ByDesign A technical publication of ASSE’s Engineering Practice Specialty Volume 13 • Number 3 Do Fall Protection Systems Need to Be Load Tested? D D ©ISTOCKPHOTO.COM/SOFIAWORLD D W By Kevin Wilcox hile the answer to the question, “Has this fall protection system been load tested?” is a simple yes or no, the answer to the underlying question, “Should this fall protection system be load tested, and if so, how?” is not nearly as simple. Load testing of fall protection systems should be conducted as part of a complete design program. Load testing is not Load testing can be a powerful tool for fall protection system designers, but the method is often misunderstood. a substitute for sound engineering practice. Many people believe that load testing of fall protection systems is required by law, ANSI standards or by both. The only requirement for load testing related to fall protection is found in the ANSI/ASSE Z359 and A10 families of standards. The standards contain provisions for load testing of manufactured fall protection equipment, such as harnesses, continued on page 8 1 ByDesign www.asse.org 2014 D PAGE 12 PTD PROCESS Proven Solutions PAGE 18 FALL HAZARDS Identifying Risks PAGE 21 RISK ASSESSMENT Fall Prevention PAGE 22 HUMAN FACTORS Inherently Safe Design For a complete Table of Contents, see page 3 Membership Welcome New Members Thanks to all Engineering Practice Specialty members and welcome to these new members. The practice specialty now has nearly 1,000 members. If you have any colleagues who might be interested in joining, please direct them to www .asse.org/JoinGroups for more information. ByDesign Engineering Practice Specialty Officers Administrator Terry Tincher ttinch@att.net Assistant Administrator Marjory Anderson mea2966@comcast.net Publication Coordinator Don Enslow enslowda@bp.com Publication Assistant Jim Harris jharris@cdc.gov RESOUrCES ©ISTOCKPHOTO.COM/ANDREWJOHNSON Engineering Information Trena Adair, Harbor Environmental & Safety Chandler Bane Christopher Banyai, GeorgiaPacific Lauren Bradshaw Bryan Carrington Melissa Colby, Spectra Energy David Curry Robert Dougherty, UTC Aerospace Alyssa Duncan William Dunlap, W.L. Gore & Associates, Inc. Ricardo Espinosa, Kimball International Kenton Heuertz, Aboitiz Power Mitchell Hora David Houle Wimberly Hoyle Rebecca King Carl Kraft, Lyondell Petrochemicals Michael Leach Eon Licorish Gabe Lorack Adam Lu William Mainord, Riverside Public Utilities Angie Meyer Fredrick Mlakar, Shaw Environmental & Infrastructure Michael Munoz, Southern Wine & Spirits Roger Poore Robert Ray Ryan Ricci, Alliance Pipeline Stephanie Richmond Tyler Ritland Anthony Rose, SWS Craig Ruberti Herbert Santos Ted Sberna Jennifer Schroeder Ernest Sholtz Robert Simon, Cooper Bussmann Johann Szautner, Szautner Forensic Engineering Jeremy Tjundes David Troutman, Wrigley Manufacturing Co. Nicholas Urbanowitz, Bunge North America Oilseed Processing Division Omote Victor, Aspon Oil Company Ltd. Ana Wauthion-Melgar James Weber, BNSF Railway Jacob Weis Joshua West, Occidental Oil & Gas Billie Willard, Ingredion Robert Yanez Deli Yu • Body of Knowledge Journal of SH&E Research International Resource Guide Networking Opportunities Publication Opportunities Volunteer Opportunities ASSE STAFF Manager, Practice Specialties Charlyn Haguewood chaguewood@asse.org Manager, Communications Sue Trebswether strebswether@asse.org Editor Jolinda Cappello jcappello@asse.org Publication Design Bethany Harvey bharvey@asse.org ByDesign is a publication of ASSE’s Engineer­ ing Practice Specialty, 1800 East Oakton St., Des Plaines, IL 60018, and is distributed free of charge to members of the Engineering Practice Specialty. The opinions expressed in articles herein are those of the author(s) and are not necessarily those of ASSE. Technical accuracy is the responsibility of the author(s). Send address changes to the address above; fax to (847) 768-3434; or send via e-mail to customerservice@asse.org. 2 ByDesign www.asse.org 2014 c o n t e n t s Volume 13 • Number 3 1 Do Fall Protection Systems PAGE Need to D Be Load Tested? 12 PAGE Proven Solutions From Prevention Through Design By Kevin Wilcox Load testing benefits include determining structural capacity for existing systems, as well as cost savings in design and construction of new fall protection systems. By Dave Walline 4Electrician Electrocuted PAGE Troubleshooting Envelope Manufacturing Machine An overview of an incident in which an electrician was electrocuted while troubleshooting a medium open-end envelope machine. Causal data from fatal and serious injury events suggest the decisions arising from the prevention through design process play a central role in avoidance of catastrophic events. D 18 PAGE Do Not Be Fooled by Falls By Thomas Kramer Properly identifying and evaluating fall hazards can help one more intelligently prioritize projects—with risk and other factors considered. 