Safety Incident Topic: Fall From Height
Location of Incident: Construction Site, Taichang China
Date of Incident: 27 January, 2007
Brief Account of Incident
A contract worker fell from a permanent work deck located 6m above the ground. The investigation revealed that on the morning of the incident, a wooden temporary platform was constructed and then positioned 1.2m./4 ft. (horizontally) from the edge of the steel permanent deck and 1m./3.3ft.(vertically) above it. The worker was standing on the wooden temporary platform in order to grind on an over head pipe. While repositioning himself, he stepped off the wooden temporary platform. The 1m fall caused the worker to lose his balance. When he landed on the steel permanent work deck, he rolled toward the edge, fell through an incomplete guardrail (top rail only), and landed on the concrete floor below. Immediately following the incident, the worker was taken to the hospital and released to work without restrictions. The extent of his injuries was a bruised torso.
Immediate Causes
- Lack of knowledge of hazards present- Unprotected height
- Inadequate guards of protective measures
Root Causes
1. Inadequate identification of critical safe behaviour
Following the installation of the guard rail (top rail only) around the blend deck, the on-site contractor and BP personnel did not recognize the requirements for fall protection when a guardrail is missing a mid-rail and toe board. Once enhanced procedures are communicated to site personnel, extensive HSSE auditing would help to identify unsafe conditions or actions.
2. Inadequate identification of work hazards
During the Jan. 27th daily pre-job tool box safety meeting, the pipe work on the steel permanent work deck was not recognized as “working at heights”. Contract supervisors and workers did not identify the increased risk of falling from the temporary work platform and its close proximity to the unprotected edge. They did not understand or recognize that approved fall protection is required when working on an elevated platform with guardrails that are missing mid-rails and toe boards.
3. Inadequate work planning
For more than two weeks prior to the installation of mid-rails and toe boards on the guardrails, extensive construction activity was allowed to be performed on the steel permanent work deck without approved fall protection.
4. Inadequate implementation of 'Policies, Standard and Procedure'
Standards for Working at Heights were in place but the applicability when working on a flat permanent work deck with an incomplete guardrail had not been addressed. Prior to the incident, the standard had been misapplied due to inadequate detail and implementation.
Actions Taken
1- Revise/update written site safety procedures to enhance requirements for work on elevated walking and working surfaces. Procedures should include a requirement for guardrails to be constructed in full (top rail, middle rail, andtoe boards) at the time of initial installation. Communicate revisions to all site personnel.
2- Contractor and BP site personnel should attend additional formal instruction on Risk Assessments and Hazard Identification. The training will include the recognition of potential interactions of simultaneous activities.
3- Contract and BP site personnel should implement an enhanced HSSE audit process including HSSE audit checklists.
4- BP site construction coordinators should attend contractor planning meetings and ensure that work activities are strategically aligned with HSSE requirements.
5- BP site personnel should audit contactors to ensure that documented risk assessments for non-routine and routine permitted work activities are being completed and adequate for the work being performed.6- Communicate the following to all BP and contractor personnel on site. “Everyone must take personal accountability for themselves and for others. Any work viewed as being unsafe must be stopped.”
What Went Well
A Permit to Work for the welding operations and the Daily Risk Assessments had been completed and signed by all contractor employees involved in the task. HSSE Training records for the contract employee were complete and readily available for review.
Lesson Learned
1. Training on Hazard Identification, considering the interactions of location and tasks, needs to be further enhanced.
2. Personal accountability of others to stop work that they viewed as unsafe is critical to safe operations.
05 September 2007
Carbon Dioxide Asphyxiation
Safety Incident Topic: Carbon Dioxide Asphyxiation Due To Exposure To Carbon Dioxide
Location of Incident: 33kV Switchgear Room, Malaysia
Date of Incident: 17 April, 2007
Brief Account of Incident
A contractor personnel was unconscious due to asphyxiation when a CO2 fire protection system activated inside an electrical switchgear room. The incident occurred during functional testing of a fixed CO2 fire protection system, which had earlier been relocated and isolated, when another CO2 system inside the same area activated. The victim was evacuated from the room by the plant’s emergency response team and regained consciousness after given first-aid treatment.
