Risk Management Project

Contents

Cover

Title Page

Copyright

Preface

Acknowledgements

Part I: Background

Chapter 1: Multidisciplinary Perspective 1.1 System Safety Contributions 1.2 Public Health Contributions 1.3 Educational Theory Contributions Learning Exercises Technical Terms References

Chapter 2: Key Terms and Concepts 2.1 Hazard 2.2 Risk 2.3 Risk Reduction Learning Exercises Technical Terms References

Chapter 3: Tools for Analysis and Synthesis 3.1 Using Models for Safety Analyses 3.2 Using Charting Methods 3.3 Summary of Part I Learning Exercises Technical Terms References

Part II: Analysis Methods

Chapter 4: Analyzing Jobs and Tasks 4.1 Basics of Job Hazard Analysis 4.2 Implementation 4.3 Example JHA 4.4 Hazard Analyses Similar to JHA Learning Exercises Technical Terms References

Chapter 5: Using Risk-Assessment Methods 5.1 Risk-Assessment Processes 5.2 Example Risk Assessment Learning Exercises Technical Terms References

Chapter 6: Analyzing Failure Modes 6.1 Rationale for FMEA 6.2 Basic FMEA Methodology 6.3 Beyond the Basics Learning Exercises Technical Terms References

Chapter 7: Constructing Fault Trees 7.1 Introduction to Fault Trees 7.2 Additional Fault Tree Tools Learning Exercises Technical Terms References

Chapter 8: Analyzing Fault Trees 8.1 Quantitative Analysis Based on Fault Trees

8.2 Identifying Cut Sets 8.3 Finding Common-Cause Failures 8.4 Summary of Part II Learning Exercises Technical Terms References

Part III: Programmatic Methods for Managing Risk

Chapter 9: Incident Investigation Programs 9.1 Closed-Loop Process 9.2 Policy Considerations 9.3 Investigative Processes 9.4 Practical Tools for Incident Investigators 9.5 Method for Modeling Harmful Incidents Learning Exercises Technical Terms References

Chapter 10: Human Error Reduction 10.1 Concepts of Errors 10.2 Comprehensive Classification System 10.3 Methods for Finding Countermeasures Learning Exercises Technical Terms References

Chapter 11: Risk-Reduction Strategies 11.1 Conceptualizing “Strategies” 11.2 The Nine Strategies 11.3 Priority for Applying Strategies Learning Exercises Technical Terms References

Chapter 12: Common Components of OSH Programs 12.1 OSH Program Aspirations 12.2 Training 12.3 Warnings 12.4 Safety Devices 12.5 Emergency Preparedness 12.6 Sanitation and Housekeeping Learning Exercises Technical Terms References

Chapter 13: Tools for Managing OSH Programs 13.1 Safety Culture 13.2 OSH Management System Approach 13.3 Ethical Policies for OSH 13.4 Summary of Part III Learning Exercises Technical Terms Appendix: Example Code of Professional Conduct References

Part IV: Risk Reduction for Energy Sources

Chapter 14: Kinetic Energy Hazards 14.1 Energy in General 14.2 Background on Kinetic Energy 14.3 Mechanisms of Harming 14.4 Strategies and Tactics for Kinetic Energy Learning Exercises Technical Terms References

Chapter 15: Electric Energy Hazards 15.1 Electrical Energy as a Source of Hazard

15.2 Mechanisms of Harming 15.3 Strategies and Tactics for Electrical Energy Learning Exercises Technical Terms References

Chapter 16: Acoustic Energy and Vibration Hazards 16.1 Background on Noise and Vibration 16.2 Mechanisms of Harming 16.3 Strategies and Tactics for Noise and Vibration Learning Exercises Technical Terms References

Chapter 17: Thermal Hazards: Heat and Cold 17.1 Background on Thermal Hazards 17.2 Mechanisms of Harming 17.3 Strategies and Tactics for Thermal Hazards Learning Exercises Technical Terms References

Chapter 18: Fire Hazards 18.1 Fundamentals of Fire 18.2 Mechanisms of Harming 18.3 Strategies and Tactics for Fires Learning Exercises Technical Terms References

Chapter 19: Explosion Hazards 19.1 Background on Explosions 19.2 Mechanisms of Harming 19.3 Strategies and Tactics for Explosions

Learning Exercises Technical Terms References

Chapter 20: Pressure Hazards 20.1 Overview of Pressure Hazards 20.2 Mechanisms of Harming 20.3 Strategies and Tactics for Pressure-Related Hazards Learning Exercises Technical Terms References

Chapter 21: Hazards of Electromagnetic Energies 21.1 Fundamentals of Electromagnetic Energy 21.2 Mechanisms of Harming 21.3 Strategies and Tactics for Electromagnetic Hazards Learning Exercises Technical Terms References

Chapter 22: Hazards of Severe Weather and Geological Events 22.1 Background 22.2 Mechanisms of Harming 22.3 Strategies and Tactics for Weather and Geological Events 22.4 Summary of Part IV Learning Exercises Technical Terms Reference

Part V: Risk Reduction for Other Than Energy Sources

Chapter 23: Workplace Conditions 23.1 Background 23.2 Floors

23.3 Stairways and Steps 23.4 Ramps 23.5 Confined Spaces 23.6 Dusty Air Learning Exercises Technical Terms References

Chapter 24: Chemical Substances 24.1 Major Categories of Chemicals Encountered at Work 24.2 Mechanisms of Harming 24.3 Strategies and Tactics for Workplace Chemicals Learning Exercises Technical Terms References

Chapter 25: Biological Agents 25.1 Plants 25.2 Pets 25.3 Livestock 25.4 Wild Animals 25.5 Mold 25.6 Pathogens Learning Exercises Technical Terms References

Chapter 26: Musculoskeletal Stressors 26.1 Background 26.2 Means by which Musculoskeletal Stressors can Harm 26.3 Strategies and Tactics for Musculoskeletal Stressors Learning Exercises Technical Terms References

Chapter 27: Violent Actions of People 27.1 Workplace Violence 27.2 Terrorist Attacks 27.3 Summary of Part V Learning Exercises Technical Terms References

Index

Copyright © 2012 by John Wiley & Sons, Inc. All rights reserved

Published by John Wiley & Sons, Inc., Hoboken, New Jersey

Published simultaneously in Canada

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise,

except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923,

(978) 750-8400, fax (978) 750-4470, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, JohnWiley & Sons, Inc., 111

River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permission.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied

warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where

appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other

damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United

States at (317) 572-3993 or fax (317) 572-4002.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic formats. For more information about Wiley products, visit

our web site at www.wiley.com.

Library of Congress Cataloging-in-Publication Data:

Jensen, Roger C., 1945-

Risk-reduction methods for occupational safety and health / Roger C. Jensen.

p. cm.

Includes bibliographical references and index.

ISBN 978-0-470-88141-5 (cloth)

1. Industrial safety. 2. System safety. 3. Risk management. 4. Industrial hygiene. I. Title.

T55.J46 2012

363.1106–dc23

2011039278

ISBN: 9780470881415

Preface My initial motive for developing this book was to provide a textbook for the next generation of Occupational Safety and Health (OSH) professionals to learn systematic methods that will help them throughout their career. As work progressed, I came to realize the book's content could also be useful

to anyone with OSH responsibilities in companies currently building or upgrading their OSH programs, including many companies located in later developing countries such as India and China. Most of the material in the book presents well-established methods and practices familiar to professionals with broad backgrounds that include industrial hygiene, occupational safety, and occupational ergonomics—three specialties I collectively refer to as OSH. I included a few innovations that I think OSH professional and students will find useful, particularly in the rigor used to define fundamental terms, the modeling method for analyzing incidents, and the consistent use of nine risk-reduction strategies. I wrote this book for three types of readers. For students preparing for a career in OSH, the book can help them learn to approach OSH in a systematic manner. For people with OSH responsibilities in companies going through the process of upgrading their OSH programs, this book can serve as a resource to help pull together the program components needed to meet the basic safety and health needs of their employees. For OSH professionals who know everything about safety, health, and environment in the industrial sector where they work, reading this book may help them see how the OSH practices used in their industry are instances of the practices used in many sectors. I organized the 27 chapters into five parts: (I) background, (II) analysis methods, (III) programmatic methods for managing risk, (IV) risk reduction for energy sources, and (V) risk reduction for other than energy sources. Part I provides general background for appreciating the later chapters and clarifies the fundamental terms hazard, risk, and risk reduction. Part II describes some system safety tools OSH processionals should know. Part III describes some common components of OSH programs and synthesizes all risk-reduction tactics into nine risk-reduction strategies used extensively in subsequent parts of the book. Part IV contains chapters on the hazard sources involving energy exchange—kinetic energy, electrical energy, acoustic energy, thermal energy, fires, explosions, pressure, electromagnetic energy, and severe weather and geological events. Part V addresses hazard sources other than energy sources—hazardous conditions found in workplaces, chemical substances, biological agents, musculoskeletal stressors, and the violent actions of people. Each chapter points out applications of how known practices fit within the nine risk-reduction strategies. My thinking is that this book differs from other books on OSH and system safety in three primary ways. First, unlike other books, this one uses a deductive approach—starting with fundamental definitions and nine risk-reduction strategies, the book demonstrates that thousands of the hazard control measures familiar to OSH professionals are instances of these strategies. Second, the book takes an international approach by not treating any particular set of regulations, directives, or standards as authoritative. A third unique feature is treating as one field the presently distinguished specialties of occupational safety, industrial hygiene, and ergonomics. During my long career working in OSH, I have witnessed a trend in which each specialty develops its own identity, holds its own conferences, has its own journals, and operates its own professional credentialing program. I would like to see this silo- building trend replaced by a shift toward unifying into one overarching field. Although I do not use this book to expressly advocate for this position, I hope that reading the entire book will convince some readers to share my viewpoint. It is my hope that professors who teach a course in system safety will adopt this book. It is appropriate for undergraduate seniors or graduate students who have previously completed introductory courses on OSH topics. Studying this book should provide students enough system safety expertise for an OSH career and help them appreciate how the material learned in prior courses fits into a cohesive package. Students will find the book more relevant to OSH than books

written for system safety professionals, and doing the end-of-chapter exercises (as explained in chapter 1) will help them improve their cognitive abilities for application, analysis, synthesis, and evaluation.

Roger C. Jensen Acknowledgments I am grateful for the very helpful editing provided by Terri Porter. I greatly appreciate the technical and editorial feedback on an early draft used as the text for an online course. Individual students who contributed most were Thomas Brown, Tyler Fortunati, Britani Laughery, Adam House, and Allan Torng. I am fortunate to have a wonderful wife, Marian, who put up with my extended hours working on this book project and too few hours spent sharing the fun things in life. Our daughter Lea Jensen, an industrial hygienist, provided inspiration for this extended undertaking. I owe much to another relative, my cousin Jeffrey Lee, for making me aware of the career opportunities in occupational safety and health. During my career, I have been fortunate to associate with some high-quality people who enabled me to grow professionally. While working 22 years with the National Institute for Occupational Safety and Health, I had some supervisors and mentors I want to acknowledge. Francis Dukes-Dobos and Austin Henschel introduced me to ergonomics. James Oppold, as Director of the Division of Safety Research, allowed me to develop new lines of research on the topics of safety training effectiveness, symbols on warning signs, stairway falls, machine safeguarding, and effects of climatic factors on safety-related behavior. Some of the associates I worked most closely with were John Etherton, Timothy Pizzatella, James McGlothlin, Patrick Coleman, and James Collins. After my NIOSH experiences, I joined a technical services company where I had the privilege of working with John Howard, Julian Christensen, Bill Askren, and Gary Williamson doing diverse projects on product safety, occupational safety, and ergonomics. Since 1999 I have been on the faculty of Montana Tech of the University of Montana, where I have enjoyed working with some wonderful and supportive associates in the Safety, Health, and Industrial Hygiene Department. The author was partially supported by Grant No. OH008630 from CDC/NIOSH. The contents are solely the responsibility of the author and do not necessarily represent the official views on NIOSH. Part I Background Part I lays the foundation for the entire book. Chapter 1 explains the multidisciplinary perspective used throughout—a perspective built on traditional occupational safety and health (OSH), enhanced by contributions from system safety, public health, and educational psychology. Chapter 2 delves into definitions of three terms used extensively in this book—hazard, risk, and risk reduction. Chapter 3 provides examples of common types of conceptual models and charting methods used in the book and the safety and health professions. These background topics are fundamental building blocks for the four subsequent parts of the book that provide the content applicable to the practice of occupational safety and health. Part II explains several practical systematic methods for anticipating hazards, assessing risks, and analyzing systems encountered in occupational settings. Part III discusses programmatic and managerial methods for reducing risks. Part IV gets into the technical aspects of reducing risks associated with various forms

of energy. Finally, part V addresses risk reduction for occupational hazards not directly linked to energy. Chapter 1

Multidisciplinary Perspective

Throughout this book, the field of OSH is viewed broadly to include traditional occupational safety, industrial hygiene, occupational ergonomics, and, to a lesser extent, environmental pollution. To make the book internationally applicable, governmental regulations of the United States and other countries are rarely mentioned. All mathematics uses international units. In this and other chapters, italic font is used for titles of books and journals, and for the first use of technical terms defined at the end of the chapter. Much of part I is based on information covered in traditional OSH books and journal articles. Concepts and methods from three other fields—system safety, public health, and education—are used to enrich and expand the basic OSH concepts and methods described in this book. Contributions from these three fields are provided in the following three sections.

1.1 System Safety Contributions The specialty known as system safety developed in response to needs of the defense and aerospace industries to reduce the enormous costs from failed missile launches and crashed aircraft. After World War II, the United States and the Soviet Union engaged in a race to gain a military advantage. During this period of rapid technological advances, safety took a back seat, and numerous failures occurred during the testing and operational phases of these new systems.1 Safety remained in the background during the 1950s and 1960s when a common practice was to design and build missiles and aircraft, fly them, investigate crashes, identify the apparent problems, fix those problems, and continue operations. This “fly–fix–fly” approach killed many pilots and destroyed many expensive missiles and aircraft. The U.S. Air Force took the lead in changing the fly–fix–fly approach to one involving increased safety input during the design and testing phases of missiles, aircraft, and other major acquisitions. In particular, the Air Force published two sets of requirements: (1) System Safety Engineering for the Development of Air Force Ballistic Missiles, 1962; and (2) General Requirements for Safety Engineering of Systems and Associated Subsystems and Equipment, 1963. The other branches of the U.S. Department of Defense (DoD) followed suit in 1966 with a broadly applicable standard for military acquisitions. A revised edition titled System Safety Program Requirement (MIL-STD-882B) came out in 1969 that has since been modified several times. These developments created a need for specialists to perform the required safety analyses. System safety career positions were available primarily in the DoD, the many defense contractors, and the National Aeronautics and Space Administration (NASA). In 1973, some of those who pioneered the field formed an international professional society to support the new specialty known as system safety engineering. Now named the System Safety Society,

it publishes the Journal of System Safety and annually conducts an international conference. More can be learned by visiting the organization's website (www.system-safety.org). The annual International System Safety Conference provides opportunities to learn about diverse applications of safety analyses. Although many of the presentations focus on safety issues in the military and aerospace industries, applications in other domains continue to grow. One major area of growth is in the transportation domain, where the focus is on improving the safety of passenger trains, buses, ferryboats, harbor traffic, and commercial aviation. Another growth area has been consumer products, where risk assessment has become commonplace. A diverse set of safety analysis tools has been developed since the early days of system safety.1,2 This book addresses a few of the tools considered most appropriate for use by OSH professionals. But before jumping into the tools, readers need to learn what system safety is today. The following definition of system safety comes from a book by Roger Brauer: “System safety is the application of technical and managerial skills to the systematic, forward-looking identification, and control of hazards throughout the life cycle of a system, project, program, or activity.”3 This definition contains several significant words and phrases deserving comment. System safety indicates a concern for a system, a word referring to a mix of equipment, property, and people interacting in an environment for some purpose. Table 1.1 may help clarify this vague description by pointing out different options for defining system levels, from the narrow to the very broad.4 At the narrowest level, a system can consist of equipment functioning without humans. The next level adds an individual interacting with equipment. At a somewhat higher level, a system can be a group of employees interacting to accomplish the employer's objectives. At an even broader level, a system can be employees from multiple employers performing their respective functions to achieve broader objectives. The broadest level listed in Table 1.1 adds consideration of influences from applicable governmental regulators and societal values. Table 1.1 Examples of Systems at Different Complexity Levels. System levela Occupational example Equipment without human

A building heating system with thermostats, furnace, and air circulation ducts

Individual and equipment

A plumber repairing a leaking faucet. An OSH manager composing a memo on her personal computer

Workgroup level An assembly line with interactions among employees and their workstations, supervisors, equipment, and materials

Multiple workgroups A construction site with work being performed by employees of a general contractor and several subcontractors

Highest All employers in a region or country operating under the same laws and regulatory processes

a These levels are adaptations of those described by Erik Hollnagel in Ref. 4.

In the definition of system safety, the phrase “application of technical and managerial skills” indicates the practical orientation of the field. System safety developed as a technical field, but expanded to address the critical role of using managerial systems to implement safety-related practices and procedures. The “forward-looking” phrase in the definition indicates attention on the future—necessarily involving anticipating problems that might occur. In contrast, a backward-looking focus attends more to investigating past incidents with the intent of assigning blame. A backward-looking focus is driven by the needs of politicians and parties to personal injury litigation, with system safety professionals seeing incident investigations as an opportunity to learn things potentially useful for the future. The

core of the system safety community embraces the forward-looking focus by making use of systematic analyses, lessons learned from past incidents, and applicable standards. Another part of the forward-looking focus involves integrating controls into systems to mitigate damage during an incident. Familiar examples are occupant protection features of modern cars like seat belts, air bags, and safety glass in windows. Other examples are engineering devices and software used for monitoring and controlling the complex processes found in industrial systems such as nuclear power plants and chemical processing facilities. The phrase “identification, and control of hazards” refers to the logical, interrelated steps of first identifying hazards within the system and then determining appropriate means to control those hazards. These steps are almost identical to those used in the practice of occupational safety, industrial hygiene, ergonomics, and pollution prevention. History has shown that hazards can easily be overlooked if systematic processes are not used. “Throughout the life cycle” reflects the importance of thinking about the full life of a system during the development stage in order to head off future problems. For example, if a project involves hazardous materials, how will the materials be disposed of at the end of the project? How will ship bodies be dismantled and the materials recycled? What will become of outdated weapon systems? What will become of old respirators? The phrase “system project, program, or activity” indicates that system safety tools and expertise apply to various projects, programs, and activities involving a broad range of systems. Examples of these references to systems are a new fleet of aircraft, a project to develop a prototype, a program for an ongoing organizational function, or an activity such as performing maintenance on equipment. The OSH community has historically underutilized system safety tools. Those who practice system safety as professionals tend to advocate for greater use of their analysis tools by the OSH community. Two advantages of using system safety tools deserve mention. First, the forward-looking focus of these methods can help reduce the risk of harm to people and property. Second, professionals who develop skills using these methods will find that these tools are portable—they travel with the individual throughout the twists and turns of a career and can be easily adapted to OSH practice in different companies, different industries, and even different countries. This book emphasizes the system safety tools most practical for OSH practice: job hazard analysis, risk assessment, failure modes and effects analysis, and fault trees.

1.2 Public Health Contributions The public health community took an interest in injury prevention during the same time the field of system safety was defining itself. Some of the concepts and tools developed in the early days of public health injury prevention remain viable today, and can be useful for risk reduction in the OSH field. Although the public health community recognizes the burden of traumatic injuries as being a public health concern, the governmental bodies that fund public injury prevention have been reluctant to commit a lot of resources to these programs based on the seemingly persistent yet mistaken belief among the general public and legislatures that injuries are inevitable. That belief was the topic of a classic paper by Dr. William Haddon Jr. in the 1968 volume of the American Journal of Public Health.5 Haddon advocated approaching roadway injury prevention with the perspective of public health and preventive medicine. He especially rejected the prevailing public opinion at the time that roadway “accidents” could be prevented by focusing funds on improving driver performance to the exclusion of any other preventive measures. His effective advocacy led to increased funding for

measures addressing prevention of roadway incidents, better protection of vehicles and occupants during a crash event, and more effective post-crash response capabilities. All these types of measures reduce the risks of roadway transportation. To sell his message, Haddon developed a tabular format for sorting out opportunities to reduce risks from roadway crashes.6 Figure 1.1 is an example of the sort of table now known as a Haddon Matrix. The example has three rows for the phases of a crash and three columns for the factors involved, yielding nine cells for identifying phase-specific countermeasures. In other papers, Dr. Haddon showed how this basic matrix format can be adapted by adding more columns for other factors. It may also be applied in domains other than roadway transportation. Figure 1.1 An example of a Haddon Matrix. Adapted from Ref. 6, Figure 13.

Today, the Haddon Matrix, in several forms, is highly regarded as a fundamental tool for guiding

injury risk-reduction programs in many domains. It serves as one of the threads used to weave this book into a cohesive manuscript.

1.3 Educational Theory Contributions In addition to incorporating contributions from system safety and public health, a third field contributed in subtle ways to this book. Known as learning theory in education circles, it provides a framework for structuring curriculum for young children through a university education. The reason for explaining this topic is to make the author's intentions transparent to readers. The OSH profession is in the midst of transitioning from rule-following field to a profession more dependent on effectively using higher level cognitive skills. Many of the Learning Exercises at the end of chapters were written to encourage students to use such skills. These experiences should help the next generation of OSH professionals become more skilled at analysis, adept at conceptual thinking, capable at evaluation, familiar with the science behind the practice, and appreciative of theory. What is meant by higher level cognitive skills? In their often-referenced handbook, Professor Benjamin Bloom and his colleagues at the University of Chicago classified learning into three broad learning domains: cognitive, affective, and psychomotor. Within the cognitive domain, Bloom proposed the following six levels of development.7

1. Knowledge acquisition. 2. Comprehension. 3. Application. 4. Analysis. 5. Synthesis.

6. Evaluation. These classifications remain highly respected by educational theorists in spite of various scholarly proposals for modifications and additions.8,9 For purposes of writing Learning Exercises, the original Bloom levels are quite appropriate and satisfactory. The levels and their relationships are discussed in greater detail below. Learning starts with basic knowledge acquisition. Preschool and elementary school learning experiences are structured to help the students gradually build a core knowledge, starting with the alphabets, numbers, and telling time. This knowledge provides a foundation for developing abilities for comprehending written words and arithmetic operations. Fostering the transition from the knowledge acquisition level to the comprehension level is integrated into the entire secondary education curriculum. The third Bloom level, application, involves making a connection between classroom material and the world outside the classroom, especially with regard to connecting ideas and principles learned in books to everyday decisions and actions. For example, a student taking an introductory psychology course who learned the signs of depression in a book and subsequently recognizes those signs in a friend or relative has successfully applied in the real world what he or she has learned in the classroom. In OSH education, internship experiences after taking some OSH courses are extremely valuable for helping students connect what they learn in textbooks to everyday workplaces. The original Bloom levels were presented as six progressive steps, like rungs on a ladder. Thus, the Bloom concept was that a person needs to develop, for example, levels 1 through 4 in order to develop level 5. Today, the Bloom list may be conceived as having three ordered lower levels (knowledge acquisition, comprehension, and application) with the higher three learning levels at the same level. Figure 1.2 depicts the relationship among these six levels as being shaped like the letter T. Figure 1.2 Relationship among Bloom's six levels of cognitive development.

The fourth level, analysis, involves the capability for examining a complex set of ideas to reach an

end point. Often, the process of analysis involves breaking down the input information into components more suitable for analysis. For example, in a construction safety class, students may be assigned to write a short essay comparing and contrasting two different policies on employee drug testing. They may approach the assignment by creating a list of pros and cons for each alternative policy. This approach helps to organize the comparison and provide a basis for contrasting the policies. The fifth level, synthesis, involves taking extensive input information and developing a model to explain how all the inputs form a logical whole. Some examples of models are provided throughout this book. This entire book is an attempt by the author to present a synthesized model of the OSH field. The sixth level, evaluation, involves comparing a specific something against a list of criteria. For

example, a governmental agency seeking a contractor for a particular project will make public a description of the project and invite proposals. When proposals are in, agency personnel will review and rate each proposal using the applicable criteria. This skill is used extensively in OSH for periodic evaluations of progress on achieving program objectives. The Learning Exercises at the end of each chapter contain items calling on a mix of lower and higher level skills. Table 1.2 provides a short list of topics included in parts II and III of this book and the primary types of cognitive skills used for each topic. Parts IV and V call for using the application level to understand how principles developed in earlier chapters apply to very diverse types of hazards. Table 1.2 Bloom Level Skills for Topics in Later Chapters. Topic Bloom level skills Job hazard analysis 3: Application; 4: analysis Risk assessment 3: Application; 4: analysis; 6: evaluation Failure modes and effects 4: Analysis Fault tree construction 3: Application; 5: synthesis Fault tree analysis 4: Analysis Incident investigation 1: Knowledge; 2: comprehension; 4: analysis Human error 3: Application; 4: analysis

Learning Exercises 1. Career paths vary. A person could, for example, be an industrial hygienist and spend an

entire career in the mining industry. Or the person could work in various industries for a few years each. Which career path appears most fitting for you? Why? 2. Consider a student named Jane. Her father owned and operated a small roofing company, and Jane worked for him during the summers when she was 18 and 19 years old. As an undergraduate in OSH, Jane did two summer internships, one in building construction and the other in roadway construction. Upon graduating, she took a job in the safety department of a bridge construction company. Every year of her 20-year career, she attended a week- long professional development conference filled with seminars on all topics of safety, industrial hygiene, and environmental protection. She attended only the construction- specific seminars. When the construction industry slumped, she found herself in need of employment in a different industry. She knew her safety-related skills were effective in the construction industry, but all her applications for safety positions in other industries were unsuccessful. What lessons can be learned from Jane's story? 3. Consider another young OSH graduate named Robert. As an undergraduate, he did an internship in OSH with a petroleum company in the pipeline operations. After graduating, he worked for a chemical plant doing process safety analyses. After three years, he changed to a job with an aircraft manufacturer doing system safety analyses. When the aircraft contract ended, he interviewed for a product safety position with a manufacturer of washing machines, dryers, and refrigerators. During the interview, he was asked how his prior jobs prepared him for product safety work in the appliance industry. Imagine you are Robert. How could you use information from this chapter to shape an effective answer? 4. Compare and contrast the career paths of Jane and Robert.

5. Obtain the original article by Dr. Haddon in the American Journal of Public Health by following the steps below. After obtaining, read the Background section and write a summary of the main points he makes about (1) terms used when discussing trauma and (2) the etiologic approach used for diseases. The article may be obtained by visiting www.ajph.org, clicking Issues Past and Present, selecting from the grid 1968 and August.

Technical Terms Haddon Matrix

A two-dimensional table for identifying possible countermeasures for public injury problems. It has three rows for the incident phases and three or more columns for system components.

Learning domains

Broad categories for the diverse mental and physical skills humans learn. Bloom defined three categories: cognitive, affective, and psychomotor.

System An integrated mix of equipment, property, and people interacting in an environment for some purpose. System safety A forward-looking and systematic approach to designing safety into a system, project, program, or activity.

3

References

1. Stephans RA. System safety for the 21st century. Hoboken, NJ: Wiley; 2004. 2. Ericson CA, II. Hazard analysis techniques for system safety. Hoboken, NJ: Wiley; 2005. 3. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 665. 4. Hollnagel E. Learning from failures: A joint cognitive systems perspective. In: Wilson JR, Corlett N, editors. Evaluation of human work, 3rd ed. London: Taylor & Francis; 2005. p. 901–918. 5. Haddon W, Jr., The changing approach to the epidemiology, prevention, and amelioration of trauma: The transition to approaches etiologically rather than descriptively based. American J Public Health. 1968;58(8): 1431–1438. 6. Haddon W, Jr., A logical framework for categorizing highway safety phenomena and activity. J Trauma. 1972;12(3): 193–207. 7. Bloom BS, Engelhart MD, Furst EJ, Hill WH, Krathwohl DR.In: Bloom BS, Krathwohl DR, editors. Taxonomy of educational objectives: The classification of educational goals. Handbook I: Cognitive domain. New York: David McKay; 1956. 8. Anderson LW, Krathwohl DR, Airasian P, Cruikshank K, Mayer R, Pintrich P, et al. A taxonomy for learning, teaching, and assessing: A revision of Bloom's taxonomy for educational objectives, complete edition. New York: Longman; 2001. 9. Krathwohl DR. A revision of Bloom's taxonomy: An overview. Theory Practice. 2002;41(4): 212– 218.

Chapter 2

Key Terms and Concepts

The literature on safety and health makes extensive use of three terms—hazard, risk, and risk reduction. This chapter discusses these terms and clarifies their usage in this book.

2.1 Hazard

2.1.1 Sample of Definitions Of the many attempts to define hazard, several representative attempts are listed in Table 2.1.1–8 The first two entries are from dictionaries, the next four from books by respected authors, and the last two from committees. Each definition is separated into three elements: (1) a brief description of a source, (2) words expressing the mechanism of transfer to cause harm, and (3) a description of the harmful consequences. The definitions appear to agree on the following order: Table 2.1 Representative Definitions of “Hazard”

Other than agreeing on order, the definitions differ markedly when compared element to element. For the source element, some definitions appear to include everything and every activity imaginable. These include the phrases “a source of,” “all aspects of technology or activities,” and “something.” The other definitions provide examples of attempts to be more specific. For the mechanism of transfer element, all eight definitions contain bridging words that differ somewhat but convey the concept that a source requires a means to cause some sort of harm. For the harmful consequences element, all eight definitions contain words about the sort of harm or what will be harmed, but the

words differ substantially. Three concise phrases are (1) injury, pain, or loss; (2) harmful effects; and (3) significant harm. The most specific one, found in MIL-STD-882D, is “injury, illness, or death to personnel; damage to or loss of system, equipment, or property; or damage to the environment.” Because many hazard analysis methods begin with identification of hazards, a definition is needed that sets some parameters for distinguishing what is and is not a hazard.

2.1.2 Proposed Definition of Hazard The approach to defining hazard is to start with a simple, easily quotable primary definition as the foundation, supplemented by additional definitions of key words in the primary definition. This approach is used extensively in scientific literature when an equation with several variables is presented, followed by specific definitions of each variable. Thus, the primary definition used in this book is A hazard is a source with potential for causing harmful consequences, where

Source is a form of energy, weather or geological event, condition, chemical substance, biological agent, musculoskeletal stressor, or the violent actions of people;

Potential for causing means the source is sufficient to bring about at least one harmful consequence; and

Harmful consequences are outcomes an organization wants to avoid.

Parts IV and V of this book contain extensive discussion of each item in the source list. The harmful consequences element is open ended, so each organization and/or industry group can enumerate whatever outcomes it values and wants to protect.

2.1.3 Additional Rationale and Clarification This subsection is for readers interested in more in-depth discussion of the foregoing definitions. The source phrases in Table 2.1 include several ways to describe the sources of hazards. The definition from Merriam Webster's Collegiate Dictionary uses the inclusive but vague word “source.”2 The other definitions in Table 2.1 demonstrate the challenge of trying to be more specific or more general. In this discussion, the limitations of these attempts are noted, and the rationale for listing particular sources is provided. For the source part of the definition, energy is a major component. Energy exists in both potential and transitional states. The potential state of energy involves stored energy such as a compressed or stretched spring, gravitational potential energy, thermal energy within materials, compressed gases, and magnetic fields. The transitional state takes several forms. Kinetic energy consists of materials moving from one place to another, as well as objects rotating. Electrical energy hazards include current traveling in a transmission line and electrons moving in lightning, static discharges, and arcs. Electromagnetic radiation contains harmful forms of ionizing radiation and nonionizing radiation. Chemical energy hazards in the transitional state include active chemical reactions (e.g., fire and explosions) that produce heat, gases, and high pressure. Pressure being transferred from a location of high pressure to a location of low pressure is a form of transitional energy. Heat energy hazards often arise from other forms of energy such as chemical reactions and electricity passing through a resistor. But the manifestation of heat energy in workplaces deserves specific recognition in a list of transitional energy states. Heat transfers from a warmer to a cooler body through conduction, convection, or radiation. These transfer processes can involve the potential

to harm people, property, or the environment. For example, hot objects can burn skin through contact or ignite some flammable vapors, and work in hot environments can transfer enough heat to a person to cause a disorder such as heat exhaustion or heat stroke. Severe weather and geological events are recognized as hazards involving multiple forms of transitional energy. Hazards of nature include storms, floods, landslides, tornados, hurricanes, drought, wildfires, earthquakes, tsunamis, and volcanic eruptions. For the source part of the definition, the word “condition” is common. It clearly includes static situations such as a slippery spot on a floor, a stairway with riser heights that vary substantially, and a room containing flammable vapors. It may also include forms of potential energy such as a stretched spring, materials stored overhead, and compressed gas cylinders in a laboratory. A human–machine interface so poorly designed that it invites mistakes could also be considered a condition. A work area with airborne particulates is a condition that threatens the health of those working in the area. Despite its broad scope, “condition” does not encompass everything we recognize as hazard sources; it omits, for example, active/transitional forms of energy, biological agents, flammable materials, and volcanic eruptions. Thus, the word “condition” belongs in a definition of hazard, but is not sufficiently comprehensive to describe everything commonly recognized as a hazard. Chemical substances, although highly useful to society, are recognized as hazards because of their potentially harmful effects on humans and other living entities. Some chemicals can kill by asphyxiation. Numerous chemicals, notably fuels, are recognized as hazards because of their flammability. Many chemicals are considered hazards because of their inherent explosive, corrosive, or reactive properties. Some increase risk of cancer, genetic mutations, or birth defects in the offspring of those exposed. Numerous biological agents are sources of occupational hazards. Infectious diseases like flu and colds are threats in all workplaces where people interact. Infectious agents like hepatitis and HIV are especially a concern to healthcare personnel. Plants like poison ivy and poison oak are recognized as sources of allergic reactions. The research and development community has created numerous biological agents capable of harming people. Wild animals, pets, and farm animals are sources of injuries and several infectious diseases. Musculoskeletal stressors are another important source. Although the vast majority of muscular work is healthy, musculoskeletal stressors become a hazard when the level of stress approaches or exceeds the tolerance of the person's body. The most frequent workers' compensation claims are musculoskeletal injuries and disorders.9 Events directly causing most of the musculoskeletal injuries are overexertion from excessive lifting, pushing, pulling, holding, carrying, or throwing. Many other musculoskeletal injuries are from bodily reaction to slipping or tripping without falling. Highly repetitive motion accounts for another significant proportion of the musculoskeletal claims. In addition to hazard sources mentioned above, the violent actions of people are the source of some hazardous situations. Among these are the highly dangerous situations created when armed robbers hold up a bank, terrorists hijack an airplane, or a recently discharged employee shows up at a worksite with a gun intent on shooting a supervisor. Once initiated, these situations can turn in many directions and end with outcomes ranging from no one being hurt to multiple deaths. The second part of the definitions found in Table 2.1 is the bridge phrase. Although expressed in several ways, the substance of this part is quite similar across all eight definitions. Read as a group, the definitions indicate the bridge phrase should indicate that the hazard exists prior to the harm, that existence of a hazard can cause harm while not going so far as to say the source will cause harm, and that the level of intensity of the hazard source needs to be sufficient to cause the harm.

The rightmost column of Table 2.1 shows different ways to describe harmful consequences. The ANSI/AIHA management systems standard sticks closely to people outcomes—injuries, illnesses, and death.8 Some of the other definitions go beyond people, including damage to equipment, property, systems, and structures. The differing items identified as being harmed by a hazard reflect differences in the values and backgrounds of the various authors and committees. To further highlight the difficulty of listing all items we wish to protect from harm, consider this contrast in perspective. A farmer with income from selling eggs would consider the chickens as valued property, and anything that could harm the chickens, like a fox, would be a hazard. In contrast, a wildlife ecologist would view the same fox as a valued part of the ecosystem deserving protection from the farmer's shotgun. Thus, if a definition of hazard incorporates a list of items that could be harmed, then no single definition will suit all authors and all organizations because of their differing values. Fine-tuning the definition of hazard is more than a point for philosophical discussion. A workable definition is useful to an organization when trying to anticipate, recognize, and control hazards. One processing plant may wish to define a hazard as any threat to harm employees. A second processing plant in the same business as the first may choose to define hazard as any threat to harm employees and visitors, or damage equipment, raw materials, in-process materials, finished product, and the ground on which the plant sits. These examples illustrate some of the endless variations in what organizations might wish to include in a definition of hazard. In conclusion, any definition of hazard that attempts to list each item of concern will be verbose and may not accurately reflect the values of all organizations. The preferred approach is to have a definition that is both concise enough to be easily remembered and quoted and flexible enough to allow each organization to define whatever it is they value and wish to protect.

2.2 Risk The word risk is used in numerous ways by the public and in professional circles. Articles in the safety-related journals use risk in three basic ways. Definition 1 says risk is a probability. Mathematicians agree that all probabilities are numerical quantities with a value in the range of zero to one, and these pure probability values have no units. Sometimes it is convenient to multiply the pure probability value by 100 in order to report it as a percentage. Books on probability and statistics use several notations for probabilities. Common notations to indicate probability of event B are PB and P(B). Using the second notation, the first definition of risk is (2.1) Definition 2 says risk is the product of probability and severity. This definition is used in the insurance industry and business community to forecast expected monetary loss for a particular set of inputs. Expected loss may be expressed in equation form as (2.2) where

E(lossB) is the expected value of financial loss from event B, P(B) is the probability of event B occurring, and LB is the estimated financial amount of loss if event B occurs.

This definition may be applied to forecast losses from multiple events. For example, if three events (A, B, and C) have the potential to produce losses of LA, LB, and LC, respectively, then the expected loss may be calculated as (2.3) Definition 3 says risk is the combination of probability and severity. Some authors call this the “doublet” of probability and severity. When this definition is used, most authors are visualizing a two-dimensional risk-assessment matrix such as that shown in Figure 2.1. Figure 2.1 Example of a two-dimensional risk-assessment matrix.

Some organizations add a third dimension when using risk assessment—typically frequency of

exposure. If there are three levels of frequency, for example, the risk assessment will use a risk matrix for each frequency category. This could be considered a fourth definition of risk, but for this book it is considered a variation of the third definition. Which of these three concepts of risk is preferred? Actually, all three concepts are valid and useful in various situations. Definition 1 is supported by the public health community, particularly the epidemiologists. For example, risk has been defined as “A probability that an event will occur (e.g., that an individual will become ill or die within a stated period of time or by a certain age).”10 Definition 2 is a monetary definition, supported by the business community and the related specialty known as risk management. The entire basis for underwriting relies on the ability to predict the expected value of claims for each policy. Underwriters do this by using past experience to estimate the probability and monetary value of claims for the specific policy. The expected loss, or risk, is a summation of all the foreseeable losses using an extension of Equation 2.3. An insurance policy transfers the monetary risk from the insured to the insurer, and the insurer spreads the risk among the many insured clients. This definition is also used in the system safety community. Although Definition 2 is useful when the loss can be expressed in monetary units, it presents problems if the monetary value of an event is controversial. For example, what value should an employer put on an incident that causes an employee's death, brain damage, or paralysis?

The risk-assessment matrices such as the one in Figure 2.1 illustrate Definition 3. The U.S. military has long used such a framework for risk assessments of major procurements. Variations and features of these tables are discussed in more detail in chapter 5.

2.3 Risk Reduction Several terms for efforts to make systems safer are found in the OSH literature. This section explains the rationale for choosing risk reduction as the best term for describing the diverse efforts to improve the safety of systems. Choosing an appropriate term involved trying to satisfy two criteria. The first came from the pioneering concepts of Dr. Haddon, concepts still highly regarded in the public health injury control community. His simple idea was that vehicle crash events involve three phases, and each phase affords opportunities to reduce losses. The original phases were called pre-crash, crash, and post-crash.11 Haddon's later papers expanded these three phases to include all forms of trauma from energy exchange.12 Today, these phases are called pre-event, during event, and post-event. Thus, a term was sought that would capture the fundamental concept that harmful events consist of three phases. The second criterion came from the various definitions of risk discussed in the preceding section. Recall that the first definition involves specifying a medical outcome, and then defining risk as the probability of that outcome. This definition is valuable for medical research, but less useful for OSH because it implies there is only one way to reduce risk—reducing the probability of the event occurring. More useful are the second and third definitions of risk because they include both the probability of the event and the severity of the harmful consequences. A term was sought that would apply to all these definitions. In the process of looking for the best term, some competing terms were considered. The term hazard control was considered because it is used extensively in the safety literature. It implies existence of a hazard and one or more ways to control that hazard. However, it does not encompass any efforts involving post-event response, rehabilitation, or restoration. Figure 2.2 depicts the distinction between the terms hazard control and risk reduction. Using the Haddon phases, the graphic indicates that hazard control is appropriate for efforts (or countermeasures) aimed at the first and second phase. However, it is an inappropriate term if the third phase is included. Figure 2.2 Incident phases keyed to the terms “hazard control” and “risk reduction.”

Another possible term is the one used by Dr. Haddon—loss reduction. Although this term

encompasses the efforts in all three phases, it remains problematic due to its association with monetary losses. Thus, an alternative word was sought. The word risk was chosen because it embodies the concept of harmful outcomes, including but not limited to monetary losses. Based on the above rationale, risk reduction means to lessen risk, and risk means any of the three

definitions discussed in the previous section. Thus, we can reduce risk by

Reducing the probability of a specified undesired outcome, Reducing the severity of the harm, Reducing the exposure to a harmful agent, or Combining two or more of the above.

The three terms discussed in this chapter figure heavily in the concepts addressed in the five major parts of this book. The chapters in part II address methods for analyzing hazards and assessing risks. Part III contains chapters on program management approaches for reducing risks; and parts IV and V contain chapters on risk-reduction strategies and tactics applicable to each of the hazard sources introduced in this chapter.

Learning Exercises 1. The definitions of hazard in Table 2.1 are only a sample of many definitions. Review

other OSH books or standards to find another definition. Respond to items a, b, and c below. a. Provide the definition.

b. Give the reference to it.

c. Explain how it might be broken down into three parts as was done with the definitions in Table 2.1.

2. In the 2001 ASSE Dictionary of Terms (see Ref. 11), the definition of hazard contains the word risk. This same book defines risk as “a measure of the combined probability and severity of potential harm to one or more resources as a consequence of exposure to one or more hazards.” In the first definition of hazard in Table 2.1, substitute the foregoing definition for the word “risk.”

a. With the substitution, how would hazard be defined?

b. What are your thoughts about this?

3. Ericson advocates a three-part hazard description.13 The three parts are (1) a hazardous element, (2) an initiating mechanism, and (3) the target and threat. Compare these three elements with the three elements used in Table 2.1 (i.e., source, mechanism of transfer, and harmful consequence).

a. What are their similarities?

b. What are their differences?

4. This chapter discusses three definitions of risk. Review other OSH books or standards to

find another definition. Respond to items a, b, and c below. a. Provide the definition.

b. Give the reference to it.

c. Indicate which of the three definitions of risk aligns best with the definition you found. If there seems to be no good fit, explain.

5. The psychology literature contains many papers reporting surveys about the public's perceptions of risk and risk-acceptance decisions. These surveys examine how the public views risks such as living near a chemical plant, traveling by commercial air, driving a car, and smoking cigarettes. Results of these surveys often disclose discrepancies between public perception and objective measures of risk.

a. Do you think risk perception should be included as a fourth type of risk definition?

b. What is your rationale?

6. Measures of risk are not uniform across industries. Compare the occupational injury statistics, which generally measure risk as a ratio of number of cases to number of person- hours worked during a year, to transportation industries, which traditionally report a ratio of number of deaths (or other events) to distance traveled in miles or kilometers. In both domains, the raw ratios are multiplied by a constant to make the ratio values more convenient for reporting. Ignoring the use of a constant multiplier, comment on what you think is the reason for reporting differently in the occupational domain and the transportation domain. 7. In the occupational domain, some older reports about safety performance used a ratio of number of injuries to number of items produced. Explain why you think labor unions strongly opposed this approach. 8. Two very different indicators of safety find use of the specialties focused on transportation safety. One uses fatalities per million kilometers or miles traveled. A second uses fatalities per 200 000 person-hours worked. Which ratio would be most relevant to each of the following? State your reasons.

a. Someone planning a trip from Paris to Munich with options for traveling by plane, bus, train, or personal car.

b. Someone contemplating a career as a flight attendant versus another occupation.

Technical Terms Harmful consequences

An organization-specific enumeration of whatever is to be avoided.

Hazard A source with potential for causing harmful consequences. Hazard controls

For a specified hazard, various approaches intended to prevent the hazard from causing harm or to reduce the severity; similar to risk reduction but not including post-incident efforts to reduce consequences. See Figure 2.2.

Potential for causing

Phrase meaning the source is sufficient to bring about at least one harmful consequence. Sufficient in this sense considers both the source (e.g., concentration, level, energy level, etc.) and tolerance of whatever might be harmed.

Risk A general term acknowledging the possibility of an undesirable event. Three definitions are used in the OSH community: (1) probability of a specified event, (2) expected loss, and (3) combined consideration of probability and severity using a risk-assessment matrix.

Risk reduction

Term for any effective means of lessening risk.

Source When used in the definition of hazard, a source may be a form of energy, weather or geological event, condition, chemical, biological agent, musculoskeletal stressor, or the violent actions of people.

References

1. Lack RW, editor. The dictionary of terms used in the safety profession, 4th ed. Des Plaines, IL: American Society of Safety Engineers; 2001. 2. Merriam Webster's Collegiate Dictionary, 10th ed. Springfield, MA: Merriam-Webster; 1995. 3. Roland HE, Moriarty B. System safety engineering and management, 2nd ed. New York: Wiley; 1990. 4. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 25. 5. Stephans RA. Systems safety for the 21st century. Hoboken, NJ: Wiley; 2004. Chapter 17. p. 11. 6. Heinrich HW. Industrial accident prevention: A scientific approach, 4th ed. New York: McGraw- Hill; 1959. 7. U.S. Department of Defense. 2000. MIL-STD-882D, Definitions section. Available at http://www.wbdg.org/ccb/FEDMIL/std882d.pdf. 8. ANSI/AIHA Z10 Committee. Occupational health and safety management systems: ANSI/AIHA Z10-2005. Fairfax, VA: American Industrial Hygiene Association; 2005. 9. Klein BP, Jensen RC, Sanderson LM. Assessment of workers' compensation claims for back strains/sprains. J Occupational Medicine. 1984;26(6): 443–448. 10. Bailey LA, Gordis L, Green M. Reference guide to epidemiology. In: Reference manual on scientific evidence, 2nd ed. Washington, DC: Federal Judicial Center; 2000. Available at http://www.fjc.gov/library/fjc_catalog.nsf. 11. Haddon W, Jr. A logical framework for categorizing highway safety phenomena and activity. J Trauma. 1972;12(3): 193–207. 12. Haddon W, Jr. The basic strategies for reducing damage from hazards of all kinds. Hazard Prevention. 1980;16(5): 8–12. 13. Ericson CA, 2nd. What's in a hazard? J System Safety. 2005;41(3): 6–9.

Chapter 3

Tools for Analysis and Synthesis

This chapter introduces two types of tools used to aid communication, analysis, and synthesis. Section 3.1 introduces various types of models and section 3.2 discusses charts of various kinds. In both sections, the focus is on the tools rather than the examples.

3.1 Using Models for Safety Analyses Models are representations of systems. This section introduces the idea of modeling systems and provides examples of some types of models useful for safety analyses. The types of models introduced here are physical models, graphic relationship models, physics models, and mathematical models.

3.1.1 Physical Models Physical models are three-dimensional physical constructions made similar to the actual system. For example, a model train is a scaled-down version of a real train. Flight simulators are made to provide a safe environment for pilot training and skill enhancement. Driver simulators are used for highway safety research. Mock-ups are commonly made during product design, and sculptors often make small models before starting their full-scale work. Physical models are also used for usability testing of products and assembly workstations.

3.1.2 Graphic Relationship Models System safety projects start with a description of the system that includes a conceptual representation of the system. Graphic relationship models are practical for modeling a specific system or a generic system. The example of a graphic model representing a generic system comes from a study by Cohen et al. (Figure 3.1).1 They reported findings from in-depth investigations of 80 stairway falls. Their information about the cases is organized into a graphic model depicting the interactive nature of three system elements: user, stairway, and environment. The graphic model is an effective way to show that a change in one element may, and often does, affect one or both the other elements. Figure 3.1 Example of graphic relationship model for user–stairway–environment system. Adapted with permission from Ref. 1.

3.1.3 Physics Models Models based on the laws of physics are called, in this book, physics models. They typically consist of a diagram paired with one or more equations. Readers may review their college physics textbook to see numerous examples. In one popular physics textbook, the authors provide a general problem- solving strategy in which a diagram is the second of eight steps: read problem, draw diagram, label physical quantities, identify principles, choose equations, solve equations, substitute known values, and check answer.2 Thus, even physics textbook authors recognize the utility of developing a diagram before choosing equations. Electrical circuit diagrams are one type of physics model. These display components of a circuit arranged as the actual circuit. The equations for describing current, voltage, and resistance are the same for the actual circuit as for the diagram. Some people call such models analog models because the diagrams are analogous to the actual circuit. Another kind of physics model uses a free-body diagram as the analog for actual objects and forces. These diagrams depict a solid object (free body) with vectors indicating forces, directions, and lines of action. The equations paired with the diagram indicate how the attributes of the vectors relate. For example, suppose the system of concern is an industrial workstation in which a seated person works with arms forward in a fixed position. Because the position is held fixed, the whole body is treated as a free body. The diagram in Figure 3.2 may be used to show gravitational forces acting on the upper arm, forearm, and hand of the seated person. These forces create a clockwise moment on the shoulder. The shoulder muscles can hold the position by generating a counterclockwise moment of the same magnitude. This sort of model provides the foundation for various biomechanical models used in ergonomics. Figure 3.2 Example of force diagram for a biomechanical model.

Biomechanical models are now available as software. Depending on preferences, these may be

called computer-assisted mathematical models or computer models. Also related are mathematical models for human biological systems (see Ref. 3 for an introduction to biomathematical modeling).3 Another type of computer model is used for reconstructing vehicle collisions. The analyst inputs known data about roadway attributes, skid marks, weather, damage to vehicles and roadway elements, and witness testimony. The models provide outputs based on engineering computations to indicate the probable sequence of events and speeds of the vehicles. A common use is for litigation to determine fault and liability.

3.1.4 Mathematical Models Mathematical models are used to define relationships among variables and constants. A model of the exponential growth of a population provides an example. Given the number of people in the present population (N0) and a proportionality constant (r), the following model allows prediction of the number of people in the population (N) after a period of time (t) has elapsed: N = N0 e

rt. This type of mathematical model describes a quantitative relationship between a dependent variable and a set of input variables. In this case, if the constant r is known, and values are specified for N0 and t, the specific value of N will be determined from the calculations. However, because the model validity is based on several assumptions, the calculated N will be only be a prediction, not the precise number of people at that future time. Statistical models are another type of mathematical model. A common use is to describe experimental results involving the effects of experimental variables on a dependent variable. These models include an error term to account for the inexact nature of the relationship. For example, an investigative team might test 10 human subjects in a laboratory to learn about the relationship between heart rate and clothing while pedaling on a stationary bicycle. The test data may be used to construct an analysis of variance model: where HRij is the dependent variable (heart rate) of subject i in clothing condition j, μij is the grand mean heart rate for all subjects in all clothing conditions, Si• is the effect of subject i averaged over all clothing conditions, C•j is the effect of clothing condition j averaged over all subjects, and ij is the term to account for the variations unexplained by the other terms in the model.

The models presented above illustrate the diverse types of models used for safety analyses. Several more are described later in chapters. Equally useful are various charting methods.

3.2 Using Charting Methods Various charting methods are useful for sorting out complex systems and processes. The charting methods introduced here are process flow diagrams, organization charts, event trees, and analytical trees.

3.2.1 Process Flow Diagrams Process flow diagrams provide a flexible methodology for modeling interrelationships among processes and order. For one common use—planning projects—project team members identify each work process they will need to complete the project. Then they organize the processes in the form of a process flow diagram. For another common use—diagramming industrial processes—these charts depict the order in which a material or product flows through the various processes from initial input to final product. Process flow diagrams are relatively easy to develop once the processes are broken down and understood. Software is readily available and often packaged with software suites, word processing programs, and presentation software. The most conventional arrangement for process flow diagrams is to depict flow from the top downward. Sometimes it is useful to have the flow proceed from left to right or in a mixture of directions. Occasionally, the flow is presented in a circular arrangement. The conventional symbols use rectangles to depict processes, diamonds to depict decisions, and lines with arrowheads to show the ordered flow. An example of how a process flow diagram can be used to model processes is shown in Figure 3.3. All but the first and last rectangles in the example have one input arrow and one output arrow. Other options for developers of process flow diagrams include having multiple arrows on the input side to show multiple inputs to the process and connecting multiple arrows on the output side to show multiple outputs. Figure 3.3 Example of a process flow diagram for a semester project report.

A common misuse of multiple outputs from a rectangle is to show alternative paths. The correct

way to show alternative paths is to use a diamond. Outputs from diamonds often involve alternative paths based on a decision indicated by text inside the diamond. The example presents the decision as a simple question calling for a “yes” or “no” answer. Diamond shapes may also be used to indicate a choice between three options by starting each option path on a corner of the diamond not occupied by an input arrowhead. The model depicts a process in a college course. The instructor assigns students to select a topic for a semester project. The students are to pick a topic, search for relevant literature, write a description of what they found, and submit their proposal to the instructor for approval. If the proposal is not approved, the student goes back to the topic selection process, and using feedback from the instructor, develops a more suitable topic. Once the instructor approves the topic and literature review, the student proceeds to finish the project. Many books on human factors and ergonomics contain a graphic human–machine interaction model. The authors differ on the complexity and the fine points of presentation, but agree on the overall concepts.4 These models depict the two major components—the human and the machine— operating within an overall environment. Figure 3.4 depicts the human component on the left and the machine component on the right. Within these major components are process boxes and arrows arranged in a circular manner to depict a counterclockwise flow of processes within each major component. While a person is interacting with a machine, such as driving a car in city traffic, the person frequently repeats the cycle depicted in order to meet the ever-changing requirements for collision-free travel. Figure 3.4 Example of a circular process flow diagram.

3.2.2 Organization Charts Organization charts are top-down charts used extensively to help structure organizational management and concisely communicate the organizational hierarchy. Software for creating such charts is readily available and easy to use. This form of chart finds use in system safety for modeling complex systems. A basic step is breaking down a complex system into units more amenable to manufacturing and safety analyses. Organizations involved in large system development projects can make good use of organization charts when parceling out safety analysis projects and allocating resources to the subsystems and assemblies most critical to system safety and reliability. Figure 3.5 shows a general model for breaking down a complex hardware system. It also illustrates a top-down system for numbering various units of the overall system. In the illustration, the overall system is broken down into three subsystems numbered 1.0, 2.0, and 3.0. Beneath each subsystem are assemblies numbered to indicate their parent subsystem. This systematic approach is followed in each branch as it divides into smaller units identified as subassemblies, components, subcomponents, and parts. Figure 3.5 Example of an organization chart for breaking down a complex system.

In system safety, the organization chart provides the format for a functional tree. A functional tree

has at the top a statement of the overall system goal. Below that, the first tier breaks down the overall goal into more than one major function. The lower tiers in each branch may show the systems involved in achieving the respective function. Lower breakdowns may resemble those in Figure 3.5. Examples of function trees are provided in books on system safety.5,6

3.2.3 Event Trees Event trees are tools to help analyze possibilities over time. In these charts, time progresses from left to right. These may take different forms, depending on the wishes of the analyst. Commonly, the left column indicates an undesired/initiating event. Branching moves left to right through various intermediate events, with the branches splitting at each intermediate event. Typical splits are based on answering yes or no to a simple question or indicating the success or failure of a safety mechanism. Each branch ends in the outcome described in the last column on the right. An example event tree is shown in Figure 3.6. It applies to the foreseeable event of a roofer falling. From the initiating event on the left, the path divides at each intermediate event resulting in multiple paths. At the right of the event chart, each path ends with a likely outcome. In the example, the roofer may have been wearing a harness connected by a lanyard to a secure cable on the roof. The first intermediate event asks whether the fall was arrested by a lanyard. In that case, the first path is the top one marked “yes.” The most likely outcome would be a painful experience when the fall is rapidly arrested, but no substantial injury. For the roofer who was not tied off, the second intermediate event accounts for the possibility of landing on a bush or other object that would cushion the impact. In addition, the third intermediate event allows the possibility of the roofer landing on his head/neck versus avoiding this worst-case impact position. Thus, this example event tree identifies five foreseeable paths between the initiating event and the outcome.

Figure 3.6 Example of an event tree.

Event trees are also useful for following the probabilities of each path at each juncture. Examples of

these are found in systems safety literature, including books by Modarres and by Ericson.6,7

3.2.4 Analytical Trees Analytical trees are charts that show logical relationships among events and conditions. Usually, the top event is the one of greatest interest, while the lower events may be thought of as causes of the events higher in the chart. These are called trees because they resemble the shape of an evergreen tree, with the widest spread at the bottom and the narrowest at the top. Figure 3.7 shows a simple arrangement. Figure 3.7 Example of an analytical tree.

The box shapes represent events or conditions. Text inside the boxes describes the event or

condition. Other events and conditions are indicated by ovals and diamonds. Between these boxes, ovals, and diamonds are logic gates. The most common gates indicate logical conditions that, if met, allow upward flow. For example, in the tree shown, the left-hand side branch indicates that event X

will occur only if event X1 and event X2 occur. The right-side branch indicates that event Y will occur if either event Y1 or event Y2 occurs. The top event will occur if both event X and event Y occur. Chapters 7 and 8 are devoted to the most common type of analytical tree used in safety analyses—the fault tree.

3.3 Summary of Part I The three chapters in part I provide background for the entire book. Chapter 1 introduces the multidisciplinary foundations for this book, in which traditional OSH knowledge is supplemented by concepts from system safety, public health, and educational theory. Specialists in system safety use numerous systematic methods for examining systems to anticipate hazards and find feasible means of reducing risks. Pioneers in public health injury prevention programs contributed logical ways of looking broadly at nonoccupational injuries to find risk-reduction opportunities acceptable to the public. Educators provide the theoretical structure for the end-of-chapter exercises aimed at strengthening higher level cognitive abilities. Three important terms are discussed in Chapter 2. The first section compares and contrasts several definitions of hazard. The section ends with a proposed definition that includes a list of seven hazard sources—forms of energy, weather or geological events, conditions, chemical substances, biological agents, musculoskeletal stressors, and violent actions of people. The second section explains the three definitions of risk. It concludes that each definition of risk has utility. The third section provides the rationale for using the term risk reduction in the title of this book and in many places throughout the book. Chapter 3 introduces several useful tools for analyzing and synthesizing systems—some of these tools are models of processes and relationships, others are charting methods used extensively in system descriptions and analyses. Many authors use these tools to enhance communication in their papers, reports, and books. Applications of these tools are illustrated in several chapters in parts II–V.

Learning Exercises 1. Find a textbook for a college course. Search the book to find a model. Models are

common in economics, biology, toxicology, and engineering. If you look in a physics or engineering textbook, do not use equations found at the beginning of a chapter for your example (these are not representations of any particular system). Instead, use an example problem in which the author has described a particular situation and reduced it to a free- body diagram or analogous mechanical system.

a. Write a brief description of the model you found.

b. Indicate your view as to what type of model it is.

2. Consider the graphic relationship model for the generic user–stairway–environment interaction shown in Figure 3.1. Assume that you need to investigate an incident of a man seriously injured from falling while descending a flight of stairs. The man admitted to being distracted by a pretty woman who was ascending the stairs. Explain how you might use the model to help you think about the distraction factors in relation to other factors.

3. Make a process flow diagram to depict what a college student goes through during an academic year to secure a job when school lets out. It could be an internship position or a career position. Allow various possibilities including (1) the first interview is botched so no offer is made, (2) the second interview lands a so-so offer, and (3) the third interview leads to a fabulous offer. Include at least one process, one decision, and one feedback loop (an arrow going from a lower decision diamond back to an earlier process indicating the need to reprocess something). 4. Suppose you are asked by a power tool manufacturer to help with a comprehensive safety analysis of a new model handheld rotary power saw. You decide to start by making a functional tree using an organization chart format.

a. Make a list of major functions suitable for the first tier of the tree.

b. Using software available to you, make the chart with the top box indicating what you regard as the goal of a person-tool system and putting the functions in the first tier. If charting software is unavailable, you can (1) use spreadsheet software, with cells serving as the boxes in an organization chart, or (2) use the table function in your word processing software. Both alternatives can be made to look similar to an organization chart if you format the cell borders appropriately.

5. Part I of this book has three chapters. What was the rationale for grouping these topics into a unit called part I? 6. For supplemental reading on the use of modeling for safety analyses, an article by Pat Clemens is recommended.8 He explains how models are used in system safety and provides a critical commentary on sloppy practices.

a. When he talks about “fidelity” of a model, what does he mean?

b. Explain his analytical progression of models based on the degree of fidelity.

c. What sloppy practice does the article author consider most pervasive?

d. Near the end of the article, Clemens provides advice for minimizing the effects of the errors and assumptions from modeling. Briefly list the items of his advice.

Technical Terms Analytical trees Charts for analyzing systems using probability and other mathematics. Event trees Charts for showing how a specified event can result in multiple paths leading to different end points. Graphic relationship models

Two-dimensional or three-dimensional depictions of the elements in a system and their interrelationships.

Mathematical models

Generic equations relating variables and constants under various assumptions.

Models Representations of systems. Organization charts Two-dimensional arrangements for depicting the hierarchical structure of units within an organization. Physical models Three-dimensional physical constructions made similar to the actual system represented.

Generally, simplified drawings representing the variables in an equation paired with the drawing. Some common

Physics models variables are objects, vectors, time, and distance.

Process flow diagrams

2D graphics showing order of flow among processes and decisions.

Statistical models Equations to explain relationships among specified variables, including unexplained variability known as error.

References

1. Cohen J, LaRue CA, Cohen HH. Stairway falls: An ergonomics analysis of 80 cases. Professional Safety. 2009;54(1): 27–32. 2. Serway RA, Faughn JS, Vuille C, Bennett CA. College physics, 7th ed. Belmont, CA: Thompson Brooks/Cole; 2006. p. 16–17. 3. Chandler AP. Human factors engineering. New York: Wiley; 2000. 4. Wilson JR, Methods in the understanding of human factors. In: Wilson JR, Corlett N, editors. Evaluation of human work, 3rd ed. London: Taylor & Francis; 2005. p. 6–10. 5. Bahr NJ. System safety engineering and risk assessment: A practical approach. New York: Taylor & Francis; 1996. p. 191–199. 6. Modarres M. Risk analysis in engineering: Techniques, tools, and trends. Boca Raton, FL: CRC; 2006. p. 30–37. 7. Ericson CA, II. Hazard analysis techniques for system safety. Hoboken, NJ: Wiley; 2005. p. 223– 233. 8. Clemens P. Modeling in system safety: A significant source of error. J System Safety. 2009;45(1): 13–17. Part II Analysis Methods Part II contains five chapters about analysis methods applicable to workplace risk reduction. Chapter 4 describes job hazard analysis—a common method for analyzing jobs and tasks by listing steps involved, identifying for each step the potentially hazardous events and exposures, and recording appropriate precautions. Extending job hazard analysis to a higher level of sophistication leads to the topic of chapter 5, risk assessment—a process widely used by businesses involved in making and distributing products and equipment to consumers, businesses, and governments. Risk assessments are useful for assessing risk before implementing efforts to control, recording plans to minimize risks, and documenting the rationale for making decisions on residual risks. Chapter 6 explains the basics of failure modes and the effects analysis—a method used extensively for analyzing equipment to clarify the foreseeable consequences of failures involving parts, components, assemblies, and systems. Chapter 7 presents fault tree diagrams—a type of graphic model useful for understanding the events and conditions that could lead to an undesired outcome specified at the top of the tree, typically a major disaster. A developed fault tree contains extensive information discernible from visual examination, but even more information can be obtained using the analytical methods described in chapter 8. The three methods described are mathematically estimating the probability of specified harmful events, identifying sets of basic events that can cause the undesired event at the top of the tree, and finding common cause failures—single failures with

potential to cause a disaster. All methods presented in part II can be applied to the diverse sorts of hazards encountered in the practices of occupational safety, industrial hygiene, and occupational ergonomics. Chapter 4

Analyzing Jobs and Tasks

4.1 Basics of Job Hazard Analysis Job hazard analysis (JHA) is a systematic technique for analyzing the hazards involved in a defined job or task. Many companies and governmental organizations use JHA, but not everyone calls it by the same name. It is also called job safety analysis. In this chapter, JHA methodology is explained and discussed in sections 4.1–4.3. Some related types of analyses are introduced in section 4.4. A conventional format for a JHA form is shown in Figure 4.1. The form consists of an upper section and a lower section, usually on a single sheet of paper. The upper section is for recording information about the task, job title, company, department, analyst, and signature dates. Many forms also have a space for recording applicable work tools and safety equipment. The lower part is a table for recording information about the hazards and risk-reduction tactics.

Figure 4.1

An initial point of discussion concerns the term job. Usually, a job refers to an employee's position (e.g., carpenter, engineer, and receptionist). Such jobs typically consist of multiple functions, and each

function can include one or more tasks. JHA is used to analyze a task, not an entire job. So if we were more precise on terminology, we would call the technique a task hazard analysis. This term, however, has not found acceptance in the safety community, so this book uses the conventional name JHA. This chapter provides a brief overview of JHAs and some comments on alternative approaches for standardizing JHAs within a company. For a more in-depth treatment of JHAs, consult a book by George Swartz.1 He provides numerous examples of completed JHAs. Free instructional material on JHAs can be found on Internet sites, including that of the Canadian Centre for Occupational Health and Safety.2 Both sources provide advice on how to select tasks for analysis and how to use the information to improve workplace safety. For a thorough review of the history of JHAs, with recommendations for getting the most value from the effort, a paper by Glenn is recommended.3 The JHA table provides three columns for recording the components of a typical JHA. The left column is for listing the steps involved in completing the task. For each step, there may be zero to several potential hazards noted in the middle column. The right column is for recording one or more tactics for reducing the risk associated with the hazard in that row of the table. Some thoughts on how to record information in each column are provided in the following sections.

4.1.1 Step Column Before embarking on a project to develop JHAs, ask the company human resources department for job or position descriptions for those positions you plan to analyze. Job descriptions generally list the job functions and abilities needed for performing each function. Some job descriptions will list common tasks for the position. The OSH department will want to match the information used for JHAs with corresponding information used in job descriptions. The job functions listed in job descriptions may be among the elements recorded in the upper part of the JHA form. Figure 4.2 illustrates the hierarchical relationships among a job and its functions, tasks, and steps. This graphic relationship model indicates that a job exists to accomplish certain functions. Within each job function, there may be multiple tasks, and most tasks may be broken down into a series of steps. Wisely selecting which tasks to analyze can optimize the value added in relation to the resources expended. Some reasons for selecting a task for a JHA may be that the task is new or revised, has a history of injuries, has the potential to cause severe injury, or involves a highly hazardous process or substance.1–3

Figure 4.2

After choosing a task, the analyst needs to break down the task into ordered steps (or other breakdown of activities). The preferred approach is to collaborate with an experienced worker who can explain the steps, demonstrate the procedures, and point out the potential hazards in each step. If a step has zero or one potential hazard, a single row of the table is used. When a step has two or more

hazards, using a row for each hazard provides room for applicable information in the middle and right columns.

4.1.2 Potential Hazards Column The middle column of a JHA form is for recording potentially hazardous events or exposures that might occur in the applicable step. There is no best or standard way of listing hazards in a JHA, but a practical approach is to identify the event or exposure that could directly cause the harm of concern. For occupational injuries and diseases, an organization may choose to adopt the categories discussed below as standard hazards for JHAs. Swartz uses the following abbreviations in the hazard column.1

SB Struck By SA Struck Against CW Contact With CBy Contacted By CB Caught Between CI Caught In CO Caught On O Overexertion and repetitive motion FS Fall to Same Level FB Fall to Below E Exposure to chemical, noise, and so on

Using the above abbreviations, entries in a JHA table might read something like the following: Worker SB tool dropped from above.

Worker CB collapsed trench walls. O when lifting portable generator. CW caustic material. Worker trips on uneven floor, injured from FS.

Companies might want to use a more comprehensive set of categories with abbreviations. An extensive list of coding categories is available in the U.S. Bureau of Labor Statistics' Occupational Injury and Illness Classification Manual.4 Among these is the attribute known as “type of event or exposure.” It contains numerous event categories, similar to those used by Swartz, for injuries involving energy exchange. A list of the energy exchange categories is provided in the left column of Table 4.1. In addition to the energy exchange group, numerous exposure categories are listed in the right column of the table. More detailed subcategories of events and exposures may be found in the above referenced manual.4 Table 11.1

4.1.3 Hazard Control Column The right column of a JHA contains text indicating what should be done to prevent an injury or other harm. The column may also be used to record tactics for moderating the hazard or mitigating the extent of harm once an identified incident occurs. For example, workers doing some work at elevation may use personal fall protection equipment as their primary hazard control. If one of them should fall and end up suspended by his lanyard, a JHA for what the other crew members should do could be useful for mitigating further harm to the fallen person and for protecting other crew members from attempting a rescue with no advance planning. The steps in JHAs do not extend into the postinjury activities of first aid to victim, transportation to a medical facility, medical care, or rehabilitation. In the context of the Haddon Matrix, which considers the pre-event, during-event, and post-event phases, JHAs typically focus on ways to reduce risk in the pre-event and during-event phases. Consequently, the third column of a JHA is labeled “Hazard Controls” rather than “Risk Reduction” (see Figure 2.2). Eight general risk-reduction strategies are listed below and explained in more detail later in this book.5 Most of these strategies reduce the probability of an undesired event, and some aim to reduce the severity of harm. As such, these strategies afford opportunities for reducing risk.

Eliminate the hazard. Moderate the hazard. Avoid releasing the hazard. Modify release of the hazard. Separate the hazard from that needing protection. Improve the resistance of that needing protection. Help people perform safely. Use personal protective equipment.

These strategies are too broad to be entered “as is” into the third column of a JHA. Rather, the strategy list is intended to help the analyst think broadly about what to put in the third column. Without a list, analysts may resort to the unimaginative approach of putting all the responsibility onto employees by stating they need to be careful, follow procedures, or get refresher training. Using the strategy list may open minds to engineering options deserving consideration.3

The actual entries in the right column should be specific enough to identify what should be done and who is responsible for getting it done.

4.2 Implementation Employers differ on how they develop and use JHAs, starting with identifying who will develop the JHA. A JHA analyst may be someone within the OSH department such as a safety technician or safety intern. Some companies take a different approach. They train the personnel who perform the task to do their own JHA prior to starting the task. For example, maintenance personnel at a mine can do a JHA while preparing to travel to the site. This helps ensure they will remember the hazards, the tools and safety equipment needed, and the precautionary practices involved. The third approach is to train supervisors to perform the JHAs. This widely used approach has the benefits of getting supervisors to think about safety more than they would otherwise do. It may also deepen their understanding of what their employees do. Procedures are needed for reviewing, approving, and preserving a record. If the analyst is from outside the work group, getting review and feedback from the workers can help improve the quality of the JHA. Similarly, if the supervisor prepares the draft, going through it with an experienced employee may identify misunderstandings and lead to better accord on how tasks should be performed. If the JHA is prepared by the workgroup, some sort of review and approval process at a supervisory level is important. Without a review, the workgroup will begin to feel as though the JHAs they develop are unimportant to the mid-level management, and this feeling will erode the JHA quality and reduce the potential benefits of the process. The effort involved in creating JHAs warrants follow-up to get the most value. Some uses are mentioned here. When preparing safety training for employees, the JHAs for tasks they perform can provide the basis for instruction. Talking with trainees about the work they do is far more interesting to them than talking generally about rules and regulations that may or may not apply to their jobs. While reviewing a JHA, employees may be invited to share comments and experiences on various steps, hazards, and safe practices. This process engages trainees in the topic—a practice recognized as an important contributor to adult learning. JHAs also may complement standard operating procedures (SOPs) for employees. The basic steps involved in a task should be the same or similar. Some SOPs list many detailed steps in a process, whereas a JHA may consolidate several small steps into a single larger step. Another difference is that SOPs typically include instructions on how to perform each step, while the JHA usually identifies a step as a process to complete. In addition, SOPs identify all tools and personal protective equipment needed, whereas a JHA may or may not list these items. For tasks involving the use of tools and equipment supplied by outside vendors, the JHA must account for the procedures specified in the instruction manual (or user guide) accompanying the tool or equipment. Unfortunately, these instructions vary substantially in quality. Some appear to have been developed by engineers as a last step in their design project, with no testing of a representative sample of users to determine comprehension. Some provide only minimal safety information and hazard warnings in the instructions. Some go overboard by including a long list of prohibition statements regarding absurd behaviors. These extended prohibition lists do not belong to a JHA. As a general rule, the JHA should indicate proper actions rather than improper ones. The appropriate place to bring up detailed instructions about tools and equipment is during training. Thus, judgment is required to prepare a JHA that includes the steps to accomplish without becoming overloaded with

specific instructions on how to perform each step.

4.3 Example JHA A utility company has a fleet of cars and vans for employee use. The company adopts a policy of encouraging employees to offer assistance to motorists in need. The OSH department decides to develop a JHA for each foreseeable type of assistance. The JHA will be used for training and developing a public assistance manual to keep in each vehicle. The lower section of the JHA they developed for jump starting a vehicle is in Figure 4.3.

Figure 4.3

This JHA is based on instructions in the owner's manual of the most common car in the fleet. The first step in the JHA is to defer the instructions for the vehicle models. If such instructions are absent, the steps in this JHA would be followed. In the example JHA, Steps 1–10 are listed in the step column. This particular breakdown is one of many possible ways. Notice that Steps 3, 8, and 10 are listed as a broad step consisting of three substeps. Another analyst could put each of the substeps in a separate row, resulting in total 16 steps

instead of 10. Three suggestions for creating useful JHAs are offered. First, avoid getting overly specific on every little part of each step. For example, detailed instructions on how to position the booster vehicle near the stalled vehicle are unnecessary, as one might reasonably assume the driver knows how to drive. Similarly, detailed instructions on how the spotter will help guide the driver of the booster vehicle into position would be superfluous. A second suggestion is to write the steps with short statements beginning with an action verb. In the example JHA, notice the action words: find, position, prepare, connect, perform, remove, and finish. The action verb sentence format is also used for writing instructions. The third suggestion is to put the actions needed to complete the task in the step column and the safety-related precautions in the third column. It can be tempting to put both in the step column, but that is an inappropriate use of a JHA. The basic approach used for JHAs has been adapted for numerous other uses. The next section introduces some hazard analysis methods similar to JHA.

4.4 Hazard Analyses Similar to JHA When civil engineers and architects plan construction projects, they routinely break down the project into phases. This helps in estimating costs, making schedules, and preparing a proposal to compete for the contract. Construction companies with the better safety and health programs involve the safety manager in the planning process in order to integrate safety into each phase. A hazard analysis tool similar to a JHA, called phase hazard analysis, provides a convenient format for the safety manager. Think of a three-column form such as the one in Figure 4.1, but in the left column record the phases identified by the civil engineers and architects. Within each phase, there will be smaller units that may be called activities. Modify the middle column to record foreseeable major hazards for each activity. At this stage, it is too early in the project to identify every job and task involved in every activity. Instead, this is the time to record major hazards that may be encountered in the phases and activities. In the right column, record the general approach to reducing risk from the hazard. For example, if fall protection railing will be needed in a certain phase, this process will help identify that need and enable inclusion in the budget. The phase hazard analysis is not expected to be in final form before the project begins. Once a project proposal is accepted, more time working out details will be justified. The preproject analysis is intended for modification as the project progresses. Planning for the first phase will be completed during the time between contract award and the start of phase 1. Similarly, during phase 1, the phase 2 analysis will be completed, and so on. In order to limit redundant entries in each phase, the broadly applicable hazards may be specified outside the phase hazard analysis form. For example, if the company considers falling objects as a hazard during all phases of the project and has a general rule that all personnel wear a hard hat while in the construction site, it would be redundant to include that in every phase analysis. It is more convenient to refer to the company's safety manual or make a separate list of safety-related practices applicable to the entire project. This way, a phase hazard analysis will avoid redundancy and focus on phase-specific hazards. The U.S. Army Corps of Engineers requires contractors to use another adaptation of a JHA called a position hazard analysis.6 One is developed for each employment category (e.g., laborer, carpenter, and pipe fitter) scheduled to work on the project. Two forms are used. The first contains an upper section and a lower section. The upper section asks for the name of the employee, job title,

organization, and primary duty location. The lower section has three columns as the basic JHA. The three columns list the tasks performed, hazards, and controls. The second form has three columns for listing equipment needed, inspection requirements, and training requirements for a specified task. Both supervisor and the affected employee must sign the form. Proper use of the two forms should ensure that all personnel working at the site receive information on the safety-related aspects of their job.

Learning Exercises 1. To practice breaking down a task into steps, consider the following scenario. You are

driving a car and have a flat tire. You pull off the main roadway to a location you think will be suitable for removing the flat and replacing it with a spare tire. What steps will be involved in changing the tire? 2. Create a JHA form similar to the one in Figure 4.1. 3. Find a JHA form on the Internet or at your workplace. 4. Compare and contrast the JHA form you created in exercise 2 with the JHA form you find in exercise 3. 5. Fill out the lower part of one of the JHA forms with the steps you identified for changing a tire.

a. For each step, fill out the column for potential hazards. Each hazard should be in a separate row.

b. For each hazard, record appropriate risk-reduction tactics in the right column.

Technical Terms Job An employment position that includes at least one function. Sometimes the word is used to identify a particular task. Job function In the context of employment, one of the achievements expected from the employee holding a job. Each job has one or

more functions. An employment position with no functions would be unnecessary to the employer. Job hazard analysis

A systematic technique for analyzing each step in a job or task by identifying potentially hazardous events/exposures and applicable controls for preventing or minimizing harm.

Job safety analysis

Same as job hazard analysis.

Phase hazard analysis

A systematic technique for analyzing each phase of a construction project by identifying foreseeable hazards and determining applicable controls for preventing or minimizing harm.

Position hazard analysis

A document for a specified employment position listing OSH information such as hazards encountered, precautionary practices, tools used, required inspections, and required safety training.

Steps The ordered elements involved in completing a task. Task An assignment for one or more individuals to complete by performing a series of steps or a set of separate activities. Task hazard analysis

Same as a job hazard analysis.

References

1. Swartz G. Job hazard analysis: A guide to identifying risks in the workplace. Rockville, MD: Government Institutes; 2001. 2. Canadian Centre for Occupational Health and Safety. Job safety analysis. Available at http://www.ccohs.ca/oshanswers/hsprograms/job-haz.html. 3. Glenn DD. Job safety analysis: Its role today. Professional Safety. 2011;56(3): 48–57. 4. U.S. Bureau of Labor, Statistics., 2007. Occupational injury and illness classification manual. Available at http://www.bls.gov/iif/. 5. Jensen RC. Risk reduction strategies: Past, present, and future. Professional Safety. 2007; 52(1): 24– 30. 6. U.S. Army Corps of, Engineers. 2003. Safety and health requirements manual, section 1, EM 385-1- 1. Available at http://www.elcosh.org/en/document/92/d000100/Army-Corps-of-engineers-safety- manual.html.

Chapter 5

Using Risk-Assessment Methods

The previous chapter on job hazard analysis showed how a table format helps organize safety analyses. It involved breaking down a task into discrete steps, identifying potential hazards in each step, and specifying appropriate tactics for reducing the risks. This basic approach provides a suitable background for the next topic, risk assessment (RA). This chapter presents RA as an ordered series of processes usually undertaken as part of a system design project. In practice, however, as the design progresses, analysts need to revisit and update earlier steps to reflect the most current design concepts.