22How Do Human PAGE D Factors Influence Inherently Safe Design? Fall Hazard Risk Assessment & Ranking By Don Enslow A critical component of incident management is a sound incident investigation system that includes employee involvement and recognizes incident investigation techniques that focus on root-cause By Bethany Harvey processes and on all contributing factors, including human factors. Safety professionals must seek to identify all risks rather than focus on a few categories of risk. argeted etrics 26 T PAGE M Managing Fatalities & Serious Injuries for By Scott Stricoff While many organizations have some awareness of exposures, near misses and minor injuries that have high potential, few possess the consistent reporting, measurement and tracking visibility needed to address these precursors in sustainable ways. CONNECTION KEY Click on these icons for immediate access or bonus information V Video 21 PAGE W Website P PDF L Hot Link 3 ByDesign www.asse.org 2014 Ad Ad Link D Direct Link Electrical Hazards Electrician Electrocuted Troubleshooting Envelope Manufacturing Machine Massachusetts FACE Investigation: 12-MA-007-01 O n April 4, 2012, a 53-year-old male electrician (victim) was electrocuted while troubleshooting a medium open-end envelope machine. The machine’s blower was not working, and the victim was working to repair it. The victim was reaching into the machine to access wiring for the blower contained in an electrical junction box when he was electrocuted. Employer The employer is a manufacturer The victim had and printer of envelopes and stationery and has been in business been working extra for 24 years. The company has 82 employees, about hours to direct approximately 60 of whom work in the manufacthe project and turing department while 20 work sales and office positions. Three disconnecting and in employees made up the maintereconnecting any nance department in which the victim worked. Employees worked 5 electrical compo- days per week, through nents affected by Monday Friday. There the facility’s move. were two work shifts each day. Saturday was a designated maintenance day for the machines, a downtime when machine setters could come in to adjust the machines. Written Safety Programs & Training The victim was the company’s main safety and health representative/trainer. At the time of the incident, the company did not have a comprehensive safety and health program. New hires were provided with an orientation that included training on multiple safety and health topics, including machine guarding, lockout/ tagout, hazard communication and powered industrial trucks. During the site visit, it was reported that since the incident, the company had started to develop a safety and health program and was holding weekly planning meetings of management and key production staff to develop a safety committee. Victim The victim had been employed by the company as an electrician for approximately 7 years at the time of the incident. He held a valid master electrician license. The victim’s normal work schedule was first shift, Monday through Friday. For 2 months before the incident, he had been working extended hours in support of the company’s relocation. It was reported that the victim had worked about 12 hours the day before the incident and was on site at 5:00 a.m. or 6:00 a.m. on the day of the incident. Photo 1: A medium open-end envelope machine viewed from the front end. 4 ByDesign www.asse.org 2014 W STANDARD ANSI/ASSE Z244.1-2003 (R2008) Investigation At the time of the incident, the company had been moving its entire facility to the newly renovated factory building where the incident occurred. Reportedly, the victim was playing a large role in this move, overseeing the breaking down, moving and setting up/ reassembling of approximately 15 manufacturing machines. The move had started 1 month prior to the incident with the machinery being moved in stages so that production could continue with limited downtime. A few machines had Photo 2: The envelope machine’s blower motor. been split into two or three pieces and moved by a rigging contractor into the new facility. The victim Incident Location had been working extra hours to direct the project and The company was in the process of moving into a disconnecting and reconnecting any electrical compobuilding built around 1900 and historically operated nents affected by the move. The company contracted an as a fabric mill. The building had been recently renoadditional electrician to help with this process. vated to accommodate the envelope company. The The machine involved in the incident was one of entire building was more than 300,000 sq ft, and the the machines that had been split into two pieces for company was to occupy about half of that space. The the move. Splitting this particular machine required machinery was set up on the ground floor, which was a removing plates, which bridged the machine frame at large open space. approximately the midpoint of the machine’s length, and disconnecting all wiring/conduit and other compoEquipment nents, which crossed this midpoint (Photo 3, p.6). The The machine involved in the incident was a medium open-end envelope machine (Photo 1) that the company machine had been moved, reassembled, tested and running the evening before the incident. had owned for about 14 years. It was estimated that the machine was manufactured more than 30 years ago and perhaps as early as the 1960s. The machine was Figure 1 configured to punch and install an Envelope Machine’s Blower Motor address window on presized sheets of paper, fold and glue the envelope Power Supply Shown From Above With into shape and put on a strip of selfsealing glue with removable strip to Approximate Pathway of Conduit seal the envelope. The machine was equipped with a blower motor (Photo 2) that provided airflow to different sections of the machine through a series of hoses. The blower’s main function was to create negative air pressure on the underside of the transfer belts to keep the paper flat and in position as it passed from one process to the next. The blower motor was powered by 480 V through a three-phase format, (three powered lines and a neutral line), which ran through conduit and many junction boxes from the main fuse panel (Figure 1). 