Outcome
1. One contractor personnel was asphyxiated due to CO2 exposure
2. The entire fixed CO2 fire protection system for the 33kV switchgear room was out of service due to loss of CO2 from the cylinders bank.
Active Failures
Unauthorized testing of the CO2 fire protection system by an incompetent personnel.
Lesson Learned
1- All work including functional testing of electrical/instrument system should be approved by authorized personnel of the OPUs. The work should be supervised and performed by competent personnel.
2- The effect of a stop-work-order should be made understood to all personnel and necessary actions e.g. cancellation/withdrawal of PTW, evacuation of personnel from the work area etc. should be taken as soon as possible.
3- Relevant parties such as Operation, Maintenance Project Team and HSE etc. should be involved in the review of method statements, Job Safety Analysis and other work procedures to ensure all hazards are identified and control measures e.g. isolation requirements are taken.
4- Method statement for each task should be documented in detail e.g. the steps to be taken, the specific switch(es) to be isolated etc. The method statement should be discussed with all relevant parties involved including the contractor and subcontractors prior to the job.
5- Access into rooms which are protected by fixed fire protection systems e.g. CO2, FM200 etc should be controlled especially during testing of the system.6- Updated drawings to be made available in the plant.
Location of Incident: 33kV Switchgear Room, Malaysia
Date of Incident: 17 April, 2007
Brief Account of Incident
A contractor personnel was unconscious due to asphyxiation when a CO2 fire protection system activated inside an electrical switchgear room. The incident occurred during functional testing of a fixed CO2 fire protection system, which had earlier been relocated and isolated, when another CO2 system inside the same area activated. The victim was evacuated from the room by the plant’s emergency response team and regained consciousness after given first-aid treatment.
Outcome
1. One contractor personnel was asphyxiated due to CO2 exposure
2. The entire fixed CO2 fire protection system for the 33kV switchgear room was out of service due to loss of CO2 from the cylinders bank.
Active Failures
Unauthorized testing of the CO2 fire protection system by an incompetent personnel.
Lesson Learned
1- All work including functional testing of electrical/instrument system should be approved by authorized personnel of the OPUs. The work should be supervised and performed by competent personnel.
2- The effect of a stop-work-order should be made understood to all personnel and necessary actions e.g. cancellation/withdrawal of PTW, evacuation of personnel from the work area etc. should be taken as soon as possible.
3- Relevant parties such as Operation, Maintenance Project Team and HSE etc. should be involved in the review of method statements, Job Safety Analysis and other work procedures to ensure all hazards are identified and control measures e.g. isolation requirements are taken.
4- Method statement for each task should be documented in detail e.g. the steps to be taken, the specific switch(es) to be isolated etc. The method statement should be discussed with all relevant parties involved including the contractor and subcontractors prior to the job.
5- Access into rooms which are protected by fixed fire protection systems e.g. CO2, FM200 etc should be controlled especially during testing of the system.6- Updated drawings to be made available in the plant.
Warm Diesel Spill
Safety Incident Topic: Warm Diesel Spill When Loosening Plug
Location of Incident: Refinery, Australia
Date of Incident: 12 June, 2007
Brief Account of Incident
The Distillate Ultrafiner was being shut down for maintenance. Part of the procedure called for soda ash washing of a heat exchanger bank. Temporary fittings were required to enable the soda ash wash. Work to prepare for blinding was being conducted by fitters while operators progressed the draining and depressuring of the unit. A plug on a heat exchanger was loosened to check if the heat exchanger was empty and depressured in preparation to installing a soda ash wash fitting. Upon the initial loosening some diesel came out of the tapered plug, but this stopped. Upon further loosening, the plug came out of the socket and ~400L of warm diesel flowed out of the exchanger under pressure. The diesel stream hit a concrete pillar, forming fine droplets. The diesel pooled and ran towards the vacuum distillation charge furnace. The diesel did not ignite. With an operator directing, the fitters responded in running out and manning fire hoses. The supervising operator isolated the heat exchanger bank from the source of pressure. The control room was contacted and instructed to sound the active aid alarm. Emergency responders arrived at the incident scene, relieved the fitters and mitigated escalation. The supervising operator installed the soda ash wash fitting when the system was depressured to re-establish containment. After securing the site, the diesel spill was removed by vacum truck.