5.1 Risk-Assessment Processes Risk-assessment processes have been embraced for many applications where concerns involve safety and health. RA has become a way of doing business in numerous domains. In the aerospace and military fields, for example, private firms are often retained to develop the next generation of weapons systems, upgraded planes, ships, and space exploration equipment. All the contracts awarded require the firms to conduct RA and other safety analyses using methods recognized in the system safety field. Military organizations wishing to purchase a piece of industrial machinery require an RA conducted by the supplier. In the domain of consumer products, the laws of product liability have evolved into more clearly defined legal duties of product manufacturers to address hazards. These laws vary from country to country, but international trade has led to considerable harmony in expectations. Product manufacturers find that conducting a sound RA before releasing a product helps make the product safer and goes a long way toward documenting proper attention to risk reduction. In the OSH field, RA has been gaining respect as an effective method for proactively considering hazards. Some companies ask their workgroups to use a simplified, field-level RA approach to assess

risks of a task they are about to undertake. This process helps the group members pause to think about and discuss the steps in the task, methods they will use, tools needed, hazards, and proper ways to minimize risks. Other methods comparable to those used by system safety engineers are suitable for numerous OSH applications such as designing a new assembly line, designing an upgrade to a chemical processing operation, and examining existing operations to find ways to reduce risk. Basic RA projects follow a common series of processes similar to the following:

1. Define the system and scope of the project. 2. Develop a preliminary hazard list (PHL). 3. Establish risk before risk reduction. 4. Determine hazard-specific risk-reduction tactics. 5. Reassess risk after risk reduction. 6. Make decisions about residual risks. 7. Prepare documentation of entire process. 8. Implement tactics and verify implementation.

Numerous authors use a process flow chart for depicting processes similar to those mentioned above.1–3 The following sections describe these processes.

5.1.1 Define the System and Scope Before putting much work into an RA project, it pays to define the system boundaries and specify the scope of the project. This approach is similar to that used for a construction project in that the owners and contractors need to agree on the work to be performed, a completion schedule, and a payment schedule. For substantial RA projects, staff time and other resources will be needed. Those who need to approve the commitment of resources will expect a proposal describing the scope of the project, costs to complete, completion schedule, and a projection of value added. Such a proposal starts with a clearly defined system and scope of the project. 5.1.1.1 System Boundaries How might system boundaries be specified? There is no one-size-fits-all approach. One might consider the system levels outlined in chapter 1 (Table 1.1). OSH professionals will generally work on projects at the second level of complexity, involving equipment and the people who use it. A practical way to start defining the system for an RA project is to consider each element in Figure 5.1 and write a description of what aspects will be included and not included for each element. Not all the elements apply to all RA projects, but each warrants consideration. Each element included in a system description contributes to the overall clarification of what is expected from the RA analysts. Some basic questions needing answers are listed below. Figure 5.1 Elements to consider specifying in an RA system description.

In what general environment will the system operate? In what facility or facilities will the system be used? What hardware will be part of the system? What software will be part of the system? What people–equipment interfaces will be part of the system? What support equipment will be considered part of the system? What interfaces with other systems will be part of the system? What will be the role of people within the system? What will be their skill levels? What manuals, training, procedures, and other human performance facilitators will be considered part of the system? What maintenance specifications and equipment will be considered part of the system?

After developing a draft system description, considerable discussions and several iterations may be needed to reach a description of the system boundaries satisfactory to all concerned. A system description provides half the foundation for an RA project. The other half is a description of the RA project scope. 5.1.1.2 Project Scope The scope of the RA analysis needs definition. Both the organization funding the RA and the RA analysts benefit from a clear understanding of what will be assessed and when and how this will occur. In design projects, it is especially important to clarify the role of the RA analysts in the overall design process, which can vary considerably depending on whether the process will follow a series model or a concurrent engineering model. The distinction is depicted graphically in Figure 5.2. Figure 5.2 Contrast between series and concurrent design processes.

In a series design process, a group of engineers works on the design. Once they consider their

design acceptable, they send their plans to other groups for review. The reviews may be performed independently by specialists for safety, manufacturability, human usability, marketability, legal matters, and others. After some time, these reviewers may approve the design or send it back to the engineers for changes. The slowest of these reviewers becomes a bottleneck for completing the final design. In Figure 5.2a, the series process shows the reengineering taking place in a relatively short time. Obviously, the time frame can vary tremendously given that the design and review steps might involve multiple iterations. Eventually, the design will satisfy all reviewers, and the process of manufacturing or construction may begin. Many companies now use a concurrent design process similar to that shown in Figure 5.2b. In the concurrent design model, a multidisciplinary team is assembled to come up with a design ready for manufacturing or construction. The team might include representatives from engineering, safety, manufacturing, legal, human factors, and marketing. By integrating multiple inputs into the early design, the team hopes to complete a final design suitable for organizational approval in less time than would be required using a series model. Safety and health specialists prefer the concurrent design process because it allows integrating safety into the design. As part of the design team, the safety expert gets a much better understanding of the design options, roadblocks, and trade-offs required to complete the project, and being on the team is a more comfortable role that being relegated to the role of reviewer. Thus, as part of the RA project scope, it pays to clarify the role of the safety personnel in relation to others involved in the design process. Some other points to clarify are listed below.

What system life cycle phases are to be included in the RA? Will the RA analysts have office space near the engineers on the design team? Does the budget for the engineers include appropriate time for them to converse with the RA analysts? Will the RA analysts have any responsibility for monitoring implementation of the risk- reduction tactics described in the final RA report? Will the RA analysts have a clear end point when their work is considered finished?

5.1.2 Develop Preliminary Hazard List The RA process may begin much like the JHA methods studied in the previous chapter. Recall that in a JHA a task is broken down into a series of steps and for each step potential hazardous event scenarios are identified. This basic approach is one of several options for starting an RA. Other ways to break down a system into discrete units include using the system elements depicted in Figure 5.1. Once the units are sorted, they are recorded in the first column of a spreadsheet and allowed an open-ended number of rows to be used in subsequent processes. For each unit, potential hazardous events and exposures are listed in another column. This initial list of potential hazards is referred to as a PHL. A team approach may be used to develop both the PHL and the follow-up processes. Team members with diverse backgrounds should be able to develop a comprehensive list of hazards. Some approaches they might use are described in a paper by Bruce Main.2 Be aware that making a PHL can generate resistance among people unfamiliar with RA who fear the implications of creating a PHL. Imagine, for example, how a manager of a power tool company might worry about such a list being used in litigation to show the company knew about the hazards associated with the use of its products. Often the lawyers for these companies have the same fears. It takes some education to convince them that using the RA approach can actually help during product litigation because when the RA process is completed, and written into a proper report, the company will have documentation of all its efforts to reduce the risks associated with each hazard. The company can then offer the report as evidence of its diligent efforts to make the product suitable for safe use. Getting to this point requires starting with a complete PHL and revisiting it at various times during the design process to add or remove items based on new information and insights. With the PHL as a starting point, the RA process continues with the assessment of risk before risk-reduction tactics are implemented.

5.1.3 Establish Risk Before Risk Reduction Before determining how to reduce the risks of each hazard in the PHL, the RA team should assess those risks based on the assumption that no prior risk-reduction efforts have been made. Doing so provides a baseline RA suitable for documenting safety gains from various efforts to reduce the risks. For each hazard in the PHL, the team discusses the foreseeable severity of the harm and the probability of that harm occurring. The team will decide on typically three to five categories of severity and establish a similar number of ordered categories for probability of the harmful event (e.g., remote, unlikely, likely, and very likely).2 Spreadsheets are convenient for organizing the information. Figure 5.3 illustrates a basic column arrangement. The first five columns (C1–C5) are shown in Figure 5.3a, and five more columns (C6C10) are shown in Figure 5.3b. The first column (C1), as is typical for RA formats, is for listing the task or other logical unit of analysis. The second column (C2) is for describing the potential hazards or exposures associated with the step or unit being analyzed. Figure 5.3 RA worksheet format: (a) columns C1–C5 and (b) columns C6–C10.

To the right of the hazard columns are three columns for risk-related entries. The first two (C3 and

C4) are for recording the categories of severity and probability, respectively. The third is for entering an overall risk level. The risk level (also called risk index or risk score) is determined from a risk matrix shown in Figure 5.4. Others may be found in various system safety books, standards, and papers.2,3,4 Figure 5.4 Example of a 4 × 4 risk matrix.

The example risk matrix in Figure 5.4 illustrates a 4 × 4 matrix with 16 cells. The cells are labeled

to indicate categories of risk level. In this example, only three categories are used: low, moderate, and high. At this point in the RA process, the analysts have a baseline rating of risk level for each hazard in the PHL. In the next process, various tactics for reducing the risk level for each hazard will be added to the RA table.

5.1.4 Select Risk-Reduction Tactics The process of identifying risk-reduction tactics also benefits from the team approach. Multiple perspectives and different kinds of expertise should contribute to a more effective result. A risk- reduction priority scheme (often called a hierarchy of controls) is selected and used. These differ in the details, but are consistent in having a preferred order starting with the possibility of eliminating the hazard, followed by considering engineering controls, and subsequently looking for helpful administrative/behavioral controls. The choice of control hierarchy often depends on the sort of system being analyzed. If, for example, the system involves a machine tool, a hierarchy applicable to machine tools would be appropriate. The lists in the Main and Manuele papers are from a voluntary standard applicable to machine tools.2,3 Similarly, if the project involves a military system, a particular hierarchy may be suggested or required by the contract. For OSH applications, the choice may be wide open. An option for OSH applications is presented in Table 5.1. It provides in the left column a three-level priority list and in the right column applicable strategies for reducing risk. Table 5.1 Three-Level Priority Order for Considering Risk-Reduction Strategies. Priority Strategya I. Control by eliminating the hazard 1. Eliminate the hazard II. Control through engineering methods 2. Moderate the hazard

3. Avoid releasing the hazard 4. Modify release of the hazard 5. Separate the hazard from that needing protection

6. Improve resistance of that needing protectionb

III. Control through administrative methods 7. Help people perform safely 8. Use PPE 9. Expedite recovery

a. These strategies are a modification of those originally proposed by Jensen.5 b. Attempts to change employees through means such as stretching and exercise programs belong in priority III.

The priority categories in Table 5.1 are intended to encourage the design team to consider the three priorities in order. Within each priority category, the strategies are in no particular order. For example, if a particular hazard cannot be eliminated, the second priority comes up for consideration. Within the second priority, the engineering strategies listed are equal in terms of preference. Any strategy that will help reduce risk is open for consideration. Another important point about hierarchies warrants comment. Selection of one of the engineering or administrative strategies does not preclude selecting others. For example, a design team looking at the in-running nip point of a conveyor belt may choose a guard to separate the hazard from that needing protection (Strategy 5). The team may also decide to place a warning on or near the guard about following lockout and tagout procedures whenever maintenance is needed (Strategy 7). A well- marked release switch might be installed to enable release of the conveyor belt tension in case someone gets caught in the nip point (Strategy 9). After appropriate risk-reduction tactics are selected, they are added to the overall RA spreadsheet in the column to the right of the risk-level column. When multiple tactics are specified, it is helpful to identify them with separate lines so that the columns to the right can be used to document how each tactic affects risk.

5.1.5 Reassess Risk After Risk Reduction After risk-reduction tactics have been identified, each is recorded in the RA spreadsheet. Figure 5.3 shows applicable columns. The design team needs to reassess the risks for each hazard by assigning ratings of probability, severity, and risk level under the assumption that each risk-reduction tactic will be implemented. The reassessed risks are documented in columns C7, C8, and C9. This process provides documentation of the anticipated safety benefits of each tactic. When multiple tactics apply to a particular hazard, the analysts need to decide how many rows to use. If, for example, a hazard has four tactics identified, the analysts could put all four in a single row, or they could use more than one row. The example later in this chapter illustrates an approach that, for a specific hazard, uses one row for all tactics that will reduce the severity and a second row for all tactics that will reduce the probability. This approach may prove helpful in three ways. First, it helps the design team think through its rationale for specifying each tactic. Second, it provides documentation of the design team's thinking for future reference. Third, it may help in the next process of assessing the acceptability of risk remaining after each tactic is implemented.

5.1.6 Make Residual Risk Decisions A key part of the RA process is clarifying risks remaining after tactics are implemented. The organization will use this residual risks information to make decisions about going forward with the project. The decision is made assuming the risks will be controlled as indicated in the RA. The decision typically will take one of the two forms: (1) the organization agrees to accept the residual risk, or (2) the organization does not actually accept but is willing to tolerate the residual risks. Each of these has advocates and opponents. Learning Exercise at the end of the chapter asks readers to think about the pros and cons of each way of stating the decision.

5.1.7 Document RA Project A thoughtful final report is essential. It may become the critical piece of evidence in a legal action

years after the RA is completed and in the consumer product business this is quite likely. Someday, somehow, someone may get injured using the product. The product manufacturer, the common defendant in a product liability suit, can use the RA report as evidence of having paid proper attention to safety prior to releasing the product for sale. To satisfy legal standards, the RA must have been performed in good faith and with due diligence. Thus, the report should include factual information about the level of effort put into the RA and related safety activities, qualifications of the design team members, and summaries of discussions reflecting sincere attempts to make the product as safe as practicable.

5.1.8 Implement the Tactics The project is not completed when the report is finished. Management processes are needed to ensure proper implementation of the risk-reduction tactics. For example, engineering controls will need quality control processes. For workplace projects, behavioral controls will need administrative systems to support implementation. A process for verifying implementation of these risk-reduction tactics will help avoid overlooking something and provide documentation that may be valuable for establishing regulatory compliance and due diligence. With products and equipment sold to consumers, businesses, or governments, a mechanism for obtaining feedback is important. Think of how many products have a toll-free number on the package for reporting problems. These numbers are specifically for getting customer feedback. The feedback needs to be recorded and periodically reviewed to identify problems with safety or quality. For high- cost products, such as motor vehicles and machine tools, a system for tracking ownership is helpful in case there is a need to contact owners about product recalls or part replacement.

5.2 Example Risk Assessment An example of an RA for a simple product is provided in this section. Readers are apprised that different analysts performing an RA on the same system will differ in their judgments about probability and severity as well as the selection of tactics applicable to particular hazards. The following example of a laser pointer design project is intended to illustrate the eight RA processes, not to make judgments about the technical aspects of the product. Start by defining the system and scope of the project. The system is a laser beam pointer used by lecturers and instructors. It is both a consumer product and a tool for use in business and educational establishments. The company name is not mentioned in this example. The design team considered the system to be the laser beam electronics, housing, batteries, packaging, and a paper insert containing instructional and precautionary information. Thus, the initial design concept specified a product having the following attributes:

The battery-powered beam will begin by considering continued use of the same diode laser as used on the company's prior product (a wavelength of 670 nm and power output <5 mW). The beam and batteries will be enclosed in housing similar to a fat pen, with appearance clearly different from the company's previous models. The housing will have an on/off switch and a clip to hold the product in a shirt pocket. One end of the housing will have a small hole for the beam. The housing will be <150 mm in length. The laser pointer will be packaged in an attractive box.

Instructions will be provided on a piece of paper inserted in the box.

Second, the RA team—consisting of an electrical engineer, a mechanical engineer, an expert in ergonomics/human factors, and a marketing specialist—developed a PHL of foreseeable hazards. This PHL contained three hazards: exposure of someone's eye to laser beam, contact with a sharp edge of the product housing cuts the user's skin, and the product housing is damaged from falling to the floor. These are recorded in column C2 of the upper RA spreadsheet in Figure 5.5. Figure 5.5 Example RA worksheet for laser pointer example.

The third task was to establish a risk level before implementation of the risk-reduction tactics. The

matrix in Figure 5.4 was used for assessing risks. It uses four ordered categories for severity and four for probability. The 16 cells in the matrix are labeled for risk levels. The RA team judged the possibility of the lecturer pointing the laser light directly into the eye of an attendee as having a severity of serious with a probability of unlikely. That put it into the risk-level category of moderate. The RA team judged the possibility of a sharp edge of the tool cutting the lecturer's skin as having a severity of slight with a probability of unlikely. Remember, this rating is based on the assumption of no prior efforts to address this hazard (i.e., the designers of the laser housing had made no prior effort to round off the sharp aspects). The RA team assigned the third potential hazard, damage to the tool housing from impact with the floor, a severity rating of slight and a probability of possible. That put it in the risk level of moderate. These ratings are shown in C3, C4, and C5 of Figure 5.5a. Fourth, the team identified feasible risk-reduction tactics for each hazard. These were entered into column C6 of the spreadsheet in Figure 5.5b. The actual text entered in C6 may be kept brief by

writing the full explanation in the report. Notice that a second row was added for the laser beam to distinguish between the risk-reduction tactic to limit severity and the three tactics to reduce probability. Row 1 applies to restricting the severity of an eye injury by limiting the power of the laser beam to the minimum needed for effective use of the pointer. The beam used in the company's previous laser pointer projected at 670 nm and was classified as a class IIIA laser under the U.S. Food and Drug Administration classification system (class 3R in the IEC 60825 system). Technological developments subsequent to the company's earlier design produced a safer beam that projects light in an optical range easier for human visual detection.6 By adopting the new technology, the design team was able to make a laser pointer that projects a beam closer to the optimal visual range using less power. The new product projects at 635 nm and will be classified as a class II laser (class 2M in the IEC 60825 system). Although this lower classification means fewer required precautions (e.g., laser symbol and text warnings), the company wants to exceed the minimum requirements because it aspires to be world class in product safety. Row 2 is used for the three tactics identified for reducing the likelihood of shining the laser beam into someone's eye long enough to cause damage. Tactic 2 is to place a warning message on the product housing and a second one on the instructional insert stating that the user should avoid shining the light at anyone's eyes. Such a tactic is not required for class 2 lasers, but the company asked the RA team to include these extra precautions. Tactic 3 is to design the actuator button using fail-to-inert mode, which means that when the user is not pressing the button, beam is not projected. Tactic 4 is to make the actuator button in such a way as to cause the user some discomfort after pushing on it for 30 s. The thought behind this tactic is to discourage speakers from getting into the habit of constantly pressing the button. In the fifth process, the revised risk ratings are recorded in columns C7, C8, and C9 of the RA spreadsheet in Figure 5.5b. Column C10 is for notes on the status of tactics used in each row. It may be used for recording whether or not the residual risk has been accepted or tolerated, what remains to be done, who is responsible for getting it done, and whether implementation has been verified. Many organizations use multiple columns for status data in order to keep track of specific matters such as status of hazard control implementation and verification. Figure 5.6 graphically shows how the tactics will change the risk level of the laser beam from moderate to low. The same basic process is used for the other hazards. Learning Exercises are provided at the end of this chapter to encourage a more hands-on experience. Figure 5.6 Graphic depiction of how RA tactics reduce risk of laser beam.

The sixth process, making decisions about residual risks, is not carried out by the design team.

Their role is to provide the technical information to a high-level manager for the decision. The company considering the new laser pointer needs to consider every risk in the final risk assessment matrix. Some guidelines are helpful to sort out the easy approvals from those needing more thought. For example, the hazards with a low-risk classification may be considered approvable without discussion. Any hazard with a high-risk classification will be disapproved. Those in the moderate-risk classification would require discussions prior to deciding to approve or disapprove. In the example, all the hazards were in the low-risk classification and easily approvable. In the seventh process, the individuals who conducted the RA are responsible for writing a full report on their project, including the residual risk decisions resulting from the project. A suggested organization is the conventional scientific format with sections for methods, findings, discussion, conclusions, references, and appendices. Appendices are useful for including documentary material

few people will want to read. For example, the initial PHL may be put in an appendix, even though it was modified several times during the project. Minutes of meetings may be included in an appendix. Appendices are also useful for including copies of standards and guidelines referred to in the report. An important consideration in preparing a report is to imagine it being read by lawyers after someone has been injured. The last process in an RA is implementing the tactics. An organization that makes the effort to conduct an RA will certainly want to make sure the tactics are implemented. As obvious as this may sound, investigations of major incidents have revealed failures to implement known tactics. In aerospace and some other fields, a formal process to verify the implementation of each tactic is used. Verification can be considered the last step in the implementation process discussed in this chapter.

Learning Exercises 1. Suppose you are concerned about a particular task performed quarterly by a pair of

electricians. You already have a JHA for the task. It has 12 steps, beginning with assembling the equipment they will need and obtaining a permit for a lockout/tagout procedure and ending with putting away the equipment they used. Answer the following questions.

a. Refer back to Table 1.1. What system levels would you include in your project?

b. For your system description, consider the components in Figure 5.1. List the components and indicate (briefly) what, if anything, involving each component would be useful to include.

c. How would you describe the scope of your RA project?

d. What would be the obvious breakdown for column C1 of an RA table?

2. The example in the text shows how to enter risk ratings for each hazard before implementing any risk-reduction tactics. After the controls are implemented, revised risk ratings are needed. In the example of a laser pointer, the change is shown in Figure 5.6 for the laser beam hazard. Show the change for the sharp edge hazard in a similar way. In other words, create an RA matrix, circle the risk level before the tactic, and draw an arrow pointing to the risk level after the tactic. 3.These two items concern the connection between tactics and the risk-reduction priorities shown in Figure 5.1.

a. For the tactic of limiting the laser beam power, determine which priority it fits into and which strategy or strategies apply.

b. For the tactic of putting warnings on the product and the insert, determine which strategy or strategies apply.

4. After completing a risk-assessment project, some residual risks are normal. A person high in the organization is asked to approve or disapprove going forward. The form of this decision has generated controversy. Comment on strengths and weakness of the two ways of stating the decision.

a. To accept the residual risk.

b. To tolerate the residual risk.

Technical Terms Baseline RA The assessment of risk for each hazard in a PHL based on the assumption that no prior risk-reduction efforts have been

made. A risk matrix is used to establish the baseline risk level. Concurrent design process

An approach to a design project that uses a team of people from multiple disciplines and departments working side by side to complete the design.

Hierarchy of controls

A preferred order of options for reducing the risks associated with a hazard, also known as a risk-reduction priorities.

IEC International Electrotechnical Commission. Life cycle phases

A term encompassing the various phases a system may go through, including initial design, user and prototype testing, final design, manufacturing, deployment, main use phase, and disposal.

Preliminary hazard list

A list of hazards identified early in the RA process, with the intent of assessing the risks associated with each hazard on the list.

Reassessed risks

The result of assessing risks for each hazard under the assumption that all noted efforts to reduce the risk have been implemented. It uses the same risk matrix as used for the baseline RA.

Risk assessment (RA)

An ordered series of processes usually undertaken as part of a system design project.

Risk level Categories of risk used for risk assessment.

Risk matrix A tabular array of cells that are assigned words or numbers as labels for ordered categories. The common tables for risk assessment use rows and columns with ordered categories of severity and probability.

Risk-reduction priority

Same as hierarchy of controls.

Risk-reduction tactics

For a specified hazard, various approaches to lessen the probability of a harmful event or reduce the severity of the harm.

Series design process

An approach to a design project that involves completing the engineering design processes before involving the expertise of other departments.

References

1. Bahr NJ. System safety engineering and risk assessment: A practical approach. New York: Taylor & Francis; 1996. p. 206. 2. Main BW. Risk assessment: A review of the fundamental principles. Professional Safety. 2004;49(12): 37–47. 3. Manuele FA. Prevention through design: Addressing occupational risks in the design and redesign processes. Professional Safety. 2008;53(10): 28–40. 4. Piampiano JM, Rizzo SM. Measuring risk & its variables objectively. Professional Safety. 2012;57(1):36--43. 5. Jensen RC. Risk reduction strategies: Past, present and future. Professional Safety. 2007;52(1): 24– 30. 6. Miller G, Yost M. Nonionizing radiation. In: Plog BA, Quinlan PJ, editors. Fundamentals of industrial hygiene, 5th ed. Chicago: National Safety Council; 2002. p. 315.

Chapter 6

Analyzing Failure Modes

When systems consist of multiple parts, there is a justifiable interest in understanding the possible effects of a part failing. This interest led to development of a methodology known as failure mode and effects analysis (FMEA). Originally developed by reliability engineers, the system safety community recognized the usefulness of FMEA and incorporated it into its arsenal of methods.

6.1 Rationale for FMEA An FMEA is a bottom-up analysis technique because the analysis starts with a list of numerous items in the system and examines what might happen if any of them should fail. The starting item is often a specific part, but it may be a subcomponent, component, subassembly, assembly, or subsystem. This inductive approach of reasoning contrasts with the deductive approach used in the next two chapters on fault trees. An FMEA helps clarify which items are most critical for the safety of the system. Sometimes, the failure of a single part can result in total system failure, and some system failures include death or serious injury. By identifying any safety-critical items, engineers can focus on solutions to avoid such failures. They may be able to procure or manufacture an item with greater reliability, specify a larger safety factor, or design in redundancy so it takes multiple part failures to cause system failure. Numerous books on system safety are available for those seeking more in-depth information.1–3

6.2 Basic FMEA Methodology Systems often consist of many elements. Figure 6.1 depicts a common convention for organizing all the items in a system. It uses an indenture format, similar to the outline of a report, to show the naming convention. The indenture farthest to the right contains the smallest units, usually specific parts. The reasons for this unusual list format is to introduce the concept known as indenture level, a concept useful when choosing the level to begin an FMEA.1 Figure 6.1 Concept of system indenture levels.

A complex system such as an aircraft or a ship has thousands of parts. It would be an incredible task

to analyze every single part to determine how it might fail and what effect each failure might have at higher levels. Therefore, an initial consideration in conducting an FMEA involves selecting the subsystems that are important to overall safety. In a ship, for example, items affecting the structural integrity of the hull are critical for the safety of the entire crew, whereas items in the dining areas are far less important for system safety. Thus, little would be gained by performing a comprehensive safety analysis for every fastener used in the dining tables, but analyzing fasteners in the hull structure is obviously important for ship safety. Consequently, choosing the initial starting place, or indenture level, is a very pragmatic decision. Once the starting place is chosen, a trained analyst is assigned a unit for analysis. A form something like the worksheet shown in Figure 6.2 is used. The upper section is similar to that used for a JHA or RA. It has spaces for indicating what is being analyzed, who performed the analyses, who reviewed and approved it, and when the analyses were completed. The lower section of the worksheet is for the technical information. Figure 6.2 Example of an FMEA worksheet.

Like numerous safety analyses, columns are used for delineating the various types of information, and rows are used for the items analyzed. The information sought in each column in Figure 6.2 is explained below. Examples of other forms, with additional columns for other types of information, are provided in other books.1,2 Column 1 is for identifying specific items. If the analysis starts at the lowest indenture level, a specific part will be identified. If the analysis starts at a higher level, the analyst records the applicable subcomponent, component, subassembly, assembly, or subsystem. Column 2 is for noting the mode or modes of failure for each item. For example, a valve may fail in an open mode or a closed mode. A bolt may fail in shear, tension, or bend. Some items may fail to operate at the correct time, while others may fail by not stopping at the proper time. Each failure mode can have different consequences. It is not uncommon for a specific item to have multiple failure modes. Stephans provides an example of a fire sprinkler system analyzed with an FMEA.2 He lists three failure modes for sprinkler heads: fails to open, open prematurely, and deliver an inadequate spray pattern. Using a separate row for each failure mode facilitates both analysis and recordkeeping for each foreseeable failure. Column 3 is for stating the foreseeable effects of the failure on other items such as those located nearby or in the same group as the failed part. These effects may be at the same or next higher indenture level. For example, if a part fails, we want to know how that will affect other parts and the subcomponent it belongs to. If a subcomponent fails, we want to know how that will affect the component it belongs to. This inductive approach of moving to successively higher indenture levels helps clarify the safety significance of each item and failure mode. Column 4 is used for noting the effect at a higher indenture level than the one in column 3. This involves working upward from the effects noted in column 3 to the entire system or to an intermediate level considered appropriate. When considering effects, the analyst should be pessimistic, noting the worst-case effect rather than the hoped-for effect. Being pessimistic expands the consideration given to avoid such outcomes. Many FMEA forms have another column for noting the effects of each failure mode on the overall system. Although examples are not shown in Figure 6.2, readers can refer them in the books mentioned in the reference list. Column 5 in Figure 6.2 may be simply for recording observations and comments. For example, while performing the FMEA, an analyst may wish to record an idea for addressing an identified concern so that the idea will not be forgotten. Other relevant comments might include detailed attributes of parts mentioned, assumptions, relevant standards, sources of information, and meanings of abbreviations.

6.3 Beyond the Basics This section introduces some extensions of traditional FMEA that system safety engineers developed and use. Some organizations extend the FMEA by incorporating parameters of risk. As in risk assessment, columns are used for the probability of each failure, the severity of the effects, and some sort of index for risk level. This approach is called failure modes, effects, and criticality analysis (FMECA) to distinguish it from an ordinary FMEA. Organizations may prefer an FMECA when they need to assess how critical the effects of different failure modes would be on the whole system. An FMECA can provide insights useful for allocating engineering efforts to the most important failure modes. A second variation in FMEA methodology, known as a functional FMEA, begins with a top-down

approach for breaking the system into branches.3 The first tier of branching may be based on system function or subsystems. Lower tiers extend the branching downward. Then, an FMEA applied to each branch helps to distinguish the functions most important to system safety. With that resolved, resources for safety analyses can be directed only to the branches important to system safety. Ericson provides an excellent explanation of the theory behind functional FEMA approaches involving functions, hardware, or hybrids.3 These three approaches to FMEA use a basic FMEA format, but provide different means to the same end—clarifying what warrants the greatest commitment of engineering resources for improving system safety. Another use of the FMEA method is to identify safety-critical items. For example, the U.S. National Aeronautics and Space Administration (NASA) uses an extension of the FMEA method to assign items to categories based on how critical their failure would be to mission success. FMEAs can be useful during the design phase of systems by identifying critical failure items. These may then be used by the design team to consider alternative designs such as adopting a larger safety factor, specifying highly reliable components, or increasing redundancy.

Learning Exercises 1. Explain why the FMEA approach is considered an inductive approach, rather than a

deductive one. 2. Use an FMEA chart such as the one in Figure 6.2 to analyze sprinkler heads in a wet pipe fire protection system. Wet pipe systems have water throughout the overhead pipes. The water is kept from spraying by the sprinkler heads. When the temperature of a sprinkler head exceeds a trigger point, it opens and lets the water discharge in a spray pattern similar to an umbrella shape. Each sprinkler is connected to a water pipe, and the pipes and sprinklers are distributed throughout the room in rows. The pipe for each row is connected to a feed line shared by all the other pipes in the room. For this exercise, format a spreadsheet with the five columns shown in the lower section of Figure 6.2, with a row for the column header, and rows 2 and 3 for listing the following two sprinkler head failures: (1) opens when there is no fire and (2) remains closed when there is a fire. Fill out the remaining cells in each row. 3. For the example of sprinkler heads, imagine at least one possible “common cause” that would make multiple sprinklers fail to function properly.

Technical Terms Deductive approach

An approach to logical reasoning that uses a general principle or theory to reach a solution or conclusion about a specific set of facts.

Failure mode Any of the ways an item could fail to function as intended. Failure mode and effects analysis (FMEA)

A systematic method for analyzing a system for reliability or safety by starting with items, such as parts and components, determining how these items could fail (failure modes), and what would be the effects of each of these failure modes at a higher level of indenture.

Indenture level The levels of elements that constitute a system. Indenture levels from higher to lower are systems, subsystems, assemblies, subassemblies, components, subcomponents, and parts.

Inductive approach

A way of logically analyzing by starting with details or facts and working toward a coherent conclusion. Detectives use this approach when they first gather evidence, and then try to develop an evidence-based explanation for the crime.

Safety-critical

items Parts, components, or assemblies that are essential and necessary for safe system operation and support.

References

1. Bahr NJ. System safety engineering and risk assessment: A practical approach. New York: Taylor & Francis; 1996. p. 145–151. 2. Stephans RA. System safety for the 21st century. Hoboken, NJ: Wiley; 2004. p. 156–167. 3. Ericson CA, II. Hazard analysis techniques for system safety. Hoboken, NJ: Wiley; 2005. p. 235– 259.

Chapter 7

Constructing Fault Trees

7.1 Introduction to Fault Trees Fault trees are useful tools for understanding how undesired events may occur. Their main purpose is to help engineers design a system so that one or more specific events can be avoided. Thus, fault trees are tools for integrating safety into a system design process. The need for a fault tree may become apparent during a risk assessment. Say the risk assessment identifies two hazardous events the organization is unwilling to tolerate or accept. For each of these, a fault tree could prove helpful for understanding both causal events and options for reducing risk. Fault trees are deductive trees in the shape of evergreen trees, with a point at the top and widening at lower levels. This chapter addresses the processes and methods for constructing fault trees—starting with the basics and progressing to some more advanced methods. The next chapter discusses mathematical processes and other analytical methods for use with fault trees.

7.1.1 Common Symbols and Arrangements A fault tree is a type of graphic analytical tree used to model a specific undesired event. This top event is represented by a box containing a concise description of the undesired event. Under the top event box are various symbols; the most common are shown in Figure 7.1. Figure 7.1 Key for most common fault tree symbols.

Numerous variations in these symbols are used in commercial software. Those in Figure 7.1 are

traditional with one exception. In this chapter, logic gates have text to help readers learn to recognize the two most common logic gates—AND gates and OR gates. System safety engineers do not need labels. In fault trees, relationships between events and gates are shown as lines without arrows. Under the top event are tiers of other events organized into logical branches. As tiers descend toward the bottom, the events become more specific. At the bottom of each branch, a specific fault or failure serves as an end point. The generic example in Figure 7.2 illustrates terminology. Figure 7.2 General locations of symbols on a typical fault tree.

The top event of a fault tree is usually an undesired event or condition. Examples of undesired

events are “person contacts high-voltage current source” and “fire starts in warehouse.” Examples of undesired conditions are “slippery spot in grocery store aisle” and “carbon monoxide level in room exceeds 35 ppm.” Typically, a system could have many undesired events and conditions. From these, a very small number may be chosen for modeling as fault trees. Rather than spending time on less significant outcomes, more value comes from time spent on high-severity events and very undesirable conditions. After the top event is identified, a logic gate is placed under it. The AND gate and the OR gate are the two most common types. The AND gate indicates that the top event will occur only if all events immediately under it occur. The OR gate indicates that the top event will occur if any of the events under it occurs. One can test the logic of a tree with either of these gates by asking if the events under it are “necessary and sufficient” to cause the event above the gate. The next tier down the fault tree is referred to as the first tier or tier 1. Tier 1 commonly consists of rectangles containing brief text to indicate an intermediate event or intermediate condition. Sometimes, tier 1 will have symbol of a house, a diamond, or a circle. The house is used for a normally occurring condition. For example, if the fault tree is for a fire in a warehouse, this tier could have a house for the existence of oxygen. When a house symbol is used, the branch ends because there is no reason to explain how a normally occurring condition exists. Another symbol that may be used in tier 1 is a circle. It indicates a basic event that does not warrant further development, such as a specific part failing. A circle is inappropriate if there is a need to examine how the event could occur. To illustrate the difference, consider a crane rope snapping. An analyst may choose to show the crane rope snapping as a basic event in a circle. But doing so terminates further inquiry into the events leading to the rope snapping. A rectangle is used when the event will have another gate under it. A diamond is used when a branch is extended to a point where the analyst cannot justify further time or effort to explain it. Thus, a diamond ends a branch with the message that further development is not considered worthwhile at this time. The symbols shown in Figure 7.2 may vary somewhat in appearance. The main reason is that different software programs provide somewhat different graphics for the same symbol. This is particularly the case with the AND gate and the OR gate. Some software provides gate labels using a

format such as G1, G2, and G3. Some show the probability of the event above the occurrence of the gate, and some will have no text of any kind. Also, some software facilitates entering text directly inside the symbol, while other software uses textboxes located atop a symbol.1 Because of these variations, reports on fault tree analyses should provide a symbol key to indicate the meaning of each symbol. Examples of software-generated fault trees can be found in many articles in the Journal of System Safety and in the books on system safety cited in the reference list. Two terms, fault and failure, often encountered in discussions of fault trees need explanation. The word fault applies when the desired state did not occur. A particular kind of fault, a failure, applies when a specific item in the system is unsuccessful. Thus, a fault may occur due to one or more component failures or due to some other cause such as an incorrect sequence of actions. In fault trees, the top box is for a fault. The circles representing failure events are found at the lowest end of tree branches. The developed fault tree sorts out the various ways the top event can occur. A system that allows the top event to occur with only one or two basic failures may be referred to as a failure-intolerant system. In contrast, a well designed system can continue functioning even though several components have failed. That sort of system may be called a failure-tolerant system. A section in the next chapter explains how to use a fault tree to identify the smallest set of failures that can cause the top event. The words fault and failure are used in the naming of two common system safety analysis tools introduced in this book. A fault tree begins with a fault (undesired event or condition) at the top and works downward through one or more tiers to the level of basic failures. In contrast, an FMEA begins with basic item failures and investigates what effects each failure might have on the tiers above it.

7.1.2 Example Fault Trees Numerous books on system safety provide examples of fault trees.1–7 Two common examples are a flashlight and a simple electrical circuit. These two examples, as well as a wildfire example, are provided in this chapter. A fault tree for the flashlight example is shown in Figure 7.3. Note that the diamonds in the first tier indicate a decision by the analyst not to develop the branch further. If the left diamonds were developed, it would be similar to the middle branch with the batteries. The on/off switch branch was not developed further because the tree is to illustrate only tree construction. Figure 7.3 Example of a flashlight fault tree.

Fault trees express logic graphically. Engineers tend to like graphic models, while many people prefer to express logic verbally. A verbal equivalent to the top event and first tier of Figure 7.3 is as follows. The flashlight will fail to provide light if

The light bulb fails, There is a lack of battery power, or The on/off switch fails.

A verbal approach as this may be used as an aid in sorting out the logic of a tier prior to starting the drawing. Several Learning Exercises at the end of this chapter are intended to help people appreciate how the verbal and graphic approaches provide equivalent expressions of the logic. Look at the second tier of the middle branch. The two branches involve mutually exclusive conditions—the flashlight either has no batteries or has at least one battery. This approach is often a useful concept for developing fault trees. It forces logical development under an OR gate. In the event box for installed batteries, instead of simply saying the batteries are installed, we want to state some kind of failure event. In the above tree, it says “Installed batteries not delivering enough power.” For the second example of a fault tree, consider the simple electrical system modeled by the circuit diagram in Figure 7.4. The source of power is a battery. There are three switches in the hot side of the circuit (A, B, and C). These are normally in the open position. There is a light in the circuit. If someone wants the light on, they should flip toggle switches A, B, and C to the closed position. How might the pilot light fail to illuminate? First, draw a tree with the top event being “Fail to illuminate.” Figure 7.4 Circuit diagram with three normally open switches.

Under the top event, an OR gate is appropriate because any one of several faults will cause the top

event. Any one of the three switches left in the open position will make the entire circuit open and ineffective. Also, if the bulb fails for some reason, or battery power is lacking for some reason, the bulb will fail to illuminate. The overall arrangement of the fault tree shows the three switch faults grouped under a single branch. Another analyst could elect to place all five fault events in tier 1—a perfectly logical option. Most fault trees can be organized in multiple ways. In the case of Figure 7.5, the analyst felt that the tree would be understood more easily by grouping the switches together in a branch. Figure 7.5 Fault tree for circuit in Figure 7.4.

The symbols in Figure 7.5 were chosen to illustrate some points about fault tree construction. In the

left branch (open circuit path), an intermediate event box is used. The OR gate under it can be opened for movement upward if, and only if, at least one of the lower events occurs. The gate may be thought of as a one-way opening that, when conditions below are met, allows influence from the lower tier to the upper tier. At the lowest tier in this tree, circles are used for the switch failures to indicate that these are basic events. Thus, the left branch ends properly, with basic events at the bottom of each branch. The middle branch (bulb failure) and the right branch (battery failure) are in diamonds. The diamond symbol indicates an event the analyst chose not to develop further. A different analyst may have elected to extend one or both of these branches to explain why these failures might occur. Once a fault tree is completed, each branch should end with an appropriate symbol. Appropriate symbols to terminate a branch are the circle (basic event), the diamond (undeveloped event), and the house (normally occurring condition). A transfer triangle (shown later in this chapter) may also appear at the bottom of a branch on a page, but it does not mean the end of the branch. It means the

branch is continued at another place in the report. The electrical circuit example also serves to illustrate the importance of paying attention to how a failure might occur—the failure mode. A simple electrical switch can fail open or fail closed. In the preceding circuit, the top event will not occur if there is a failure in closing any of the switches. That means the switch stayed open when the system operators wanted it closed. Our third example applies to an undesired fire event. The first point is the importance of making the top event specific. Simply putting “Fire” in the top event may lead to misunderstanding. For example, on a camping trip, you want to start a campfire, a fire is a success rather than a fault. Similarly, you want burners in your furnace to burn. Many other fires, however, are undesirable. Examples of undesired fires are kitchen grease fires, house fires in general, automotive engine fires, and fires in wildlands (e.g., forests, grasslands, and agricultural fields). A fault tree for a wildland fire is shown in Figure 7.6. Figure 7.6 First tier of a fault tree for undesired fire in wildlands.

Under the top event, the AND gate indicates the top event will occur only if all four events in the

first tier occur. Notice the use of diamonds for the two left branches. This indicates the analyst chose not to develop these branches further. It also simplifies the tree for the purpose of illustrating the use of an AND gate. It could, however, be productive to extend each of these branches. For example, the first tier provides nothing useful about the sources of heat, amount of heat energy needed, or that the fire needs heat to ignite as well as to continue. The second diamond tells us next to nothing about the vegetation sources encountered in wildland fires. Moving across the tree, the circle is used for chemical chain reaction. This is considered, for this fault tree, to be a basic event. It is actually a somewhat complicated interaction of heat level, fuel availability, fuel condition, weather, and supply of oxygen. The fourth branch of the tree indicates that oxygen occurs normally in outdoor locations on planet Earth. The three fault trees in 7.3, 7.5 and 7.6 illustrate modeling an undesired event using symbols and logic applicable to fault trees. What if we want to model a desired event? For example, when camping we want to start a campfire, and we want our flashlight to illuminate when we switch it to the “on” position. For these applications, we can use the same symbols and similar logic, but we put the successful event at the top and call it a positive tree or a success tree.

7.1.3 Example Success Tree The electric circuit depicted in Figure 7.4 was used to explain a fault tree, but it may also be used to explain a success tree. To achieve success, all three switches need to be closed, the bulb must be operational, and the battery must be delivering enough power. A success tree is shown in Figure 7.7.

Figure 7.7 Success tree for circuit in Figure 7.4.

Table 7.1 summarizes changes made in the fault tree (Figure 7.5) to convert it into a success tree

(Figure 7.7). Notice that gates were flipped from being OR gates to being AND gates, and event descriptions inside the symbols were rephrased to change from stating undesired events to stating desired events. Table 7.1 Converting a Fault Tree to a Success Tree. Element Fault tree Success tree Gates OR gate AND gate Top event Fail to illuminate Light is on Left branch, tier 1 Open circuit path Closed circuit path

Left Branch, tier 2 Failure to close switch A* Switch A closeda

Middle branch, tier 1 Bulb failure Bulb operational Right branch, tier 1 Battery failure Battery delivering power a. Same for switches B and C.

7.1.4 Common Mistakes When learning to construct fault trees, four mistakes are common. The first is using lines with arrowheads. Proper fault trees use simple lines to connect the various symbols. The second is ending a branch with an event box. Each branch should end with a proper terminal event symbol, a circle, a diamond, or a house. The third common mistake when constructing fault trees is to connect a gate directly to a gate under it. This construction makes the logic difficult for readers to follow and may even confuse the analyst. Thus, when constructing fault trees, avoid having a gate under another gate without an event or condition between them. Figure 7.8a illustrates a gate stacking error. A corrected tree is shown in Figure 7.8b. The correction involved inserting an event between the gates. For example, the new event will be whatever happens when both intermediate events C and D occur. Figure 7.8 Example of improperly stacked gates and correction.

The fourth common mistake is skipping a tier. This may occur because the analyst writes in an

event box the word “and” or the word “or.” Consider this a red flag deserving careful review. When the word “and” is needed to describe an event, it may be more appropriate to have another tier under to box with an AND gate. To illustrate, an event box reading “Person slips and falls” is actually two events. A person can slip without falling, and a person can fall without slipping. Similarly, when the word “or” is needed to describe an event, it may be more logical to create another tier under the event box with an OR gate. An event box reading “Person slips or trips” is actually describing alternative events, not one event. This concludes the introduction to constructing fault trees and success trees. Professionals who work with fault trees regularly find some additional symbols and techniques useful. Some of these are introduced next.

7.2 Additional Fault Tree Tools Systems safety engineers who regularly work with fault trees find several additional symbols useful. Because standardization tends to be industry specific, it is essential to provide in reports a key to all symbols used. Figure 7.9 shows the symbols key for this discussion. Figure 7.9 Key for additional fault tree symbols.

The first two symbols in Figure 7.9 show transfer triangles. These triangles are useful when a fault

trees grows too large for a single page in a report. They may also be used to avoid repeating identical branches for particular failure events. As a reader examines the tree downward from the top event, a branch will seem to end with a triangle attached under an event box. There will be some sort of note to tell the reader where to look for further development of the branch. The note format in Figure 7.9 is from the book by Stephans.7 For example, on page 1 of a tree, a transfer triangle may send the reader to page 4 to see the branch developed further down. To assist readers in following the logic of the branch, it is useful to duplicate the event and triangle at the top of the continuation page. The branch continues downward until it ends with an appropriate terminal failure or transfers to other

pages. Whatever format convention is used, focus on clearly communicating your logic to readers who may attempt to understand your tree. The DELAY gate symbol is used to show that once the event below occurs, some time passes before the event above occurs. For example, consider a mixing vessel in a chemical plant. The process was designed for a reaction involving two input chemicals and one output chemical. The chemical engineers designed it, so the inflow will equal the outflow. If something goes awry, such as material input exceeds output, there will be a buildup of material in the vessel. A pressure relief valve should open to release pressure. If it fails to open, the pressure inside the vessel will increase. The fault tree could make use of a DELAY gate to inform about how long it will take for the pressure buildup to exceed the vessel capability. The exclusive OR gate symbol is used when the upper event or condition will occur if exactly one of the lower events occurs. If two or more of the lower events occur, the gate will block upward movement through it to the upper event. The ellipses depicted in the lower rows of Figure 7.9 are used by professionals to clarify or supplement an attribute of the associated gate or event. For most fault trees, the developer can limit the use of ellipses by using AND gates and OR gates. In other words, if you develop a fault tree with numerous ellipses, you may want to revisit the tree to determine if your logic is clear. The INHIBIT gate is above a single-input fault event. It may be used to indicate a factor that inhibits or facilitates movement upward through the gate.

Learning Exercises The outline form of expressing logic (see section 7.1.2) can be useful for developing logical fault trees and success trees. Several of these Learning Exercises are for developing abilities to translate between the verbal and the graphical approaches for expressing logic.

1. For the fault tree in Figure 7.3, write out the logic for the left branch, second tier, using an outline format. You should try three ways the bulb could fail. 2. Study the fault tree in Figure 7.6 depicting elements for an undesired wildland fire. Write out the logic for the first tier using the outline format. 3. What does the fault tree in Figure 7.6 tell you about strategies for extinguishing a fire? 4. Examine the success tree in Figure 7.7. Write in outline format the logic for the first tier. 5. This chapter contains several mentions of software for creating professional looking fault trees. A useful first step is to examine your software resources. You might try the integrated software suites to find graphic software. Try using whatever software you have to create a fault tree similar to that in each of the following.

a. Figure 7.3

b. Figure 7.6

6. A professor scheduled a test at 11 a.m. on Wednesday. A student might fail to show up for the test.

a. If you want to make a fault tree for this, what text would you put in the top event box?

b. What type of gate would you put under the top event?

c. List reasons for this “no-show.”

d. Group the reasons for no-show into crisp categories suitable for placing under the gate in a fault tree. If you have more than five reasons, consider consolidating some of the reasons into categories suited to a fault tree.

e. Use the outline format to write the final version of the logic you would use to make a fault tree for the student failing to show up for the test.

7. Suppose you are safety manager for a package shipping company such as UPS. Many packages are shipped by air during the night. After arrival at local airports, the packages are loaded into delivery vans or trucks. Past experience indicates that occasionally one of your drivers is cited by police for driving a vehicle without two headlights shining. You have not had any expensive losses, but you want to be proactive to avoid a large loss in future. Consider using a fault tree to better understand how this could happen and how it might be prevented in the future. You would need to decide whether to make the top event an undesired event or an undesired condition.

a. What would you put as the top event for an undesired event?

b. What would you put as the top event for an undesired condition?

8. In the fault tree for a flashlight failing to provide light (Figure 7.3), there are three branches under the OR gate in tier 1. Under the middle branch, there is another OR gate, and under it are two branches (tier 2).

a. Would it be logically correct to simply raise the pair of branches in tier 2 up to tier 1?

b. What reason can you offer for using the branching system shown in this chapter, rather than adding more events to the first tier?

c. What if we were to replace the box for “lack of battery power” with the three basic (circle) events in the middle branch. That would make the entire fault tree have only one tier. Would it be logically correct?

9. Gain experience constructing logic trees by making a success tree for making a campfire. Try including tiers 1 and 2.

Technical Terms Basic event Failure of a specific item, depicted in a fault tree as a circular symbol with text describing the failure. Failure Term used for the event of an item not functioning as intended. Failures are a subset of faults. Failure-

intolerant systems

Term for systems that can be substantially harmed by the failure of one or very few parts.

Failure- tolerant systems

Term for systems that were designed and built to withstand occasional failures of one or more parts.

Fault Word indicating that the desired state did not occur.

Fault tree A top-down arrangement of symbols connected with logic gates and lines to indicate how failures at lower levels can cause undesired events and conditions higher in the tree.

Intermediate condition

A condition within an analytical tree located below the top event and above the terminal event in a branch.

Intermediate event

An event within an analytical tree located below the top event and above the terminal event in a branch.

Logic gates Symbols in analytical tree, located between tiers, serving the function of allowing or disallowing passage from the lower tier to the next higher tier. An AND gate allows passage if all requirements under it are met. An OR gate allows passage if any one of the requirements under it is met.

Success tree A top-down arrangement of symbols connected with logic gates and lines to indicate how success of the top event depends on the success of numerous lower events.

Symbol key An explanation of the symbols used in a fault tree or other graphics. Terminal event

An event at the bottom of a branch of an analytical tree.

Top event The event located at the top of an analytical tree, shown as a rectangle. In fault trees, it is for an undesired event or condition. In success trees, it is for a desired event or condition.

References

1. Ericson CA, II. Hazard analysis techniques for system safety. Hoboken, NJ: Wiley; 2005. 2. Bahr NJ. System safety engineering and risk assessment: A practical approach. New York: Taylor & Francis; 1997. 3. Brown DB. Systems analysis and design for safety. Englewood Cliffs, NJ: Prentice Hall; 1977. 4. Hammer W. Handbook of system and product safety. Englewood Cliffs, NJ: Prentice Hall; 1972. 5. Roberts NH, Vesely WE, Haasl DF, Goldberg FF. Fault tree handbook. Report No. NUREG-0492. Washington, DC: U.S. Nuclear Regulatory Commission; 1981. 6. Roland HE, Moriarty B. System safety engineering and management, 2nd ed. New York: Wiley- Interscience; 1990. 7. Stephans RA. Systems safety for the 21st century. Hoboken, NJ: Wiley; 2004.

Chapter 8

Analyzing Fault Trees

The previous chapter dealt with constructing fault trees. This chapter discusses methods for analyzing fault trees by computing probabilities, finding cut sets, and considering common-cause failures.

8.1 Quantitative Analysis Based on Fault Trees The quantitative analysis of risk helps numerous individuals involved or affected by the systems designed and built to serve a function. The engineers working on a system design project consider risk data to recognize safety-related weaknesses so they can make improvements before completing the design. Managers of the organizations involved want risk data to help them decide whether to accept particular residual risks. If the system might affect a local community, the risk data may help residents feel more confident that the company has taken risk seriously and incorporated appropriate risk-reduction tactics into the facility design. An effective approach is to provide risk information in a quantitative format, and fault trees provide a useful foundation for choosing proper equations to compute risk probabilities. Because the computations are based on probability, this chapter starts with a brief review of applicable probability.1

8.1.1 Applicable Probability Probability is a branch of mathematics dealing with chance occurrences. Basic probability is a value in the range of zero to one that indicates the likelihood of a defined event resulting from a trial, experiment, or occurrence. For example, a crane moves an I-beam from the ground to position on a structural frame of a building. Outcomes of that occurrence can be categorized as no damage or damage. Another example, using a time-based approach, is an industrial operation that is performed for 100 h. The outcomes events can be categorized as having functioned successfully or unsuccessfully. In this book, the probability of occurrence of event X is represented by P(X). Other equivalent notations are PX and Pr(X). A useful tool for understanding probability is the Venn diagram—a visual model of the possible outcomes of a single trial, experiment, or occurrence. A rectangle represents the entire sample space of possible outcomes. Outcomes of special interest, called events, are shown as circles within the rectangular sample space. For our purposes, the circles represent the unwanted events. For example, consider the specific instance of an employee working for 1 h. The outcomes of that working hour could be classified as not injured or injured. Figure 8.1a depicts these outcomes in the Venn diagram. Another example illustrates the application of probability to transportation. Consider the specific instance of a person driving a car from home to work. Outcomes of the journey may be classified into three categories: (1) arrived on time, (2) arrived late, or (3) failed to arrive that day. In the Venn diagram in Figure 8.1b, circles represent the two undesired events. Figure 8.1 Two examples of Venn diagrams.

For fault tree analyses, probability values for the failure events at the bottom of the tree are needed.

These values may come from assumptions, empirical data, or estimates. Probability values from assumptions are often used as examples in textbooks on probability and statistics. Examples commonly used are coin tosses, which assume P(heads) = P(tails) = 0.5, and the roll of a single die,

which assumes each die is balanced so P(each side) = 1/6. Probability values from empirical data are obtained from multiple trials conducted as formal experiments or from past records of similar events. Probabilities from estimates may be developed from discussion among members of a system design team. Using the probability values for lower events in a fault tree, the probabilities of events at the next higher level can be computed, and from those values, probabilities for progressively higher levels can be computed until the top event is reached. The formulas for these computations are explained next. The equations presented in this chapter use algebra. In many of the system safety books, and probability textbooks, the preferred computations use Boolean algebra. However, Boolean algebra is not essential for typical applications encountered in occupational safety and industrial hygiene. Readers interested in learning about the Boolean approach may consult other books.2–4

8.1.2 AND Gates Figure 8.2 includes four ways to think about fault tree analysis. Two graphic ways are the Venn diagram and the corresponding fault tree. Two other ways of expressing the probability of X1 are the sentence format expression and the algebraic formula. Figure 8.2 Understanding the AND gate.

The three circles in the Venn diagram correspond to the three failure events in the first tier of the

fault tree. The fault tree indicates that the top event (X1) will occur if, and only if, events A, B, and C occur. A small space in the middle of the Venn diagram shows where all three circles intersect and that space represents failure X1. Thus, within the large sample space (S), all events are successes except the highlighted space in the middle. The probability of X1 is the algebraic product of the probabilities of the events A, B, and C. The equation P(X) = P(A)P(B)P(C) may be used for most AND gates located above three events in a fault tree. However, this formula assumes that the probabilities of the events are independent. When the assumption of independence does not apply, the equation needs modification to account for the dependence. An example of dependence would be if P(C) is initially 0.005, but when event B occurs, the value of P(C) changes to 0.01. Thus, the probability of C, given that B had occurred, is P(C|B) = 0.01. In such case, the latter value goes into the formula instead of P(C). An example may help to illustrate the value of having a situation in which multiple failure events must occur before the top event occurs. Suppose that A, B, and C are independent events with occurrence probabilities of 0.01, 0.005, and 0.002, respectively. The probability of the top event, X, is

computed using the multiplication formula given previously: Notice that event X is very unlikely to occur (one chance in 10 million). This is why we like to have an AND gate under an undesired event—because it takes multiple failure events to make the top event occur. If there are more than three events under the AND gate, the probability of the upper event can be calculated by multiplying the probabilities of all the lower events. It is just a simple extension of the previous equation. Thus, if a fault tree has event X above an AND gate, and events A, B, C, D, . . ., N below it, P(X) is calculated using Equation (8.1) : (8.1) This is the general equation for an AND gate with any number of independent events under it.

8.1.3 OR Gates An OR gate means the top event will occur if any of the lower events occurs. Two methods for computing the probability of the top event are presented here. The first method yields an accurate value when the events under the gate are mutually exclusive and yields an approximate value otherwise. Figure 8.3 depicts the mutually exclusive case with a Venn diagram, a fault tree, a sentence format, and an equation. Figure 8.3 The OR gate for mutually exclusive events.

The approximation formula shown in Figure 8.3 applies to three events under an OR gate. The

more general formula in Equation (8.2) allows adding the probabilities of any number (n) of events (Ei) under the OR gate.

(8.2) Figure 8.4 depicts the situation where the events are not mutually exclusive (i.e., the event spaces in a Venn diagram overlap). The shaded area in the Venn diagram is the union of the three circle events. Figure 8.4 The precise formula for calculating the probability of three events under an OR gate.

The formulas in Figure 8.4 use the notation that the probability of a fault event is P(X) and the

probability of the background event is P(X′). Together these represent all possible outcomes of an event. They are called complementary because together they make up the whole. Thus, we can say (8.3) or for fault events When an expression for P(X) or P(X′) is needed, simply rearrange Equation (8.3) to obtain Equations (8.4) and (8.5). (8.4) (8.5) Equation (8.5) is the one for computing the probability of the event above an OR gate. The key to using it is getting the correct values for P(X′). A three-step algebraic approach is explained below. The first step in OR gate computations is to determine probability values for the complements of each failure event under the gate. This is achieved for each circled event by subtracting the failure probability from 1.0 according to Equation (8.4). If the events are denoted A, B, and C, we would compute P(A′), P(B′), and P(C′). The second step is to apply an adaptation of Equation (8.1) to compute P(X′) by multiplying the complements of every circled event in the sample space: The third step is to use Equation (8.5) to compute P(X). An example should make this clear. Suppose the sample space represented by the Venn diagram has three circled fault events. The probabilities of events A, B, and C are 0.01, 0.02, and 0.005, respectively. To compute the probability of X, first use Equation (8.4) to determine probabilities of the complements of each failure event: Second, insert these values into Equation (8.1) to compute P(X′):

The third step is to use Equation (8.5) to compute P(X): The results may be compared with the value obtained with the approximation method (Equation (8.2)). Using the same event probability values, the approximation formula yields This computed value is very close to that obtained using the first method. This will be the case when the probabilities of all the events being multiplied are low, as in the example. This concludes the discussion of basic building blocks for quantitative fault tree analysis. The next two sections introduce qualitative methods for identifying cut sets and finding common-cause failures.

8.2 Identifying Cut Sets A very practical aspect of fault tree analysis involves identifying sets of events that could cause the top event. Consider a design team working on a system development project. They would like to know what basic failures and faults are most critical to safety. With that information, the team can adjust its design to avoid those events. The term cut set refers to a collection of basic failures that will cause the top failure event. Finding all the cut sets in a small fault tree may be achieved by examining the branches and thinking through combinations needed. But as fault trees expand downward and laterally, identifying cut sets becomes more complex. In addition, system designers are particularly concerned about which cut sets involve the fewest number of basic failures. Basic events in these minimum cut sets provide logical targets for design team emphasis. Nearly every book on system safety describes at least one systematic method for locating cut sets and minimum cut sets. For this book, a method suitable for OSH projects is presented.5 It involves systematically working from the top of the tree down through each tier to find the various cut sets. A basic step in identifying the most critical failures involves identifying sets of basic events that could cause the top event. The analyst first examines each set for redundant events, dropping all but one, and then reviews the remaining sets to find those with the minimum number of basic event. The idea is to design the system so the top event will occur only if numerous basic failures occur. An example is the best way to explain how the method is used. Figure 8.5 shows a fault tree with two branches in the first tier. Begin by assigning labels to the various events. A convention for identifying events is to use numbers for basic events and letters for intermediate events. Each basic event gets a unique number and that number is used even though the event is part of multiple branches. In this illustration, basic events 1, 2, and 3 happen to be in both branches. Figure 8.5 Fault tree to illustrate cut sets.

The general approach is to work downward from the top event. Sets of events are recorded in a

tabular format. When working downward through an AND gate, record each event under the gate in a separate column. When working downward through an OR gate, record each set in a new row of a table. To illustrate with this example, the AND gate requires two events (A and B) to produce the top event. The example uses a spreadsheet setup as shown in Table 8.1. The leftmost column is for the number or each step in the process. The second column from the left is for a set identifier of the form “n.m” where n is the number of the step and m is a number assigned to each set created in that step. The next columns are the worksheet columns; in this case, only four columns are needed. Further to the right is a column for recording how the analyst created that set. The far right column asks if the set is a cut set. The answer will be “yes” when the set contains only numbers. Table 8.1 Filled Worksheet for Identifying Cut Sets.

The first step is to record events A and B in separate columns of the worksheet. After this step, the goal is to replace all intermediate events (the letters) with basic events (the numbers). In Step 2, the left branch of the tree is taken to the second tier while keeping the right branch unchanged. This

involves working downward from A through an AND gate. At the second tier, the A branch divides into two more branches: basic event 1 and intermediate event C. These two events plus event B make a set that satisfies the top event, and this set is recorded in the second row of the table. Only one event is allowed in a cell, so it takes three columns to record the three events in the set. One of those events is recorded in column C1. Column C2 retains the B event, and column C3 is used for the second event under A. Thus, the second row contains the set {1, B, C}. Step 3 takes on the second tier of the right branch. It has an OR gate indicating that event B will take place if either basic event 3 or intermediate event D occurs. These are entered into the worksheet as shown. Since this is an OR gate with two events under it, two rows are needed. These rows are for set 3.1 and set 3.2. The two sets are {1, 3, C} and {1, D, C}. Neither of these sets is a cut set because each contains one or more letters. So, “No” is entered in the far right column of each of the rows. Step 4 continues the effort to replace intermediate events with basic events. This time intermediate event C in sets 3.1 and 3.2 is replaced by the basic events under C (events 2 and 3). Since these are under an OR gate, two rows are needed to replace set 3.1, and two more rows are needed to replace set 3.2. Thus, set 3.1 will result in two new sets: {1, 3, 2} and {1, 3, 3}. These cut sets are entered in the table as set 4.1 and set 4.2, respectively. Similarly, to replace C in set 3.2, two more rows are needed. These are entered as sets 4.3 and 4.4. Neither of these new sets, {1, D, 2} and {1, D, 3}, is a cut set. Step 5 involves replacing the only remaining intermediate event in set 4.3 and set 4.4. Replacing event D in each set with basic events 1 and 2 leaves cut sets in sets 5.1 and 5.2. The Table 8.1 worksheet now shows four rows with numbers and no letters. These cut sets are examined to identify redundant basic events. In set 4.1, there are no redundant events. Set 4.2 has one redundant element (event 3). The extra 3 should be dropped to yield the set {1, 3}. Set 5.1 repeats both event 1 and event 2, so one of each should be dropped. That leaves the following cut sets: With this analysis method, errors by the analyst are foreseeable. It is therefore suggested that each cut set be verified by shading a printed version of the tree as illustrated in Figure 8.6. Parts (a) and (b) of the figure show the minimal cut sets {1, 3} and {1, 2}, respectively. The verification procedure starts at the bottom of the tree and works upward. In the upper tree, basic events 1 and 3 are shaded first, and the paths upward are traced by shading the gates and events that provide an upward pathway to the top event. In the lower tree, events 1 and 2 are shaded, and the path upward is shaded in the same manner. Figure 8.6 Two minimum cut sets for example fault tree.

Finding minimal cut sets provides useful information to system designers. However, caution is

needed to avoid focusing all attention on the minimum cut set paths. There are typically many cuts sets. Although the minimal cut sets warrant the most attention, others should not be ignored. This is illustrated in a study about a bridge collapse analyzed with a fault tree.6 There were cut sets containing a single element, such as a plane crashing into the bridge, and a ship colliding with a span due to being too tall for the clearance. But the failure path that actually caused the collapse consisted of multiple elements. The concrete footing of one of the four support piers deteriorated after 32 years

of water erosion. This led to a failure in the footing and collapse of the pier. Soon after the initial pier collapsed, adjacent piers were overloaded and failed. Ten people were killed.

8.3 Finding Common-Cause Failures Redundancy has made possible very respectable safety records for large and complex systems with high potential for disasters such as those found in aviation, nuclear power generation, and chemical processing plants. However, disasters involving these complex systems have occurred, and lessons have been learned from the investigations. Among these lessons is one about not allowing a safety- critical function to fail due to a single cause that affects multiple items in the system—a failure known as a common-cause failure. Consider the fault tree in Figure 8.7. The top event is the failure of a safety-critical subsystem. Under it is an AND gate. In tier 1, assemblies A, B, and C are considered redundant. Each assembly has a different design, but some parts are the same. A design team may look at this and, using Equation (8.1), calculate that the probability of all three redundant assemblies failing is very small. This would make the design team quite confident about avoiding the top event. However, further examination of the system will reveal a common-cause failure. Figure 8.7 Fault tree illustrating a common-cause failure.

Tier 2 has subassemblies D, E, F, G, and H. Tier 3 has components J and K. The basic failure events

are parts. Look first at the left branch, starting at the bottom tier. If part 3 fails, component J will fail, subassembly D will fail, and assembly A will fail. Thus, the failure of part 3 is a single cause for the failure of assembly A. Now look at the middle branch. If part 3 fails, subassembly E will fail. The failure of E will cause assembly B to fail. Now look at the right branch. If part 3 fails, component K will fail. That failure will pass upward to make subassembly H fail, and this will make assembly C fail. From all this, we can see that a failure of a single item (part 3) will cause failure of each of the

three assemblies—assemblies initially considered redundant. The fault tree in Figure 8.7 illustrates how a safety-critical function can fail due to a single part failure even though it has three assemblies under an AND gate. The source of this problem is the interdependence of the three assemblies. This lack of independence means that simply multiplying their failure probabilities yields an unrealistic value for the upper event probability. How might the vulnerabilities to safety-critical functions originate? Ericson provides several examples, some of which are mentioned here.7 In one example, an airliner crashed after multiple hydraulic lines were damaged by a single event in the rudder area. This led to loss of hydraulic fluid in multiple lines, loss of control of the aircraft, and a disastrous crash. Common causes may also stem from two redundant assemblies designed and manufactured by the same manufacturer. In that situation, a defect in design, a part, or the manufacturing could make both assemblies vulnerable to failing at the same time for a common reason. In other words, the two assemblies are not independent. Similarly, a common cause may stem from having the same firm perform maintenance on two or more redundant assemblies. A single maintenance specialist might make the same error on all similar assemblies. Other origins involving errors may include errors in the specifications, design, production, and installation of the components and assemblies. Another potential source is unexpected outputs from software shared by elements of multiple safety-critical subsystems. Environmental influences may also adversely affect performance of multiple elements of components that support redundant assemblies. These are just a few of the possible origins of common causes. Quite often, common cause origins are easy to overlook and challenging to find. The systems for which common-cause failure analysis may be used range in complexity. For less complex systems such as that in Figure 8.7, a good fault tree and some attention may be enough to identify common-cause failures. For complex systems, a systematic approach is needed. Typically, a project is funded for a team of engineers and system safety professionals to perform the common cause analysis. For OSH professionals who need to learn more about the process, the Ericson book has an excellent chapter on common-cause failure analysis.7

8.4 Summary of Part II Part II consists of five chapters on methods OSH professionals can use for risk identification and analysis. The first (chapter 4) introduces the tool known as job hazard analysis (JHA). The chapter provides a typical format and discusses each of the three columns for recording the analysis. The JHA development process begins by breaking down a task into steps. The analyst then identifies any potential hazardous events and exposures in each step and records in the third column appropriate hazard controls for each potential hazard. Two variations on the basic JHA are mentioned. The phase hazard analysis serves as a practical tool for integrating safety and health into construction projects. The position hazard analysis serves as a tool for documenting that the employer thought through the safety-related requirements of each position and shared that information with each employee. The second methodology, risk assessment (RA), is described in chapter 5 as a widely used process for businesses involved in making and distributing products and equipment to consumers, businesses, and governments. RA also provides a structured approach for OSH professionals to assess occupational systems to improve understanding of potential hazards and identify suitable risk- reduction tactics. The ability to apply RA processes is becoming an essential tool for careers in occupational safety, risk management, and industrial hygiene. Chapter 6 introduces the third methodology—failure mode and effects analysis (FMEA). It is useful

for identifying items in a system most critical for system performance and safety. The direction of analysis is opposite to that used for constructing fault trees. To construct a fault tree, the analyst starts at the top of an imaginary evergreen tree and works downward. To perform an FMEA, the analyst starts low in the tree and works upward. The methodology of FMEA uses a tabular form with rows and columns to structure analysis of specific items. For each item, possible failure modes are entered into the form. Each mode is characterized in terms of effects farther up the tree. The fourth methodology, described in chapter 7, is constructing fault tree diagrams. A well- constructed fault tree provides insight into the causes of a specific undesired event or condition. The tree can help system engineers identify vulnerabilities and safer design options. Constructing these diagrams requires knowledge and comprehension of the system, as well as an ability to synthesize the information into a logical graphic model. The fifth methodology in part II (chapter 8) extends the fault tree construction topic by explaining three methods for analyzing fault trees. First, fault trees provide a basis for computing the probability of the top event by starting at the bottom of the tree and using failure probabilities of basic events to compute the probability of events at progressively higher tiers. Second, fault trees provide a foundation for identifying the sets of basic events that can cause the top event, including identifying the minimum cut sets. Third, fault trees provide a structure for seeking out possible common-cause failures—obscure situations in which a single cause can have detrimental effects on multiple items initially thought to be independent and redundant. All five chapters in section II concern methods currently used by OSH professionals and their associates to reduce the risks of harmful events and exposures.

Learning Exercises 1. Consider the case of an organization with 40 full-time employees that during the course

of a year had two recordable injuries involving two different individuals. a. Sketch a Venn diagram to depict the outcomes (injured or not injured) for 1 year of work by one individual employee.

b. If no changes are anticipated in the work or the OSH program, we can project the same results next year. What is the projected probability of an individual employee being injured on the job next year?

c. What is the probability of an individual employee completing next year without an injury?

d. Venn diagrams often use the size of circles to represent the proportion of total space in the diagram applicable to the specified outcome. If that were done in this case, what portion of the space in the rectangle should be allocated to the injury circle?

2. Consider a fault tree with an AND gate under the top event. The first tier contains four failure events with respective failure probabilities: 0.005, 0.002, 0.01, and 0.0001.

a. What equation should you use to compute the probability of the top event?

b. Using the equation, what numerical value do you get for the top event probability?

c. For the top event, what is the probability value of the complementary event space (i.e., success probability)?

3. This is an exercise in probability computations involving a two-tier fault tree. It is the same example fault tree as used in chapter 7, Figure 7.5. For the example, use the following probability values for each event.

Failure to close switch A 0.001 Failure to close switch B 0.001 Failure to close switch C 0.001 Bulb failure after 2000 h of operation 0.03 Battery not working at 2000 h 0.005

a. Given the probabilities above, compute the probability of an open circuit path using the most accurate method.

b. Say you have used the flashlight for 2000 h with the same bulb. The batteries have been changed occasionally, but the overall probability of failing remains 0.005. What is the probability of the top event occurring when you turn the flashlight on? Use the most accurate method and your answer to (a) for calculating your answer.

c. What if the tree had been constructed by putting all five failure events in the first tier? Show the probability calculations for that arrangement and compare the computed value with your answer to (b). Use Equation (8.5).

d. Compute (c) using Equation (8.2). Compare the probability values you obtained using the two equations.

4. For the two qualitative methods described in this chapter, concisely distinguish between their purposes. 5. Regarding minimum cut sets, the discussion mentioned a bridge collapse. What point was made? 6. Part II of this book has five chapters. What was the rationale for grouping these topics into this part?

Technical Terms Common cause A single origin for the failure of multiple system components, assemblies, or subsystems. Common-cause failure

Phrase for multiple failures of system components, assemblies, or subsystems originating from a common cause, usually referring to failure of safety-critical items.

Cut set Term used in fault tree analyses to describe a collection of basic failures that, if all occur, will cause the top event.

Independence In probability theory, N events in a sample space are independent if the probability of any event is unchanged by the occurrence of another event.

Minimum cut sets

Term used in fault tree analysis for the cut set, or cut sets, containing the least number of events. Also called minimal cut sets.

Quantitative analysis

Term referring to a numerical-based analysis.

References

1. Walpole RE, Myers RH. Probability and statistics for engineers and scientists, 4th ed. New York: Macmillan; 1990. p. 1–33. 2. Ericson CA, II. Hazard analysis techniques for system safety. Hoboken, NJ: Wiley; 2005. p. 198– 204. 3. Roberts NH, Vesely WE, Haasl DF, Goldberg FF. Fault tree handbook. Chapter XII. Report No. NUREG–0492. Washington, DC: U.S. Nuclear Regulatory Commission; 1981. Available at www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0492 (accessed July 6, 2011). 4. Andrews JD, Moss TR. Reliability and risk assessment, 2nd ed. New York: ASME; 2002. p. 201– 267. 5. Stephans RA. System safety for the 21st century. Hoboken, NJ: Wiley; 2004. p. 178–180. 6. LeBeau KH, Wadia-Fascetti SJ. Fault tree analysis of Schoharie Creek Bridge Collapse. J Performance Constructed Facilities. 2007;23(4): 320–326. 7. Ericson CA, II. Hazard analysis techniques for system safety. Hoboken, NJ: Wiley; 2005. p. 397– 421. Part III Programmatic Methods for Managing Risk Part III contains five chapters about risk-reduction methods implemented through OSH programs. Chapter 9 addresses incident investigation programs starting with a description of a closed-loop process to ensure that lessons learned are used to strengthen operational weaknesses. It presents policy issues to address an organization-specific incident investigation policy. It explains tools to help incident investigators organize evidence into a series of events and conditions leading to and following the harmful event. It concludes with a graphic model depicting the interrelationships among (1) the regular functioning system operating normally, (2) an initial deviation from normal going uncorrected, (3) the end of control, (4) subsequent events leading to a harmful outcome or near miss, and (5) post-incident events affecting the ultimate outcome. Chapter 10 addresses human errors, explaining the concept of errors in relation to system tolerance, summarizing a multidisciplinary classification system, and offering two analysis methods for addressing safety-related errors and rule violations. Chapter 11 proposes consolidating all risk- reduction strategies into nine categories and explains how these fit into the traditional three-level risk-reduction priority scheme: (1) eliminate the hazard, (2) use engineering controls, and (3) use administrative controls. Chapter 12 discusses some common components of most OSH programs, starting with the importance of defining the organization's OSH program aspirations, followed by essays on training, warnings, safety devices, emergency preparedness, and sanitation/housekeeping. Chapter 13 provides an overview of OSH program management, specifically addressing the overarching topics of safety culture, management systems, and ethical policies.

Chapter 9

Incident Investigation Programs

People investigate harmful incidents for various reasons.1 For safety professionals, the primary reason for investigating incidents is to learn about system weaknesses and vulnerabilities so that corrective actions can be identified and implemented, and a secondary reason is to comply with recordkeeping requirements. For legal advisors, the main interest is to properly obtain evidence in order to prepare for possible litigation. For the news media, a single “cause” is sought for a news story. For regulatory agencies, the main reason is to determine what regulations may have been violated. In addition to these common reasons, an incident investigation may be conducted for at least three other reasons. One is to look for evidence of criminal behavior, such as a fire started by an arsonist. A second is to determine the economic value of losses in order to obtain some financial indemnity from an insurer. A third is to learn about ways to make the organization more effective by strengthening management processes (not just safety-related processes). To accommodate these varying needs and perspectives, it helps to have a written policy and standard practices in place before an incident occurs. This chapter consists of five main sections. The first three sections address the concept of a closed- loop process, common issues to resolve in an incident investigation policy, and basic investigative processes. The fourth one explains some useful tools to help investigators with their analysis, and the fifth section provides a graphic model useful for visualizing the various phases and events leading to and following the incident. Incident investigations fit somewhere on a continuum from shallow to deep. Shallow investigations typically look only at the conditions and events close to the incident, and the report consists of descriptive information called for by an incident investigation form. Deeper investigations extend to root causes—the weaknesses and vulnerabilities that allowed or led to the events and conditions most directly associated with the incident. Clearly, deeper investigations have the potential to yield more insightful conclusions and useful recommendations.

9.1 Closed-Loop Process A foundation for understanding organizational options for incident investigations begins with understanding the concept of a closed-loop process. The graphic model in Figure 9.1 is used to explain the relationship between a normally functioning system and a closed-loop incident investigation process. The upper part of the model depicts the normal activities of the system simplified into (1) the inputs to the system, (2) the system performing in a normal, predictable manner, and (3) the outputs. The lower part of the model shows the flow of processes for responding to the occasional harmful incident. Figure 9.1 Graphic model of a functioning system with a closed-loop process for addressing harmful incidents.

System inputs include materials, utilities, people, and other resources entering the system. System

outputs are goods and services valued by customers and usually some waste. The box depicting a functioning workplace system signifies an operating entity. Some workplace systems are defined by location, such as manufacturing plants, chemical processing facilities, a group of people working together in an office building, construction sites, hospitals, mines, ships, airports, and farming operations. Other workplace systems are defined by an area or region in which they operate, such as local governments, entities operating railroads, courier service providers, and businesses engaged in transportation. Within workplace systems, there are daily variations that are normally tolerable. Successful systems have capabilities to monitor and detect when things start going awry and to make corrections in a routine, relatively easy manner. The correctable deviations are regarded as being within the tolerance of the workplace system. Some deviations go uncorrected, and a portion of these start a chain of uncontrolled events that leads to a harmful outcome. Figure 9.1 uses rectangles to represent the five processes in a closed-loop investigation. It applies to investigations conducted by a team seeking to learn how to make the workplace safer. It may apply to form-driven investigations, provided the investigators are well trained, they come up with useful recommendations, and the organization follows up on those recommendations. When the decision is to conduct a team investigation, all five processes in Figure 9.1 are performed—effectively closing the loop. The remainder of this chapter emphasizes the importance of each organization tailoring policies to fit its unique needs. No attempt is made to describe a best practice or a preferred “how to” approach for post-incident investigation. Background material for this chapter comes from the author's experiences integrated with advice from numerous authors, especially Bahr, Hughes, and Oakley.2–4

9.2 Policy Considerations A written policy provides the organizational guidance about what to do after a harmful incident. The organization may conveniently make the policy a section of its official policy for administering an OSH program. Table 9.1 provides an outline of the processes and associated policy issues the organization may choose to include in an incident investigation policy. The remainder of this section discusses these issues without attempting to specify a one-size-fits-all approach. Table 9.1 Overview of Some Policy Issues for Responses to Harmful Incidents.

Policy application Issues to resolve Defining scope of incident investigation policy

What types of incidents will be investigated?

Deciding on depth of investigation

What criteria will be used for deciding which incidents to have a team perform an in-depth investigation? Will decision on depth of investigation be based on actual outcome or on what could have been the outcome had the response been ineffective?

Assigning and preparing investigators

How does organization choose investigators? What training will investigators get?

Collecting and preserving evidence

What procedures are expected for (1) collecting evidence and (2) preserving evidence?

Will policy explicitly call for getting evidence on (1) the normal process and (2) the history of equipment maintenance?

Analyzing evidence Should all teams use a particular analysis tool? Reaching useful recommendations

Does organization want to have guidelines for the recommendations contained in investigation reports?

How will draft recommendations be reviewed prior to finalizing the investigation report? Communicating findings, recommendations, and lessons learned

Does organization want a policy on (1) assigning corrections to appropriate individuals, (2) a formal verification procedure, (3) distributing the report, or (4) sharing lessons learned outside the organization?