5 ByDesign www.asse.org 2014 The day of the incident, the machine setter/ operator had been scheduled to resume work as the machine was ready to use. While making adjustments, the machine operator noticed he could not hear the blower motor running and reported the issue. The victim discovered during his initial troubleshooting that the blower may have been running at a reduced power, and perhaps one of the electrical lines had shorted or disconnected after being set up at the new facility. The victim then continued to further troubleshoot the motor wiring, replacing some fuses in the main panel and apparently locating a short in the blower’s wiring. At the time of the incident, the victim was accessing a junction box located near the break in the machine at floor level (Photo 4). It was unclear if the victim was voltage testing to ensure that the junction box was de-energized or if he was continuing to troubleshoot. While accessing this junction box, he came in contact with an energized component and was electrocuted. It is suspected the current traveled from one hand, through his torso and out his other hand or perhaps another part of his body touching the machine. The machine operator noticed the victim looked like he was straining while reaching into the machine and walked over to offer assistance. He realized the victim was being electrocuted and pulled on the victim’s sleeve to move him away from the machine. The machine operator then yelled for help and another coworker called emergency medical services. The local fire department was at the site to inspect the fire alarm panel as part of the move into the renovated facility. A coworker informed fire department personnel of the incident, and they started to care for the victim. Local police, additional fire department personnel and state police arrived at the incident location. The victim was transported by ambulance to a local hospital where he was pronounced dead. Face Program T he NIOSH Fatality Assessment and Control Evaluation (FACE) program is a research program designed to identify and study fatal occupational injuries. The FACE program’s goal is to prevent occu­ pational fatalities across the U.S. by identifying and investigating high-risk work situations and then formulating and disseminating prevention strate­ gies to those who can intervene in the workplace. Investigations conducted through the FACE program allow the identification of factors that contribute to these fatal injuries. This information is used to devel­ op comprehensive recommendations for preventing similar deaths. Participating states voluntarily notify NIOSH of traumatic occupational fatalities resulting from spe­ cific causes of death, including confined spaces, elec­ trocutions, machine-related, falls from elevation and logging. FACE is targeting investigations of deaths associated with machinery, falls, energy production, deaths of youths under 18 years of age not covered by child labor hazardous orders and deaths of for­ eign-born workers. Nine state health or labor departments have cooperative agreements with NIOSH for conducting surveillance and on-site investigations and for recom­ mending prevention activities at the state level using the FACE model. For more information, contact Nancy Romano at ndr4@cdc.gov or (304) 285-5889. Cause of Death The medical examiner listed the cause of death as electrocution. Recommendations Recommendation 1: Employers should ensure that electrical circuits and equipment are de-energized and that lockout/tagout standard operating procedures are implemented and enforced prior to beginning work. Photo 3: The bridge plates at the envelope machine’s split point. 6 ByDesign www.asse.org 2014 Recommendation 2: Employers should provide and ensure that employees use appropriate PPE and tools for troubleshooting live circuits. Recommendation 3: Employers should develop, implement and enforce an injury and illness prevention program that addresses hazard recognition and avoidance of unsafe conditions. Recommendation 4: Employers should ensure that work is scheduled to allow for sufficient rest periods between work shifts. Recommendation 5: Machine manufacturers should implement the prevention through design concept to ensure the safety and health of machine users, including machine operators and maintenance workers. • Photos 4-5: The envelope machine’s junction box (view from left and right of bridge plate) where the worker contacted live wire. Z359 Fall Protection Code Now Available on Flash Drive V ersion 3.0 of the ANSI/ASSE Z359 Fall Protection Code is now available on a flash drive, allowing SH&E professionals worldwide to have instant and portable access to what is considered the definitive resource for fall protection. Initially released in 2007, the code is a series of coordinated standards and reference documents that establish the requirements for an effective and comprehensive fall protection management system. Version 3.0 includes the following standards: ANSI/ASSE Z359.0-2012, Definitions & Nomenclature Used for Fall Protection & Fall Arrest ANSI/ASSE Z359.1-2007, Safety Requirements for Personal Fall Arrest Systems, Subsystems & Components ANSI/ASSE Z359.2-2007, Minimum Requirements for a Comprehensive Managed Fall Protection Program ANSI/ASSE Z359.3-2007, Safety Requirements for Positioning & Travel Restraint Systems ANSI/ASSE Z359.4-2013, Safety Requirements for Assisted-Rescue & Self-Rescue Systems, Subsystems & Components ANSI/ASSE Z359.62009, Specifications & Design Requirements for Active Fall Protection Systems ANSI/ASSE Z359.7-2011, Qualification & Verification Testing of Fall Protection Products ANSI/ASSE Z359.12-2009, Connecting Components for Personal Fall Arrest Systems ANSI/ASSE Z359.13-2013, Personal Energy Absorbers & Energy-Absorbing Lanyards