Investigation Findings
The work was being done following an operations procedure with a blind list under the supervision of an operator. The supervising operator asked the fitters to second bolt a number of heat exchanger flanges to prepare for blinding. The operator and the fitters talked about the step of pulling a plug to install the soda ash wash fitting. The operator thought that he clearly communicated that the step of pulling the plug was not to be done until the blind was in place, after completely draining the heat exchanger bank and isolating it from the stabiliser.The fitters’ understanding was that the operator had instructed them to pull the plug and install the soda ash wash fitting. It was believed that the heat exchanger bank was open to drain to the pump out system. After initially loosening the plug, the fitters checked and confirmed that the figure 8 blind had been swung to the open position and the valves were lined up to the pump out drum. Subsequent checks confirmed that the pump out line was not blocked. The level in the pump out drum remained constant while the heat exchanger was thought to be draining (this is the subject of ongoing investigation). The fitters had conducted a personal job safety analysis (PJSA). The hazard of breaking containment on live equipment was not raised on the PJSA. The procedure had not been progressed to the stage where breaking containment was called for.
What Went Wrong (critical factors)
1. Containment was broken when it was not safe to do so. The plug was loosened based on the fitter’s understanding of the operator’s verbal instruction. The operator and the fitter did not have a common understanding of how far the procedure had progressed and whether or not it was safe to break containment.
2. Containment was broken by loosening a plug. Once the plug came out of the socket, it was impossible to control the outflow of diesel until the system could be isolated from fuel gas pressure.
3. There was no valve or flange on the plug hole to allow a safer means of checking the pressure and liquid level. Verification that the system was drained and depressured was by loosening the plug. This method was not appropriate.
Immediate Causes
1. Servicing of energised equipment. The heat exchanger bank was at stabiliser pressure using fuel gas, let down to flare. The heat exchanger bank had not completely drained when the plug was loosened.
2. Inadequate isolation of process or equipment. The plug was not a suitable form of isolation from the process to break containment because once the plug was removed from the socket the plug could not be replaced until the system had depressurised.
3. Inadequate equipment. The heat exchanger bank did not have an adequate or obvious means of determining that the shell side of the heat exchanger was fully drained and depressurised
System Causes
1. Human factors consideration. Verbal communications in the plant are susceptible to misunderstanding.
2. Inadequate implementation of policy / standards / procedures. In the procedure the step for isolating the heat exchangers from the stabilizer appears after the step to install the temporary fittings.The operating procedure was ambiguous on when to install the isolating blind on the shell side inlet of the heat exchanger. The step to install the blind appeared twice in steps K11 and L21. Step L21 appeared after the step (L13) calling for the installation of the soda ash wash fitting.
3. Inadequate assessment of needs and risks the plug was loosened without positive confirmation that the shell side of the exchanger was drained of liquid and depressurised.
4. Inadequate technical design. The heat exchanger bank requires periodic repair and maintenance. To prepare for this maintenance, the heat exchanger must be drained, gas freed and opened. The lack of an appropriate facility for checking that the heat exchanger is empty and depressurized represents and inadequate design.
5. Inadequate correction of prior hazard /incident. The hazard of the plug without an isolation valve was recognised and had been raised at previous turnarounds, but had not been corrected.
Summary of The Local Actions
1. As an additional safeguard, fitters are requested to only loosen and remove plugs,which do not have an isolating valve, in the immediate presence of the supervising operator.
2. Implement site measures/procedures on verifying depressurization / isolation prior to breaking containment, checking that they are in line with the new group isolation standard.
3. Consider implementing a process for unit shutdown where the state of each section between isolations is shown as they progress (e.g. on the process flow diagram).
