The safety and security of employees remains the number one priority for every utility, public and private, not only because workers have the right to a safe workplace but also because it is just good business. Four case studies illustrate safety failures that resulted in death and equipment destruction principally due to management inattention, poor supervision, and worker mistakes. All the incidents were avoidable.
Many generation companies have made safety a cultural norm, often beginning internal meetings with a safety note and requiring monthly safety training sessions. Zero lost time accidents during the two- or three-year construction period of a new power plant has become the norm, and an expectation. In many plants, a safety pause is taken before beginning work on even the most straightforward repair job to ensure directions are clear and the right tools are available. Some companies have gone to the extreme of requiring employees departing on a business trip to take a cab to the airport because of the potential dangers (and liabilities) when driving a personal vehicle. Home safety is a growing concern of companies with remote workers.
U.S. Occupational Safety and Health Administration (OSHA) statistics reveal that worker injuries and deaths in the power industry are a fraction of those across U.S. industry in general. Utility workers are safer at work than at anytime in the past—often safer at work than at home. However, company safety processes may be in writing and training logs signed off, but it only takes a split second of inattention for an accident to occur.
OSHA statistics tell us that the most cited actions were when workers failed to follow prescribed safety rules or workers (and supervisors) failed to identify a situation where safety was compromised. Unfortunately, OSHA citations usually occur after a workplace accident occurs (see sidebar).
| Top 10 OSHA Citations Issued in FY2013The following were the top 10 most frequently cited standards by the U.S. Occupational Safety and Health Administration (OSHA) in fiscal year 2013 (Oct. 1, 2012, through Sept. 30, 2013):
|
Catastrophic industrial accidents occur in the U.S. each year, and the after-accident reports usually find a breakdown of existing safety processes was the root cause. Often these plants had a safety culture only on paper, or one never existed in the first place. This article presents four case studies where worker safety was compromised, either through negligence or apathy, and the results were dreadful. The names of the facilities are not included because our focus is on lessons learned, not news reporting.
Hydro Plant Flash Fire
A hydroelectric power plant in the West, owned by a large multi-region utility, experienced a flash fire that killed five and injured three construction workers in October 2007. Painting contractors had begun epoxy recoating of the 1,530-foot interior steel wall portion of the penstock, which is a total of 4,300 feet long. The penstock is the conduit or tunnel that delivers the water from the reservoir to the hydroelectric turbine-generators. The tunnel interior diameter varies between 12 and 14 feet at this plant. Recoating of the walls is a common maintenance requirement to maintain structural integrity, maintain water tightness, and prevent corrosion of steel surfaces (Figure 1).
 |
| 1. Penetrating the penstock. A 4-foot by 6-foot opening was cut into the penstock for contract worker access. Two wooden bulkheads were constructed to contain and remove sandblasting and grinding debris and to provide work area ventilation via flexible ducts. The result was a confined space with only a single means of egress. Source: U.S. Chemical Safety Board |
Workers experienced problems with their paint spray equipment shortly after beginning the epoxy application. The spraying was stopped and the sprayer system was cleaned using the industrial flammable solvent methyl ethyl ketone (MEK). The cleaning work was done at the work location within the penstock. The National Institute for Occupational Safety and Health (NIOSH) lists MEK as a “highly flammable” solvent, with a flash point below 73F.
A flash fire occurred when a static spark ignited the solvent inside one of the two epoxy feed hoppers. The fire spread quickly when other plastic containers of the solvent (later determined to be approximately 16 gallons) and epoxy erupted. Four workers near the exit were able to quickly exit the penstock with minor injuries. Emergency response teams were unable to reach the five workers trapped behind the fire in the penstock before they succumbed to smoke inhalation. The fire occurred when the safety inspector and general foreman were away from the worksite having lunch.
The subsequent investigation conducted by the U.S. Chemical Safety Board (CSB) focused on “the technical and organizational causes of the fire.” The CSB investigated the incident to determine the root and contributing causes to help other plant owners prevent similar tragedies from occurring.