ANSI/ASSE Z359.14-2012, Safety Requirements for SelfRetracting Devices for Personal Fall Arrest & Rescue Systems ANSI/ASSE Z359.1-1992 (R1999)—Historical Document, Safety Requirements for Personal Fall Arrest Systems, Subsystems & Components ANSI/ASSE A10.32-2012, Fall Protection Systems for Construction & Demolition Operations ANSI/ ASSE Z490.12009, Criteria for Accepted Practices in Safety, Health & Environmental Training Click here for more information on the code or click here to purchase it. • 7 ByDesign www.asse.org 2014 cover story Do Fall Protection Systems Need to Be Load Tested? continued from page 1 lanyards and other PPE, but they do not discuss load testing of anchorages or anchorage connectors. Load testing can be a powerful tool for fall protection system designers, but the method is often misunderstood. Load testing is not given extensive or specific treatment in the codes and standards, so interpretation and sound engineering judgment are necessary to determine appropriate applications of this testing method. Load testing benefits include determining structural capacity for existing systems, as well as cost savings in design and construction of new fall protection systems. Load testing can also help prevent incidents and injuries on systems that are in use but have insufficient documentation to demonstrate their structural capacity. testing program can confirm the adequacy of the structural capacity and can yield the necessary documentation for their recertification. Likewise, load testing will expose any system deficiencies, mitigating the unknown hazard that may cause a failure. After all, a false sense of security might increase the risk of a fall. Confirm Existing Systems In some cases, load testing may be the only feasible way to determine structural capacity. Because fall protection systems are often installed on structures long after their initial construction, a variety of structural (and nonstructural) materials can serve as the substrate through which the fall protection loads must ultimately travel and be resisted. For the designer, this means that the structure to which the fall protection system is attached may not be readily assessed by analytical means. As with any construction project, installation of fall protection may vary widely in quality between projects Regulations & Standards and contractors. Load testing is often a valuable alternaExisting fall protection regulations and standards offer tive to structural analysis in locations where information only limited provisions regarding load testing. In fact, needed to perform a conventional analysis is not availOSHA does not address the subject at all. The ANSI/ able or when the structure cannot be assessed by convenASSE standards contain provisions for load testing of tional analytical methods. In some cases, fall protection manufactured fall protection equipment, such as harness- systems are installed without proper oversight or docues, lanyards and other PPE, but they mentation. In the author’s experience, load testing has do not discuss load testing of anchor- been conducted to verify that the installation was perLoad testing is ages or anchorage connectors. Many formed in accordance with proper construction methods manufacturers of subsystems, such a visual inspection of adhesive anchors installed often a valuable as horizontal lifelines, require that (e.g., into concrete cannot be relied on to evaluate the strength installers test the equipment to of those anchors). alternative to the verify that it was properly installed, structural analysis but this requirement rarely (if ever) System Redesign or Reconfiguration extends to testing the anchorage to Load testing may also be a useful tool in the reconin locations where the building structure. figuration or redesign of existing fall protection systems information needed Although the building code does for new applications and new loadings. Reuse of part not prescribe fall protection loads, or all of an existing system as part of a new fall protecto perform a con- the International Building Code tion design may be a cost-effective alternative to new contains a full section of regulaconstruction. Because of the evolving nature of fall ventional analysis tions for in-situ load testing of protection regulations and standards, loadings and usage is not available or building structures, written in the needs may change over a system’s lifespan. Load testof building code loading ing is a means of establishing structural adequacy for when the structure context conditions. Concerning window components of an existing system that cannot be readily cannot be assessed cleaning, the ANSI/IWCA I-14.1 analyzed for new loading conditions. Note that load teststandard addresses load testing of ing should not be considered a replacement for proper by conventional window cleaning anchorages, but its analysis. However, load testing is often useful in verifyof the topic is somewhat ing assumptions that must be made to proceed with engianalytical methods. treatment incomplete and ambiguous. More neering analysis. specifically, the standard does not Commissioning & Certification require load testing of anchors. It merely gives guidMany proprietary systems, such as horizontal lifeance in the event that a professional engineer deems lines, need to be certified or commissioned by the load testing necessary. In short, load testing of fall protection system anchor- installer or the designer prior to use. Manufacturers often require load testing as part of the certification process for ages is not required. their systems. This may also be true for systems requirWhy Load Test Fall Protection