4. Revise the Ultrafiner shutdown procedures, including; nitrogen purging and closure of valve to stabiliser to occur prior to breaking containment and connections of the soda ash wash fitting; and remove ambiguity about when to install blinds on heat exchangers.
5. Revise the breaking of containment procedure to include the hazards of pressure (hydraulic / pneumatic) and how to verify that something is depressurized. Develop a breaking of containment training module.
6. Assess the need, develop a plan and implement the plan for fitting isolation valves to plugs in the older units. Alternatively, replace them with nozzles and blank flanges. Back weld plugs that do not need to be removed.
7. Address the training of fitters in the appropriate level of emergency response, considering the possibility of them being first responders.
8. Communicate the findings of this incident refinery wide to raise awareness.
What Went Well
1. The fitters assisted the operators with the first response.
2. The emergency responders reacted quickly, providing more than the required resources to avert escalation of the incident.
3. The fitters and operators openly contributed to the investigation.
Location of Incident: Refinery, Australia
Date of Incident: 12 June, 2007
Brief Account of Incident
The Distillate Ultrafiner was being shut down for maintenance. Part of the procedure called for soda ash washing of a heat exchanger bank. Temporary fittings were required to enable the soda ash wash. Work to prepare for blinding was being conducted by fitters while operators progressed the draining and depressuring of the unit. A plug on a heat exchanger was loosened to check if the heat exchanger was empty and depressured in preparation to installing a soda ash wash fitting. Upon the initial loosening some diesel came out of the tapered plug, but this stopped. Upon further loosening, the plug came out of the socket and ~400L of warm diesel flowed out of the exchanger under pressure. The diesel stream hit a concrete pillar, forming fine droplets. The diesel pooled and ran towards the vacuum distillation charge furnace. The diesel did not ignite. With an operator directing, the fitters responded in running out and manning fire hoses. The supervising operator isolated the heat exchanger bank from the source of pressure. The control room was contacted and instructed to sound the active aid alarm. Emergency responders arrived at the incident scene, relieved the fitters and mitigated escalation. The supervising operator installed the soda ash wash fitting when the system was depressured to re-establish containment. After securing the site, the diesel spill was removed by vacum truck.
Investigation Findings
The work was being done following an operations procedure with a blind list under the supervision of an operator. The supervising operator asked the fitters to second bolt a number of heat exchanger flanges to prepare for blinding. The operator and the fitters talked about the step of pulling a plug to install the soda ash wash fitting. The operator thought that he clearly communicated that the step of pulling the plug was not to be done until the blind was in place, after completely draining the heat exchanger bank and isolating it from the stabiliser.The fitters’ understanding was that the operator had instructed them to pull the plug and install the soda ash wash fitting. It was believed that the heat exchanger bank was open to drain to the pump out system. After initially loosening the plug, the fitters checked and confirmed that the figure 8 blind had been swung to the open position and the valves were lined up to the pump out drum. Subsequent checks confirmed that the pump out line was not blocked. The level in the pump out drum remained constant while the heat exchanger was thought to be draining (this is the subject of ongoing investigation). The fitters had conducted a personal job safety analysis (PJSA). The hazard of breaking containment on live equipment was not raised on the PJSA. The procedure had not been progressed to the stage where breaking containment was called for.
What Went Wrong (critical factors)
1. Containment was broken when it was not safe to do so. The plug was loosened based on the fitter’s understanding of the operator’s verbal instruction. The operator and the fitter did not have a common understanding of how far the procedure had progressed and whether or not it was safe to break containment.
2. Containment was broken by loosening a plug. Once the plug came out of the socket, it was impossible to control the outflow of diesel until the system could be isolated from fuel gas pressure.
3. There was no valve or flange on the plug hole to allow a safer means of checking the pressure and liquid level. Verification that the system was drained and depressured was by loosening the plug. This method was not appropriate.
Immediate Causes
1. Servicing of energised equipment. The heat exchanger bank was at stabiliser pressure using fuel gas, let down to flare. The heat exchanger bank had not completely drained when the plug was loosened.
2. Inadequate isolation of process or equipment. The plug was not a suitable form of isolation from the process to break containment because once the plug was removed from the socket the plug could not be replaced until the system had depressurised.