The beginning of the closed-loop process depicted in Figure 9.1 is an incident of some kind. Organizations need to define what incidents to include and exclude from their incident investigation policy. Will the policy apply to employees, the environment, product users, equipment, facilities, or others? What are the legal requirements for investigations? What level of severity will trigger an investigation? Another question to resolve is what sorts of events will be investigated with a full team doing an in- depth investigation. A policy could specify criteria for equipment damage in terms of estimated financial loss. A policy could specify criteria for human injuries based on severity. If the organization uses a risk-assessment matrix, it may also be useful to mirror the severity categories used in their risk matrix. For example, say the company uses four categories of severity in its risk assessments (e.g., minor, moderate, serious, and catastrophic). It may be advantageous to use the same severity categories in the policy on depth of investigations. Advantages of this include being consistent, limiting complexity, and facilitating comparison of actual harm to the level of harm shown in the applicable risk-assessment document. The severity of harm can be affected by the post-incident response. A rapid response by emergency medical service personnel can make the difference in life or death. The response by an environmental response team to a spill (e.g., an overturned tanker truck leaking a chemical) can greatly limit the amount and spread of the chemical and thereby reduce the cost of restoring the soil. The response of a fire department to a structural fire can make the difference in a total loss or a repairable structure. Because post-incident response often affects severity, a question for consideration is: Should the policy be based on the outcome severity after the response or on the potential worst case had there not been an effective response? For example, in a petroleum refinery, a small fire started, and an employee noticed it and used a portable fire extinguisher to extinguish it. If based on actual outcome, it would be considered a minor incident warranting an ordinary investigation, but viewed from the perspective of the potential worst case, it would be considered serious incident warranting a full- scale, in-depth investigation. Some organizations encourage personnel to report near-miss incidents based on the idea that for each actual injury there are many instances of someone coming close to being injured. By obtaining

reports and investigating many near-miss incidents, OSH professionals can uncover hazardous conditions, events, or exposures suitable for correcting before any harm occurs. Organizations that ask employees to report near-miss incidents will want a policy or process for investigating or otherwise following up on the reports. Another policy decision involves terminology. Some people passionately debate the pros and cons of terms used to describe incident outcomes. The U.S. military community uses the word mishap. The word “accident” is commonly used in general industry, construction, in reference to major transportation disasters, and by coroners to classify cause of death. The public health community uses words specific to human health such as injury, death, and disease, while avoiding the word “accident” because a substantial portion of the public associates the word with an unpreventable or random event. No attempt is made in this chapter to either criticize these other terms or advocate for the term “harmful incident.” One final policy issue warrants comment. Organizations vary on how much time and money they want to put into incident investigations. Differences result in part from how OSH leaders view the benefits from investigating past events versus time spent on proactive OSH projects. Some safety professionals liken investigating past incidents to a dog chasing its own tail—a never-ending circle of investigating and fixing problems. Some organizations choose to allocate more OSH resources to proactive programs. There is no one-size-fits-all allocation formula.

9.3 Investigative Processes Critical parts of an incident investigation include (1) collecting and preserving evidence, (2) reaching evidence-based conclusions, (3) developing useful recommendations, and (4) communicating findings, recommendations, and lessons learned.

9.3.1 Collecting and Preserving Evidence Common types of evidence are photographs, scale drawings of the location, statements by witnesses, and documents in paper or electronic form. Before allowing changes in the scene, take numerous photographs, keep a log of the date, time, and location, and preserve all of it. Obtain measurements for making a scale drawing of the area. Mark or tag tools, equipment, and other items for clear identification in case of litigation. As soon as possible, interview eyewitnesses—people who were in the area of the incident and who possibly saw, heard, or smelled something relevant to the incident. Other witnesses to interview are people who have knowledge of how the operations are supposed to work and how things actually work. Interviews with these people may provide information for identifying deviations that may have contributed to the events preceding the harmful incident. Readers who occasionally investigate workplace incidents can easily identify published material containing advice on investigation methods and procedures.3,4 For readers who find that their jobs involve regular incident investigations, training courses are typically available through professional societies or agencies in their business domain. Some common domains with need for frequent investigations are found in government agencies that investigate chemical plant fires and explosions, workplace fatalities, and crashes involving aircraft, trains, and buses. Special courses are available for fire and police department investigators who need to look for evidence of arson (deliberate fires started with criminal intent). Property insurance companies also provide training for investigating fires to determine if the fire was covered by the policy, if a third party might have some liability, and the value of losses.

Easily overlooked in incident investigations is the need for evidence with regard to the normal processes, practices, and controls in the affected system. This information will facilitate comparing what normally occurs with the actual events leading to the incident being investigated. That comparison may indicate deviations from normal that created a hazardous condition or resulted in a normally effective control being ineffective. An example would be learning that a particular machine frequently malfunctions or that an employee routinely followed a procedure that differs from the standard operating procedures.

9.3.2 Reaching Evidence-Based Conclusions The various sources of evidence may be viewed as pieces of a puzzle. Once the pieces are assembled, the investigative team can begin putting the puzzle together. Some analytical tools for helping an investigative team complete the puzzle are discussed in this section. Incident investigators should strive for evidence-based conclusions. While that may sound obvious, it can be tempting to do the opposite. The opposite is reaching a conclusion and then sifting through the evidence to find support for that conclusion, while discounting or ignoring evidence that conflicts with the conclusion. To avoid that pitfall, organizations may choose to specify methods for keeping investigators on track. Three logical steps for taking the path from evidence to conclusion are

1. Develop the accident sequence, 2. Analyze it, and 3. Determine causal factors.4

In Step 1, the investigation team uses the evidence to explain the sequence of events. It is often helpful to start by describing the scene where the incident occurred. This can include such information as the place and conditions existing before, during, and after the incident. Typical types of evidence for this step are photographs and a scale drawing of the location. In Step 2, the investigative team seeks to provide a plausible explanation for all the reliable evidence. Some techniques the team may use to analyze the evidence are described in books by Oakley and Stephans.4,5 One such tool—the events and causal factors chart—is explained later. In Step 3, the investigation team reviews their results from Steps 1 and 2. From this foundation, the team extracts the factors that contributed, enabled, or directly caused the events in the sequential chain. Following the three-step process should lead to evidence-based conclusions as well as identifying factors in need of change. Investigators should recognize their investigation is what statisticians call a sample of one. Therefore, investigators should be cautious about trying to generalize their findings beyond the scope of their investigation. It is best to limit the findings and conclusion to your case. Later, others may develop generalization after reading your report and many other reports. Also keep in mind that the ordinary occupational incident investigation team lacks the resources, and perhaps the expertise, to adequately assess organization-level issues. This contrasts with highly funded multidisciplinary investigations of major disasters involving ships, passenger planes, nuclear power plants, petroleum refineries, and space flights.

9.3.3 Developing Useful Recommendations As a practical matter, the investigation team should attempt to focus on making recommendations that are feasible to implement economically, technically, and legally. Consider the alternative. If the team

makes a recommendation that never gets implemented, the organization may find its nonresponsiveness used against it in future litigation. To illustrate how such a scenario might unfold, consider a general contractor in the building construction business. They had a subcontractor employee seriously hurt when he fell from a roof. The investigation team recommended that the general contractor should closely monitor and enforce fall protection for elevated work performed by all subcontractor employees. Now suppose three years later an employee of a subcontractor falls from a roof and gets seriously hurt. The employee could sue the general contractor claiming failure to exercise due diligence by not making sure all subcontractor employees always use fall protection. As evidence, the injured employee's attorney can introduce the report from three years ago that recommended the general contractor should enforce fall protection by its subcontractors. The attorney will argue that the general contractor failed to exercise due diligence by not fully implementing the recommendation in the prior report. In essence, the recommendation may have imposed a legal duty on the general contractor that did not previously exist. Thus, before finalizing its report, it will be wise for the investigation team to consider each recommendation for legal implications as well as for economic and technical feasibility. Another matter to consider when developing recommendations involves prior risk assessments. If the organization already has an RA applicable to the investigated events, it makes sense to review it. The RA can provide information useful for the incident investigators, and the findings from the incident investigation can be useful for reassessing the RA. If not all the risk-reduction tactics in the RA were in place when the incident occurred, the investigation team would most likely recommend actions to reimplement the tactics. If all the tactics were in place, the team needs to reassess the RA and consider revisions to correct deficiencies. Another option would be to conclude that the risk was acceptable before the incident and continues to be acceptable into the future. This second conclusions could be quite appropriate for an incident of equipment damage. But if an employee was harmed, this conclusion would leave the impression that the employer is coldhearted and lacks genuine concern for employees. In reality, people expect the investigation team to make some sort of recommendations for change, either to reimplement risk- reduction tactics or modify the RA.

9.3.4 Distributing Findings, Recommendations, and Lessons Learned

Before wrapping up the investigation, the team needs to distribute their findings, recommendations, and lessons learned. Clearly, the final investigation report should be distributed to the individuals most affected by the incident. If not given a copy, they might suspect something important is being hidden from them. A distribution list should include everyone with a possible role in implementing recommendations. Although an incident investigation team is responsible for making recommendations, the team has no authority to assign managers to implement the recommendations. Therefore, an organization intending to have a closed-loop process needs to transfer recommendations from the incident report to managers with authority to implement. Since busy managers may not find the time to read the entire report searching for findings and recommendations applicable for their units, some mechanism is needed to highlight the specific responses applicable to each manager. One approach could be to distribute the report to managers with an accompanying memo highlighting items applicable to the manager. Another approach could be an oral presentation on the investigation at a management meeting.

There is also a need to follow up on implementation. A process to verify proper implementation of corrective measures contributes to overall safety by providing (a) impetus for managers to implement recommendations applicable to their operations, (b) assurance for the organization that corrections were made, and (c) documentation of closing the loop. The investigation team may want to share important lessons learned with others. Some organizations with multiple sites have mechanisms for sharing lessons learned at one site with counterparts at other sites. Similarly, some industry groups have shared reporting of lessons learned. The nuclear power industry, for example, developed an information sharing system because of a mutually recognized need to operate all nuclear plants in the world safely. Another example of sharing is found in the fire protection community. Journals and magazines routinely publish reports about major fires and explosions, and these typically contain lessons learned.

9.4 Practical Tools for Incident Investigators In this section, practical tools for incident investigation teams are explained. The first tool helps the team use the evidence to develop a sequential chart of events and associated contributors to those events. The second tool can help the team think broadly about potential corrective actions to reduce future risks. The third helpful tool is the use of prior investigation reports found in published literature and reputable websites. The fourth section briefly explains three other analysis tools.

9.4.1 Events and Causal Factors Chart A useful tool for sorting out the sequence of events is depicted in Figure 9.2. Called an events and causal factors chart, it displays the events in boxes arranged in order from left to right. The text in the event boxes indicates the actor (person or thing) and the action. The action description should simply state the action and avoid judgmental words such as unsafe, improper, or erroneous. Ovals connected to events are for noting conditions and factors associated with the event. For the example chart, there was one condition relevant to event 1 and two conditions relevant to events 2 and 3. The point where the harm occurred is depicted by a star-shaped figure. Although some organizations use a diamond shape, this may not be ideal because it gives too many meanings to the diamond—in the conventional flowchart a diamond shape is used for decisions, and in analytical trees a diamond shape is used for an undeveloped event or condition. In the figure, two response events (R1 and R2) are depicted to the right of the star. These are useful for documenting the performance of the first response and subsequent actions to mitigate the harm. Figure 9.2 Basic format of an events and causal factors chart.

An events and causal factor chart can help not only the investigation team, but also those who read the final report. It depicts the main events and associated conditions, and it provides an organizational structure for writing the incident scenario. Although the chart shown makes this whole effort seem very simple, possibly trivial, it can be invaluable when sorting through scenarios that are more complex. For one thing, the “conditions” described in the chart can be used for various types of information relevant to the event, four of which are noted below.

1. Enabling conditions that had to occur in order for the event to occur (e.g., the machine was connected to the building's electrical system). This kind of condition is recognized in legal circles as being one element of a negligence case. It is the element involving proof that the harm would not have occurred “but for” the condition existing. 2. Omitted events or nonevents such as noting the victim omitted a step in a procedures (e.g., entering a confined space without first checking the concentration of flammable vapors). 3. Contributing factors such as a warning sign was not visible, lighting was poor, or the employee had been working extra hours for three straight days. 4. Basic facts relevant to the event such as noting the distance of a fall, the weight of an item involved, or the fact that the company required a particular item of PPE.

The text in ovals should be concise and avoid judgmental adjectives. Some organizations and authors will use an additional symbol to show why a particular condition existed (Oakley uses a hexagon).4 Thus, events and causal factors charts provide considerable flexibility for sorting out the sequence of events, conditions associated with the events, and the causes of the conditions and events. All this information will directly help the investigators understand how and why the incident occurred. An example of an occupational fatal fall is offered to illustrate how the events and causal factors chart can be used to clarify the sequential events. Figure 9.3 uses three rows to organize events into three phases. The top row contains the preliminary events that set up and allowed the man to fall. The second row contains the sequential events from loss of control to injury. The third row contains the relevant response events subsequent to the injury. Figure 9.3 An event and causal factors chart for fall from a scissor lift.

A painter named Joe was painting a high-bay ceiling with a roller brush. He was working from a

scissor lift (SL) elevated to about 4 m, making his center of gravity about 5 m above the floor. The SL was borrowed from another subcontractor with a crew at the site. The railing on the lift platform was intact on the front and both sides. Elevation controls were attached to the front rail. When the SL was new, the rear of it had a swinging, self-closing rail at approximately hip height and a chain for use as a midrail. Workers could enter the platform by either crawling under the rail or using the rail as a door. However, the old borrowed SL no longer had the rail. It also did not have a chain. Information obtained from other painters after the incident enabled the investigators to determine the normal method they use to paint a high ceiling from a SL. Painting a ceiling involves constantly looking upward. Workers fill their brush, and then start in the front of the platform and work backward until they feel their hip bump the back rail. They even call this a “bump bar.” Once they feel it, they walk back to the front to begin another cycle. After obtaining photographs of the SL, statements from a coworker, and interviews with other painters, the event sequence was pieced together as shown in Figure 9.3. The chart begins with Joe climbing onto the SL platform. Other investigators may elect to start further back in time in order to elucidate why Joe borrowed a SL instead of using one owned by his employer. They might also ask why Joe would choose to use a SL he could easily see was lacking a rail. Thus, one of the issues facing incident investigators is where to begin.

Benner proposed a place to begin an investigation.6 He recommended looking for an event that started an uncontrolled chain of events based on a general model of a functioning system. A brief explanation of this model will help readers appreciate his rationale. Think of the daily activities of a functioning system operating in a normally controlled manner or in homeostasis. In that state, many events go as expected, and the occasional deviation from normal (Benner called it a perturbation) can be easily dealt with by human response or engineered adjustments. When something unusual occurs and fails to be detected and adequately corrected, homeostasis is lost—initiating of a potentially uncontrolled chain of events. The chain of events may lead to various outcomes ranging from no harm to very serious harm. Once the investigators know what events led to the harm, Benner advises that they take their investigation back in time to the original deviation. At that starting point, the investigators try to determine why and how the deviation occurred and what happened afterward. In the illustration, the deviation was identified as Joe climbing onto the platform of the unfamiliar SL with a missing gate. That was the deviation event—when he deviated from his normally successful method of painting a ceiling using his own company's SL. Thus, the event sequence in the top row of Figure 9.3 starts with the deviation event and ends with the failure of the last hazard control—Joe keeping mental focus on his body position relative to the opening. The ergonomics principle of single-channel processing tells us that humans are poor at concurrently performing two or more mental processing tasks. Joe was trying to concurrently process both body position and the roller brush applying paint to the ceiling. His normally successful stop in the correct position was the only fall prevention tactic. The failure of that tactic ended his postural control. The second row of the chart begins with Joe no longer having control of his body—he was falling and could do nothing about it. Other intermediate events in this row led to his head hitting the concrete floor, causing traumatic injury. It is the nature of intermediate events that multiple outcomes are possible. Outcomes can range from catastrophe to close but unharmed. In the example case, outcomes would have been different if Joe had been wearing a harness connected by a lanyard to a fixture on the platform, if he had tumbled differently and landed on a different body part, or if he had landed on a half-empty cardboard box instead of a hard floor. All these variations in possible outcomes illustrate the importance of including the details of the intermediate events in the chart. To appreciate a chart such as this, it helps to initially read the descriptions in the event boxes, and then go back and look at the ovals. The two ovals above the first event box illustrate different types of conditions. The first (never used this SL before) was a contributing condition. The second (no rail on rear of SL) was an enabling condition. The condition above the second event box (controls in front of SL) is a fact that merely makes clear that Joe must have gone to the front of the SL to raise the lift. The two ovals above the third event are contributing factors for the painting work Joe was doing. The first one (routine work for Joe) was determined from witness statements obtained from other painters who had worked with Joe. The second (looking upward) was assumed as being necessary to properly paint a ceiling. The oval concerning work pattern being from front to rear is to make clear that an assumption was associated with this event. The last oval in the top row (expected to bump rail at rear) was another assumption based on interviews with other painters. Investigators can include in their events and causal factors chart any events or conditions that helped mitigate the severity of harm. These are generally located just to the left of the star symbol in the chart. For example, if Joe had landed on a half-empty cardboard box, that would be identified as an event that reduced the deceleration at the bottom of his fall. As another example, if a dropped object impacts the hard hat of a worker below, the mitigating effect of the hard hat would be shown as an event. If the driver of a car loses control and the car hits a tree, mitigating events might be “seat belt

holds driver in seat” and “air bag cushions driver's head.” On the other hand, if a normally effective safety device was not in use or unavailable, the chart should indicate the absence in an oval. Figure 9.4 contains two charts for car wrecks. Figure 9.4a shows how to include the role of safety devices. Since the contributions of the seat belt and air bag occur at the same time, they are shown as parallel events. Figure 9.4b shows how to indicate the lack of safety devices. The two ovals are placed above the event they influence—driver slams into steering wheel. Thus, events and causal factors charts can show safety devices contributing (in event boxes) or failing to contribute (in ovals). Figure 9.4 Event charts for severity-mitigating factors that helped (a) and failed to help (b).

The events and causal factors chart is a useful tool for understanding and presenting a harmful

incident. It may also help the investigators identify potential recommendations for system improvements. Another useful tool to help with recommendations is the Haddon Matrix.

9.4.2 Haddon Matrix for Countermeasures The investigation team may use a Haddon Matrix to generate and organize possible recommendations for what Haddon called “countermeasures” applicable to highway injuries and fatalities.7 He presented a matrix with three rows to categorize the phases of a highway crash: pre-crash, crash, and post-crash. Columns were for elements of highway systems that could be modified. The cells of the matrix were used to record possibilities for making the system safer. Obviously, the cells are intended only for short descriptions of each potential countermeasure. Figure 9.5 shows a form of Haddon Matrix with three rows and four columns suitable for most workplace systems. The three rows are like Haddon's except terms more suited for occupational incidents are used. The “pre-incident operations” row is for noting ways the system can better control deviations from normal operations. Success with items in this row will prevent an uncontrolled chain

of events. This row is also useful for noting preparations for the second and third phases. The second row is for noting ways to alter the event sequence between the loss of control and the harmful event. This is the row for entering ways to stop the chain of events, avoid aggravating factors, and use mitigating factors. The third row is for noting ways to make the response as effective as possible. Figure 9.5 Matrix for risk-reduction recommendations.

When using a Haddon Matrix, confusion can occur when deciding in which row to put safety

devices. To appreciate this confusion, first consider personal protective equipment such as hard hats and personal fall protection devices. On the one hand, it makes sense to put them in the pre-incident phase because that is when personnel need to start using the devices. On the other hand, these devices provide mitigating value in the during-incident phase. Using another example, seat belts in cars, the driver and passengers need to latch their seat belts in the pre-incident phase, but the injury mitigating value would be realized in the during-incident phase. Using both rows is an effective way to get the most benefit from a Haddon Matrix. Similar confusion can arise with response activities. One could argue that planning and preparation for effective responses occurs in the pre-incident phase, so these activities belong to that row. One could also make the argument that the value from first responders occurs in the post-incident phase, so that row would be more appropriate. Different organizations may prefer one or the other row. Again, using both rows is the most effective way to benefit from a Haddon Matrix.

9.4.3 Learn from Prior Incident Investigations OSH professionals can learn innumerable lessons by studying incident reports found in journals, magazines, and websites of governmental agencies. Unfortunately, many in the OSH field fail to believe that lessons learned in one industry may be useful to other industries. Lessons learned about weaknesses in management system are often applicable across industries, as the following examples illustrate. A large team of highly-regarded professionals investigated the 1986 Space Shuttle Challenger explosion. They dug deeply into NASA's management system and practices. One of the most notable chapters in their report was entitled the “The Silent Safety Program.”8 That title came from findings that major decisions about launching were made by a team of engineers and managers with no input from a safety representative. Moreover, the placement of safety offices within the organizations was “under the supervision of the very organizations and activities whose efforts they were supposed to check.” These findings supported a recommendation to change the organization by placing the safety,

quality, and reliability functions at a higher position within NASA, where it would have more independent authority. This lesson about making the safety function independent of production management applies to many organizations, not just NASA. The more recent Space Shuttle Columbia disaster investigation also delved into management systems.9 Both NASA investigations provide lessons for other organizations regarding the need for a closed-loop process something like that described earlier in this chapter. In the nuclear power industry, much has been learned by examining multiple investigation reports. The in-depth investigations of specific incidents at nuclear power plants have provided insights into specific cases, but to maximize lessons learned for the benefit of the worldwide nuclear power industry, it helps to examine these cases to find common underlying lessons. Matthews examined multiple incidents and arrived at two important conclusions.10 The first was that a history of no accidents at a facility tends to make people complacent. The second was that safety performance requires both safety-oriented managers and safety-oriented personnel. One without the other is inadequate. These lessons from nuclear industry incidents also apply to other industries. The trend for investigations of seriously harmful incidents, particularly in the chemical industries, has been to examine the role of management systems and organizational culture. An investigation of an explosion in a French dynamite factory serves as an example.11 The investigators demonstrated that information about management systems can be obtained with modest increase in investigation resources by using an evidence collection approach focused on a list of desirable organizational dimensions. This finding might be useful to many other organizations, but unfortunately many people in the safety field will look at a report like this as being applicable to only one French dynamite factory. This narrow perspective discourages the transfer of useful information from one industry to another.

9.4.4 Other Analysis Tools System safety specialists have developed numerous techniques for analyzing past incidents. The summary descriptions in this section are for three practical techniques. The change analysis technique involves comparing two situations or event scenarios. It was originally developed for comparing an existing system with a proposal to change the system. It can also be used after a harmful incident to compare the events that occurred with the events in an ideal scenario (e.g., the standard operating procedures). As an example, the change analysis might reveal an employee was using work practices different from the standard practices used in the past. To perform this analysis, the investigators develop two sequential event charts—one for a no harm scenario and the other for the harmful incident scenario. The events are then compared directly to find differences. The barrier analysis technique helps the investigation team identify various means by which the system prevents a hazard from harming a “target” (that which we want to protect). Known as barriers, these means include physical barriers and administrative approaches. Some are no brain devices such as barriers used for machine guards and radiation shields. Others are engineered systems capable of monitoring processes, identifying when safe tolerances are exceeded, and responding in an appropriate manner, such as initiating corrective responses or communicating with employees by causing an alarm or warning light to activate. Employees perform barrier functions when they monitor processes to detect and correct deviations. Administrative barriers include work practices, checklists, and procedures. Some software programs function as barriers by not allowing operators to select options inconsistent with safe procedures. The team performing a barrier analysis looks for barriers that were in place but inadequate, barriers that should have been in place but were not, and

barriers that might be helpful if adopted in the future. The analytical tree technique helps the investigators use deductive logic to find failures and faults that contributed to the unwanted events. For example, if a fault tree has the top event matching the event being investigated, the team can work downward to examine each lower fault event. Evidence can be examined for each lower event to determine if it occurred or not. This analysis is particularly useful for eliminating some hypothesized failures from being the cause.

9.5 Method for Modeling Harmful Incidents Numerous respected experts have proposed models of the accident process, but none of these models has achieved broad acceptance. The model presented here makes use of the three Haddon phases, the concept of deviations and deviation-control mechanisms, and the flexibility of the events and causal factors charting tool. Figure 9.6 depicts a model for integrating the concepts presented in this chapter. The three rows are those of Haddon, slightly modified to model occupational incidents. These phases are labeled pre- incident operations, during incident, and post-incident responses. In the core of the graphic, activities and events are depicted according to phase. During pre-incident operations, the system operates as it should. This does not mean it operates perfectly. At various times, equipment malfunctions, people make errors, and other deviations from normal occur. Most workplace systems have informal or formal mechanisms for avoiding, detecting, and responding to deviations. These deviation-control mechanisms include various means for addressing deviations to restore normal operations. Foreseeable deviations that have the potential for causing serious harm warrant multiple control mechanisms, each capable of stopping a particular deviation from developing into a full-blown problem. Each additional independent deviation-control mechanism makes the system more resilient to the effects of that particular deviation. Figure 9.6 Generic model for a harmful incident organized by phase.

The graphic model depicts the functioning system as usually working with various deviations being

controlled. This is essentially the same starting point as the “deviation model of accidents” attributed to Kjellén.12,13 The concept is that deviations from normal operations, if uncorrected, can start an uncontrolled chain of events, possibly ending in a harmful outcome. The concepts of deviations and deviation-control mechanisms should lead incident investigators to seek an understanding of (1) the manner in which the system normally operates, (2) the initial deviations, (3) the deviation-control mechanisms that were supposed to control deviations, and (4) the reasons the mechanisms were ineffective in the incident under investigation. The next phase of the model begins once a deviation manages to get through or around all deviation-control mechanisms. Events in this during-incident phase, such as those shown in 9.2, 9.3 and 9.4, are charted in the second row of the model. Starting with an out-of-control event, subsequent intermediate events open up various possibilities for the outcome. Intermediate events can alter the end result by aggravating the harm, mitigating the harm, or avoiding harm. Some of the no harm cases will be recognized as near misses. The model in Figure 9.6 depicts a case ending as a harmful event because that is usually the reason for doing the investigation, but the charting model is equally suited for analyzing near-miss incidents. The third phase is the same as Haddon's third phase. It contains the first response events, secondary responses, and longer term events that involve rehabilitating an injured employee, returning an injured employee to work through a modified duty program, restoring the environment, repairing damaged equipment, and similar efforts to reduce the final extent of harm. Figure 9.6 may fit some incidents such as a glove, while others may not fit the model very well. Some examples of good fits are single workplace incidents resulting in traumatic injury or damage to property, a short-term contact with a chemical or blood-borne pathogen, cases of asphyxiation, and onset of heat or cold disorders. It is not suited for modeling harm that occurs over a period within a

functioning system, such as cumulative trauma disorders from highly repetitive hand activities, lung diseases that develop gradually over long periods of exposure to airborne dust, and diseases attributed to long-term exposure to low concentrations of chemicals.

Learning Exercises 1. Incident investigators have different reasons for investigating. Which reason serves as the

basis for following the closed-loop process described in Section 9.1 ? 2. Explain the role of barriers for supporting normal system operations. 3. What is the use of a written incident investigation policy? 4. Why should an incident investigation policy define precisely what incidents will be investigated? 5. Why should the post-harm response be included in an incident investigation policy? 6. An incident investigation policy can provide guidance for deciding the level of an investigation. What three factors are mentioned for inclusion in that guidance? 7. What are the three essential topics to include in the incident investigation policy regarding evidence? 8. Suppose a person was an eyewitness to an event that injured a coworker. An hour after the incident, the witness wrote a description of what she heard and saw, and then signed and dated the document. Is what she described evidence or fact? 9. Explain what an incident investigation team can learn about barriers from a prior RA of the process involved in an incident. 10. Suppose you chair an incident investigation team. After completing a report, you present it to the organization's highest managers. You get asked several questions. One manager asked if the report distribution could be limited to those with a need to know. Other managers used the expressions “sweep it under the rug” and “don't air you dirty laundry.” What reasons can you give for taking the opposite tack and widely distributing the report? 11. Regarding the example of the painter falling from a scissor lift platform (section 9.4.1), answer these questions.

a. What hazard control tactic was used to keep Joe from falling off the back of the platform?

b. Explain why this hazard control had a low chance of being effective.

c. What ergonomics principle explains why the hazard control tactic had low reliability?

12. Give two examples of lessons learned by investigators of nuclear power incidents that may be broadly applicable to other technical industries. 13. The speaker at a seminar suggested two techniques for helping supervisors improve their injury investigation reports.14 Provide a brief response for each of the two techniques.

a. Four reports from another plant of the company were obtained—two good ones and two poor ones. These were shared with the supervisors during a training session and used for discussion. How do you think that using these reports as a

basis for discussion among the supervisors could help improve the quality of supervisors' investigations and reports?

b. Adopt a standard practice of having supervisors present their reports to managers or the safety committee. How do you think that process might help improve the quality of the reports?

14. Which risk factor, severity or probability, is reduced by an effective barrier? 15. Which risk factor, severity or probability, is reduced by mitigating factors?

Technical Terms Deviation- control mechanisms

Various means for addressing deviations to restore normal operations. Engineered systems and personnel function as deviation controllers by monitoring processes, detecting deviations, and taking corrective actions. Effective deviation- control mechanisms make a system more resilient.

Deviations from normal

The difference between how an employee or business process actually performs and the performance considered normal. Generally, small deviations are tolerated or easily corrected and large deviations are more challenging.

Eyewitnesses Individuals who were in the area of the incident and who possibly saw, heard, smelled, or otherwise sensed something relevant to the incident.

Form-driven investigation

The process of collecting data on incidents as required for a report form. These are usually performed by one person who gathers the information required by the form.

Harmful incident

A sequence of events resulting in harm to a valued entity—most commonly injury to persons, damage to property, roadway crashes, fires, and contaminant releases to the environment. A near-miss incident is similar to the initial events but ends without harm.

Incident investigation policy

An organization-specific guide for investigating incidents.

In-depth investigation

The process of collecting evidence, developing the incidence sequence, analyzing it, determining causal factors, reaching conclusions, and making recommendations. In-depth investigations are usually performed by a team of people with different expertise and generally involve incidents that ended in a high-severity outcome.

Intermediate events

Events occurring during the period starting with the moment system control is lost and ending with a harmful outcome or near miss.

Mishap An unplanned event or a series of events resulting in death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment.15

References

1. Benner L, Jr. Five accident perceptions: Their implications for accident investigators. J. System Safety. 2009;45(5):17–21, 44. 2. Bahr NJ. System safety engineering and risk assessment: A practical approach. New York: Taylor & Francis; 1996. p. 191–199. 3. Hughes B. Incident investigation: Evidence preservation. Professional Safety. 2009;54(9): 55–57. 4. Oakley JS. Accident investigation techniques: Basic theories, analytical methods, applications. Des Plaines, IL: American Society of Safety Engineers; 2003. 5. Stephans RA. Systems safety for the 21st century. Hoboken, NJ: Wiley; 2004. p. 253–259. 6. Benner L, Jr. Accident investigations: Multilinear events sequencing methods. J Safety Research.

1975;7(2): 67–73. 7. Haddon W, Jr. A logical framework for categorizing highway safety phenomena and activity. J Trauma. 1972;12(3): 193–207. 8. Presidential Commission on the Space Shuttle Challenger Accident (Rogers, Commission). Report of the Presidential Commission on the Space Shuttle Challenger Accident. Report Number NTIS-64. Springfield, VA: National Technical Information Service; 1986. p. 152–162. 9. Manuele FA. Is a major accident about to occur in your operations: Lessons to learn from space shuttle challenger explosion. Professional Safety. 2004;29(5): 22–28. 10. Matthews RB. Nuclear safety: Expect the unexpected. Professional Safety. 2005;30(12): 20–27. 11. Le Coze J. Accident in a French dynamite factory: An example of an organisational investigation. Safety Science. 2009;48(1): 80–90. 12. Kjellén U. The deviation concept in occupational accident control—I: Definition and classification. Accident Analysis and Prevention. 1984;16(4): 289–306. 13. Kjellén U. Prevention of accidents through experience feedback. London: CRC; 2000. p. 36–58. 14. Moriarty B. How to develop and sustain an effective accident investigation program. Presented at the AIHce2011 Conference. May 19 2011, Portland, OR. 15. U.S. Department of Defense. February 2000. MIL-STD-882D, Definitions section. Available at www.wbdg.org/ccb/FEDMIL/std882d.pdf.

Chapter 10

Human Error Reduction

Learning from past experience is not limited to investigating harmful incidents. Another learning source comes from analyzing past human errors and violations of safety rules. This chapter presents some concepts of human error, classifications of safety-related errors and rule violations, and two approaches for finding countermeasures.

10.1 Concepts of Errors There seems to be many concepts of human error. This section introduces some of those, starting with a concept from the law of negligence. It comes up when one person sues another for allegedly acting negligently or failing to act when under a duty to act. When translated into the concept of human error, there are two categories.

1. Errors of commission—when someone makes an error while trying to perform a task, and 2. Errors of omission—when someone with a duty to act does not attempt the action.

Common errors of commission in workplaces occur when an employee tries to perform some action and fails to execute it in the proper way. Common errors of omission in workplaces occur when an

employee tries to perform a multistep task and somehow manages to skip a step. These two broad types of errors may be viewed as a starting place for developing subcategories that are more useful for understanding causes of errors and developing effective countermeasures. The system safety community approaches human errors much like it approaches part failures—they want to know the probability of human errors in particular situations, and they want to clarify factors influencing human errors. One of the underlying concepts of this approach is the recognition that humans make many errors. Most are easily identified and corrected, and others have relatively trivial consequences. One might say such common errors are within the system tolerance. Even in safety-critical domains such as aviation, modern systems are designed to tolerate most ordinary human errors. Figure 10.1 shows the concept of system tolerance in the form of two control charts, each with dashed lines depicting limits of the range of human actions the system can tolerate. Figure 10.1a shows a narrower range of acceptable conduct, with two of the data points being outside the system tolerance range. Figure 10.1b shows a system more tolerant of human variability. The same behaviors are plotted on both charts, but the system shown in Figure 10.1b tolerates all the actions. Figure 10.1 Control charts contrasting systems with (a) narrower and (b) wider tolerance for human actions.

One definition of human error is “an out-of-tolerance action within the human–machine system.”1

Consider this definition in light of the two control charts in Figure 10.1. For the same series of human actions, the system in Figure 10.1a, with the narrower tolerance range, has two errors, while the system in Figure 10.1b, with the wider tolerance range, has zero errors. Thus from this perspective, a human error is not solely defined by human behavior; it is defined by both the behavior and the system in which that behavior takes place. Literature from the system safety community provides some fundamental concepts for quantifying error probabilities. The basic variable for error rates is the human error probability (HEP), defined as the ratio of number of errors that occurred (Nerrors) to the number of opportunities for errors to occur

(Nopp). 1 When a human error is an intermediate event in a fault tree, HEP may be used when

computing the probability of an item failure. However, HEP values are imprecise because of limitations in how they are obtained and factors that can affect them. Consider the following examples of how HEP data might be obtained. First, think about a power press setup for actuation using a foot pedal. The press operator loads the part into the point of operation, pulls his hands away, and actuates the stroke using the foot pedal. One of the known errors occurs when reaching forward. The operator's center of gravity gets too far forward, causing the operator to apply pressure downward with his toes.2 If this occurs while the toes are over the pedal, the machine will stroke. In order to obtain a HEP value, one could take extended videos of a few operators performing the cycle many times. After a lengthy time reviewing the videos looking for instances of the operators starting to lose balance, an analyst could compute the HEP and use it for fault tree computations. It should be clear from the example that getting accurate HEP values can be tedious as well as difficult. A more practical approach to obtaining a HEP value for a task is to search the literature or the Internet. Two examples of the sort of HEP values one might find are (1) general error of omission for items embedded in procedure (0.001) and (2) technician “seeing” an out-of-calibration instrument as “in tolerance” (0.01).3 When searching literature, be sure to include search terms that have meanings interrelated with human error. A common term in the literature, human reliability, refers to the probability of a human correctly performing a specified task under stated conditions for a specified period. For example, to find the reliability of a roofer complying with fall protection procedures, you could ask: What is the probability that a roofer will comply with fall protection rules for a complete shift of roofing work? Efforts to find data on human error rates and reliability are further complicated if various situational circumstances are considered. The numerous factors influencing error rates and reliability are often referred to as performance influencing factors or performance-shaping factors.1,4 Those connected to the individual—internal performance-shaping factors—include factors such as experience with the task, training, attitude, motivation, and mental models. Those external to the individual—external performance-shaping factors—include factors such as workplace temperature, lighting, noise, pace of production, communications, safety climate, supervision, and fellow workers. Both types of performance-shaping factors can influence the HEP in a positive or negative way. Thus, if a fault tree analysis requires an HEP value, the analyst may be fortunate enough to find data for the average HEP of similar events. If there appear to be significant performance-shaping factors, an adjustment to the published HEP value would be appropriate. In addition to the legal and system safety concepts of human error mentioned above, there are several others. A concept proposed in a book by James Reason focused on making systems more tolerant of variations in human actions.5 He characterized operational systems as having multiple barrier-like defenses for preventing faults and errors from disrupting normal system operation. Each defensive mechanism can effectively stop some, but not all, types of errors from propagating. Defenses include organizational factors, supervisory factors, preconditions for unsafe acts, and unsafe acts. The defenses are depicted in a graphic as slices of Swiss cheese aligned in order. The idea is that a fault or error needs to find a straight path through all slices in order to seriously disrupt the system. A fault or human error may lead to events that get through a hole in one slice but get stopped by the next slice. If there are several independent slices, each with a few holes, the likelihood of a hole in the first slice being aligned with a hole in the second slice is small, but not zero. Having a third slice in the array further reduces the probability of holes being aligned in all three slices. In Chapter

8, this concept was explained in terms of probability. If three successive slices have holes constituting 5%, 8%, and 10% of their respective area, and the holes are independently located, the probability of an open path through all three slices is P(all) = 0.05 × 0.08 × 0.10 = 0.0004. Investigating errors using the Swiss cheese model involves identifying the defenses and looking for the holes in each. That sort of analysis can lead to a deeper understanding of the pathway to the incident and help identify ways to, in essence, reduce the size and number of holes in each slice. This Swiss cheese model is widely recognized and respected. A well-published author on human error, Sidney Dekker, distinguished two views of error.6,7 The older view regards the people who commit error as the problem, while the newer view regards the organization/system as the problem.6,7 The newer view opens many doors for organizational improvements that can reduce the probability of human error, increase the system tolerance for human error, or both. Leading authors on the subject of human error share many of the same concepts. One is that a classification system for types of human errors is essential because different types of errors require different error-reduction strategies. Another area of agreement is the importance of understanding the background factors affecting errors. A well-researched, multidisciplinary approach to classification is explained in the next section.

10.2 Comprehensive Classification System Several attempts to classify human errors were examined by Wiegmann and Shappell.8,9 After analyzing relevant theories from experts with diverse disciplinary backgrounds, they determined that the classification system needs to include both errors and rule violations. The umbrella term they chose for these, unsafe acts, indicates that the classification system applies to only acts relevant to safety. Their system is presented in Figure 10.2 and summarized in this section. Figure 10.2 Taxonomy of unsafe/inappropriate acts as per Wiegmann and Shappell.

The left column of Figure 10.2 identifies two major groups of unsafe acts—human errors and

violations. Within the first major group—errors—are three types identified in the mid-major category. Decision errors may be thought of as thinking errors. A person may plan a course of action

that is inappropriate for the situation, misinterpret available information, make a poor choice based on an incorrect assumption, or choose a less safe option when a safer alternative is available. Skill- based errors involve a person performing a familiar task she is skilled at doing, but on a particular occasion, she does it incorrectly. Some examples of skill-based errors are having a lapse of attention, forgetting something, omitting a step in a procedure, or incorrectly executing an intended action. Perceptual errors involve a failure of the senses (i.e., hearing, seeing, smelling) to capture some sort of signal, or sensory inputs being misprocessed by the brain. Many of these errors in the first major group are part of the everyday lives of people. Within the second major group—violations—are two different types identified in the mid-major category. The first type is the routine violation of safety relevant rules. In workplaces, it is not uncommon to find that personnel routinely perform a task without following company rules or standard procedures. This sort of regular behavior exemplifies a willful or habitual violation. The second mid-major type of violation involves a normally safety compliant employee performing an out-of-character act not condoned by management. A deeper investigation of such a violation may reveal underlying reasons. In the case of a willful violation, the person may have thought his approach was equivalent to or better than the standard procedure; in the case of a routine violation, the person may have been working in his habitual manner without thinking about any applicable rule. In other words, the individuals who committed these errors may have been qualified and conscientious employees who thought they were doing their assigned work safely and effectively. Classifying an error or violation begins a process aimed at understanding the underlying factors and conditions leading to the unsafe act. Building on the prior work of Reason, Wiegmann and Shappell developed taxonomies for each of three background factors: (1) preconditions for unsafe acts, (2) unsafe leadership, and (3) organizational influences.8,9 They named the entire set of taxonomies, together with detailed explanations of each, the human factors analysis and classification system (HFACS). An exemplary analysis of historical cases applied the HFACS to more than 500 mining accident reports from Queensland, Australia.10 One outgrowth of that project was the addition of a fourth background factor, outside influences, which in the domain of mining is the influence of regulation. The same paper presents the HFACS modified for the mining industry. This modified version appears much better suited for OSH applications than the original version. Figure 10.3 depicts the concept that four types of background factors influence errors or violations. Figure 10.3 Depiction of four sets of background factors that influence errors and violations according to Patterson and Shappell.10

The process of finding countermeasures starts with classifying a particular error or violation into

an appropriate subcategory (Figure 10.2) and then identifying the background factors relevant to the error or violation addressed. The effort put into this leads to a better understanding of the underlying or root causes of the error, and this understanding will help identify appropriate countermeasures.

10.3 Methods for Finding Countermeasures Methods for finding suitable countermeasures for unsafe acts depend on how the problem is approached. The proactive approach involves anticipating future unsafe acts, while the reactive approach involves looking for ways to correct a historical problem with unsafe acts. The proactive approach involves anticipating unsafe acts employees might make while performing a task. A systematic method makes use of a worksheet similar to the JHA form. Figure 10.4 shows a format suitable for recording the information. Column 1 of the worksheet is for listing steps in the task, just as was done on a JHA form. Columns to the right are for entering foreseeable unsafe acts, the initial/immediate consequence, any recovery opportunities, and tactics for reducing the probability or consequence of the act. Readers should recognize that after identifying a foreseeable unsafe act, the analysis process is a bottom-up, inductive approach similar to that used in an FMEA, except that the starting point is an unsafe act instead of a part failure. The “tactic” column is useful for noting existing methods for mitigating the effects as well as new tactics that might improve the situation. Figure 10.4 Worksheet for proactively analyzing foreseeable unsafe acts.

The reactive approach is used to address a historical problem with unsafe acts—perhaps a problem

was revealed because several different individuals performing the same task made the same mistake multiple times. Examples might include roofers failing to tie off, or mine equipment operators occasionally parking their equipment improperly. In such situations, organizations should look for opportunities to change system attributes either to improve system tolerance or to change factors that contribute to unsafe acts. An approach for finding appropriate countermeasures (used by Wiegmann and Shappell) uses small groups.11 After classifying the unsafe act according to the HFACS taxonomies shown in Figure 10.2, the group considers each unsafe act in terms of five elements: the human, technology, environment, task, and organization.8–10 Then the group identifies ideas for countermeasures. Finally, the group examines each potential countermeasure for feasibility, acceptability, cost, effectiveness, and sustainability. Both proactive and reactive methods provide a structured approach for identifying countermeasures. Any success resulting from the effort depends on the problem-solving skills and creativity of the participants.

Learning Exercises 1. Briefly explain the difference between errors of commission and omission.

2. Explain the relationship between human error and system tolerance. 3. Distinguish between the labels “performance-shaping factors” and “performance influencing factors.” Which do you think best fits the underlying concept? 4. Explain external performance-shaping factors. 5. Explain internal performance-shaping factors. 6. What are the variables in the HEP ratio? 7. What specific group in the right column of Figure 10.2 fits the following scenario? A truck driver drove through an intersection while the light was red. When interviewed later, he said he was driving toward the sun and could not tell the light was red. 8. What specific group in the right column of Figure 10.2 fits the following scenario? An employee tripped on a floor mat and fell. When interviewed, she said her mind was on something other than walking when she suddenly tripped. 9. What specific group in the right column of Figure 10.2 fits the following scenario? A clerical worker had a box full of files that needed moving to another office. She knew it was quite heavy, so she looked around for a suitable cart. She could not find a cart, and she wanted to get the job completed before lunch, so she decided to lift and carry the box herself. In the process, she injured her lower back. 10. Develop an ability to use the worksheet in Figure 10.4 by considering the following scenario from the 1992 Summer Olympics in Barcelona. Based on a description by Steven Casey, relevant background and events were as follows.12 In the synchronized swimming competition, part of the individual performance events is the compulsory routine in which four elements are prescribed. Competitors perform the four compulsory routines. Judges are chosen from a pool of qualified judges who come from countries with no competitors in the event. Judge Lobo, a Brazilian, was one of the judges. Judges start with a score of 10 and make deductions for various weaknesses in the performance. At the end of each routine, judges entered their score using a keypad similar to a telephone keypad with 0–9 digits plus a 10 key and a 1/2 key. After each routine, their scores were entered, and the computer determined the average score used as the final performance measure. In 1992, the favorite was a Canadian named Sylvie Frechétte. She performed extremely well. Judge Lobo rated the performance a 9.7, but her fingers punched 8.7 on the keypad. She soon saw the score on the large scoreboard and realized her error. She tried unsuccessfully to change it using the keypad at her station. She called a referee for assistance. The referee from Japan and Judge Lobo had difficulty communicating in English. They called the head referee, an American. After a few minutes checking the rulebook, she ruled that a change in the score was not allowed. As a result, Sylvie Frechétte finished second and an American won the gold medal. For good reason, the Canadians were in an uproar about the ruling and were especially mad at the American official. Table 10.1 shows a partial worksheet for analyzing foreseeable errors. The entries for columns 1 and 2 are given. Understand that the worksheet is for future planning and not for documenting the actual events in the 1992 Olympics. Compose the words that you would enter in third, fourth, and fifth columns of each row.

Table 10.1 Columns 1 and 2 of a Worksheet for Analyzing Potential Judging Errors. Task/step Error

1. Observe entire routine 1.1. Fail to pay attention to all elements of routine 2. Decide on score 2.1. Choose score inconsistent with scoring rules 2. Decide on score 2.2. Misperceive an element of routine 2. Decide on score 2.3. Misjudge an element of routine 2. Decide on score 2.4. Normally fair judge allows nationality to influence score 3. Enter score by keypad 3.1. Punch wrong key

Technical Terms Human error probability (HEP)

The likelihood of a person performing a particular action erroneously.

Human reliability

The probability that a person can correctly perform a specified task under stated conditions for a specified period.

Performance- shaping factors

The various factors that influence the probability of human error and reliability of human performance. Internal factors are influences connected to the individual. External factors are influences outside the individual.

System tolerance

The range of actions a system can accommodate while maintaining normal function. Examples of a system not functioning normally include interruption of production, human injuries, product damage, and property damage.

Unsafe acts Safety relevant human errors and violations of company rules.

References

1. Bahr NJ. System safety engineering and risk assessment: A practical approach. New York: Taylor & Francis; 1996. p. 151–161. 2. Trump TR and Etherton JR., Foreseeable errors in the use of foot controls on industrial machines. Applied Ergonomics. 1985; 16(2): 103–111. 3. Stephans RA. System safety for the 21st century. Hoboken, NJ: Wiley; 2004. p. 138. 4. Kim JW, Jung W. A taxonomy of performance influencing factors for human reliability analysis of emergency tasks. J Loss Prevention Process Industries. 2003; 16: 479–495. 5. Reason J. Human error. Cambridge: Cambridge University Press; 1990. 6. Dekker S. The field guide to understanding human error. Aldershot, UK: Ashgate; 2006. 7. Dekker S. Reconstructing human contributions to accidents: The new view on error and performance. J Safety Research. 2002; 33: 371–385. 8. Shappell SA, Wiegmann DA. The human factors analysis and classification system–HFACS (DOT/FAA/AM-00/7) Washington, DC: U.S. Federal Aviation Administration; 2000. Available through the National Technical Information Service, Springfield, VA. 9. Wiegmann DA, Shappell SA. A human error approach to aviation accident analysis: The human factors analysis and classification system. Burlington, VT: Ashgate; 2003. 10. Patterson JM, Shappell SA. Operator error and system deficiencies: Analysis of 508 mining incidents and accidents from Queensland, Australia using HFACS. Accident Analysis Prevention. 2010; 42: 1379–1385. 11. Shappell SA, Wiegmann DA.Workshop 12: Managing human error in complex systems. Human Factors and Ergonomics Society 52nd Annual Meeting; September 22, 2008.

12. Casey S. The atomic chef and other true tales of design, technology, and human error. Santa Barbara, CA: Aegean; 2006. p. 54–62.

Chapter 11

Risk-Reduction Strategies

11.1 Conceptualizing “Strategies” This chapter addresses strategic thinking about risk reduction. In contrast to thinking about specific hazards, or about rules, regulations, and standards, the idea of thinking strategically involves stepping back and looking for broader principles applicable to all occupational hazards.

11.1.1 Terminology Organizations typically function by establishing broad goals and measurable objectives. Strategies for achieving objectives are general approaches, and tactics are more specific means for implementing strategies. Figure 11.1 depicts the relationships among goals, objectives, strategies, and tactics. Figure 11.1 Relationships among goals, objectives, strategies, and tactics.

For an OSH department, an objective might be to reduce risk in a particular operation, task, or

business unit, with measurement of risk based on risk assessments performed before and after making changes. For such an objective, a risk-reduction strategy would be a general approach for reducing risk, and a risk-reduction tactic would be a more specific means for implementing the risk- reduction strategy. The terms strategies and tactics also have some usage in the domain of mathematical problem solving. An insightful book by Professor Zeitz at the University of San Francisco teaches problem solving using a top-down approach starting with a strategy, then a tactic, and finally with various tools of mathematics.1 This approach differs from that found in typical mathematics textbooks that explain the tools and give students problem sets at the end of each chapter. With these traditional textbooks, students are expected to find—through some unspecified process—solutions to the problems. What usually happens in a class is that some students seem to “get it” and successfully solve most problems, while other students become discouraged because they cannot seem to find

these unspecified paths for problem solving. Professor Zeitz developed the top-down approach to help all students discover this general path to problem solving. A similar approach is advocated in this book, even though the “problems” differ from those encountered in mathematics. In OSH, the “problems” are the potential hazards identified by one or more of the proactive hazard analysis methods discussed in previous chapters. After identifying potential hazards, how can we decide what approach will best fit our particular problem within the context of the constraints and policies of our organization? By thinking of these issues as problems that need to be solved, we can trace a path to the solution from strategies to tactics to the tools for implementation. An example of this way of thinking in the public health domain comes from the pioneering work of Dr. Haddon. While working on the public health problem of roadway injuries and fatalities, he determined that legislators and the general public had very limited vision for possible solutions. In his communications, Dr. Haddon chose the word strategy for his landmark public health papers on controlling hazards. For his 1973 paper in the Journal of Trauma, he chose the title “Energy Damage and the 10 Countermeasure Strategies.”2 In a later paper published in the journal Hazard Prevention in 1980, he again used strategies in the title “The Basic Strategies for Reducing Damage from Hazards of All Kinds.”3 In these papers, and others, he emphasized the value of finding solutions to injury problems by following a logical path from strategies to tactics to the tools for implementation. Dr. Haddon's pioneering ideas and papers remain the primary source of public health theory for injury control. Thus, the words strategies and tactics are used in this book to sustain the theoretical model started by Dr. Haddon and to encourage professionals in the OSH community to think broadly and logically about the various potential solutions to occupational hazards.

11.1.2 Adapting the Original Strategies In addition to the 10 strategies proposed by Haddon, other respected authors have proposed alternatives strategy lists. An influential paper by Johnson in 1975 contained a list of 12 strategies for controlling energy hazards.4 Both Johnson and Haddon founded their lists on the premise that all injuries result from the transfer of energy from an energy source to that which is harmed, be it a person, animal, environment, or property. Subsequent authors proposed lists encompassing more than energy hazards.5,6 Building on the work of these prior authors, the best ideas were consolidated into nine risk-reduction strategies.7 Subsequent modifications led to the following list.

1. Eliminate the hazard. 2. Moderate the hazard 3. Avoid releasing the hazard. 4. Modify release of the hazard. 5. Separate the hazard from that needing protection. 6. Improve the resistance of that needing protection. 7. Help people perform safely. 8. Use personal protective equipment (PPE). 9. Expedite recovery.

The above list applies to energy sources and other hazard sources encountered in occupational settings. Efforts in each phase contribute to reducing overall risk by reducing the probability of the harmful event occurring or the extent of damage resulting from the incident. Table 11.1 illustrates

how the strategies align with Haddon phases using common practices for entering a confined space. Table 11.1 Practices for Confined Space Entries Arranged by Haddon's Phases. Phase Confined space practice Strategy Pre- event

Lock out any potential pathways for hazards to gain entry Avoid releasing the hazard

Use checklist to assure the entering person has donned appropriate PPE, rescue equipment is operational, and communications devices are working

Use PPE and help people perform safely

Station a person outside the space to (1) monitor the person inside in case rescue becomes necessary, (2) ensure rescue equipment remains operational, and (3) assist entrant with egress

Help people perform safely

During- event

Extract entrant due to an unusual threatening occurrence Separate the person from the hazard in the confined space

Post- event

Provide first aid and transport to suitable medical facility Expedite recovery

Some readers may think that working toward a classification of risk-reduction strategies is a waste of time. In response, OSH professionals might do well to recognize that classification systems are a foundation of each major branch of science—physics, chemistry, biology, and geology.8 While each field has a history of scientific classification (also known as taxonomy), the one developed for classifying biological species is most well known to the general public. Carl Linnaeus developed and published a taxonomy for all living things, now known as the Linnaean classification system.9 At the time of his publication (1735), his taxonomy may have seemed as a waste of time to many people. Even Linnaeus may not have foreseen the long-lasting effects of his pioneering work. Since the original publication, biological scientists have made many additions and other modifications due to discoveries of previously unknown forms of life. The prolonged and focused effort biologists have made toward a comprehensive and updated classification system underscores the value of scientific fields having sound classification systems. Each of the other scientific fields has an analogous history of developing classification systems for the major aspects of their field. Dr. Haddon wrote about the importance of having scientific classification systems for the emerging field of injury control. He advocated approaching the highway injury and fatality problem by using methods already established in the recognized fields of science. In particular, Haddon advocated for classification systems for both the etiology (causes) of highway crashes and the countermeasure strategies for reducing risk.10 This second classification system is discussed next.

11.2 The Nine Strategies This section explains the nine strategies for risk reduction. Some explanations include a list of common tactical approaches. While this section mentions a few specific applications of the tactics, the Learning Exercises contain questions designed to help readers appreciate the connection between strategies, tactics, and common workplace applications.

11.2.1 Eliminate the Hazard After identifying a hazard, the first control option to consider is the possibility of eliminating the hazard from the system. This is highly desirable because eliminating the hazard is a 100% reliable solution for avoiding harm from that hazard. Tactics for this strategy are the following:

Avoid creating the hazard in the first place, and

Remove an existing hazard.

11.2.2 Moderate the Hazard Often a hazard can be modified to reduce the harm it might cause. This strategy has no effect on the probability of a harmful event occurring. Instead, it moderates the hazard so less harm is caused when the harmful event occurs. The strategy may involve several tactics for reducing the potential harm such as the following:

Reduce the energy level to no more than what is needed for functionality, Reduce the intensity of energy transfer, Reduce the concentration of a hazardous air contaminant, and Substitute a less hazardous material for a more hazardous material.

11.2.3 Avoid Releasing the Hazard A common strategy in occupational settings is to control a known hazard by preventing it from escaping from an enclosure or location. Similarly, we can avoid starting a fire or explosion by preventing the coexistence of a fuel, an oxidizing agent, and an ignition source. Risk-reduction tactics that avoid releasing a hazard are the following:

Enclose potentially hazardous materials within appropriate containers, Contain electrical energy within insulated circuits, Enclose sources of radiation within appropriate shields, Lockout and tagout potential sources of energy or materials, and Avoid the coexistence of fuels, oxygen, and an ignition source.

11.2.4 Modify Release of the Hazard This strategy applies to hazards that might be harmful if released from a controlled location. Engineering approaches implemented prior to a release can provide mechanisms for controlling the manner of release to minimize any harm that might result. The tactics are the following:

Control the rate of release, Control the location of the release, and Stop the released hazard to avoid further harm.

This strategy does not include PPE, such as hard hats, impact resistant glasses, and footwear with toe protection. Their use does not modify the release of the hazard, so this sort of PPE does not fit well

into Strategy 4. Impact protective PPE is a last line of defense from a previously released hazard, such as a falling object or a small projectile. In this list of nine strategies, the use of impact protective PPE fits in Strategy 7, which is specifically for the use of PPE.

11.2.5 Separate the Hazard From That Needing Protection Hazards with known locations may be controlled by designs that ensure separation of the hazard source from the persons, animals, environment, or property needing protection. The tactics of this strategy are the following:

Separate by distance, Separate by locations, and Separate by a barrier.

When the focus is people protection, separation by distance involves designing operations so that personnel are located a safe distance from the hazard. It also applies to facility layouts that put hazardous operations a safe distance from buildings occupied by numerous people. Separation by location involves locating a hazard where people are not exposed. Separation by barriers involves placing between a hazard source and people something that will prevent harm, such a fence, barrier, shield, or guard.

11.2.6 Improve the Resistance of That Needing Protection Several opportunities exist for improving the ability of things to resist hazards. Consider a laptop computer. If you drop an ordinary laptop from a meter onto a hard floor, it has a good chance of being damaged. What if you drop a “ruggedized computer” made for military use in hostile environments? It should easily take a 1 m drop without sustaining damage. The difference is that one computer is more resistant to impact than the other. This same concept is captured in Strategy 6. Some common tactics for improving resistance include improving the ability of

Equipment and tools to withstand impacts and vibrations, Electronic devices to withstand power surges, Structures to survive severe weather events, Buildings to resist fire, Materials to withstand rusting and corrosion, Product containers to withstand rough handling during the distribution processes, and Humans to resist a disease through vaccination.

11.2.7 Help People Perform Safely Reducing risks in occupational setting depends heavily on the employees. In the field of human factors, the term facilitators refers to the many ways of designing systems to help personnel correctly perform their tasks.11 The common tactics for Strategy 7 are listed below.

Design human–machine interfaces to minimize errors and maximize correct performance.12 Provide warnings to notify and remind people of hazards, as well as to communicate appropriate precautions. Design work to match task demands with the capabilities and limitations of the workers. Provide personnel with excellent task training and safety-related training. Design work so that the convenient method is also the safest method. Design equipment and work demands to tolerate foreseeable human errors. Help employees prepare their bodies for the stresses faced on the job. Conduct operations in a manner that minimizes likelihood of workplace violence.

11.2.8 Use Personal Protective Equipment The use of PPE provides personnel a means of moderating the extent of harm from hazards not otherwise controlled. As such, PPE is regarded as the last line of defense. PPE usage shows up frequently in JHAs and risk-assessment tables. Recall that when using a risk-assessment approach, hazards are listed in a column, usually the left one. To the right are columns for probability of a particular event, the severity of the associated harm, and a risk index of some sort. Further to the right is a column for risk-reduction tactics. A typical application of PPE in an RA would be to first list in a row of the table a risk-reduction tactic aimed at controlling the hazard, and then on a lower row enter the use of PPE to provide a last line of defense. Keep in mind that the PPE strategy is not for changing the probability of an event or exposure; it is for reducing the severity. Common tactics for PPE are the following:

Protect body parts from impacts from objects, Protect body parts from repeated pressure by damping and distributing forces, Greatly reduce the concentrations of air contaminants in breathing air, and Provide a barrier to protect skin and eyes from contact with hazardous chemicals.

11.2.9 Expedite Recovery This strategy corresponds to the post-event phase of harmful events and exposures. Although preparations for a response occur during the pre-event phase, the implementation takes place in the post-event phase. There are many ways to prepare for potentially harmful events in the workplace. At the basic level, employers provide first aid kits at the worksite, as well as personnel with at least basic training for administering first aid. Employers with operations having potential to spill hazardous materials on soil or into a body of water know the importance of advance preparation for quick response in case a spill occurs. Advanced preparation is a key elements in all of the following Strategy 9 tactics:

Administer effective first aid,

Expedite transit of injured employees to emergency facilities, Refer employees with possible occupational diseases to appropriate medical providers, Respond promptly and effectively to hazardous material releases, and Implement steps in a business continuity plan.

11.3 Priority for Applying Strategies This section explains how and in what order to consider the strategies within the context of risk assessment and a design team project. Recall that the team starts by identifying all foreseeable hazards and harmful incidents that might occur without any risk-reduction tactics in place. After listing them in a spreadsheet or table, the team estimates the probability of each incident and the severity expected, and using a risk-assessment matrix assigns a risk level. Once the risks are classified, the design team begins to explore options for reducing each risk. The list of risk-reduction strategies may be useful in two ways. First, it may help the design team generate control options. Second, it should help structure their search for options by considering the strategies by order of priority. Figure 11.2 shows an order for considering the various strategies. If a team chooses to use this scheme, its first consideration would be eliminating the hazard. If this is not feasible, the second priority options, engineering controls, would be considered. These strategies lead to solutions that have high reliability when properly designed, installed, and maintained. In contrast, the third priority strategies, administrative practices, are less reliable because of their heavy dependence on human effort and behavior. Figure 11.2 Strategies arranged into three priorities.

A couple more points regarding priorities and strategies warrant clarification. First, selecting a

particular strategy from the second group does not preclude also selecting others from the second or third group. Selecting an engineering control and one or more administrative controls is a common approach. The other point of clarification concerns the Strategy 6 approach of making things more resistant to harm. Most applications of this strategy are permanent modifications to physical things. An application to humans would be an immunization that lasts a lifetime. Attempts to make employees more resistant to musculoskeletal stressors, such as a stretching program at the beginning of a shift, fit better in Strategy 7—help people perform safely. These types of efforts also belong to priority III

because of their dependence on regular human effort.

Learning Exercises The intent of these Learning Exercises is to provide readers an opportunity to bridge the gap between general strategies and specific applications (see section 11.3). Each numbered item in these Learning Exercises corresponds to the strategy in section 11.2 with the same number. Many of the exercises involve practices widely recognized throughout the OSH community. For each specific scenario, readers are asked to provide only one solution using the applicable strategy. A complete solution for many of the scenarios would require more than one tactic.

1. Perform exercises a–c below using Strategy 1—eliminate the hazard. a. A nursing assistant manually lifts a patient into a bathtub because the patient is unable to support his own weight or assist in the transfer. The nursing assistant has been complaining of frequent backaches. As an ergonomics consultant, what solution do you suggest?

b. In a fish canning facility, diesel powered forklifts are used for much of the transport. In the past 5 years, there have been two instances of the building ventilation system shutting down. In both instances, the carbon monoxide levels in some locations rose to twice the limit recommended (e.g., threshold limit value). The company facilities engineers say they cannot achieve 100% reliability with the ventilation system. As the company's industrial hygiene consultant, what solution do you suggest?

c. A company involved in the transportation of refined petroleum has a facility where railroad tank cars are filled with product stored in large tanks. To complete the filling operation, a worker must climb on top of the tank car in order to access the infill ports. The company's present approach to fall protection is that it has a cover over the location and a rail with a short lifeline hanging down. The worker is required to wear a fall protection harness and hook up his or her lanyard to the lifeline when atop the tank car. This takes time, and sometimes a worker will fail to hook up, so it is not a perfect system. As the company's safety engineer, what solution can you suggest?

2. Perform exercises a–c below using Strategy 2—moderate the hazard.

a. An older industrial building has a fire extinguishing system equipped with Halon extinguishing agent. The company is making an effort to brand itself as an environment-friendly company. Halon is recognized as being detrimental to the earth's ozone layer, but the facility needs a fire protection system. As an environmental engineer, what solution do you suggest?

b. In a shop, there is a pathway for visitors marked by yellow lines. Some high school students were taking an escorted tour of the shop when one of them walked slightly out of the path and bumped the sharp edge of a metal table. The student tore his shirt and lacerated his abdomen. There was a lot of concern about the

wound becoming infected and the possibility of legal action. The facility manager wants to continue allowing escorted tours through the shop. As a safety engineer, what do you suggest to moderate the sharp edge hazard?

c. Heat from a furnace in a foundry keeps a room warm during the winter. However, during the summer, the combination of furnace heat and warm humid external air in the room can become difficult for workers to tolerate. There have been instances of heat exhaustion and the occupational health physician is concerned about a future case of heat stroke. What solution do you suggest?

3. Perform exercises a–c below using Strategy 3—avoid releasing the hazard.

a. A room within a petrochemical facility contains various piping for flammable materials. You recognize the possibility of leaks that would raise the concentration of flammable vapors in the room. If the vapor concentration rises to the flammable range, it is vulnerable to ignition. Workers in the room use various steel tools and you are concerned about a spark being created by these tools because it might ignite the flammable vapor and cause considerable harm to the employees, facility, equipment, and overall operation. As a safety engineer, what do you suggest for avoiding this harmful outcome?

b. A construction company has laborers working in a trench 2 m deep. A safety engineer sees this and expresses grave concern about the possibility of the dirt walls collapsing on the laborers. She explains to the foreman that ground pressure from the sides of the trench push on the dirt laterally as if trying to fill up the opening. If you were the safety engineer, what would you recommend to avoid collapse of the dirt wall?

c. A graduate student in chemistry wants to study certain mixtures of chemicals. One of the chemicals emits hazardous gases when exposed to air. The student proposes to conduct the experiments in a general-purpose laboratory room in the campus chemistry building. As the campus safety and health officers, what do you require to avoid releasing the hazardous gas into the room?

4. Perform exercises a–c below using Strategy 4—modify release of the hazard.

a. A chemical processing facility is planning an addition. One major component is a chemical mixing vessel for an exothermic reaction. The chemical engineers recognize what they call a “remote” possibility of a system variation that would lead to a dangerous rise in pressure if the following were to occur. First, the internal pressure rises about the capacity of the vessel. Second, the seams in the vessel walls will be challenged. Third, the weakest seam will fail and allow some gas to escape. Fourth, the escaping gas will rapidly open the seam and external air will be contaminated. Workers in the area would thus be adversely affected. The company will be liable for air pollution fines and the damage caused. What do you suggest for designing the vessel to avoid these outcomes?

b. A replacement building is being designed for a facility that makes cardboard.

This facility will be replacing a similar building that was destroyed by an explosion. Inside the building, one stage in the cardboard making process creates a highly explosive mixture of air and small particles. Although numerous engineering controls are being planned to prevent this from recurring, engineers admit to a remote possibility of a major explosion existing even with their designed controls. When talking to the architects, you explain how the previous building was destroyed when the rapidly expanding gases from the explosion knocked down the walls and blew the roof straight off. What do you suggest to the architects so that the next explosion does not destroy the walls and roof of the building?

c. A building renovation project is being planned. One foreseeable hazard is electrical energy from using power tools. The project engineer tells you of the intent to use building outlets with three prongs (hot, neutral, and grounding wires) for all power tools, and they will need to use extension cords. A safety engineer reviewed the project and tells the project engineer that having a power tool grounded is not enough to protect the tool user in case of a short in the tool housing. This is because the worker will experience severe current exposure before the circuit breaker opens and stops current flow. What do you recommend for ensuring the current flow will be stopped quickly enough to protect the worker from a lethal shock?

5. Perform exercises a–c below using Strategy 5—separate the hazard from that needing protection.

a. A positive clutch mechanical power press is used for processing various items, so it needs frequent changes in setup. The principal hazard is the point of operation where the upper die strikes the lower die to create the desired output. Two company employees have had fingers amputated on the machine during the past 10 years. The company safety director, who actually works half-time on safety and half in human resources, seeks the advice of a safety engineer. What can the safety engineer recommend for assuring the operator's hands are at a safe distance from the point of operation?

b. A conveyor belt is being planned for moving coal dust from a mine to a nearby power plant. The safety engineer on the design team pointed out the hazard of in- running nip points. An employee representative on the design team asked fellow workers about their safety-related concerns. Several were concerned about getting clothing or body parts caught in the nip point on one end of the conveyor. It seems the walkway leading to the restrooms passes dangerously close to the end of the conveyor, and sometimes they are in a hurry. How might the new conveyor be located so that only qualified maintenance personnel will be able to get near the nip point?

c. A new casino is being planned. Among the various potential hazards identified in the risk assessment is the possibility of an armed robbery. The main concern is that cashiers may be threatened with a gun. What do you suggest for building

suitable protection for the cashiers from the hazard of armed robbery?

6. Perform exercises a–c below using Strategy 6—improve the resistance of that needing protection.

a. A governmental agency wants to build a new office in a location prone to earthquakes. If you were asked for advice, what can you suggest for improving the resistance of the building to damage from an earthquake?

b. Administrators of a hospital want to protect their staff from possible infection with hepatitis B. A vaccine is available. How is a vaccination program an example of Strategy 6?

c. A forest not far outside a city is filled with dead tree materials and considerable undergrowth. Experts on forest fires describe the forest as being a tinderbox (i.e., it that will burn rapidly if a fire should start during hot weather). The vast majority of city residents want to avoid having their forest burned. What option can you suggest for improving the resistance of the forest to fires?

7. Perform exercises a–e below using Strategy 7—help people perform safely.

a. The shop in an industrial facility has four pedestal rotary grinders. Each uses a different grinding wheel. The shop foreman is concerned that occasionally a worker might make a mistake and put a grinding wheel of the wrong size on a grinder. That can results in a rotation rate exceeding the capability of the grinding wheel. History shows numerous instances of a grinding wheel breaking up in an explosive fashion and projecting particles into the face of the operator. What solution do you suggest for helping personnel select and install the correct grinding wheel?

b. An assembly workstation has a fixed height of 72 cm. Four workers work in that station during the various shifts spread throughout the month. One of the best workers happens to be the tallest. He has been complaining about bothersome pain in his upper back from spending so much time with his head tilted down and his torso leaning forward. The company medical director considers these complaints as early indicators of a developing upper back disorder. As the company ergonomist, what do you suggest to help this worker avoid an upper back disorder?

c. A large haul truck transports ore within a mine. When backing up, the driver can use the mirrors on each side of the cab, but still has a large blind space behind the truck. What might a safety engineer recommend to help both driver and pedestrians avoid a backing over fatality?

d. A room in a large government facility has an automatic fire protection system. If activated, it quickly fills the room with an extinguishing agent that will snuff out a fire. However, if a person is in the room, this is a serious threat because the new atmosphere is unfit for human breathing. The installation company recognized

this threat and built the system, so a buzzer sounds for 60 s before the extinguishing agent is released. The buzzer was intended to convey the message to promptly exit the room and shut the door. A fault tree used to analyze the top event of an employee being in the room when the extinguishing agent is released revealed a weakness. What if personnel in the room hear the buzzer but fail to understand the intended message? What solution can you suggest for correcting this vulnerability in the system?

e. A diamond mine deep in the earth requires miners to work long hours in intense heat. Owing to a history of heat strokes, the mine wants to institute a program to prepare the new hires before sending them into the hottest areas of the mine. If you were asked for suggestions, what would you suggest and how does that relate to Strategy 6?

8. Perform exercises a–c below using Strategy 8—use personal protective equipment.

a. At a building construction site, personnel working on the lower floors might be injured by an object falling from higher floors. What do you recommend for those on the lower floors?

b. A company cleaning up an old chemical plant is concerned about its employees who initially encounter unknown chemicals. What do you recommend for protecting these individuals from breathing hazardous air contaminants?

c. A small company specializing in carpet installation received complaints from employees about knee pain. They use a tool known as a “knee kicker” to force the carpet tightly against the walls. These tools have one end with sharp teeth-like protrusions for gripping the carpet edge and the other end has a pad that the carpet installer kicks with his knee to force the carpet against the wall. What do you recommend for these carpet installers?

9. Perform exercises a–c below using Strategy 9—expedite recovery.

a. A farm located in a hot climate requires many field workers. The owner is aware of the risk of an employee developing a heat stroke that, if not cared for promptly, could cause the employee to die or suffer permanent brain damage. What can you suggest to ensure that an employee suffering from a heat stroke is cared for promptly?

b. A trucking company transports liquid pesticide from a manufacturing facility to regional distribution points. On the basis of the prior experiences of other trucking companies, the owners are aware that a truck can tip over under some circumstances and spill pesticide onto the roadway, road edges, and water adjacent to the roadway. The company would be fully liable for any environmental damage. What can you suggest the owners do?

c. A construction company is planning to bid on a bridge construction project in a rural location. The safety director knows from past projects in rural sites that

medical care is often delayed by the admission practices at local medical facilities. Injured employees have been known to wait as long as an hour to see a doctor. What can you suggest the safety director do to overcome this slow access to medical care?

Technical Terms Administrative controls

Risk-reduction tactics dependent on human behavior and effort, making administrative controls less reliable than engineering controls.

Engineering controls

Risk-reduction tactics designed and built into a system to control a hazard with minimal dependence on human action. Engineering controls are considered more permanent and reliable than administrative controls.

Facilitators Engineering and administrative practices aimed at helping personnel perform tasks safely and correctly. Risk-reduction strategy

A general approach for reducing the risk associated with a hazard.

Risk-reduction tactic

A specific means for implementing a risk-reduction strategy.

Strategies General approachs for achieving an objective. Tactics Means or methods for implementing a strategy.

References

1. Zeitz P. The art and craft of problem solving, 2nd ed, Chapter 1. Hoboken, NJ: Wiley; 2007. 2. Haddon W, Jr., Energy damage and the 10 countermeasure strategies. J Trauma. 1973; 13(4): 321– 331. 3. Haddon W, Jr., The basic strategies for reducing damage from hazards of all kinds. Hazard Prevention. 1980; 16(5): 8–12. 4. Johnson WG. The management oversight and risk tree. J Safety Research. 1975; 7(1): 4–15. 5. Asfahl CR, Rieske DW. Industrial safety and health management, 6th ed. Upper Saddle River, NJ: Pearson Prentice Hall; 2004. p. 61–62. 6. Manuele FA. On the practice of safety. Hoboken, NJ: Wiley; 2003. 7. Jensen RC. Risk reduction strategies: Past, present, and future. Professional Safety. 2007; 52(1): 24– 30. 8. Hazen RM, Trefil J. Science matters: Achieving scientific literacy, 2nd ed. New York: Anchor Books; 2009. p. 19–23. 9. Hazen RM, Trefil J. Science matters: Achieving scientific literacy, 2nd ed. New York: Anchor Books. 2009. p. 266–270. 10. Haddon W, Jr., The changing approach to the epidemiology, prevention, and amelioration of trauma: The transition to approaches etiologically rather than descriptively based. American J Public Health. 1968; 58(8): 1431–1438. 11. Peacock B, Laux L. “ WARNING: Do not use while sleeping”—The role of facilitators. Ergonomics Design. 2005; 13(4): 5-6, 28–29.

12. The Eastman Kodak Company. Kodak's ergonomic design for people at work, 2nd ed. Hoboken, NJ: Wiley; 2004. p. 269–371.

Chapter 12

Common Components of OSH Programs

This chapter discusses selected components of OSH programs—OSH program aspirations, training, warnings, safety devices, emergency preparedness, and sanitation and housekeeping. All these topics are referred to multiple times in subsequent chapters, so presenting them here reduces redundancy.

12.1 OSH Program Aspirations Organizations differ in the level of their OSH program aspirations. At the lowest level are employers who pay no attention to OSH. Managers of these organizations may be heard saying things like “we do not need an OSH program because we have experienced employees who know how to work safely,” or “we do not need a formal safety program because our work is not dangerous.” When employees of these organizations incur an injury, a cursory investigation invariably concludes the injury was caused by the unsafe work behavior of the injured employee or a coworker. That shallow conclusion reinforces the employer's belief that a safety program is unnecessary. At the next higher level are organizations focused on compliance with applicable rules, standards, and codes. Managers in these organizations typically equate compliance with safety—a belief that is not entirely justified for several reasons. First, countries and other jurisdictions differ on the comprehensiveness of their standards and codes. If a particular hazard is not covered by a regulation or code, it can easily be overlooked. In the United States, for example, there are no national regulations on musculoskeletal stressors associated with heavy manual materials handling or repetitive motion. Second, standards adopted for regulatory purposes are often outdated, no longer reflecting the practices found in reputable voluntary standards. In the United States, for example, the national standards for air contaminant exposures contain many outdated exposure limits the industrial hygiene community considers inadequate. Third, standards typically emphasize workplace conditions while placing minimal requirements on the behavior of employees. This unregulated factor plays an important role in many occupational injuries and diseases. So a compliance-focused OSH program is much better than no program, but less effective than it could be. The highest levels of OSH program aspirations are for organizations choosing to perform at a “best practice” or “world-class” level. These organizations comply with applicable regulations, but go far beyond that. They often set their own standards at levels stricter than the regulatory standards. They typically subscribe to a continuous improvement methodology for their OSH programs, incorporating cycles of performance measurement, evaluation of findings, and correction of weaknesses. An example of how a continuous improvement process can be incorporated into OSH training programs is provided next.

12.2 Training Training employees for safe job performance is a core function of OSH programs. Two basic reasons for OSH training are the employees' right-to-know and their on-the-job behavior. Regarding the first reason, it is widely recognized that employees deserve to be informed of the hazards they might encounter on their job, and what practices they should follow to avoid harm. When the hazards are chemicals, the phrase “right to know” is used extensively and adopted into the regulations of many countries. However, the idea of “right to know” should not be limited to chemicals. It should certainly include any type of hidden hazards. Whether the right-to-know principle should apply to hazards that are open and obvious is a question worthy of debate. All employers, especially those aspiring to have world-class OSH programs, should attempt to ensure that every employee potentially exposed to a hazard will be informed enough to recognize the hazard and know the precautions for avoiding harm. The primary vehicles for enabling employees to recognize and avoid hazards are training and warnings. This section describes training processes and the next section discusses warnings. Regarding the second reason for OSH training, it is generally believed that training influences how employees perform their jobs. So prevalent is this belief that studies to check it are rare. In one study, forklift operators with a large regional warehousing company were assigned to one of three experimental groups.1 One group received no training, another received training alone, and the third received training plus performance feedback. Performance was measured by extensive behavioral observations before and after the interventions. The proportion of proper operating behaviors for each group provided the performance measure for comparison. Comparing group performance change from pre- to postintervention, the no-training group changed minimally, the training-only group improved considerably, and the training plus feedback group improved somewhat more than the training-only group. Thus, at least this one study found evidence supporting the belief that safety training translates into improved on-the-job safety performance. The flowchart model depicted in Figure 12.1 provides an overview of processes involved in OSH training.2 As a generic model (i.e., not for any particular topic), it can serve as a framework for all OSH training within an organization, regardless of the particular topic. The generic model incorporates the elements needed for continuous process improvement. Figure 12.1 Generic training process model. Adapted with permission from Ref. 2.

The rectangles in the model depict processes that vary, depending on the subject of the training.

Diamond shapes in the model indicate decision points. From these decision points, some arrows indicate feedback to earlier processes. These are the key branches for supporting the continuous improvement process. To facilitate the following explanations, the elements in Figure 12.1 are labeled using a number for processes and the letter D followed by number for decisions. According to the mode, an organization considering a new training program will first decide if training is the most suitable approach for a particular safety and health problem (D1 in Figure 12.1).