Systems? ing recertification. Although it is not required, a designer may choose to load test fall protection systems for many reasons. A load 8 ByDesign www.asse.org 2014 ©ISTOCKPHOTO.COM/FRANKY DE MEYER Load Testing Program Load testing of fall protection needs to be more than simply pulling on anchorages and giving them approval. A complete program includes an investigation phase with an approved group of carefully selected and designed load tests that address the specific components in question for the systems being tested. Testing requires deliberate planning of test logistics and complete documentation of the entire process. This documentation provides a vital record of work for future use. Pretesting Investigation Designers should investigate the fall protection systems and their supporting structures before testing. Performing this due diligence will limit the inherent risks associated with load testing of an existing structure. Without sufficient knowledge of the structure, it is not possible to reliably predict how it may behave when subjected to a concentrated test load. Furthermore, pretesting investigation aids in the selection of system components that will actually require a load test. In addition, the investigation informs the designer’s decision about the type of test that will most effectively test those components. For example, load testing is only useful if it provides information about how an anchorage will perform when loaded in the same direction as a force that a fall will generate. One would not conclude that an anchor in a roof could withstand a 200-lb pullout load just because a 200-lb person could stand on it. Office Investigation Several tasks should be performed in the office before the load testing begins. Designers should review any available documentation regarding installation of the existing fall protection systems to assess whether certain system components will require testing and to understand the overall quality of the installation. Designers should review structural drawings and perform calculations to identify building structures eligible for testing and to set safe limits for testing loads. At times, load testing may be ruled out by analysis for some structures that cannot handle the concentrated loads necessary to test certain system components. This in-house work lays the groundwork for effective test design and meaningful results. Potential Pitfalls & Disadvantages While load testing can be a valuable tool in the evaluation and design of fall protection systems, it has some drawbacks that should be considered before proposing a load testing program. Research & Development Any load testing program, even if similar to past projects, will need to be somewhat customized to the current project’s specific needs. This may include significant amounts of research, investigation and test development. The costs associated with the program development effort should be estimated at the outset so that the owner can decide whether the value added by the testing is worth the cost of bringing it to fruition. Risk of Accidental Damage/Liability Despite a designer’s best efforts, risks will remain during a load testing operation. While contracts and agreements with the client, testing agency and other concerned parties can limit the test designer’s liability, a lawsuit is always a possibility if collateral damage occurs. In most cases, the benefits will outweigh the risks, but those risks should always be kept in mind when pursuing load testing as means to a fall protection solution. 9 ByDesign www.asse.org 2014 Unfavorable Results Although load testing is designed to identify deficiencies in fall protection systems, too many unfavorable results eliminate the economic benefits of load testing. While discovering inadequate systems can help avoid incidents, failed systems must be rejected, removed, redesigned and replaced. Load testing then becomes an expensive extra step in the redesign and renovation of fall protection systems. If it is predicted that a group of systems will experience a high rate of failure during load testing, or if high failure rates are experienced in a sufficient sample of tests early in a program, the designer and client should consider abandoning load testing in favor of pursuing new design and installation. However, this situation is not likely to be revealed until substantial amounts of time and money have been invested in the development of a load testing program and the generation of a sufficient body of data. Practical Considerations The types of load tests employed in a fall protection testing program will vary between projects. The tests used will correspond to the specific system components identified for testing and will also vary based on the makeup of the building structure as well as the types of fall protection systems installed. Selection of a test type in a given application depends on what the test needs to prove and what component of the fall protection system needs to be tested. The designer should consider the following questions when selecting the tests used in the load testing program: •What am I trying to test? •How can it be isolated from the other system components? •Can a single test prove the capacity of multiple components? •Is a physical test required or will an inspection suffice? Although the planning and theory behind a load testing program are critical to achieving successful results, those results will only be valuable if the tests are well executed and well documented. Design professionals possess the greatest amount of responsibility for ensuring that the testing is a success and should, therefore, maintain an