3. Inadequate equipment. The heat exchanger bank did not have an adequate or obvious means of determining that the shell side of the heat exchanger was fully drained and depressurised
System Causes
1. Human factors consideration. Verbal communications in the plant are susceptible to misunderstanding.
2. Inadequate implementation of policy / standards / procedures. In the procedure the step for isolating the heat exchangers from the stabilizer appears after the step to install the temporary fittings.The operating procedure was ambiguous on when to install the isolating blind on the shell side inlet of the heat exchanger. The step to install the blind appeared twice in steps K11 and L21. Step L21 appeared after the step (L13) calling for the installation of the soda ash wash fitting.
3. Inadequate assessment of needs and risks the plug was loosened without positive confirmation that the shell side of the exchanger was drained of liquid and depressurised.
4. Inadequate technical design. The heat exchanger bank requires periodic repair and maintenance. To prepare for this maintenance, the heat exchanger must be drained, gas freed and opened. The lack of an appropriate facility for checking that the heat exchanger is empty and depressurized represents and inadequate design.
5. Inadequate correction of prior hazard /incident. The hazard of the plug without an isolation valve was recognised and had been raised at previous turnarounds, but had not been corrected.
Summary of The Local Actions
1. As an additional safeguard, fitters are requested to only loosen and remove plugs,which do not have an isolating valve, in the immediate presence of the supervising operator.
2. Implement site measures/procedures on verifying depressurization / isolation prior to breaking containment, checking that they are in line with the new group isolation standard.
3. Consider implementing a process for unit shutdown where the state of each section between isolations is shown as they progress (e.g. on the process flow diagram).
4. Revise the Ultrafiner shutdown procedures, including; nitrogen purging and closure of valve to stabiliser to occur prior to breaking containment and connections of the soda ash wash fitting; and remove ambiguity about when to install blinds on heat exchangers.
5. Revise the breaking of containment procedure to include the hazards of pressure (hydraulic / pneumatic) and how to verify that something is depressurized. Develop a breaking of containment training module.
6. Assess the need, develop a plan and implement the plan for fitting isolation valves to plugs in the older units. Alternatively, replace them with nozzles and blank flanges. Back weld plugs that do not need to be removed.
7. Address the training of fitters in the appropriate level of emergency response, considering the possibility of them being first responders.
8. Communicate the findings of this incident refinery wide to raise awareness.
What Went Well
1. The fitters assisted the operators with the first response.
2. The emergency responders reacted quickly, providing more than the required resources to avert escalation of the incident.
3. The fitters and operators openly contributed to the investigation.
03 September 2007
Crane Overturned
Safety Incident Topic: Crane Overtuned
Location of Incident: Road Between Tank And Cooling Tower Area
Date of Incident: 15 January, 2007
Brief Account of Incident
A 50 tonnes crane being employed to lift pipes from ground level to a pipe rack 8 meters high located at the west side of the cooling tower. Prior to setting the pipes in place, it was required to blow out (clean) the pipe pieces. There was not enough space on the road between the cooling tower and tank area to extend both sides of the stabilizer fully so one side of crane stabilizer was not fully extended. When the crane operator lifted the pipes and rotated the crane, it overturned in the direction of the shortly extended stabilizer. The crane fell towards the tank area. The crane hook hit the vent pipe on top of the naphtha tank (at a height of 14m) then came to rest on top of the tank. The crane boom was jackknifed and rested on an acetic acid product line which was bent slightly. Fortunately, as the crane overturned slowly, there were no injuries or environmental problems.
Potential Outcome
- Naptha leak / acid leak- single or multiple leakCritical Factors
- West side of stabilizers to the tank area was not fully extended due to narrow working space.
- Crane rotated in the direction of the not fully extended stabilizers.
Immediate Root Causes
1- Crane stabilizers not fully extended both sides.
2- Crane operator miscalculated weight load on un-extended stabilizer side.
3- Detailed work procedure was not prepared prior to crane operation specifically.