There may be, for example, an engineering control sufficiently effective to eliminate the need for training. In many instances encountered in the OSH field, training is required by regulation and is often a requirement of large businesses that contract out much of their work. Even if the underlying motive for establishing a training program stems from a requirement, course developers should write a statement of goals for the training that emphasizes the safety and health benefits rather than simply saying the goal is to comply with a requirement. Each training program begins with needs (No. 1), usually driven by a history of harmful incidents, by regulatory requirements, by the findings of a JHA or RA, or by a desire to improve the employees' abilities to recognize hazards and participate in hazard control. Several methods for determining training needs are summarized in a paper by Cekada.3 For training related to a particular job, one practical methods involves (1) defining job requirements, (2) specifying tasks within each function, (3) determining potentially hazardous events and exposures for each task, (4) defining precautions the employee should take, and (5) listing the skills and knowledge required to safely perform each task. A task-analysis chart such as that shown in Figure 12.2 facilitates organizing this information in a format the course developers can use to delineate learning objectives for the training. Figure 12.2 Task analysis worksheet relating functions, tasks, knowledge, and skills.

Effective learning objectives focus on the needs of trainees. In contrast, a poor practice is to list

course objectives from the perspective of the instructor. For example, “to demonstrate how to properly don and doff personal protective gear” is much more appropriately worded as “at the conclusion of the training, each trainee will demonstrate the skill to properly don and doff the personal protective gear.” This format helps course developers and instructors focus the course on what the trainees take away from the training. The learning objectives developed in process 2 should drive the third process—develop learning activities, materials, and specifications. Each objective needs a plan to help trainees develop the applicable knowledge or skill. Because OSH training involves adults, best-practice course development makes use of adult learning theories.4–6 A basic difference between working adults and college students is that college students have more tolerance for lectures. Experts on adult training agree that lecture sessions should not be too long. In the morning, when trainees are fresh, their attention spans may be as long as 20 min. After lunch, attention spans will be shorter. A second factor to consider is the mode of learning. Some adult learners absorb a lot from a lecture, while others get little. Some learn from watching a professionally developed training CD about the topic, some learn best from touching and using items, and some learn best from participating in peer discussions. The point is, in order to reach all trainees in a group of adults, the better courses offer several modes for learning the same material or skill. Part of the course development process is to allocate time for each topic and develop a lesson plan

for each time unit in the course outline. The lesson plan will identify multiple learning activities for each unit. Many trainers use topic relevant games or hands-on activities to stimulate interest and involvement. Training on respirators, for example, might use a mixture of lecture, demonstration, and hands-on practice with the equipment. Generally, classroom training is most suited to achieving objectives involving knowledge, while hands-on training is most suited to objectives involving skill development. However, knowledge gained can be reinforced through hands-on training, and some skills can be developed in a classroom setting. Many training programs start with a test of some sort to document trainee knowledge and skill before the training (D2). There are three very good reasons for pretesting. First, instructors can compare pretraining results with similar posttraining test results to provide a measure of training effectiveness. It is the only way to find out how much trainees gained from the course. The second reason is to determine to what extent trainees already have the knowledge and skills prior to sitting through the training. Depending on the results of the pretest, the instructor can adjust the instructional level and material to match the existing expertise of trainees. The third reason is that the process of taking the pretest contributes to the overall learning experience of attending the course by providing trainees time to concentrate on the material, recall and reinforce older memories of the material, and recognize weaknesses in their knowledge and skills. When the course is ready for delivery, some ingredients that strongly influence effectiveness include having an instructor with appropriate expertise, suitable facilities and audiovisual equipment, and access to equipment for hands-on activities. Topic relevant games and small group activities support trainee interest, attention level, and learning. Table 12.1 summarizes various techniques for assessing a training course—process 6 in the flowchart. Assessment results provide the basis for the instructor to make changes with intention of improving the training. The next diamond in the flowchart (D3) asks if the course will be repeated. If not, the training model ends here. Otherwise, the process continues to D4 that asks if there will be an attempt to improve the program. Table 12.1 Training Assessment Techniques. Assessment technique What is assessed? Comments 1. Trainee evaluations at end of course

Trainees' opinions of their experiences, instructor's performance, and facilities

Can help instructor learn what trainees like and dislike

2. Testing trainees at end of course Trainees' knowledge and skill at end of course Very valuable if tests assess course learning objectives

3. Pretest to posttest comparison Trainee learning due to the course The two tests must be comparable in difficulty and material

4. Instructor's assessment after course Instructor's impression of course attributes that could be improved

Useful if instructor follows up by making improvements for future offerings

5. Trainee performance on their jobs before and after course

Changes in work behaviors apparently due to the course

Obtaining observational data pre- and post- course is resource intensive

If no improvements are needed, the course is ready to be repeated with no changes. If improvements are needed, the flowchart leads to the last process box in the model, which calls for making whatever changes would be beneficial. After making the changes, the flow chart has an arrow from process 7 up to the start of the next course offering. A record of attendance and successful completion for each trainee provides important documentation. Many programs also create a card or certificate for each successful trainee to keep for his or her personal documentation.

12.3 Warnings Like training, warnings and similar safety-related messages provide another approach for both informing employees of hazards and influencing work behavior. These devices communicate through human auditory, tactile, olfactory, and visual senses. Each is reviewed in this section. An auditory warning serves best to alert people to an uncommon situation. Auditory alarms are excellent for getting attention, and the sound distributes in all directions so that people can detect it regardless of the direction of their head relative to the source. Traditional alarms (sirens, buzzers, horns, and bells) are limited in that they convey a simple message to the effect that something different is happening, which is why these devices are sometimes called auditory alerts. The person hearing the sound must figure out what to do. Various advances in the design of auditory alarms have extended the options. Devices are now available with options for pitch, waveform, rhythm, and intensity.7 With a bit of training, personnel can learn to distinguish the sounds and recognize the intended meanings. In addition, advances in voice synthesizer technology have created options for adding verbal messages to the traditional auditory warning devices. A common use of auditory warnings is for backing-up alarms on large vehicles. A key reason why these devices are used, and required, is that when a large vehicle is backing up, large areas behind the vehicle are not visible. These blind spots have been implicated in many run-over fatalities. To compensate, the alarms installed on the back of a large vehicle emit an obnoxious beeping sound while the vehicle is backing up. The hope is that people behind the vehicle will become aware of the approaching vehicle and move aside. No one knows how many lives have been saved by these devices, but they are by no means foolproof—people have been backed over even when the vehicle backing-up alarm was working. Some of these unfortunate incidents occurred at construction sites and mines, where multiple large vehicles routinely operate. A common belief is that the personnel on foot become complacent to the frequent sounds of backing-up alarms and begin to ignore the sounds. When that happens, the safety devices become less effective. Devices based on human tactile senses typically use vibration to alert people. When the device is next to the skin, the user can easily detect the vibrations. These devices are used extensively in cell phones and in the devices that restaurants use to notify waiting customers that their table is ready. A review of possible devices that could be used to notify an emergency responder when exposed to radiation concluded that the vibratory type is desirable for getting attention, but the combination of vibratory device and a spoken message would be most effective.7 For the danger of exposure to odorless and colorless gases, adding an odorous chemical provides a mechanism for warning personnel that the gas is present. Examples are the addition of pyridine to argon and methyl mercaptan to natural gas. Limitations are similar to those of auditory warnings. Lights are used on police cars, fire trucks, ambulances, wrecker trucks, and utility vehicles to attract the attention of other drivers and pedestrians. An advantage of flashing lights is their noticeability, even when viewed in the periphery of one's visual field. Flashing lights are also used in buildings for fire notification. Although fire alarms are extremely loud auditory devices, for building occupants who are deaf, the flashing lights serve as an alternative warning to the loud alarm. Because a bright flashing light reflects off wall and ceiling surfaces, even an occupant who is looking in the opposite direction of the light source will notice the flashes of reflected light. A weakness of flashing lights is the very limited information conveyed. A person seeing a flashing light may or may not understand what it means. Someone who misinterprets the warning could

choose a course of action that leads to increased danger (a decision error). Another kind of lower key visual warning is found on displays in the control rooms of advanced facilities, ships, aircraft, motor vehicles, and many other engineered systems. Common forms of these include a light that comes on where none usually exists, a green light that changes to red, or a light that starts blinking. These warnings draw attention initially, but a weakness is that personnel can become complacent or mistrustful. If you visit a control room of a large plant, look at all the lights and gauges. Sometimes you will see a blinking light, ostensibly warning of an abnormal condition. If you ask the operators why they ignore the light, they will likely tell you that experience has convinced them the problem is not the equipment being monitored, but it is a defect in the warning light system. As a visitor, you will not know if they are right or wrong, but you will have to wonder why they are so willing to continue operations when they know something is not working as it should. Signs are commonly used in workplaces to convey safety-related information. Many of these are warnings about particular hazards, and some signs provide general information. Signs are valuable in four ways. First, for personnel already familiar with the work area, signs located near hazards serve as reminders of the hazard. Second, for personnel unfamiliar with a work area, signs serve to notify them of the hazard. Third, safety signs serve to inform personnel of precautionary behavior. Fourth, a value not widely recognized is that the quality of workplace signage can affect the safety culture of the organization. Quality signage in a workplace conveys the subtle message that management really cares about employee safety. On the other hand, a facility filled with old, rusted, dust covered signs conveys the opposite message. Worldwide standardization efforts for safety-related signs have nearly achieved harmonization for colors and symbols. This success is largely due to the contributions of numerous researchers and their studies.8,9 Formats for sign layouts have not achieved international harmonization due to the standard formats used in the United States differing from those adopted internationally. The two examples of workplace signs in Figure 12.3 illustrate common layouts in the United States. Signs contain spaces (panels) for designated content and standards specify format options for each panel. For the signs in Figure 12.3, the top panel contains a signal word in all capital letters within a specified background color. For safety-related signs used to warn of a hazard, the standard format of signal word panels reflects both theory and considerable empirical research into the colors, words, and symbols. Red conveys the level of greatest hazardousness. Less hazardousness is conveyed by yellow and orange. The signal word DANGER conveys greater hazardousness than CAUTION or WARNING. The sign in Figure 12.3a includes an internationally recognized triangle with an exclamation inside. When used in the signal word panel as shown, the symbol increases the impression of hazardousness.10 Standards for signs used for communicating messages relevant to safety in general, rather than a particular hazard, use blue or green backgrounds in the signal word panel. Figure 12.3 Example formats for workplace warning signs in the United States.

Under the signal word panel, the sign may have a text panel, a symbol panel, or both. In the text

panel is a succinct message about the hazard and potential harm, followed by a text message about appropriate precautionary behavior. Many workplace signs provide the text messages in two or more languages. The symbols used in symbol panels should not be invented by an artist or a creative attorney. There are numerous symbols with standardized formats that have been tested for comprehension and found suitable for a specific message.11 Some advantages of safety symbols are that they communicate effectively without the need for workers to be literate, their meaning may be captured by a quick glance, and many symbols are understood internationally.11 Symbols for indicating a prohibited behavior use a pictogram depicting the behavior behind a diagonal slash running from the lower right to the upper left. Although the world is slowly moving toward harmonized safety signage, flexibility is needed to allow local traditions and stereotypes. Local testing can be used to check if the international standards need modification for a particular population. An example of local testing used a study population of 50 male employees from industrial enterprises in India.12 The testing of their perceptions of colors and signal words indicated that their perceptions of hazardousness were similar, although not identical, to those found among participants in studies conducted in other countries. The differences did not appear great enough to warrant development of an India-specific convention for workplace safety signs.

12.4 Safety Devices Numerous safety devices are useful for implementing engineering control strategies. The major types are introduced in this section. Devices known as dead-man controls, used on many powered tools and equipment, require a human to actively engage a mechanism (e.g., a lever or button) in order to keep the machine operating. The term dead-man control came from the application of the device on train engines. Imagine the early days of locomotives. What if the train engineer died during a run? The train would continue moving as a runaway train. A countermeasure developed for this hazardous situation was a lever in the cab the train engineer was required to hold in position to maintain power to the wheels. If the engineer let go of the lever, for any reason, the train would begin to slow down and eventually stop. A more modern alternative used in many trains today requires the driver/engineer to either press a button or change the throttle position every minute. The dead-man control design is now used for many power tools such as electric drills, portable power saws, and lawn mowers. The human must actively engage a mechanism to make the tool run. If the human releases the engaging mechanism for any reason, the motor shuts down or the drive mechanism is disengaged, causing the moving parts to come to a stop. One major benefit of this design is that the hazardous movement ceases soon after releasing the engaging mechanism. Thus, if

the operator drops the power tool, it does not continue operating. The second benefit comes from placing the engaging mechanism a safe distance from the hazard. Thus, during operation the hand on the engaging mechanism should be located a safe distance from the hazardous energy. There is, however, a concern about possible injury during the brief time between when the control is released and when the hazardous motion fully stops. What happens if the operator releases the control and then rapidly reaches for the hazardous moving part? This may seem a bit crazy, but consider this actual scenario. A groundskeeper was mowing a lawn with a push-type power lawn mower. There had been 5 days of rain, so the grass was wet and long. Several times, the blades jammed from the wet grass accumulating in the housing around the blades. Each time the groundskeeper released the control, reached under the housing, and cleared the excess grass using a short stick. The more he performed this procedure, the faster he got. Finally, his movement was so fast that he got his hand under the housing before the blades fully stopped. Power tool manufacturers recognize the need to design tools for shutting down rapidly. To determine how brief this stop time must be, they need to know the duration of the operator's movement from the control mechanism to the point of danger (i.e., the after-reach time). Determining after-reach time involves experimentation with a sample of people similar to those who will be using the power tool. After collecting several after-reach times from each of the study participant, descriptive statistics are determined for the measured after-reach times (e.g., mean time, standard deviation, and range). From these findings, the manufacturer needs to decide what after-reach time to use for design specifications. After selecting a value for after-reach time, the tool designers need to find a way to make the stop time less than that of after-reach time. Related to the dead-man control are some system designs widely used in safety engineering.13,14 The term fail-safe applies to a system in which, if a particular failure occurs, the state of the system will not be dangerous. The nondangerous state may be achieved by failing passive or failing active. The fail-passive design is a direct descendent of the dead-man control. If the operator fails to maintain the engaging mechanism, the power for the equipment drops to its lowest level, often to zero. Thus, the equipment ceases to move or otherwise operate. A fail-passive design is also used for electrical circuits. If the current exceeds the design capacity of the circuit, the circuit breaker should trip, opening the circuit path and stopping the current flow. A ground fault circuit interrupter is another safety device used in many electrical circuits. It monitors the difference in current between the hot wire and the neutral wire. If the difference exceeds a set point (approximately 5 mA), the device causes the circuit to shut down. The fail-active design is an alternative to the fail-passive design. Safety engineers like fail-active designs for systems that would be dangerous if allowed to shut down at the wrong time. Examples might include an industrial operation that would be severely damaged if shut down suddenly, or a system that serves a critical safety function. For these systems, a failure should not result in shutting down or ceasing operation. The safer alternative is for a fail-active mode to kick in. A common design for workplace applications involves having a normal mode and an alternate fail-active mode. For the basic workplace fail-safe design, once the normal mode fails, the system is left with one means of sustaining the operation or safety function. This mode should be regarded as a temporary state in need of correction as soon as possible. Allowing the safety system to continue without correction would be inviting disaster. Engineers familiar with this issue will design a mechanism to make personnel aware of the temporary operating mode. This might be a blinking light on a control panel, a unique noise, or both. The design should provide a message to make clear to the operator what action is needed.

In addition to fail-active devices, two other designs are useful for sustaining safety-critical functions after a single failure. One is the use of a backup unit. For example, if the power supply to a hospital shuts down for very long, patients would die. Therefore, hospitals have backup generators available to provide power during an electrical outage. The other design, redundancy, involves putting two or more components into the system, each one being sufficient to perform the function independently. Another group of safety devices includes interlocks, lockouts, and lockins.13 A safety interlock serves the function of allowing, or disallowing, the active energy state of a device such as a microwave oven, a clothes dryer, or an industrial machine. Although there are numerous types, some of the most familiar are incorporated into a door or gate. The interlock acts as a switch that allows the active energy state when closed and disallows operation when open. A lockout keeps a source of energy out of where it should not be. This device is commonly used by maintenance personnel while they work on a machine, clean an empty storage vessel, or make changes in electrical circuits—they first isolate the site from all hazard sources using various switching devices, then lock those setting with a padlock to make sure no one comes along, and finally change the setting. A lockin keeps an energy in the active state (e.g., an electric circuit that must be active) or keeps a hazardous energy from getting out of a normally safe location.

12.5 Emergency Preparedness This section discusses organizational planning and preparation for emergencies and catastrophes. The focus is on the role of employers, rather than on the roles of fire departments, police, and emergency medical services; and discussions are limited to fundamental aspects of emergency planning and preparation. Subsequent chapters revisited the topic in the context of emergencies due to fires, explosions, geological events, weather events, workplace violence, and terrorist attacks. What is meant when people talk about catastrophes and emergencies? An incident may be called a catastrophe if the outcomes create exceptional demands on resources needed to respond. Resources include medical personnel, rescue personnel, transport capacity, and hospitals. Incidents considered emergencies include catastrophes and other highly disruptive situations. Brauer defines an emergency in terms of three elements.15 Emergencies are characterized by the following features: (1) arising in a relatively short span of time, (2) having disruptive effects on normal activities, and (3) needing a rapid and effective response to limit the damage. After the onset of typical emergencies, a lack of effective response allows the harm to expand in breadth and depth, whereas an effective response will limit the damage. In the movies, effective responses to emergencies are shown as the heroic actions of characters played by movie stars. This idealized approach is unreliable and inadequate. Businesses have responsibilities for the consequences of the emergencies they create, and their post-event response will influence their liability. Governmental organizations also have responsibilities to respond to emergencies they create, and some governmental organizations exist primarily to provide response services (e.g., fire department, police departments, and emergency medical services). All these business and governmental organizations benefit by advance planning and preparations for emergency response. Effective planning requires the time of many individuals, which in turn requires management support. Such support can range from minimal to enthusiastic. A minimal level of support corresponds to a compliance aspiration as discussed in Section 12.1. If management supports only

compliance, the applicable laws and regulations will set the bar for the planning effort. For organizations aspirating to a best-practice level, much more is involved. OSH personnel typically advocate for a best-practice program, while other managers may have only compliance aspirations. Getting clear on the level of managerial support early in the process can help avoid endless frustration stemming from different visions by the top managers and the personnel involved in implementation. Because most of the books and journal articles about emergency planning assume a best-practice aspiration, those involved in the planning process would do well to review the advice in such documents and select only those recommendations most suited for meeting organizational needs. A logical starting point for emergency planning is to assemble a planning team.15,16 The team will want to start by identifying all the possible emergency incidents that might occur, followed by a shorter list of incidents most likely to affect the organization's operations. Some incidents deserving consideration by business and government organizations are as follows:

Fires and explosions originating within the organization's property Fires and explosions on neighboring property Severe weather events Geological events such as earthquakes and volcanic eruptions Acts of terrorism Acts of employee violence Aggressive activities by mobs Releases of hazardous chemicals from industrial facilities or neighboring facilities Disruption of core utility services Disruption of electronic systems by lightning, power surges, and cyber attacks

Creating a short list of the most compelling types of emergencies enables a planning team to optimize the value resulting from their efforts. The process involves considering both the probability and the severity of foreseeable events. Similar to the risk-assessment matrix approach discussed in Chapter 5, some potential events will be high in both severity and probability, others low in both, and many in between. Reaching agreement on a risk matrix early in the planning process might prove useful for resolving differences in opinion. For example, an individual on the planning team might advocate for including a particular type of event on the short list because, somewhere in the world, some time ago, an event like that occurred. When presented with such a worst-case argument, the team members may need clarity on the responsibilities of the team. Generally, an emergency planning team is responsible for using its collective judgment to choose events for the short list and to develop emergency plans for those events. The team also has a responsibility to consider the economic realities of the organization or organizations participating in the planning. Each type of event on the short list needs careful thought so that the team can plan suitable responses. Fires and many other events require plans for evacuating personnel from buildings. Other events call for keeping personnel inside buildings (the lockdown response). Events involving failure of a utility service or means of communication usually involve establishing redundant services or backup systems. Each type of event on the short list needs planning. The team will want to discuss and decide on a policy on fighting fires. Three basic policy options are (1) evacuating all personnel whenever a fire is detected, (2) authorizing a few selected personnel

to use a fire extinguisher on small (incipient) fires while everyone else evacuates, and (3) maintaining a team of well-trained and equipped personnel to respond while all others evacuate. The third option places a rather heavy burden on the organization to provide adequate training and equipment to the response team members. Another component of planning considers the investigation process. Major incidents tend to involve large losses and raise issues of legal and financial responsibilities. It helps to have a plan for the immediate process of securing the scene, collecting evidence, and preserving evidence. The plan may call for using two teams—one to collect and preserve evidence and the other to analyze the evidence, determine root causes, write a report, and conduct debriefings.17 The best emergency plans are comprehensive in their scope. An Internet search identified dozens of templates for emergency action plans that can provide a useful outline and format for developing a plan. A sample template by the U.S. National Institute for Occupational Safety and Health may be a convenient starting place for organizations developing an original plan.18 Using a template does not negate the need for an organization to form a team and think through many issues, including answering the following questions. How will the organization create a record of evacuated employees? What method will be used to account for all personnel who evacuated and any who stayed to provide initial response? How will employees interact with outside responders? Will employees assemble in locations out of the way of responders? Will employees participate in directing traffic? Will certain personnel be assigned to assist the responders? Which employer personnel will deal with newspaper and television reporters? Who will contact insurance providers? For more information on issues to consider relative to disaster and emergency planning and management, the National Fire Protection Association has a comprehensive standard19. Another emergency-related planning process involves planning for business continuity. The disruption of normal business operations due to a major fire, explosion, or similar disaster can financially destroy an unprepared business. The adverse business impacts that can result from such unexpected events can be mitigated by following what is generally known as a business continuity plan.20 Some elements to address in such a plan are communications with insurance companies, sharing information with the news media, meeting short-term financial obligations, retaining customers, cleanup, salvage, rebuilding structures, and repairing damage to the environment.

12.6 Sanitation and Housekeeping Both facility sanitation and housekeeping play fundamental roles in workplace safety and health. Poor sanitation encourages transmission of diseases such as common colds and flu, which means more employees will call in sick. This affects safety in two ways. First, replacement workers often have less expertise than the regular workers and may not fully appreciate the hazards and reasons for safe practices. Second, in many workplaces, when someone calls in sick, the work crews are expected to complete the regular work with a short crew. That puts more workload on each person and may lead to injuries. In nursing homes, for example, the nursing aides work in teams of two. If 12 nursing aides are scheduled for the shift, there will be six teams. If one calls in sick, there will be 11, leaving five two-person teams and one working alone. Since some of the work involves transferring residents (patients) who can provide little assistance, the exposure to musculoskeletal stressors of the nursing aide working alone will be greater than when working with a partner, increasing likelihood of a musculoskeletal injury. Unsanitary work conditions can contribute to the spreading of hazardous materials. This is

especially a concern where hazardous dusts or toxic materials are encountered in limited areas of a site, but due to poor sanitation practices, the contaminants are spread to other parts and to other employees. Another issue in this regard arises when employees wear their contaminated clothing home where the contaminant can be spread to other family members. Unsanitary facilities provide an attractive harbor for rodents and insects that, along with other pests, can transmit diseases throughout the facility. Once these sorts of pests establish a colony in the facility, they can be difficult to eliminate. Good sanitation is the most effective way to keep these pests from getting that initial foothold. Basic employee needs for sanitation should not be taken for granted, even in the most developed countries. Some of the most basic needs are a plentiful supply of sanitary drinking water, clean and functioning toilet facilities, hand washing facilities, a sanitary area for eating, and an adequate sewer system. At many industrial sites and mines, employees need locker rooms for changing into and out of work clothes, showering, and storing their gear. In workplaces where employees use personal protective equipment, there is a need for facilities to clean and sanitize equipment such as respirators, hard hats, and nondisposable hearing protectors. Workplace sanitation also benefits from regular cleaning practices. Sometimes called “housecleaning,” these practices include regular removal of trash and other waste materials, dusting, sweeping and mopping floors, cleaning spilled oils and other materials, and cleaning equipment. Good housekeeping contributes to both risk reduction and a safety culture.21 Housekeeping involves having places for everything, and actually keeping those things where they belong. Signs of poor housekeeping include pallets, barrels, boxes, and tools placed in all sorts of places; pedestrian pathways cluttered with items people might trip on; and fire exit pathways with items left there by employees who could find no other place to leave the items. In a well-managed facility, work is planned, there are designated places to store equipment, and employees understand that they are expected to perform according to the rules. In poorly managed workplaces, work is loosely planned, there are few rules for storing equipment, and employees perform their tasks according to their judgment. In general, workplaces incorporating good sanitation, housecleaning, and housekeeping practices convey to employees and visitors the impression of being desirable places to work. These practices, combined with quality safety signage, should positively affect safety culture by conveying the message that management is committed to supporting employee health and safety.

Learning Exercises 1. Suppose you review some of the OSH training programs already developed and used by

an organization. You find each program has a purpose statement, but it appears the various instructors had very different ideas about how to phrase a purpose statement. Develop a generic format for a purpose statement that may be used in all the OSH training courses within your organization. The format will have blank spaces to fill in for each particular course. 2. Develop a plan for a 2 h training program on warning signs. Assume the employees have never had a course like this one. The OSH department recently bought new signs conforming to the most recent standards and replaced all the old signs. Your plan should incorporate adult learning theory, such as diverse ways for learning. You are not being asked to develop the content of the course, but rather to describe how the time will be used.

Include statements of the purpose of the training and learning objectives for trainees. Include time for a pretest and a posttest. 3. Each of the types of warnings has strengths and weaknesses. Answer the following questions.

a. What strengths and weaknesses do auditory beeps and flashing lights share?

b. What strengths and weaknesses are inherent to warning signs?

c. If an employee says warning signs are ignored, and therefore useless, how can you respond in support of having warning signs in the workplace?

4. In some management system standards, warnings are among the categories for hierarchy of controls. In these ordered lists, warnings are preferred to administrative controls, and administrative controls are preferred to PPE.

a. Do you think all types of warnings are more desirable than all types of administrative controls? Explain your rationale.

b. Do you think all types of warnings are more desirable than all types of PPE? Explain your rationale.

5. For each item below, what type of safety device is in use?

a. A clothes dryer will not operate unless the door is closed.

b. A battery-powered smoke detector emits an audible beep when the battery is nearly dead.

c. A mechanical power press has a curtain of light separating the human operator from the point of operation (the danger point). If the operator's arm or hand is detected by the light curtain, the press will not cycle.

6. A robotic work cell in a manufacturing facility has two safety devices to keep personnel separated from the hazardous movement of the robot. The first is a gate that will prevent the robot from operating while the gate is open. The second is a pressure-sensitive floor mat located between the gate and the robot movement zone. If the floor mat senses pressure, the robot cannot operate. Why are two safety devices needed? 7. Regarding emergency preparedness, concisely respond to the items below.

a. Explain differences in organizational aspirations.

b. Explain the two-step process for selecting a short list of emergencies to focus on when planning for emergencies.

8. Consider the following exchange during a meeting of the emergency planning committee. This particular meeting is for selecting a short list of foreseeable emergencies to address in planning. Jim says the chance of a hurricane is so tiny that it should not make

the short list of emergency planning. Robert describes an instance where a similar facility was hit by a hurricane resulting in two deaths and extensive damage to the facility. He says he does not want to be held responsible if a hurricane strikes the facility. If you are chairing the committee, what might you say? 9. In planning for responses to some disasters, it becomes apparent that rescue personnel may be exposed to sources of radioactivity. A personal monitoring device is available to track exposure and recognize when the dosage is getting close to the tolerable level. You want to be sure the emergency worker is alerted when his or her exposure level reaches a point where exiting the area is necessary. The person will be wearing full body protective gear. For notifying the person, what type of warning devices would you recommend and what features would be desirable? 10. Engineers are designing a nuclear power station. To maintain the temperature of the reactor core, continuous water around the core is essential. The engineers need to select a valve for controlling the water flow. They have a choice between a normally closed valve and a normally open valve. Either type of valve will be controlled by an electric motor. During a “What if?” session, somewhat asked what if the electric power to the plant should fail? For this scenario, the engineers decided that a fail open valve would be safest. Is this a fail-active design or a fail-passive design? Explain your answer. 11. Continuing with the nuclear power station design, suppose the plan is to have a pair of redundant cooling systems, each with separate valves, electric motors, and pipes surrounding the reactor core. Electric motors control the valves in both cooling systems. If electric power to the plant fails, both cooling systems would be affected in the same way.

a. Would a power outage be an example of a common cause failure?

b. In computing the probability of both cooling systems failing, would it be correct to multiply their respective failure probabilities?

12. Explain how industrial housekeeping and sanitation can influence the workplace safety culture.

Technical Terms After-reach time

The time between the release of a hand actuator and the instant the hand enters the danger area of the machinery.

Business continuity plan

A proactive plan for a particular business entity describing what will be done after a major fire or disaster to minimize losses and continue the business.

Catastrophe An incident resulting in harm to people or environment and creating exceptional demands on resources needed to respond.

Dead-man control

A safety device that allows power to a machine only while a lever or other device is engaged by the machine operator.

Emergency An incident that occurs in a relatively short time, disrupts normal activities, and creates a need for rapid and effective response to limit the damage.

Fail-safe A term indicating that a particular failure of a system will result in the system being not dangerous. The nondangerous state may be achieved by failing passive or failing active.

Housekeeping In the context of OSH, various practices supporting decent working conditions, such as regular removal of trash and other waste materials, dusting, cleaning floors, cleaning spilled oils and other materials, cleaning equipment, and keeping everything in its place.

Program aspirations

In the context of OSH, what organizations are trying to achieve with their OSH programs such as complying with requirements or being world class.

Redundancy A design approach for increasing system reliability by using multiple components to perform the same important function. Each component can perform the function alone. The redundant components may be identical, similar, or different. Component independence is highly desirable for system reliability.

Stop time The brief time between releasing the control of powered equipment and the hazardous motion fully stopping. Task-analysis chart

A useful tool for developers of OSH training courses to determine the knowledge and skills trainees need to perform their tasks safely.

Warnings Various means for notifying people of a hazard so that they have the opportunity to take appropriate precautions.

References

1. Cohen HH, Jensen RC. Measuring the effectiveness of an industrial lift truck safety training program. J Safety Research. 1984; 15(3): 125–135. 2. Jensen, RC. Safety training: Flowchart model facilitates development of effective courses. Professional Safety. 2005; 50(2): 26–32. 3. Cekada TL. Conducting an effective needs assessment. Professional Safety. 2011; 56(12): 28–34. 4. Kelly MH. Teach an old dog new tricks: Training techniques for the adult learner. Professional Safety. 2006; 50(6): 44–48. 5. Galbraith DD, Fouch SE. Principles of adult learning: Application to safety training. Professional Safety. 2007; 51(9): 35–40. 6. Merli CM. Effective training for adult learners. Professional Safety. 2011; 56(7): 49–51. 7. Herring SR, Hallbeck MS. Conceptual design of a wearable radiation detector alarm system: A review of the literature. Theoretical Issues Ergonomics Science. 2010; 11(3): 197–219. 8. Wogalter MS, Laughery KR. Warnings and hazard communications. In: Salvendy G, editor. Handbook of human factors and ergonomics. 3rd ed. Hoboken, NJ: Wiley; 2006. p. 889–911. 9. Wogalter MS, editor. Handbook of warnings. London: Lawrence Erlbaum; 2006. 10. Jensen RC, McCammack AM. Severity message from hazard alert symbol on caution signs. Proceedings of the Human Factors and Ergonomics Society 47th Annual Meeting, Santa Monica, CA: Human Factors and Ergonomics Society; 2003. p. 1767– 1771. 11. Deppa SW. U.S. and international standards for safety symbols. In: Wogalter, Dejoy, Laughery, editors. Warnings and risk communication. London: Taylor & Francis; 1999. p. 477–486. 12. Borade AB, Bansod SV, Gandhewar VR. Hazard perception based on safety words and colors: An Indian perspective. International J Occupational Safety Ergonomics. 2008; 14(4); 407–416. 13. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 98–102. 14. Hammer W, Price D. Occupational safety management and engineering, 5th ed. Upper Saddle River, NJ: Prentice Hall; 2001. p. 192–200. 15. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 537–545. 16. Schroll RC. Industrial fire protection handbook, 2nd ed. Boca Raton, FL: CRC; 1999. p. 183–192. 17. Resimius M, Stiller J. Effective preparedness training: Improving response to major incidents. Professional Safety. 2010; 55(3): 18–20. 18. National Institute for Occupational Safety and, Health. Emergency action plan (template).

Available at http://www.cdc.gov/niosh/docs/2004-101/emrgact/emrgact.doc. 19. National Fire Protection, Association. NFPA 1600, Standard on disaster/emergency management and business continuity programs, 2010 ed. Available at http://www.nfpa.org. 20. Clas E. Business continuity plans: Key to being prepared for disaster. Professional Safety. 2008; 53(9): 45–48. 21. Becker JE. Implementing 5S to promote safety and housekeeping. Professional Safety. 2001; 46(8): 29–31.

Chapter 13

Tools for Managing OSH Programs

A typical career progression within the OSH field begins with an education in a relevant field. The first job involves application of material learned in school. These entry-level positions often involve considerable attention to compliance with rules and regulations. As the person gains experience, managerial aspects of the job become more significant. This chapter provides background on three managerial topics important to the advancing OSH professional—safety culture, management systems, and ethical policy.

13.1 Safety Culture Since the mid-1990s, the level of interest in safety culture has skyrocketed. There are many speakers on these and related topics at professional development conferences and many articles on safety culture in the professional journals. This section briefly explains fundamental terms and concepts regarding organizational characteristics relevant to safety culture. Organizations differ considerably in their values, attitudes, and practices. These differences appear in many business areas such as quality, productivity, financial policy, ethical practices, human resources, environmental protection, and employee safety and health, all of which contribute to the organization's culture. Thus, safety and health is but one component of a complex mixture of values, attitudes, and practices that make up organizational culture. Many OSH managers strive to improve their part of the mixture—the safety culture—with the understanding that doing so is a long-range goal. The safety-related values, attitudes, and practices within an established organization take time to modify. It requires gaining the genuine support of people at all levels of the organization. The path to achieving long-range goals usually starts with establishing objectives. In most organizations, objectives include measures of performance, a time frame, and a target level of achievement. For objectives involving safety culture, a challenge is finding a suitable measure of performance.

13.1.1 Safety Climate Surveys A suitable measurement approach has been evolving to meet the need for tracking objectives

involving the safety culture. It involves using surveys to learn about safety climate. Safety climate is a part of safety culture we can measure using questionnaire surveys of employees at all levels of the organization.1–3 These surveys seek to learn about employee perceptions of safety practices and attitudes. An example from one study used multiple survey items for each of the following factors.2

Management commitment to safety Supervisor safety support Coworker safety support Employee participation in safety-related decision-making and activities Competence of employees with regard to safety

Constructing an employee perception survey requires considerable effort and sophistication to achieve adequate reliability and validity.4 Valid surveys contain multiple rating items for each of the factor categories. The survey administrator processes the employee responses to provide information about each factor. Results of perception questions may be useful for one or more of three purposes: (1) tracking objectives, (2) continuous improvement programs, and (3) research. The one already mentioned is tracking objectives. The second is identifying the weaker components of safety climate as a basic step in the continuous improvement program. For example, a survey might reveal that managers think they consistently show support for safety and health practices, while the perceptions of employees may be quite different. Such a finding would prompt the organization to institute improvements during the next cycle of the continuous improvement process. The third purpose of safety climate surveys is research to advance the understanding of safety climate. An example of this is an employee survey for a large retail business with stores throughout the United States and Canada.1 Results found a significant association between perceptions of safety climate and the organization's safety-related policies and practices. Two other influential factors found in the survey were the general quality of the work environment and the safety-related communications. Similar retail businesses may regard these findings relevant for comparing to their own safety climate. When reading research reports of safety climate surveys, attention to the survey sample is critical. If the entire sample consists of employees from one business, results apply only to that business. Likewise, within a large industrial facility such as a vehicle assembly plant, one can expect differences in safety climate among the work units. Generalizing findings from one unit to others in the same organization is problematic because the responses are unique to the surveyed population.5 For research purposes, the most valid use of safety climate surveys is for learning about factors within the surveyed population. Generalizing may be more acceptable if based on results of similar surveys of employees in a similar type of businesses. For example, if similar surveys of four large retail companies consistently found a relationship between safety policies and perceptions of safety climate, one may cautiously conclude that the relationship applies to large retail businesses in general. It would be unwise to assume that those same findings would apply to organizations in another sector, such as health care, energy, or manufacturing. A smart approach to safety climate surveys is to develop standardized, industry-specific survey instruments. An example of this approach is being pursued by some people in the healthcare industry.6 Potential uses might include comparing different sectors within the healthcare industries, comparing different healthcare entities with peers, and learning from their collective experiences more about

factors that influence safety climate in healthcare settings. Organizations concerned with measuring safety climate need to decide how often to administer surveys. The use of a yearly frequency, so common in many areas of business, is probably too frequent. Since attitudes and perception change gradually, a frequency in the range of two to five years may be adequate. For organizations with objectives for improving safety climate, the logical survey frequency will correspond to the frequency of the continuous improvement cycle for safety climate.

13.1.2 Getting Value From Safety Climate Surveys After a survey is completed and analyzed, the organization will identify weaknesses, plan corrections, and implement the corrections. For example, suppose the responses show that employees perceive management's commitment to safety as weak. A plan to correct this weakness may involve efforts to make the safety-related activities of top managers more visible. Top managers can demonstrate their commitment to safety by personally announcing changes in safety-related policies and practices, by accompanying personnel from the OSH department on walk-around surveys and audits, by highlighting safety and health in newsletters and talks, and by meeting personally with injured employees. An approach used at one plant in the automotive industry involved having the plant manager discuss with each injured employee the findings from the investigation of his or her injury.7 If the manager leaves the impression of sincerely caring, the injured employee will come away feeling the plant manager actually cares about employee safety, and the same employee will share that impression with associates. As another example, suppose the safety climate survey indicates lackluster employee participation and coworker support for safety and health. Various changes can strengthen those factors. One is to adopt a system for improving safety-related behaviors. Many employers use behavior-focused systems based on established principles from the field of behavioral psychology. A key starting place is getting small groups of employees who do similar work to identify specific behaviors important for working safely. They then screen these to identify those behaviors that are observable and classifiable as being proper or improper. Training provided for the work group members teaches how to observe the behaviors of others in the group, provide face-to-face feedback to their coworkers, accept feedback from others, and file a report. Someone in the OSH department collects observation reports and computes the percentage of observed behaviors considered proper. Some companies post results on an employee bulletin board in the form of group performance. Some key benefits of these programs are the high level of employee involvement, attention to safety, performance feedback from coworkers, and changes in work group behavioral norms. All these activities contribute to safety climate by increasing employee participation and coworker support. While safety climate surveys are the primary source of information about safety culture, a different perspective on organizational culture warrants mention. Reviews of some major disasters provided interesting findings about attributes of safety culture that open the door for disasters. These were subsequently paired with attributes that discourage disasters.8 Table 13.1 lists the pairs of attributes. Although the title of the article refers to the nuclear power industry, the attributes contrasted in the table synthesize finding from disasters in space flight, process industries, and nuclear power generation. As such, one may view the safety culture attributes as useful for many industrial sites where major disasters are possible. Table 13.1 Contrast Between Deficient and Good Attributes of Organizational Cultures. Deficient attributes Good attributes

Diffuse responsibilities Clear accountability and openness Invincible mindset Respect for limitations of technology Compliance means safe enough Keep striving for excellence “Groupthink” in teamwork Teamwork practices encourage and respect individual thinking No systematic processing of relevant experience from elsewhere

Uses process for learning from the bad experiences of others

Lessons learned disregarded Lessons learned from ourselves and others are communicated and used for improvements

Low priority of safety actions Safety is paramount Little preparation for severe events Prepared and practiced for emergencies Unnecessary acceptance of hazards in design or operating features

Maximizing safety design/operation before accepting risks

Failure to use of project and risk management techniques Use proven techniques to aid technical excellence Safety matters not recognized/integrated into work of organization

Clearly defined responsibilities and authority for safety matters

Based in part on Ref. 8.

13.2 OSH Management System Approach Like the importance of safety culture, interest in management systems has skyrocketed. Standards organizations throughout the world have developed management system standards. A study by Manuele indicates that the various standards are similar in terms of overall outlines of their standards and in the use of continuous improvement processes.9 A standard adopted by the American National Standards Institute (ANSI) is summarized in this section to illustrate the major features of an occupational health and safety management system (OHSMS).10,11 Figure 13.1 depicts the major concepts. The large box on top represents the ongoing workplace system in operation with the current OHSMS depicted in the lower left corner of the large box. Using the process in the ANSI standard, the organizations will transform the current OHSMS into an OHSMS modeled after provisions in the ANSI standard. Figure 13.1 Major processes for implementing an occupational health and safety management system.

The processes for initial planning are depicted with two smaller process boxes placed under the

large box on the left. The standard specifies that the planning process must involve the leadership of top management and include employee participation. This process should produce a policy statement indicating management's commitment to and vision for the OHSMS. Another important outcome of this initial planning process is identification of the major issues facing the organization, including both hazards and components of the current OSH management systems. The planning team then prioritizes the issues. The plan will describe the methods to be used for regular operation of the new

OHSMS. For example, the plan will describe the risk assessment approach to be used, including the risk assessment matrix and guidelines on tolerable risks. Upon completion of the initial planning steps, implementation begins. The implementation will take time, so the diagram shows multiple arrows to indicate a phased implementation process. The implemented OHSMS will use the methods described in the OHSMS plan. The left column of Table 13.2 lists some of the activities for which written methods will be invaluable. The right column indicates sources in this book for more information about the methods. Table 13.2 OHSMS Activities Needing Written Methods. Activities needing written methods Source for more information Identifying hazards Chapter 4 Conducting risk assessments Chapter 5 Following a preferred order for hazard controls Chapter 11, section 11.3 Performing various hazard analyses Chapters, 6, 7 and 8 Investigating injuries and new occupational disease cases Chapter 9 Training personnel on OSH matters Chapter 12, section 12.2 Being prepared for emergencies Chapter 12, section 12.5

This standard does not explicitly include risk reduction involving property damage or environmental pollution, but the organization may choose to include those concerns. Various ongoing monitoring provides assessment data for periodic review. Examples are industrial exposure measurements, injury reporting, behavioral observations, compliance inspections, and audits concerned with the OHSMS implementation. The plan should also address ways to avoid introducing hazards to the workplaces. Three of these are as follows:

1. A management of change procedure, 2. A plan for incorporating health and safety into the procurement process, and 3. A plan for managing the interactions between the organization's personnel and contractor's personnel working at the same facilities.

On the right-hand side of Figure 13.1 are some continuous improvement loops. The ANSI standard specifies that management must review the OHSMS at least annually. The review team is expected to identify weaknesses in the OHSMS and recommend corrections. In addition to the management review, the organization may use other continuous improvement loops to examine the performance of various components of the OHSMS. Each loop includes (1) planning corrective actions, (2) implementing into operations, (3) obtaining and evaluating data collected subsequent to the change, and (4) introducing changes to make the program better. These four processes are often referred to with an easy to memorize string of words such as plan-do-check-act or plan-do-study-act.12 The ANSI standard contains numerous required processes as well as recommended practices to give organizations flexibility. Of course, organizations with low aspirations may simply ignore the existence of the ANSI standard or any other voluntary OSH management system standard. Organizations with more ambitious aspirations for their OSH programs may choose to model their OSH management system on the ANSI standard or a standard from another organization such as the International Organization for Standardization (ISO) or the International Labour Organization (ILO). They may apply their chosen standard as is, or take a smorgasbord approach—choosing features that seem to fit the needs of the organization. Most organizations with best-practice aspirations will

choose one OHSMS to guide their program.

13.3 Ethical Policies for OSH OSH departments and staff occasionally need to resolve issues for which there is no clearly right or wrong resolution. These gray area issues arise from the nature of OSH functions. Consider that the OSH manager and staff are employees of the organization. In exchange for their pay and benefits, they owe the organization duties of loyalty and support. At the same time, the main reason the organization has a professionally staffed OSH department is to support all employees through various health and safety programs. When the OSH department is also responsible for addressing environmental concerns, responsibilities extend to supporting the community through pollution prevention programs. The gray area issues typically arise when duties to two or more constituents appear to conflict. Early writings by philosophers and religious scholars on the subjects of ethics and morals provided a foundation for present thinking. From these roots, two branches relevant to OSH have emerged— business ethics and professional ethics. The business perspective generates extensive media coverage whenever corporate practices contrary to the public interest are revealed. The professional ethics branch consists of profession-based branches, such as medical ethics, legal ethics, and engineering ethics. The professional organizations created by OSH professionals also have codes for ethical practice. This section focuses on the interrelated roles of business ethics and professional ethics applicable to OSH departments and careers. Many people go through life without much thought about business or professional ethics. They generally assume they have some sort of natural instinct for distinguishing between right and wrong. If they happen to encounter a situation requiring a gray area decision, they will be on shaky ground. They may seek guidance from peers, family members, religious advisers, or the writings of various authors (e.g., see chapter 26 in Ref. 13). However, this approach of waiting until the situation presents itself is not encouraged. The preferred approach—the one advocated in this book—is to be proactive. A proactive approach involves two parts. One is formulating an ethics policy statement for the OSH department. The other is obtaining top management support for the OSH professionals in the organization who want to practice their profession in accordance with the ethical codes applicable to their profession.

13.3.1 Ethics Policy Statement The OSH department needs to find a way to formulate an ethics policy that fits the culture of the organization. Large organizations typically have an official statement regarding ethics. The OSH department should align its statements of mission, goals, and ethics with those of the organization. This need to align is not unique to OSH. In organizations, the top-level mission statements of the organization should drive the mission statements for all subordinate units. And the goals of each unit should align with one or more of the organization's goals. Thus, managers are very familiar with the concept of alignment and should have no trouble understanding the need to align the ethics statement of the OSH department with that of the organization. The OSH program statement of goals should clarify a basic issue facing industrial hygienists: Is it the goal of the organization to comply with the legally required exposure standards or with best- practice exposure standards? A clear statement on this critical matter can head off a common conflict faced by industrial hygienists.

The content of OSH program ethics statements will vary across organizations, but any such statement should address two key issues. One is clarification of the competing duties to support (1) the organization, (2) the employee health and safety, and (3) the environment. Ideally, the statement will be clear enough to provide guidance for the OSH program manager when asked, for example, to support top managers while compromising employee health and safety or environmental protection. The second key issue to address in the OSH program ethics statement concerns the conduct of staff professionals. Ideally, the statement will expressly acknowledge that OSH professionals should conduct their work according to the ethical codes of their profession. If these two issues are addressed in a policy statement that top management has approved, the chances of serious ethical dilemmas for the OSH manager and professional staff are greatly reduced.

13.3.2 Management Approval Once formulated, the OSH department ethics statement needs approval at the highest feasible organizational level. When seeking management approval, it may prove useful to reference one of the most respected gurus of management, Peter Drucker. In the ethics chapter of his book Management: Tasks, Responsibilities, Practices, Drucker asserts that professionals need principles to distinguish themselves from the masses.14 His first and overarching principle is that professionals “do no harm,” which he qualifies by adding the word “intentionally.” His second principle is autonomy, which means a person acting in a professional capacity can make decisions within the domain of responsibilities associated with their field. A person is not autonomous if the boss (or client) can control the person's day-to-day activities and dictate decisions or recommendations. Drucker's third characteristic of a professional is respect for privacy. When a professional is entrusted with confidential information, it stays confidential. A professional is expected to know what information is confidential, and if unclear, find out. Some information is normally confidential even without an explicit statement to that effect. Normally confidential information that OSH personnel are likely to encounter include the following:

Information about company trade secrets or other proprietary rights, Employee medical records, and Responses from employees to surveys are generally considered confidential.

A professional must be in a position to protect private information without fear of being reprimanded or discharged. Many managers who are familiar with Drucker's writings will find it difficult to oppose an OSH department proposal to formulate a statement of ethics addressing Drucker's three principles of professionalism. To appreciate why OSH professionals benefit from an ethics code, consider that reputations are built over time. Daily decisions, statements, and behaviors contribute to establishing a reputation. Those in OSH careers can develop a reputation for being ethical by consistently being trustworthy, fair, and honest. All these traits are important for performing OSH functions effectively. Although it can take years to build, a reputation can be destroyed by a single, visible, unethical decision or behavior. The most effective way to prevent such a damaging career event is to take a proactive approach to ethics. Codes developed by professional peers address the characteristics mentioned by Drucker (do no harm intentionally, work autonomously, and respect privacy) in addition to other issues

encountered by those in the profession. The ethical codes and codes of practice specifically for the OSH professions vary, so an OSH professional may chose one that most closely matches their primary specialty. Sources of ethical codes for the OSH professions include those of professional societies and those of organizations that issue professional credentials. The most appropriate choice depends on the country of practice and the professional specialty. For purposes of illustrating the nature of ethics codes, one from the Board of Certification in Professional Ergonomics (BCPE) is in the appendix to this chapter.

13.4 Summary of Part III Part III consists of five chapters on programmatic methods for reducing occupational safety and health risks. Chapter 9 summarizes the steps in a closed-loop process for ensuring follow-up to harmful incidents and discusses issues for organizations to consider when developing policies related to each step of that process. It explains tools to help incident investigators organize evidence into a series of events and conditions leading to and following the harmful event. It concludes with an innovative graphic model showing the interrelationships among (1) the regular functioning system operating normally, (2) the initial deviation from normal, (3) a failure to detect and correct the deviation, (4) subsequent conditions and events leading to the harmful event, and (5) post-incident events affecting the ultimate outcome. A discussion of human error in chapter 10 presents some attempts at classifying errors and an approach for thinking strategically about reducing errors. Lessons may be learned from investigating incidents involving human error by digging deep enough to understand the causes of the human error. The chapter emphasizes a classification system for unsafe acts (errors and rule violations) that OSH professionals can use to identify countermeasures for addressing the underlying cause of the error. Chapter 11 introduces the concept of “strategies” in the context of public health and occupational safety and health. After a brief review of some notable prior attempts to classify all risk-reduction strategies, a nine-category classification system is provided and briefly described. The nine strategies can be useful for a system design team while stepping through a risk assessment. The strategies fit neatly into a conventional three-level priority scheme—eliminate the hazard, use engineering controls, and use administrative controls. The extensive Learning Exercises provide readers an opportunity to appreciate how the strategies apply to specific OSH scenarios. Chapter 12 discusses several basic activities and programs that serve as foundations for OSH programs. It begins by pointing out that organizations have differing aspirations for their OSH program, and the aspiration level drives the organization's level of commitment to specific programs. The employee training topic is structured around a flowchart model of the training process that includes continuous improvement. The review of warnings addresses the pros and cons of devices based on sound, vibration, lights, and signs. The overview of safety devices introduces some common engineering approaches for ensuring that equipment failures do not immediately cause serious harm. Section 12.5 summarizes the value of and approaches to emergency planning and preparation. Section 12.6 summarizes the value of sanitation and housekeeping practices to workplace health and suggests that good sanitation and housekeeping practices contribute to employee health and safety culture. Chapter 13 discusses three managerial topics important to OSH professionals. It begins with the much discussed topics of safety culture and safety climate. Efforts to assess the safety culture of

organizations have led to employee survey instruments for determining factors that influence safety climate within the organization surveyed. Because the results of numerous surveys of employees in diverse industries have produced varied conclusions about which factors influence safety climate, the author expresses support for developing and validating industry-specific survey instruments. Occupational health and safety management systems are illustrated by explaining key processes found in an American standard. Section 13.3 discusses ethical policies relevant to professionals in the OSH specialties. The author encourages taking a proactive approach to OSH ethics.

Learning Exercises 1. Explain the distinction between safety culture and safety climate.

2. A multinational company decides to upgrade its current OHSMS by following the ANSI standard discussed in the chapter. During initial planning, the team members seem confused about the difference between inspections and audits. If you were on the team, how would you explain the distinction? 3. Explain the difference between a proactive and a reactive approach to professional ethics. 4. Assume a recent college graduate is hired for an industrial hygiene position. After completing her first monitoring assignment, she writes a report. The senior industrial hygienist she works for reviews the report and annotates many changes. Some relate to recommendations in the draft, where the boss changes language stating that certain controls “shall” be implemented to less demanding words such as “could” and “recommended.” The new IH is offended by all the changes and considers her professionalism violated because she is not being allowed to work autonomously. Discuss the issues in terms of professional ethics.

Technical Terms Continuous improvement

An organizational practice for improving processes through regular cycles of performance measurement, evaluation of findings, and correction of weaknesses.

Continuous improvement loops

Periodic reviews of processes for evaluating past performance, assessing, planning, and implementing improvements.

Safety climate The perceptions, attitudes, and beliefs of people at all levels of an organization regarding occupational safety and health practices.

Safety culture The pervasive values and actions of people at all levels of an organization regarding occupational safety and health.

Appendix: Example Code of Professional Conduct The following is quoted, with permission, from the BCPE. The code is accessible from http://www.bcpe.org/page/codeofethics.

Code of Ethics and Professional Conduct The BCPE is dedicated to protect the consumer of ergonomists' professional services by (a) establishing, promoting, and revising as necessary standards that reflect the qualifications for the professional practice of ergonomics; (b) establishing procedures for the evaluation of the credentials

of those who voluntarily apply for certification by the BCPE, causing the issuance of a certificate to those who have qualified, in the sole judgment of the BCPE, as having met the standards established by the BCPE; (c) maintaining and disseminating a directory of certificate holders on a regular basis; and (d) advancing the field as well as the practice of ergonomics. To promote and sustain the highest levels of professional and scientific performance by its certificate holders, BCPE has adopted this code of ethics. Certificate holders shall, in their professional ergonomics activities, sustain and advance the integrity, honor, and prestige of the ergonomics profession by adherence to the following principles (Adopted May 4, 2002):

Principle 1 BCPE certificate holders shall practice their profession following recognized scientific principles and practices. The lives, health, and well-being of people depend upon their professional judgment. They are obligated to protect the health and well-being of the public.

Principle 2 BCPE certificate holders shall be honest, fair, and impartial. They shall act with responsibility and integrity in all professional actions. They shall adhere to high standards of ethical conduct with balanced care for the interests of the public, employers, clients, employees, colleagues, and the ergonomics profession. They shall avoid all conduct or practice that is likely to discredit the profession or deceive the public.

Principle 3 BCPE certificate holders shall undertake assignments only when qualified by education or experience in the specific technical fields involved. They shall accept responsibility for their continued professional development by acquiring and maintaining competence through continuing education, experience, and professional training.

Principle 4 BCPE certificate holders shall avoid deceptive acts that falsify or misrepresent their academic or professional qualifications. They shall not misrepresent or exaggerate their degree of responsibility in, or for, the subject matter of prior assignments. They shall not misrepresent pertinent facts concerning employers, employees, associates, or past accomplishments.

Principle 5 BCPE certificate holders shall conduct their professional relations by the highest standards of integrity and avoid compromise of their professional judgment by conflicts of interest.

Principle 6 BCPE certificate holders shall act in a manner free of bias with regard to religion, ethnicity, gender, age, national origin, or disability.

Principle 7 BCPE certificate holders shall keep confidential personal and business information obtained during the conduct of their services, except when required by law.

Principle 8 BCPE certificate holders shall seek opportunities to offer constructive service in civic affairs and work for the advancement of the safety, health, and well-being of their community and their profession by sharing their knowledge and skills.

References

1. DeJoy DM, Schaffer BS, Wilson MG, Vandenberg RJ, Butts MM. Creating safer workplaces: Assessing the determinants and roles of safety climate. J Safety Research. 2004;35(1): 81–90. 2. Seo D-C, Torabi MR, Blair EH, Ellis NT. A cross-validation of safety climate scale using confirmatory factor analytic approach. J Safety Research. 2004;35(4): 427–445.

3. Salminen S, Sepplsquällsquä A. Safety climate in Finnish- and Swedish-speaking companies. International J Occupational Safety Ergonomics. 2005;11(4): 389–397. 4. O'Toole M, Nalbone D. Safety perception surveys: What to ask, how to analyze. Professional Safety. 2011;56(6): 50–62. 5. Shannon HS, Norman GR. Deriving the factor structure of safety climate scales. Safety Science. 2009;47(3): 327–329. 6. Turnberg W, Daniell W. Evaluation of a healthcare safety climate measurement tool. J Safety Research. 2008;39(6): 563–568. 7. Boraiko C, Beardsley T, Wright E. Accident investigation: One element of an effective culture. Professional Safety. 2008;53(9): 26–29. 8. Long RL, Briant VS. Vigilance required: Lessons for creating a strong nuclear culture. J System Safety. 1999;35(4): 31–34. 9. Manuele FA. ANSI/AIHA Z10–2005: The new benchmark for safety management systems. Professional Safety. 2006;51(2): 25–33. 10. ANSI Z10, Committee. Occupational health and safety management systems: ANSI/AIHA Z10- 2005. Fairfax, VA: American Industrial Hygiene Association; 2005. 11. Manuele, FA., Advanced safety management: Focusing on Z10 and serious injury prevention. Hoboken, NJ: Wiley; 2008. 12. Adams, EE., Total quality safety management—An introduction. Des Plains, IL: American Society of Safety Engineers; 1995. p. 3–7. 13. Goetsch, DL., Occupational safety and health for technologists, engineers, and managers, 7th ed. Upper Saddle River, NJ: Prentice Hall; 2010. p. 593–605. 14. Drucker, PF., Management: Tasks, responsibilities, practices. London: Harper & Row; 1974. p. 366–369. Part IV Risk Reduction for Energy Sources We come now to a turning point in the book. Parts I–III dealt with some concepts used throughout the book, various systematic analysis methods, and tools for managing OSH programs. Parts IV and V provide chapters on the seven hazard sources introduced in chapter 2—forms of energy, weather or geological events, conditions, chemical substances, biological agents, musculoskeletal stressors, and the violent actions of people, with numerous examples to illustrate how the nine strategies introduced in chapter 11 apply to the hazard sources. Part IV discusses the first two of the seven categories of hazard sources Because energy takes many forms, eight chapters are devoted to that hazard source and one is for weather and geological events. The chapters are on kinetic energy, electrical energy, acoustic energy and vibration, thermal energy, fires, explosions, pressure, electromagnetic energy, and severe weather and geological events. Hazards that develop from two or more energy transformations are classified based on the energy category most proximal to the threatened harm. Each of the energy chapters has a review of the basic physics of the energy source, followed by a discussion or the mechanisms by which the energy can harm people, property, or environment. The

third section in each chapter presents numerous examples of accepted practices for reducing the risks associated with the hazardous energy using the nine strategies. Chapter 14

Kinetic Energy Hazards

Energy comes in many forms. We rely on various forms of energy for our daily living and for making industrial production possible. This chapter begins with a brief review of energy in general before getting into the main topic—kinetic energy (KE).

14.1 Energy in General To understand energy, we first need to distinguish among three concepts—energy, work, and power.

Energy refers to the ability to do work. Work is using a force to move something.1 To measure work, we need to know the amount

of force used and the distance of the movement. If you were to push with all your might on a solid wall, the wall would not move. Although you would accomplish zero work, you would use some of your metabolic energy trying.

Power refers to the rate of work. Expressing power quantitatively involves quantifying work per unit of time.

Energy in an inactive state is potential energy. It has potential to perform work, but it is currently dormant. For example, a load held by a crane has the potential to slip from the rigging and fall to a lower level. The gravitational potential energy of the elevated load transforms into an active state during a fall. A projectile in motion also illustrates active kinetic energy. Energy often changes from one form to another. A basic scientific law says that within a closed system, when energy is transformed, the total amount of energy before the transformation equals the total energy after the transformation. Known as the Law of Energy Conservation (or First Law of Thermodynamics), it tells us that energy is neither created nor destroyed, but only changes form.1 Forms of energy do not always fit neatly into distinguishable categories. To illustrate how varying perspectives can lead to fuzzy lines between categories, consider two examples. First, the distinction between kinetic energy and electrical energy is generally accepted. However, a physicist may point out that the electrical energy exists because of electrons moving within the copper wires of an electrical circuit; thus, the motion of the electrons may logically be used to classify this as kinetic energy. Of course, this is the perspective of neither the general public nor the OSH community. Second, sound energy is the motion of atoms in the air, so one might logically argue that sound energy is a form of kinetic energy. Again, the OSH community thinks of sound energy as belonging to a separate category. For this book, the energy category most directly threatening harm is the category used for discussion. Two examples may clarify the point. First, when cooking a meal using an electric stove, the heat of the heating elements is the hazard source most directly threatening to burn the skin if

touched. The same hazard could arguably be categorized as an electrical hazard because the heat is created by passing electric current through the heating element that offers resistance, causing the electrical energy to transform to heat energy. Because the most direct threat of injury is a burn, not the threat of electric current passing through the cook's body, the thermal energy category is used. As a second example, consider that a boulder high on a mountain has gravitational energy. While sitting there, it is doing no harm. If it dislodges and rolls downward, it will transform the potential energy into kinetic energy. In the form of kinetic energy, the boulder can become a proximate cause of harm to whatever is in its path, so the source of the hazard is the kinetic energy of the boulder. Using this same rationale, gravitational energy is discussed in this chapter. Figure 14.1 provides a visual perspective for appreciating energy as part of a sequence of events leading to a harmful event. The graphic, previously introduced in chapter 9, depicts the during-event phase of a harmful event. This phase has an initiating event, leading to intermediate events, leading to the harmful event. Figure 14.1 Place of varying proximal events in chain of events.

The graphic can be useful both retrospectively for understanding past incidents and prospectively

for visualizing sources of energy that pose risk of harm in the future. The ability to envision potential harm facilitates the development of strategies and tactics for reducing the risks associated with the energy source. Throughout this chapter, strategies and tactics are presented for (1) avoiding an initiating event by eliminating the hazard source or keeping the operating system in a normal state; (2) if an initiating event occurs, interrupting the sequence of events by blocking or moderating the hazardous energy; and (3) mitigating the severity of harm by using PPE.

14.2 Background on Kinetic Energy The energy of an object in motion is known as kinetic energy. Every discussion of KE begins with the contribution of Isaac Newton. Just after completing his bachelor's degree in 1665 at Trinity College, Cambridge, he was planning to continue with graduate studies. But a plague forced school officials to close the campus. While living at home for two years, Isaac developed the binomial theorem, differential calculus, the law of gravity, and an understanding of objects in motion. On the topic of objects in motion, he synthesized the contributions of other scientists into three interrelated statements. When school reopened, he returned to college and completed his master's degree in 1668. Newton's brilliant developments were so impressive that Isaac Barrow, the Professor of Mathematics at Trinity, resigned his position to make a place for Newton. At age 26, Newton became the Professor of Mathematics at Trinity College, and he did all this without a slide rule, hand calculator, personal computer, or Internet access!

14.2.1 Newton's Laws of Motion

Newton's Laws of Motion are an essential starting point for understanding the processes by which KE causes harm. Newton's three laws are as follows:1

First law. A body remains at rest or continues to move in a straight line with uniform velocity if there is no unbalanced force acting on it.

Second Law. An unbalanced force acting on a body will cause that body to accelerate in the direction of the force with an acceleration inversely proportional to the mass of the body. Today, the equation for the Second Law is a = F/m, or more commonly F = ma, where a is the acceleration vector, F is the vector sum of all forces acting on the object, and m is the mass of the object.

Third Law. For every action there is an equal and opposite reaction. The terms action and reaction are vector forces. The force diagram for floor friction (Figure 14.2) illustrates this law with the downward force of the object weight against the floor being opposed by the reactive force of the floor upward against the object.

Figure 14.2 Free-body diagram of floor friction to illustrate Newton's Third Law of Motion.

Building on Newton's Laws of Motion, other scientists developed additional laws and principles that provide the basis for much of engineering, especially mechanical and civil engineering. First, we will look at the Law of Energy Conservation and Law of Conservation of Momentum in the context of objects moving.

14.2.2 Law of Energy Conservation A moving object possesses kinetic energy. The KE of an object moving in a straight path may be expressed mathematically in terms of its velocity (v) and mass (m) as follows. (14.1) When a moving object hits a stationary object, the KE of the moving object is not lost—it is preserved in multiple forms. Some of the energy is transformed into heat energy added to each object. Another part is transferred to the stationary object by giving it movement and KE. The object that was moving may retain part of the original KE. According to the Law of Energy Conservation, the pre-impact KE will equal the sum of post-impact energies within the closed system. Part of the post-impact energy will go to deforming one or both objects, as well as to heat energy taken up by each of the objects. The impact takes a brief time (Δt) to complete. Afterward, each object has a different energy than before the impact. The post-impact

energy within the system consists of the heat energy gained by each object and the post-impact KE of each object.

14.2.3 Law of Conservation of Momentum To understand more about how impacts cause harm, we turn to the Law of Conservation of Momentum.2,3 In addition to KE, a moving object has a property known as momentum. The momentum of an object is the product of its mass and velocity: (14.2) Thus, for a given object, momentum increases directly with velocity. Think of the difference between tossing a bullet at a target and shooting the bullet with a pistol. Although the mass of the moving object is the same in both scenarios, the bullet fired from the pistol will have more momentum and therefore much greater effect on the target. Similarly, for two objects moving at the same velocity, the one with greater mass will have more momentum. According to the Law of Conservation of Momentum, when two objects collide, the momentum before the impact will equal the momentum after the impact. In OSH, the common case involves a moving object hitting a stationary object. In that instance, the pre-impact momentum of the moving object will be distributed between the two objects so that the post-impact momentum of the two objects will equal the pre-impact momentum of the one object. The change in momentum (ΔM) occurs during the brief time period (Δt) from initial contact to completion of the momentum exchange. If we assume for the sake of simplification that the force (F) acting on the impacted body is constant during Δt, we can use the following equation to determine change in momentum: (14.3) Even if the force is not constant, we can obtain a fair approximation of ΔM by using the average force during Δt.

14.2.4 Rotational Motion Thus far the discussion of kinetic energy has focused on linear motion. Rotary motion is also important in OSH. For example, the rotating blade of a circular saw contains kinetic energy. When it cuts a board, some of that energy is used to break apart the wood fibers. Motors create rotation in a shaft that can be linked with gears, belts, and other power transmission devices to provide useful energy for moving other machine components. The flywheel on a mechanical power press stores rotational energy for use when a press stroke is actuated. When saw blades, shafts, flywheels, and similar devices are rotating, they possess kinetic energy. The equations are more complex than those for linear motion and unnecessary to develop here. Suffice to say that rotational motion also behaves according to Law of Energy Conservation and Law of Conservation of Momentum.

14.2.5 Potential Kinetic Energy In the practice of OSH, the potential form of kinetic energy is important. An object sitting on the top shelf of a tall storage rack has a kind of potential kinetic energy known as gravitational energy. The energy is normally controlled by the support from the storage rack. If a forklift on the other side of the storage rack happens to collide with the rack, the entire rack may respond by wobbling. The wobbling could cause the object on the top shelf to slide off and fall. During the fall, the original gravitational energy transitions from potential state to active kinetic energy. When the falling object

hits the floor, the kinetic energy will again be transferred according to the Law of Energy Conservation. Gravitational energy plays a key role in many occupational injuries and fatalities. Many injuries result from falling objects hitting people and others result from persons falling. The OSH professional should understand the basic physics model for gravitational potential energy (PEG). Think of a base level such as a floor and an object positioned at a higher level. The initial potential energy of the object is a function of its mass (m), the downward pull of gravity (g), and the distance it could fall. The potential fall distance (Δd) is the difference between the initial elevation and the base elevation. The equation relating these variables is (14.4) What this equation tells us is quite intuitive. For a particular object, the mass does not vary. The pull of gravity is very close to constant anywhere on the surface of Earth, with a value of 9.8 m/s. Therefore, the level of energy, PEG, varies directly with the fall distance. Another form of potential kinetic energy involves elastic materials. An object with elastic properties may be stretched or compressed a little out of its resting state. The household rubber band exemplifies the concept of storing energy after being stretched. Springs are available commercially for applications involving stretching or compressing. A spring made for stretching is useful for applications where the engineer wants a pulling force between the two ends of the spring. A spring made for compressing is useful for applications where the engineer wants a pushing force between the two ends of the spring. In these cases, the amount of force exerted by the spring is directly related to the length of the deformation (x) and a constant unique to the spring or other elastic material (k). Thus, F = kx. The potential energy of a spring (PESprg) is (14.5) This equation applies while the spring is within its elastic range. Once stretched excessively, the spring will not perform according to the equations for springs.

14.3 Mechanisms of Harming Many occupational injuries and fatalities result from kinetic energy, especially impacts. While impacts transfer kinetic energy during a very brief period, numerous other occupational injuries and fatalities result from kinetic energy transfers that occur more slowly. For example, body parts can get crushed when caught in or between objects. This section explains the relationship between kinetic energy and occupational injuries and fatalities. Kinetic energy transferred to humans accounts for many occupational injuries and fatalities. The injuries are diverse, but common ones are punctures of the skin or eyes, lacerations, broken bones, spinal injuries, and brain damage such as concussions. Because the body parts harmed may involve muscles and bones, we may be tempted to classify some of these injuries as musculoskeletal injuries. However, classifications based on the source of injury, rather than the result of injury, provide more fruitful opportunities for risk reduction. Occupational injuries resulting from impacts and slower transfers of kinetic energy account for a large portion of costs. An indication of the relative importance of these various kinetic energy injuries is shown in Table 14.1. It lists the major categories of event types proximal to injuries. The injuries within the data set are based on work-related injuries for which workers' compensation claims were filed and approved. The second column indicates the percentage of costs associated with

each event as reported by workers' compensation insurers in 2007. The largest portion of total cost was for falls on the same level. Second on the list were injuries due to an employee falling from a higher to a lower level. Chapter 23 provides in-depth discussion of conditions related to falls on floors and stairways, so the present chapter omits repetition of that material. Other categories listed in Table 14.1 are persons being struck by objects, striking an object, being caught between objects, and highway incidents. Table 14.1 Kinetic Energy Injuries: Percentage of Costs by Type of Event. Event categories Percentage of costs Falls on same level 14.6 Falls to lower level 11.7 Struck by object 9.0 Highway incident 4.7 Caught in/compressed by 3.9 Struck against object 3.8 Total 47.7 Data from Liberty Mutual Research Institute for Safety based on costs for workers' compensation cases in the United States in 2007 (www.libertymutual.com/researchinstitute). Being caught between objects includes some cases involving KE and KE in combination with other forms of energy. For example, when a worker gets caught between a wall and a piece of mobile equipment, the energy exchanged involves both the kinetic energy of the equipment moving and the energy from the motor driving the movement. The highway incident category encompasses vehicle collisions, rollovers, and other roadway incidents. The highway incident category differs from the other categories in that it is not based on the most proximal event. To understand this category, think of a model with two proximal event—a vehicle collision followed very quickly by the occupant impacting objects within the interior of the vehicle. The more proximal of these two events is the person impacting an object inside the vehicle, so coding these injuries as struck against injuries would be consistent with other kinetic energy injuries. But for workers' compensation, such detail is not on the claim form. Therefore, the practical alternative is to simply classify these impact injuries in the broad category for highway incidents. The categories in Table 14.1 are based on one of several recordkeeping schemes used in workers' compensation systems.4 The category for “event or exposure” reflects a single event or exposure most directly producing the harm. It may be called the proximate event or proximal exposure. For kinetic energy injuries, human injury results from the proximal event transferring to the humans more energy than can be safely tolerated. Many of the commonly used protective devices use the technical information discussed in this chapter. Consider two examples. First, what happens when a bricklayer working on a scaffold drops a brick and another worker below is unfortunate enough to be directly in the path of the falling brick? We can compare the effect of wearing a hard hat versus not wearing one using the physics of impacts. In either case, a large portion of the pre-impact momentum will be transferred to the head and a smaller portion will be retained by the brick as it deflects off. Thus, we can assume that ΔM will be the same whether the employee is wearing or not wearing the hard hat. However, the duration of impact when no hard hat is worn will be very brief, starting when the brick makes initial contact with the scalp and ending when the skull bones stop the brick from further penetrating the head and the brick falls away. For the employee wearing a hard hat, the shell of the hard hat will take the initial impact. A bit of time will pass as the shell descends and transfers some of

the energy to the suspension system. The total time from initial impact of the brick on the shell until the brick loses contact with the shell will be longer because the time for the hard hat equipment to deform will be longer than the time for the skull to deform. From Equation 14.3, we see that for the same ΔM, a longer Δt will involve a smaller average force. Thus, one benefit of the hard hat was reducing the average force on the skull from the impact. Another benefit of a hard hat comes into play when the shell reaches its lowest point. When the impact is within the design parameters of the hard hat, there should be some air between the shell and skull due to the suspension system slowing down the shell's descent to zero before it reaches the skull. However, in more powerful impacts, the shell will be driven by the impact into contact with the skull. In either case, the hard hat mitigates the harm from the impact by distributing the forces to a broader surface area on the head. That reduces the force per unit area, which in turn reduces the harm to the skull. In addition, the suspension system consists of stretchable materials that take up some of the initial kinetic energy of the falling brick. This reduces the energy transferred to the head. This, in turn, reduces the load transmitted to the cervical spine, thereby reducing the risk of spinal injury. The second example of how understanding the physics of mechanical energy can help us understand the mechanisms of kinetic energy injuries is the case of an employee falling. Whenever a person falls from a higher to a lower elevation, the event is classified as a “fall from elevation.” Based on the physics involved, the mass of the person has potential gravitational energy as expressed in Equation 14.4 (PEG = mgΔd). While working at the elevated level, the potential energy is controlled by the work surface under the worker's center of gravity. If for some reason the center of gravity shifts outside the work surface, control is lost and the person begins to fall. During the fall, the gravitational energy transitions into kinetic energy, and both KE and momentum increase as the fall progresses. The maxim “It's not the fall that hurts—it's the landing” accurately conveys the fact that no injury occurs until there is an impact with the lower surface. During the brief time of impact, the KE is distributed between the ground and the human body. If the ground is hard concrete, the impact duration will be extremely brief—almost all the energy goes to the human body in the form of deformation energy and great injury results. If the ground is a more forgiving material, such as loose soil, the impact time will be a bit longer, the deformation of the soil will take some of the energy, and the injury will be less because the force on the human body will be less (see Equation 14.3). An understanding of the physics of kinetic energy helps OSH professional comprehend how traumatic injuries occur and helps the PPE industry make protective equipment that provides workers with an effective last line of defense from impacts.

14.4 Strategies and Tactics for Kinetic Energy There are many methods for reducing risks of harm from kinetic energy. Table 14.2 lists the nine risk-reduction strategies in the left column. In the right column are tactics applicable to the corresponding strategy. The following discussion expands the abbreviated text in the table. Table 14.2 Strategies and Tactics for Reducing the Risks of Kinetic Energy. Risk-reduction strategy Risk-reduction tactics

1. Eliminate the hazard 1a. Eliminate KE by keeping objects stationary by securing in place or locating where movement is prevented 1b. Eliminate KE by bringing a moving object to zero velocity 1c. Eliminate gravitational energy by performing work at ground level rather than at elevation or bringing an elevated object to ground

1d. Eliminate potential energy of a spring by returning it to its neutral length 2. Moderate the hazard 2a. Use no more velocity than needed

2b. Replace hard object with softer object 2c. Lengthen duration of impact (Δt) to reduce the average force (F) during impact 2d. Increase impact area to reduce force per square meter

3. Avoid releasing the hazard 3a. Avoid moving object hitting another object 3b. Avoid moving object hitting a person 3c. Avoid letting an object or person with gravitational energy fall

4. Modify release of the hazard

4a. Control rate of release of gravitational energy

4b. Control direction of the released object or material 5. Separate the hazard from that needing protection

5a. Place a barrier on or around that needing protection from impact

5b. Design workplaces to separate areas for moving objects from areas used by people 5c. Design tasks to ensure people are located a safe distance from moving objects 5d. Design operations to separate by time the co-location of a hazardous moving object and people

6. Improve the resistance of that needing protection

6a. Design and build the housing of instruments and equipment to withstand foreseeable impacts

6b. Design and build parts and components of instruments and equipment to withstand foreseeable accelerations resulting from impacts

7. Help people perform safely 7a. Use knowledge from ergonomics to design the operator–machine interfaces to minimize errors 7b. Design highways with clear lane identification to reduce the information processing load on the drivers 7c. Provide safety signs made to reflect the best available attributes supported by research 7d. Provide appropriate safety training for personnel who operate the organization's vehicles and heavy equipment

8. Use personal protective equipment

8a. Have employees wear impact-resistant PPE to protect body parts

8b. Have employees who are at risk of falling from heights use personal fall protection system to limit distance person can fall and avoid impact with surface at lower level

9. Expedite recovery 9a. Be prepared to help employee injured by a fall 9b. Be prepared to transport injured employee to medical facility

Eliminating the hazards is always the first strategy to consider. KE will be eliminated if stationary objects are prevented from moving laterally or falling downward. Some examples are as follows:

When preparing to haul cargo on a flatbed truck trailer, straps and other devices are used to secure it, so it will not get blown off by the wind or a rapid evasive maneuver on the roadway, which would present a KE hazard to other motorists.

When compressed gas cylinders can become torpedo-like projectiles if an upright cylinder falls breaking off the stem and allowing the gas to release through the opening. Such events are eliminated when the cylinders are stored properly (i.e., upright, with the cap in place, and secured to solid objects).

Gravitational energy can be eliminated by performing work at ground level rather than at elevation. For example, some welding tasks on building frames and bridges traditionally performed by structural ironworkers at elevation can be changed so that the work is performed at the ground level. A crane is then used to lift and position the structural assembly into place. Storing a heavy object on the floor instead of on a shelf eliminates the chance of it falling off. Bringing a moving object to zero velocity is another way to eliminate KE. The fail-passive

engineering devices use this tactic for many applications, including rotary power saws and lawn mowers. When the operator releases the actuator, the rotary motion is quickly stopped. Bringing a stretched or compressed spring to its neutral position is another way to eliminate KE. A standard step taken by maintenance workers before starting a maintenance task is to identify and control all sources of energy that might be threats during the task. When springs are involved, allowing them to return to a neutral length eliminates the hazard. For situations where eliminating the potential energy of a spring is not feasible, the spring may be physically blocked to avoid releasing the hazard (Strategy 3). The workers ensure effectiveness of the block by applying a lockout mechanism supplemented by a tag to inform anyone who might come along that the lock is intentional and must not be removed. The second strategy is to moderate the hazard. One tactic for moderating the hazards of KE, PEG, or PESprg is to reduce the velocity of the moving object so that the impact force will be less. A second general tactic is to modify the object before it becomes mobile by changing attributes such a hardness, weight, and sharp edges. A third tactic is to modify the impact to either extend the duration of contact or increase the contact area to reduce the force per square meter. Strategy 3 is to avoid releasing the hazard. When the hazardous energy is KE, the energy is released through deceleration, and the deceleration of primary concern in OSH is a harmful impact. A gradual deceleration is, in general, not harmful. Thus, the method for avoiding release of KE is to avoid a harmful impact. Five examples are as follows:

1. During roadwork, passing vehicles have KE. Traffic flow channeling provides a technique to allow the vehicles to pass by the workers without impacts. 2. Workers using a scaffold for work occasionally drop a tool from a scaffold platform, putting personnel below at high risk. One common method for avoiding this is to tether the tool to something that will arrest the falling tool before it descends very far.5 A second method is to have a toeboard on the work platform to prevent tools and work materials from falling off when inadvertently kicked by a worker's boot. 3. A fall protection tactic for workers doing work at elevation (e.g., bridge or tall building construction) is to install safety nets below edges and holes where people might fall. Since velocity increases with distance fallen, the shorter fall distance to the net, versus to the ground, involves less velocity. After contacting the net, the person is gradually decelerated to a stop (average deceleration = initial velocity divided by Δt). Thus, the falling person benefits from less velocity and more gradual stopping. 4. On ships, trucks, trains, and planes, many objects and tools have a storage space made specifically to hold a particular item. For example, trucks typically have a specific space for the tools needed to change a tire, which avoids releasing the hazardous projectile during a minor to moderately intense collision (although in a very intense collision the tools might break loose). 5. When someone parks a wheeled vehicle on a slope, it has potential energy. The event of the parked vehicle rolling downhill is eliminated by the combination of setting the parking brake, putting the vehicle in the proper gear for parking, and choking the wheels.