The investigation determined the technical cause of the incident was the ignition of the MEK that was circulated through the sprayers for purposes of cleaning. The work occurred in an open area within the penstock, although “a number of ignition sources present or created by the work activity were not eliminated or controlled.” Specifically, the MEK circulating through nonconductive hose was a likely source of a static spark that ignited the MEK. The other possible ignition source was halogen lamps used to illuminate the penstock, none of which were of explosion-proof construction (Figure 2).
 |
| 2. Inside the penstock. Five workers were trapped between the west bulkhead and fire that began with the solvents and epoxy compounds. Properly equipped and trained rescue workers were about 75 minutes away. Source: U.S. Chemical Safety Board |
There were also a number of administrative causes of the fire. First, the facility management knew about the epoxy application and the intended use of MEK for cleaning the paint guns but failed to “perform a hazard evaluation of the epoxy recoating work” and thereby failed to identify the hazard of using flammable liquids within the penstock. In addition, there was no pre-job safety planning or option of using a nonflammable solvent.
Next, although the penstock is very long, it is still classified as a permit-required confined space. OSHA defines a confined space as one that is: large enough to enter and perform work, limited access and egress, and not designed for continuous occupancy.
Further, OSHA defines a permit-required confined space as one that contains or has the potential to contain a hazardous atmosphere, contains material that has the potential for engulfing an entrant, has an internal configuration such that an entrant could be trapped or asphyxiated by inwardly converging walls or by a floor that slopes downward and tapers to a smaller cross section, or contains any other recognized serious safety or health hazard.
Neither the painting contractor nor the plant owner treated the penstock as a permit-required confined space, and neither evaluated the hazards of a confined space when flammable solvents were introduced in the vicinity of where hot work and abrasive blasting were part of the recoating of the penstock interior walls.
Also, the plant owner did not have policies and procedures in place that addressed a confined space monitoring plan or continuous monitoring of the workspace where flammables were to be used. OSHA has identified a hazardous atmosphere as “flammable gas, vapor or mist in excess of 10% of its lower flammable limit (LFL)” [29 CFR 1910.146(b)]. The National Fire Protection Association (NFPA) defines LFL as “that concentration of combustible material in air below which ignition will not occur,” in its Recommended Practice for Handling Releases of Flammable and Combustible Liquids and Gases, NFPA 329 (2005).
The documentation obtained by CSB confirmed that the owner and contractor recognized that there was only a single point of egress within the penstock before the work began but failed to address the problem in the work plan. On the day of the incident, the contractor took only a single flammable atmosphere reading—at the entrance to the penstock, 1,450 feet from the work area.
The owner’s contracting process was also found to be inadequate. The owner’s contractor selection process was to rank contractor proposals based on specific performance factors, such as past performance, work quality, and safety record. In the evaluation process, this contractor received a “zero” in the safety category, which according to the owner’s selection process should have disqualified the contractor. However, the contractor was not eliminated by management but was selected primarily based on low price.
As the project proceeded, the owner was aware of ongoing contractor safety problems, including a recordable injury, evacuation of the penstock due to high carbon monoxide readings, and electrical problems caused by the contractor. The owner took no action subsequent to these incidents.
Finally, the plant’s emergency response plan for the penstock recoating project was to call 911. “No emergency responders with confined space technical rescue certifications were at the hydroelectric plant and immediately available for rescue on the day of the incident.” The CSB investigation determined that the closest community rescue service was approximately 75 minutes away. Rescue workers talked with the trapped workers on hand-held radios for 45 minutes before they died from smoke inhalation. There were no fire extinguishers located inside the tunnel.
The owner and contractor subsequently failed to cooperate fully in the CSB investigation, particularly with providing requested documentation. In fact, the CSB eventually had to request the assistance of the U.S. Attorney’s Office to obtain requested documentation from the parties. Several contractor managers even “asserted their constitutional right against self incrimination.”
When the CSB was ready to release its final report, the owner and contractor, each facing criminal charges in relation to the fatalities, unsuccessfully went to federal court in an attempt to block its release. The CSB’s August 2010 final report is available at www.csb.gov.
In June 2011, the owner was acquitted in the criminal case of willfully violating OSHA regulations causing death, pleading the accident “was not foreseeable.” However, the owner paid an OSHA fine of $150,000 to settle the citations issued after the investigation and paid millions to the dead workers’ families to settle civil lawsuits. The contractor paid $1.55 million to satisfy workplace safety violations, and criminal charges are pending.