System Root Causes
1- The crane company supplied 50 ton crane where 25 ton crane was requested-Last minute plan change required the crane to reset and change location to blow out the pipes.
2- Crane operator’s decision to continue without change of location; but only adjusting boom angle while rotating the boom
3- Employee observed first movement; boom was raised to a high angle and then rotated to prevent overturn.- Crane operator began to lift and commenced his turn simultaneously on return of pipe.- At this position on return run; crane stabilizers on the west side could not support the load causing the crane to overturn.
4- In summary:
- Work procedures insufficient to task
- Proper precautions had not taken
- The work procedure did not address specific crane issues.
- Lack of employee experience regarding crane operation and safety.
Key Actions
1- Another company contracted to bring 25 ton crane to complete remaining job and new safety procedures utilized during setup and completion of task.
2- Spread the narrow working place to extend all stabilizers fully according to newly revised work procedure
3- Specific safety protocols and procedures drawn up for use of heavy equipment within SSBP
4- All outside contractors to be monitored closely and to follow SSBP safety procedures while working within SSBP
5- Safety training plan for outside contractors to address safety issues while performing tasks for SSBP Lesson Learned
6- This incident is directly related with lack of sufficient safety procedures in place compared with other major big project. Therefore it is required to increase safety standards even if small project.
7- In the event of difference or deviation against original plan, new safety analysis for the situation should be performed within all authorized people.
Location of Incident: Road Between Tank And Cooling Tower Area
Date of Incident: 15 January, 2007
Brief Account of Incident
A 50 tonnes crane being employed to lift pipes from ground level to a pipe rack 8 meters high located at the west side of the cooling tower. Prior to setting the pipes in place, it was required to blow out (clean) the pipe pieces. There was not enough space on the road between the cooling tower and tank area to extend both sides of the stabilizer fully so one side of crane stabilizer was not fully extended. When the crane operator lifted the pipes and rotated the crane, it overturned in the direction of the shortly extended stabilizer. The crane fell towards the tank area. The crane hook hit the vent pipe on top of the naphtha tank (at a height of 14m) then came to rest on top of the tank. The crane boom was jackknifed and rested on an acetic acid product line which was bent slightly. Fortunately, as the crane overturned slowly, there were no injuries or environmental problems.
Potential Outcome
- Naptha leak / acid leak- single or multiple leakCritical Factors
- West side of stabilizers to the tank area was not fully extended due to narrow working space.
- Crane rotated in the direction of the not fully extended stabilizers.
Immediate Root Causes
1- Crane stabilizers not fully extended both sides.
2- Crane operator miscalculated weight load on un-extended stabilizer side.
3- Detailed work procedure was not prepared prior to crane operation specifically.
System Root Causes
1- The crane company supplied 50 ton crane where 25 ton crane was requested-Last minute plan change required the crane to reset and change location to blow out the pipes.
2- Crane operator’s decision to continue without change of location; but only adjusting boom angle while rotating the boom
3- Employee observed first movement; boom was raised to a high angle and then rotated to prevent overturn.- Crane operator began to lift and commenced his turn simultaneously on return of pipe.- At this position on return run; crane stabilizers on the west side could not support the load causing the crane to overturn.
4- In summary:
- Work procedures insufficient to task
- Proper precautions had not taken
- The work procedure did not address specific crane issues.
- Lack of employee experience regarding crane operation and safety.
Key Actions
1- Another company contracted to bring 25 ton crane to complete remaining job and new safety procedures utilized during setup and completion of task.
2- Spread the narrow working place to extend all stabilizers fully according to newly revised work procedure
3- Specific safety protocols and procedures drawn up for use of heavy equipment within SSBP
4- All outside contractors to be monitored closely and to follow SSBP safety procedures while working within SSBP
5- Safety training plan for outside contractors to address safety issues while performing tasks for SSBP Lesson Learned
6- This incident is directly related with lack of sufficient safety procedures in place compared with other major big project. Therefore it is required to increase safety standards even if small project.
7- In the event of difference or deviation against original plan, new safety analysis for the situation should be performed within all authorized people.
Subscribe to:
Posts (Atom)