The fourth strategy is to modify release of the hazard. In the early days of elevators, there would occasionally be a rapid descent to the bottom, resulting in fatalities and various serious injuries. Modern elevators have multiple safety devices, one of which is a braking mechanism to limit the velocity of descent.

When an old roof needs replacing, the roofers pull off the old covering. To get the old materials down to a truck, the roofers generally set up a chute with a wide opening at the top and a channel leading down to the truck body. This channeling method keeps the released material under control, so it will not hit something or someone on the street level. The fifth strategy is to separate the hazard from that needing protection. An example is a long moving conveyor in a location between a work area and the restroom. Workers in a hurry are tempted to climb over or crawl under the conveyor, rather than taking extra time to walk around it. Rather than attempting to change the behavior of all the employees, the employer could construct a pedestrian bridge to allow workers to take the shortest route while maintaining separation from the moving conveyor. A common method for separating personnel from a hazard is to use barriers, guards, and fences. For example, in a building construction project, the path of crane movement is planned prior to performing lifts. The site authorities will order precautions such as designating the areas under the load path as no personnel locations and setting up portable barriers around the area. Posting signs warning personnel to stay out of the area adds to the reliability of the portable barriers by providing people hazard information so they will choose not to cross the barrier. This example also illustrates increasing the effectiveness of an engineering control (separating with a barrier) by also applying an administrative tactic (warning signs). In a warehouse with high storage shelves, forklift trucks are used to place and remove pallets of materials on the shelves. There is a recognized risk of material falling from higher shelves and hitting a forklift operator. A standard practice is to use forklift vehicles with falling object protective structures—an overhead barrier that separates the operator from falling materials. People and hazards may also be separated by time. This is the method used for some mechanical power presses (the positive-clutch type). The work cycle is arranged so the operator can reach to the point of operation only while the press ram is up. After loading the point of operation, the operator must retract both hands and use them to press a pair of actuator buttons to make the ram complete a stroke. When set up correctly, the operator's hands are separated from the point of operation during the part of the cycle when the ram is closing with tremendous KE and momentum. Improving the resistance of that needing protection (Strategy 6) is commonly used for equipment. The designers write specifications for the equipment housing that include foreseeable impacts; as a result, machine tools for use in manufacturing environments have heavy steel housings. Most laptop computers have housing with limited capability for impact protection. For some military needs, special portable computers called “ruggedized computers” are available. The specifications for these require capability to withstand impacts with a hard floor when dropped from a specified height. Not only is the housing impact resistant, their internal components are made to tolerate the rather severe decelerations that occur from impacts. The seventh strategy is to help people perform safely. An example might be a crane operator workspace with the best human engineering features to help the operator perform without errors, with precision, and within load capacity. For the large, heavy equipment used in the mining and construction industries, the operators need to climb to reach their cab. During these climbs, falls can be prevented by helping the climbers control their personal gravitational energy using well-designed stairs and short ladders with handrails or handholds located for convenient and effective grasping. Several types of PPE provide millions of workers a last line of defense from kinetic energy hazards. Perhaps the most prominent of these Strategy 8 devices are hard hats, which serve to mitigate

the harm of a falling object hitting a worker's head. Although manufacturers design hard hats to meet downward impact standards, the hats also provide some protection from low-energy side impacts. Most common industrial hard hats have a brim to provide some protection of the eyes and face from small falling objects. Underground miners wear a particular type of head protection known as bump caps. These protect the miner's head when it bumps a protrusion from the mine roof. Eye protection PPE offers considerable protection from projectiles traveling laterally. Older styles offered protection only from projectiles traveling directly toward the face. Experience proved that many eye injuries occur from objects reaching the eye from the side. This led to the availability of side-shield attachments to the old frames. Today, many safety glasses feature wrap around side protection, and they come in a wide range of sizes or adjustable features to accommodate different temple lengths and nose widths. The improved sizing, styling, and lighter weight of today's safety glasses help overcome the weaknesses of the older product and help employees tolerate wearing safety glasses for long periods (Strategy 7). Footwear with impact protection is used in many jobs where employees handle heavy objects that might drop on their feet. The common impact footwear covers the toes with a shield of steel or other material. Some offer metatarsal protection as well. Safety footwear, like eyewear, now comes in a variety of styles. The soles also come in diverse materials and patterns to meet the needs of workers in varied worksites. For many tasks performed at elevation, there are several methods for protection. One involves wearing a body harness connected by a lanyard to a secure object or lifeline located above the work area. If the worker falls, the lanyard will fully extend and stop the descending worker from a long fall. Like other kinds of PPE, effectiveness depends on workers using it at the proper time and in the proper manner. The ninth strategy involves rescue, first aid, other immediate responses, recovery, and rehabilitation. The discussion in the previous chapter explained the value of developing plans for a post-incident response. One consideration unique to KE is planning for rescuing a worker who fell and was saved by personal fall protection gear. If the rescue takes too long, the suspended person will suffer the ill effects of suspension trauma.

Learning Exercises 1. Suppose we closed all the colleges and universities in the world for two years.

a. Do you think a student somewhere in the world would spend the two years thinking like Newton did?

b. Do you think having access to the Internet would help or hinder such a thinking process?

c. What Bloom level (see chapter 1) did Newton use to develop his three laws?

2. Imagine you coach a track team. You have three athletes who compete in the shot put event. All three have good technique and achieve similar trajectory angles. One can put the shot farther than the others. Using the concepts of energy, work, and power, explain why he can outperform the others. 3. Consider two objects of equal mass moving in a straight line. Object A has a velocity of 4

m/s. Object B has half the energy of object A. What is the velocity of object B? 4. Two boxes are sitting on shelves. Each has a mass of 8 kg. The shelves supporting box A and box B are 3 and 2 m, respectively. Object A has more gravitational energy than object B. What is the ratio of their gravitational energies (A to B)? 5. A spring with k = 800 N/m is compressed by 0.05 m. What is the energy of the spring? Include in your answer the SI units of energy. 6. Suppose you are a close friend of a physicist. You happen to share with her some occupational injury data regarding falls. She comments that it seems silly to have two categories of falls (falls on the same level and falls from elevation). She points out that both occur due to losing control of gravitational energy, a descent, and an impact with the ground. She suggest it would be more logical to have one category called loss of gravitational support. How could you explain why having two categories is useful? 7. In this chapter, a dead-man actuator control is offered as an example of eliminating the hazard of KE by bringing velocity to zero. However, the KE is not eliminated instantly. There is a delay between releasing the actuator and when the motion stops. During this brief time (the after-reach time), what other strategies are used to protect the worker? 8. On the topic of tethering tools used on scaffolds and elevated platforms, attaching a tether to a railing of a guardrail is not recommended by the companies that make guardrails. Why do you think they object to this use of their railing?

Technical Terms Active state The state of some type of energy while doing work, in contrast to the potential state of being dormant

or inactive. Energy Ability to do work. Gravitational energy Potential kinetic energy of an object when located at a higher elevation than the base elevation. Kinetic energy (KE) Energy possessed by a moving object. Potential energy The state of some type of energy not actively doing work. Potential energy of a spring (PESprg)

Capability of a compressed or stretched spring to move something.

Power Rate of doing work. Work Moving an object by applying a force.

References

1. U.S. National Institute of Standards and, Technology. Fundamental concepts of force. Gaithersburg, MD: NIST. Available at http://www.nist.gov/mel/mmd/mf/whatis-force.cfm. 2. Hazen RM, Trefil, J. Science matters: Achieving scientific literacy, 2nd ed. New York: Anchor; 2009. p. 26–43. 3. Serway RA, Faughn JS, Vuille C, Bennett CA. College physics, 7th ed. Belmont CA: Thompson Brooks/Cole; 2006. p. 81–92. 4. Jensen RC. How to use workers' compensation data to identify high risk groups. In: Slote L, editor. Handbook for occupational safety and health. New York: Wiley; 1987. p. 364–403. 5. Salentine J. Tethering tools when working at heights. Professional Safety. 2011;56(9): 66–68.

Chapter 15

Electric Energy Hazards

Electrical energy is essential to modern business and very useful for daily living. From an OSH perspective, the electrical energy used in workplaces may be regarded as a hazard source made safe by using appropriate hazard controls. Failure of the controls can release electrical energy that can then cause harm. This chapter has three main sections. The first provides a general background on electrical energy, the second explains the means by which electricity can harm, and the third provides examples of strategies and tactics for reducing risks associated with electrical energy hazards. A related topic, the electromagnetic spectrum, is discussed in another chapter.

15.1 Electrical Energy as a Source of Hazard The major forms of electrical energy discussed in this section are static electricity, lightning, and electric current in circuits. The references of this chapter are well suited for OSH professionals seeking more insight into electrical hazards and safe practices.1–3

15.1.1 Static Electricity Static electricity involves a rapid transfer of electrons between dissimilar materials. This transfer creates heat, possibly enough to ignite fuels. Of particular concern for OSH professionals is the possible ignition of air containing fuel vapors or combustible dusts. Static electricity is a widely recognized hazard in an environment where flammable and combustible liquids are present.1 When these materials are flowing in pipes, they create areas where positively charged particles concentrate and other areas where negatively charged particles concentrate. Similarly, when a liquid fuel is poured from one container to another container, areas develop with different concentrations of charged particles. There comes a point at which the concentrations differ enough to generate a sudden transfer of the charged particles in the form of sparks. Another source is the rubber tires on vehicles. The vehicle body tends to develop an electrical potential different from the ground. A person standing on the ground will have a different charge than the vehicle body. If the person touches the vehicle body, at first contact a tiny spark will occur, resulting in a slight sensation for the person, and more important, heat that may be sufficient to ignite flammable vapors in the air.

15.1.2 Lightning Lightning is a sudden transfer of ions from one location to another. The common transfers are between a cloud and earth, two clouds, and one part of a cloud to another part of the same cloud. The cloud to earth strikes last less than 1 s, but create tremendous heat. Points on landmasses commonly hit by lightning are tall trees, mountain ridges, and buildings. Ship poles also get many hits. Damage at the sites hit results from the intense heat created as the ions transfer and from the shock wave created by the hot expanding air.

15.1.3 Electric Current in Circuits Electricity in electrical circuits is capable of harming people and igniting fires. The harm to people occurs via electric shock, burning of skin and internal tissue, and electrocution. The ignition aspects are generally associated with faulty wiring, which can cause arcs or hot components with potential to ignite flammable or combustible materials. To understand electrical safety, a person needs to understand the basics of circuits. The following explanation is provided to help readers who are not very familiar with the terms and properties of electrical circuits. The commonly used terms current, voltage, and resistance refer to the basic properties of circuits. The current (I) flowing in a circuit relates to voltage (V) potential and resistance (R) of the load according to Ohm's Law:

(15.1) Current is measured in amperes (A), voltage potential in volts (V), and resistance in ohms (Ω). The Ohm's Law equation may also be expressed in two alternative forms: V = IR or R = V/I. To illustrate these relationships, consider a simple circuit with a 6 V battery connected with copper wires to an appliance with a resistance of 3 Ω. Using Equation (15.1), the current flowing through the appliance may be computed as follows: I = V/R = 6 V/3 Ω = 2 A. A little thought tells us the current will increase if we lower the resistance. That fact explains why electric circuits use wires made of metals that have low resistance to electric current. Low resistance corresponds to high conductivity. The common metals for wires used in electric power distribution systems are copper and aluminum. More expensive materials, with almost no resistance, are known as superconductors. Also needing explanation are the concepts of electrical energy, work, and power. In the Système International (SI), joule (J) is the unit for electrical energy and various other types of energy. It expresses the ability of an electrical source to do work. Recall that the definition of work is using force to move something. In the case of electrical energy, the force comes from the voltage potential in a circuit, and it is used to move electrical charges from one place in a circuit to another. The SI unit of both electrical energy and work is the joule. This may not seem intuitive at first, but consider that since energy is the ability to do some amount of work, using that energy to do that amount of work logically uses the same unit of measurement. Electrical power is the time rate of doing work. Since work is in joules and the standard unit of time is second (s), the logical unit for power is J/s. However, the official SI unit of electrical power is watt (W), where 1 W equals 1 J/s. The watt is also used in the customary system of units used in the United States. Table 15.1 summarizes the units for energy, work, and power. Table 15.1 Important Terms of Electrical Power.

Another important property of electric current is the type of current flow—direct or alternating current. For a circuit supplied by a battery, the current flows in one direction and is called direct current (DC). Current is considered flowing from the positive terminal around the circuit and back to the negative terminal. For a circuit supplied by the power company, the current flows in alternating directions. Conceptually, think of the free electrons in the conducting wires following a cycle of shifting slightly to the right and then slightly to the left. The pattern repeats rapidly and the movement in each direction contributes equally to the work. In the United States, typical houses and businesses are supplied with alternating current (AC) cycling 60 times per second or 60 Hz. The application of Ohm's Law is straightforward for DC circuits. However, for AC circuits, the voltage and current follow constantly changing levels. If plotted against a time line, voltage changes according to a sine wave. The same is true of the current level. Thus, what value of voltage and amperage should be used for Ohm's Law calculations? To answer this, recognize that in each cycle both voltage and amperage have a peak value on the positive part of the sine wave and another peak on the negative side. Both positive and negative contribute to the work, so instead of treating one as adding and the other as subtracting, we treat both values as contributing equally. By doing so, the effective values may be determined mathematically in terms of the peak value. The effective voltage is 0.707 of the peak voltage and the effective current is 0.707 of the peak current. The electrical engineer or architect designing a circuit will use the effective voltage for Ohm's Law computations. Arc welding is a special application of electrical circuits. An arc welding machine creates a large voltage potential between the hot wire and the neutral wire. The neutral is connected to the metal to be heated (known as the “work”) and the hot wire connects the arc welding machine to an electrode. When the welder brings the electrode close enough to the work, an arc jumps across the gap. At that point, the potential electrical energy becomes active electrical energy as current flows across the gap. Much of the electrical energy is transformed into heat energy due to the high resistance of the air in the gap.

15.1.4 Electrical Power Supply and Usage The final part in the basics of electrical circuits is understanding the connection between AC electricity in the power lines and the electric circuits in buildings. The power company provides a line from its distribution network to each customer. Within the customer's premises, the supply line connects to a junction box that provides connections to each of the numerous circuits in the facility. Each circuit is designed and installed according to particular specifications for voltage and current. Receptacles are wired into the circuits to allow use of the electricity. Figure 15.1 illustrates the wiring

for a power tool plugged into a three-prong receptacle. Figure 15.1 Wiring for a power tool plugged into a three-prong receptacle.

When selling and buying electrical power, the kilowatt hour (kWh) is used. To illustrate how fees

are determined, consider a small business operating out of a rented office. Say the office used 20 A for 10 h, and the voltage supplied is 110 V. The power is calculated using the first equation for power (P = VI). Using the data, P = (110 V) (20 A) = 2400 W. Since the business used electric power for 10 h, it will owe the power company for using 2400 W (10 h) = 24 000 Wh. For convenience, the power companies prefer to sell power in 1000 W units, so the business will be charged for 24 kWh. Although electricity within an engineered electrical circuit can injure people and ignite fires, circuits designed and installed according to applicable codes present very little risk. However, not all electrical installations comply with codes. Common reasons include degraded or damaged original equipment and electrical usage that exceeds the original design specifications. In industrial facilities, while process changes are in the planning stage, a person with electrical expertise should check the proposed changes to make sure the circuits are adequate for the process needs. This is the standard practice for organizations with a management of change program.

15.2 Mechanisms of Harming Through numerous mechanisms, electrical energy can damage electronic equipment, harm people, and provide the heat to ignite a fire.

15.2.1 Damage to Electronic Equipment Many electronic devices are designed to use direct current. Their internal components would be ruined if connected to AC circuit. Because electricity supplied by the power company and distributed throughout our structures is AC, the current must be changed to DC before it enters electronic devices. This is accomplished by an AC adapter. It may be inside the housing of the electronic device or located external to the device. The externally located adapter is typically in a black box found between the power cord from the wall socket and the second power cord to the device. Adapters not only convert AC to DC, but they also protect the internal components by outputting the direct current at a voltage level matched to the device. The adapters may be thought of as a safety device for the electronic equipment. Another cause of damage to electronic equipment is the occasional power surge, which may result

from a lightning strike somewhere along the distribution lines serving the facility. The commonly used surge protectors are safety devices for moderating the excessive power before it reaches the electronic device.

15.2.2 Harm to People The primary threat to humans is current in electrical circuits. Our entire nervous system functions by using electrical current. If current from an external source enters the body, it overwhelms the healthy functioning of the nervous system. In some circumstances, the external electricity will cause muscles to grip relentlessly—many people have reported being unable to let go of current carrying items such as power tools and aluminum ladders. In other circumstances, the electric current passes through the heart. The heart muscles, which normally contract rhythmically, can be so disrupted as to cease coordinated contractions and begin convulsing in an ineffective manner known as fibrillation. When in fibrillation, the heart no longer pumps blood through the normal distribution system. The effects are devastating. The fibrillating heart muscles need a lot of fresh oxygen, but fail to get it, resulting in permanent damage. Other body muscles and the brain also fail to get the oxygen they need. In some instances, current entering the chest causes the diaphragm to tense up, stopping respiration and leading to asphyxiation. Current flowing through one or more body parts can also cause the tissue temperature to rise rapidly, resulting in burning of the tissue. The relationship between the level of current and the resulting health effects is complicated by multiple factors, including duration of contact with the current, body parts through which the current flows, skin wetness, gender, and frequency. Nevertheless, some general guidelines are available regarding expected health effects at various levels of AC current at a frequency of 60 Hz. The guidelines listed below indicate what to expect for contact with current at various levels, expressed in milliamperes (mA).

≤1 mA, no sensation >3 mA, painful shock >5 to 20 mA, muscle spasms <20 mA, not fatal 20 to 75 mA, sometimes fatal, especially as exposure time lengthens >75 to 300 mA, usually fatal

These exposure–effect data have two implications. First, all effects noted above occur with less than 1 A of current. The ordinary electric circuits in houses and industrial buildings have a circuit breaker or fuse at the junction box for automatically opening the circuit if current exceeds the circuit capacity. A circuit designed for 15 A will have a 15 A fuse or breaker and copper wiring sized to carry 15 A of current without appreciably heating up. If appliances and other loads supplied by the circuit draw more than 15 A, the fuse will blow or the breaker will open. This will prevent heat building up in the wires, which in turn will protect the circuit materials and prevent ignition of a fire. As useful as these devices are for protecting the circuit, they are not designed to protect a person who contacts the current. A person contacting the current in certain ways could get as much as 15 A passing through their body—at levels that far exceed the range from >75 to 300 mA that is associated with fatalities. The second implication of the exposure–effect data concerns protection of people. As indicated, current levels of 5 mA or less are below the levels known to cause death or muscle spasms. To set a threshold for acceptable current level is complicated, but we can say that keeping exposures less than

5 mA should neither kill anyone nor cause muscle spasms that prevent letting go. The 5 mA level has been adopted for the design of a type of safety device known as a ground-fault circuit interrupter (GFCI). When a GFCI is incorporated into an AC circuit, it monitors the system for equal current flowing in the hot wire and the neutral wire. The two currents should be the same. If the difference between the current in the hot wire and that in the neutral wire starts to exceed 5 mA, the device causes the circuit to open and cease conducting current. The response takes only 1 ms. Why might the currents differ? Most likely, there is a leak, or short, somewhere in the circuit. It means the current has found an unwanted pathway out of the proper circuitry. A person contacting an item in that path can provide a path to ground. Often, that item is a power tool in which a path between the circuit wires and the tool housing allows some current to energize the tool housing. When the person holding the tool housing squeezes the actuator switch, current can flow from the hot wire to the housing, through the hand, through the arm, through the chest, down through a leg, and into the ground. With a GFCI in the circuit, the loss of current will be detected. If the loss exceeds 5 mA, the circuit will rapidly open. The person will feel a shock but not suffer any lasting harm. Without the GFCI in the circuit, the person could be exposed to a harmful level of current. In addition to the above discussion on harm to people from the current in electrical circuits, lightning can harm people and property. Lightning bolts from cloud to cloud and within a cloud can damage airplanes, but the major concern for OSH is damage to people and property. Property not protected by lightning rods or similar devices is vulnerable to being struck. If struck, the heat can start the structure on fire, destroy electronic equipment, and electrocute personnel. For example, people have been electrocuted while bathing or showering since the lightning current tends to follow a path through water pipes leading to the ground. Likewise, people are advised not to use landline telephones during a lightning storm because the phone line provides a path to the ground. Personnel working outdoors are at risk of being struck. Lightning can deliver immediate death to a person hit directly or nearly hit. Even if the person is not killed, his or her hearing can be permanently damaged from the extremely loud burst of acoustic energy. Personnel working outdoors can be electrocuted if their body becomes a path for current to flow to the ground. The person may be touching a piece of heavy equipment when it gets hit by lightning or when it comes into contact with a power line—an event that occurs much too often with equipment that can be extended vertically, such as cranes.

15.2.3 Ignition of Unwanted Fire The last means by which electrical energy can cause harm involves ignition. An active electrical circuit can create heat that, in some circumstance, can ignite fuel. One way is if the load on a circuit is too much for the wiring. This is avoidable if the circuit has a properly sized circuit breaker or fuse. However, sometimes people get tired of a circuit shutting down frequently. Instead of having it fixed or replaced by an electrician, they choose to replace the fuse with one having higher capacity. Thus, a 15 A fuse might be replaced by a 20 A fuse, allowing more current than the wiring was designed to handle. Now the wires may be loaded with up to 20 A. The wires are too small to shed the heat generated by the current, so heat will build up in the wires. This scenario is the cause of many home fires because in older homes the circuits were designed for fewer appliances than we use today, and the wires run through wall spaces where accumulations of flammable and combustible materials may be present. A second ignition concern is with electric arcs. These occur when an active circuit is switched off. Although these small arcs are usually out of sight, one can perform a simple experiment to see one.

Arcs are visible when you unplug an active appliance. For example, if a clothes iron or lamp is plugged in and turned on, you can see an arc by dimming the room lights and pulling the plug. The arc will appear as a blue light between the wall socket and the prongs of the cord. The light is caused by current jumping across the small air gap separating the two conductors. It is essentially a tiny version of the arc created deliberately when performing electric arc welding. The little experiment mentioned should be tried only in an environment where the air is free of flammable vapors; as a rule, the safe practice is to prevent these arcs by using the appliance power switch to turn it off before pulling the plug. The sparks developed by static electricity are another ignition source. The major concern for static electricity is when the environment might contain flammable vapors within the flammable range. A two-pronged prevention strategy involves (1) limiting the production of sparks and arcs and (2) keeping the flammable vapor concentration well outside the flammable range of the material. Limiting the production of sparks may be accomplished by bonding surfaces that might otherwise develop dissimilar charges. Bonding involves connecting a conducting cable between the surfaces. The practice is very common for transferring flammable liquids from one container to another. Without bonding, sparks would develop, and some might have enough energy to ignite vapors. In summary, electrical energy can damage equipment, harm people, and provide the heat to ignite an unwanted fire. In the next section, we examine strategies and tactics for reducing risks of these harmful events.

15.3 Strategies and Tactics for Electrical Energy The strategies for reducing risks associated with electrical energy are listed in the left column of Table 15.2. On the right are examples of applicable tactics. Eliminating the hazards is always the first strategy to consider, but when it comes to electricity, eliminating the hazard can be difficult or impractical. In modern commerce, we need electricity for computers, communications, lighting, powered equipment work, and many other applications. Another option noted in Table 15.2 is replacing electricity with a different form of energy. Maintenance personnel use the elimination strategy when they need to work on equipment. Before starting the work, they disconnect all circuits serving the equipment and lock and tag the switches. Table 15.2 Strategies and Tactics for Hazards of Electrical Energy. Risk-reduction strategy Risk-reduction tactics 1. Eliminate the hazard 1a. Use no energy

1b. Use another form of energy 1c. Before working on equipment, disconnect electrical circuits and apply locks and tags

2. Moderate the hazard 2a. Use minimum voltage to meet needs 2b. Use minimum current to meet needs 2c. For transferring flammable liquids in pipes, use pipe made of materials that do not promote buildup of static electricity

3. Avoid releasing the hazard 3a. Design and build high reliability into all connections in a circuit 3b. Enclose sites where arcs may occur 3c. Keep circuitry dry 3d. Use lockout and tagout procedures

4. Modify release of the hazard 4a. Provide grounding for circuits 4b. Provide a fuse or breaker for each circuit

4c. Include in circuit a GFCI 5. Separate the hazard from that needing protection

5a. Ensure integrity of component insulation and proper connections

5b. Use double-insulated housing for power tools 5c. Isolate electrical equipment from people spaces

6. Improve the resistance of that needing protection

Use fire-resistant materials for items at risk of ignition from electricity

7. Help people perform safely 7a. Use human factors guidelines when designing equipment and user manuals 7b. Provide appropriate warning decals on equipment 7c. Perform usability testing of equipment, manuals, and warning decals

8. Use personal protective equipment 8a. Provide appropriate PPE for personnel exposed to potentially hazardous electrical energy 8b. Provide quality training regarding the use of PPE 8c. Maintain integrity of PPE

9. Expedite recovery Include emergency preparedness plans for first response to victim of electrical contact

The second strategy is to moderate the hazard. Basic tactics are to use the minimum necessary voltage and current to accomplish the task. For areas with flammable vapors, the use of printed circuit boards, semiconductors, and other devices requiring very low current can keep energy levels below that required for ignition. In operations involving the transfer of flammable liquids, the designers of equipment for transferring flammable liquids can specify the pipes and containers should be made of low-spark generating material such a stainless steel. Strategy 3—to avoid releasing the hazard—finds many applications in electrical circuitry. The current in electrical wiring is normally contained within one or more layers of insulation, which effectively prevents the current from being released. Each end of an electrical wire is connected to another part of the circuit, so ensuring proper and secure connections will avoid current leaking at the juncture points. By assuring good and reliable connections, we can prevent the hazards associated with leaking current. Keeping circuitry dry is a useful tactic for avoiding release of the hazard. Moisture can penetrate small spaces at junctions, creating a conducting path out of the designed circuit. People have died in bathtubs when using a powered device that became wet. Portable power tools soaked by rain might conduct some current to the housing. The fourth strategy is to modify release of the hazard. This is the most useful of the strategies for reducing risks associated with electrical energy. Providing grounding for electrical circuits has long been recognized as an effective tactic for channeling the flow of errant current. If current occurs outside the designed path for a circuit, the grounding wire should carry the current directly to the ground where it immediately dissipates into the enormous mass of the earth. The rapid flow of the current from the hot wire to the ground will quickly exceed the threshold of the fuse or circuit breaker, resulting in opening the circuit path and shutting down the flow of current. Two types of grounding are used. System grounding is established by the power company at the transformer connecting the customer to the distribution lines. Grounding is also installed in circuits that supply current to appliances within the facility. The combination of grounding outside and inside provides two lines of defense against voltage surges from lightning and other events. In addition to system grounding, device-specific grounding is used for many power tools and appliances (see Figure 15.1). The power cord provided with commercial equipment should have the type of wall plug appropriate for the device. Beware of advice offered by anyone who thinks modifying the plug is a good idea. Another common tactic for modifying the release of electrical energy is to incorporate a GFCI into a circuit. As explained earlier, it monitors the difference in current between the hot wire and the

neutral wire. If the difference exceeds 5 mA, the GFCI will almost instantly cause the fuse or circuit breaker to open the circuit. GFCIs are used where leaks in a circuit are more likely, such as in areas with water. The fifth strategy is to separate the hazard from that needing protection. This tactic is applied to high-voltage electrical installations by locating electrical equipment in a fenced yard, room, or vault with access restricted to certain qualified electricians. Similarly, power lines hung on high towers use this strategy to separate the hazard from people. Using double-insulated power tools is another example of tactic for keeping people separated from the current. The idea behind these tools is that if a short develops inside the tool, the current will need to pass through two barriers of insulation in order to energize the tool housing and contact the person. Another tactic for separating people from electric current is isolation. Using ladders made of nonconducting materials (e.g., fiberglass) while working on or near electrical equipment is one means. The public generally believes wooden ladders are nonconducting, but this belief is not entirely correct. A very dry wooden ladder may be nonconductive, but a wooden ladder wet from rain will conduct electricity. Even the wood in a new wooden ladder contains moisture that facilitates some degree of conductivity through the fibers. So the safe approach is to issue personnel ladders that are certified by a recognized testing laboratory as nonconductive. The sixth strategy is to improve the resistance of that needing protection. The word “resistance” used in this strategy must not be confused with the concept of electrical resistance. This strategy is to make the item of concern more resistant to being harmed by electrical current, for example, by using fire-resistant materials to make items that are at risk of ignition from electricity. Strategy 7—to help people perform safely—applies to equipment controls and displays. Providing labels for switches and other electrical control devices can prevent errors. Providing signal lights to indicate equipment status (e.g., whether in the on or off position) can help personnel avoid errors. For readers seeking additional information on displays and controls, several ergonomics books have chapters with guidance on selecting appropriate displays and controls. A book by Konz and Johnson and a book by The Eastman Kodak Company are recommended.4, 5 The eighth strategy is to use personal protective equipment. Utility employees often use insulated gloves when working with energized power lines. They also use head protection made to minimize conduction from a current source to the head. Footwear is available with low-conductivity soles. Full- body protection is used by electricians working with high-voltage installations. Planning and preparing to expedite recovery begins with emergency planning for a worksite (Strategy 9). If electrical incidents are foreseeable, plans should clarify capabilities needed for an effective first response. Some potential injuries are severe burns to skin, burns to internal tissues in an appendage, fibrillation, and inability to breathe. Other types of incidents are fires and explosions ignited by a spark, arc, or heat from an electrical circuit.

Learning Exercises 1. A residence in the United States is supplied with alternating current at 120 V. Electric

current consumed during the day (12 h) averaged 20 A/h. What is the hourly average power consumption? What is the total power consumed that day? 2. Explain the difference between DC and AC currents. 3. How does an effective management of change program contribute to electrical safety?

4. Explain the reason for setting the trigger point of GFCI devices at 5 mA. 5. Why does arc welding generate intense heat? 6. Explain the reason for having a grounding wire on portable power tools. 7. Give an example of Strategy 7 applied to electrical energy. 8. Explain why wooden ladders should not be trusted to provide electrical insulation. 9. Suppose you are conducting a training session for supervisors. One of them says, “When I was 9 years old, I was electrocuted when I stuck a screwdriver into a wall socket.” How would you explain why you are sure his facts are wrong?

Technical Terms Arcs Visible current jumping the gap in an electrical circuit. Arcs can be continuous (as in arc welding) or single flashes (as

when unplugging an appliance while it is turned on).

Bonding Electrically connecting two or more items with a common conductor in order to equalize the electrical potentials of the items. The common conductor, generally called a bonding wire, is not part of an electrical circuit.

Current The flow of electrical charge within a circuit. Electrocution Death resulting from electrical energy. Ground-fault circuit interrupter (GFCI)

A shock protection device for an electrical circuit. A GFCI detects the difference in current in the hot wire and the neutral wire. If the difference exceeds a trigger level of about 5 mA, the device causes the circuit breaker to open and stop the flow of electricity.

Grounding The practice of electrically connecting an item with the earth (ground). The connection uses good conductors such as copper or aluminum with one end attached to the item and the other end attached to a grounding rod or other conductor rooted in the earth.

Ions An atom or group of atoms that has developed a positive or negative charge as a result of gaining or losing an electron.

Resistance A force opposing current flow. Spark A tiny, hot, glowing particle. Some common spark producers are static electricity, welding, and friction. Système International (SI) The International System of Units, abbreviated SI from the French Système International d'Unités.

6

Voltage The effective difference in potential between any two points in a circuit; that difference establishes an electromotive force that moves electrical charges between those points.

References

1. Hammer W, Price D. Occupational safety management and engineering, 5th ed. Upper Saddle River, NJ: Prentice Hall; 2001. p. 341–373. 2. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 172–173. 3. Wiggins JH. Managing electrical safety. Rockville MD: Government Institutes; 2001. 4. Konz S, Johnson S. Work design: Occupational ergonomics, 7th ed. Scottsdale, AZ: Holcomb Hathaway; 2008. p. 293–329. 5. The Eastman Kodak Company. Kodak's ergonomic design for people at work, 2nd ed. Hoboken, NJ; 2004. p.269–363. 6. Rowlett R. The international system of units (SI). Available at http://www.unc.edu/~rowlett/units/sipm.html.

Chapter 16

Acoustic Energy and Vibration Hazards

The discussion of acoustic energy and vibration is combined into one chapter because the hazards have similar origins and cyclical patterns. In OSH, acoustic energy is more commonly referred to as noise and is widely recognized for its adverse effects on hearing. Vibration is known in OSH as the main cause of occupational hand-arm vibration syndrome and as a contributor to the spinal wear and tear damage experienced by people who spend thousands of hours sitting in a vibrating seat.

16.1 Background on Noise and Vibration In workplaces, most noise and vibration originates from the movement of solid objects. Another source is moving water such as in streams, ocean waves, and through the penstock and turbines of a hydroelectric dam. Numerous industrial processes have fluids flowing rapidly through pipes that occasionally cause the pipes to shake and emit noise, as well as through valves that can produce a whistling noise. If the solid object is in contact with air, the kinetic energy of the object moving transfers some acoustic energy to the air. If the solid object is in contact with a fluid, the kinetic energy of movement imparts pressure to the fluid. In both situations, the back and forth motions of the solid object create waves of higher and lower pressure in the affected air or fluid. If the solid object is in contact with another solid object, it will transfer the kinetic energy of the motion directly to the second object. The OSH profession is concerned with a human body part being the second object and being subjected directly to vibration.

16.1.1 Characteristics of Noise and Vibration Figure 16.1 is a graph for understanding cycles that follow a sinusoidal pattern. The vertical axis is the value of a sine wave with values ranging from −1.0 to plus +1.0. When working with noise and vibration, we replace the sine wave variable with a more meaningful measure of the physical parameter involved. Figure 16.1 Instantaneous amplitude of a pure tone or vibration plotted against time.

For noise, the most common variables are intensity and air pressure. For vibration, commonly

plotted variables are displacement, velocity, and acceleration. The horizontal axis may be time or distance. These various plots help visualize the key wave attributes: period (denoted ), frequency (f), wavelength (λ), instantaneous amplitude (the vertical axis), amplitude (A), and root-mean-square (RMS) value. The RMS serves as the effective amplitude of the plotted variable. Table 16.1 provides three fundamental equations relating some of these variables. The variable in the vertical axis is something that can be measured with an appropriate instrument. In the case of sound, data for such a graph would be from an instrument capable of continuously measuring air pressure and located at a fixed site away from the source. For a single pure tone generated by a tuning fork, a graph of this sound pressure would show a pattern similar to that shown in Figure 16.1. In the case of vibration, the vertical axis of the graph is often used for the instantaneous value of acceleration, which is the measurable parameter associated with adverse physiological effects on humans. Two other commonly plotted variables are instantaneous displacement from the neutral, or midposition, and instantaneous velocity of the motion. Expressions for the intensity of sound and vibration are based on a ratio of the measured amplitude to a reference value. This general ratio approach is applied to several measurable quantities. For vibration, the common quantities are displacement, velocity, and acceleration. For noise, the most common quantity is the sound pressure. Taking the logarithm of the ratio creates a linear numeric called the decibel (dB). Standard formulas are established for each of the quantities.1 Two of these formulas are presented in Table 16.1, with the left column stating the relationship in sentence form and the right column showing the formula. The table also provides some common formulas applicable to the oscillatory parameters labeled in Figure 16.1. Table 16.1 Some of the Common Equations for Noise and Vibration. Relationship Equation Sound pressure level in air is a function of the ratio of instantaneous measured air pressure (p) to the reference value po (20 μPa), with results in decibel units

20 log(p/po)

The decibel level of vibration acceleration is a function of the ratio of instantaneous acceleration (a) to the reference value ao (1 μm/s

2) 20 log(a/ao)

The product of cycle time and frequency equals one cycle f = 1 cycle

Wavelength equals the speed of sound (c) divided by frequency λ = c/f

The value of the root-mean-square amplitude is 70.7% of the peak amplitude RMS = 0.707 A

16.1.2 Human Aspects of Noise and Vibration Human perception of sound does not correspond directly to the attributes of sound already mentioned. What we call “pitch” is a sensation based largely on the frequency of sound, but is also influenced by the waveform. What we sense as “loudness” is largely based on the effective sound level, but is also dependent on frequency. The interplay between perceived loudness and frequency is presented in graphs showing lines of equal loudness perception across a range of frequencies. In order to have a practical scale for comparing levels of loudness, we use a decibel scale. Occupational noise exposure standards and measuring instruments are readily available. When an employee's exposure regularly exceeds a standard, the expectation is that over a working career, the employee will experience more hearing loss than would occur naturally due to aging. The mechanisms of how noise exposure connects in a causative manner to hearing loss are discussed in section 16.2. Occupational vibration involves two exposure categories, whole-body vibration and hand-arm vibration. Whole-body vibration occurs in jobs involving standing on a vibrating floor or sitting on a vibrating seat. The standing exposures are less of a concern because the legs partially dampen the vibration before being transmitted to the pelvis and spine. Hand-arm vibration occurs when manually handling vibrating power tools.

16.2 Mechanisms of Harming The mechanisms of harm for occupational exposure to noise, whole-body vibration, and hand-arm vibration may be conceptualized in terms of the following three-element model. The following three sections explain how this model applies to noise, whole-body vibration, and hand-arm vibration, respectively.

16.2.1 Effects of Noise Exposure Occupational exposure to noise can cause permanent loss of hearing capability. Human hearing is optimal at the age when most people enter the workforce. People can expect some reduction in hearing capability between ages 20 and 50, with more pronounced declines during their fifties and beyond. Occupational exposure to noise can accelerate the hearing loss. The mechanism of harm is the acoustic energy encountered in the workplace—the cycles of varying air pressure enter the ear canal and deliver acoustic power to the eardrum. The resulting vibration of the eardrum is mechanically transmitted to the inner ear through the middle ear by three connected bones. Within the inner ear, special hair-like cells respond to the various frequencies. These cells interface with nerves belonging to the auditory system to produce nerve impulses recognizable by the brain. The hairs in the inner ear have considerable tolerance for noise levels, but the tolerance can be exceeded by some combinations of high noise levels and duration of exposure.

An extremely loud noise (e.g., an explosion) can permanently damage the eardrum and the inner ear. A couple hours of exposure to loud noise can cause a reduction in capability of detecting sound at particular frequencies. This temporary threshold shift is similar to muscular fatigue in that rest leads to full recovery. Sometimes a worker does not get enough quiet time for the hair cells to fully recover from the fatigue that caused the temporary threshold shift. With continued exposure to the noise, the hair cell damage can become permanent. Because the damage affects a cluster of hair cells responsible for sensing certain sound frequencies, people with occupational hearing loss differ in the sounds they can hear. Results of audiometric testing are presented in a chart displaying the threshold (in decibels) of hearing throughout the range of hearing frequencies. Sometimes the frequencies showing the greatest loss can be related back to the same frequencies encountered on the job or in military service. The individual's audiometric tests may show a detriment in hearing threshold at the same frequency as their prior exposure. Such clear- cut links between exposure and harm are often obscured in today's work world because few people keep the same job with the same noise exposure for an entire career. More commonly, by the time a worker has suffered noticeable hearing loss, identifying a specific cause can be challenging because of the multiple factors associated with hearing loss—aging, military exposures, off-work activities, and various lifetime workplace exposures.

16.2.2 Effects of Whole-Body Vibration Occupational exposure to whole-body vibration is part of many jobs. Some jobs involve standing on vibrating floors and others involve sitting on vibrating seats. Biomechanical modeling and several laboratory studies help us understand how a vibrating source transmits harmful energy to the human spine. Less is known about the way in which whole-body vibration can damage soft tissue in the torso and neck. Numerous jobs include exposures to whole-body vibration. In transportation, railroad personnel riding trains stand or sit for a substantial portion of their shift. Personnel working on ferryboats and barges are similarly exposed. Numerous sitting jobs involve substantial vibration. Truck drivers are exposed to vibrations from uneven road surfaces as well as the vehicle motor. Roadway vibrations are transmitted through the tires, wheels, and suspension system to the truck body and from the truck body to the attachment points of the frame to the seat. Other jobs involving considerable vibration while sitting include driving farming equipment and city buses, operating heavy construction equipment, flying helicopters, and driving haul trucks in open-pit mines. Coal miners in underground mines are exposed to whole-body vibration driving continuous mining machines and ore hauling vehicles. Increased recognition of the long-term harmful effects of the vibration exposure and advances in technology have led to improved seating for many of the workers in such jobs. Some whole-body vibration studies of jobs involving extended sitting on a vibrating seat (such as driving a truck, bus, or tractor) provide evidence of a relationship between measures of exposure and measures of back pain and other health outcomes.1,2 One study found that the main contributors to low back pain among occupational drivers were the following factor interactions: posture plus vibration, posture plus manual materials handling, or all three.2 Sitting exposures to vibration are more consequential than standing exposures. Consider a person supported by a vibrating surface. If standing, some of the vibration is dampened by the shoe soles and more by the feet, ankles, lower legs, knees, upper legs, and hip joints. As a result, standing exposure to whole-body vibration has not been strongly associated with spinal damage. The story is different for prolonged sitting on a vibrating seat.

The vibrations in the seat exert alternating movements directly connected with the body of the person. The movements may involve up–down cycles, side to side cycles, and front to rear cycles. In three-dimensional coordinates, these cycles are referred to as the z-axis, y-axis, and x-axis, respectively. In each direction, the seat movement transmits corresponding movement to the person. These movements involve displacement in position and the accelerations inherent to changing direction with every cycle. In addition, rotational movements may be taking place. These are characterized using the nautical terms pitch, yaw, and roll. Occupational exposure standards use one graph for up–down vibration and another graph for side to side and front to rear movement.3 The forces of the up–down vibrations are transmitted to the sitting person's pelvis and from there to the lumbar spine. During the upward phase of each cycle, the upward force from the pelvis to the L5/S1 disc is opposed by an equal downward force from the weight of the upper body. These opposing forces squeeze the lumbar discs, making them flatter. When the motion shifts from upward to downward direction, the lumbar discs are subjected to pulling forces causing increased disc height. These repetitive cycles occur thousands of times per hour, and after many hours of exposure, the discs suffer fatigue damage as any other material does when subjected to repeated mechanical stress. The cartilage end plates of the discs are believed to incur small tears that never fully heal. Over time, the end-plate damage leads to reduced fluid in the discs, and the discs become permanently flatter, drier, and more rigid. Once in that state, the discs are more susceptible to becoming prolapsed or herniated and impinging on a nerve to cause pain (for a more comprehensive discussion of disc- related and other harmful outcomes, see Ref.). The lumbar region of the spine is the most vulnerable part of the spine. Laboratory studies have provided information about the transmissibility of vibration from the vehicle seat to the driver's pelvis and up the spine. Most of the transmissibility affects the lower lumbar discs, subjecting them to the repetitive stress of alternating compression and tension. Thus, concerns about spinal discs damage should focus on the lower lumbar discs. The vibration frequency is a major factor in disc damage. A resonant frequency occurs in the range of 4.5–5.5 Hz for the up–down motion of a sitting person.3 That means the respective frequencies of the vibration loading and the spinal reaction become synchronized to create a much worse effect than occurring outside the resonance range. A fatal effect has been shown with monkeys subjected to vibration at resonant frequency for a few hours. A spinal effect on humans has been shown in laboratory studies. At the resonant frequency, laboratory measurements have shown that the upper spine actually moves vertically more than the pelvis. In the process, the spinal discs are subjected to an exaggerated, stressful loading.

16.2.3 Effects of Hand-Arm Vibration Hand-arm vibration has been linked to work involving extensive use of vibratory hand tools. Effects may be felt by anyone who has spent a few hours using a power tool. Some power tools known for their vibratory effects are chisels, chain saws, sanders, grinders, riveters, drills, jackhammers, compactors, sharpeners, and shapers.4 The forearm muscles get fatigued from extended gripping, and the vibration combined with gripping causes a feeling of numbness or insensitivity in the forearm. This tends to induce a tighter grip. The tighter grip facilitates transmission of vibratory motion from the tool to the hand, wrist, and forearm. Early work on hand-arm vibration stemmed from concerns among Scandinavian forest harvesters using chain saws in cold weather. That work extended to other occupations and led to development of standards for measurement, exposure assessment, and control.4–7

The original sources of vibrations—the tool motor and moving parts—cause the tool housing to vibrate. The vibrating surface of the tool housing transmits the vibration to the skin of the hand. Between the skin surface and hand bones, the vibration is damped a bit, but a large portion of the vibration transmits into the bones. The hand bones transmit the vibration through the carpal bones to the forearm bones. Although the etiology of what is now called hand-arm vibration syndrome(HAVS) is not precisely understood, the resulting symptoms have been strongly associated with prior exposure to vibrating hand tools.3 Older literature refers to the syndrome as Raynaud's phenomena of occupational origin and vibration white finger. Symptoms of HAVS include white fingers following cold exposure; reduced function of sensory and motor nerves; and disturbances in muscles, bone, and joints.3 If the symptoms are detected early, the person may fully recover by avoiding additional hand- arm vibration exposure. However, if the symptoms develop too far, the syndrome becomes permanent and the person may have substantial restrictions on tasks involving manual handling or dexterity. For the person with HAVS, rest may moderate the symptoms temporarily, but the symptoms can recur rapidly when the person uses a vibrating hand tool. Working in a cold environment exacerbates the response. Most adverse health effects of noise, whole-body vibration, and hand-arm vibration are the cumulative result of extended exposures. All three sources have established methods for measuring occupational exposures and evaluating against a standard.

16.3 Strategies and Tactics for Noise and Vibration The strategies and tactics for mitigating the risks of noise, whole-body vibration, and hand-arm vibration have much in common but differ in details. Engineering approaches for both noise and vibration can become quite technical. This section presents risk-reduction tactics familiar to the OSH community. Readers seeking more technical information may find it in books on the subject.8,9

16.3.1 Risk-Reduction Tactics for Noise Exposure The strategies for reducing the risk of hearing damage from noise exposure are listed in the left column of Table 16.2. On the right are examples of applicable tactics. Other sources provide more detailed information on the various tactics.9–13 Table 16.2 Strategies and Tactics for Reducing the Risks of Noise Exposure. Risk-reduction strategy Strategies and tactics 1. Eliminate the hazard 1a. Avoid locating noise sources in employee areas

1b. Remove existing noise sources from employee areas 2. Moderate the hazard 2a. Purchase quieter equipment

2b. Substitute quieter for noisier equipment 2c. Replace surfaces that reflect noise with sound absorbing materials 2d. Use technology to moderate noise-generating sources

3. Avoid releasing the hazard Enclose noise sources

4. Modify release of the hazard 4a. Locate noise sources in corners with sound absorbing materials for ceiling and adjacent walls 4b. Direct generated noise away from employee areas

5. Separate the hazard from that needing protection

Separate noisy areas from employee areas by barriers or distance

6. Improve the resistance of that needing protection

Not feasible

7. Help people perform safely 7a. Avoid noise that interferes with interpersonal verbal communication 7b. Provide auditory warning that can be distinguished from other sounds in the environment 7c. Provide work environments that do not require employees to use hearing protection or respirators

8. Use personal protective equipment 8a. Provide employees with hearing protection suited for their noise exposure 8b. Provide employees with the means and encouragement to properly use their hearing protective devices

9. Expedite recovery Transfer personnel who show signs of hearing loss from noisy work to a low-noise job

The first strategy is to eliminate the hazard. Common noise sources in occupational environments include production machines (e.g., mechanical power presses), power tools, and the high-velocity flow of gases and liquids in pipes. In the design phase for an industrial process, avoid putting these or similar noise sources in areas where employees will be working. If the facility is already operating with a particular noise source, eliminating the source would require removing it from the area where personnel work. The second strategy is to moderate the hazard. In the design phase of an industrial process, equipment purchasing specifications can set a noise maximum and make noise reducing devices part of the deliverables. In existing facilities, substituting a quieter alternative for a noisy machine or hand tool might be a feasible option. Damping is a widely used engineering approach for reducing noise and vibration. The vibrating mass that creates noise and vibration has some elasticity, which allows it to slightly displace from its neutral position. When it is displaced, it will exert a force tending to return to the neutral. Once it starts returning to the neutral, it will go too far and displace in the opposite direction. If there were no energy losses, the vibration would continue indefinitely, but there are losses to friction and perhaps to heat, resulting to a gradual reduction in the swing. This reduction in the energy of oscillation is known as damping. Engineers often use damping to lessen the energy of a noise or vibration source. Figure 16.2 displays two cyclical patterns of amplitude. Figure 16.2a shows the pattern for an oscillatory motion with zero damping. Figure 16.2b shows how damping affects the oscillation by both reducing the peak amplitude with each cycle and shortening the time it takes to bring the motions to a trivial level. Noise damping reduces the sound level and vibration damping reduces the displacement. This decay in amplitude can be aided by having the vibratory motion go through a damping material. The damping serves to reduce the amplitude of each successive cycle. Figure 16.2 Effect of damping on vibratory motion.

If noisy flows through pipes and valves are anticipated, engineering technology can be used to moderate noise level. For example, could a slower flow rate be used? Can metal parts and pipes be secured with vibration damping devices? Noise damping and isolating technology may also be used for noise generated by the vibrations of motors, fans, and other moving apparatus. Materials falling into metal chutes can create considerable noise. Can the metal chute be replaced or fortified with wood or plastic to reduce the noise? Strategy 3 is to avoid releasing the hazard. The main tactic is to completely enclose the source. Brauer provides some basic guidelines on making an effective enclosure.10 At a minimum, the enclosure should be complete; even small openings will allow considerable noise energy to escape. In addition, the inner surfaces of the enclosure should be composed of or covered with sound absorbing material to avoid the buildup of reverberant noise. The fourth strategy is to modify release of the hazard. In some situations, the noise from a source can be influenced so as to minimize adverse effects. One tactic is to locate the machine, process, or other noise source in a corner of the facility; position it so that the greater part of the noise is directed into the corner walls and install sound absorbing materials on these walls and the ceiling. Brauer describes several engineering approaches for moderating surfaces to limit reflection or increase absorption of sound energy.10 Similarly, it may be feasible to arrange some noise sources so the noise energy is directed outside the facility or into a large area away from employees. Mufflers on engine exhaust systems are designed to allow exhaust gases to pass through while moderating the loud engine noises to acceptable levels. The fifth strategy is to separate the hazard from that needing protection. Noise sources may be separated from employees by barriers or by distance. Barriers can reduce sound somewhat; however, sound moves easily around barriers, especially higher frequency sound. A shield-like barrier may seem as a great idea, but actual noise reduction can be less than might be intuitively expected. To be effective, a barrier should be close to the noise source, of material that limits noise transmission through it, and as tall as feasible. Using distance to separate a noise source from personnel will reduce the noise exposure level. If the noise source is moved sufficiently far from personnel to eliminate noise exposure, it would be part of the first strategy, eliminating the hazard. Strategy 6, to improve the resistance of that needing protection, is not applicable to noise. It is not possible to make the hearing capability of employees more resistant to damage from excessive noise exposure. The same may be said of vibration. The seventh strategy is to help people perform safely. In many situations, verbal communication plays an important role in safety. Background noise can interfere with this communication, so limiting background noise can help employees perform safely. Also, auditory warnings must be distinguishable from background noises in the environment. An example is the backup beeper on trucks and other large vehicles. If used in a noisy environment, the beeping may not be heard or may go unnoticed due to the worker being so accustomed to the generally loud work environment that no single sound stands out enough to draw attention. Another concern arises when personal hearing protection is used due to the loud background noise. The combination of loud background noise and use of hearing protection makes hearing safety information more difficult. The use of respirators also interferes with transmitting spoken message to fellow employees. During the 1979 crisis at the Three Mile Island Unit 2 nuclear power station, control room personnel had significant communication problems because the respirators they had to wear partially muffled their voices and their hearing was impeded by the multiple conversations going on among people not normally in the control room. The operators had to pull their respirators aside to speak to others in the room. Thus, the ideal way is to design work so personnel do not need to use hearing protection or

respirators. The eighth strategy is to use personal protective equipment. While this strategy has a lower priority than the engineering control strategies, it serves the needs of millions of workers. Many workplaces have areas with noise levels considered too high based on company policy, a voluntary standard, or a mandatory standard. Whatever the reason, the use of hearing protective devices provides a last line of defense for protecting hearing. If an employer determines its employees need personal hearing protection, it should establish a hearing conservation program that includes acquisition of the PPE, training, maintenance, signage, workplace noise monitoring, periodic audiometric testing, and medical oversight. Hearing protective devices are commercially available in several forms. Basic types are earplugs (ear inserts) and earmuffs, with several variations available for each type. In extra noisy worksites, using both earplugs and earmuffs is necessary to cut the noise reaching the eardrum down to a tolerable level. The use of personal hearing protection can make verbal communication more difficult. In extra noisy areas where workers wear earplugs and earmuffs for hearing protection, verbal communicate is ineffective, so they must use other forms of communication. Some employers have a standard set of hand gestures for these situations. The ninth strategy is to expedite recovery. Periodic audiometric testing provides valuable information for early detection of hearing loss. If audiometric tests reveal an employee is losing hearing, a determination is needed as to the cause. The medical adviser may need to estimate the portion of hearing loss due to aging, disease, and workplace noise exposure. If noise exposure is suspected, the employee can be transferred to a job involving minimal noise exposure. This will not restore hearing capability, but it should end further loss due to employment. A transfer policy may prove beneficial for a couple of reasons. One is that, without such a policy, other employees may feel entitled to the low-noise job because of their seniority. In addition, a policy can establish how a transferred employee's wage rate will be affected. Having such a policy in advance can help avoid the appearance of being arbitrary or retaliatory.

16.3.2 Risk-Reduction Tactics for Vibration Exposure Table 16.3 summarizes strategies and tactics for reducing risks associated with whole-body vibration. Because the tactics are self-explanatory and similar to those discussed in the preceding section, narrative accompanying the table is considered unnecessary. However, one point worth mentioning concerns seats available for vehicle drivers and heavy equipment operators. The so-called air ride seats effectively prevent driver exposures to resonant frequency. This enables the drivers and operators to avoid the most harmful aspects of whole-body vibration. Other technological advances in seat design also contribute to effective vibration damping. Table 16.3 Strategies and Tactics for Reducing the Risks of Whole-Body Vibration Exposure. Risk-reduction strategy Tactics for whole-body vibration 1. Eliminate the hazard 1a. Avoid bringing vibrating equipment to the workplace

1b. Fix equipment that vibrates inappropriately 1c. Eliminate need for employee to sit on vibrating surface

2. Moderate the hazard 2a. When purchasing heavy equipment include specs for limited vibration at operator seat 2b. Replace older operator seats with newer vibration damping seats so that exposure is not in resonant frequency range

3. Avoid releasing the hazard Isolate vibration sources from media that can transmit vibration to humans 4. Modify release of the hazard 4a. Install vibration damping materials between source and transmission media

4b. Install springs between source and transmission media to reduce vibratory accelerations 5. Separate the hazard from that needing protection

Use facility design to separate personnel and vibration sources

6. Improve the resistance of that needing protection

Not feasible

7. Help people perform safely 7a. Provide workstations that allow operator to alternate between sitting and standing 7b. For sitting jobs requiring precise manual manipulations, provide operators with a nonvibrating seat

8. Use personal protective equipment For vibrating floor, provide employees with footwear having soles suited for damping vibration

9. Expedite recovery Actively manage medical care of personnel with a low back medical condition

Table 16.4 summarizes strategies and tactics for the hazards of hand-arm vibration. An extended narrative accompanying the table is considered unnecessary because the tactics in the table are sufficiently self-explanatory and similar to those used for noise. One observation worth mentioning is that the manufacturers of handheld power tools have made substantial progress reducing vibration or avoiding significant vibration in the resonant range. This is particularly useful because it makes unnecessary the use of antivibration gloves and antivibration coverings for the handles of power tools. Table 16.4 Strategies and Tactics for Reducing the Risks of Hand-Arm Vibration Exposure. Risk-reduction strategy Risk-reduction tactics 1. Eliminate the hazard 1a. Avoid bringing vibrating power tools to the workplace

1b. Fix power tools that vibrate inappropriately 1c. Eliminate need for employees to use handheld power tools

2. Moderate the hazard 2a. When purchasing power tools include specs for limited handle vibration

2b. Choose tools powered with motors with an even number of cylindersa

3. Avoid releasing the hazard 3. Isolate vibration sources from media that can transmit vibration to humans 4. Modify release of the hazard Purchase power tools with vibration damping materials built into the handle

b

5. Separate the hazard from that needing protection

Have tool held by remote manipulator separated from human controller

6. Improve the resistance of that needing protection

Not feasible

7. Help people perform safely 7a. Provide workers with hand tools having handles suited for their hands and the tasks they perform 7b. For assembly line workstations, use tool suspension devices to hang heavier tools 7c. For power hand tools with substantial vibration, provide warning on product and in user manual

8. Use personal protective equipment Provide power tool users with vibration damping gloves

c

9. Expedite recovery 9a. Maintain medical surveillance in order to identify symptomatic employees before they develop permanent HAVS. Reassign them to jobs without hand-arm vibration 9b. For employees with permanent HAVS, assign work with no hand-arm vibration exposure

a. Motors with an odd number of cylinders tend to generate more vibration. b. Wrapping hard surface tool handles with vibration damping tape is not recommended because it increases the diameter of the handle, requiring the user to grip with greater force (see Ref.). c. Full finger gloves are recommended (see Ref.).

Learning Exercises

1. Perform the computations below using information in Table 16.1. a. If a pure sound has a frequency of 3000 Hz, what is the value of the period ( )?

b. If a vibrating mass has a peak displacement of 1.3 mm, what is the value of the RMS displacement?

c. What is the sound pressure level value (Lp) for a sound with an RMS value for p = 14 N/m2?

2. Say an employee comes back from an audiometric test with results showing poor hearing at 4000 Hz. This was the only frequency showing a loss. The employee has been with the company for six years, always in the same job. What would be the basic steps for the OSH staff to take? 3. Say a haul truck driver in an open-pit mine comes with a report from his doctor that says the driver's lumbar spine shows signs of significant degeneration. He has been driving a haul truck for 22 years at your mine. If you were the company medical adviser, and you agreed with the medical report, make two recommendations, one engineering and one administrative? 4. Explain the effects of damping on oscillatory waves. 5. Explain and compare the role of rest (i.e., nonexposure) as a prescription for HAVS, muscle fatigue, and temporary threshold shift in hearing. 6. One tactic for reducing noise exposure is to set up a barrier between the source and the personnel. What characteristics of an effective barrier are mentioned in the chapter? 7. Suppose a manufacturing facility is preparing to install a heavy new machine that will produce substantial vibrations. Engineers have identified two options for minimizing the effects of vibrations on the floor. One is to mount the machine on a thick pad of vibration damping material. The other option is to cut a hole in the floor and build an independent platform from the ground below up to the level of the floor. That would prevent the machine and floor it sits on from touching the room floor. Which strategy in Table 16.4 applies to each option? 8. Say a chain saw manufacturer makes chain saws for professional timber harvesters (lumberjacks). The present chain saw motor has three cylinders. One engineer suggests changing to a four-cylinder motor. Why?

Technical Terms Amplitude (A) The maximum (or peak) deviation of a physical quantity from its equilibrium position. It is one of the two special values of

the instantaneous deviation of the quantity. The other special value is the RMS.

Damping Reducing the energy level of an oscillating phenomenon over a time by use of some sort of energy absorbing mechanism or material.

Decibel (dB) A dimensionless variable, computed from the ratio of measured air pressure (p) to a reference air pressure (po). The formula is 20 log (p/po).

Decibel scale A unit for expressing level of noise or vibration relative to a low reference value.

Frequency (f) The cycle rate, with units of cycles per second. Frequency is a fundamental attribute of oscillating phenomena and very useful for describing a pure tone, a vibrating mass, alternating electric current, and electromagnetic energy. Undesired sounds because of either interfering with communication or appearing unpleasant to the listener. Also used for

Noise any factor that interferes with transmission of electronic signals.

Noise damping

Reducing noise energy by passing through a sound absorbing material.

Instantaneous amplitude

The deviation of a physical quantity from its equilibrium position at any point in time. Two special values of instantaneous amplitude are the peak amplitude (A) and the RMS amplitude.

Isolation Separating the source of noise or vibration from a transporting medium. Period (τ) The time between corresponding points on successive waves of an oscillating phenomenon. Resonant frequency

A small vibration frequency range within which the external oscillations create an exaggerated responding vibration in the subject, making the effect much worse.

Sound pressure (p)

The pressure of sound at any moment measured at a point some distance from the source. Usually measured in μN/m2 or μPa.

Sound pressure level

The decibel expression for the pressure of sound at any moment measured at a point some distance from the source (see Table 16.2).

Vibration damping

A reducing effect on vibration energy by using a viscoelastic material to remove some of the vibration energy.

Wavelength (λ)

The distance between corresponding points on successive sound waves.

References

1. Bovenzi M. Metrics of whole-body vibration and exposure–response relationship for low back pain in professional drivers: A prospective cohort study. International Archives Occupational Environmental Health. 2009;82: 893–917. 2. Okunribido OO, Magnusson M, Pope MH. The role of whole body vibration, posture and manual materials handling as risk factors for low back pain in occupational drivers. Ergonomics. 2008;51: 308–329. 3. Wilder DG, Wasserman DE, Wasserman J. Occupational vibration exposure. In: Wald PH, Stave GM, editors. Physical and biological hazards of the workplace, 2nd ed. New York: Wiley; 2002. p. 79– 104. 4. National Institute for Occupational Safety and Health. Criteria for a recommended standard: Occupational exposure to hand-arm vibration. DHHS(NIOSH) Publication No. 89-106. Cincinnati, OH: The Institute; 1989. 5. International Standards Organization. Guide for the measurement and the assessment of human exposure to hand transmitted vibration. Geneva: The Organization, ISO 5349; 1986. 6. American Conference of Governmental Industrial Hygienists. Hand-arm (segmental), vibration, in the 2010 TLVs and BEIs based on the documentation of the threshold limit values for chemical substances and physical agents & biological exposure indices. Cincinnati, OH: ACGIH; 2010. p. 188– 191. 7. American National Standards Institute. Guide for the measurement and evaluation of human exposure to vibration transmitted to the hand. New York: The Institute, ANSI S3.34; 1986. 8. Ver IL, Beranek LL. Noise and vibration control engineering, 2nd ed. Hoboken, NJ: Wiley; 2006. 9. Crocker MJ, editor. Handbook of noise and vibration control. Hoboken, NJ: Wiley; 2007. 10. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 411–433. 11. Konz S, Johnson S. Work design: Occupational ergonomics, 7th ed. Scottsdale, AZ: Holcomb

Hathaway; 2008. p. 426–433. 12. Bruce RD, Bommer AS, Moritz CT. Noise, vibration, and ultrasound. In: Denardi R, editor. The occupational environment: It's evaluation and control. Fairfax, VA: American Industrial Hygiene Association; 1997. p. 425–488. 13. Berger EH, Royster LH, Royster, JD, Driscoll DP, Layne M. The noise manual, 5th ed. Fairfax, VA: American Industrial Hygiene Association; 2003.

Chapter 17

Thermal Hazards: Heat and Cold

17.1 Background on Thermal Hazards Thermal energy concerns for the OSH community involve having too much heat or not enough heat. The concerns about too much heat are burns and heat disorders. This chapter summarizes the mechanisms of heat exchange between people and the environment, reviews indices used for evaluating exposures, explains the various disorders, and demonstrates how the risk-reduction strategies apply to thermal hazards.

17.1.1 Fundamentals of Thermal Energy for OSH Heat as a “source” of burn injury is typically the result of another type of energy being transformed into heat. For example, the burners on a stove are a hazardous form of heat energy. The heat in the common burner is the result of electrical energy flowing through coils of relatively high resistance. If a person were to touch a heating element on a stove and get burned, the most proximal cause of the injury would be heat, not electric current. A basic principle is that thermal energy flows from the warmer to the cooler region.1 The extensive equations for quantifying this heat-transfer process are taught in university courses called heat transfer and thermodynamics. Older books on these subjects used several units for heat energy, work, and power such as calories, British thermal units, and now joules and watts. The current SI units are summarized in Table 17.1. Table 17.1 Important Terms for Thermal Energy.

A common mode of heat transfer is by direct contact between the skin and a hot surface. Known as conduction, it occurs when skin directly contacts an object that is hotter or cooler than the skin. The

radiant heat mode occurs when the skin is exposed to sunlight, flame, or a nearby hot surface. Radiant heat transfer also occurs in cold environments where one's skin and clothing will transfer heat to cooler objects in the area. A third kind of heat transfer, convection, is implicated in burns from contact with scalding hot water or other fluid. Convection also applies to the exchange of heat between the skin and surrounding air. A less obvious type of heat transfer occurs when the sweat on skin and clothing evaporates. The evaporation process carries heat away from the skin. This mode of heat transfer plays an important role in heat stress and a moderate role in cold stress. These modes of heat transfer provide the basis for a general mathematical model to explain the various factors that enable people to maintain a relatively constant body temperature even when the surrounding air feels unpleasantly hot or cold. Their model begins with the premise that human heat balance (thermoregulation) depends on balancing the heat added to the body and the heat removed. By quantifying each factor in the same units, we should be able to sum the heat additions and the heat losses to arrive at a value near zero. The summative equation for change in body heat content (ΔS) during some period of time is (17.1) where

M is metabolic energy, Wk is external work performed, CV is heat gained or lost by convection, R is heat gained or lost by radiant heat transfer, CD is heat gained or lost by conduction, and E is heat lost by evaporative cooling.

Each heat transfer term in Equation (17.1) has a mathematical model (equation) for quantifying the effect on overall heat exchange. OSH professionals may find these equations helpful when working on control measures for particular heat sources. Readers looking for these equations are referred to book chapters referenced at the end of this chapter.2–4 For heat stress, the conductive heat transfer (CD) term may be dropped from Equation (17.1) because conductive heat transfer contributes very little to heat balance. For cold stress, CD is useful when the worker stands on frozen ground or on a cold floor (e.g., in a refrigerated room). The contact between the cold surface and a worker's boot can draw a significant amount of heat from the feet. Similarly, a job that requires manually handling cold objects, even with gloves, can remove considerable heat from the hands. The metabolism (M) term in Equation (17.1) always adds to the total body heat, but not all metabolism becomes heat. Some portion of metabolic energy may be used to perform external work. For example, walking up a stairway uses metabolism for raising the body upward (the work), as well as generating heat. The part doing external work does not add heat. For that reason, the work term (Wk) in Equation (17.1) is subtracted from total metabolism. The result is the true metabolic heat load. However, for practical occupational exposure assessment, the work term is generally ignored because it is a small portion (<10%) of metabolic heat. Convective heat transfer (CV) may either add or take away heat from the total body heat content. Heat is transferred to the body when the surrounding environment is warmer than the skin, and heat

moves out of the body when the skin is warmer than the surrounding environment. The rate of convective heat transfer is slower when the air-to-skin contact is static, as opposed to when the air moves over the skin. More generally, the temperature difference and the air velocity relative to the body surface affect the rate of convective heat transfer. In OSH, we usually think of the surrounding environment as air, but in some occupational situations, the surrounding environment is water or other liquid. This can occur in many work situations such as falling into cold water while working on a bridge or boat dock. Some divers work underwater on the hulls of docked ships. Sometimes rescue personnel find themselves in cold water, intentionally or unintentionally, when attempting to rescue someone from a body of water. A worker surrounded by cold water will rapidly lose heat, leading to loss of ability to swim. Radiant heat transfer (R) may either add or subtract heat from the total body heat content. Heat is transferred to the body when an external surface is hotter than the surface of the body facing the hot object. This effect is noticeable when working near a furnace, oven, heater, or flame, and becomes more pronounced when closer to the heat source. Another key factor in radiant heat transfer is the magnitude of the temperature difference between the external object and a person's skin and clothing. A greater difference means more heat transfer in the same time period. Radiant heat transfer also occurs in a cold environment, but the heat transfers from the person to nearby cooler objects. The primary factors that affect radiant heat transfer in the cold stress situation are the same as those in the heat stress situation: separation distance and temperature difference. Evaporative heat loss (E) provides the primary means for workers in hot jobs to maintain their normal body temperature. The physiological mechanism is to increase sweat production. More sweat on the skin and clothing supports an increased rate of evaporative heat transfer from the body. The rate of this heat transfer depends on the difference in the water vapor pressure in the air and on the skin surface, as well as the air velocity. These two factors explain a basic control tactic for work in hot, humid worksites—using standing floor fans to help speed up E. Without the fans, the difference in vapor pressure between the skin and air will be rather small because the static air next to the worker's skin becomes fully saturated. The result is almost no difference in vapor pressure and almost no evaporation, and the sweat will drip from the worker's skin to the floor. In contrast, with a fan, the air next to the worker's skin is constantly moving. The air from the fan will have a lower vapor pressure than the air immediately next to the sweaty skin and clothing, and this difference in vapor pressure accelerates the evaporation of sweat. In most situations, the sweat will evaporate rather than drip onto the floor. The human thermoregulation model in Equation (17.1) contains terms for the various factors involved in maintaining heat balance. Experts in cold stress and heat stress have attempted to find sound and practical indices to enable prediction of how various combinations affect humans. This task has led to some practical indices for OSH applications.

17.1.2 Indices for Cold Stress Basic indices for cold stress account for air temperature and wind speed. Using a table format, various combinations of air temperature and wind conditions are presented in terms of equivalent temperature under calm conditions. Equivalent temperature scales are found on the websites of weather services in countries with colder winters. Another index is the ACGIH TLV for cold stress.5 Typically, wind chill charts used by weather services reflect the equivalent cooling effect on bare skin of the various air temperature and wind speed combinations. These charts should be regarded as very general guides because of multiple

factors influencing acceptable exposures. For example, workers in cold jobs normally wear warm clothing, and their clothing varies greatly (e.g., type of coat, gloves/mittens, head cover, ear protection, footwear insulation, and nose cover). In addition, considerable variation is introduced by different amounts of metabolic heat generated by the work. Thus, tables based on exposed bare flesh provide only a rough basis for comparing cold conditions. The numerous variables explain why the world does not yet have a widely agreed upon exposure limit for workplace cold exposure.

17.1.3 Indices for Heat Stress Standards and guidelines for occupational heat exposure are somewhat more useful than those for cold. Several indices for heat stress have been proposed. Excellent explanations and commentary on these indices are provided by Ramsey and Bishop as well as Bernard.4,6 The index receiving the most support is the value obtained with a wet bulb globe thermometer (WBGT). It is a composite measure that accounts for the effect of air temperature, humidity, wind speed, and radiant heat transfer. It is based on three temperature measurements:

1. Black globe temperature (TG) is measured by a thermometer in the middle of a black, metal globe. The matt black globe surface absorbs radiant heat from hot objects in the area and reflects almost none. 2. Natural wet bulb temperature (TNWB) is measured by a thermometer with a wick around the sensor. The wick is wetted prior to taking a measurement. During the measurement, the water on the wick evaporates and cools. It is called “natural wet bulb” to distinguish it from the aspirated wet bulb temperature used by engineers for thermodynamic calculations. TNWB reflects the effect of environmental humidity on the E factor in Equation (17.1). In a humid environment, the evaporative cooling effect lowers the thermometer very little, while in a dry environment, the wick lowers the temperature more. Air movement also contributes to cooling the thermometer by accelerating evaporation from the wick. 3. Dry bulb temperature (TDB) is measured by a thermometer exposed to the air, and it accounts for the effect of air temperature on convective heat transfer.

Taken together, these temperature measurements provide values suitable for computing the WBGT. Two forms of the WBGT are used. For workers directly exposed to the sun, Equation (17.2a) is used, and for those not exposed to the sun, Equation (17.2b) is used. (17.2a) (17.2b) Heat stress exposure standards account for both environmental conditions using WBGT and physical activity level using estimates of metabolic rate(MR). A comparison of five different heat stress standards showed agreement in recommended WBGT within 1 or 2 °C.4 These standards use a table or graph to indicate their respective recommendations. Figure 17.1 illustrates a two-curve approach for evaluating measured heat exposures. The lower curve applies to workers who are not heat acclimatized; the upper one applies to workers fully acclimated to the hot conditions. The two curves are approximately the same as those found in the ACGIH TLV for heat stress, but in the TLV the two lines are labeled “action limit” and “TLV,” respectively.7 If exposures are above the action limit, various precautions need implementation. Exposures should not exceed the upper line. Points on the horizontal axis of Figure 17.1 are based on a time-weighted average metabolic rate (TWA MR) for 1 h. Using time expressed in minutes, the formula is

(17.3)

Figure 17.1 Example of heat exposure action levels and exposure limits.

Astute readers may notice that the metabolic heat rate for this exposure model ignores the external work term (Wk) in Equation (17.1). This is to simplify the process of obtaining a reasonable value for MR, and is based on the assumption that nearly all the energy from metabolism is in the form of heat (i.e., external work can be ignored). The corresponding formula for time-weighted average exposure, using WBGT, is

(17.4) Obtaining values for these two equations requires monitoring the employee for 1 h. During that time, the employee may perform work at different metabolic rates. Therefore, the time (ti) spent at each rate is required for Equation (17.3). Similarly, if the employee spends time in more than one work area, both the WBGT and the time in each work area are required for Equation (17.4). In practice, the metabolic rate values are less precise than the WBGT values. The common way to get metabolic rate values is to watch the worker, break down the hour into sessions of similar work level, and use metabolic rate values found in data tables for estimating MR for each session. Data tables are available with metabolic rates shown in various units, most commonly in kcal/min, kcal/h, or watts. Figure 17.1 uses watts. The ACGIH TLV also has a table with guidance for sorting exposure levels based on the proportion of time a worker spends working in the heat versus resting in the same heat. On initial impression, these guidelines appear to simplify the application. However, that can be misleading because the guidelines assume the rest area and the work area have the same environmental conditions. Only in rare cases does a worker need to rest in the same hot area as he or she works. Even when working outdoors in the sun, workers can usually find a shady place to recover. In addition, the work–rest categories assume the work is at the upper end. For example, the 50–75% category assumes the worker worked 75% and rested 25%. If the worker actually worked 55%, the guidelines are misleading because the indicated exposure line is for 75% work. Thus, this author discourages using the work–rest guidelines approach. It is better, and no more difficult, to compute the time-weighted values using Equations (17.3) and (17.4). With those values and knowledge of the worker's acclimatization, employee's exposure can be compared to the curved lines in the ACGIH TLV.

17.2 Mechanisms of Harming

This section explains the relationships between occupational exposure to thermal hazards and health effects—burns, heat disorders, and cold disorders. Also summarized are the effects of the workplace thermal conditions on the safety-related behavior of the workers. The most common burns result from skin contacting with a hot object or fluid. Burns can also result from excessive contact with cold objects. The severity of heat burns is determined by two main factors: (1) the difference in temperature of skin and the contacted object or fluid, and (2) the duration of the contact. We all know from life experiences that if our finger contacts a hot object and we quickly withdraw, we can limit the severity of a burn or avoid any burn at all. We also know that for the same duration of contact, touching a hotter object will cause a more severe burn than touching an object that is not as hot. In addition to the burns incurred through conduction, we can be burned from exposure to radiant heat. Two common sources of radiant heat associated with occupational burns are sunlight and welding. Both can cause severe burns. Burns from cold also involve conduction. Both important factors applicable to heat burns also apply to cold conduction burns—the colder the object, and the longer the contact, the greater the severity. Another factor is moisture. Moisture between the cold object and the skin will freeze and adhere to both surfaces. A curious child who touches his tongue to a cold metal pipe will soon find that his tongue is frozen to the pipe. Humans are warm blooded and must maintain a core temperature within a narrow margin (the prescriptive zone). Too much heat can cause the core body temperature to rise above the normal, healthy level (approximately 38 °C), and too little heat can cause the core body temperature to sink below the normal, healthy range. For repeated occupational exposures to cold working conditions, it is undesirable to allow core temperatures below 36 °C. Lower core temperatures are associated with reduced vigilance and reduced manual dexterity. In addition, when the core body temperature gets low, the circulatory system reduces blood flow to the extremities, making fingers, toes, ear lobes, and the nose vulnerable to frostbite. Disorders associated with heat are described in material by the U.S. National Institute for Occupational Safety and Health, and available at www.cdc.gov/niosh/topics/heatstress. It describes the heat disorders—heat stroke, heat exhaustion, heat cramps, fainting, heat rash, and transient heat fatigue—listing the symptoms and appropriate first-aid procedures. Similar material on cold stress is available at www.cdc.gov/niosh/topics/coldstress. It provides information about the cold disorders— hypothermia, frostbite, trench foot, and chilblains. Information about the occupational groups most affected by heat and cold disorders comes from a retrospective review of workers' compensation records in the United States.9 The occupational categories with the largest proportion of claims for heat disorders (heat exhaustion and heat stroke) were farm laborers (7.5%), firefighters (6.8%), miscellaneous laborers (5.6%), construction laborers (5.2%), miscellaneous operatives (4.7%), truck drivers (4.3%), laborers not specified (3.8%), and gardeners/groundskeepers (3.4%). The occupational categories with the largest proportion of claims for cold disorders (mainly frostbite) were miscellaneous laborers (10.4%), truck drivers (7.6%), construction laborers (4.3%), firefighters (3.6%), garbage collectors (3.4%), police and detectives (3.3%), and farm laborers (3.1%). An indication that most cases arose in outdoor conditions comes from the finding that 75% of the cold cases occurred in the coldest months, January and February. The body parts affected by cold were finger (24.5%); foot, not toes (14.4%); hand (14.0%); toe (12.9%); multiple body parts (5.1%); ear (4.2%); upper extremity (3.4%); respiratory system (3.1%); lower extremities (2.5%); and nose (1.4%). For the year studied, the total number of claims was 762 for heat disorders and 645 for cold disorders.

Occupational heat and cold exposure not only causes heat and cold disorders, but also affects safety-related behavior. A 14-month observational study was conducted in a metal products manufacturing plant and a foundry.9 Thermal environment data and observations of safety-related behavior were obtained. Results showed the unsafe behavior rates were lowest in the mid-range of conditions (approximately 17–23 °C). The proportion of unsafe behaviors increased on both the cooler and the hotter ends of the range.

17.3 Strategies and Tactics for Thermal Hazards The strategies for reducing risk associated with workplace heat are listed in the left column of Table 17.2. On the right are major groups of applicable tactics. Table 17.3 lists similar strategies and tactics for cold work environments. The text below clarifies or supplements the tactics in the table. Table 17.2 Strategies and Tactics for Reducing the Risks of Workplace Heat. Risk-reduction strategy

Risk-reduction tactics

1. Eliminate the hazard 1a. Avoid hot surfaces in work areas 1b. Eliminate existing hot surfaces 1c. Eliminate need for personnel to work in hot area by having them perform the task in cooler area

2. Moderate the hazard 2a. For hot surfaces, use minimum heat needed 2b. Provide portable fans or spot cooling to accelerate evaporative cooling rate 2c. For work in the sun, provide some shade 2d. Manage individual heat load to avoid having an extra high heat load hour during a shift by scheduling heavy tasks for cooler part of day, mechanizing heavy tasks, or assigning more personnel to share the heavy work

3. Avoid releasing the hazard

3a. For pipes and containers with hot materials under pressure, assure integrity of connection points to avoid releasing hot materials 3b. For hot material stored or transported under high pressure, avoid an explosive release by installing a suitable pressure-relief valve to avoid an internal pressure buildup

4. Modify release of the hazard

4a. Fully enclose heat source except for in–out ventilation ports to take heat away

4b. For very hot materials stored under pressure, install overpressure devices so that if internal pressure exceeds a set point, the released material will be sent in the least harmful direction 4c. For pipes and containers with steam or other hot material under pressure, provide a shield around pipe nodes so that if a leak develops, the hot material spray will be interrupted and redirected

5. Separate the hazard from that needing protection

5a. For radiant heat sources, provide a barrier between personnel and source of radiant heat. Insulation around hot pipes and containers also helps by exposing a cooler outer surface to the workers

5b. For heat generating equipment, locate heat source away from employee areas 5c. For hot objects in workplaces, install insulation to separate the hot surfaces from personnel

6. Improve the resistance of that needing protection

Personnel can improve their resistance to heat stress, but this is classified as part of Strategy 7 because the change is not permanent.

