In
August 1992, a Minnesota hog farm employee was overcome when he
entered a 12-foot-deep manure pit to retrieve a pump. His uncle
entered the pit in an attempt to rescue him, despite warnings from a
co-worker on the scene, and was also overcome. Both men died of
hydrogen sulfide poisoning. In response to this and a similar
incident, NIOSH has recommended that workers never enter a manure pit,
even when attempting a rescue, without using a supplied air respirator
and taking other necessary precautions. In Indiana on July 21, 1987,
a construction worker entered a 7-foot-deep sewer manhole to perform
an inspection. He collapsed, and a co-worker entering the sewer to
rescue him also collapsed. Both workers died. Tests revealed low
oxygen levels in the sewer and the presence of methane and hydrogen
sulfide. Another accident in a sewer occurred in Oregon on October
10, 1986, when a self-employed contractor collapsed in an underground
vault. Thirty minutes later, two passersby saw the contractor's body
in the water at the bottom of the vault. They both entered the vault
to rescue the contractor and also collapsed. Two policemen and two
paramedics arrived on the scene, entered the vault, and then had to be
helped out. Finally, firefighters wearing appropriate breathing
apparatus arrived and removed the contractor and the first two
rescuers. The contractor and one of the rescuers were dead; the
second rescuer was in serious condition and had to be hospitalized.
Carbon dioxide and other wastes generated by bacteria and algae growth
had displaced the oxygen in the vault. In other incidents, the
rescuers were more fortunate than the victims, but still were injured:
On September 7, 1993, a worker was cleaning a railroad tank car in
Hudson, Colorado. When the worker poked his head inside the tank car,
he was overcome by vapors from diesel solvent and fell inside the car.
Another worker going to his rescue was injured. A third worker was
able to pull both men from the tank. The first worker died and the
two rescuers were hospitalized. OSHA levied $245,000 in fines against
the company. On September 19, 1986, a Georgia plumber entered a sewer
to measure a length of line. He complained of a strong odor, then
collapsed. Two coworkers attempted a rescue, but became dizzy. Their
failed rescue attempt delayed notification to the fire department,
which was not called until 20 minutes after the plumber collapsed.
The plumber died of asphyxia.
Lessons Learned
Anyone faced with the need to rescue a worker will have to make some
important decisions very quickly. The urge to go to the aid of a
collapsed co-worker is very strong. However, as these incidents show,
many rescuers become victims themselves. Ironically, in many of
these cases, the victim may already have been dead when the rescuer
came to his aid. To protect workers, OSHA has issued extensive
requirements regarding excavation (29 CFR 1926.651 and 1926.652) and
confined spaces (29 CFR 1910.146). In addition to these requirements,
the following are good safety practices, which should be followed by
would-be rescuers.
1. Be aware of the dangers associated with the rescue. In many of
the incidents described in this article, the victims and rescuers
were unaware of the danger they faced. If you aren't aware of the
hazards, you cannot take precautions to protect yourself.
2. Ensure that personal protective equipment (PPE) is available.
Even if a rescuer is aware of the danger, he or she may decide in
the heat of the moment to take the risk to save a buddy. If PPE
is available so that the rescuer can don it quickly, the chances
of the rescuer and victim surviving can increase greatly.
3. If possible, summon help before entering a confined space to
effect a rescue. Then, even if something happens to you,
additional rescuers will still arrive. In the incident in
Georgia, the arrival of trained rescuers was delayed by 20 minutes
because the workers on the scene did not summon help before
entering the confined space.
Of course, the best way to reduce danger to rescuers is to ensure that
a rescue is never required. If workers had been trained in awareness
of the dangers in excavations and confined spaces and entered them
only after taking necessary precautions, none of the incidents
described would have happened, and none of the rescues would have been
necessary. Precautions include testing the atmosphere in the
confined space, providing adequate ventilation, wearing PPE when
required, and having a standby person outside the confined space. For
excavations, precautions include checking for soil characteristics,
proper side bracing, sloping, availability of exit ramps or ladders,
and rescue equipment. If you must enter a hazardous area to rescue
someone, think before you go in. Don't become a dead hero.
NEVER BYPASS EMERGENCY PROCEDURES: All Bomb Threats Dangerous
A bomb threat at Argonne National Laboratory-East (ANL-E) ended
quietly. Had the scenario been different, involving an actual bomb,
the actions taken might not have prevented significant injuries. In
the early afternoon of March 2, 1994, a DOE Chicago Operations Office
(CH) employee was handed a note by a custodian, who claimed he had
found the note while working. The note contained a threat to bomb
the building and also threatened the life of a specific staff member.
Following CH policy, the employee phoned the building manager
immediately, but reached the building manager's supervisor instead.
The supervisor had met with the building manager the previous day
regarding recent incidents of vandalism and theft. The custodian, a
special employee in a program to provide training and jobs for
intellectually and emotionally challenged individuals, was a suspect
in the vandalism and theft incidents. ANL Security was notified. An
ANL-E senior manager assumed control of the situation and decided to
handle the event administratively. No emergency was declared, nor
was the Emergency Management Organization (EMO) notified. Aware of
the custodian's special challenges, the senior manager requested that
the custodian be brought to his office and asked for assistance from a
psychologist in the medical department. The custodian was brought to
the senior manager's office by his foreman, who, although named in the
death threat, was unaware that any threat had been made. The foreman
was sent to another office and informed of the death threat, but was
not given proper security protection. ANL-E Security notified the
county bomb squad, CH Security, and site contract security (Am-Pro).