appropriate level of control over practical aspects of the testing, particularly if a third party is physically performing the tests. Laying the groundwork for proper field methodologies and documentation of test results will ensure that testing is delivered with the highest value possible. • Kevin Wilcox is principal at LJB Inc. Classroom@ASSE Upcoming Live Webinars (11:00 am - 12:30 pm Central) On-Demand Offerings March 12, 2014 ANSI/AIHA/ASSE Z10-2012: Standard for Occupational Health & Safety Management Systems Real Programs & Strategies That Ignite Employee Engagement Changing Behaviors: Balancing the Elements for Effective Safety Management Systems Temporary Workers Safety April 23, 2014 Applied Case Studies in EOHS Ethics May 14, 2014 International Society for Fall Protection Symposium Prevention Through Design Virtual Symposium ©ISTOCKPHOTO.COM/ONUR DÖNGEL Loss Control Virtual Event Making Metrics Matter Global Safety Experience Improving Safety Through Mobile Technology 10 ByDesign www.asse.org 2014 Join your fellow safety professionals at the muchanticipated Safety 2014 Conference. Experience best practices, emerging trends, develop new skills, build a powerful community of colleagues and revitalize your passion for the profession. You’ll come back refocused, revitalized, reconnected, READY. “Why would I travel so far to attend the conference? There are so many reasons . . . education, networking, social gatherings, international perspective, specialty discussions, exhibits, etc.” Natalie Skeepers, South Africa SAFETY 2014 PROFESSIONAL DEVELOPMENT CONFERENCE & EXPOSITION June 8-11, 2014 | Orange County Convention Center West Building | Orlando, FL www.safety2014.org | 847.699.2929 By Dave Walline, CSP PTD Process Proven Solutions From Prevention Through Design ©ISTOCKPHOTO.COM/DAVINCIDIG C ausal data from fatal and serious injury events suggest the decisions arising from the prevention through design (PTD) process play a central role in avoidance of catastrophic (life-ending or life-altering) events. Numerous studies and research reveal 20% to 50% of all mishaps reported indicate a design gap finding. From the author’s firsthand experience and study, fatal and serious events are at the high end of this percentage range. The central question is, What is holding back organizations from addressing design-related events head-on? The author believes a critical organizational and cultural blind spot exists. Through benchmarking with other SH&E professionals, he has found that most injury/illness data management systems used by organizations do not ask for, capture or highlight design-related causal factors. This data gap has caused latent, design-related conditions to go uncontrolled and undetected in most organizations. As a direct result, both existing and new designs continue to be operated or procured with inherent uncontrolled hazards and risks that can potentially cause serious mishaps. To avoid such design-related incidents, the author strongly suggests that SH&E professionals personally dive deep into their own organizations’ injury/loss experience if they have not done so already. By criti- cally examining previous incidents, startling answers can be uncovered. The author has gained new insight from his own experiences by drilling deeper into causal data from past mishaps. Other SH&E professionals can also discover compelling information that can be used to generate a stronger focus on PTD in their organizations. One key outcome of the author’s work has been the development of a design safety checklist centered on fatal and serious mishap prevention controls related to past events. This design-focused checklist has been a game changer for designing out fatal and serious mishap-related risks. preoperational stage. SH&E professionals must shift and even depart from traditional safety roles and daily job duties, such as compliance program writing, training, inspections and claims management, and must transition into risk avoidance and risk mitigation activities related to organizational planning, design, specifications, safety procurement specifications, design safety reviews, proven solution development and risk assessment. Based on the author’s informal research and discussion with many global SH&E professionals over the past 5 years, the SH&E community roughly spends its time as follows: 1) preoperational, 10% (avoidance PTD Skill-Building and elimination focus); To enhance their skill level and 2) operational, 70% (compliance efforts around PTD, SH&E proand retrofit focus); fessionals should first obtain and 3) postincident, 20% (claims read ANSI/ASSE Z590.3-2011, management, litigation, regulatory Prevention Through Design: issues); Guidelines for Addressing 4) postoperational, <1% (decomOccupational Hazards and missioning, demolition). Risks in Design and Redesign Today’s best organizations seek Processes. out innovative and creative SH&E Section 1.3 of the standard, professionals, but the SH&E job which is focused on application, description of tomorrow will likely states the PTD standard applies to look much different. Progressive four main stages of occupational employers will look for SH&E prorisk management: fessionals who possess these key core 1) preoperational; competencies (working in the preop2) operational; erational risk management stage): 3) postincident; 1) PTD; 4) postoperational. 