7. Help people perform safely

7a. Make and use an acclimatization program for new workers and those returning from several days away from work. 7b. Support a program to encourage employees who work under heat stress conditions to maintain or improve their physical fitness 7c. Train employees exposed to heat stress on lifestyle, clothing, precautionary behavior, self-monitoring, and monitoring fellow workers 7d. Make sanitary drinking water readily available for those exposed to heat stress

7e. Provide rest areas suitable for cooling off 7f. Encourage frequent breaks for those exposed to heat stress

8. Use personal protective equipment

8a. Provide personal cooling vests to help with briefer exposures to very hot work areas

8b. For workers using full-body chemical protective gear, provide extra airflow through the suit to remove heated, humid air

9. Expedite recovery 9a. Maintain a cool space for any employee who shows signs of heat cramps or heat exhaustion 9b. Maintain first-aid capability appropriate for treating burns and heat disorders

Table 17.3 Strategies and Tactics for Reducing the Risks of Cold Objects and Work Environments. Risk-reduction strategy Risk-reduction tactics 1. Eliminate the hazard 1a. Avoid putting freezing surfaces in working areas

1b. Eliminate existing freezing surfaces from working areas 1c. Eliminate need for personnel to work in cold area by having them perform the work in warmer area

2. Moderate the hazard Provide a portable heater to add warmth to a cold room

3. Avoid releasing the hazard For very cold materials (e.g., cryogenics), design, build, install, and maintain storage vessel and transport tanks using best practices

4. Modify release of the hazard

For storing or transporting liquefied gases, place overpressure devices so that if internal pressure exceeds a set point, the expanding gas will be sent in the least harmful direction

5. Separate the hazard from that needing protection

5a. When outdoor weather is cold, provide personnel with comfortably warm indoor work areas

5b. Locate freezing objects away from employee areas 5c. When personnel must work outdoors in cold weather, provide wind-breaking barriers

6. Improve the resistance of that needing protection

This strategy does not apply because changes in people are not permanent.

7. Help people perform safely

7a. Support a program to encourage employees who work under cold stress conditions to maintain or improve their physical fitness 7b. Train employees exposed to cold stress on lifestyle, clothing, precautionary behavior, self- monitoring, and monitoring fellow workers 7c. Make sanitary drinking water and warm beverages readily available for workers exposed to cold stress 7d. Provide rest areas suitable for warming up 7e. Establish a work/rest schedule suited to the cold work exposure

8. Use personal protective equipment

8a. Provide personal heating devices to workers exposed to very cold areas

8b. Provide cold-appropriate personal protective gear for hands, feet, and head 8c. Provide some financial assistance for workers to buy cold-appropriate pants and coat

9. Expedite recovery 9a. Maintain a warm space for any employee who shows signs of cold stress such as disorientation and shivering 9b. Maintain capability to treat an employee who develops a cold-related disorder

The first strategy is to eliminate the hazard either during the facility design phase or during the operation phase. The design phase of a facility may afford opportunities to eliminate from occupied rooms equipment having surfaces either hot enough or cold enough to harm personnel. Once operational, similar opportunities might be found for removing the same type of equipment from an unoccupied work area. It may also be feasible in some situations to make arrangement so that employees to perform work in a very hot or very cold area can do the work in a more moderate area. The second strategy is to moderate the hazard. On building construction projects during winter, workers doing interior work often use a portable heater to make the room temperature more tolerable. Similarly, when work is required in a hot area, the use of spot cooling devices can reduce

the heat level. Using fans to blow air directly on workers in hot, humid areas helps them maintain thermal balance by accelerating evaporative cooling from sweat. However, fans have limited value in dry climates because the sweat already evaporates rapidly. Also, when the air temperature is well above skin temperature (e.g., above 40 °C), blowing hot air on the workers adds more heat through convection than it removes through evaporative cooling. To decide if fans will help, watch the workers to see if sweat accumulates on their clothing. If their clothing gets drenched, fans will probably help. If their clothes appear dry, adding fans will be ineffective since the sweat is already evaporating quickly without a fan. If work is performed in the sun, any form of full or partial shade will help reduce the radiant heat load. Another tactic for moderating heat load is to use one of the following means for managing the heat load from heavy manual work. One approach is to schedule tasks so that the highest metabolic rate tasks are performed during the coolest part of the shift. A second is to assign extra personnel to share the heavy work performed in a hot location so that no individual is exposed to an excessive heat level. A third is to mechanize the heavy manual tasks. Strategy 3 is to avoid releasing the hazard. The release of hot material under pressure (e.g., steam) from pipes and containers is prevented by designing, installing, and maintaining the interfaces/nodes so that no leaks develop. For hot material stored or transported under high pressure, an internal pressure buildup leading to an explosive release of hot material can be prevented by installing and maintaining suitable pressure-relief devices. For some normally gaseous materials kept in a liquid state by maintaining them at an extremely cold temperature, release can be prevented by designing, building, installing, and maintaining quality storage vessel and transport tanks. Especially important are cryogenic materials—those stored at temperatures below −180 °C (93 K). Some materials stored in cold temperatures above the cryogenic level are also highly hazardous if the refrigeration fails. Managing such materials requires best- practice aspirations; anything less is simply unacceptable for liquefied materials that can expand rapidly and disperse into personnel areas. Best practices include having a first rate process safety management program. The fourth strategy is to modify release of the hazard. For a specific source of heat, such as a machine or heating process, it may be feasible to enclose the source except for openings to allow ventilation ducts to bring in cooler air and exhaust the heated air. For pipes and containers with steam or other pressurized hot materials, leaks can develop at connection points. An engineering approach for this potential hazard is to install shields around pipe joints/nodes so that if a leak develops, the hot material spray will be interrupted and redirected for minimal harm. For storing or transporting liquefied gases, incorporating overpressure devices is standard practice. These devices work by releasing small to moderate amounts of material when internal pressure exceeds a set point. The fifth strategy is to separate the hazard from that needing protection. Some basic practices are noted in the two tables. Locate heat sources away from employee areas. For pipes and containers with steam or other hot materials, install insulation around the pipes and containers to avoid having surfaces in the work area capable of causing burn injuries. In some work areas, radiant heat transfer contributes substantially to the total heat load by radiating to the worker's clothing and skin, as well as heating up various objects in the work area. A radiant heat shield between the radiating surface and work areas can effectively protect workers from the radiant heat. For pipes and containers with steam or other hot materials, the potential hazard of a leak shooting hot material at nearby workers can be prevented by designing facilities so personnel will not be exposed. Containers with cold materials also benefit from insulation and placement away from employee areas. An example of Strategy 5 so routine that it may go unnoticed is the practice of

putting thermal insulation on the handles on snow shovel and numerous other metal-handled tools used in cold environments. The sixth strategy, to improve the resistance of that needing protection, is not applicable. Heat acclimatization is not a permanent change so it belongs in Strategy 7--help people perform safely. For work in hot environments, some employers have an acclimatization program for new workers and those returning from several days away from their hot jobs. Adaptations associated with acclimatization to heat include increased sweating, less salt in the sweat, and improved sense of how much water is needed to maintain hydration. Tactics listed in Table 17.3 for cold stress do not include acclimatization because, unlike working in the heat, working in the cold does not lead to significant physiological acclimatization. Both tables include the use of medical prescreening for personnel prior to assignment to a job with significant heat stress or cold stress, and both tables list supporting a program to encourage employees with thermally stressful jobs to maintain or improve their physical fitness. Several other tactics for Strategy 7 are noted in the two tables. Several tactics apply to work in both hot and cold environments. Among these is training workers on lifestyle, clothing, precautionary practices, self-monitoring, and monitoring fellow workers. Another is making water and other hydrating fluids readily available. Cooled drinks are desirable for work in hot environments, and warm to hot drinks are best for work in cold environments. A suggested policy for encouraging adequate hydration is to respect the preferences of individuals by making available diverse nonalcoholic beverages. Attention to rest breaks is a third shared tactic. Obviously, a cool break area is desirable for employees who work in hot environments, while a warm break is needed for those who work in cold environments. In addition, more frequent, shorter breaks are preferred to less frequent, longer breaks. Some employers have a self-determination break policy—allowing each worker to decide when to take a break. Such a policy can succeed if the personnel share an adequate work ethic. Strategy 8 is to use personal protective equipment. The tactics listed in Tables 17.2 and 17.3 are widely recognized and need no clarification. In addition to these widely used practices, some employers provide employees an allowance to purchase work clothing appropriate to the thermal conditions of the workplace. The ninth strategy is to expedite recovery. Two similar tactics are listed for both hot and cold workplaces. For hot working conditions, a basic tactic is to maintain a cool space for any employee who shows signs of a heat disorder such as heat cramps or heat exhaustion. A second tactic is to maintain the capability to treat an employee who develops heat stroke. A worker suffering from heat stroke needs immediate and aggressive action to lower his or her core body temperature. It could be a fatal mistake to leave a heat stroke victim lying in a cool room or in the shade while waiting for an ambulance. They need aggressive cooling such as immersion in a bath of cold water. For cold work conditions, workers may develop frostbite on the tip of their nose or on an exposed earlobe without being aware of it. A part of training for work in cold environments should include the role of each team member to watch fellow employees for frostbite or signs of early hypothermia such as disorientation, confusion, shivering, loss of coordination, and fatigue. Catching these developing conditions early, and providing appropriate care, can head off more severe outcomes.

Learning Exercises 1. Employers have diverse policies on paying for personal protective equipment. Imagine

you are asked to consult for a large farming operation with laborers employed during cold winter months and hot summer months. For each of the items listed, do you think the PPE should be purchased by the employer, the employee, or should they share the costs?

a. Hearing protection inserts.

b. Gloves.

c. Work boots.

d. Work pants.

e. Work coat.

f. Head protection.

g. Safety glasses (nonprescription).

h.Safety glasses (prescription).

2. For the same farming operation, what policy differences would you recommend for the seasonal employees? 3. Two OSH professionals spent a hot summer day collecting data on employee exposures to heat stress. During the afternoon, they monitored a particular worker from 2 pm until 3 pm. One person set up the thermometer stand near the worker and recorded temperatures frequently. The other person observed the worker's activities and estimated metabolic heat using tables. The worker's activities were broken down into four segments of similar metabolic rate. Results are summarized below.

a. What value is the TWA WBGT for the hour?

b. What value is the TWA MR for the hour?

c. Compare the TWA values computed with the curves in Figure 17.1. What is the conclusion about heat exposure?

4. A topic of some controversy for heat stress work concerns whether to recommend that workers in these jobs increase their dietary salt intake. Associated with this issue is whether an employer should provide drinks containing sodium and potassium salts (“sports drinks”). Answer the following questions.

a. What do you think is the rationale for encouraging increased salt intake.

b. What do you think is the rationale for not encouraging increased salt intake.

5. There is widespread agreement that employers should provide sanitary drinking water for employees. Drinking fountains are a common means of delivery. In construction sites and agriculture workplaces, drinking fountains are generally not feasible and water jugs are common. Do some research on the Internet or in sanitation books to learn about sanitation requirements for drinking water. What minimum sanitation practices should be followed when using water jugs?

Technical Terms Acclimatization The physiological changes that occur in response to a succession of days of exposure to environmental heat stress

that reduces the strain caused by the overall heat stress. Conductive heat transfer (CD)

The net heat exchange by conduction between an individual and objects in contact with the individual during a specified period.

Convective heat transfer (CV)

The net heat exchange by convection between an individual and the environment during a specified period of time.10

Evaporative heat loss (E)

Body heat loss by evaporation of water (sweat) from the skin during a specified period of time, expressed as kcal, Btu, or W.10

Metabolic rate (MR)

Time rate of energy produced by metabolism. Example units are kcal/min and W/h.

Metabolism (M) Energy produced by oxidation in muscles. When used in Equation (17.1), M is total metabolic energy of the person during a specified period of time.

Radiant heat transfer (R) Heat exchange by radiation between two radiant surfaces of different temperatures.

10

Thermoregulation The maintenance of core body temperature within a narrow range.

References

1. Hazen RM, Trefil J. Science matters: Achieving scientific literacy, 2nd ed. New York: Anchor; 2009. p. 33–41. 2. National Institute for Occupational Safety and, Health. Criteria for a recommended standard: Occupational exposure to hot environments, revised criteria 1986 DHHS(NIOSH) Publication No. 86- 113. Cincinnati, OH: The Institute; 1986. p. 18–23 and Appendix B. 3. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 337–357. 4. Ramsey JD, Bishop PA. Hot and cold environments. In: DiNardi SR, editor. The occupational environment: Its evaluation and control, 2nd ed. Fairfax, VA: American Industrial Hygiene Association; 2003. p. 613–642. 5. American Conference of Governmental Industrial, Hygienists. Cold stress. In: 2010 TLVs and BEIs based on the documentation of the threshold limit values for chemical substances and physical agents & biological exposure indices. Cincinnati, OH: The ACGIH Association; 2010. p. 200–208. 6. Bernard, TE Occupational heat stress. In: Bhattacharya A, McGlothlin J, editors. Occupational ergonomics. New York: Marcel Dekker; 1996. p. 195–218. 7. American Conference of Governmental Industrial Hygienists. Heat stress and heat strain. In: 2010 TLVs and BEIs based on the documentation of the threshold limit values for chemical substances and physical agents & biological exposure indices. Cincinnati, OH: The ACGIH Association; 2010. p.

209–218. 9. Jensen RC. Workers' compensation claims relating to heat and cold exposure. Professional Safety. 1983; 28(9): 19–24. 10. Ramsey JD, Buford CL, Beshir MY, Jensen RC. Effects of workplace thermal conditions on safe work behavior. J Safety Research. 1983; 14(3): 105–114. 11. National Institute for Occupational Safety and, Health. Criteria for a recommended standard: Occupational exposure to hot environments, revised criteria 1986 DHHS(NIOSH) Publication No. 86- 113. Cincinnati, OH: The Institute; 1986. Appendix A, Glossary.

Chapter 18

Fire Hazards

18.1 Fundamentals of Fire Fires cause considerable harm, including death, injuries, air pollution, property damage from the fire, and property damage occurring during firefighting. Financial losses continue after a fire from business interruption, time to recover lost documents, medical costs for those harmed, temporary relocation costs, salaries paid to personnel who are doing recovery work rather than work contributing to business goals, and damaged reputation in the community. Not all of these diverse consequences fit neatly into the mainstream duties assigned to OSH professionals. OSH professionals tend to focus on employee safety and health, but responsibilities often extend to other related business needs. Common collateral duties include security, product safety, workers' compensation, environmental pollution, waste management, visitor safety, liability insurance, and property/fire insurance. Thus, facility fire protection is one of many knowledge areas the OSH professional may need during a career. This chapter discusses how fires start, are sustained, and spread; describes how fires cause harm; and provides numerous examples of how the nine risk- reduction strategies are used.

18.1.1 Elements for Starting and Sustaining Fires Fires are transition processes for states of energy. The transition involves changing potential chemical energy into other forms of energy through combustion. In combustion, a fuel containing stored chemical energy is oxidized. In most cases, an ignition source triggers the initial chemical reaction to release the stored energy. Fire processes may be modeled simply as The initiating elements consist of a fuel, an oxidizing agent, and heat for ignition. A fire may be defined as rapid oxidation of material during which heat and light are emitted.1 Other common outputs are flames, smoke, and gases. Many fires start and soon die out. What it takes for continued burning is known as a chemical chain reaction, which combines with the three ignition elements to sustain a fire:

1. Fuel, 2. Heat, 3. Oxidizing agent, and 4. Chemical chain reaction.

These four elements are sometimes depicted graphically as a four-sided geometric shape (tetrahedron or rectangle). Figure 18.1 illustrates the difference in the elements for igniting a fire and for sustaining a fire. Basic background on each of the four elements is provided below. Figure 18.1 Elements for igniting a fire and for sustaining a fire.

18.1.1.1 Fuel Fuels come in so many forms that a standard classification system is used for everyday practice. The fire insurance industry uses these classifications when assessing the fuels in an insured property. Fire protection engineers use the classifications when designing fire sprinkler systems for buildings. Building owners use the classifications to select portable extinguishers to match the types of fuels in the area. The classifications used in the United States are listed in Table 18.1. All are based on the fuel burned except Class C, which consists of energized electrical equipment. It differs from the other classes in that electrical fires are the result of extreme heat from current flowing across gaps in the circuit, as discussed in chapter 15. The extreme heat can burn insulation and create a constant source of arcs that sustains nearby burning. Table 18.1 Fire Classes A, B, C, D, and K

The physical state of the fuel affects its ability to ignite and to sustain a fire. The solid materials

(mostly Classes A and D) can be found in large pieces as well as fine dusts. A solid wooden beam is relatively difficult to ignite, whereas wood dust is relatively easy to ignite. The difference is explained by the ratio of surface area to mass—a higher ratio being easier to ignite. A second major factor is whether the fuel is in a gaseous, liquid, or solid state—gaseous being most easily ignited and solid being least. A third factor that plays an important role in the ignitability of fuels is temperature —a higher temperature makes a fuel easier to ignite, and the fire will burn with greater intensity. The Class B fuels get extensive attention in the fire codes and in the practice of OSH. The obvious reason is that most of these materials are relatively easy to ignite—many having been produced to serve society as fuels. Most flammable and combustible (F&C) materials encountered in general industry are found in a liquid or gaseous state. Some are found in a solid state, such as those used as rocket fuel propellants. Industries have learned ways to transport, store, and dispense F&C materials, so the risk of unintentional ignition is quite low but not zero. When an unintentional fuel ignition occurs, it is usually the result of multiple failings in the established controls. The actual burning of solids and liquids takes place within vapors on the fringes of the material. For example, when wood is heated, it gives off vapors. If the heat is sufficient, the vapors ignite, the combustion creates flame, the flame heats other parts of the wood, more vapors are produced, and the fire spreads. With F&C in liquid state, there is a layer of vapors just above the top surface. The concentration of this vapor is higher at the surface and declines with distance. Somewhere in this range, the concentration of vapor is within the flammable range. For each material, this range is defined by a lower flammable limit (LFL) and an upper flammable limit (UFL). When the vapors are ignited, the heat produced warms the liquid in the top layer of the liquid F&C material, causing an increased rate of liquid changing to vapor. If the temperature of the liquid is above its ignition temperature, the liquid continues to burn, constantly feeding the fire until all the liquid available is consumed. 18.1.1.2 Heat Ignition sources are forms of heat energy. They may be grouped into four categories: mechanical, electrical, chemical, and nuclear. Figure 18.2 is a fault tree showing one way to visualize the role of the four fuel types in a sustained fire. Being under an OR gate means any one or various combinations of the fuels can sustain a fire. Each type of heat energy is discussed below. Figure 18.2 Fault tree depicting how a fire can be sustained by any of four alternative heat sources.

Mechanical heat can develop from friction or compression. Fans in ventilation ducts provide an

example of friction heat. The friction of rotating metal-to-metal parts can heat the metal enough to ignite flammable vapors in the ventilation duct. Diesel engines provide an example of compression heat. In the cylinders, each cycle involves compressing a mixture of air and diesel fuel until it explodes. Electrical heating can develop in four ways: 1. resistance—too much current through the circuit causes heat buildup; 2. arcing—current flowing across a gap in the circuit; 3. static—electron flow between two surfaces having different charges; and 4. lightning—intense flow of electrons between a cloud and the earth. Chemical heating can develop in four ways: 1. combustion—heat generated by a fire igniting nearby fuels; 2. decomposition—pile of materials subjected to an external heat source decomposes and generates heat; 3. spontaneous heating—decomposition rate of materials becomes rapid enough to initiate fire with no external source of heat; and 4. solution—mixing certain chemicals generates enough heat to start a fire. Nuclear energy comes from changes in the nuclei of atoms. Both fission and fusion processes can occur in controlled conditions in which the heat generated by the reaction is continuously removed to maintain a heat level in the reactor core in the safe tolerance range. Without an effective cooling system, the heat would rapidly rise to a level high enough to ignite many objects in the area. Regardless of which type of heat is involved, a fire will not start unless the amount of heat energy is sufficient. Under controlled laboratory conditions, a material is tested to determine the minimum temperature required to ignite it. The ignition temperature is useful for comparing different materials being considered for buildings, furniture, and consumer products. The amount of heat energy required to raise the temperature of a material to its ignition temperature is not so easily determined outside a laboratory. For example, consider that while you are at a station pumping gas into your car, you see another customer filling his car while smoking a cigarette. Should you worry? Is the amount of heat in his cigarette sufficient to ignite gasoline vapors? 18.1.1.3 Oxidizing Agent Oxidation is an exothermic chemical reaction that releases the potential energy stored in a fuel. Oxygen is the most common oxidizing agent; other chemicals that function as oxidizers include chlorine, fluorine, hydrogen peroxide, nitric acid, sulfuric acid, and hydrofluoric acid.2 These chemicals react by taking on electrons from a fuel and releasing oxygen during the combustion process. Common oxidation processes release energy at different rates, as follows:3

Rusting is a slow form of oxidation. Metabolism is a faster form of oxidation than rusting. Fire releases energy at a much faster rate than metabolism. Combustion explosions release large amounts of energy in a very brief time.

18.1.1.4 Chemical Chain Reaction The fourth element of a sustained fire is a chemical chain reaction. Think about being on a camping trip. You find a nice campsite, set up your tent, find some twigs and logs, and select a suitable fire pit. It helps to have some dry paper you can wad up for the base of the fire. On top of the paper, you lay

your twigs. You continue by arranging on top of the twigs some thin-sized branches and small logs. You use a match to ignite the paper, creating a flame that heats the twigs. The twigs catch fire quickly, and you hope the branches will also ignite. With the base materials burning, the logs get hotter and begin to emit flammable vapors. If the materials were dry and arranged well, you will soon have a sustained campfire.

18.1.2 Fire Spread Fires sustained by the four elements discussed above tend to spread from the burning fuel to unburned fuel. Spreading occurs in several ways, one being through direct flame contact (as in the above example, where the campfire spreads from the paper to the twigs and upward). Fire investigators looking for signs of arson seek visual signs of flames spreading upward from a single spot. Once they identify the spot of origin, they can hypothesize about how and why a fire could have started at that point. Other forms of heat transfer were discussed in chapter 17 on thermal energy but are revisited here from a different perspective. When a building is on fire, convective heat transfer occurs when the heated air rises and fills the space near the ceiling. If the heated air in a burning room travels laterally to an adjacent room, it will carry the hot air to that room and possibly raise the room temperature enough to ignite materials, thereby spreading the fire. If the lateral flow is blocked, the rising hot air will push the cooler air down, setting up a circular flow within a space. Radiant heat transfer occurs when two objects are separated by open space. The direction of the heat transfer is from the hotter surface to the cooler surface, like a campfire warming the campers. In hotter building fires, the hot wall of a burning building radiates substantial heat to adjacent buildings. The actual heat transfer is the result of electromagnetic waves initiated by the warmer object flowing to the surface of the cooler object. When the electromagnetic waves reach the surface of the cooler object, the energy converts to heat. Forest fires spread through radiant and convective heat transfer. They radiate heat from burning trees to trees not yet burning, heating up and drying out the tree leaves, pine needles, pinecones, and branches. Air heated in the burning section spreads laterally and upward. The lateral spread heats up adjacent trees, and essentially prepares them for ignition. The vertical convective currents carry small embers from burning trees that, after reaching a plateau, tend to descend ahead of the fire spread onto dry tree parts that promptly ignite. Conductive heat transfer occurs through a solid object or between two objects touching one another. This form of heat transfer plays a role in spreading fires within a building. Metal pipes are good heat conductors, so pipes between rooms can transfer heat from a room with fire to an adjacent room. The heat level can become sufficient to ignite materials with relatively low ignition temperatures. Of particular concern are flammable vapors. Thus, in rooms where flammable vapors might exist within their flammable range, metal pipes are recognized as a potential ignition source in need of appropriate controls.

18.1.3 Flashovers and Backdrafts: Threats to Firefighters When fighting structural fires, firefighters face numerous threats to their safety and health, two of which are flashovers and backdrafts. Their respective progressions are briefly explained below. Flashovers start with a fire in an enclosed room. Heat builds up until the ignition temperature of major materials in the room is reached. Suddenly, many things in the room ignite in a flash. The

ignition creates a burst of expanding, hot air that can be fatal to an exposed firefighter. Another special form of fire-originated explosion is known as a backdraft. Briefly, this starts with a fire in an enclosed room. All the room oxygen is consumed, leaving the space filled with smoke and hot gases with a high concentration of carbon monoxide—a flammable gas. An opening to the space occurs, perhaps when a firefighter opens a door. Oxygen enters the room. Very rapid burning of the fresh oxygen occurs, raising the room temperature enough to ignite the carbon monoxide and causing room gases to expand with explosive force. Such an event was dramatically depicted in the movie Backdraft.

18.2 Mechanisms of Harming Harm from fires starts with destruction of the fuel burned. Fire causes further harm by destroying valued property, causing smoke damage, and injuring people. In addition, when firefighters respond to a structural fire, they often need to break glass, chop openings in roofs, and spray powerful water streams into rooms, all of which cause property damage. The fire by-products of heat, light, flame, smoke, and fire gases can be hazardous to both building occupants and firefighters. The respective mechanisms of harm are outlined below.

Heat. The heat from a fire transfers heat to surrounding areas, facilitating the fire spread. For human safety, heat is a problem if the fire develops so rapidly that some people are unable to avoid exposure to the intense heat. This scenario sometimes happens when people are trapped on one of the upper floors of a building. Heat from fires is also a key element in flashovers and backdrafts.

Light. The light produced by fire is not considered a serious threat to people. Flame. Flame spreads fire and can cause extremely serious burns. An unfortunate but too-

common scenario involves a person getting sprayed or soaked in a flammable liquid that ignites.

Smoke. Smoke damages the interior of a burning building and pollutes the air. More importantly for building occupants and firefighters, smoke reduces visibility. In many industrial fires, the fire burns materials like hydraulic fluid, with a by-product being very thick, dark smoke. The smoke initially rises to the ceiling. If there is no place for it to go laterally, the dark smoke fills the room from the top downward, thereby obscuring visibility to such an extent that people in the room cannot find an exit.

Fire Gases. Fire gases account for the largest number of fire fatalities. Two particularly common fire gases are carbon monoxide (CO) and carbon dioxide (CO2). Exposure to CO disrupts the effective supply of oxygen to the brain and other body parts, which can lead to poor judgment and mental errors that make escape less likely. Exposure to CO2 increases the rate and depth of a person's breathing, contributing to a faster rate of CO uptake.3 These two gases, plus reduced oxygen concentration in the air, can cause unconsciousness and death from asphyxiation before the person manages to exit to a fresh air environment. Numerous other toxic gases can develop in fires as well, depending on the materials burned.

18.3 Strategies and Tactics for Fires

Risk reduction for fires involves the full spectrum of Haddon's three phases. During the pre-event phase, there are extensive methods for preventing a fire. This phase is the priority, but the subsequent two phases also afford useful opportunities for reducing risks. In the during-event phase, damage can be heavily influenced by an installed response system, evacuation procedures, and firefighter responses. During the post-event phase, there are many opportunities to minimize the financial losses to property and business. Also, getting high-quality medical care and rehabilitation services for anyone harmed in a fire can help limit the consequences for the victim and for any entity with financial liability. Including all three of the Haddon phases in a fire protection plan provides the most effective approach to minimize total risk. Hot-work permit programs encompass several of the nine risk-reduction strategies. These are used in industries in which specific work operations generate heat capable of igniting a fire (e.g., welding and torch cutting). Some standards and codes list specific processes to include, but each company may include a broader list in its hot-work program. The idea behind hot-work permits is the requirement that jobs be planned before they are started. Planning includes inspecting the site, specifying the heat generating processes, removing or covering combustible materials, avoiding work if flammable vapors are present, using a person to stand by with a fire extinguisher and watch for any start of a fire, and following specific steps after completing the work. For the most part, the tactics incorporated into hot-work programs are the same as those used for fire protection generally, but some of the tactics listed in Table 18.2 are unique to hot work. Table 18.2 Strategies and Tactics for Reducing the Risks of Fires. Risk-reduction strategy Risk-reduction tactics 1. Eliminate the hazard 1a. Eliminate fuels

1b. Eliminate heat sources 1c. Eliminate oxidizers. Monitor to ensure goals are met

2. Moderate the hazard 2a. Limit fuel quantities 2b. Substitute less flammable materials for more flammable materials

3. Avoid releasing the hazard 3a. Design and build systems to minimize risk of fuels, heat, and oxidizer coexisting 3b. Install lightning protection on structures 3c. Maintain very low oxygen content in a space 3d. Store F&C materials well below or well above their flammable range. Monitor to ensure goals are met 3e. Avoid static spark ignition by grounding and bonding containers involved in F&C transfers

4. Modify release of the hazard 4a. Provide automatic detection and response systems 4b. Design buildings with venting system for fire gases and smoke 4d. Have a pre-fire plan for howfire fighters will attack fire in different parts of the site

5. Separate the hazard from that needing protection

5a. Use space and/or barriers to separate operations of higher fire risk so that any fire damage will be confined 5b. Maintain separation between F&C compressed gases and high-oxygen-content gases using distance and/or barriers (e.g., acetylene and oxygen cylinders) 5c. Store small quantities of F&C materials in approved storage cabinets 5d. Build firewalls to separate areas of fire risk from areas for people and valued property 5e. Cover ignitable items in areas where hot work will be performed

6. Improve the resistance of that needing protection

6a. Construct facilities with fire-resistant materials

6b. Cover structural beams with heat insulation to limit damage from heat of a fire 7. Help people perform safely 7a. Train personnel on fire prevention tactics

7b. Conduct fire evacuation drills

7c. Ensure fire exits are well marked and maintained 7d. Provide remote controls for valves and other critical devices that might be needed during fire response 7e. Provide appropriate training and equipment for personnel who may help with fire response

8. Use personal protective equipment

8a. Provide fire-resistant clothing for personnel who work with F&C materials

8b. Provide appropriate PPE for personnel who may participate in response to a fire 9. Expedite recovery 9a. Establish and maintain a business continuity plan

9b. Be prepared to render effective first aid to personnel affected by a fire

Risk-reduction tactics for fires and explosions are far too numerous to cover in a single chapter of a book. A more feasible approach is to refer readers to more extensive sources of information, particularly building codes, fire codes, and electrical codes used throughout the world. Some industrial sectors with high potential for major fires (e.g., chemical processing and petroleum refining) have created guidelines specific to the industry. In the United States, fire codes and electrical codes are developed and distributed by a voluntary organization—the National Fire Protection Association (NFPA)—while other countries may have their own codes and code-writing organizations. Whatever the source, these organizations are outstanding sources for information about what should be done to prevent fires, to protect structures, and to facilitate the safe exit of occupants. Some fundamental features in these codes warrant mention in this book on risk-reduction strategies for OSH. A valuable approach in the fire codes is the classification of buildings according to their use and occupancy, which helps building owners to easily locate the provisions applicable to their buildings. For example, provisions concerning exits and related life-safety requirements differ considerably for industrial buildings, elementary schools, nursing homes, prisons, and high-rise office buildings. The classification approach is also used to classify areas within facilities. For rooms where flammable or explosive atmospheres might develop (i.e., hazardous locations), the engineering and architectural requirements spelled out in the codes are particularly rigorous. By initially determining which classification applies to each room, the owner can have rooms designed and constructed according to code. Readers seeking more on the NFPA codes most applicable to OSH are referred to a book by Ferguson and Janicak.2 The strategies and tactics for reducing risks associated with fires are listed in Table 18.2. The numerous tactics for preventing unwanted fires in the pre-event phase may be summed up with the following principle: Avoid the coexistence of fuel, heat, and an oxidizing agent. Thousands of tactics for implementing this principle are found in the fire codes, building codes, and electrical codes. Table 18.2 lists some commonly used tactics for risk reduction. Supplemental comments on the tactics are provided in the following discussion. The first strategy is to eliminate the hazard. For a particular building, vehicle, home, or other location, eliminating a fuel source is the most straightforward tactic. Eliminating the fuel during the initial design is obviously effective, and eliminating from an existing location achieves the same end. Eliminating heat sources can avoid risk of ignition. Eliminating the presence of oxygen is a tactic used in some confined spaces containing fuel. It involves replacing the oxidizing agent with an inert gas. This tactic is listed in Strategy 1 because it eliminates the risk of ignition. However, maintaining a zero-oxidizer environment is less reliable than employing the other two tactics in Strategy 1 because doing so requires several affirmative steps. The failure of any of the essential controls may result in a failure to maintain the desired atmosphere. Thus, this third tactic should be recognized as an elimination tactic contingent upon the maintenance of the unusual atmosphere within the space.

The second strategy is to moderate the hazard. The overarching tactic involves limiting fuel quantities through engineering and administrative processes. An example of the engineering approach is designing fuel storage facilities to limit the amount of fuel in occupied buildings. Preferably, large amounts of fuel are stored remotely from the occupied areas, with only enough for immediate needs stored in the occupied areas. Examples of the administrative approaches are to have and enforce housekeeping procedures for removing trash daily and providing self-closing containers for cloths contaminated with flammable organic liquids. Brauer provides a concise summary of the numerous specific engineering and administrative tactics found in the NFPA codes.1 The second tactic for moderating the hazard involves substituting a less flammable material for a more flammable material. Strategy 3—avoid releasing the hazard—equates to preventing a fire from starting. Five common tactics are listed in Table 18.2. The first is an overarching tactic calling for a facility design approach to minimizing the risk of fuels, heat, and an oxidizer coexisting. The second involves installing proper lightning protection, which will carry the current in a lightning strike into the ground, thereby avoiding the structure. Also, some lightning protection systems provide an invisible protective shield above the facility to make the facility less attractive to lightning. The third tactic involves maintaining the space so that the oxygen content stays below that needed for ignition. The fourth tactic is to store F&C materials so the vapor concentration is well above or well below the flammable range for the material. With this approach, a vapor monitoring device is usually installed to detect if the vapor content drifts outside the tolerance range. The fifth tactic is to avoid static spark ignition of F&C materials by grounding containers and following bonding practices when transferring F&C materials. The fourth strategy is modifying release of the hazard. This broad strategy includes the various methods for responding to a fire. One of the most useful is installing automatic detection and response systems in areas with fire risks. Three commonly used approaches illustrate application of this tactic:

1. Automatic water sprinkler systems in facilities are useful for cooling a fire. These may actually extinguish a fire or limit heat buildup until qualified firefighters can respond. 2. Automatic detection and extinguishing systems are useful for protecting spaces where specific types of fires might start. These are designed to extinguish a foreseeable fire in the space by delivering a chemical agent that will kill the fire by removing one or more of the four elements of a sustained fire (see Figure 18.1). 3. Automatic detection–response systems in ducts containing flammable materials are intended to extinguish fires almost as soon as a fire starts. The system detects the start of a fire and automatically releases an extinguishing agent downstream to snuff out the fire.

Numerous other tactics are useful for modifying the release of the fire hazard. One is incorporating into facility designs some venting holes to allow smoke and fire gases to escape. Venting holes in roofs are effective for allowing hot gases and smoke to exhaust from the facility—making a safer environment for both evacuating the building and fighting the fire. Another tactic listed in Table 18.2 involves the use of a fire watch during hot work such as welding. The fire watch is a person responsible for monitoring the hot work to spot any unusual events. In particular, if a fire starts, the person is to promptly extinguish it with a portable extinguisher. Strategy 4 also includes the many tactics used by firefighters during a fire response. Instead of attempting to list all these tactics, a single tactic in Table 18.2 refers to having a pre-fire plan. The planning process requires working with the local fire department to mutually agree on how firefighters will attack a fire in various areas

of the site. In the process, firefighting resource needs in the various areas should be identified and addressed. The fifth strategy, to separate the hazard from that needing protection, is often implemented by providing space or a barrier. A commonly used tactic is to arrange industrial facilities so that processes posing higher risks of fire are kept separate from other facilities. Thus, if a fire develops, the damage will be confined to just one process area. Areas for filling the propane tanks used by forklifts are usually separated from the main facilities by space and a firewall. Workstations used for hot work are typically separated from common-use areas by space and barriers. Fuel product businesses design storage facilities (tank farms) with ample space between tanks so that one tank can burn without spreading the fire to neighboring tanks. Storing small quantities of F&C materials in approved F&C storage cabinets effectively separates the fuels from the heat that might develop if there is fire in the room. These cabinets provide an insulating barrier that keeps the temperature within the cabinet lower than the temperature of the external air. By this means, the air and fuels inside the cabinet will not reach ignition temperature as quickly as they would without the insulating barrier. A second tactic is to store F&C compressed gases separately from oxygen cylinders, which greatly reduces the risk of a leaking fuel cylinder and leaking oxygen cylinder combining to create a highly flammable atmosphere. The most common example of this is the practice of separating stored acetylene cylinders from stored oxygen cylinders by distance, barrier, or both. This tactic also applies to thousands of industrial spaces in which flammable mixtures might be present. A major concern of these hazardous locations, as they are called in fire codes, is ignition by an electric arc or overheated wire. The codes classify the spaces based on the type of fuel in the room atmosphere. The more easily ignited the materials, the more rigorous the requirements for electrical equipment. If the room is in the easily ignited classification, electrical equipment needs to be enclosed appropriately (e.g., in a particular type of conduit) so that an arc or overheated wire will not directly contact the room air. If the room air is potentially explosive, the enclosures for electrical equipment need to account for a possible explosion within the enclosure. Appropriate equipment will allow the exploding gases to vent in a cooled condition to the outside atmosphere or other safe space. Barriers are widely used tactics for Strategy 5. The firewalls in buildings function as barriers by resisting the spread of a fire in one room to an adjacent room. Wall materials are rated on the basis of how long they can continue their barrier function. The fire-resistant blankets used for hot work function as barriers by protecting combustible materials in the area from contact with sparks and other hot particles created by the hot work. The sixth strategy is to improve the resistance of that needing protection. Architects use this tactic when specifying material for buildings and other structures. Many commercial materials are rated by nationally recognized laboratories for their fire-resistant properties. For larger buildings, constructed with steel beams, architects may specify that an insulating material be applied to the structural beams. This helps protect the beams from loss of strength due to the heat of a fire and can save on the cost of replacing beams after a fire. The insulation is not always adequate, as demonstrated in the 2001 World Trade Center disaster in New York City, when two commercial aircraft were intentionally flown into a pair of high-rise buildings. The building had insulated steel beams, but the intense heat of the fire from the burning jet fuel was too much. Before the fires ended, the beams softened and gave way, leading to the collapse of both buildings.4 The seventh strategy is to help people perform safely. The five tactics listed in Table 18.2 need no supplemental explanation. The eighth strategy is to use personal protective equipment. In the oil and gas industries, many personnel are provided with outerwear made of fire-resistant material. This PPE provides protection

from a brief fire for a substantial portion of skin. A second tactic involves providing PPE for personnel who may respond to a fire. Employee fire brigades are the usual group needing this level of PPE. Since these are company personnel, their safety and health is within the purview of the company OSH department. In the United States, an industrial fire brigade must meet several requirements to ensure that personnel are protected, which includes providing response team members with PPE suited for the type of responses they may need to make. If they are expected to enter burning structures to fight fire, they need gear equivalent to that provided to professional firefighters. If they will fight only small (incipient) fires, the PPE requirements are less demanding. The ninth strategy is to expedite recovery. The most important tactic for expediting recovery involves developing and maintaining a business continuity plan. These plans are intended to help a company avoid bankruptcy, retain customers, and generally get back into business as soon as possible after a major disaster. A second tactic involves being prepared to render effective first aid for individuals injured in a fire, which should include plans for getting the more severely injured to appropriate medical care facilities.

Learning Exercises 1. List the four elements of a sustained fire.

2. Suppose you are at a gas station pumping gas into your car. You see another customer filling his car while smoking a cigarette. What information would you need to know in order to assess the risk of the cigarette starting a fire? 3. When a large, open tank of oil ignites, the flame spreads across the entire surface. An extinguishing method is to spread a foam agent all over the surface. Explain why this works. 4. Identify the three main sources of damage from a building fire. 5. Explain how smoke from a fire behaves. 6. Consider a room in an industrial facility containing several gas lines and gas cylinders. These normally operate without leaking any flammable material, so the room concentration is usually at zero. The room has an automatic flammable vapor detector. The LFL of the material is 6%. The production manager recommends setting the automatic detector at 4.5% (three-fourths of the LFL). You learn from a colleague at another plant that they set theirs at 1.5% (one-fourth of the LFL). What are the pros and cons of each option? 7. What is the basic principle for preventing fire from occurring? 8. Which strategy applies to installed fire sprinkler systems? 9. Give two examples of using barriers for fire protection. 10. Explain the difference between fire prevention and fire protection.

Technical Terms Backdraft

A dangerous fire event resulting from a fire in an enclosed room consuming all the room oxygen, leaving the space filled with smoke and hot gases with a high concentration of carbon monoxide. An opening to the space occurs, allowing oxygen to enter the room. Very rapid burning of the fresh oxygen occurs, raising the room temperature enough to ignite the carbon monoxide and to expand the gas with explosive force.

Chemical chain reaction

The fourth element in a sustained fire. The chain reaction occurs within the material itself when the fuel is broken down by heat, producing chemically reactive free radicals, which then combine with oxidizers.2

Fire Rapid oxidation of material during which heat and light are emitted.1

Fire protection

Various engineering approaches for helping protect people, property, and operations from fires and explosions.

Fire watch A person assigned to continuously monitor hot work in progress, paying particular attention to any start of a fire or other deviations from normal.

Flammable range

Term used for F&C vapors to indicate the vapor concentration range in which burning can occur. Below this range, the vapor is too lean to burn. Above this range, the vapor concentration is too rich to burn. The flammable range is unique to each material.

Flashover A dangerous fire event resulting from a fire in an enclosed room heating the room and its contents until the ignition temperature of the major materials in the room is reached. Suddenly, many things in the room ignite in a flash, creating a dangerous burst of expanding hot air.

Ignition temperature

The temperature above which a fuel will sustain combustion after being ignited by an external heat source.

References

1. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 281–324. 2. Ferguson LH, Janicak CA. Fundamentals of fire protection for the safety professional. Toronto: Government Institutes; 2005. 3. Schroll RC. Industrial fire protection handbook, 2nd ed. Boca Raton, FL: CRC; 2002. p. 19–20. 4. Hamburger R, Baker W, Barnett J, Marrion C, James M, Nelson H. WTC1 and WTC2. In: McAllister T, editor. World Trade Center building performance study: Data collection, preliminary observations, and recommendations. Washington, DC: Federal Emergency Management Agency (FEMA 403); 2002. p. 2-1–2-12.

Chapter 19

Explosion Hazards

19.1 Background on Explosions A typical explosion involves a sudden expansion of material that produces outward pressure. The effects of the triggering event depend on the space available for expansion. If not fully contained, the material will rapidly expand, typically creating a loud noise and pushing hot gases outward. If fully contained, the explosion forces will exert great pressure on the inner walls of the containment vessel, which may hold firm, allow movement, or break and allow the gases to spew out in a violent manner. Three common types of industrial explosions are (1) detonation of explosives, (2) unintended combustion explosions, and (3) mechanical explosions. This chapter concerns the first two. Chapter 20, on the hazards of pressure, addresses mechanical explosions such as pressure vessels rupturing and boiling-liquid expanding-vapor explosions (BLEVEs). The detonation of explosives involves the use of explosive material and a means of detonating the explosion. It is used to break rock for mines, tunnels, and excavations and to demolish old structures. The whole process is highly regulated to ensure that the explosive materials do not fall into the hands

of people with criminal intent. Regulations address manufacturing, transporting, selling, storing, using, and tracking. Combustion explosions and ordinary fires have similar chemistry, but explosive events are much quicker and produce an outward pressure in the form of a high-pressure wave, expanding material, and heat. If the wave front has a velocity greater than the speed of sound, it is a true explosion; if it is less than the speed of sound, it is called a deflagration. Dust explosions are a type of combustion explosion, the fuel being airborne particles of combustible material. Dust particles have a high ratio of surface area to mass, making ignition a quick process. These fires spread very rapidly from the origin space throughout the entire dust- containing space, raising the air temperature, causing increased pressure, and creating turbulence. The turbulence often shakes loose dust that had settled on surfaces, adding airborne fuel that leads to a second explosion that is sometimes more harmful than the first. Although combustion explosions have much in common with ordinary fires, some similarities and differences are worth noting. Both are exothermic chemical reactions. Both require the coexistence of three elements: fuel, heat for ignition, and an oxidizing agent. After initiation, a major difference is that deflagrations and dust explosions rapidly burn explosible material farther and farther from the origin. The resulting pressure wave and heat has destructive potential strongly influenced by the containment conditions, space available for dispersion, and fuel availability. The focus of this chapter is on reducing the risk of explosions hurting employees and damaging business property. There is no discussion about the technology of creating explosives and explosive devices. Nor is there any discussion about reducing the risk of terrorists and other criminals using explosives to harm people or property. Also omitted from this chapter is a discussion of flashovers and backdrafts, because those were covered in the previous chapter on fires.

19.2 Mechanisms of Harming The result of an explosion depends a great deal on the containment. If in an open space or container, the expanding pressure and materials will travel outward, gradually decreasing in pressure and concentration. Typically, as the materials expand, they react with the air, causing a fireball. If in an enclosure, the expanding pressure and materials will exert great pressure on all internal surfaces of the enclosure. An enclosure designed and built to contain such explosions may do so without damage. In contrast, detonation of an explosive set within a drill hole for mining will break up the rock enclosure. Some enclosures have solid containment walls on all but one side. Such is the case with guns. The gunpowder detonation within the chamber creates an expanding gas that exerts intense pressure on the bullet, forcing it down the barrel. Some explosions in containment vessels break through a weak part of the vessel wall, allowing the expanding gases to spew out in a powerful and dangerous manner. Explosions cause damage through the by-products of the exothermic chemical reaction. The main destructive by-products are a blast wave, a fireball, and hot gases. The blast wave consists of high- pressure, hot gases needing space for expansion. A fireball contains very hot gas expanding outward from the blast center. When the expanding gases are confined, the outward pressure of the blast wave can break through a weak part of the equipment. Once a small opening occurs, the rapid outflow of gases tends to expand the opening. The escaping gas can carry with it fragments of the broken equipment. The hot gas and fragments are propelled at high speed away from the reaction site. After that point, the potential for harm depends on who or what has the misfortune of being in the path.

Another hazard of explosions is damage to human hearing. A person close to an explosion can suffer damage to the eardrum and internal elements of his or her ear from the acoustic trauma.

19.3 Strategies and Tactics for Explosions The NFPA identifies five strategies for controlling explosions,1 which align with the strategies set forth in Table 19.1. The discussion in this section will supplement or clarify the tactics in Table 19.2. Because the focus herein is on strategies and tactics, readers seeking more detail may find it in other books for OSH professionals.1–3 Table 19.1 How the NFPA Control Strategies Match to the Risk-Reduction Strategies in This Book. NFPA control strategy Strategy per this book Containment 3. Avoid release of the hazard Quenching 4. Modify release of the hazard Dumping 4. Modify release of the hazard Venting 4. Modify release of the hazard Isolation 5. Separate the hazard from that needing protection

Table 19.2 Strategies and Tactics for Reducing the Risks of Explosions. Risk-reduction strategy

Risk-reduction tactics

1. Eliminate the hazard

1a. Avoid having explosive materials on-site

1b. Avoid processes that temporarily create explosive mixtures 1c. Eliminate a heat source near an explosive material

2. Moderate the hazard

2a. Limit fuel quantities by engineering and administrative processes

2b. For combustible dusts, limit amount by frequent cleaning 3. Avoid releasing the hazard

3a. In vessels for containing explosive materials under specific pressure conditions, avoid an explosive release by having pressure-relieving devices on the vessel 3b. Avoid static spark ignition by grounding and bonding containers involved in F&C transfers 3c. Avoid ignition by hot objects by prohibiting specified objects in designated locations 3d. Maintain oxygen concentrations of the air in contact with explosive materials at a low level by means such as displacement by an inert gas 3e. For industrial vessels used to contain highly flammable gases at a pressure above boiling point, plan on the possibility of a leak releasing large amounts of material into the atmosphere. Avoid explosion by (1) a high level of monitoring vessel conditions and (2) isolating the vessel from heat sources

4. Modify release of the hazard

4a. Store explosive materials in vessels with vents designed to release upon internal pressure reaching a set point

4b. Install explosion quenching systems capable of rapidly spraying water or dispersing a suppressant to stop further reaction 4c. Design into equipment capability for dumping the reacting mixture into an area where it can be tolerated

5. Separate the hazard from that needing protection

5a. Store explosive materials in limited quantities separated by distance rather than storing a large amount in a single place

5b. Separate multiple magazines for storing explosives according to standards 5c. Locate far from populated areas any potentially explosive operations or storage facilities 5d. For intentional explosions, use time and location to separate personnel and equipment from the products of the explosion

5e. Put barriers between explosive source and whatever needs protection 6. Improve the resistance of that needing protection

Design and construct items to withstand foreseeable explosive forces

7. Help people perform safely

7a. Provide remote controls for valves and other critical devices that personnel will need to use after an explosion

7b. For crews setting explosives, provide SOPs, checklists, drug testing, and training 8. Use personal protective equipment

Provide personnel with body armor appropriate for foreseeable explosive projectiles

9. Expedite recovery

9a. Implement automated response systems before an explosion occurs

9b. Implement procedures for personnel to follow after an explosion 9c. Establish and maintain a business continuity plan

The first strategy is to eliminate the hazard. For a particular location, eliminating a fuel that has the potential for explosion (e.g., explosives, other materials with known explosive potential) is the most straightforward tactic. It applies particularly to enclosed spaces where oxidation can produce a buildup of high-pressure gas that can be suddenly released when containment capacity is exceeded. Elimination during the initial design prevents the fuel from ever being introduced, and eliminating the fuel from an existing location achieves the same end. Eliminating or avoiding a heat source being near explosive material is another tactic listed in Table 19.2. The second strategy is to moderate the hazard. The overarching tactic involves limiting fuel quantities through engineering and administrative processes. Two engineering approaches are to design fuel storage facilities to limit the amount of fuel in occupied buildings, and to design and build explosive material containers that, in the event of an explosion, will withstand the maximum pressure and contain the explosion. Preferably, large amounts of fuel are stored remotely from the occupied areas, and only enough for immediate needs are moved into the occupied areas. An example of the administrative approach is to enforce housekeeping procedures for removing trash daily and providing self-closing containers for cloths contaminated with flammable liquids. A second tactic involves regularly cleaning work areas, which limits the amount of dust available for combustion. The third strategy is to avoid releasing the hazard. For explosives, a basic tactic is to strictly control the detonation. A related tactic is to ensure that explosive materials do not coexist with an ignition source at an unintended point in time. For dusts in confined spaces, putting inert gas into the air space above settled dust can effectively keep the partial pressure of oxygen below that needed for ignition. For dust that has settled on surfaces, avoiding turbulence helps keep the dust in a settled form. For airborne dusts, adding moisture to the air raises the ignition temperature.1 For flammable liquids, keeping vapor concentrations outside the flammable range will avoid a deflagration. The reliability of this tactic increases when automatic monitoring devices are used to detect and respond whenever the vapor concentration drifts outside the desired operating range, which is generally set well below or above the explosive range. Avoiding spark ignition in locations where flammable vapors may be present is a practice to emphasize. Some examples are worth mentioning. First, for many years it has been known that static sparks are common in flammable liquid transfer sites. A standard practice to avoid an explosion is to ground one or both containers and to bond the two containers. Second, a newer source of sparks has evolved with the use of electronic vehicle keys. In one case, a plumber completed a house call, returned to his van, pressed the remote door unlock button, and the van exploded. Apparently, while he was in the house working, a leaking acetylene tank in his van created an atmosphere of vapors in the flammable range. When he used the

vehicle remote key to unlock the doors, a tiny spark in the vehicle was enough to ignite the acetylene. Industrial vessels designed for containing flammable material capable of exploding commonly incorporate pressure-relieving devices. These normally hold the pressure within the system. When the pressure exceeds a set point, these devices open to allow some gases and vapors to escape. After letting out the excess material, most of these devices will reclose. The function of the open–reclose- type devices is to deal with deviations under normal operating conditions. A particular type of pressure-relieving device, known as rupture disks, is set to open at a higher pressure than the open– reclose type of pressure-relief devices. The rupture disks' opening pressure is close to that expected when an explosion is imminent. Thus, rupture disks may be considered a last line of defense against a full explosion.4 Some highly flammable materials that are gases under normal atmospheric conditions are stored and transported under pressure to keep the material in liquid form. A rare event needing attention is the possibility of a leak releasing large amounts of material into the atmosphere. Because these materials are kept in a liquid state by pressure, if a leak develops, the pressure is lost and the material escapes in a gaseous state. The cloud of material may float over a heat source such as a flare or hot stack. Two preventive tactics are

1. Conducting a high level of monitoring to prevent conditions that could lead to a leak (e.g., corrosion, abnormal stresses, mechanical shock), and 2. Isolating the vessel from heat sources by locating it far from flares and other heat sources.5

The fourth strategy is modifying release of the hazard. Tactics for this strategy involve preparing for the remote possibility that an explosion will occur. Appropriate planning and implementation will minimize the effects of an explosion. One way is to build into the container places for venting the material in acceptable directions. This venting tactic is useful for industrial buildings that house a process with potential for an explosion. Outward opening vent holes, skylights, windows, and doors can allow the hot expanding gases to escape and may prevent destruction of the structure. Saving the basic building structure will greatly reduce the time needed to repair the facility and return to operation. Another common way to modify release of an explosion applies to air movement ducts that contain combustible dusts such as coal and wood dust. Experience has shown that fires occasionally break out in these ducts. The small initial fire can quickly develop into a full deflagration, blowing apart large sections of ductwork and associated processing equipment. Nearby people can be injured or killed by projected material. Fire detection and response systems are available commercially that provide monitors throughout the ducts. These explosion suppression systems have detection and response elements. Detection may be based on changes in emitted light characteristics increase in air pressure. If the detectors sense ignition in one part of a duct, a water spray or other extinguishing agent will be released downstream of the site within 0.1 s.5 The release usually snuffs out the embryonic explosion before it fully develops. The fifth strategy is to separate the hazard from that needing protection. Several widely recognized tactics fit this strategy. One is separating high-oxygen-content gases and fuels (e.g., flammable and combustible materials). The standard practice of storing cylinders of acetylene and oxygen either separately or with a solid barrier between the cylinders is an example. Strategy 5 includes many common practices for storing explosive materials, starting with a preference for storing these materials in smaller quantities at multiple sites, rather than in a large quantity at a single site. A second widely used tactic applies to storing munitions. The storage sites, known as magazines, have specific

standards to minimize the risks associated with explosions. In addition to provisions for minimizing explosions in individual magazines, the standards specify a minimum distance between the magazines in order to prevent an explosion in one from starting a chain reaction through other magazines on the site. On a broader scale, decisions for locating industrial facilities regularly consider the potential for explosions and other major incidents. If a significant explosion is foreseeable (although considered unlikely), locating the facility far from a populated area is advisable. Barriers are often erected between industrial facilities that have a potential for explosion in order to avoid one explosion causing damage to adjacent buildings. The separate-by-location tactic, combined with timing, is used in mining. Between the time an explosive charge is set and detonated, time is provided for all miners to clear the area. Various procedures are followed to confirm the separation of all miners before detonation proceeds. The sixth strategy is to improve the resistance of that needing protection. Any sort of man-made physical object that needs protection from an explosion may be designed with the goal of being able to withstand foreseeable explosive forces. The seventh strategy is to help people perform safely. After an explosion, it is not uncommon to find that the resulting fire is being fed by flammable or combustible fluids coming out of busted lines. A tactic for helping people to perform safely applies to process designs that incorporate remote controls to allow personnel to control the flows without going into a dangerous location. Personnel who work with or around explosive materials—especially crews who work with intentional explosions such as those in mining, construction, and structural demolition—need awareness training and specific training for performing their work properly. These crews depend on each other, so numerous procedures and regulations govern their jobs. It makes sense that these regulated jobs include qualification standards including a criminal background check and substance testing. The employers help these crews perform safely by providing standard operating procedures, task checklists, and extensive training. The eighth strategy is to use personal protective equipment. If personnel may be at risk because of their proximity to an explosive device, body armor can provide some protection. This tactic is used in war zones where soldiers might encounter exploding grenades, roadside bombs, or other explosive devices that spray shrapnel. For applications outside military operations, projectiles from explosions often hit personnel with an energy that exceeds the design limits of ordinary hard hats and safety glasses. Nevertheless, these safety devices may somewhat reduce the severity of injury from small explosions nearby and large explosions farther away. For example, the use of safety goggles in chemistry labs is standard practice because they provide protection in the event of a spill or small explosion. When developing a risk assessment, it may be tempting to note the use of head or eye PPE as a tactic for reducing the severity of harm from an explosion. However, the RA team should think through the actual value of such devices before assuming they will be effective for a particular explosion. The ninth strategy is to expedite recovery. The tactics listed in Table 19.2 involve engineering approaches implemented before explosions occur. One is limiting fire damage. The fireball and hot air from an explosion often ignite other materials in the area. Having an installed sprinkler system in the location where an explosion is most foreseeable may prove useful for limiting the extent of damage from the core explosion. However, the sprinkler system may prove useless if significantly damaged by the explosion. Having installed sprinklers in adjacent areas might limit the fire damage by either cooling the area or extinguishing an incipient fire in those areas. Another tactic is an automated system for responding to the problems an explosion can create. An automated system

could have an emergency power system, an automated emergency control system, and a system for qualified personnel to control affected operations.5 Other advance plans and systems for limiting damage after an explosion and ensuing fire are noted in the previous chapter on fires. Some notable ones identified by Baasel include installing remote control valves to allow personnel to isolate equipment and areas of the plant, blowdown tanks in remote areas of the plant for transferring materials removed from fire areas, drainage systems to remove liquid spills, and a system of interlocks to prevent materials from flowing in the wrong direction at any time.5 Emergency plans for the response of personnel should include the response to an explosion. Another fundamental tactic is to have a business continuity plan ready to implement right after the explosion. All these tactics provide ways to prepare in advance for mitigating the damage from an explosion and facilitating recovery.

Learning Exercises 1. What are the two common types of industrial explosions discussed in this chapter?

2. What are three common by-products of combustion explosions? 3. Ductwork explosion suppression systems for avoiding dust explosions have great value, but they are not free of problems. For many systems, after each discharge, the system needs to be shut down for cleaning and discarding the affected material, which interrupts production. Many production supervisors order that the devices be turned off because of the numerous interruptions. If you were the OSH manager at such a facility, what would you recommend as a better solution? 4. A problem surfaced with the U.S. military operating in Afghanistan. Roadside bombs were exploding under vehicles carrying troops (Humvees). Troops were sustaining fatalities, loss of lower limbs, and other serious injuries from projectiles coming upward through the floor. Investigators recommended that the vehicles be equipped with a metal plate under the passengers to protect them. Into which strategy does this tactic belong? 5. Of the nine strategies in Table 19.2, which take effect in the Haddon phase called the “during-event” phase? 6. Look up the words deflagration and detonation. What characteristics make them different?

Technical Terms Acoustic trauma

Injury to the sensorineural elements of the inner ear from a single noise burst or by direct trauma to the head or ear.

Explosion A sudden change in material that produces outward pressure from the material expanding, a pressure wave, and heat. The effects of the expanding pressure depend on the space available for expansion.

Explosives Substances containing a large amount of stored energy and used to create explosions. Magazines Places for storing ammunition, bombs, and explosives. Rupture disks

A metal membrane designed and manufactured to burst at a certain pressure and temperature to prevent overpressurization of the attached vessel.4

References

1. Ferguson LH, Janicak CA. Fundamentals of fire protection for the safety professional. Toronto: Government Institutes; 2005. p. 35. 2. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 325–335. 3. Hammer W, Price D. Occupational safety management and engineering, 5th ed. Upper Saddle River, NJ: Prentice Hall; 2001. p. 425–439. 4. Wilson AT. Troubleshooting field failures of rupture disks. Chemical Engineering. 2006;113(13): 34–36. 5. Baasel WD. Preliminary chemical engineering plant design, 2nd ed. London: Van Nostrand Reinhold International; 1990. p. 95–96.

Chapter 20

Pressure Hazards

20.1 Overview of Pressure Hazards In the course of studying this chapter, astute readers will notice that pressure, fire, and explosions are interrelated. The three chapters on these topics (chapters 18, 19, 20) discuss numerous incidents where two or more of these hazards come into play. Flashovers and backdrafts originate in building fires, progress by increasing pressure, and culminate in an explosive blast. Some explosive events start with a fire under or beside a liquefied petroleum gas tank, causing the liquefied gas to expand, increasing internal pressure, and eventually blasting through a weak part of the tank walls. Thus, the author considered various options for organizing these three topics before deciding to have separate chapters on fires, explosions, and pressure hazards. Pressure is a form of energy because it can perform work by raising a mass. Aspects of pressure energy relevant to OSH professionals are grouped into two categories for this chapter. The first group relates to the challenges of working in unusually high- or low-pressure atmospheres. The second group encompasses pressure systems used in industry, such as compressed gas cylinders, boilers, chemical processing vessels, hydraulic systems, and pneumatic systems.

20.1.1 Unusual Pressure Atmospheres Conditions for people working under water use elevated air pressure to maintain a space capable of resisting the external pressure of the water. Without the high air pressure, external water tends to find pathways into the space. In addition, the potential for implosion cannot be ignored. People work under water for various reasons. For example, in the building of bridges over large rivers and inlets, abutments to support the spans must be set on a solid footing, which is often deep under the water level. That requires establishing a temporary underwater environment for the foundation work. Similarly, creating tunnels under waterways requires sealed work areas maintained at high pressure. Professional divers provide a third reason for working under water. Those who dive deep need

equipment capable of maintaining a pressurized microenvironment inside their diving suit. When people change from a high-pressure to a low-pressure environment, the body needs to adjust slowly. Making the change too quickly can cause decompression sickness and similar disorders. Another hazard of high-pressure environments is the air mixture of oxygen and nitrogen. Only the proper mixture ensures that the workers have proper breathing gases.1 Work at very high elevations challenges the cardiovascular system to deliver enough oxygen to the brain and other vital organs. Examples include constructing roads and hiking paths in high mountains. Aircraft crews regularly work at high elevations, but the tactic of pressurizing the aircraft interior normally protects them from the effects that would otherwise exist.

20.1.2 Pressure Used in Industry Many industrial processes include pressure vessels of various kinds. The material contained may be in a liquid or gaseous state, and maintaining that state within specified temperature and pressure ranges is essential. In the early days of boilers, there were many explosions due to internal pressure exceeding the capacity of the vessels. The field now known as safety engineering originated at that time primarily to fix the boiler explosion problem. Since those early days, many practical devices have been invented and incorporated into pressure-vessel standards. These devices and standards have greatly reduced the rate of pressure-vessel explosions; however, continued diligence is required to completely eliminate these explosive events. Boilers are not the only kind of pressure vessels that can burst open from excessive internal pressure. Bursting vessel explosions can occur when the pressure inside any fully enclosed vessel exceeds the capacity of the weakest part of the vessel walls. When pressurized material breaks through the vessel walls and expands, damage can result from the pressure wave, heat, or projected fragments from the vessel. If the pressure vessel contains highly flammable gases at pressure above the boiling point (usually maintained in liquid state), another hazard needs attention. A significantly large leak or discharge can send a cloud of flammable vapor into the air. Once airborne, the material may encounter an ignition source and explode. The larger the release, the greater the explosion. The compressed gas cylinders used extensively in industry for a variety of gases come in several standard sizes and shapes. They have a portal to allow filling and dispensing. The most vulnerable part of compressed gas cylinders is the stem. If the stem breaks off a cylinder filled with compressed gas, the exiting gas rapidly contaminates the local air and propels the cylinder like a rocket. If a leak develops in the stem or related hardware, the escaping gas contaminates the local air and may go undetected. Industry makes extensive use of pressure in the form of hydraulic and pneumatic systems. Both consist of a device to compress a fluid, an enclosed network of hoses or pipes, and various controls. The fluid in hydraulic systems is liquid, and that in pneumatic systems is gas. The hazards of the compressed fluid are normally controlled through proper design, connections, and maintenance. When these controls fail, the release of pressurized fluid can be quite harmful.

20.2 Mechanisms of Harming The mechanisms of harm resulting from pressure are described in three subsections: work in high- or low-pressure atmospheres, pressure used in industry, and direct pressure on the worker.

20.2.1 Working in Unusual Pressure Atmospheres Working in environments with low atmospheric pressure presents concerns about oxygen delivery to the brain and other vital organs. The physiology is explained in many books on physiology, aviation medicine, and occupational health. Stated briefly, as the altitude of the workplace increases, the capacity of the blood to deliver oxygen throughout the body declines.1 The effect on workers doing light to moderate work is rather minimal from sea level up to about 2000 m, but for heavy labor the effects are significant at lower elevations. Workers adjust to higher elevations by increasing their breathing rate and heart rate. Additional adjustment may come from slowing the pace of work and taking more breaks. Working in environments with high atmospheric pressure presents concerns about decompression sickness and variations known as caisson disease, the bends, and dysbarism. This occurs when a person changes from a high- to a low-pressure atmosphere, as when someone who has been working under water rises toward the surface. If the change is too rapid, gas bubbles form in the blood and other tissues. The bubbles can cause joint pain and alter the normal functions of the central nervous system and circulatory system.1,2 Implosions occur when a large pressure difference between the pressure outside and inside a closed container exceeds the strength of the container. Usual situations for implosions are when the internal pressure is air or a near vacuum and the external pressure is water or other liquid. For underwater exploration and submarines, structural designs are for specified depths; going deeper increases the risk of an implosion.

20.2.2 Pressure Used in Industry When a pressurized container bursts, damage may come from several sources. The expanding gas can directly affect the personnel who breathe it. The rapid airflow of the expanding gas can send objects flying, lift flammable dust from surfaces, and blow small particles into the eyes of workers. When the container breaks apart, bolts, rivets, and various fragments may become fast-moving projectiles capable of harming personnel and equipment. Finally, when the valve of a compressed gas cylinder breaks off, the cylinder becomes a heavy, rocket-like projectile.2 There are several distinct types of pressurized-container incidents. One type that every OSH professional should recognize is called a boiling-liquid expanding-vapor explosion (BLEVE).3 These events can occur with a normally gaseous material that is held in liquid state within a pressurized container. The only reason the material stays liquid is the high pressure. The container could be a railroad tank car, a highway tanker truck, or a stationary storage vessel. The initiating event is a rise in temperature, often due to a fire outside the vessel. The heated material creates more vapor pressure in the container. At some point, the weakest part of the vessel wall fails. The vapor that escapes through the small initial opening will rip open more of the vessel wall and allow a gush of very high- velocity, high-pressure gas to shoot outward, devastating a large area in its path. The sequential model below may help readers remember the events: The power for pneumatic and hydraulic equipment comes from gas and liquid pressure, respectively. Both are created by specialized equipment and distributed through solid lines or flexible hoses.1,2 When flexible lines are used, the failure of a connection can lead to fluid flowing through the hose and causing the hose to whip about. The whipping action can injure a person or damage workplace

hardware. The air in pneumatic systems is pressurized by passing through an air compressor. It then flows through solid lines or flexible hoses to equipment. Compressors come in many capacities—some of which are placed in a fixed location and others are designed for portability to various worksites. Uses of compressed air are many, including spray painting, tire inflating, cleaning, rock drilling, and powering pneumatic tools. The lines can develop leaks, but the problem most often mentioned in the OSH literature is misapplication of the air through the nozzle. Workers have died from air being shot into a body orifice and expanding within the body.1,2 Another recognized hazard involves cleaning surfaces by spraying them with pressurized air. This process makes small particles airborne, and the particles can get into eyes. Spray cleaning this way is allowed if appropriate precautions are taken to protect the eyes of the sprayer and coworkers. The fluid in hydraulic systems is a liquid substance specifically made for that use. If a leak develops, the fluid squirts out with high pressure and velocity. Both velocity and pressure decline as the material gets further from the leak point. If a person is near the leak, the fluid can penetrate the skin and enter the body. From there, it can have serious effects on health and can even cause death. In addition, because the fluid is flammable, if it leaks onto or near an ignition source, it can start a fire. The leak will continue to feed the fire until pressure to the line is closed or all fuel is exhausted.

20.2.3 Direct Pressure on the Worker Numerous occupational injuries and fatalities result from direct pressure on the worker's body. This occurs when a worker is close to an explosion or lightning strike. The pressure waves can damage the worker's hearing. Another way this happens is when the human body gets squeezed between objects. Squeezing on the chest can prevent inhalation and cause death from asphyxiation. This occurs when, for example, a person's body is caught between a floor and a heavy object, in a chute such as at the bottom of a grain bin, or between a machine and a fixed object like a wall or ceiling. A case investigated by the author involved a worker who was told to take a scissor lift from the third floor to the first floor. This lift was drivable from the platform. He rode it into the freight elevator, parked near the elevator controls, leaned over the rail, and pressed the elevator down button. In the process, his torso apparently pressed the up button of the lift. The man's chest became trapped between the rail and the elevator ceiling, and his torso blocked access to the up and down controls of the lift. The elevator reached the first floor and sat there briefly before a coworker on the first floor opened the elevator and found the victim still alive but unable to breathe, talk, or release the up button of the manlift. The coworker could not figure out how to release the pressure and lower the manlift and yelled for help. Other workers arrived, and none could figure out how to release the pressure. Someone tried to cut the side rails with a welding torch. It took too long, and the man suffocated.

20.3 Strategies and Tactics for Pressure-Related Hazards Strategies and tactics for reducing the risks of pressure-related hazards are presented in two parts. The first addresses unusual atmospheric pressures, and the second concerns pressure used in industry.

20.3.1 Work Under Unusual Atmospheric Pressure Unusual atmospheric pressures include too much and too little pressure. Table 20.1 summarizes strategies and tactics used to minimize the risks of work under high or low atmospheric pressures.

Table 20.1 Strategies and Tactics for Reducing the Risks of High- and Low-Pressure Atmospheres. Risk-reduction strategy Risk-reduction tactics 1. Eliminate the hazard 1a. For deepwater exploration, eliminate use of humans by using robotics and remote controls

1b. For caisson work, perform as much as feasible on the surface rather than in a pressurized environment 1c. For air travel, fly at lower elevations where there is no need for cabin pressure and oxygen control

2. Moderate the hazard For work in pressurized environments below water level, set pressure level no higher than that needed for engineering requirements

3. Avoid releasing the hazard For high-altitude aviation, avoid cabin pressure release through engineering design, manufacturing quality, and maintenance

4. Modify release of the hazard After work in high-pressure location, release gases in blood slowly by decompression procedures

5. Separate the hazard from that needing protection

Not applicable

6. Improve the resistance of that needing protection

Not applicable

7. Help people perform safely 7a. For work at high elevations, adjust work-pace expectations for new personnel to allow time for acclimation to the atmosphere 7b. For work at high elevations, allow more rest time for heavy manual tasks

8. Use personal protective equipment For high-altitude flying, provide emergency breathing air for crewand passengers in case of loss of cabin pressure

9. Expedite recovery Monitor workers throughout decompression. If symptoms develop, put workers in a medical chamber

Strategy 1 addresses efforts to eliminate human exposure to high or low atmospheric pressures. For deepwater exploration, technological advances have successfully eliminated the need for human presence in many diving vessels by using robotics and remote controls. Media coverage of the 2010 Deepwater Horizon oil spill disaster in the Gulf of Mexico provided the public with a glimpse of these capabilities. For construction workers doing underwater work in pressurized environments, the elimination strategy applies to work performed on the surface rather than in the high-pressure environment. The one low-pressure tactic noted in Table 20.1 is aircraft flying at low-enough altitudes to eliminate the need for cabin pressure and oxygen control. The second strategy involves moderating the hazard. For underwater work, the pressure level inside a structure should not be greater than that necessary to meet engineering requirements for structural integrity and leak protection. The third strategy is to avoid releasing the hazard. The tactic in Table 20.1 relates to the various engineering and manufacturing efforts that contribute to aircraft cabins being able to hold the air pressure at levels needed by the crew and passengers. The fourth strategy is to modify release of the hazard. For workers in pressurized environments, decompression procedures have been established to moderate the hazard of gas bubbles forming rapidly in the blood when decompressing. Having workers proceed through decompression chambers slows their physiological adaptation and allows most workers to cope with the hazard. The seventh strategy is to help people perform safely. Two tactics in Table 20.1 relate to work performed at high altitudes. The first tactic is to adjust the work-pace expectations for new personnel to allow time for acclimation to the atmosphere. The acclimation process of increasing hemoglobin levels in the bloodstream takes time, with considerable progress made in the first week followed by modest progress during the subsequent three weeks. For manual labor-type work at high elevations,

the employer may allow more frequent rest breaks than would be normal for work performed closer to sea level. This tactic applies to both new employees and those who have been working at the elevation long enough to become acclimated. The eighth strategy is to use personal protective equipment. The one tactic listed in Table 20.1 applies to maintaining cabin pressure in high-flying aircraft. If that fails, the backup is to provide individual breathing masks fed by an appropriate mixture of oxygen and nitrogen. The ninth strategy is to expedite recovery. The tactic noted in Table 20.1 involves monitoring individuals as they proceed from a pressurized environment through decompression. The monitoring should detect if someone is not decompressing properly and needs medically supervised decompression, such as recompression followed by extra-slow decompression.2

20.3.2 Pressure Used in Industry Table 20.2 links strategies to tactics for reducing risks associated with the use of various pressures in industry. For the first strategy of eliminating the hazard, one tactic would be to consider eliminating from the worksite pressurized vessels such as compressed gas cylinders and pneumatic and hydraulic systems. The tactics listed for the second strategy, moderating the hazard, are self-explanatory. Table 20.2 Strategies and Tactics for Reducing the Risks of Pressure Used in Industry. Risk-reduction strategy Risk-reduction tactics

1. Eliminate the hazard Completely avoid having any pressurized gas cylinders, pressurized vessels, pneumatic power, or hydraulic power at the worksite

2. Moderate the hazard 2a. For air hoses with nozzles, install nozzle that limits pressure to safe levela

2b. For the whipping hazard of flexible hoses, make the hoses only as long as necessary2

2c. For gas cylinders containing toxic materials, bring on-site only the amount needed for short-term usage

3. Avoid releasing the hazard 3a. For the hose-whipping hazard, use solid rather than flexible lines where practical 3b. For hydraulic and pneumatic lines, conduct regular inspections and maintenance 3c. For pressurized systems of all kinds, avoid working on them unless sure that all pressure has been released2

3d. For powerful equipment with extension capabilities (e.g., scissor lifts), install a flange around extension/retraction controls to avoid unintended activation 3e. For gas cylinders, follow the gas industry procedures 3f. For pressurized vessels in industrial processes, monitor to ensure operations are within design limits

4. Modify release of the hazard 4a. For hydraulic and pneumatic lines, install metal guards at locations most vulnerable to failure 4b. For the whipping hazard of flexible hoses in pressurized systems, install restraints to limit whipping2

4c. Allow air hoses for cleaning only when precautionary procedures are followed

4d. For water hammer hazard to liquid lines, install an air chamber or accumulator in the line2

4e. For pressurized vessels, incorporate pressure-relieving devices 5. Separate the hazard from that needing protection

5a. For cylinders containing fuels, store outdoors in area away from heat sources

5b. For storing oxygen and acetylene cylinders, store with appropriate separation 6. Improve the resistance of that needing protection

Secure protective caps on gas cylinders when not in use or while being transported

7. Help people perform safely Train personnel on safe procedures for working with pressurized systems 8. Use personal protective equipment

Provide PPE indicated in JHA or RA

9. Expedite recovery 9a. Install remote controls for hydraulic and pneumatic lines to allow stopping the pressure without local exposure 9b. For machines that might squeeze a person against a solid object, install a device to sense abnormal resistance and interrupt the drive mechanism when needed

a. Air pressure levels allowed for cleaning clothing and surfaces vary by jurisdiction. When used appropriately, the United States allows using air pressure if less than 30 psi (207 kPa). Some Canadian provinces disallow cleaning with air pressure, while others allow using air pressure if less than 10 psi (69 kPa).

For the third strategy, avoiding release of the hazard, seven tactics are listed in Table 20.2. The tactic of using solid lines rather than flexible lines where practical comes from Hammer and Price.2 They note that solid lines are less prone to whipping when they come loose. However, because solid lines are not completely free of that hazard, they recommend securing solid lines at points where they are most vulnerable to breaking. Regular inspections and maintenance also reduce the risks of pressure releases from failure in hydraulic and pneumatic systems. The third tactic is to depressurize systems before working on them—a standard part of hazardous energy control (lockout/tagout) programs. Many serious injuries and fatalities have resulted among maintenance workers and others who have been surprised by a pressure release. Part of this tactic involves ensuring that all pressure has been released. Employers with high aspirations for safety include a requirement to formally test the system to confirm that all pressure has been removed. Another tactic, applicable to compressed gas cylinders, is to follow the gas industry procedures for working with gas cylinders. Those procedures emphasize the behavioral and administrative practices rather than the engineering approaches.2 Most of the engineering work has already been done by the gas industry, so cylinder users need to focus on procedures. The last tactic in Strategy 3 concerns the importance of monitoring industrial processes to detect any deviations from the design parameters. In some industrial processes, the concern is too much heat, too much pressure, or both. In others, the concern is too little heat, too little pressure, or both. Gas laws tell us that when a gaseous material is in a vessel, a rising temperature coincides with increasing pressure. For pressurized vessels, the main concern is too much pressure. Too much pressure can lead to a leak or an explosion. Having and following pressure limitations reduces the risk of an explosion. Although this is standard practice spelled out by the engineers who designed the vessel, things occasionally go wrong. The post-startup maintenance and modifications are often identified as primary causes of pressure-vessel problems. The technical tools are well known for ensuring that operations are within design limits, but, unfortunately, too often people develop overconfidence in the technology and become less diligent in the follow-up processes. The fourth strategy is modifying release of the hazard. The first two tactics, concerning hydraulic and pneumatic lines, address risk reduction in case a line failure starts releasing high-pressure gas or fluid. The third concerns misusing air hoses to spray-clean surfaces (a usage that may be acceptable if appropriate precautions are followed). The water hammer hazard noted in Table 20.1 can occur when a flow valve in a fluid line is opened rapidly rather than slowly, which causes the line to shake severely, possibly damaging the connections. An engineering approach is to install an air chamber or hydraulic accumulator in the line to temporarily store suddenly released fluid.2 The last tactic in Strategy 4 concerns the numerous pressure-relieving devices, brief descriptions of which are provided in books by Brauer and by Hammer and Price.1,2 Brauer's list includes safety valves, relief valves, safety-relief valves, frangible disks, fusible plugs, discharge, vacuum failures, freeze plugs, and temperature-limit devices. In a typical operation, the devices must hold the internal pressure up to some level but open when pressure exceeds the level. Temperature-limit devices operate similarly but respond when the temperature reaches a certain level. When the material

released is an air pollutant or flammable material, the discharge needs an appropriate engineered control system. The fifth strategy is to separate the hazard from that needing protection. The two tactics reflect, without going into specifics, standard practices for storing compressed gas cylinders. The sixth strategy is to improve the resistance of that needing protection. The tactic applies to protecting the valve stem and associated hardware from impact by using a safety cap as a protective shield when the cylinder is in storage or transit. Obviously, the cap must be removed when the cylinder is in use. The seventh strategy is to help people perform safely. The tactic listed is to provide training to personnel who will work with pressurized equipment. This is particularly important with regard to pressure because there are numerous hazards not readily apparent to workers. For example, they may not know the hazards of air pressure sprayed on their skin or into a body orifice, the hazards of working on equipment with retained pressure, the effects of mishandling gas cylinders, or the reasons for various practices for storing gas cylinders. Because many of the hazards involved with pressure are not obvious or visible, workers need awareness training that goes beyond work rules—they need to learn the reasons for the rules. The eighth strategy is to use personal protective equipment. Because the choice of PPE is highly dependent on the potential hazards encountered, the tactic is stated generically and simply defers to the PPE requirements of the applicable job hazard analysis or risk assessment. If either of these analyses has already been completed, the documentation should indicate any PPE needed. The ninth strategy is to expedite recovery. A very important tactic is to install, before an incident, remote controls for hydraulic lines. When a fire or explosion involves hydraulic lines and a flammable liquid, the response can have a tremendous effect on the ultimate damage. To avoid the scenario of an employee or professional firefighter acting heroically by entering a dangerous scene to shut off a valve in the hydraulic system, devices for shutting off flow should be installed in locations away from the site where lines might fail. Such forethought can pay off greatly in terms of personnel safety and reduced damage from the fire. A failure to install such devices can lead to the kind of tragic consequences that resulted from a disaster in a chicken processing plant in North Carolina.4 A leak in a hydraulic line sprayed flammable fluid onto a nearby hot object, which ignited the fluid. The burning hydraulic fluid created a dense black smoke that spread rapidly throughout the facility. No employee seemed positioned to shut off the flow of fluid into the line, so it continued spraying flammable liquid into the fire. The thick black smoke spread rapidly and killed 25 employees.