Within 20 minutes, the bomb squad arrived and requested escort to the
threatened building from the ANL-E Fire Chief. Because the EMO had
not been notified, the Fire Chief (who was the Incident Commander)
knew nothing of the incident; he contacted the Emergency Management
Officer, who was also unaware of the incident. The Fire Chief met
with the Emergency Management Officer in the threatened building; both
were soon notified that a decision had been made by Security to
evacuate the building. The Emergency Management Officer was being
informed of the situation when the decision to evacuate was made. At
that point, declaring an emergency seemed moot, as all parties were
acting as if there was an emergency. The Senior Manager ordered the
evacuation. The Fire Chief announced the evacuation over the public
address system. Ninety minutes after the note was received, but 25
minutes before the bomb was supposed to explode, personnel left the
building. The senior manager and staff, security staff, the
psychologist, and members of the bomb squad remained in the building
to question the custodian, who soon admitted that there was no bomb
and that he was responsible for both the vandalism and the note. The
DuPage County bomb squad walked through the building with the
custodian, who admitted again that there was no bomb. No thorough
search was conducted. About 90 minutes after evacuation the building
was reopened. Building employees were not given a reason for the
evacuation nor informed of the building's status when they re-entered
the building. Because the EMO system wasn't activated (by placement
of a "911" emergency telephone call or other means, such as calling
the Fire Department), there was no proper notification and
communication between ANL-E and DOE. The threat was not managed under
the Incident Command System, and emergency procedures (emergency
facility activation, Bomb Alert Plan, emergency notifications, public
affairs, and so on) were not followed. ANL-E and DOE personnel met
the next day to analyze the handling of the incident, and formed a
Quality Management Committee on Emergency Preparedness to investigate
the event and prepare a report. The committee's task was to determine
the lessons to be learned and improvements to be made for handling
such events. In addition, the committee provided ANL-E and DOE
management with recommendations related to training, exercises, and
procedures. The committee determined that there was indeed an
emergency and that the EMO should have been notified. The committee
also agreed that the incident should have been classified as an Alert.
Moreover, the Bomb Alert Policy and Procedure states that "all bomb
threats will be treated as valid." Failure to notify the EMO and use
the Incident Command System to manage the event meant that:
-No Incident Commander was available to interface with local
authorities or coordinate on-scene emergency response activities.
-No consideration was given to moving all affected personnel to a
safer location.
-The Technical Support Center wasn't activated, so no technical
assessment of the situation was conducted.
-There wasn't enough time to use established evacuation procedures.
The Fire Chief was forced to make an ad hoc announcement after having
been briefed on the situation.
Failure to activate the EMO through an emergency call resulted in a
patchwork of informal and back-channel notifications. Management's
reluctance to use Emergency Management Systems in place to handle
incidents further confused the issues and hindered effective
coordination. When Laboratory management decided not to activate the
EMO, they chose to undertake managing a crisis, making complex
decisions, and dealing with response activities without the support of
the Emergency Management System. The ANL Comprehensive Emergency
Management Plan stipulates that Am-Pro will work under the direction
of the Incident Commander (in this case, the Fire Chief) unless Am-Pro
and ANL assign the duties of the Incident Commander to Am-Pro.
Because the Fire Department wasn't notified immediately, and
management assumed control, Am-Pro's extensive training in managing
bomb threats and security crises was not used. Other matters of
security were overlooked:
-Building personnel were subjected to unnecessary risk because they
were not evacuated immediately.
-No consideration was given to the safety of the foreman named in the
death threat.
-The individuals remaining in the building to question the custodian
placed themselves at unnecessary risk.
-Management summoned authorities without notifying the relevant,
responsible onsite departments.
Committee recommendations endorsed by the DOE-Argonne Area Office and
ANL-E included the following:
1. Conduct a tabletop drill to allow individuals who would respond in
such events to practice appropriate actions and procedures.
2. Conduct training regarding the activation and operation of the
EMO.
3. Develop a mechanism for providing accurate information updates to
employees following implementation of protective actions.
4. Develop emergency procedures that would involve the psychologist
at the beginning of any emergency involving disturbed individuals,
acts of hostility or violence, or any threat to the Laboratory.
The bottom line is that high priority must be given to the timely and
proper implementation of emergency management systems in any
potentially dangerous circumstance. CH is considering whether to
change their current policy of calling the building manager in an
emergency, instead of dialing 911.
Lessons Learned
-Initial perceptions influence decision making. Managers
underevaluated the bomb and death threats because they immediately
connected them to a special employee already suspected of theft and
vandalism. All incidents with the potential to become an emergency
should be treated as such.
-Emergency procedures should be followed in any potentially dangerous
situation. If any of the actions described in the threat had
occurred, the Laboratory could not have responded promptly and
properly.
-Bypassing the emergency management systems in place will result in
confusion. When management chooses to handle a crisis, they will have
to make complex decisions and deal with response activities without
the support of emergency management systems.
-The safety concerns of affected personnel must be considered.
Personnel should be given prompt information following a serious
incident.
-Proper interfacing must occur to provide support and carry out
emergency duties.G
Reference
CH-AA-ANLE-ANLESSD-1994-0001
---------------------
* The alert system at Oak Ridge is composed of Green, Yellow, and Red
Alerts. Green Alerts can communicate good practices and lessons
learned. Yellow Alerts are cautions that potentially dangerous
situations may exist, and will require various types of actions by all
recipients. Red Alerts signify very serious safety issues, and
normally require instant response from affected organizations.