Pressure Pipe Explodes
The plant maintenance staff at a power plant was charged with replacing a high-pressure steam piping spool piece that connects the main steam stop valve to the non-return valve. The piping configuration at this particular plant interconnects the high-pressure steam piping across four boilers.
On the day work began, workers noticed that the main steam stop valve on an adjacent boiler was leaking steam. The workers were unfamiliar with the steam piping arrangement and dismissed its importance. In addition, because the welders were very experienced, the company elected not to test the welders prior to beginning the work or follow welding procedure inspections required by the American Society of Mechanical Engineers (ASME) Piping and Boiler and Pressure Vessel Codes.
The welders began fabricating the new spool piece in place on a Friday afternoon, completing the first 3/32-inch circumferential welding root pass connecting the pipe to flanges located on both ends of the pipe. The root pass filled in about one-fifth of the pipe thickness, which was sufficient to seal the spool piece. The crew then secured their work and left for the weekend. Unbeknown to the crew, the leaking valve on the adjacent boiler slowly filled the new spool piece with steam. The steam condensed into water as the pipe cooled over the weekend. A drain line on the spool piece was left closed, causing hot water to slowly accumulate instead of drain.
The crew returned to their work on Monday morning and none of the workers or plant staff thought to open the drain valve to ensure the spool piece was dry inside. The welder went to work to complete the four remaining welding passes on one end of the pipe spool. The pipe heated from welding (the heat-affected zone ranged from 1,200F up to the weld puddle temperature of 3,000F) caused the trapped water to evaporate and superheat, thus pressurizing the pipe spool. The welders next began making the final 1/16-inch passes on the other end of the pipe spool.
The welder was about two-thirds of the way around the spool with his second pass when the “pressure vessel” exploded. A portion of the reheated root pass and the second pass weld material struck the welder in the chest, causing serious injuries, and hit the welder’s helper in the face and eyes, causing what was probably a permanent loss of vision.
These preventable injuries were caused by a series of mistakes by the workers and plant supervision. The lessons learned from this tragedy are self-evident:
- Welding on an enclosed structure when you don’t know what is on the other side of the weld surface is extremely dangerous. Also, any enclosed volume must be thoroughly vented before and during a weld repair because any liquids present will evaporate and pressurize the container. The strength of the molten weld to contain a buildup of pressure inside the container is essentially zero.
- Any welding on plant piping, particularly high-pressure steam piping, regardless of how insignificant the repair appears, requires up-to-date welding qualifications for the work to be performed, in accordance with the ASME piping and pressure vessel codes. It’s unclear whether the quality of the welding was an issue. However, playing fast and loose with well-established welding processes is always a safety mistake.
- Plant supervision and management failed to instill a safety culture in these employees and failed to have safety inspectors present during the work. Supervisors should have also recognized the safety implications of a steam valve leak in an adjacent boiler.
Hot Work Ignites Flammable Fumes
In November 2010 at a process plant in upstate New York, a welder and foreman were repairing equipment located on top of an atmospheric storage tank. The hot work ignited flammable fumes contained within the tank, and the subsequent explosion killed the welder. Although the fumes present in the tank were from a unique source, the result was no different than if the tank contained fuel oil or another of the many flammable liquids found in a power plant. The lessons learned remain the same (Figure 3).
 |
| 3. Dangerous work environment. A still shot taken from a CSB animation shows the location of the workers at the time the fumes in the tank were ignited by the welding. Source: U.S. Chemical Safety Board |
In this particular incident, the tank contained flammable vinyl fluoride (VF) gases produced from the liquid VF used in the manufacture of photovoltaic panel films and other consumer goods. VF is a colorless, heavier-than-air, highly flammable gas at ambient conditions. The tank containing the VF vapor was 11 feet in diameter and 19 feet tall, with a volume of 10,800 gallons.
The tank shell and top were quarter-inch-thick stainless steel. A flash tank vented small amounts of VP as a gas to the atmosphere and drained to the tank, and the area was equipped with flammable vapor air monitoring to alert operators when an explosive gas mixture is present. An alarm was set at 10% of the lower explosion limit (LEL) and the high alarm was at the 2% LEL. The sample monitor was located directly under the flash tank vent. At the time of the incident, the area surrounding the three VF slurry tanks was classified as general purpose electrical at ground level, on the top of the tanks, and on the elevated catwalks connecting the tanks.