Learning Exercises 1. Search the Internet to find an example report on a BLEVE. Avoid news media reports due

to their shallow coverage. Answer these questions: What was the chemical? What was the boiling point temperature? What sort of vessel was involved? What event initiated the loss of pressure? What is known about the burst event? What effects were due to the shock wave? What effects were due to the chemical dispersion? Other than effects of the shock wave and chemical dispersion, what other harmful effects were in the report? 2. Regarding flashovers and backdrafts, these are explosive events that develop in a confined space and lead to an explosive release of hot gas. The author chose to describe them in the chapter on fires. Write a concise argument in favor of including these incidents

in the chapter on fires rather than in this chapter on pressure. 3. Fatalities have been reported when someone enters the top of a grain bin while grain is being dropped through the chute into a train car. The assumed reason for the person's action is that he was trying to break up a crust on the top that was slowing flow out the bottom. For whatever reason, the person steps on the top crust of the grain and finds it does not support his body weight. The person falls through and becomes wedged in the chute at the bottom of the bin. Other workers may see feet sticking out the bottom, but they have no apparent way to rescue the victim quickly enough to prevent suffocation. What OSH practice or policy should be followed to prevent such a tragedy? 4. The chapter mentions situations where a pressurized vessel containing flammable gas might rupture, sending a cloud of flammable gas floating into the atmosphere. What can you suggest as a measure to minimize risk of the cloud being set afire by an ignition source? 5. Firefighters train for holding a fire hose so that it will spray in the intended direction. What is similar about a fire hose and a loose hose of a hydraulic or pneumatic system? 6. The 2010 BP Deepwater Horizon disaster in the Gulf of Mexico may be examined in light of risk-reduction strategies. Underwater oil extraction makes use of the high pressure under the sea floor to push the oil upward. Under the planned and normal conditions, the released oil is completely contained as it travels to the surface. Thus, the release of the pressure is a planned part of the process. When containment failed, the pressure continued pushing crude oil upward into the Gulf waters. Think about the issues posed by the following statements. Do you think the following characterizations are fair?

a. Refer to the definition of hazard in chapter 2. The crude oil was the source with potential to harm the Gulf waters, aquatic life, the coastline, and the fishing and tourism industries.

b. We can confidently assume that the risk of harm was recognized prior to the incident.

c. The strategy used by BP for operating the well was to modify release of the hazard by completely enclosing the oil as it flowed from under the Gulf waters up to the surface.

d. The tactic involved using oil industry technology to construct and operate the containment system.

e. The tactic and strategy failed, allowing oil to gush upward without containment.

f. BP recognized the importance of having a backup containment system. It identified one in the application for approval to drill. The method had never been tested in deep water, so it was unproven at that time.

g. When the backup containment system was deployed, it was ineffective.

h. Strategy 9 (expedite recovery) was inadequately incorporated into the project.

Technical Terms BLEVE Acronym for boiling-liquid expanding-vapor explosion. Hydraulic accumulator

A pressure vessel that functions as a shock absorber by storing or absorbing excess fluid.

Hydraulic system

Collection of equipment and flow lines containing a fluid used to perform work by transferring pressurized liquid.

Implosion Sudden collapse of a container due to external pressure exceeding internal pressure enough to crush the container walls. Also applies to building demolition in which explosives are used to break or weaken key structural elements, causing an inward collapse of the walls.

Pneumatic system

Collection of equipment and flow lines containing air or another gas used to perform work by transferring pressurized gas.

References

1. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 359–369. 2. Hammer W, Price D. Occupational safety management and engineering, 5th ed. Upper Saddle River, NJ: Prentice Hall; 2001. p. 312–340. 3. Ferguson LH, Janicak CA. Fundamentals of fire protection for the safety professional. Toronto: Government Institutes; 2005. p. 104–106. 4. Schroll RC. Industrial fire protection handbook, 2nd ed. Boca Raton, FL: CRC; 2002. p. 5–7.

Chapter 21

Hazards of Electromagnetic Energies

21.1 Fundamentals of Electromagnetic Energy We notice only a small part of the electromagnetic energy in the environment. Our senses allow us to detect colors and the feel of sunlight on our skin, but our senses are not developed to detect many other forms of electromagnetic energy. This chapter provides a brief overview of the forms of electromagnetic energy, with an emphasis on those considered health hazards in the workplace. An understanding of electromagnetic energy requires developing an extensive vocabulary of the terms in this unique specialty. It would be unrealistic to include a complete review of electromagnetic energy in one chapter, and dedicating more than one chapter of this book to electromagnetic energy would be disproportionate to the importance of this topic. Therefore, this chapter addresses a few fundamentals about waveforms and the various types of electromagnetic energy (also called “radiation” by many authors). Waveforms within a broad range of wavelengths and frequencies are traditionally included in the

term electromagnetic energy. Figure 21.1 shows the attributes of typical electromagnetic waveforms. The figure is similar to one encountered in the chapter on noise and vibration. Both plot a sinusoidal wave pattern. The vertical axis applies to amplitude of the quantity measured. The difference between the vibroacoustic wave graph and this one is the horizontal axis. For the vibroacoustic graph in Figure 16.1, the horizontal axis uses time. For the electromagnetic graph, the more useful variable is travel distance. By using distance in the graph, we can see the meaning of wavelength—the spacing between corresponding points on successive waves. It is usually denoted with the Greek letter lambda (λ). Figure 21.1 Instantaneous amplitude of an oscillating electromagnetic wave plotted against distance.

The wavelengths of electromagnetic energies include a tremendous range from gigameters down to

picometers. Very different causes and effects are found in regions of this range. Figure 21.2 provides a graphic showing the categories of the spectrum typically discussed under the topic of electromagnetic energy or electromagnetic radiation. The category ranges are approximated by the bar graphics, using the wavelength scale on the left. Note that it uses SI prefixes to label every third point on the axis. Points between indicate the effect of moving the decimal one place. For example, when going from meters to millimeters, the points are 1.0 m, 0.1 m, 0.01 m, and 0.001 m (1 mm). Figure 21.2 Forms of electromagnetic energy arranged by wavelength.

Wavelength is useful for describing and comparing all forms of electromagnetic energy. However,

frequency is preferred for some categories. A frequency scale is included on the right-hand side of the figure for the applicable range. Frequencies (f) in any range may be calculated from the wavelength and the speed of light (c ≈ 3 × 108 m/s) using the equation f = c/λ. This calculation will yield a value of frequency with the units in cycles per second, or hertz. The wavelength range included in Figure 21.2 includes the electromagnetic energies most applicable to the practice of OSH. Other electromagnetic energies exist outside the range shown. Those above the graphic are of interest to particle physicists, astrophysicists, and some research laboratories. Those below are of interest for technologists in the communication and power distribution fields. However, for the purpose of this chapter, these are considered outside the mainstream of OSH, and omitted from discussion. Also not shown in Figure 21.2 is the range of electromagnetic fields (EMFs)—energy fields generated by electrical and magnetic equipment.1 EMF exists around these devices in a static form (i.e., not varying with time). The wavelengths span the lower portion of Figure 21.2 (wavelengths >1 mm). We have the capability to measure the fields, but we lack clarity on the importance of EMF to the practice of OSH. Assertions of a causal link between EMFs and human health are controversial. Rather than waiting for results of further research, electrical equipment manufacturers have been proactive in efforts to limit the intensity of EMFs during design.1 In addition, electronic product certification laboratories have criteria for EMF intensity. As for this book, further discussion of EMF

energy is considered unnecessary. The radio wave region of the electromagnetic spectrum includes a relatively broad span of frequencies. Within the broad span are some specific ranges used by our technical society. These include radio waves in the AM band, the FM band, and the broadcast band used for airwave transmission of television. Microwaves are in the short-wave portion of radio waves. These are useful for home cooking appliances, industrial heating processes, radar in aircraft navigation systems, and some specialized research laboratories. Infrared (IR) radiation is produced by hot objects and molecules. These waves provide the link between the emitting source and the receiver. The receiver absorbs the heat. Some applications of infrared radiation warrant mention. Physical therapists use infrared emitting devices for heating tissues deeper than the skin. Some photography captures infrared light in the image while filtering out light in other wavelengths. This has numerous applications for research. The human eye does not sense the infrared waves directly, but devices have been developed to make it feasible. Night vision goggles and scopes are useful for military operations. Game hunters can locate animals during dark hours, but using these devices for actually targeting game is restricted by the hunting regulations of many governmental jurisdictions. Human visual senses detect colors—the category just above the infrared category in Figure 21.2. Compared to the other types of electromagnetic energy, the range of visible light is very small, from 400 to 760 nm. But compared to human awareness of electromagnetic waves, visible light far exceeds the others. Ultraviolet (UV) light includes electromagnetic waves with shorter wavelengths than visible light. UV is emitted by the sun, but fortunately most of it is filtered by the ozone in the stratosphere. The part of UV that gets through the stratosphere is in the region close to visible light. In this region, we encounter the following frequencies: UV-A, UV-B, and UV-C. Proceeding up the spectrum depicted in Figure 21.2, X-rays and gamma rays are next. X-rays are created by machines and used for both medical and industrial applications. Gamma rays are emitted from the nuclei of radioactive atoms.

21.2 Mechanisms of Harming Mechanisms of harm depend on the type of radiation. Nonionizing radiation striking a human has minimal penetration of the skin, and some penetration of the eyes. Some forms of ionizing radiation travel through the skin, and others enter the body through ingestion and inhalation. Because of very different health effects, the two broad categories of electromagnetic energy are summarized in separate subsections.

21.2.1 Nonionizing Radiation For several years, public health agencies have been informing the public about the adverse health effects of exposure to the sun and sunlamps.2,3 Three adverse effects are summarized below.

1. Sunburn usually results from outdoor exposure to UV radiation from the sun. Excess exposure to a sunlamp, including models for home and tanning salons, also produces sunburn. Effects on skin can range from mild to intense pain. For any particular exposure, individual factors also play a significant role in determining the effect. 2. Skin aging is accelerated by chronic exposure to UV.

3. Skin cancer risk is increased by exposure to sunlight. Individual factors also play major role, with fair-skinned people being most at risk. Ultraviolet light in all three regions (A, B, and C) is a risk factor for skin cancer.

Exposure to UV radiation also affects the eyes. Three major effects are listed below.

1. Arc eye is a condition resulting from eye exposure to the intense UV from arc welding. Also called “welder's flash,” the condition can come from looking directly at the arc or from UV reflected off walls, the ceiling, or other surfaces around the welding environment. 2. Solar retinitis is a condition of considerable eye discomfort from UV-A penetrating the eye. The condition is also called “eclipse blindness” due to a cause being looking at a solar eclipse without an effective filtering lens. 3. Cataracts appear to have some association with UV radiation exposure. A clear causal relationship is not well established.

Laser light is another type of nonionizing radiation found in the wavelength range of IR–visible–UV.4 Commercially available low-energy lasers are used extensively by lecturers and carpenters. Higher intensity lasers are used for machining a wide range of materials. Harmful effects include thermal burns, photochemical injuries, and eye injuries.3 The primary health concern is for eyes.3,4 Damage may occur in the cornea, lens, retina, or other part of the eye.4 Eye damage depends on the beam intensity, wavelength, duration, source (direct or reflected), and direction entering the eye.4

21.2.2 Ionizing Radiation By definition, ionizing radiation is electromagnetic or molecular radiation that, when it passes through matter, produces ions. Variations in ionization processes strongly influence the effects. This chapter provides a very brief summary of the topic. Numerous OSH reference books provide more details.5–7 Readers with keen interest in this topic should look for books or courses in the field known as health physics. Health effects depend on type of particle, the total dose, and the time over which the dose was acquired. Thus, this discussion begins with the classification of ionizing particles. The particles of concern are alpha particles, beta particles, neutrons, X-radiation, and gamma radiation.5 The latter two are often referred to as X-rays and gamma rays. Health effects of ionizing radiation stem from the ionization process that disrupts the electron balance of the affected molecule. Is that always unhealthy? There seems to be agreement among health physicists that a small number of ionized cells are tolerable. At some level, the number of ionized cells exceeds the tolerance of a particular organ, and adverse health effects develop. At the molecular level, an unhealthy molecule may no longer have the ability to reproduce or divide. It may damage a neighboring molecule by stripping electrons from that molecule, and it may cause mutations in other molecules. Different organs respond in different ways. Thus, the effects cannot be predicted precisely because of the numerous interactions among the type of ionizing particle, the type of healthy cell, the dose, the duration of exposure, and randomness. For individuals who work around ionizing radiation, tactics have been developed to keep their exposures within the tolerable level.

21.3 Strategies and Tactics for Electromagnetic Hazards

The strategies for reducing risk with the hazards of the electromagnetic spectrum are summarized in Table 21.1 for nonionizing radiation and Table 21.2 for ionizing radiation. On the right of each table are applicable tactics. Most of the tactics in the tables are self-explanatory; so the following supplemental explanations are brief. Table 21.1 Strategies and Tactics for Reducing the Risks of Nonionizing Radiation Hazards. Risk-reduction strategy Risk-reduction tactics

1. Eliminate the hazard 1a. Instead of having workers construct something outdoors in the sun, have them perform some or all of the work in a building or otherwise protected from the sunlight 1b. Schedule outdoor work for evenings and nights 1c. Eliminate arc welding from a worksite

2. Moderate the hazard 2a. Schedule outdoor work for times when the sun is lower on the horizon rather than during midday hours 2b. Use laser beams with only enough power required for the task

3. Avoid releasing the hazard Use lockout and tagout procedures for high-energy lasers when personnel could be at risk 4. Modify release of the hazard

For arc welding and lasers, light reflected from walls, ceilings, and other surfaces can be modified by coating with low-reflectance paint

5. Separate the hazard from that needing protection

5a. Apply sunscreen to skin before exposure

5b. Provide work areas with overhead shading devices (canopies) 5c. For higher energy lasers, establish restricted areas with appropriate signage and limited access

6. Improve the resistance of that needing protection

Improve resistance to sunburn by gradually tanning skin. This does not change risk of skin cancer

7. Help people perform safely 7a. Encourage personnel to use plenty of sunscreen by providing instruction and supplying the lotion 7b. Provide personnel with information about the hazards of sun exposure and precautionary practices 7c. For higher energy lasers, post warnings and provide instructions for personnel who may interact with the equipment

8. Use personal protective equipment

8a. Ensure that workers exposed to arc welding or laser light protect their eyes by using light filtering lenses appropriate for light source 8b. Workers exposed to sunlight can wear garments with built-in UV protection, a hat, gloves, and glasses with a UV filter

9. Expedite recovery 9a. Train personnel on early detection of skin cancer 9b. For employees returning from skin cancer surgery, consider options for work not involving sun exposure

Table 21.2 Strategies and Tactics for Reducing the Risks of Ionizing Radiation Hazards. Risk-reduction strategy Risk-reduction tactics

1. Eliminate the hazard 1a. For defined areas of facility, prohibit materials with ionizing radiation from entering, being used, or being stored 1b. For facilities with known ionizing radiation sources, remove the sources from the site

2. Moderate the hazard Dilute highly radioactive materials to lower radioactivity

3. Avoid releasing the hazard 3a. Inspect outgoing personnel and materials to detect and avoid releasing contaminated materials from facilities 3b. Monitor exhaust air and water released from facility to detect contamination and avoid environmental damage 3c. Establish and maintain criticality controls when processes have possibility of reaching criticality 3d. Regularly inspect all containers of radioactive materials for signs of developing corrosion or structural weaknesses

4. Modify release of the hazard 4a. Designate as “controlled access areas” locations with high ionizing radiation. Limit employee exposures to these areas

4b. Encase radioactive materials in sealed containers designed to limit leakage to zero or very small amounts

5. Separate the hazard from that needing protection

5a. Build radiation shields between radioactive sources and areas used by personnel

5b. Provide remote controls for radiation-producing machinery 5c. Provide remote controls for handling radioactive materials 5d. Practice excellent housekeeping to prevent personnel from unintentionally acquiring radioactive materials that might be subsequently ingested or inhaled

6. Improve the resistance of that needing protection

No tactics. Cannot change human resistance to ionizing radiation

7. Help people perform safely 7a. Use SOPs to encourage employees to perform each task in the proper way 7b. Train personnel to use the SOPs 7c. Put radiation hazard label on all containers with radioactive materials 7d. Have personnel carry a pocket dosimeter so that they can see if an exposure may have been excessive

8. Use personal protective equipment

8a. Have personnel use gloves and other protective clothing when possibly handling radioactive materials or containers 8b. Have personnel wear respiratory protection based on a formal respiratory protection program

9. Expedite recovery 9a. Have in place a spill management system to limit harm 9b. Monitor body fluids and excreta for early detection of overexposure

The first strategy is to eliminate the hazard. Tactics for nonionizing radiation involve avoiding work under direct sunlight for most of a shift. Many highway construction projects schedule a majority of work at night. This reduces the disruptive effects on traffic flow during busy hours and eliminates worker exposure to sunlight. Consideration may be given to eliminating arc welding by choosing another process for the task or removing the arc welding from the site. For ionizing radiation, tactics involve eliminating sources from areas where people work. This tactic applies to not letting a source on the facility in the first place and removing sources already located on the site. The second strategy is to moderate the hazard. For sunlight exposure, scheduling work for the evening hours reduces exposure because the intensity is decreased while the sun is low on the horizon. For laser application, using beams with only enough power required for the task moderates the potential exposure. Laser beams are categorized to reflect hazardousness.3,4 Those in the more hazardous categories require more engineering and administrative controls. For ionizing radiation materials, diluting container contents may be an option. The dilution may change the classification of the contents and make disposal or storage less costly. The third strategy is to avoid releasing the hazard. For sunlight and arc welding, the UV light emitted cannot be prevented from releasing. For ionizing radiation, there are several tactics. The first is to control everything leaving the facility to avoid spreading contamination to the community. That tactic includes inspecting and monitoring all outgoing personnel, shipped materials, waste water, and exhaust air. A second tactic applies to processes with potential to reach criticality (intense nuclear reaction). Criticality controls include monitoring closely to prevent deviations in work processes that could increase the risk of reaching criticality and releasing massive amounts of radiation. Steven Casey describes a sad case of failure to prevent deviations from the standard procedures for mixing materials used to make nuclear fuel pellets.8 The third tactic applies to stored materials. A rigorous inspection program may be used to detect any signs of container deterioration, and of course, deteriorated containers need replacement. The fourth strategy is to modify release of the hazard. For arc welding, light reflected from walls and the ceiling can be modified by coating with low-reflectance paint. This provides protection for

personnel who are not welding but are exposed while passing by or working near the welding area. A tactic used for locations with ionizing radiation is to control the individual exposure time. To make this tactic effective, strict administrative procedures are used to make sure the exposure hours of individuals do not exceed a total allowed by health physics guidelines. A tactic used for storing and transporting radioactive materials is to encase the materials in sealed containers designed specifically for the material. Effective encasement should avoid releasing ionizing radiation or material from the container. The fifth strategy is to separate the hazard from that protection. For UV light, sunscreen products applied to the skin before exposure partially block penetration of the harmful UV radiation. Although authorities agree that excessive exposure to the UV light should be avoided, there are some differences in opinion about how far to carry this advice. Some encourage avoiding sunlight as much as possible. Advice from others is to get enough sunlight to sustain vitamin D levels, but more than that is ill advised. All the experts agree that lotions with UV blocking agents should be applied to skin before exposures. They also agree that most people apply insufficient lotion, and they do not reapply often enough. Sunlight blocking agents are designated by the type of UV light for which they protect. Protection from UV-A and UV-B is most common. The sixth strategy is to improve the resistance of that needing protection. Reducing risk of sunburn may be achieved by gradually acquiring a tan. This approach, however, does not reduce risk of skin cancer. Human susceptibility to health damage from ionizing radiation is not changeable. The seventh strategy is to help people perform safely. Two tactics are listed in Table 21.1 for sun exposure. One is to encourage personnel to use plenty of sunscreen lotion. A fundamental way is for the employer to provide appropriate lotion to employees who work in the sun. The second tactic involves conducting periodic training sessions on hazards of sun exposure and precautionary practices for reducing risk of sunburn and skin cancer. Tactics listed in Table 21.2 for ionizing radiation include four administrative practices. First, develop and use standard operating procedures (SOPs) to encourage employees to perform each task in the proper way. Second, training provides the connection between SOPs in a manual and the personnel who need to follow the SOPs. Third, put radiation hazard labels on all containers with radioactive materials and post signs at the entrances to protected areas. Fourth, have personnel carry a pocket dosimeter so that they can easily determine if a particular event exposed them to radiation. Employees may carry a pocket dosimeter as well as a more accurate monitoring device. The pocket dosimeter has the advantage of making quick feedback available to a worker who will then be enabled to take appropriate actions. These devices are less accurate than some other personal monitors.6 Two other types are the film badge and the thermoluminescent detector. Carrying a pocket dosimeter plus one of the more accurate monitors permits both quick feedback and accurate exposure data determined somewhat later. The eighth strategy is to use personal protective equipment. Welders use face shields to protect from splatter. Providing specific light filtering lenses to workers exposed to harmful lights is effective. Workers exposed to sunlight can wear garments with built-in UV protection, hard hats to protect their head, gloves to protect their hands, and sunglasses to protect their eyes. For ionizing radiation, personnel can use gloves and other protective clothing when possibly handling radioactive materials or containers. Finally, personnel can wear respiratory protection based on a formal respiratory protection program. The ninth strategy is to expedite recovery. A common tactic is monitoring body fluids and excreta for early detection of overexposure. The discharge water from toilets needs monitoring to detect if radiation levels have increased to a troublesome level. If that happens, actions to prevent

contaminated water from leaving the facility and getting into deep groundwater or surface water are essential, and investigating to find the source of the contaminant is a key step in the process of preventing future incidents. Another very important tactic for expediting recovery is to have in place a spill management system to limit harm. A spill management system can include multiple elements. Among these are automated systems to monitor and detect spills quickly, systems to seal off the area by means such as closing automatic doors, possibly applying a controlling agent, means for notifying personnel of the proper response, plans for evacuation known by personnel, and personnel trained and equipped to safely perform cleanup.

Learning Exercises 1. Out of the various forms of electromagnetic energy, which ones can humans detect

without any scientific instrument? 2. Figure 21.1 looks similar to Figure 16.1. What is the difference in the horizontal axis? What is the difference in the spread between successive waves? 3. In most common radios, you can tune in AM as well as FM stations. Do the station numbers refer to the frequency or the wavelength? 4. Which type of electromagnetic radiation is most recognized for causing each of the following?

a. Sunburn, accelerated skin aging, and skin cancer.

b. Arc eye and solar retinitis.

5. What practices can be used at a nuclear power plant or nuclear research facility to protect the community outside the facility from ionizing radiation? Take into consideration the families of workers, dry cleaners, and community air and water. 6. In what ways can a nuclear power plant help people perform safely? 7. When machine shops are inspected, nuclear facilities take quite seriously accumulations of dust in corners. In contrast, inspections of machine shops in general industry (e.g., an automotive part supplier) regard dust in corners of minimal concern. Explain the reason for the difference in emphasis.

Technical Terms Controlled access area

A designated area in which the exposure of individuals to radiation or radioactive material is controlled.

Criticality controls

Engineering and administrative systems for making sure processes do not reach nuclear criticality.

Electromagnetic fields (EMFs)

Static electric and static magnetic fields associated with natural phenomena and some types of electromagnetic energy. The fields do not vary with time. The strength of a field at a point depends upon the distribution and behavior of the electrical charges involved.

Electromagnetic radiation The propagation or transfer of energy through space and matter by time-varying electric and magnetic fields.

2

Ionizing radiation

Electromagnetic or particulate radiation capable of producing ions when passing through matter.

Nonionizing radiation

The part of the electromagnetic spectrum where there is insufficient quantum energy to cause living matter to ionize. It includes radiant energy with wavelengths in the range of 100 nm to 300 000 km.2

Wavelength The distance between corresponding points of two successive waves of a sinusoidal waveform such as electromagnetic energy. It is usually denoted with the Greek letter lambda (λ).

References

1. Karpowicz J, Gryz K. Electromagnetic hazards in the workplace. In: Koradecka D, editor. Handbook of occupational safety and health. Boca Raton, FL: CRC; 2010. p. 199–214. 2. Hitchcock RT, Moss CE, Murray WE, Patterson RM, RockwellJr., Nonionizing radiation. In: DiNardi SR, editor. The occupational environment: Its evaluation and control, 2nd ed. Fairfax, VA: American Industrial Hygiene Association; 2003. p. 494–571. 3. Miller G, Yost M. Nonionizing radiation. In: Plog BA, Quinlan PJ, editors. Fundamentals of industrial hygiene, 5th ed. Chicago, IL: National Safety Council; 2002. p. 281–325. 4. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 390–393. 5. McCarthy ME, Thomas B. Ionizing radiation. In: DiNardi SR, editor. The occupational environment: Its evaluation and control, 2nd ed. Fairfax, VA: American Industrial Hygiene Association; 2003. p. 572–610. 6. Cheever CL. Ionizing radiation. In: Plog BA, Quinlan PJ, editors. Fundamentals of industrial hygiene, 5th ed. Chicago, IL: National Safety Council; 2002. p. 257–280. 7. Pachocki KA. Ionising radiation.In: Koradecka D, editor. Handbook of occupational safety and health. Boca Raton, FL: CRC; 2010. p. 297–325. 8. Casey S. The atomic chef and other true tales of design, technology, and human error. Santa Barbara, CA: Aegean; 2006. p. 13–26.

Chapter 22

Hazards of Severe Weather and Geological Events

22.1 Background This chapter discusses two hazard sources for organizational performance and employee safety. Significant weather events and major geological events can interrupt operations and harm personnel. These events are not preventable, and therefore, not viewed within the traditional framework of most OSH issues. For example, we have no standards to follow for compliance. The most prevalent view in the OSH field is to treat these events through emergency planning and preparation. Major weather events include severe winter storms, hail, floods, torrential rains, mudslides, high winds, tornadoes, hurricanes, and nearby lightning strikes. These events arise from the natural transitions of air and water. The air movements are driven by temperature gradients constantly occurring as the heat from the sun is distributed. The pressure gradients are tied to the temperature

gradients as the more dense cooler air pushes warmer air. A third factor adding considerable complications is the altitude. Air movements can vary in direction and velocity at different elevations. For these basic reasons, weather forecasts are based on probabilities rather than certainties. Major geological events include earthquakes and volcanoes. Both arise from hot material deep under the surface exerting pressure on the more solid materials comprising the mantle. The heat comes from continued radioactive decay of materials deep in the Earth and from heat left over from the Earth's formation.1 The mantle consists of large platonic plates that rest on a bed of molten material. Some plates contain continents such as the African Plate, the Eurasian Plate, and the South American Plate. Some plates, like the Pacific Plate, are the ocean floors with a few seamounts rising high enough to be islands. Earthquakes originate from the junction of abutting platonic plates.1 One type involves two plates sliding laterally relative to each other. This is the common case in California where the San Andreas Fault lies. The Pacific Plate moves northwest relative to the North American Plate. Movements occur in spurts, producing frequent minor tremors, and occasionally producing destructive shaking. A second type involves two plates separating. The Mid-Atlantic Ridge is formed by continental plates separating and allowing molten materials from below to push up into the Atlantic Ocean. During various geological periods, some of the resulting ridges grew peaks tall enough to form the present Atlantic islands. A third type is one plate sliding over another. The Andes Mountains are the result of the South American Plate being elevated by an ocean plate sliding under South America. If the plates meet under the ocean, a very different result can occur. After years of two plates pushing against each other, a point is reached where the plates suddenly move, one sliding under the other. The rising plate creates an upward push on the water above it, while the descending plate pulls downward on the water above it. This pressure difference transmits all the way from the ocean floor to the surface, initiating a large wave in which the high water chases the low water across the vast ocean. These tsunamis (or tidal waves) travel great distances. When the wave reaches a shoreline, the low water arrives and causes an extreme low tide condition. The following high water wave then rushes ashore with the power to kill people, severely alter the natural environment, and destroy such human-built items as highways, bridges, buildings, and industrial facilities. Volcanic eruptions arise in somewhat predictable locations. Some arise in a location where an ocean floor platonic plate meets a continental plate resulting in the ocean floor plate sliding under the continental plate. As the lower plate sinks further down it heats up, eventually becoming molten. The molten material breaks through a weak spot in the plate above it and spews out lava. This usually occurs in places where prior eruptions have occurred, such as old volcanic mountains. There are several of these volcanic mountains in British Columbia, Washington, and Oregon. Another location for volcanoes is in a few “hot spots” around the Earth. These locations are above stationary openings located deeper than the plates. The platonic plates move over these hot spots very slowly but in a predictable direction. A major hot spot created the Hawaiian Islands. The oldest islands are in the northwest end of the chain. The newest are in the southeast end. The most recently created of the islands is the large island, Hawaii. These islands grew out of the Pacific Plate as it slowly moved northwest over the hot spot. Another hot spot is located in the North American Plate under Yellowstone National Park. From an OSH perspective, the important point is that the risk of a volcanic eruption is largely confined to geographic locations with a history of eruptions. Thus, location is predictable, but the timing of an eruption is speculative. Geologists may be able to predict that a volcanic eruption in a particular site will occur sometime in the next thousand years. Although advances in monitoring quakes continue to improve forecasts, considerable uncertainty remains. We simply need to accept the uncertainty and proceed with appropriate precautions to mitigate adverse

effects and prepare for recovery.

22.2 Mechanisms of Harming Both major weather events and geological events can affect the people and functioning of an organization. Weather events can significantly affect employee commuting, especially for those using the roadways. Weather can also disrupt shipments into and out of the facilities. Both weather and geological events can interrupt access to utilities (e.g., electric power, fuel gas, and water) and communications (telephone, cell phone service, and Internet connections). Power surges from lightning can damage electronic systems. Major geological events like earthquakes can damage building structures and cause building materials to fall on personnel inside. Volcanic eruptions spew ash and gases into the air. The extended eruptions of a volcano in Iceland in 2010 caused cancellation of commercial air traffic throughout most of Europe for several days. During the post-event phase, employees and external responders may become unknowingly exposed to hazards created by the weather or geological events. Examples include gas leaks, exposed electrical wires, unstable walls and ceilings, and damaged pneumatic or hydraulic lines. Hurricanes and ice storms often bring down power lines. Lines close to ground level are serious hazards for rescue workers and repair personnel. Major weather events create situations that put people in need of rescue. Examples are people stranded by a severe snowstorm or flood, private boats being caught in a severe storm at sea, and people buried under rubble left by a tornado, hurricane, or earthquake. The people who volunteer to attempt rescue often find themselves subjected to dangerous situations. For example, a rescue at sea operation may expose rescue personnel to the hazards inherent in helicopter flight during bad weather and retrieving people from a sinking vessel. Job hazard analyses of these sorts of missions would reveal diverse specific hazards encountered during the planned steps, and for many of these the hazard control depends on timely and effective action by team members. A single decision error or mistake in execution can have serious consequences.

22.3 Strategies and Tactics for Weather and Geological Events

The strategies for reducing risk with weather and geological events are listed in the left column of Table 22.1. On the right are some of the applicable tactics. Table 22.1 Strategies and Tactics for Reducing the Risks of Weather and Geological Events. Risk-reduction strategy Risk-reduction tactics

1. Eliminate the hazard 1a. Avoid locating facilities in locations known as high risk for significant weather or geological events 1b. Call off or postpone a rescue mission if conditions make it too dangerous

2. Moderate the hazard Not feasible 3. Avoid releasing the hazard Not avoidable 4. Modify release of the hazard Not feasible 5. Separate the hazard from that which needs protection

Locate workplaces away from sites likely to experience a flood or mudslide

6. Improve the resistance of that which needs protection

6a. Construct buildings and other structures using technology for tolerating earthquakes

6b. Establish redundant or backup systems for utility services and communications 7. Help people perform safely 7a. Provide shelters within facilities where employees may go during hurricanes and tornadoes

7b. Conduct drills to help personnel learn emergency response procedures 7c. Rigorously train and adequately equip personnel who will be performing rescue missions so that they can do so safely 7d. Establish policies encouraging personnel to choose not to drive during severe weather

8. Use personal protective equipment

For outdoor workers, provide protective outerwear appropriate for foreseeable weather events

9. Expedite recovery 9a. Include in the business continuity plan those weather and geological events considered most likely 9b. Include in emergency plans specifics about post-incident actions needed, responsible individuals, and required training and resources they will need 9c. Have OSH trained people monitor the work of responders and repair personnel 9d. Have repair teams develop a JHA or RA prior to starting tasks

The first strategy is to eliminate the hazard. One tactic is to avoid building a new facility in a location known as high risk for significant weather or geological events. This may seem quite ivory tower, but companies looking for new facility sites include this risk among the numerous other site- selection criteria. A tactic for a rescue team is to postpone the mission if the situation would involve more risk to rescue personnel than is tolerable. Strategies 2 through 4 have no tactics listed in Table 22.1. The author could not think of any way to affect weather or geological events by moderating the hazard, avoiding release of the hazard, or modifying the release. A tactic for Strategy 5 is to locate workplaces away from areas likely to experience flooding or a mudslide. The sixth strategy is to improve the resistance of that which needs protection. The governments of places with a history of destructive earthquakes have adopted requirements for new construction to mitigate effects of substantial tremors. Whether required or not, it makes sense to incorporate available earthquake technology into construction specifications for new structures located where the risk of earthquakes is substantial. The seventh strategy is to help people perform safely. The first tactic listed is to provide shelters in building where employees may congregate during highly windy events like hurricanes and tornadoes. This should provide protection from glass and other objects thrown about by the destructive powers of the wind. In addition, the shelters may provide protection if the roof or walls collapse. Conducting emergency response drills is a well-known tactic for helping personnel respond appropriately to disruptive weather and geological events. A third tactic is to establish policies encouraging employees to choose not to drive during severe weather. Policies may consider both commuting employees and those who perform work-related driving. The safety of people performing rescue operations makes use of Strategies 7 and 8. Performing rescue operations in the safest feasible manner requires extensive training and first class equipment. Through training and equipment, the team members will have opportunities to deal with obstacles and hazards encountered as they perform the rescue. Those performing this sort of work also benefit from personal protective equipment, for example, the self-contained breathing apparatus worn by firefighters when entering a burning building to rescue a child, and the bullet-resistant vests worn during some military and police operations. For 24-hour operations, policies may clarify how decisions are made when severe weather is forecast. One such policy may address decisions about keeping some employees at work while having others stay home. For employees who drive as part of their job, policies can make clear the

organization's support for individuals deciding to cease driving when they feel conditions are too risky. The costs to stop driving, and possibly pay for a motel room, are relatively small when weighed against the costs of roadway incident. Consider some of the potential costs. If an employee is involved in a roadway incident where others are seriously harmed, the potential for litigation is quite high. Lawyers commonly view large organizations as “deep-pocket” targets for legal action. The lawsuits, regardless of merit, can cost a great deal to defend, and settle. Damage to vehicles and roadside fixtures (e.g., signs, light poles, and guardrails) can be quite costly. Even small vehicular incidents like fender benders can lead to an employee using work time for visiting auto body shops to get repair estimates, dealing with insurance companies, and finding temporary transportation. The eighth strategy, to use personal protective equipment, has only one tactic. It is to provide outdoor workers with protective outerwear appropriate for foreseeable weather events. The raincoats provided for police are an example. Rescue teams employ this tactic through rigorous training and providing quality equipment for personnel who will be performing the missions. The ninth strategy is to expedite recovery. The first two tactics listed are discussed more extensively in Section 12.5. One is to include in the business continuity plan those weather and geological events considered most likely. The second is to include in emergency plans the responses and recovery activities needed after a weather or geological event. It is particularly important to identify individuals or positions charged with responsibilities to perform response tasks, and to provide those individuals with the training and specific resources needed to perform their assigned tasks. A third tactic is to have OSH trained people monitor the work of responders and repair personnel to provide an extra pair of eyes for spotting hazards. A fourth tactic is to have repair teams develop a job hazard analysis or risk assessment prior to starting a task. A tactic applicable to rescue teams is developing a plan and becoming prepared for responding in case the primary rescue or combat team needs help.

22.4 Summary of Part IV Part IV has nine chapters about energy hazards—eight address forms of energy and this chapter addresses diverse forms of energy associated with weather and geological events. To put part IV in perspective, Figure 22.1 depicts two-dimensional matrix with a row for each of the seven hazard sources identified in chapter 2, and a column for each of the nine risk-reduction strategies. The first two rows apply to part IV. Cells marked with an X indicate for each source the strategies mentioned in part IV. Figure 22.1 Matrix showing the risk-reduction strategies applicable to the two hazard sources addressed in part IV.

The first chapter begins with a section describing energy in general and explaining how energy

frequently changes form. The main material in each chapter contains three sections starting with a background about the scientific aspects of the energy, followed by explanations of the mechanisms by which the hazardous energy can harm people or other valued items, and concluding with a section illustrating applications of risk-reduction strategies to the hazardous energy. A two-column table format is used to clearly map the various tactics to one of the nine strategies. Most tactics listed in the tables illustrate risk-reduction approaches found in OSH-related books, regulations, and voluntary standards. The author has attempted to include enough tactics to illustrate how the strategies are implemented. The topics of the chapters in part IV are energy sources with potential to cause harm. These are kinetic and gravitational energy, electrical energy, acoustic energy, thermal energy, fires, explosions, pressure, electromagnetic energy, and weather and geological events. Due to the frequent change of energy from one form to another, some topics discussed in one chapter could have been discussed in another chapter. For example, some incidents start as fires, create high pressure, and explode. Explosions can create a shock wave that is a particular form of acoustic energy. Another example is earthquakes. Earthquakes result from the intense pressure between platonic plates being changed to kinetic energy when the plates move. If underwater, the kinetic energy transfers to the water and creates waves. If under a continent, the kinetic energy creates pressure waves that manifest as tremors or earthquakes. Thus, grouping all these energy topics into one of the major parts of the book emphasizes their interrelated character. The fifth major part of the book discusses occupational hazards not quite so clearly based on energy.

Learning Exercises 1. If this chapter on weather and geological events were left out of the book, into which

energy chapter or chapters would you put (a) weather events and (b) geological events. Explain your rationale. 2. Do you think a tsunami should be considered a weather event or a geological event? Why? 3. Of the nine strategies in Table 22.1, which take effect in the Haddon phase called the “post-incident” phase?

Technical Terms Geological events

Earthquakes and volcanoes.

Weather events

Uncommon and disruptive weather conditions such as severe winter storms, hail, floods, torrential rains, mudslides, high winds, tornadoes, hurricanes, and local lightning strikes.

Reference

1. Hazen RM, Trefil J. Science matters: Achieving scientific literacy. New York: Anchor Books; 2009. p. 215–250. Part V Risk Reduction for Other Than Energy Sources Part V continues the discussion of the seven categories of hazard sources—forms of energy, weather or geological events, conditions, chemical substances, biological agents, musculoskeletal stressors, and the violent actions of people. Having addressed the first two in part IV, the remaining chapters address the other five hazard sources. Chapter 23 addresses conditions of workplace associated with increased risk. Due to the enormous variety of workplace conditions, the chapter focuses on a few that are both manageable and known to contribute to numerous occupational injuries, fatalities, and diseases—floors, stairs, ramps, confined spaces, and dusty working conditions. Chapters 24 through 27 provide background information and examples of risk-reduction strategies for the hazards of chemical substances, biological agents, musculoskeletal stressors, and hazards arising from the violent actions of people. Throughout the chapters in this part, the emphasis is on the pre-event and during-event phases. The post-event phase is important, but it would be redundant to include it in the discussion of each hazard source. Readers will also notice distinctions based on different organizational aspirations for workplace safety and health. As explained in chapter 12, some organizations aspire to comply with applicable laws and standards, while others aspire to operate at a best-practice or world-class level. These organizations typically define best practice by referring to the latest voluntary standards applicable to their industry. Chapter 23

Workplace Conditions

23.1 Background Workplaces have various physical features that can, if not managed appropriately, be hazards to employees. Perhaps all workplaces have walking and working surfaces, most have stairways and/or ramps, many have confined spaces, and some have dusty air. The condition of these features, and many other workplace features, can be made safe through attention to engineering controls and administrative practices. On the other hand, lack of attention can make these features hazardous conditions. This chapter addresses workplace conditions selected because they are found in so many workplaces, and because of their association with occupational injuries and diseases. OSH professionals and the public generally think of walking surfaces with slippery spots as being hazardous to pedestrians. Thus, we can consider the slippery surface as a hazardous condition, waiting passively for a human to come along. If a person slips on the slippery spot and falls, we consider the slippery spot as the proximate cause of the injury. This is the view taken in this section. However, another perspective warrants acknowledgment. A physicist may take the view that the potential gravitational energy of the person's body is the hazard, and the slip caused failure of the base of support for the gravitational energy, resulting in release of potential energy, leading to impact with the floor. The physicist's perspective is entirely logical, but may seem a bit twisted for most of the OSH community and general public. The view that the hazard is the location rather than the energy is taken for this chapter because the opportunities to correct a hazardous location are abundant, whereas instructing employees to better control the gravitational energy of their body while walking is unlikely to change ambulatory habits. Similar differences in perspective are presented when the location is a confined space containing a potentially harmful chemical or energy. Many spaces in industrial facilities contain air contaminants and various unseen energies with potential to harm anyone who might enter the space. Some industrial properties contain chemical- laden ponds that may look like swimming holes to neighborhood children. The condition of such industrial spaces affects the risk of an injurious incident. Two other factors also contribute significantly to risk: frequency of exposure and the behavior of those exposed. The importance of a hazardous condition increases as the extent of exposure increases. To emphasize this point, consider an industrial facility with two similar concrete stairways. Both have a chunk of concrete broken off the lower step. One leads to the basement and is used twice a month by a maintenance employee. The other is used by many employees every shift, averaging 800 descents per month. In an ideal world, the company would have both stairways repaired promptly. If, however, the company does not have an unlimited maintenance budget, and wants to commit funds to the most important matters, fixing both steps this year may not be feasible. A risk assessment would make clear that the stair used frequently has a much higher risk-reduction potential. Before saying this is obvious, think about the typical walk-through safety inspection. A small team walks through a work area and notes any conditions not conforming to standards. These sorts of checklist inspections consider both defects the same, with no concern for frequency of use.

To illustrate how significant this is, consider some numbers. Start with an estimate that the probability of a fall while descending either staircase once is 0.000 001. The probability of a fall on either staircase during a month may be calculated by multiplying the probability of a fall per descent by the monthly number of descents. Thus, for the frequently used staircase, the monthly probability is 0.000 001 falls/descent × 800 descents/month = 0.0008 falls/month. For the infrequently used staircase, the probability is 0.000 001 falls/descent × 2 descents/month = 0.000 002 falls/month. The ratio of these risks (0.0008/0.000 002) indicates that the frequently used staircase has a risk 400 times greater than the infrequently used staircase. Basic calculations such as these illustrate how much more risk-reduction potential may be realized by allocating facility funds to repair the more frequently used staircase. Throughout the following subsections about managing fixed-location hazards, risk-reduction opportunities include managing the condition itself, the frequency of use, and the behavior of those exposed.

23.2 Floors The safety literature and codes agree that walking surfaces should be built and maintained for injury- free walking. This is an excellent goal for companies building new facilities and those with world- class aspirations for their OSH programs. However, there are many companies getting by in old facilities, and having less ambitious OSH goals. For these companies, obtaining funds for working surface safety projects may be very challenging. Thus, the following discussion attempts to address some considerations OSH managers may find helpful when prioritizing walking surface projects. Public sidewalks, like the one shown in Figure 23.1, provide a good example of the need to consider more than just the hazardous condition. Other significant considerations include frequency of use, cost effectiveness, and human expectations. The frequency of use factor is obviously important and easily understood. The cost effectiveness factor comes into play as projects for OSH improvements compete for resources with each other and with proposals from other organizational units. The human expectation factor needs some explanation. Figure 23.1 A substantial crack in a sidewalk with low frequency of pedestrian traffic.

When people walk, they adjust their walking behavior to the walking surface they expect to

encounter. Workers at construction sites do not expect a city-like walking surface; they know that peering at the surface ahead is required. People using public sidewalks provide another example. In a new neighborhood with new sidewalks, pedestrians develop expectations of level sidewalks. Along with that expectation, they walk without looking ahead at the sidewalk. In an older neighborhood with sidewalks having numerous cracks, broken concrete, and mismatched slabs, pedestrians do not expect level sidewalks and they understand the need to look ahead at the walking surface. If city officials do not have sufficient funds to maintain all sidewalks in tip-top shape, they will need to prioritize sidewalk projects, and in doing so, they are justified in considering human expectations along with frequency of use and cost effectiveness. The following discussion begins with explanations of how humans interact with walking surfaces, and how falls sometimes occur. Following this discussion, risk-reduction tactics are noted.

23.2.1 How Pedestrians Fall Hazardous locations associated with slipping involve interactions among several factors. Drawing the findings and conclusions of a few of the researchers in this area, the following explanation is provided.1–4 People routinely walk on level surfaces without giving it any thought. Most walking is controlled by neural connections involving the lower extremities and the spinal cord. The brain is not actively involved in ordinary walking. When the person sees an obstacle or other variation in the walking surface ahead, the brain intervenes in the automated process and causes an adjustment in the walking pattern, or gait. This allows pedestrians to successfully traverse many types of walkways without falling. A common problem arises when the person encounters a surface variation they fail to see or notice. Why this is important requires a basic understanding of how people walk and occasionally fall. As we walk, the leading foot makes initial contact with the heel. At that instant, the heel is exerting a forward shear force against the floor surface. For a fraction of a second, the heel slips forward (and a bit laterally). During a normal stride, the shear force (Fmotion) is countered by force in the opposite direction (Fk) from the friction between the heel and floor. At first, Fmotion > Fk. As more body weight is transferred to the floor, there comes a point where Fmotion < Fk. After that, the heel motion decelerates, and usually comes to a stop soon. A slipping distance in ordinary walking less than 1 cm is not even noticed by the person. Slipping up to 3 cm is considered within the range of controlled walking for healthy people. As the length of the slip increases beyond 3 cm, concerns for slipping falls increase. As one can easily imagine, when the leading foot suddenly slides forward, we instinctively react. Sometimes the bodily reaction avoids a fall. The probability of a successful reaction declines as the length of the slide increases. For example, a relatively high proportion of recoveries from 4 cm slides are expected. But the proportion of recoveries from slides over 10 cm will be very low. In between this range, the proportion of successful recoveries declines. Walking techniques that make sliding distance shorter are to walk slower and shorten stride length. Those of us living in northern climates learn this from walking outdoors during winter. When we encounter spots of ice, taking very short steps enables us to either avoid slipping altogether or limit the length of slipping. A similar approach applies when approaching a wet floor. If we know the floor is wet, we can either avoid it or walk on it slowly with very short strides. That technique reduces the reaction force required to control the initial heel slip and keeps the body's center of gravity approximately above the supporting feet. If one foot does slide, the other foot is not far from being

positioned to support the upper body. Falls initiated by slipping have some common fall patterns.3 Two patterns follow slipping of the leading heel during straight-ahead walking. In pattern 1, the leading foot slides forward and becomes airborne. The trailing foot continues forward and also becomes airborne. The torso falls and the person hits the floor with their buttocks, possibly damaging their tailbone. The back of their head may also impact the floor. Pattern 2 starts similarly, but the trailing foot stays low and tucks under the leading leg. This fall pattern tends to result in floor impact involving one-sided buttock or hip impact, and often elbow impact. The side of impact is that of the trailing foot. Figure 23.2 is an event tree showing the paths to these two outcomes as well as paths to other patterns of falling from a slip. The probability values in the event tree are crude guesses provided for the third Learning Exercise at the end of the chapter. Figure 23.2 Event tree for a slip on the same level, showing paths of outcomes and crude estimates of branch probabilities.

When the person begins to change direction, a somewhat different fall pattern occurs. When the

person starts a turn, the torso redirects in the direction of the turn, and the leading foot demands more than usual floor reaction force to stop. In pattern 3, the leading foot starts sliding in the original direction of travel, but relative to the person's torso, the foot moves laterally. The trailing leg buckles, and the person lands on the side of their buttocks. Excellent graphics depicting these typical fall patterns are provided in Ref. 3. A fourth slipping pattern is occasionally encountered.3 The initiating event is a slip by the trailing foot as the toes push off. The trailing foot slides backward. Many people recover from this type of slip, but if recovery is unsuccessful, the typical fall pattern involves the knee of the trailing leg impacting the floor.3 The secondary impact may be shared by the upper leg, hip, and arm on the side of the slipping foot. The walking event known as stumbling involves interruption of the expected foot–floor contact. When we walk, the leading foot establishes contact with the floor (initially the heel, followed by a shifting to the toes). While the leading foot is in contact with the floor, the trailing foot leaves the floor and swings forward.3 During this motion, the body's center of gravity continues moving forward. Normally the trailing foot ends the swing with a new heel contact in front of the center of gravity. In stumbling, the trailing foot is interrupted as it moves forward. Typically this involves the shoe sole brushing against the floor resulting in a slowing of the foot movement. Before assuming

that only the most awkward among us would allow this to happen, recognize that the forward swing of most people provides a very small clearance with the floor. As people get on in years, they tend to have even less clearance. We have all seen older people shuffling along, almost dragging the following foot forward. Their clearance is so small that it takes only a slight elevation of the floor to catch the foot. The shoe sole can be easily slowed by a small bit of sticky surface such a gum deposited by an inconsiderate person days before. Fortunately, not all stumbling events lead to a fall. People in the workforce are generally fit enough to recover when the stumble only briefly interrupts their foot motion. Less fit people, especially the very old, are more likely to fall after stumbling. A fall from stumbling resembles that from tripping. Loss of balance from tripping and stumbling produces a face-forward fall often accompanied by an extended arm impacting the floor. This response may soften the fall and avoid serious injury, or it may result in a broken bone. Fracture of the radius bone (a Colles' fracture) accounts for the largest portion of these fractures.4 A trip event occurs when a walking person's toe contacts an obstruction. The obstruction may be a protrusion from the walking surface or a loose object in the path. Examples are the curled edges of floor mats and wrinkles in rugs. These types of walking surface deviations are easily observed, and uncomplicated to correct. Employee awareness of the hazardous nature of such protrusions can provide the necessary monitoring for early detection.

23.2.2 Risk Reduction for Falls on the Same Level Risk-reduction tactics for falls on the same level focus on preventing initiating events. Once the initiating event occurs, the outcome depends on the person's reaction. Aside from teaching people how to fall gently (e.g., skiers learn how to fall safely), there is nothing the OSH professional can do to affect the during-event phase of the incident. For the post-event phase, an effective first response can help reduce the ultimate severity of the injury. The first priority is to eliminate the hazard. Eliminating slipping events involves providing consistently high friction throughout walkways. As explained earlier, a primary contributor to walkway slipping and stumbling is encountering an unexpected difference in the slipperiness of the surface. The quantification of floor conditions from slippery to nonslippery uses the coefficient of friction (COF). Values of COF, usually represented by the Greek letter μ, range from zero to one, with the low end for extremely slippery and the high end for extremely gripping. For an object sitting on a floor without moving, we use μs, the static value. For a moving object in contact with the floor, we use μk, the kinetic value. The flooring industry finds the static value useful as a guideline for quantifying slipperiness, with a value greater than 0.5 considered a rough dividing line between too little and adequate friction for flooring. The OSH community looks at the kinetic value as being more relevant because the most common slip-initiated falls occur during the early phase of heel contact with the floor—while the heel is moving forward. Figure 23.3 provides an explanation of the classic relationship among forces involved when a moving object is sliding on another solid object. Figure 23.3 Force vectors between heel and floor soon after contact.

Researchers who study slipping while walking have concluded that the classic model for COF

found in college physics textbooks contains assumptions unsuitable for directly characterizing shoe– floor friction due, in part, to the types of materials in the shoe soles, the flooring, and the contaminating material found on floors. These experts prefer to use a variable reflecting the friction required to counteract the shear force—the required coefficient of friction (RCOF). The RCOF is the ratio of shear force to the normal force. Normal force is the upward force from the floor pushing against the heel (see Figure 23.3). The way an RCOF variable may be used is illustrated by an example in Ref. 1. For a normally healthy person walking at a normal pace on a dry surface, an RCOF greater than 0.18 should be adequate to stop the initial heel slip quickly.1 Thus, sometime in the future, there is hope that researchers will be able to use RCOF to define thresholds for floor friction. One obstacle for standards development is the method for measuring μk. Various instruments have been developed for measuring the frictional properties of surfaces.5,6 Unfortunately, no single instrument has achieved the status of “gold standard” for measuring the dynamic friction of floors in occupational facilities. Some progress has been made on standardizing surfaces that can be used to test the performance of slipperiness meters (tribometers) in terms of accuracy and reliability.7 But more work lies ahead before instrument testing procedures are fully established and instruments meeting the standards become available for use by the OSH community. Even if that is accomplished, standards development committees will continue being challenged by the numerous factors required to validly differentiate acceptable from unacceptable floor slipperiness. A major factor is the ever- changing contamination of floors by dirt, oils, and water. Another is the incredible number of combinations of shoe sole materials and floor covering materials. Measuring the friction of a just cleaned and polished floor may seem like a good idea, but soon after people start walking on the floor, the measured levels will cease being representative of what the employees experience. Given the present state of portable friction measurement instrumentation, employers may want to focus on making walking surfaces consistent, especially adjacent floors covered with different materials. Portable instruments are reasonably suited for identifying differences within the same environment. The difference approach would account for the underlying cause of slipping falls—an unexpected difference in COF. Also, measuring differences may help overcome some weaknesses in the different measuring instruments. Take, for example, two adjacent surfaces. What if instrument A measured COF values of 0.7 and 0.4, while instrument B measured COF values of 0.6 and 0.3? These values do not match in absolute COF values, but they do provide the same difference (0.3). Perhaps, employers should start thinking about setting company guidelines for walkway surfaces based on avoiding abrupt changes in floor slipperiness as measured with existing portable devices. It would, of course, require making several measurements under varying conditions to obtain appropriate

descriptive statistics (e.g., means and standard deviations). But that is no different from the professional practice of industrial hygiene that always emphasizes the importance of taking multiple measurements. Another approach for eliminating falls on the same level involves housekeeping. Properly managed facilities designate walkways and fire egress pathways with painted lines. Rules are in place and enforced to maintain these floor spaces free of objects. Besides eliminating tripping hazards, maintenance of clear walkways sends a visual message to employees and visitors that the facility is committed to providing a safe environment. When eliminating walkway hazards is not feasible, or impractical, there are ways to moderate the hazards. A common example involves the need to temporarily extend a power cord across a walkway. One approach is to eliminate the cord being a tripping hazard by hanging it above the walkway. Another way is to secure the cord to the floor with tape, under a carpet, or channeled within a commercially available device specifically intended for extension cords. With that approach the tripping hazard remains, but in a modified form with less risk than would otherwise be the case. Cracks in walking surfaces present tripping hazards. The photo of a public sidewalk in Figure 23.1 shows a substantial crack on which a pedestrian could easily catch a foot and trip. If one side of the crack is elevated above the other, a person's toe can catch the raised part and initiate a trip. An unresolved issue concerns how great the elevation difference needs to be before we consider it a tripping hazard. One view is that a single elevation difference can be applied to all public places.8,9 For example, a rule of practice may use a 10 mm or greater difference for categorizing a floor elevation change as being a tripping hazard. Another view is that the tolerable elevation difference should consider the flooring defect itself, the location, and the use pattern. This view finds support in the argument that worker expectations vary. For example, workers on construction sites and in underground mines, and railroad personnel doing track maintenance do not expect level walking surfaces. In contrast, visitors to shopping malls expect very level walking surfaces; after all, they are encouraged to look at merchandise displays rather than at the floor ahead. In between these extremes are the diverse workplaces in which a large percentage of people work. Thus, when it comes to walking surfaces having cracks with elevation differences, there are two views on how to distinguish between a crack large enough to warrant promptly taking countermeasures and one small enough to tolerate for the time being. When substantial cracks develop in walkways, prompt repair is the preferred countermeasure. Less permanent alternatives involve modifying the hazard. One temporary modification is for the facility to mark the crack to draw the attention of approaching pedestrians. Marking may be as simple as painting the elevated side with orange paint. A warning sign may contribute to drawing attention to the hazard. For some hazards on walking surfaces, redirecting pedestrians around the hazard provides a practical tactic. Workers needing to use part of a public sidewalk for their work routinely use this tactic. They may be repairing the sidewalk, loading/unloading materials, or working on a building exterior. Another common use of this strategy involves floor mopping. Janitors doing floor mopping routinely put up signs to redirect pedestrians away from the wet, slippery floor. In situations like these, the strategy is to separate the hazards of the work from the passing pedestrians. While the conditions of level walking surfaces in workplaces and public places can present several hazards for pedestrians, the associated falls involve a relative short fall distance. The hazards of falling on a step or stairway present greater fall distances, and more severe injuries.

23.3 Stairways and Steps Stairways may be thought of as inherently hazardous locations capable of being made acceptably safe by appropriate design, construction, and maintenance. Stairway characteristics affecting safety include the step dimensions, step uniformity, handrails, and guardrails. Key step dimensions are riser height and tread depth. Not all standards agree on the details of how these parameters are defined and measured. Figure 23.4 illustrates a method based on effective dimensions. The terms effective tread depth and effective riser height indicate the measurements reflect dimensions critical to foot placement, and are made from the same point on a step to the corresponding point on the adjacent step. This approach accounts for any slope (wash) or irregularities in the step surface. In the illustration, the effective tread depth is 305 mm (12 inches), and the effective riser height is 176 mm (6.9 inches). Figure 23.4 Stairway step height and depth measurement.

Taken together, the dimensions in Figure 23.4 make a 30° slope. Studies based on metabolic energy

expenditures for ascending stairs indicate a preferred range of 25–30°. Studies of misstep frequency while descending indicate desirable tread depths are over 305 mm (12 inches).10 Taken together, most guidelines applicable to workplace stairways approve of dimensions somewhat like those in the illustration. However, guidelines do not specify exact dimensions because architects need some flexibility to design stairways to fit the floor space available and the height difference between the bottom and top. The riser height in Figure 23.4 is appropriate for stairways in work settings. If a stairway is for general public use, including very young children or older/retired persons, the risers should be shorter (roughly in the range of 130–150 mm) to accommodate the needs of these diverse populations. The tread depth in Figure 23.4 provides a sufficient landing area for feet while descending. As tread depths get shorter than 280 mm, expect an increase in missteps during descent. Two patterns of missteps on descent are involved. One is the foot slipping on the nosing. The other, the more common one, involves overstepping. An overstep results in the heel of descending persons just catching the edge of the step, rather than landing firmly on the step. When only the heel catches, the foot bends downward rapidly, the knee buckles, and the body lunges forward. Step uniformity is widely recognized as a component of safe stairways.10–12 The reason requires an understanding of typical human behavior when using a stairway. Observations of people using stairways found patterns.10 When people approach a stairway from above, they look at the upper steps. They tend to continue looking as they take the first step down. After one or two steps down, their eyes no longer look at the stairway. Because they are accustomed to stairways with uniform steps, they expect uniform steps and feel no need to continue looking downward. They adjust their

stepping motions (gait) to match that of the first and second steps. If somewhere in the stairway a particular step has different dimensions, there is a mismatch between reality and human expectation. Thus, the reason stairway step variation is a risk factor for falls is that (1) people do not expect step variations, (2) they do not easily notice step variations, (3) if they are unaware of a step variation they will not adjust their gait as needed, and (4) they can easily misstep on the nonuniform step or an adjacent step. Once the misstep occurs, the person may fall or recover. If a fall occurs, the person often impacts the nosing of one or more steps as they descend. Very severe injuries and death can result from such falls. There are ways to help people see deviations in step dimensions. One is to provide a visual contrast at the leading edge, or nosing, of each step. Many stairways have nosing strips for this purpose. The person standing at the top of a flight can look down and visually detect nonuniformity among these edge lines. Someone doing safety inspections may also use this simple technique. Opposite of making the edge lines easily visible is the poor choice of covering steps with heavily patterned flooring material or carpeting. To the person descending, the patterns act like camouflage, obscuring visual differences between adjacent steps. Another way to help people see deviations in steps is to provide uniform lighting throughout a flight. Uniform lighting avoids the shadows that can deceive the visual senses. A third approach is to avoid visual distractions within a flight. Investigations of people using stairs have found that visual changes, especially changes that attract the eyes to one side of the stairway, tend to draw the attention of the stairway users away from looking ahead. While looking elsewhere, the person has no chance of noticing anything unusual about the steps ahead, and they can easily misjudge when they have reached the last step. Architects often specify nosing on the leading edge of steps (see Figure 23.4). Nosings help with ascending by making the step edge more visible and with descending by providing consistent friction at the edge of each step in the flight. Older stairs without nosings tend to have worn spots on the leading edge due to thousands of shoes rubbing the same spots. These spots become more rounded than other parts of the step, so the steps are no longer uniform. Several recommendations for architects are provided in Ref. 12. These address such matters as planning for pedestrian traffic flow with the goal of minimizing stairway usage, avoiding traffic conflicts, and providing sufficient width to accommodate one person ascending while another person is descending. For example, in a workplace, if workers need to use a stairway to get between their work location and the restroom, they will be using the stairs frequently. A lower risk design will put the restroom on the same level as the work locations. In addition, architects may benefit from thinking of the top of a stairway as a hole in the floor. A hole in a floor is easily recognized as a danger for anyone who fails to notice it. For example, a janitor may back into a stairway while sweeping or mopping the floor; or a person may be walking toward a location, with their vision focused well above the opening, and never notice the stairway in their path. Thus, the location and design of the upper opening to a stairway needs consideration. One feature that helps make the stairwell visible is the handrail. Stairway handrails contribute to both safety and usability. For ascent, people use a handrail to help pull their body upward. For descent, handrails are valuable to assist with postural orientation and to help recover from a misstep. The more serious fall injuries occur during descent, so placing a handrail on the side most used for descent makes sense. In the United States, the trend is to descend using the right side of the stairs. Thus, a handrail on the right side is a fundamental safety device. If the opposite trend is found in some other countries, the handrail recommendations need reversing. Having a handrail on the side used for ascent is less fundamental for safety, but useful for people ascending and for those descending who elect to use the handrail on that side. Handrails on both sides

are useful for wide stairs and for stairs frequently used by older people.12 Handrails come in many shapes and sizes. To serve as effective safety devices, the handrail should be suitable for the descending person to easily slide their hand along the entire flight without interruption. It should be positioned away from the wall, and be shaped for easy gripping with a power grip. The preferred cross sections for power gripping are circular and oval shapes, with a horizontal diameter in the range of 38–50 mm (1.5–2 inches). The height of the handrail also needs consideration. Building codes typically specify or recommend a range for handrail heights. Since not all populations in the world have the same body size characteristics, the desirable range for handrail heights should consider the anthropometrics of the population.13 For example, building codes in the United States provide a range of acceptable handrail heights (30–34 inches or 76–86 mm). This range would not be ideal for the populations found in many other countries. Within the range of acceptable heights, a higher placement is better for recovering from a misstep. Many people do not distinguish between a stairway handrail and a stairway guardrail. A handrail is attached to a wall on one or both sides of a stairway. A stairway guardrail (also called a railing) is for an open side of a stairway with the primary function being protection from falling off the edge of the stairway. While the top rail can function as a handrail, the newer approach is to incorporate into the guardrail a separate handrail at the appropriate height. For workplaces, the standards for guardrail heights have been increasing in order to prevent persons from falling over the top rail. With these higher guardrails, worker may find the top rail feels awkward to use as a handrail during descent, especially the shorter workers. Many manufactured stairway guardrails are available with a top rail suited for fall protection and use by taller personnel, plus a lower rail suited for shorter people. This discussion would be incomplete without pointing out the danger of short flights. Specifically, a single step down often goes unnoticed. Flights of two steps also have that problem. When the walker steps off the upper level, expecting their heel to land at the same level, they are completely unprepared when the foot only finds air. They tumble face first to the floor. They may instinctively extend an arm and break their radius bone. They may hit their face or forehead on the floor. Sometimes, a walker approaching a single step from the lower level will not notice the step, and trip on it. Recommendations by leading experts are consistent with the risk-reduction strategies listed in the previous chapter. First, architects may find a way to eliminate the need for a change in floor level by, for example, building the lower floor up to the same level as the upper floor. Second, substituting a ramp may be feasible. This is an excellent example of substituting a lesser hazard for a greater hazard. A third option is help the workers perform safely by making the change in elevation highly visible by installing features easily visible at heights well above the floor. A pair of handrails is a good start. A ceiling slope corresponding to the ramp or stair slope is another visual cue. Different lighting or different wall colors may also aid recognition.

23.4 Ramps Ramps provide another means for people to transition between floor levels. Issues associated with ramps include person's falling while walking on a ramp, usability for people in wheelchairs, tripping on ramp edges, falling off the side of ramps, and operating forklift vehicles on ramps. Building codes provide design guidelines and standards. Persons falling while walking on a ramp occur most often during descent. One pattern is they unintentionally increase their walking speed to a point where they lose balance and tumble forward. Another pattern involves excessive slipping of the heel on contact with the floor. The slipping risk is

greater than walking on a level surface because of the angle the heel makes with the floor. The RCOF is greater, and may not be met. For that reason, guidelines and standards specify giving the ramp surface a course texture to achieve a high COF. Also, the RCOF increases as the steepness of the ramp increases. Guidelines may specify a maximum slope for ramps intended for walking, but guidelines for wheelchair use specify less slope. Thus, the architects need information about the expected users. Providing a handrail, like with stairways, is a tactic for aiding with recovery from a slip. People approaching a ramp from the side may not notice the rise near the bottom and trip on it. Therefore, making the lower part of the ramp highly visible when viewed from the side serves to help people avoid tripping. As the ramp rises, the potential fall distance gains importance. The usual safety device for this hazard is a guardrail along the open side of the ramp. A guardrail serves three safety purposes: it protects people from falling off the edge, it can serve as a handrail to aid people on both ascent and descent, and it provides visual cues of the ramp's existence to people walking near the ramp. Forklift vehicles using ramps encounter a balance issue. Operating with the load on the downhill side can cause the vehicle to tip forward, with the front tires serving as a fulcrum. The rear wheels rise up and lose contact with the ramp surface. Since steering occurs through the rear wheels, the operator loses directional control. Therefore, when descending a ramp while carrying a load, the safe practice is to operate with forks in the uphill direction. Thus, having operators back down the ramp is the safe practice. When ascending a ramp while carrying a load, the safe practice is also to drive with forks in the uphill direction. If the load obstructs the operator's view ahead, a spotter assists the operator. The various hazardous locations discussed above are working and walking surfaces that can be made safe for human use by using known risk-reduction strategies. The most common of these strategies is helping workers perform safely. We turn next to hazardous locations commonly known as “confined spaces.”

23.5 Confined Spaces The OSH community uses the term “confined space” to identify a class of locations for which special precautions are needed prior to entry. These locations are not intended for human occupancy, but may, infrequently, require a person to enter. Because many deaths have occurred in confined spaces, industrialized countries have regulations for confined space entry. Although these requirements vary somewhat in definitions of confined spaces and precautions required, their underlying goal is to prevent the sorts of fatal scenarios that killed workers in the past. As with other regulations, there will be some misinterpretations, misconceptions, and misapplications of the requirements (see paper by Taylor on the required precautions in the United States).14 A particularly troublesome scenario occurs when one member of a work crew enters a space, and collapses. A coworker sees what happened and enters the space with intent of a rescue.15 The second worker also collapses. There have been cases of a three or more repeats of this deadly sequence. The standards start by defining what is, and is not, a confined space. Definitions specify attributes of spaces included in the particular standard. Some attributes are the space (1) was not created for human occupancy; (2) has limited means of egress and ingress; and (3) lacks natural ventilation. Some definitions include an attribute about having a particular type of recognized hazard in the space. Some regulations define two categories of confined spaces based on level of threat to the entrant. This leads to a requirement to identify all spaces in a facility that fit the definition. Each space requires a sign

posted at the entrance identifying it as a confined space, stating no entry unless authorized, and indicating the means for obtaining authorization. For the more hazardous spaces, someone designated by the organization must issue a permit after making sure the organization's procedures will be followed before, during, and after the entry. Among the procedures are requirements that the personnel involved have completed appropriate training. The paper permit is posted outside the space so that anyone walking by can check to see if the entry is an authorized entry. Some common confined spaces are storage tanks, compartments of ships, process vessels, pits, silos, vats, wells, sewers, digesters, degreasers, reaction vessels, boilers, ventilation ducts, tunnels, underground utility vaults, and pipelines.15 The most commonly encountered conditions that make confined spaces hazardous are

Oxygen deficiency, Oxygen displacement (inert gases and simple asphyxiating substances), Flammable atmospheres, Toxic gases, Solvents, Engulfment, and Other physical hazards.

Some of the physical hazards in the last category warrant mention. The space may contain mechanical equipment or electrical connections that should be de-energized and locked out throughout the entry. The space may be connected to lines for material flow during normal operation. Before an entry, these connections need to be physically disconnected, blanked off, or emptied by procedures such as double blocking and bleeding out the material between the blocks. In spaces entered from above, there may be objects that could fall through the opening and hit the worker inside. There may be objects and surfaces hot enough to burn skin if touched. There may be moisture that could increase the hazards of electrical sources, and there may be a noise source in the space that gets amplified by reverberating off the walls in the space. People in confined spaces have died from lack of oxygen resulting in several scenarios. One is the original atmosphere in the space has inadequate oxygen to sustain life. A person enters the space and after some time starts to experience symptoms of oxygen deprivation, losing ability to climb out of the space, and collapsing. A second scenario for asphyxiation occurs after purging a space with an inert gas to prevent a fire. If a person enters the space while it contains mostly inert gas, the shortage of oxygen will lead to oxygen deprivation, and eventually to asphyxiation. A third scenario occurs in containers for storing loose materials, like grain or coal dust. A common fatal scenario with loose materials is a person in the space above the materials falls into the materials. With their head fully engulfed, they desperately gasp for air, only to have their lungs filled with the material. The fourth asphyxiation scenario involves confined spaces with a chute at the bottom. A person falls into the space, becomes trapped in the chute, and suffocates. Another fatal scenario in confined space is a fire or explosion. These occur in spaces normally used to store flammable material. If the task is to enter the space to perform cleaning or other maintenance, the first step is to empty the container of the flammable material. This inevitably leaves a residue of flammable vapors in the space. One procedure is to set up ventilation to pull the flammable vapors out while bringing fresh air in through another port. After terminating ventilation,

there may be some vapors in the space with a vapor concentration within the flammable range. Fires have resulted when a person enters space, starts the task, and somehow causes a spark. The person has almost no chance of escaping. In these applications today, it is standard practice to test the atmosphere in the space using a flammable gas meter before allowing anyone to enter. Supplementing the precautions of venting and testing for flammable vapors, the employer can equip the maintenance person with non-sparking tools. A fire will ignite only if all three precautions fail. Toxic atmospheres often occur in confined spaces. It is obviously preferred to avoid ever having a person enter a space contaminated with a toxic substance, but when it becomes necessary, providing the entrant with appropriate respiratory protection effectively separates their breathing zone from contaminated air inside the space. Appropriate breathing devices for entering confined spaces with unhealthy atmospheres are supplied air respirators and self-contained breathing apparatus. The primary tactics for preventing deaths in confined spaces start with training the entrant and the person who will be monitoring the work so that they will be able to properly perform the work and deal with unexpected deviations in the process. On the day of a confined space entry, precautions include preparing the space by implementing the precautionary practices specified in the company's confined space entry program, and completing the task as planned. An entry that goes according to plans is part of Haddon's pre-event phase. If something happens that jeopardized the entrant's safety, the during-event phase would start and continue until the person exits the space. Haddon's third phase involves first aid and transport to a medical facility. Further sources of information on confined spaces are readily available in OSH books, journals, and websites of governmental agencies in the applicable country. The next section addresses workplace conditions with dusty breathing air.

23.6 Dusty Air Numerous kinds of airborne dust have properties with potential for harming exposed people. The main concern with these small particles is their effects stemming from breathing the particles. Some small particles encountered in workplaces have a long history of causing lung diseases named to reflect the cause. Some well-known diseases and agents are silicosis and silica dust, asbestosis and asbestos, black lung and coal dust, and brown lung and cotton dust. Some kinds of dust are associated with, or causes of, occupational diseases with long latency periods. What happens after a particle enters the nose or mouth varies. Some small particles are trapped in the moist lining of the nose, mouth, throat, and windpipe (trachea). Some particles make it to the upper lungs only to get caught by the lining of the bronchus. Some of the smallest particles make it to the alveoli. Generally, the concentration of large particles reduces quickly in the upper passageways, mid-sized particles penetrate deeper before being caught, and the smallest particles reach the alveoli. This explains the recent fuss about nanoparticles because they are so small that they behave much like air contaminants in the gaseous state. Nanoparticles and gases distribute throughout the pulmonary system. Once the inhaled particle reaches a stopping place in a respiratory area, numerous things may occur. Most of the larger particulates get stopped in the mucus lining of the upper airways, and expelled through a natural defensive mechanism. Particulates not expelled may lodge permanently in narrower passageways of the lungs. The smallest particulates and gaseous chemicals have the best chance of reaching the alveoli. Once settled deep in the lungs, the particle may just remain there, taking up space formerly used for normal lung functioning, or it may increase in size due to a

physiological reaction to coat the foreign object with more material. With long-term exposure, thousands of small particles can accumulate, significantly decreasing the functional capacity of the lungs. Strategies for protecting workers from airborne particulates emphasize ventilation and use of respirators. It is hard to imagine a situation where eliminating the hazard or substituting a less hazardous dust would be feasible. Avoiding the release of the hazard (Strategy 2) is a feasible strategy exemplified by watering dirt roads and other work areas where dust can be blown into the breathing zone of workers. Buildings for industrial processes involving dust can be constructed so that personnel are separated from the dust (Strategy 5). Improving the resistance of that which needs protection (Strategy 6) is not a feasible option for employees, but it is feasible for coating surfaces of objects exposed to moving particulates. Many employers provide dust filtering respirators (Strategy 8) along with training for properly using and maintaining the respirators (Strategy 7). An example of the ninth strategy, expedite recovery, is to provide exposed workers with pulmonary function tests in order to detect early signs of reduced lung capacity. A finding of reduced capacity could trigger medical consultation to make a diagnosis and establish an appropriate course of action.

Learning Exercises 1. Explain in your own words the author's point about the role exposure plays when

assessing the importance of work floor surfaces being less than ideal. 2. Suppose in your workplace an employee slipped on a grease spot, fell, and injured her hip. A supervisor filled out an incident report in which the correction he recommended was that employees need to pay attention while walking. What could you say to educate the supervisor about the role of human expectations? 3. In the event tree shown in Figure 23.1, hypothetical probability values are provided for each intermediate event. Assume the initiating event occurs. What will be the computed probability values in the right column? 4. Summarize the obstacles in the way of developing a broadly acceptable standard for floor slipperiness. 5. Explain the author's suggestion to working around the obstacles. 6. What is the limitation in saying any crack in a floor surface with a difference in elevation of more than 10 mm is a hazard? 7. For stairways, explain what is meant by effective tread depth and effective tread height. 8. Explain why step uniformity is so important for stairways. 9. Why do many manufactured stairway guardrails have a built-in handrail instead of just letting the top of the guardrail serve the same purpose as the handrail? 10. If a facility has short flight of steps (one or two steps), what can be done to make it easily visible to employees approaching from above? 11. When a container normally used for a flammable liquid needs interior maintenance, the container is emptied and vented before allowing an employee to enter. Two precautions for fire protection are testing the vapor concentration prior to entry, and providing the employee with non-sparking tools. Use concepts from fault trees to explain why both precautions provide more safety than either alone.

Technical Terms Alveoli

Tiny sacs located at the ends of branches of the pulmonary system. Through the thin walls of the alveoli, chemicals are exchanged with nearby blood vessels—oxygen from inhaled air goes to the bloodstream, and carbon dioxide goes from the blood to the air in the alveoli where it is removed with exhaled air.

Coefficient of friction (COF)

A number between 0 and 1, reflecting the extent of friction of a surface and computed as the ratio of shear force to normal force. See Figure 23.3 for further explanation of force vectors involved.

Dust Solid particles of organic or inorganic materials formed by breaking down larger collections of the same matter such as coal, wood, and grain. Airborne dusts tend to settle out of calm air under the force of gravity.

Effective riser height

The difference in height between adjacent steps in a stairway, determined from the same points on the leading edge of each. See Figure 23.4.

Effective tread depth

The horizontal distance between adjacent steps in a stairway, determined from the same points on the leading edge of each. See Figure 23.4.

Particulate A small bit of solid or liquid matter. Aerosols and dusts are particulates. Required coefficient of friction (RCOF)

The COF needed to counteract the shear force of an object sliding on the surface. If the RCOF is greater than the shear force, the object will decelerate and come to a stop.

Stairway guardrail

A fall protection barrier located on the side of a stairway where a fall might occur. Secondary uses include functioning as a handrail and providing a visual cue to make people aware of the stairway.

Stairway handrails

A bar along the wall side of a stairway that benefits those who use it by giving them something to help pull themselves up the stairs, improving their sense of postural orientation, and giving the person who has a misstep a contact point to help recover rather than fall. A handrail also provides a visual cue that aids postural orientation.

Stumbling A type of misstep that occurs during locomotion. A stumble results from contact between the floor and the sole of the foot or shoe causing unexpected frictional resistance to the forward motion. The stumble event may lead to recovery or a forward fall.

References

1. Chambers AJ, Margerum S, Redfern MS, Cham R. Kinematics of the foot during slips. Occupational Ergonomics. 2002/2003; 3: 225–234. 2. Redfern MS, Cham R, Gielo-Perczak K, Grönqvist, R, Hirvonen M, Lanshammar H, et al. Biomechanics of slips. Ergonomics. 2001; 44: 1138–1166. 3. Bakken GM, Cohen HH, Abele JR, Hyde AS, LaRue CA. Slips, trips, missteps and their consequences, 2nd ed. Tucson, AZ: Lawyers & Judges Publishing; 2007. p. 5–24. 4. Hyde AS. Fall injuries. In: Bakken GM, Cohen HH, Abele JR, Hyde AS, LaRue CA, editors. Slips, trips, missteps and their consequences, 2nd ed. Tucson, AZ: Lawyers & Judges Publishing; 2007. p. 127–132. 5. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 139–142. 6. Bakken GM, Cohen HH, Abele JR, Hyde AS, LaRue CA. Slips, trips, missteps and their consequences, 2nd ed. Tucson, AZ: Lawyers & Judges Publishing; 2007. p. 24–27. 7. ASTM F2508-11. Standard practice for validation and calibration of walkway tribometers using reference surfaces. Available at http://www.astm.org/Standards/F2508.htm. 8. Di Pella S. Slip, trip, and fall prevention: A practical handbook, 2nd ed. Boca Raton, FL: CRC; 2010. p. 1–2. 9. Bakken GM, Cohen HH, Abele JR, Hyde AS, LaRue CA. Slips, trips, missteps and their consequences, 2nd ed. Tucson, AZ: Lawyers & Judges Publishing; 2007. p. 34–36.