2) risk assessment; The author believes for PTD to 3) management of change; come to the forefront of business deci4) fatal and serious injury presion making, the SH&E community vention; must begin to spend more time in the 12 ByDesign www.asse.org 2014 5) operational risk management system; 6) contractor risk management; 7) safety specifications for procurement; 8) human error and human performance. These core competencies are highlighted in ANSI/AIHA/ASSE Z10-2012, Occupational Health and Safety Management Systems, another document SH&E professionals should obtain, read, fully understand and adopt. SH&E professionals who possess these core competencies will bring the required leadership and creativity to their organizations and facilities by identifying, establishing and driving proven solutions into new designs and processes. The author believes future SH&E professionals should establish a career target (both time and skill set) to work 70% in the preoperational stage of risk management. In this stage, the business world sees the SH&E professional as a leader, valued business partner and risk mitigation advisor. Personal recognition and reward come with this new role. According to the author’s observations, SH&E professionals spend most of their time in a firefighting and/or compliance mode while making these common mistakes: 1) Assume their business leaders know what they should be doing next in SH&E (such as PTD). 2) Believe nothing can be done in PTD without a corporate edict or standard. 3) Think that PTD is to be left only to engineers and designers. 4) Fear that they will not perfectly implement PTD when starting out. 5) Wait for others to engage them in the PTD process. Safe Design Myths & Bad Design Hurt Organizations Five common myths must be dispelled and overcome to move an organization forward: 1) The design meets minimum compliance; therefore, it is safe. 2) PTD is cost-prohibitive. Highlevel controls are too costly. 3) PTD will slow down the project. We do not have time for design reviews and risk assessment. 4) The current/old design is safe enough. We have always done it this way. Our injury experience does not prove otherwise. 5) Low-level controls on the hazard-control hierarchy greatly reduce severity of harm. Bad designs can negatively influence an entire organization in the following ways: 1) serious mishaps; 2) low employee morale; 3) elevated risk levels; 4) human performance barriers; 5) product quality issues; 6) losses impacting profitability; 7) poor operating efficiency; 8) equipment and process reliability issues; 9) litigation; 10) poor public image; 11) higher labor costs; 12) compliance gaps; 13) waste and scrap; 14) business interruption; 15) customer expectations not being fulfilled. Proven solutions are myth-busters that address causal factors surrounding catastrophic events and have these key attributes: 1) risk avoidance; 2) hazard elimination; 3) severity reduction; 4) high level of control (control effectiveness); 5) remove barriers to safe work; 6) reduce burden costs (e.g., costly retrofitting, claims, compliance programs); 7) address both normal and abnormal conditions; 8) widely accepted by users; 9) positive impact on operating efficiency and maintenance; 10) easily incorporated into engineered designs and procurement specifications. Such solutions should be incorporated into a project at the earliest stage of the design process as performance objectives and design criteria and can be used to provide a tangible view of Proven solutions what achieving offer the rare acceptable risk looks like. opportunity to Proven soludesign out or to tions originate Proven Solutions: from the hieraravoid entire hazard/ PTD Culture Revolution chy of controls. Risk avoidance and hazard As presented exposure categories. elimination are proven solutions for in Z590.3, this designing out causal factors. These approach is solutions directly remove highthe preferred method of achieving potential risk factors often faced by acceptable risk in design through exposed groups, such as operations risk avoidance. Avoidance has the and maintenance personnel, congreatest net positive impact on safe struction workers and the public. design because it prevents hazards PTD decision makers and stakefrom entering the workplace though holders are responsible for risk design. When avoidance strategies control, and these entities include are used, no hazards need to be elimbusiness owners, customers, capital inated or controlled. project delivery teams, construction A good risk avoidance statement managers, design/build firms, engibegins with a “no” statement. Each neers, designers, machine builders/ no statement bears a proven solufabricators, operations and maintetion. Taking this approach may seem nance personnel and SH&E professtrange to many SH&E professionals sionals. Proven solutions provide a because avoiding risk can rarely be visible means to remove traditional accomplished. Most SH&E profescultural barriers in the form of false sionals tend to work in the reactive beliefs from design-for-safety efforts. or costly retrofit world and never 13 ByDesign www.asse.org 2014 14 ByDesign www.asse.org 2014 ©ISTOCKPHOTO.COM/NADLA b) work made accessible by fixed stairways/platforms; c) establishing a proper accessway for work-lifts. 2) An automated guided vehicle system eliminates forklift operations. 3) Electrical energy isolation, arc-preventive switchgear/motor control centers and diagnostic ports are used. 4) Piping system isolation valves are used at ground level, as are gauges and filters. 5) A trailer restraint system and dock door barrier guards are used. 6) Automated product conveyance and lifting systems are used. 7) Fully-enclosed chemical process and mixing systems are used. 8) Fall prevention, including perimeter guarding, skylight guarding and aerial lifts, is used live in the risk avoidance mindset or 5) No manual handling/lifting of 100% of the time during construcworkspace. manufactured products exceeding 45 tion. During the conceptual design lb by production employees. 