The plant’s three VF slurry tanks were “locked out” by the plant owner on Oct. 22, the day after the plant began a two-week outage for repairs. Emergent work on the roof of Tank 1 was delayed due to lack of materials and was rescheduled for Nov. 9, when the contract welder was available, which was after the plant was restarted.
In the meantime, a loop seal pipe (separating the VF slurry from the vapors) located inside of Tank 2 split open. An engineer inspected the pipe and determined that the damage was not significant and the tank was returned to service. The engineer that performed the inspection did not recognize that the split in the loop seal provided an open path for flammable vapors to travel to adjacent tanks, a “low hazard” area. The engineer did not recognize that the split overflow line could not be secured as part of the lockout process.
On Nov. 6 the plant was restarted, and Tanks 2 and 3 were returned to service while Tank 1 waited on parts. On Nov. 8 a plant process compressor malfunctioned with the effect of doubling the amount of waste vapor sent to the tanks. The following day, a lockout card was completed for Tank 1 that confirmed that all five pipes connected to the tank were secured and isolated from the online processes. The overflow line was not referenced in the lockout report because it had no valves.
The welder began work on Tank 1 after completing a hot work permit on Nov. 9, as planned, although the welder did not confirm the valves were locked out before beginning work. A plant lab technician also manually checked the area on top of the tank before weld repairs began and found no flammable vapors present, but failed to sample the interior of the tank. The interior of the tank wasn’t tested because when empty of slurry, it was considered as low hazard.
Just after 9 a.m., the welder attached his safety harness to the tank and began using an electric arc welder to weld a C-channel beam to the roof of the tank. The arc welding increased the metal temperature to in excess of 1,200F, well above the VF autoignition temperature of 725F (the autoignition temperature of diesel oil is about 410F). The foreman was stationed on the catwalk adjacent to the closed manway cover serving as the fire watch. Two hours later, an alarm in the main control room reported a fire inside Tank 1. Shortly after the alarm, the overpressure within the tank blew the manway cover off the tank roof, landing over 100 feet away.
The explosion also tore open a 25-foot length of the top-to-shell weld, leaving only a 2-foot seam acting as a hinge. The roof of the tank folded completely over the side of the tank pivoting on the remaining weld. The welder was killed immediately by blunt force trauma. The foreman faired better, suffering first-degree burns and other minor injuries. The fire quickly consumed the flammable vapor and self-extinguished (Figure 4).
 |
| 4. Explosive opening. The explosion folded over the roof, killing the welder and severely injuring the foreman. Source: U.S. Chemical Safety Board |
The incident investigation determined that an earlier plant hazard analysis modeling did not consider that VF could accumulate in sufficient amounts in a tank to reach flammable levels, although the hazard analysis did determine that loss of the compressor would double the VF vapor produced. The cracked looped seal pipe in Tank 2 had the unfortunate effect of increasing the amount of flammable vapor present in Tank 1. In addition, the insulation was removed from Tank 1 during the overhaul and not yet been replaced at the time of the incident, which also resulted in the production of more flammable vapor due to condensation (colder tank metal temperatures).
The subsequent investigation found that the contractor correctly completed the required hot work permit paperwork. The plant safety procedures required the “area proprietor” to inform the worker of any process changes or of any additional safety information that might affect the work. The final incident report noted, “On the day of the incident however, neither the construction field engineer nor the employee signing off as the area proprietor had understanding of the area, the process, or potential hazardous conditions.”
The portion of the hot work permit that asked if flammable material would be within 35 feet of the work was left blank. The owner’s construction engineer was also found to have “had no working knowledge of the… process” and did not recognize the impact of the failed compressor on the production of flammable vapor. Also, the area proprietor that signed the hot work permit was from the service department and knew little about the process, a safety shortcut that had been going on for months. Internal controls require the area proprietor to be “knowledgeable” and to walk down the area where the work was to be done.
It was later determined that the area proprietor who signed the permit didn’t even know where the hot work was to be performed.
OSHA issued 10 citations to the plant owner and eight to the construction company doing the work for violations of OSHA 29CFR 1910.147 (Control of Hazardous Energy (lockout/tagout standard) and 29 CFR 1910.252 (Welding, Cutting and Brazing). The owner was fined for not including a process to completely isolate the tank and for failing to install blind flanges in the overflow line. The contractor was fined for failing to ensure the lockout/tagout procedure was rigidly followed and the tank was properly isolated. OSHA fined both companies for failing to inform employees about the explosion potential when performing hot work on Tank 1.