10. Templer JA, Mullet GM, Archea J, Margulis ST. An analysis of the behavior of stair users (NBSIR 78-1554). Gaithersburg, MD: National Bureau of Standards (now National Institute of Standards and Technology); 1978. 11. Cohen J, LaRue CA, Cohen HH. Stairway falls: An ergonomics analysis of 80 cases. Professional Safety. 2009; 54(1): 27–32. 12. Archea J, Collins B, Stahl F. Guidelines for stair safety (NBS Building Science Series 120). Gaithersburg, MD: National Bureau of Standards (now National Institute of Standards and Technology); 1979. 13. Kroemer KHE. Fitting the human: An introduction to ergonomics, 6th ed. Boca Raton, FL: CRC; 2008. p. 3–30. 14. Taylor B. Confined spaces: Common misconceptions & errors in complying with OSHA's standard. Professional Safety. 2011; 56(7): 42–46. 15. Pettit TA, Braddee R. Overview of confined-space hazards. In: Worker deaths in confined spaces. DHEW (NIOSH) No. 94-103. Cincinnati, OH: National Institute for Occupational Safety and Health; 1994. p. 5–10.

Chapter 24

Chemical Substances

Chemicals encountered in workplaces make many processes possible, and chemicals encountered outside of work make modern society possible. These, and many other beneficial uses of chemicals, are not without risks. Textbooks, reference books, websites, and scientific literature provide abundant information on chemicals. This chapter begins with a brief review of chemicals found in many workplaces, followed by a summary of the mechanisms of harm to workers, and ends with examples of strategies for limiting exposures.

24.1 Major Categories of Chemicals Encountered at Work The summaries in this section group chemicals into categories familiar to the OSH professionals. Some of these groups are based on similarity of use (e.g., solvents and pesticides), one by state of the compound (fumes from molten metal), and several by similarity of health effects. Industrial solvents like turpentine and mineral spirits function effectively to dissolve unwanted materials such as adhesives, cleaning fluids, paints, and glues. The OSH community is particularly concerned with the health effects and flammability of industrial solvents. Pesticides are compounds for killing pests, and to perform that function, pesticides must have poisonous properties. The toxicity levels for humans range from too toxic for use to low enough to be approved for selling to consumers without restrictions. The role of OSH professionals is to champion processes for minimizing risks for employees involved in the manufacturing, distribution, and application of pesticides. Metals and metal compounds make up endless solid items like vessels, motors, mechanical energy

transmission components, industrial machines, and heavy equipment. A major concern to OSH professionals is worker exposure to the fumes emitted from metals in the molten states such as during welding, ore processing, and metal production. Asphyxiants harm by interfering with the essential function of supplying oxygen to various body parts. The basic process of breathing involves inhaling fresh air, extracting oxygen from it, and giving up carbon dioxide with the exhaled air. Chemicals that change the natural breathing process create problems. Normal fresh air is approximately 79% nitrogen, 21% oxygen, and very small amounts of other gases. Inhaled air with significant concentrations of carbon monoxide or carbon dioxide can alter the normal breathing process by reducing the supply of oxygen to organs and tissues. Some other well-known asphyxiants that interfere with normal breathing include cyanide gas, which prevents cells from using oxygen; nitrous oxide, which impairs the usual process of lungs to expel contaminants; and inert gases used to fill a space for fire prevention, which makes the space unacceptable for human respiration. Corrosive substances react with and damage human skin as well as man-made materials. Two large groups of corrosive chemicals are acids and bases. Common acids are acetic acid, hydrochloric acid, nitric acid, chromic acid, hydrofluoric acid, perchloric acid, sulfuric acid, and fuming sulfuric acid.1 Common bases are potassium hydroxide, sodium hydroxide, aluminum chloride, bromine, phosphorus trichloride, potassium bifluoride, sodium hypochlorite, and zinc chloride.1 Irritants are chemicals that irritate tissue by direct contact, causing an inflammatory response. The most common occupational exposures occur by inhalation of air containing irritant chemicals. Common irritants that affect the mouth, throat, and lungs are acetic acid, acrolein, formaldehyde, and formic acid.1 Common eye irritants are ammonia, alkaline dusts and mists, hydrogen chloride, hydrogen fluoride, halogens, nitrogen dioxide, ozone, phosgene, and phosphorus chloride.1 Neurotoxic chemicals adversely affect the nervous system. Exposures can interfere with normal functions of the central nervous system, efferent nerves, peripheral nerves, and sensory organs. Some neurotoxins are methyl mercury, carbon disulfide, manganese, organic phosphorus insecticides, and tetraethyl lead.1 Oxidizing chemicals are capable of producing oxygen by spontaneously reacting with organic or combustible materials in environments with no more heat than ordinary room temperature. By producing oxygen, these reactions can contribute to fires and explosions. A few examples of oxidizing agents are perchloric acid, chromic acid, and inorganic peroxides. Three chemical classifications defined by health effects—carcinogens, mutagens, and teratogens— warrant special attention. Carcinogens increase risk of cancer, mutagens increase risk of genetic mutations, and teratogens increase risk of birth defects in the offspring of those exposed. The scientific evidence for classifying a chemical into one or more of these categories comes from both epidemiological studies of humans and laboratory studies of mice and other laboratory animals. Standardization bodies examine the strength of this evidence and assign chemicals to categories such as “known” and “suspected” carcinogens, mutagens, or teratogens. As might be imagined, different committees of experts, looking at the same evidence, may disagree on which category to assign a particular chemical. Fuels for fires and explosions consist of one or more chemicals. These materials are hazards because of their potential to be transformed from a state of potential energy to a fire capable of causing harmful consequences. In this book, separate chapters discuss fires and explosions. This chapter addresses only health effects of exposure to fuels.

24.2 Mechanisms of Harming The effects of chemical agents are complex because effects are chemical specific, organ specific, dose related, and affected by duration of influence on the organ. Specialists in the field of industrial toxicology are continuously contributing new knowledge to our understanding of the diverse combinations of chemicals, organs, and effects. The brief overview in this section provides a foundation for readers not already familiar with industrial hygiene. Chemicals can harm the environment through emissions into the air, water, or soil. Chemicals in the air or water can slowly corrode metal structures and vessels through the process of rusting. Chemicals can harm people by entering the body through any of three routes—inhalation, ingestion, or absorption through the skin. The route most commonly encountered in industrial workplaces is inhalation—the route through the mouth, throat, and lungs. Contaminants in gaseous state flow like the rest of the inhaled and exhaled air. Chemical contaminants in particulate form follow different patterns, largely determined by size but also influenced by other attributes. Some particles are trapped in the moist lining of the nose, mouth, throat, and windpipe (trachea). Some particles make it to the upper lungs only to be caught by the lining of the bronchus. Some of the smallest particles make it to the alveoli. Generally, the large particles penetrate least, mid-sized particles extend deeper into the lungs, and the smallest particles, including nanoparticles, reach the alveoli. In the alveoli, particulates may break down into their constituent chemicals. The chemicals in the deep lungs may diffuse across the alveoli walls, enter the bloodstream, and distribute throughout the body. The ingestion route for chemicals starts with entry into the body. A common mechanism is purposefully eating food, drinking liquids, or taking oral drugs (lawfully prescribed or illegally obtained). Any of these ingested materials may have chemical contaminants. Inadvertent ingestion mechanism involves the person's hands transferring chemicals to food prior to consumption, and chemicals introduced to the mouth by contaminated hands touching the lips. Eating food containing potentially toxic properties is a common mechanism of ingestion. Consuming spoiled food can introduce biological agents that release harmful chemicals in the digestive tract. On rare occasions, a person may ingest food or drink another person (acting criminally) deliberately contaminated with a harmful chemical. The third route of entry is by direct contact with the skin, eyes, or other exposed body parts. Skin contact by some chemicals leads to dermatitis (e.g., alkalis, acids, vapors, and irritant gases). A subset of the direct contact cases comes from employees becoming sensitized during their work around the chemical. Occupational dermatitis cases make up about half of the workers' compensation claims for compensable diseases. Eye contact with some chemicals causes symptoms such as irritation, red eye, and watering of the eyes. Industrial solvents can harm by their inherent property of being able to dissolve other substances and materials. Inhalation and direct skin contact are the common routes of entry. Physiological effects vary considerably, depending on the specific solvents and extent of exposure. Metals and metal compounds in a molten state produce fumes that workers may inhale. Depending on the exposure dose, health of the individual, and composition of the fumes, symptoms of certain diseases can develop. Many welders have developed a set of symptoms known as metal fume fever. These symptoms include fever, headache, cough, and a metallic taste.1 For many welders working a traditional workweek, their symptoms are most intense on Monday mornings. The theory is they have some immunity to welding fumes that reduces over the weekend, so on Monday morning, they feel the effects, but soon reenergize their immunity and work the remainder of the week without being

bothered. The immunity theory applies only to the acute symptoms mentioned. There is no reason to think this immunity provides any protection from the effects of long-term exposure to metal fumes. Some metal fumes have been causally linked to particular diseases, for example, copper fumes being linked to Wilson's disease and Indian childhood cirrhosis.1 Exposures to some metal fumes have been linked to cancer. Inhalation of metal fumes occurs regularly when welding without respiratory protection. The fumes are the result of molten metal giving off metallic vapor in gas form that regroup into tiny droplets of liquid metal and start to descend. Other chemicals are often part of the fumes. Welding fumes are primarily metals, but the fumes can contain other chemicals such as those from the coating material coming off the welded surface. Pesticides come in numerous forms—some with much more harmful effects on humans than others. Several of the pesticides, with sufficient dosage, can interfere with a critical neurotransmitter chemical acetylcholine. And some, especially the organochlorine pesticides, have been banned from use because their persistent chemical makeup would, if usage continued, lead to ever-increasing concentrations in the groundwater, lakes, seas, and oceans. The water concentrations are picked up by the fish, and may end up on the human dinner plate. Ingestion of some of these chemicals may increase risk of cancer. Employees engaged in the manufacture and transportation of pesticides, as well as the agricultural workers, are potentially exposed.

24.3 Strategies and Tactics for Workplace Chemicals The strategies for reducing risk with chemicals are listed in the left column of Table 24.1. On the right are major groups of applicable tactics. Table 24.1 Strategies and Tactics for Reducing the Risks from Workplace Exposures to Chemicals. Risk-reduction strategy Risk-reduction tactics 1. Eliminate the hazard Eliminate the hazardous chemical from the workplace 2. Moderate the hazard 2a. Substitute a less hazardous chemical

2b. Reduce the amount of the chemical 2c. Reduce the concentration of the chemical

3. Avoid releasing the hazard Enclose the chemical in a container that prevents any release 4. Modify release of the hazard

4a. Use local ventilation to control any released substance

4b. Direct airflow to take process emissions away from breathing zone of workers 5. Separate the hazard from that needing protection

5a. House processes with hazardous chemicals in separate structures from those used by personnel

5b. Use building walls to separate hazardous chemical locations from rooms used by personnel 6. Improve the resistance of that needing protection

6a. Apply protective coatings on materials used for equipment, tools, products, etc.

6b. Apply protective ointments to skin prior to possible exposure to dermatitis-producing chemicals 7. Help people perform safely 7a. Instruct employees on safe procedures for working with or near hazardous chemicals

7b. In rooms with hazardous chemicals, provide written material describing the hazardous properties of those chemicals 7c. On chemical containers, provide warning labels with information for safe handling. To be effective, the text and symbols should fit the exposed population 7d. Provide people with information about appropriate practices for avoiding ingestion of hazardous chemicals

8. Use personal protective 8a. Provide and use whole-body protection by enclosing personnel in protective ensemble appropriate

equipment for the exposure conditions 8b. Provide and use respiratory protection appropriate for the conditions. 8c. Provide and use skin protection with a wearable chemical barrier such as chemical protective gloves 8d. Administer a PPE program to ensure effective use of the PPE provided

9. Expedite recovery 9a. Provide safety showers and eyewash stations in appropriate locations 9b. Include in first-aid courses instruction on procedures for responding to personnel who contact hazardous chemicals through ingestion, inhalation, or direct skin contact 9c. Provide the phone number for a poison control center in rooms where hazardous chemicals are used

The first strategy is to eliminate the hazard. This strategy applies to the full range of system levels. At the workstations level, there are opportunities to remove hazardous chemicals by storing in other areas. At the facility level, this strategy applies to both stored chemicals and in-process chemicals. During plant design, or subsequent process modification, consider options for not having particular hazardous chemicals within the facility. This may necessitate having other firms perform the processes involving those chemicals. Although this solution carries ethical baggage, the outsourcing approach eliminates the hazardous chemical from one facility. At a broader system level, there may be opportunities for a large national or international organization to ban use of a particular chemical. This has occurred with certain pesticides. Reducing the amount of a highly hazardous chemical on-site provides a feasible option. According to Baasel, the Union Carbide plant in Bhopal had three 15-metric ton storage tanks for methyl isocyanate.2 Would it have been feasible to reduce that amount through process design? Apparently, Mitsubishi Chemical Industries had a similar plant in Japan that did not store any methyl isocyanate on-site. They also produced the chemical in an intermediate step, but afterward it went immediately into the next production process. Thus, there was no need to store any of the highly hazardous chemical. The third strategy—avoid releasing the hazard—involves providing containers for chemicals that do not leak under normal conditions or during foreseeable abnormal conditions. Many opportunities for leaks and spills occur during transit. Mechanisms in modern rail tank cars and highway tankers provide multiple barriers, so a release will occur only if more than one protective mechanism fails. The fourth strategy is to modify release of the hazard. If small amounts of a chemical enter a room, local and facility ventilation may be sufficient to control the concentration of chemicals in the workplace air. In pressure vessels, the use of a pressure-relief valve serves the function of modifying release of the stored chemical by emitting small amounts when the internal pressure exceeds the set point of the device. The fifth strategy is to separate the hazard from that which needs protection. An approach widely used in the chemical industry is to protect populated communities by locating chemical plants in unpopulated sites. This requires a means of avoiding nearby property from becoming populated after the plant becomes operational. For example, the Union Carbide plant in Bhopal started in a low- population area, but after starting operations, many employees moved their families into housing close to the plant.2 This is one reason chemical plants tend to be located in industrial parks that have large areas set aside for industrial purposes, and the local government prohibits housing within the park. Similarly, within an industrial site, the processes and storage areas with hazardous chemicals may be located away from other structures. Limited options are available for improving the resistance of that which needs protection (Strategy 6). Materials used for consumer products and industrial operations are usually coated to improve appearance and to protect the material from foreseeable damage (e.g., dings and corrosion). Another application of this strategy is having workers apply protective ointments on skin to protect themselves

from dermatitis-producing chemicals and biological agents such as poison ivy. The seventh strategy is to help people perform safely. The four tactics listed in Table 24.1 involve the usual practices for hazardous materials management such as providing material safety data sheets, labeling containers, and instructing workers on precautionary practices. The eighth strategy is to use personal protective equipment. Common types of chemical PPE are respirators, full-body protective suites, and gloves. When these protective devices are used, the employer needs a program to assure proper use and maintenance of the equipment. The ninth strategy is to expedite recovery. Three tactics listed in Table 24.1 are common in workplaces. Providing safety showers and eyewash stations contributes much to the capability for limiting harm from inadvertent chemical contact. Similarly, having personnel trained in proper first aid for victims of chemical contact and ingestion can be a life saver. It is also common to post the phone number of an organization with specialized information about poisons and first-aid procedures for those poisoned.

Learning Exercises 1. Chemicals may be classified according to several attributes. For classifications based on

health effects, what are the chemical categories mentioned in Section 24.1? 2.Chemicals may enter the human body through three routes. What are the three routes? 3.Table 24.1 lists the nine risk-reduction strategies and various tactics applicable to each strategy. Can you think of a tactic not on the list?

Technical Terms Alveoli

Tiny sacs at the ends of branches of the pulmonary system. Through the thin walls of the alveoli, chemicals are exchanged with nearby blood vessels. The normal and healthy chemical exchange is oxygen from inhaled air goes to the bloodstream, and carbon dioxide goes from the blood to the air in the alveoli where it is removed with exhaled air.

Asphyxiants Various chemicals that disturb the maintenance of adequate oxygen supply to different systems in the body.1 Carbon dioxide exemplifies a simple asphyxiant; it reduces the oxygen getting to the lungs. Carbon monoxide is the most common chemical asphyxiant; it reduces the essential exchange and transportation of oxygen by chemically modifying the normal oxygen-carrying capacity of the hemoglobin.

Asphyxiate To kill or make unconscious by inadequate oxygen, presence of noxious agents, or other obstruction to normal breathing.3

Occupational dermatitis

Inflammation of the skin caused or induced by a work-related exposure.

Suffocate To stop respiration or deprive of oxygen. Also to die from being unable to breathe.3

References

1. Dikshith TSS. Safe use of chemicals: A practical guide. Boca Raton, FL: CRC; 2009. 2. Baasel WD. Preliminary chemical engineering plant design, 2nd ed. London: Van Nostrand Reinhold International; 1990. p. 94. 3. Merriam Webster's Collegiate Dictionary, 10th ed. Springfield, MA: Merriam-Webster; 1995.

Chapter 25

Biological Agents

This chapter addresses several sources of harm from biological agents. These include plants, pets, livestock, wild animals, insects, mold, and blood-borne pathogens. As in other chapters, the discussion focuses on the occupational health and safety issues, and does not attempt to be exhaustive. The chapter organization is according to the source. For each source, the discussion includes a brief explanation of the hazard, those exposed, the mechanisms of harming, and some basic strategies and tactics for reducing risks.

25.1 Plants The plants considered hazards to workers are those encountered by people working outdoors. These will vary in different regions of the world. In North America we encounter poison ivy, poison sumac, and poison oak. Examples of those exposed are tree trimmers, landscapers, gardeners, wildland firefighters, and people clearing vegetation for utility lines. The plants mentioned above are inappropriately named “poisonous.” A better term would be “allergenic” plants because their effect is an allergic reaction. Like many allergenic substances, people vary in their sensitivity. The extent of exposure also affects the allergic response. Touching the leaves with bare skin evokes the strongest response. Allowing the allergic substance to contact an open wound may increase the chance of a severe reaction spread over greater areas of skin. Getting the allergenic substance on clothing can extend the potential exposures from the outdoors into the home. Touching the affected clothing can transmit the substance to anyone who handles the clothing. Reactions vary from plant to plant, but tend to involve itchy skin followed by development of blisters. In locations with known allergenic plants, and regular access by people, the possibility of using Strategy 1 is worth considering. Eliminating some of these plants is not a trivial task. The effort involves exposing personnel to the plants, using chemicals that can harm other plants, and there is no assurance of long-term success. In public parks and preserves, there will be objections to disrupting the natural ecology of plant life. Discussions with experts on local plant life and various stakeholders are essential steps in the decision process. Thus, Strategy 1 may be an option to consider, but doing background research is advisable prior to making a final decision to attempt elimination. The primary prevention approach is Strategy 5—keep skin and clothing separated from the plants. This requires that people have the ability to recognize the allergenic plants, pay attention while in vegetated areas, and avoid getting close. For employers of personnel potentially exposed, this starts with employee education to enable personnel to recognize the plants and know the precautionary practices they should take. Secondary prevention (Strategy 9) involves promptly and thoroughly washing any skin that may have contacted the plants. Washing with common hand soap and water is generally effective, but special washing products on the market may be more effective. Minimizing the handling of clothing that may have picked up some allergenic substances can avoid releasing the hazard from the affected material to other skin areas, as well as to the skin of other individuals (Strategy 3). It is best for the person who wore the clothing to take it directly to a washing machine,

start the wash, and take a shower to remove any small traces of residue from skin that may have been missed by direct washing.

25.2 Pets Domestic pets like dogs can be hazards to delivery personnel. Postal delivery personnel in the United States will deliver mail to mailboxes on porches of individual houses. Sometimes pet dogs can be very aggressive toward these letter carriers as well as other visitors. Pets other than dogs can also pose a threat to delivery personnel and visitors, but these are far less common than dogs. When bit by a dog, the treatment generally involves an unpleasant series of rabies shots. For homes with a dog kept in a yard, the owner may put their mailbox outside the fenced area to allow the letter carrier to keep separated from the dog (Strategy 5). Owners may also use Strategy 4 (avoid releasing the hazard) by keeping the pet indoors during delivery hours, chaining the dog up to prevent reaching the letter carrier, and keeping the pet in a fenced area away from the path used by the letter carrier.

25.3 Livestock Livestock on farms and ranches can be hazardous to personnel. People can suffer harm from mules kicking, herded animals trampling, goats biting, and camels spitting. The domesticated elephants in India can crush people against structures or underneath their great weight. People can catch several diseases from livestock.1 Anthrax is one of the diseases caused by the zoonotic pathogens. Workers at risk include those who work with animals such as veterinarians, ranchers, and farmers. Other workers are exposed during processing of animal products (hides, wool, and meat) including leather workers, butchers, wool workers, and even those working on wool carpets. Droppings from chickens and other birds are recognized as causes of histoplasmosis and ornithosis. The basic approach for reducing risk to humans working around livestock is separating the animals from the humans as much as feasible (Strategy 5). Containing livestock in a pen, coop, or fenced area is a means of separating the livestock areas from people areas.

25.4 Wild Animals People performing work in rural areas occasionally encounter wild animals with capability to harm. Some of this work involves land and game management, surveying, and ranching. Hunting and fishing guides sometimes run into dangerous animals. Workers in public parks, zoos, and wild animal preserves routinely interact with the protected animals. Oil workers and other personnel working in the arctic regions encounter rabies-infected arctic foxes. Professional divers occasionally encounter sharks, electric eels, and various other aquatic life forms. Through years of experience, and unfortunate incidents, people have developed guidance for reducing risks. It is not the place of this book to attempt to provide specific precautions for every species of animal in every corner of the world. Local wildlife agencies make precautionary information available for those who may need the information. The fundamental approach involves Strategy 5—separate the wild animals from the people. This requires individuals to use appropriate

precautionary behaviors to respect the space around animal habitats. This may be complemented by efforts by wildlife and park personnel to discourage the most dangerous animals from locations commonly used by people. For example, bears can become habituated to raiding campgrounds for easy food left accessible by campers. Campsite managers work at getting campers to store food in a manner that does not attract bears. Getting all the campers to comply is more challenging than OSH staff trying to get all employees to comply with all work rules. In order to encourage compliance, campsite managers have found ways to make it easier for campers to dispose of food waste, limit aromas that attract bears, and store food appropriately (Strategy 7—help people perform safely). Numerous species of snakes are poisonous. Of the many species, some well-known ones are the black mamba and saw-scaled vipers of Africa, the tiger snake of Australia, the rattlesnake of North America, and the Indian cobra of southern Asia. The strategy most suited for poisonous snakes is keeping people separated from the snakes (Strategy 5). Outdoor workers often encounter bees, wasps, hornet, spiders, and other pests. Scorpions are found in many regions of the world. Spiders are found almost everywhere. Mosquitoes are both nuisances and vectors for disease. Useful information about the hazards presented and precautionary practices may be found on website of reputable governmental agencies in countries throughout the world. The agencies most likely to provide information on local insects are those involved in public health or agriculture. The NIOSH website (www.cdc.gov/niosh/topics), for example, has concise papers on the following topics: poisonous plants, venomous snakes, venomous spiders, West Nile virus, Lyme disease, tick-borne disease, fire ants, scorpions, bees, wasps, and hornets. The principal strategy for reducing risk is Strategy 7—help people perform safely. This involves training personnel on three topics: (1) to recognize the animals likely encountered in the area, (2) to know appropriate precautionary practices, and (3) to know procedures for responding after being stung, bitten, or hurt in other ways.

25.5 Mold Mold has received considerable public attention in recent years. It is a concern in homes and workplaces due to people reporting symptoms they believe are caused by exposure to mold. Mold is a fungal growth existing both indoors and outdoors. The mold itself is not toxic, but some types produce toxins (mycotoxins) that affect some people. Mold is a topic for which conflicting information is readily available. Readers are advised to question information based on the experiences of individuals who feel mold exposure caused them to suffer. This anecdotal information lacks scientific reliability. Better sources are found on the websites of governmental public health agencies. One is the NIOSH website (www.cdc.gov/niosh/topics) containing links to brief articles on several topics, including one on mold. For occupational exposures, indoor mold is the primary concern. Mold tends to grow in moist, poorly ventilated places. Thus, logical approaches for reducing structural damage and mycotoxin production start with getting rid of the mold. Strategy 1 calls for eliminating the source of the hazard. Eliminating mold starts with eliminating the source of the moisture and getting rid of carpet and building materials already infiltrated by mold. Mold on hard surface materials can be removed by washing with household cleaners or a mixture of bleach and water. In areas inherently moist from climate or local water, the use of a dehumidifier and/or extra ventilation can moderate the growth of mold and concentration of mycotoxins (Strategy 2). When employees report symptoms related to dampness and mold, Strategy 9 applies. The

information found on the NIOSH website describes applicable symptoms for two conditions: (1) allergic responses, and (2) a type of lung inflammation known as hypersensitivity pneumonitis. NIOSH advises having symptomatic individuals examined by a physician for proper diagnosis and treatment. The treatment might include restrictions on working in locations known for the presence of mold.

25.6 Pathogens Bacteria, viruses, and other pathogens present people with risks of numerous diseases. This section focuses on occupational concerns with pathogenic diseases associated with blood, with limited comments on other biological agent concerns. Some occupational diseases result from microorganisms transmitted in blood. Well-known diseases from “blood-borne pathogens” are hepatitis B, hepatitis C, and human immunodeficiency virus (HIV). Hepatitis B produces varied symptoms that may eventually manifest as liver cancer, cirrhosis of the liver, and chronic hepatitis. Hepatitis C infection leads to chronic liver disease. HIV greatly reduces immunity to various diseases. Workers most commonly exposed to human blood as part of their job include healthcare workers, laboratory workers, and first responders. Healthcare workers get exposed to blood in several ways. The common ones are through needlesticks or cuts from sharp instruments containing the blood of a patient. During surgery, the exchange of sharp surgical instruments between surgeons and surgical nurses occasionally results in cuts. Exposures also come from contact with any bodily fluid from an infected patient. Historically, the trash in medical facilities contained some used needles and other “sharps” with blood. Janitors were at risk of blood exposure from being stuck while collecting the trash. Fortunately, most exposures to contaminated blood do not result in infection. Various non-job exposures include needle sharing among drug users, having unprotected sex, and patients getting transfusions of infected blood. Since these various means of transmission involve human behavior, people need information they can believe and translate into action (Strategy 7). An interesting experience during the early days of HIV provides some insight that OSH professionals can use for employee training. In the early 1980s, public health surveillance systems identified some new clusters of unusual cases that became known as acquired immunodeficiency syndrome (AIDS). The initial case clusters involved male homosexuals, leading to the general public impression that it was a disease confined to those who engaged in male-to-male sex. That public impression created difficulties for healthcare workers who acquired the disease. As public health surveillance reports began to show that the disease could be acquired by anyone, and research determined the transmission could be through any exchange of bodily fluid, not just sexual contact among homosexual men, the public needed some convincing. The U.S. Surgeon General, C. Everett Koop, saw the need to educate the public on what the public health community actually knew about AIDS.2 In 1986, he wrote a 26-page report, in plain language, explaining the new epidemic, the means of transmission, the effects, and advice for reducing further spread of the disease. It was widely distributed. However, feedback indicated a great many people formed opinions about the contents without actually reading the full report. In particular, many moral idealists objected to having a government report talk about using condoms and providing sex education in elementary schools. This group included the White House staff under President Ronald Reagan. In spite of White House objections, Dr. Koop wrote a much shorter letter he hoped would be read by a larger portion of the public. Congress authorized a budget for mailing the letter to all households in the country. The authorization bill made clear the letter need only be approved by

authorities in the Department of Health and Human Services (not the White House).2 In early 1988, the letter was mailed to over 100 million households. The public response was generally positive, and negative feedback was remarkably limited. What can OSH professionals learn from this? When preparing employee training on topics with some potentially moral or religious implications, begin the course with the message that the course content is based on scientific evidence and best practices. Early in the course establish your credibility by presenting material that cannot be refuted. Inform trainees of the sources for your material, and explain that these sources can be trusted. Risk reduction involves the first and third Haddon phases. Primary prevention for healthcare workers involves several practices known as standard precautions in health care.3 These precautions emphasize hand hygiene for all, and use of PPE whenever a risk assessment indicates a possible exposure to body substances or contaminated surfaces. The PPE options include clean nonsterile gloves, clean nonsterile fluid-resistant gown, and mask and eye protection or a face shield. Respiratory hygiene and cough etiquette make a third component of the standard precautions in health care. Following these precautions contributes to the safety of healthcare workers and the patients. In addition to these valuable administrative practices, some engineering strategies also help with pathogen control. A basic precaution is handling needles and other sharps using risk-minimizing techniques. For example, past practices revealed that many of the employee needlesticks occurred when trying to place a cap on the needle before disposing of it. Modern healthcare facilities have eliminated capping (Strategy 1) by having personnel put the used, uncapped needles directly into a sharps disposal container located in rooms where needles are used. Some new designs for syringes make it easy to withdraw the needle into the syringe body without exposing the hands to the needle.4 This Strategy 5 approach separates the hazard from the person. Protection of janitors also uses Strategy 5 in that the walls of the sharps containers provide a puncture-proof barrier between the used sharps and the hands of the person who collects the containers. The standard precaution requires caregivers to wear appropriate PPE (Strategy 8) that serves as a personalized shield between themselves and the blood of the patient. Medical facilities provide or arrange the hepatitis B immunization of employees who might be exposed to patient blood. Immunization illustrates use of Strategy 6—improve the resistance of that which needs protection. Once a healthcare provider becomes aware of being stuck by a needle, or otherwise exposed, there are procedures to follow. A reporting system is invaluable for knowing about the exposure. In case the person develops one of the diseases, the report will serve as documentation that the exposure occurred at work. This Strategy 9 tactic offers some value for those exposed to blood-borne pathogens. For hepatitis B, previously unvaccinated individuals can be treated effectively with the vaccination protocol. For HIV, there are treatment regimes available. The effectiveness of these regimes has increased substantially since the early days of the HIV epidemic in the 1980s and new developments are continuing. Storing biological agents in biological safety cabinets avoids releasing the hazard (Strategy 3). Laboratory facilities for research on especially dangerous biological materials are operated throughout the world and classified into four levels based on their capabilities to contain these materials. A major strategy for these facilities is the use of containment zones. These zoned areas (some being separate buildings) have various features including independent ventilation systems. Access to zones is limited to those with proper training and a need for access. The Level 4 facilities are for biological hazards with potential for extremely severe effects (e.g., mass epidemics). For medical laboratories, research facilities, and some production facilities, personnel need to

work with pathogens or other biological materials with potential to cause disease. If a biohazard cannot be eliminated, it may be feasible to contain it in specially built enclosures (Strategy 3). Another approach is to provide equipment such as robots and remote manipulators to help personnel get their work done while being separated from the hazardous biological agent (Strategy 5). Table 25.1 summarizes risk-reduction strategies and tactics for personnel working around pathogens and other biological agents. Table 25.1 Strategies and Tactics for Protecting Healthcare Personnel from Pathogens. Risk-reduction strategy Risk-reduction tactics 1. Eliminate the hazard Eliminate tasks of recapping used syringe needles 2. Moderate the hazard Not applicable 3. Avoid releasing the hazard 3a. Design pathogen research labs with distinct containment zones

3b. Use robots or remote manipulators to work with dangerous biological materials 4. Modify release of the hazard 4a. Use the standard precautions for health care to reduce spread of biological agents

4b. Release pathogens by flowing through a filter containing a pathogen-killing substance

5. Separate the hazard from that needing protection

5a. Dispose of sharps in special containers

5b. Collect sharps in sharps containers 6. Improve the resistance of that needing protection

Vaccinate healthcare employees for hepatitis B virus

7. Help people perform safely 7a. Place sharps disposal containers where most convenient for easy disposal after use 7b. Mark all biohazard containers with biohazard symbols and text as appropriate 7c. Provide training for personnel potentially exposed

8. Use personal protective equipment Use PPE to shield workers from blood of patients

9. Expedite recovery 9a. For hepatitis B patients not already immunized, put them through the immunization process 9b. For HIV patients, follow an evidence-based treatment protocol

Learning Exercises 1. For contact with allergenic plants, how would you draw the line between the during-event

and post-event phases? 2. Regarding pets, dogs are mentioned in the chapter. Identify another species of pet that may present personal risks for humans. 3. What types of venomous snakes are discussed on the NIOSH website? 4. In many worksites, when a worker has a small scratch or cut, they visit the OSH representative for first aid. If you are the OSH person, what words would you say to explain why you put on surgical gloves before cleaning and patching the wound? 5. Find the nearest biosafety Level 4 facility to your location. One place to look is on the following web page: www.answers.com/topic/biosafety-level.

Technical Terms Pathogen An agent of disease. The term usually refers to infectious organisms such as viruses, bacteria, and fungi. Standard precautions in A set of precautionary practices meant to reduce the risk of transmission of blood-borne and other pathogens

health care from both recognized and unrecognized sources.3

Zoonotic pathogens Pathogens that transmit communicable disease from animals to humans.

References

1. Brauer RL. Safety and health for engineers, 2nd ed. Hoboken, NJ: Wiley; 2006. p. 483–493. 2. Koop CE. Koop: The memoirs of America's family doctor. New York: Random House; 1991. p. 193–239. 3. World Health, Organization., Standard precautions in healthcare. Available at http://www.who.int/csr/resources/publications/standardprecautions/en. 4. Goetsch DL. Occupational safety and health for technologists, engineers, and managers. Upper Saddle River, NJ: Prentice Hall; 2011. p. 549–550.

Chapter 26

Musculoskeletal Stressors

26.1 Background This chapter addresses those musculoskeletal stressors of greatest concern to OSH professionals. To get started, a general concept needs explanation. Human physical activities might be characterized as lying on a continuum from completely inactive to intensely active. Health is related to level of physical activity as follows. The very sedentary life leads to reduced cardiorespiratory capacity, poorly toned muscles, and weight gain. In combination, these effects accelerate aging and shorten life. In contrast, being physically active supports cardiorespiratory capacity, tones muscles, and helps maintain a healthy weight. These positive effects occur when the activity matches the individual's capabilities and limitations. When the musculoskeletal stresses of the work exceed the musculoskeletal capability of the worker, the risk of developing a disorder becomes substantial. This chapter discusses these musculoskeletal stressors, mentions some common injuries and disorders, summarizes our understanding of causes and effects, and provides examples of risk-reduction strategies applied to musculoskeletal disorders. Over 200 years ago, Italian physician Ramazzini wrote about health effects of work: “certain violent and irregular motions and unnatural postures of the body, by reason of which the natural structure of the vital machine is so impaired that serious diseases gradually develop therefrom.” Today, much is known about the risk factors Dr. Ramazzini described as “irregular motions and unnatural postures.” Occupational medicine specialists and ergonomists have developed a respectable understanding of the risk factors for the most common occupational musculoskeletal disorders (MSDs). This section provides a brief review of some widely recognized occupational MSDs. A number of musculoskeletal conditions develop gradually from repeated stress. When these are

referred to collectively, various terms are used. Four worth mentioning are 1. Repetitive motion injury, 2. Repetitive strain injury, 3. Wear and tear disorders, and 4. Cumulative trauma disorders.

The label cumulative trauma disorder(CTD) fits many, but not all, of the musculoskeletal disorders commonly associated with work. A closer look at the three words, cumulative trauma disorder, reveals much about their development. The word cumulative indicates a gradual buildup, trauma indicates a harmful event, and disorder indicates a medical condition. Each disorder has its unique etiology, but, in general, CTDs develop gradually from very small traumas that fail to self-repair and accumulate over time to produce a disorder. Many musculoskeletal conditions result from a single incident like an automobile crash, fall, or excessive load on a body part. These musculoskeletal injuries as well as MSDs affect muscles, tendons, spinal discs, ligaments, nerves, cartilage, and joint surfaces. Both are included in this chapter.

26.2 Means by which Musculoskeletal Stressors can Harm This section introduces some of the most common work-related MSDs and the musculoskeletal stressors known to cause, aggravate, or contribute to the condition. The discussion covers upper extremities first, followed by those of the back and spine.

26.2.1 Upper Extremity Conditions The upper extremity discussion starts with the body system most directly affected—tendons, nerves, and neurovascular elements. Tendinitis is an inflammation of a tendon. Some causes are repeated exertion, vibration, and being in contact with a hard surface. People who need to work with hands over their heads sometimes get shoulder tendinitis. Tenosynovitis is irritation and inflammation of a tendon sheath. When the sheath swells, the inside diameter narrows, creating more frictional resistance to movement of the tendon inside. This is accompanied by reduced lubricant between the sheath and the tendon, further increasing the frictional resistance. Sometimes this leads to an inability to move the tendon. De Quervain's disease is a special case of tenosynovitis that occurs in the abductor and extensor tendons of the thumb where they share a common sheath. De Quervain's disease is associated with forceful gripping and hand rotation like wringing a wet cloth. Tennis elbow is the common term for lateral epicondylitis. The irritated tendons are those attached to the epicondyle (the lateral protrusion at the distal end of the humerus bone). It is most common among tennis players, and specifically associated with serving. In workplaces, tennis elbow can result from activities that involve forceful, rapid, and repeated forearm supination or pronation. An occupational example would be using a hand-powered screwdriver on an assembly line.1 The second group of MSDs includes those affecting nerves. Carpal tunnel syndrome is the result of compressing the median nerve as it goes through the carpal tunnel of the wrist. It is directly caused by swollen tendons in the carpal tunnel pinching the median nerve. The swollen tendons result from tasks involving repeatedly stressing the tendons in the carpal tunnel, especially by forceful exertions in nonneutral wrist postures, vibration, and high repetition of the same motion. Common symptoms are numbness and pain in the parts of the hand served by the median nerve.

The third group of MSDs includes neurovascular disorders. Thoracic outlet syndrome is a disorder resulting from compression of nerves and blood vessels between the clavicle and ribs at the brachial plexus, a site known as the thoracic outlet. Symptoms include numbness of the arm and may limit use of arm muscles. Occupational causes include working with arms elevated and any activity that puts pressure on the thoracic outlet. Vibration white finger involves insufficient blood supply in the hand due to narrowing of blood vessels. The narrowing results from vasospasm triggered by vibration. It is often associated with extensive use of vibrating hand tools such as chain saws and jackhammers. Using such tools in a cold environment significantly increases the risk of getting this disorder. See chapter 16 for more discussion of hand-arm vibration. Each CTD has its own set of risk factors well described in a book by Freivalds.2 However, most ergonomists agree that the major risk factors for CTDs in general are

Highly repetitive movements, Awkward postures (or postures far from the neutral posture), High forces, and Lack of time for recovery from microtraumas.

Each of these risk factors increases risk of developing a CTD. The combination of two or more risk factors acts synergistically to greatly increase risk. Working as a cutter on assembly lines in meat and poultry processing plants exemplifies work with multiple risk factors, and their very high workers' compensation claim rates for non-impact wrist disorders confirm the expected effects.3 Data entry using a keyboard provides an example. Say a person uses her right hand to enter numbers on the numeric keypad for 8 h a day. This job has the first risk factor—highly repetitive movements. This factor alone may slightly increase her risk of developing carpal tunnel syndrome. If she also works with her wrist in a nonneutral alignment, the second risk factor, posture, would increase her risk considerably. If she tends to pound the keys unnecessarily hard, that would bring the third risk factor into the equation. If she works steadily, without breaks, the fourth risk factor would be present. The combination of three or four risk factors greatly increases risk of developing carpal tunnel syndrome. Other commonly encountered risk factors for particular types of CTDs are

Tools that irritate nerves in the palm, Carrying thin loads with a pinch grip, Low-frequency vibration, especially under cold conditions, and Working with the hands under cold conditions.

Various risk factors can be encountered at work and while off work. It is not always clear if the origin of a particular cumulative MSD was from activities at the present job, previous jobs, off-work activities, a personal characteristic of the individual, or some combination of these. Some individuals are more vulnerable to developing cumulative MSDs. Sometimes psychosocial factors appear to influence individual reaction after experiencing the symptoms; some quietly deal with the pain and continue working, others seek medical treatment and take time off work. Psychosocial factors also influence whether they report their condition as a work-related injury/illness. Due to the multifactor

nature of causation, ergonomists say a risk factor is a factor that causes, aggravates, or contributes to a cumulative trauma disorder.

26.2.2 Spine and Back Conditions The discussion now turns from MSDs of the extremities to MSDs and musculoskeletal injuries of the spine and back. A common symptom is back pain. Some people incorrectly use the term “back pain” as though it were a disease. It is actually a symptom associated with numerous medical conditions— some being soft tissue injuries and others being spinal disorders. Common soft tissue injuries are torn muscles, often resulting from a motion or exertion. Torn muscles generally recover in 1–3 weeks. Often a slight muscle tear results in a tightening up response by adjacent muscles people refer to as a stiff back. Whether the person will miss work depends on the severity of the tear, the person's tolerance for pain, how much they like the job, and how physically demanding their job is. Common spinal disorders occur in the lumbar and cervical regions. An unhealthy spinal disc can allow pinching a nerve, which results in pain radiating out to wherever the nerve goes. For example, if the sciatic nerve is pinched as it exits the lumbar spine, pain will radiate to the buttocks and down the leg. A similar pinching in the cervical spine can produce symptoms in the shoulders and arms. The region of the spine associated with most occupational back disorders is the lumbar region, especially the L5/S1 and L4/L5 discs. These joints are subjected to greater compressive load than joints higher up the spine, and compressive loads are accepted by experts in occupational biomechanics as good indicators of overall biomechanical stress level on these spinal discs.4,5 Experiments on cadaver spines show that these discs have limits for tolerating compressive loads, and when exceeded, cartilage end plates develop tears. When the person performs heavy manual work over a long period, more tears develop and the initial ones extend in length and scar over. Eventually, the accumulation of damage to the end plates no longer allows sufficient fluid diffusion to keep the discs filled with moisture, leading to the discs getting flatter and more rigid, and increasing risk of a pinched nerve. The stressors that increase risk of back disorders may be found on the job and outside of work. Also important are individual differences in physical and psychological makeup. The major back stressors associated with increased risk of back pain and/or back disorders have been identified as follows:6

Heavy lifting and heavy work. Frequent lifting. Lifting loads near one's strength capacity. Occasional very stressful load handling. Sudden unforeseen events (e.g., crashes, falls, impacts). Prolonged standing or sitting. Others back stressors include whole-body vibration, pushing, pulling, carrying, twisting, and bending.

Workers in jobs involving heavy, whole-body labor are at greatest risk of occupational back problems that involve medical care and/or time off work. Some of these jobs are nursing assistants working in nursing homes, garbage collectors, and laborers.7

26.3 Strategies and Tactics for Musculoskeletal Stressors The strategies for reducing risk from musculoskeletal stressors are listed in the left column of Table 26.2. On the right are major groups of applicable tactics. The first strategy is to eliminate the hazard. This approach works for both tasks that stress the extremities and those that stress the back. Most often this involves replacing the human with a machine capable of performing the task. Occasionally, a task can be eliminated by changing the basic way of getting the work done. For example, a nursing home may have a procedure for weighing residents involving helping them transfer from a wheelchair onto a scale, and then back to the wheelchair. These two back-stressing transfers by a nursing assistant can be eliminated by having a larger scale onto which the wheelchair and resident can be rolled for weighing. After getting the weight, the wheelchair weight is subtracted from the result to obtain the person's weight. This approach eliminates two transfers involving exposure to shoulder and back stressors. The second strategy is to moderate the hazard. For tasks identified as having risk factors for CTDs, modification of the risk factors should reduce risk of developing a CTD. For tasks involving manual lifting, the tasks can be assessed for known risk factors, and changes may be made to reduce risk factors associated with the task. NIOSH has guidelines for evaluating a manual lifting task to identify attributes furthest from optimal; so the most effective modifications will address those attributes.5 The NIOSH method provides a numerical lifting index indicating how stressful the task is. The same index can be used to see how it would be if certain modifications were to be made. Another approach often used in manufacturing is job rotation. The idea is to let workers divide their shift into two or more workstations. This can be useful if different body parts are stressed in each workstation. For example, one workstation might stress the person's lower back, while a second stresses their right wrist, and a third stresses their neck. The hope is that avoiding 8 h of stressing the same body part will avoid causing injury. Most ergonomists recognize the practical value of this approach, but regard it as a temporary solution—temporary until an engineering solution can be found to avoid overstressing the employee. A method leading up to job modification is an employee survey known as a body-part discomfort survey. Employees are shown a sketch of a body and asked to express how each body part feels. Most forms use a rating scale for indicating the extent of discomfort. These surveys are used to identify mismatches between job demands and the employee's capabilities and limitations. In some instances of mismatch, a job modification can be made to provide a better fit. The third, fifth, and sixth strategies do not appear suited for to the hazards of musculoskeletal stressors. The fourth strategy applies to some heavy exertion tasks. An example is changing the storage location of heavy object an employee needs to lift from being near the floor to being elevated to level between the knees and hips. This will effectively reduce the intensity of the musculoskeletal stressors on the lower back. The seventh strategy is to help people perform safely. Three tactics for manual handling are noted in Table 26.1. The first is to provide training on work methods to minimize musculoskeletal stressors. This sort of training seeks to provide employees with the knowledge needed to recognize back- stressing tasks and choose a method that will minimize musculoskeletal stresses. Such training may also be viewed as fulfilling an employer's responsibility to inform employees of hazards and precautions appropriate for their job, like right-to-know training and warning signs. This training will usually be provided by a supervisor or experienced employee while showing the new worker

how to perform the task. A different sort of training teaches employees to use proper body mechanics. A large cohort study of postal workers found this approach was ineffective for reducing incidence of back injuries.8 Table 26.1 Strategies and Tactics for Reducing the Risks from Musculoskeletal Stressors. Risk-reduction strategy Risk-reduction tactics

1. Eliminate the hazard 1a. Do not have a human do work involving unhealthy musculoskeletal stressors. Usually this involves having a machine do the work 1b. Eliminate the need for the stressful work

2. Moderate the hazard 2a. Modify work by reducing risk factors 2b. Modify the duration of exposure to stressful work using job rotation 2c. Use body-part discomfort surveys to identify mismatches between employee and job demands; make appropriate changes

3. Avoid releasing the hazard Not applicable 4. Modify release of the hazard

When performing a heavy manual task, position body optimally and use a smooth rather than jerking motion

5. Separate the hazard from that needing protection

Not applicable

6. Improve the resistance of that needing protection

Not applicable

7. Help people perform safely

7a. Provide job-specific training on work methods to minimize musculoskeletal stressors

7b. Provide material-handling equipment for heavy tasks 7c. Implement programs to increase the capabilities of exposed employees for resisting musculoskeletal stressors

8. Use personal protective equipment

Provide pads for body parts exposed to repetitive pressure

9. Expedite recovery 9a. Use symptom surveys to detect individuals with symptoms suggesting early stage of a CTD; change their work assignments appropriately to stop further development of CTD 9b. Have employees with symptoms obtain medical care from an appropriate specialist 9c. Support employees trying to recover from a CTD by providing a return-to-work program suited to their needs

The second tactic is to make appropriate material-handling equipment available for use instead of brute force. This includes having the equipment where and when it is needed. Otherwise, workers may feel they can more easily do the task without the equipment. Employers can encourage employees to engage in physical activity during nonwork hours to help maintain or improve their physical fitness. This could be most beneficial if acted on by employees inclined to being sedentary. It might not be helpful to employees who already engage in lots of high- intensity exercise in their off time. In a prospective cohort study of an occupational cohort, the incidence of low back pain was compared for employees sorted into three groups based on their physical activity level.9 The highest incidence rates were for the lowest and highest exercise cohorts. The middle group, those who regularly engaged in moderate physical exercise, had the lowest back pain incidence. It was somewhat surprising that those who engaged in frequent, vigorous physical activity had higher rates than the moderate group. Perhaps some people are too zealous about their workouts. Many employers have implemented programs to help employees prepare for their daily work. Examples include stretching and group calisthenics prior to commencing work. The scientific evidence on the efficacy of these programs has not clearly established benefits in terms of reduced

rates of musculoskeletal disorders.10 However, this lack of evidence may be due to the difficulty of conducting a proper intervention study in a workplace. The eighth strategy is to use personal protective equipment. The use of knee pads is a preventive practice for workers who stress their knees by impact, such as carpet installers who use their knee as a hammer to kick a carpet stretcher, and flooring installers who expose their patella to direct contact with hard surfaces. Workers who expose their palms to hard surfaces can benefit from a glove designed specifically to reduce compression forces that pinch nerves in the palm. Some employees wear a wrist brace during work, or only while sleeping. This is intended to keep symptoms of a wrist CTD from recurring or getting worse. Some employers provide manual handling employees a belt designed to provide back support when lifting. These are intended to stabilize the spine, reduce the stress on low back muscles, and hopefully reduce the risk of a back problem. Studies to determine if these industrial back belts actually reduce risk of back problem have been conducted with mixed findings. Consequently, the ergonomics community does not endorse the use of back belts for workers without a history of back pain. The ninth strategy is to expedite recovery. The first and best tactic is to identify early symptoms of a CTD so that interventions can be implemented to head off a full-blown disorder. The means to accomplish this is to conduct a symptom survey of employees. Medical personnel evaluate the results and determine if intervention is needed. For ethical and perhaps legal reasons, symptom survey records should be treated as confidential medical records. Body-part discomfort surveys are easily confused with symptom surveys. Both call for using a rating scale linked to a specific body part shown on a diagram, and both rely on respondents to make a good faith effort to report how each body part feels. The tools are distinguished in purpose, rating scale, use, and confidentially as indicated in Table 26.2. Table 26.2 Difference Between Two Similar Employee Surveys. Characteristic Body-part discomfort survey Symptom survey

Purpose To identify task–employee mismatches To identify early signs of a possible developing medical condition

Rating scale Level of discomfort Level of pain

Use Used by ergonomists and industrial engineers with the goal of correcting the task–worker mismatch

Used by medical personnel with the goal of prescribing an intervention before a disorder matures

Confidentiality Treat with same level of confidentiality as other nonmedical employee survey data

A medical record that should be treated with the same high- level confidentiality as other medical records

When a symptom survey indicates an employee experiences pain in a particular body part, further investigation is required to determine if the pain is work related. This might include a medical exam and an ergonomic assessment of the work. If the pain is work related, several responses may be considered. Interventions might involve changing the employee's tasks, changing to a different job, implementing job rotation, or prescribing medical interventions like anti-inflammatory drugs, using a wrist brace, or wearing a back brace or lifting belt. The second tactic comes into play when an employee has developed a diagnosed musculoskeletal disorder. It involves being proactive in finding a medical provider with qualifications appropriate for the disorder. This has the potential of expediting recovery and return to work. The third tactic is to have an effective return-to-work program. Also called modified duty programs, these involve having the employee come into the workplace instead of sitting at home. This can avoid the malaise that tends to set in when a worker stays home while recovering, helps the individual sustain a feeling of being appreciated at the workplace, and often shortens the duration of temporary disability.

Learning Exercises 1. Sometimes in the popular press we find articles suggesting that ergonomists want to

eliminate hard physical work. Considering the introduction to this chapter, what is a more correct characterization of the ergonomist view of hard physical work? 2. In the discussion of upper extremity cumulative trauma disorders, what are the three physiological systems used for organizing the discussion? 3. Give one example disorder from each of the groups identified in question 2. 4. List the four well-recognized risk factors for cumulative trauma disorders. 5. List the seven major risk factors for back pain. 6. Explain the different purposes of a body-part discomfort survey and a symptom survey. 7. Indicate what items of personal protective equipment may be useful for MSDs.

Technical Terms Body-part discomfort survey

A survey of employees asking them to indicate their level of discomfort in various body parts. The purpose of these surveys is to identify mismatches between the task demands and employee capabilities and limitations so that corrections may be made to reduce or eliminate job-related discomfort. Most rating scales are from no discomfort to intense discomfort.

Cumulative trauma disorder

A musculoskeletal disorder resulting from cumulative trauma.

Cumulative MSDs

Same as cumulative trauma disorders.

Musculoskeletal disorders

Medical conditions of the muscles, tendons, ligaments, joints, cartilage, nerves, or spinal discs that develop gradually. Some are work related.

Musculoskeletal injuries

Medical conditions of the muscles, tendons, ligaments, joints, cartilage, nerves, or spinal discs that result from a traumatic incident.

Symptom survey

A survey of employees asking them to indicate on a body-part-specific rating scale how it feels. The scales are usually labeled for level of pain ranging from no pain to intense pain. The purpose of these surveys is to identify early signs of a possibly developing musculoskeletal disorder so that medical intervention can be applied. Survey forms and results should be treated like other confidential medical records.

References

1. Leclerc A, Landre M, Chastang J, Niedhanner I, Roquelaure Y. Upper-limb disorders in repetitive work. Scandinavian J. Work Environment Health. 2001;27: 268–278. 2. Freivalds A. Biomechanics of the upper limbs: Mechanics, modeling, and musculoskeletal injuries. Boca Raton, FL: CRC; 2004. 3. Jensen RC, Klein BP, Sanderson LM. Motion-related wrist disorders traced to industries, occupational groups. Monthly Labor Review. 1983;106(9): 13–16. 4. Chaffin DB, Andersson GBJ, Martin BJ. Occupational biomechanics, 4th ed. Hoboken, NJ: Wiley; 2006. p. 130–146. 5. Waters TR, Putz-Anderson V, Garg A. Applications manual for the revised NIOSH lifting equation. Cincinnati, OH: National Institute for Occupational Safety and Health; 1994. 6. Jensen RC. Epidemiology of work-related back pain. Topics Acute Care Trauma Rehabilitation. 1988;2(3): 1–15.

7. Klein BP, Jensen RC, Sanderson LM. Assessment of workers' compensation claims for back strains/sprains. J Occupational Medicine. 1984;26(6): 443–448. 8. Daltroy LH, Iverson MD, Larson MG, et al. A controlled trial of an education program to prevent low back injuries. New England J Medicine. 1997;337(5): 322–328. 9. Matthews T, Hegmann KT, Garg A, Porucznik C, Behrens T. The predictive relationship of physical activity on the incidence of low back pain in an occupational cohort. J Occupational Environmental Medicine. 2011;53(4): 364–371. 10. Choi SD, Woletz T. Do stretching programs prevent work-related musculoskeletal disorders? J SH&E Research. 2010;2(3): Feature Article 2. Available at http://www.asse.org/publications.

Chapter 27

Violent Actions of People

The last hazard source category is one not generally recognized by authors of OSH books. It contains highly hazardous situations created when people become physically aggressive toward others and when terrorists attack a place of work. Once initiated, these situations can turn in many directions and end with outcomes ranging from no one being hurt to multiple deaths. This hazard source category does not include careless conduct, negligent behavior, or failure to follow a safety rule. Take, for example, an employee who fails to use available and required eye protection. This behavior is clearly improper and undesirable because it takes away the last line of defense for the individual. It does not, however, create a new hazard for the misbehaving employee or for fellow employees. Likewise, an employee who operates a power tool with a power cord having damaged insulation is not creating a new hazard since the electrical hazard exists whether or not the cord has proper insulation; what the employee has done is not take advantage of a normally effective safety device. These examples of working with a compromised hazard control are offered to make clear that these behaviors are different from the violent actions of people. This chapter is limited to people-created, highly hazardous situations that imminently threaten the lives of people at work. Strategies and tactics for the violent actions of people are summarized in Table 27.1. The discussion below begins with a section on workplace violence and ends with a section on attacks by terrorists. Table 27.1 Strategies and Tactics for Workplace Violence and Terrorist Attacks. Risk-reduction strategy Tactics for violent and outrageous conduct 1. Eliminate the hazard No feasible means known to author 2. Moderate the hazard Provide selected personnel training on de-escalation techniques 3. Avoid releasing the hazard 3a. High-risk businesses keep windows open enough for those outside to see inside

3b. High-risk business have signs stating limited cash is kept in the premises 3c. High-risk businesses have security camera system and signs indicating the place is protected 3d. Provide good lighting in parking lots

4. Modify release of the hazard Restrain or subdue the violent individual 5. Separate the hazard from that needing protection

5a. Use bullet-resistant glass to separate cashiers from would-be robbers

5b. Limit workplace access to current employees and invited guests

5c. Defend the air traveling public from car bombs by using most intense security measures in areas of greatest people density 5d. In prisons, separate guards from prisoners by physical barriers

6. Improve the resistance of that needing protection

Not applicable

7. Help people perform safely 7a. Train employees of high-risk businesses on how to respond to robbers 7b. Train service providers in high-risk jobs on how to anticipate and respond to the aggressive behavior of clients/patients 7c. Treat employees fairly and let them know they are treated fairly 7d. Train supervisors to recognize signs an employee might become violent 7e. Provide assistance for employees feeling threatened by a nonemployee

8. Use personal protective equipment Care providers may wear PPE for a specific patient (e.g., wear a face shield while caring for an individual prone to spitting)

9. Expedite recovery For individuals who have been traumatized by the violent behavior of others, provide access to professional counseling

27.1 Workplace Violence Everyone in the OSH field is aware of the potential for workplace violence. Four types of violent situations at workplaces reoccur often enough to form a pattern.1,2

27.1.1 Robbery and Other Criminal Acts One repeated pattern occurs during a robbery or other criminal act.1 These commonly take place in workplaces where there is cash, during late night or early morning hours, and where only one or two people are working. Common targets for these crimes are 24-hour convenience stores, fast food restaurants, and taxi drivers. Doing business in high-crime neighborhoods also increases likelihood of robbery. The initiators of these crimes typically do not know their victims and often use a gun to coerce compliance with demands. The most heartless of these criminals gets the valuables and then shoots the victim in order to eliminate the only person who could identify the perpetrator at trial. These situations account for the most workplace murders in the United States, except for year 2001 when terrorist, using hijacked commercial airliners, attacked the World Trade Center and the Pentagon killing over 2700 people working in the buildings and causing over 400 rescue workers to give their lives attempting to save others. Strategies for addressing these hazardous situations start with discouraging the criminal minded person from targeting a particular person or establishment. Some tactics for implementing this Strategy 3 approach (avoid releasing the hazard) are used by many owners of convenience stores and fast food restaurants. They keep windows sufficiently free of advertising so that a person outside can see a robbery in progress, and they post signs near the entrance door informing would-be robbers that only small amounts of cash are kept in the premises and that surveillance cameras are in place. An example of Strategy 5 used in high-cash businesses (e.g., banks, casinos, and racetracks) is separating the cashiers from the customers with a barrier of bullet-resistant glass. Similar barriers are used in some taxis. Training store clerks and taxi drivers how to respond during a robbery can improve their chance of surviving the incident (Strategy 7—help people perform safely). The approach is to politely treat the perpetrator like a customer, comply with all demands, and hope the perpetrator simply leaves the crime scene without killing the robbery victim.

27.1.2 Client Attacks on Service Provider A second repeated pattern occurs when a service provider gets assaulted by the person being served.1 These situations occur in healthcare facilities where a patient strikes a nurse or other care provider. Other situations involve a student assaulting a teacher and a welfare recipient assaulting a social worker. Fortunately, these assaults rarely result in death.1 Approaches for these assaults on service providers start with each provider attempting to recognize the potential of a particular person acting violently. If this sort of risk assessment identifies someone, the service provider can have a second person present during any period of contact with the person of concern. The presence of two people may influence the person to behave. The individuals who enter these sorts of service professions receive training on how to communicate effectively with those served. Part of that training teaches techniques for dealing with hostile and otherwise difficult people. Clearly, these Strategy 7 approaches can reduce the frequency but not prevent all cases.

27.1.3 Attacks by a Disgruntled Employee or Former Employee The third recurring pattern involves an employee or former employee launching an attack at the workplace. Often the aggressor is someone who feels mistreated by the organization, a unit in the organization, a supervisor, or other employees. The outcomes of these assaults vary, with the worst result occurring when the aggressor brings a gun and shoots multiple employees. It is highly desirable to remove motives for insider attacks by treating personnel fairly, having and following personnel procedures that assure all employees are treated the same, and convincing all employees that the organization and managers attempt to treat employees fairly. If this Strategy 3 does not succeed, and an employee remains convinced of having been mistreated, he/she could become the source of an attack. Security measures that limit facility access to current employees will keep employees separated from a disgruntled former employee. A policy of no guns allowed in workplaces serves to deter gun attacks arising from a momentary fit of anger (Strategy 3). The idea is that the angry employee could only launch a gun attack by leaving the premises, getting a gun, and returning. This allows time for the person to cool off, and with a cooler head decide to call off the planned attack. It also provides time for the business to summon security personnel or police. Hiring practices that screen applicants using criminal background checks, contacting references, and conducting multiple personal interviews serve to avoid employing people with a history of violent behavior. Training supervisors to recognize precursors of violent outbursts can avoid some of these incidents. Precursors include signs that an employee is having disputes with coworkers, being on the receiving end of bullying by fellow employees, or feeling distressed for reasons such as excessive workload, too much responsibility, or an overly controlling supervisor. Supervisors need to know who they should contact if they need assistance, perhaps someone with the human resources department or an employee assistance professional.3

27.1.4 Attacks Related to Domestic Squabbles The fourth pattern occurs when a nonemployee enters the workplace with intent to hurt a specific employee. Usually the perpetuator's motive stems from a troubled domestic relationship with the employee (often the spouse or former spouse of the perpetuator). These situations account for 5% of the workplace murders in the United States.2

Various practices and procedures can reduce the risk of domestic violence occurring in the workplace. Having a building security system that limits access to the building can effectively separate the targeted employee from the would-be perpetrator. Having a security guard control the entrance to work areas serves a similar purpose. Having a receptionist at the entrance can discourage some would-be perpetrators, but not physically prevent them from entering the facility. Having policies that encourage employees to report when they feel threatened by a domestic partner, coupled with a plan to take appropriate precautions, can discourage violence at the workplace. Attacks in company parking lots can be discouraged by good lighting and making available to an employee who requests it an escort to and from their parked car. For all these violent situations, training personnel on de-escalation techniques can moderate the perpetrator's behavior (Strategy 2). Angry people tend to think irrationally, so finding ways to slow things down allows the perpetrator time to cool off and start thinking rationally about the consequences of their actions. Time also provides an opportunity for security personnel or police to respond.

27.2 Terrorist Attacks Attacks by terrorists on workplaces are a source of highly hazardous situations threatening all affected employees. The motives of terrorists vary, but clearly differ from the four types of workplace violence discussed in the preceding section. The motives for some terrorist actions include a desire to draw attention to a cause, get revenge for a perceived injustice, and hurt people who do not share the religious or political views of the terrorists. The apparent motive for several previous airliner hijackings was to obtain ransom money or get associates freed from prison. Some terrorists attack a particular workplace because they see it as a symbol of something they distain (e.g., the Federal Building in Oklahoma City and the Twin Towers in New York City). Governmental efforts to limit the weapons extremists can get are part of Strategy 2—moderate the hazard. A primary strategy employers can use is separating the workplace from outsiders with a barrier. Industrial facilities and military bases enclose the workplace with a security fence with gates for controlling access. Many western countries have fortified the perimeters and exterior walls of their embassy buildings to protect personnel and to improve the resistance of the buildings to car bombings. Airport security systems operate somewhat like gates to an industrial facility, separating the aircraft and legitimate passengers from persons who would like to highjack or destroy the airplane. All these tactics are applications of Strategy 5—separate the hazard from that which is to be protected. Many airports have taken steps to address the car bomb threat to people. One is deliberately separating parking lots from high-density passenger areas; another is controlling traffic in arrival and departure areas to make it difficult for a terrorist to leave a car bomb parked in that busy area. These tactics will not prevent a determined terrorist from deploying a car bomb on airport grounds, but by making the likely location a parking lot—an area with few people at any point in time—the number of people killed will be less than it would be if exploded in a crowded area. These tactics modify release of the hazard (Strategy 4) by making the parking lot the most vulnerable location for deploying a car bomb. Hiring practices that screen applicants using criminal background checks, contacting references, and conducting multiple personal interviews make it difficult for a terrorist organization to get their loyal followers a job in targeted industrial facilities where they would have opportunities to sabotage

operations.

27.3 Summary of Part V Part V consists of five chapters about risk reduction for hazards not classified as energy hazards. Figure 27.1 depicts two-dimensional matrix with the seven hazard sources in rows and the nine risk- reduction strategies in the columns. The last five rows apply to part V. Cells marked with an X indicate for each source the strategies mentioned in the applicable chapter. Figure 27.1 Matrix showing the risk-reduction strategies applicable to the five hazard sources addressed in part V.

Chapter 23 discusses some common hazardous conditions associated with workplace facilities—

walking surfaces, stairways, ramps, confined spaces, and dusty air. The point is made that these locations exist harmlessly until a human comes along. Management decisions on resource allocations to improve the safety of these locations warrant risk assessment to account for both the frequency of human exposure to the location and the potential severity of harm. Regarding walking surfaces and stairways, the discussion emphasizes the importance of meeting the expectations of the people walking on working surfaces and using stairs. The topic of chemicals encountered at work is discussed in chapter 24, beginning with a brief review of health effects, followed by comments on routes of entry, and ending with strategies and tactics for avoiding harmful exposures. Chapter 25 discusses biological agents encountered at work. It has sections on plants, pets, livestock, wild animals, mold, and pathogens. Each section mentions some of the more common instances of occupational exposures to biological agents, and provides examples of risk-reduction tactics.

The discussion of the fourth topic in part V, musculoskeletal stressors, starts by recognizing that most physical activity is healthy and important for maintaining health. Problems arise when stressors on various joints and muscle groups exceed the capabilities of those body parts. Discussions along these lines are provided for the two most common areas affected—the low back and upper extremities. Two employee survey tools used by ergonomists and occupational medicine physicians —discomfort surveys and symptom surveys—are compared and contrasted. Strategies for addressing mismatches between a worker and the job demands emphasize adjusting the work demands to match the capabilities and limitations of the employee. The final topic in part V concerns the violent actions of people. Topics in this chapter are workplace violence and terrorist attacks. The discussion of workplace violence describes four types and summarizes risk-reduction tactics for each. The section on terrorist attacks focuses on defensive tactics an employer can take prior to being attacked.

Learning Exercises 1. This chapter on the violent actions of people includes some actions and excludes others. It

does not include the actions of a construction laborer who enters a deep trench knowing it lacks proper shoring. What rationale does the chapter author use to explain why this sort of behavior is not a hazard source? 2. For neighborhood convenience stores, list three factors that increase risk of being robbed. 3. Some nursing homes have a particular resident known for hitting care providers. What protective measures can be used? 4. What engineering approach mentioned in this chapter applies to both attacks by former employees and attacks stemming from domestic disputes?

Technical Terms Compromised hazard control

The failure of a worker to use normally effective and appropriate PPE or other available safety device or practice when performing work.

Workplace violence Violent acts, including physical assaults and threats of assault, directed toward persons at work or on duty.4

References

1. LeBlanc MM, Barling J. Workplace aggression. Current Directions Psychological Science. 2004;13(1): 9–12. 2. Peek-Asa C, Runyon CW, Zwerling C. The role of surveillance and evaluation research in the reduction of violence against workers. American J Preventive Medicine. 2001;20: 141–148. 3. Anderson KR, Tyler MP, Jenkins EL. Preventing workplace violence. J Employee Assistance. 2004;34(4): 8–11. 4. Jenkins EL. Violence in the workplace: Risk factors and prevention strategies (Current Intelligence Bulletin 57 NIOSH No. 96–100) Washington, DC: U.S. Government Printing Office; 1996.

Index

accident deviation model of acoustic energy acoustic trauma injury administrative barriers administrative controls Air Force aircraft analysis, barrier analytical trees analytical tree technique ANSI/AIHA management systems ANSI/AIHA Z10 Committee application skill arc welding Army Corps of Engineers aspirations, OSH program atmospheric pressure high low backward-looking focus barrier barrier analysis biological agents bloodborne pathogens livestock mold needles pathogens pets plants standard precautions in healthcare sharps wild animals zoonotic pathogens BLEVEs (boiling-liquid expanding-vapor explosions)

Bloom levels Board of Certification in Professional Ergonomics boiling-liquid expanding-vapor explosions see BLEVEs burns pipes business continuity plans career paths chart methods analytical trees control event trees organization charts process flow diagrams top-down chemical substances hazardous chemicals 331 health effects mechanisms of harming material safety data sheets occupational dermatitis oxygen risk-reduction strategies routes of entry cognitive skills cold disorders claims, workers' compensation firefighters frostbite cold stress heater, portable indices personal protective equipment tactics risk-reduction tactics common-cause failure compressed gas cylinders compromised hazard control concurrent design process confined spaces

atmosphere entrant entry fatal scenarios Haddon inert gases program spaces continuous improvement loops processes programs crashes, roadway CTDs (cumulative trauma disorder) cumulative trauma disorder see CTDs cut sets bridge collapse minimum safety-critical damage deductive approach Department of Defense design fail-to-inert-mode final initial design models concurrent design series design design process diagram, free-body diamond shapes due diligence dusty conditions airborne alveoli dust lungs nanoparticles particulates

pulmonary system tactics educational psychology educational theorists electrical effects electrocution exposure-effect data fibrillation muscle spasms electrical hazards aluminum ladders arcs circuit breaker conductors electricity GFCI (ground-fault circuit interrupter) ground-fault circuit interrupter see GFCI grounding ignition insulation lightning Ohm's Law power power cord power tools receptacle risk-reduction strategies SI units sparks static tactics wooden ladders electromagnetic energy EMFs frequencies gamma rays health physics infrared laser

microwaves wavelength X-rays ultraviolet emergency planning business continuity plans catastrophes disaster emergencies emergency medical services short list energy energy exchange categories environments, hot. See also heat stress errors, human countermeasures defenses error rates HEP (human error probability) HFACS HFACS taxonomies human error probability see HEP human factors analysis human factors analysis and classification system see HFACS incidents, mining mining, accidents Olympics performance-shaping factors human reliability safety-critical domains safety-related errors Shappell,134 system tolerance taxonomies tolerance range Wiegmann error models classification system classification system, HFACS Swiss cheese model

error types commission skill-based habitual violation omission perceptual errors unsafe acts ethics business ethics codes confidential information ethics statement misrepresent ergonomics profession professional ethics reputation responsibilities evaluation, cognitive skill event trees evidence see incident investigation procedures explosions blast wave combustion explosions definition dust explosions expanding gases fireball fuels hazard heat sources ignition mechanical explosions sparks vessels deflagration explosion devices automated system blowdown tanks detection

magazines pressure-relief quenching rupture disks suppression systems, ductwork venting explosion risk reduction administrative processes business continuity plan explosion control strategies explosion damage acoustic trauma injury bombs, roadside destructive by-products pressure vessels rupturing explosives detonation magazines materials mining risk-reduction tactics facilities dusty conditions exits firewalls property damage sanitation smoke damages signs venting holes failure failure mode failure modes and effects analysis see FMEA failure-intolerant system failure-tolerant system fall same level fall patterns slips stumbling

trips FMEA components failure failure modes functional FMEA indenture levels inductive approach safety-critical items safety factor system failures fault trees analytical tree failure-intolerant system failures failure-tolerant system common mistakes condition gate gate stacking error independence intermediate events outline approach quantitative analysis success tree symbols symbol key terminal event tier undesired conditions undesired events verbal approach fault tree analyses basic events common cause complements cut sets equations formulas gate computations

probabilities venn diagram floors COF (coefficient of friction) cracks event tree fall patterns floor friction floor mats floor slipperiness floor surface foot-floor contact, expected friction human expectations materials RCOF (required coefficient of friction) sidewalks slippery spots risk-reduction tactics fire fuels Class classifications F&C materials flammable materials flammable vapors fuels vapors fire gases carbon dioxide carbon monoxide smoke fire hazard backdrafts flashovers risk-reductionstrategy risk-reduction tactics overarching tactics fire protection automatic detection barriers

cabinets codes definition electrical codes electrical equipment flammable vapor detector hazardous locations insulating lightning protection systems National Fire Protection Association (NFPA) NFPA (National Fire Protection Association) fire response brigades business continuity plans evacuation drills extinguish firefighters personal protective equipment venting holes fire science campfire chemical chain reaction combustion energy F&C materials fire, definition flame flammable materials flammable range flammable vapors heat transfer ignition, electrical ignition elements ignition temperature LFL (lower flammable limit) oxidizing agent sparks UFL (upper flammable limit) vapors

gas cylinders gases, compressed General Requirements for Safety Engineering of Systems and Associated Subsystems and Equipment geological events earthquakes risk-reduction tactics tidalwaves tsunamis volcanic eruptions graphic relationship models gravitational energy choking wheels elevators fall protection devices hard hats tethering tools Haddon Haddon Matrix Haddon phases hand-arm vibration damping effects of hand-arm vibration hand-arm vibration exposure hand-arm vibration syndrome (HAVS) HAVS (hand–arm vibration syndrome) power tools risk-reduction tactics hazard. See also particular hazards in chapters analysis methods control definition sources hazard controls healthcare nursing assistants heat transfer heat disorders burns heat cramps heat exhaustion

heat stroke occupations transient heat fatigue workers' compensationclaims heat stress acclimatization employee areas hot environments fans heat load heat sources indices personal protective equipment pipes radiant heat shield steam risk-reduction tactics water jugs WBGT (wet bulb globe thermometer) hierarchy of controls Hollnagel, system complexity levels housekeeping human factors, errors human-machine interaction mental processing tasks reliability, human single-channel processing traffic flow channeling hydraulic systems identification, forward-looking IEC ignition friction heat energy heat sources ignition elements ignition temperature static spark

vapors incident analysis barrier analysis technique barrier functions causal factors chart countermeasures deviation concept deviation-control mechanisms deviations, initial during-incident events events and causal factors chart intermediate events Kjellén, deviation model of accidents lessons learned management systems model model, graphic modeling harmful incidents multilinear events sequencing methods out-of-control event past incidents personal protective equipment prior incident investigations post-incident events post-incident responses pre-incident operations severity-mitigating factors system control system tolerance system weaknesses workplace systems incident investigations incident investigation policy closed-loop process initial response shallow investigations team investigation incident investigation procedures evidence evidence-based conclusions

evidence preservation eyewitnesses interviews investigation team photographs recommendations report distribution team investigation indenture levels inductive approach industries aerospace healthcare livestock mining nuclear infectious diseases initiating events injury prevention, public interfaces human-machine interaction people-equipment ionizing radiation containers controlled access area criticality criticality controls personal protective equipment pocket dosimeter radiation hazard labels radioactive materials respiratory protection risk-reduction strategies SOPs (standard operating procedures) sources (JHA) job hazard analysis example JHA form hazard control column

potential hazard column steps step column supervisors task job job functions job hazard analysis see JHA job safety analysis kinetic energy barrier distance, safe elastic materials elevation, fall from gravitational energy kinetic friction Law of Conservation of Momentum Law of Energy Conservation momentum Newton Newton's Laws PPE potential projectiles risk-reduction strategies 193 spring tactics traffic flow channeling vehicle Koop, Everett ladders laser learning domains life cycle phases lightning logic gates logic gate symbols losses management systems see OSH management systems

mining errors explosives incidents missiles models biomechanical computer definition graphic relationship models harmful incidents human-machine interaction mathematical models models analog physical physics statistical training musculoskeletal stressors back body-part discomfort survey ergonomists MSDs NIOSH risk factors risk-reduction tactics symptom survey upper extremity National Safety Council National Aeronautics and Space Administration (NASA) The Silent Safety Program Presidential Commission National Institute for Occupational Safety and Health (NIOSH) noise acoustic energy acoustic trauma injury common equations effects of hearing protection

damping reducing noise-generating sources risk-reduction tactics sound pressure sources nonionizing radiation hazards infrared radiation laser beams microwaves personal protective equipment ultraviolet radiation welder's flash nuclear industry incidents nuclear power incidents occupational safety, traditional organization charts OSH OSH management systems American National Standards Institute (ANSI) continuous improvement health, occupational industrial hygienists International Labour Organization (ILO) management systems OHSMS OSH programaspirations pathogens personal protective equipment strategy phase hazard analysis PHL (preliminary hazard list) pneumatic systems hydraulic accumulator hydraulic systems implosions fluid incidents, pressurized–container personal protective equipment

pneumatic systems pressure releases pressure vessels pressurized vessels standards, pressure-vessel water hammer hazard power tools pressure, directly on worker pressure, flying aircraft crews breathing masks cabin pressure pressure, high atmospheric decompression risk-reduction tactics underwater work pressure, low atmospheric acclimation atmosphere high elevation, work risk-reduction tactics pressure, risk reduction pressure used in industry air hoses BLEVE (boiling-liquid expanding-vapor explosion) boilers compressed gas cylinders explosions, pressure-vessel flexible hoses fluid gas cylinders hydraulic accumulator hydraulic lines hydraulic systems implosions incidents, pressurized-container personal protective equipment pneumatic systems pressure releases pressure-relieving devices

pressure vessels pressurized vessels standards, pressure-vessel water hammer hazard preliminary hazard list see PHL pressure relief valve position hazard analysis process flow diagrams priority categories product liability product litigation program aspirations public health public health injury prevention RA (risk assessment) administrative strategies baseline RA definition final risk assessment hazard columns hazard control matrix preliminary hazard list priority categories process project scope reassess risks risk level safety benefits scope strategies system boundaries system description system elements system interfaces system life cycle phases verifying radiation ionizing

nonionizing ramps forklifts RCOF strategy surface redundancy reliability, human rescue mission operations personal protective equipment risk assessment risk-reduction strategies residual risks resilient, systems resonant frequency right to know risk definition level matrix measure perception of reducing residual risk-acceptance decisions risk assessment see RA risk-reductionpriority risk-reduction strategies administrative controls energy hazards engineering controls expedite recovery exposures facilitators Haddon moderate nine strategies personal protective equipment, strategy

phase, post-event priorities separation shields space, confined tactics risk-reduction tactics, defined safety climate safety-critical functions safety-critical items safety-critical subsystem safety culture safety factor safety devices after-reach time dead-man control fail-active fail-passive fail-safe safe distance gate lever lockins lockouts power tools stop time safety-related requirements safety training see training sanitation facilities pests self-contained breathing apparatus single-channel processing source, defined sparks spring, energy stairways building codes effective riser height

effective tread depth guardrails handrail human expectations missteps riser height short flights, danger stairway guardrail stairway handrails step variations visual cue standard operating procedures (SOPs) steps strategy list success trees sunlight lotions skin cancer sun exposure sunburn sunlamps sunscreen synthesis, cognitive skill system assemblies complex systems components definition resilient subcomponents subsystems system control system safety analyses methods community contributions definition Systems Safety Engineering for the Development of Air Force Ballistic Missiles System Safety Society task hazard analysis

thermal hazards air velocity heat balance heat transfer core body temperature heat exchange heat load metabolism skin sweat traffic flow channeling training adult learners assessment techniques flowchart model instructor knowledge learning pretest purpose right to know skills task-analysis chart trees, generally. See also analytical trees; event trees; fault trees underwater work decompression UV (ultraviolet radiation) arc welding hazards of sun exposure light filtering lenses lotions skin cancer sun exposure sunburn sunlamps sunlight exposure sunscreen vehicle collisions Venn diagram

vibration. See also hand-arm vibration; whole body vibration amplitude common equations damping exposure hazards risk-reduction tactics sources violent actions of people terrorist attacks workplace violence warnings auditory colorless gases colors definition facility signs flashing lights formats lights safety culture safety symbols signal words signs symbols weather hazards flood high winds hurricanes lightning mudslides risk-reduction tactics severe winter storms tornadoes weather events welding arc metal fume fever whole body vibration

damping seats effects of whole-body vibration risk-reduction tactics workers' compensation workplace systems workplace violence client attacks on service provider criminal act disgruntled employee domestic squabbles personal protective equipment tactics