The CSB subsequently issued the bulletin “Seven Key Lessons to Prevent Worker Deaths During Hot Work in and Around Tanks” in February 2010, which discusses 11 incidents in which hot work ignited flammable vapor in or near storage tanks, three of which were violated during this incident. The CSB report can be found at http://tinyurl.com/mmqv7t3.
Destructive Dust Explosions
The danger of dust explosions is common to many industry sectors, although the magnitude and carnage from these explosions appears to have steadily grown over the past decade. In its 2006 Investigation Report, “Combustible Dust Hazard Study,” the CSB identified “281 combustible dust incidents between 1980 and 2005 that killed 119 workers and injured 718, and extensively damaged industrial facilities.”
Many of these explosions occurred in utility plants that burn coal, but the ubiquitous nature of these explosions is apparent; the incidents occurred in 44 states, in several different industries, and involved a variety of materials.
The CSB report specifically discusses seven catastrophic explosions that occurred during the decade preceding release of its report. The common factor was secondary dust explosions that caused most of the damage, principally due to “inadequate housekeeping and excessive dust accumulations.” A secondary explosion occurs when a primary, and often small, explosion or other event occurs that produces a blast wave that lofts dust accumulated on floors and structures into the air and then is ignited by the primary explosion or other ignition source.
In effect, a weak primary explosion often causes a very strong secondary explosion. The NFPA defines an explosive dust as fine material that can pass through a U.S. No. 40 Standard Sieve (about 430 microns).
The CSB completed three in-depth dust explosion investigations in 2003 prior to the report release. The first was at a pharmaceutical manufacturing plant, located in North Carolina, which killed six workers and completely destroyed the facility. That explosion was caused by polyethylene powder accumulation above the suspended ceiling used in the production of rubber medical devices. Also, electrical equipment located above the suspended ceiling was not rated for use around combustible dust (Figure 5).
 |
| 5. Explosive mixture. A pharmaceutical manufacturing plant allowed polyethylene dust to collect above a suspended ceiling that eventually led to an explosion, destroying the plant. Workers were not informed that the dust residue was a safety concern. Source: U.S. Chemical Safety Board |
The post-incident investigation found that employees were not trained about the hazards of combustible dust. OSHA, local fire department, and insurance company inspectors inspected the plant, although none made comment about the potential for a dust explosion. The CSB determined that if the company had “adhered to NFPA standards for combustible dust, the explosion could have been prevented or minimized.”
The second incident occurred in an aluminum products manufacturing plant in Indiana, where an explosion killed one worker and injured several others. The plant recycled scrap aluminum produced by its production line and fed it into a melt furnace. Transporting the aluminum scrap produced aluminum dust that was sucked into a dust collector.
The explosion occurred in an inadequately vented and cleaned dust collector that was located too close to the scrap processing area. “The initial explosion spread through ducting, causing a large fireball to emerge from the melt furnace.” Dust was also present on overhead beams and other structures that was lofted as a result of the first explosion.
The proximate cause of the fire that burned the facility to the ground was a dust collector that was “not designed or maintained to prevent dust explosions.” Neither the owner nor regulators adequately investigated earlier dust fires at the facility, nor were any process changes made. Again, the CSB determined that if the company had “adhered to the NFPA standard for combustible metals, the explosion could have been prevented or minimized.”
The third major eruption occurred in a facility located in Kentucky that produced acoustic insulation for automobiles. The explosion claimed the lives of seven workers, injured 37, and completely destroyed the facility. According to the CSB, “the manufacturing process began by impregnating a fiberglass mat with phenolic resin, and then used air to draw the resin into the fiberglass webs. On the day of the explosion, a curing oven that had been left open because of a temperature control problem likely ignited the combustible resin dust stirred up by workers cleaning the area near the oven.”
With the knowledge of plant managers, dust had accumulated throughout the manufacturing facility in dangerous amounts. The production process used compressed air for cleaning, often blowing large amounts of resin dust into the air. Again, Kentucky OSHA, state fire marshals, and insurance company safety inspectors had inspected the facility, but all failed to recognize the combustible dust hazard. Again, the CSB determined that if the company had “adhered to NFPA standards for housekeeping and fire/explosion barriers, the explosions could have been prevented or minimized.”
OSHA Resists Issuing Dust Safety Regulations
The CSB report on the hazards of dust in the workplace was released to the public at a Washington, D.C., press conference on Nov. 9, 2006. The CSB’s two-year study called for OSHA to prepare a new regulatory standard “designed to prevent combustible dust fires and explosions.” The report noted that there is no comprehensive federal safety regulation designed to prevent dust explosions and that engineers, regulators, fire inspectors, and insurance companies are generally unaware of dust explosion hazards.
Also, there were common causal factors shared by the three tragedies mentioned above. First, the hazards of dust were not adequately communicated to employees. The Material Safety Data sheets “do a poor job of informing workers of dust explosion hazards and the OSHA regulation for hazard communication… do not address combustible dust.” Second, each plant produced dust that accumulated on structures in excess of the NFPA standard that warns that layers 1/32nd of an inch thick, less than the thickness of a dime, can constitute a hazardous condition. Finally, any material that will burn in air can become a combustible dust.
OSHA’s response since release of the CSB report has been silence. On July 25, 2013, the CSB at a follow-up public meeting in Washington, D.C., “declared the response by OSHA… on combustible dust… to be ‘unacceptable.’ ”
The CSB also “voted to make adoption of a combustible dust standard… first priority in the CSB’s recently established ‘Most Wanted Safety Improvements Program.’” To its credit, the CSB has taken its case public and promises “stepped-up advocacy” for regulations that can prevent dust explosions. The CSB stated that it strongly believes the regulatory changes suggested in its 2006 report will prevent similar incidents and will save lives.
The CSB noted that OSHA “recognized the importance of NFPA’s dust standards” by including fugitive dust as a “National Emphasis Program that OSHA began last year and reissued earlier this year [2013].” However, without a comprehensive standard, businesses and regulators don’t know which NFPA standard applies, so compliance requirements aren’t clearly stated.
Since the release of CSB’s 2006 investigative report, dust explosions have continued to occur. For example, an explosion occurred at a sugar company in February 2008 caused by large accumulations of powdered sugar, in a plant were the powder accumulations were often up to “mid-leg” height or was airborne in the facility, often making it difficult to see across the plant. Fourteen workers were killed and 36 were injured. The subsequent investigation found much of the electrical equipment in the plant was not dust-tight and the dust collection system was inadequate.
Another CSB investigation continues on the December 2010 dust explosion at a West Virginia plant processing titanium powder that claimed the lives of three workers and at a Tennessee plant where multiple iron dust flash fires combined with a hydrogen explosion that destroyed a plant in January 2011, killing three workers.
In the power industry, there have been many coal-dust related explosions that caused injury and property damage over the years for these very same reasons. It appears the turning point for the power industry was the secondary coal dust explosion at Ford’s River Rouge manufacturing plant, located in Dearborn Mich., in February 1999 that killed six workers and injured 36. According to the Michigan OSHA investigative report, housekeeping failed to control accumulations of coal dust throughout the plant. The triggering event was a relatively small natural gas explosion in the power plant, but the shock wave shook free suspended dust accumulations that produced a massive secondary coal dust explosion that caused the majority of the damage to the plant.
In 2000, the Powder River Basin Coal Users’ Group (PRBCUG) was formed to address the “safe, efficient, and economic use” of PRB coal, which is more prone to secondary explosions than other types of coal. Members of the PRBCUG and POWER have written extensively about how to avoid coal dust explosions since that time. The PRBCUG has also produced webinars on the topic and its Powersafe Combustible Dust e-Learning course, “Combustible Dust Awareness for Coal,” is available online (www.prbcoals.com).
The excellent work of the PRBCUG in educating plant owners and workers about the danger of poor coal dust housekeeping and for providing a forum in which experiences can be shared has helped make a significant reduction of major coal dust–caused incidents in the power industry over the past few years. Complacency often follows success so learn from the experiences of others and take a fresh look at your plant’s safety program.
There is always room for improvement. ■
— Dr. Robert Peltier, PE is POWER’s consulting editor.
https://www.powermag.com/safety-is-not-an-accident/?pagenum=1