9) Employees wear less PPE, not stage, risk avoidance and hazard 6) No elevated or remote energy more. elimination allow SH&E profesisolation points used for lockout/ 10) Devices are enabled under sionals to work and participate with tagout/try tasks. the exclusive control of maintenance design and project teams. Proven 7) No open chemical processing workers for approved troubleshootsolutions offer the rare opportunity to and mixing systems. ing tasks. design out or to avoid entire hazard/ 8) No unsecured trailers while 11) All hazardous energy isolation exposure categories. loading. points are at floor level within 3 m 9) No open electrical panels to Proven solutions create and shape of need. perform diagnostics or thermography. the bond between the SH&E com12) Employees are removed from 10) No fall hazards during buildmunity and engineering and design directly interfacing with powered ing construction. communities by allowing engineers machinery and equipment using 11) No congested or restricted and designers to do what they do barrier guarding and automated jamworkspace regarding people, equipbest—incorporate risk control meaclearing systems. sures into their designs and redesigns ment, maintenance and emergencies. 12) No direct interface between with confidence. PTD Influence on Exposure employees and powered machinery From 2009 to 2011, the author & Human Performance and equipment (during either normal worked on a large capital project in The only opportunity SH&E or abnormal conditions). China, a multimillion-dollar manuprofessionals and designers have to Upon completion of this project, facturing facility. He worked with impact severity of harm is during many of the 350 employees at this the design/build firm to incorporate the avoidance and elimination stage. proven solutions into the plant design new facility found their new work In some cases, substitution can also environment to be world-class and by placing each of the performance affect the severity of harm. Other worker-friendly. objectives into a no statement. The levels of control can only impact Sustainable, proven solutions are likelihood, not severity. result of this effort came with a nonow used on all projects based on exposure outcome. Examples of no The author highly recomthe no statements the author estabstatements included: mends that SH&E professionals lished for the China project. For 1) No portable ladders. obtain and read ANSI B11.0-2010, example: 2) No powered forklift trucks Safety of Machinery: General 1) Typical portable ladder tasks used in the manufacturing space. Requirements and Risk are designed out by 3) No elevated work. Assessment. Table 3 in this stana) relocating work at ground 4) No energized electrical work. dard, the hazard control hierarchy, level; outlines the influence each level of control has on risk factors, such as severity and likelihood. The table indicates that the greatest influence on eliminating or reducing severity of harm is at the elimination or substitution level. Based on the author’s experience, many SH&E professionals, engineers and others hold a false belief that low-level controls have a great impact on severity when they do not. Guarding and engineering controls are excellent risk control measures, but their primary purpose is to reduce likelihood, not severity. That is why control effectiveness and control maintainability are so important for sustainable protection. To prevent fatal and serious loss events, the focus on design must begin with avoidance and elimination because these highest-control levels relate directly to severity reduction. Proven solutions also support safe behaviors and eliminate many common human error factors. SH&E leaders begin to understand the affect of PTD in their organizations when they overhear project managers, business leaders and others make these statements: 1) “Design the work so it is easy to do it safely and difficult to do it wrong.” 2) “Severe injuries will have a greater impact on the organization than will stopping production to improve safety.” 3) “Someone who wants to do well never underestimates a bad outcome.” 4) “Administrative and PPE controls will never replace appropriate safeguarding.” 5) “We could be world-class if this process were not so poorly designed to begin with.” Proven solutions can significantly enhance human performance through avoidance and elimination of the following human error influencers: 1) high ambient noise; 2) poor ergonomics (e.g., layout, job setup, workspace); 3) PPE loading and barrier to job completion; 4) working in high ambient temperatures or poor lighting; 5) responding to routine process upsets and abnormal conditions; 6) performing complex work; 7) physically demanding work that leads to fatigue; 8) use of hand tools that draw a worker close to the hazard. The only opportunity SH&E professionals and designers have to impact severity of harm is during the avoidance and elimination stage. Proven Solutions Reduce Burden Costs A key PTD selling point often overlooked by the SH&E community and during design reviews is the long-term burden costs the organization will incur when hazards are not eliminated in the design or redesign phase. The SH&E community can identify and communicate burden costs when low-level controls are selected over one-time, high-level controls designed to avoid or eliminate hazards and risks. Most SH&E professionals spend the majority of their time in the operational and postincident phase due to: 1) burdensome oversight of regulatory-driven programs and claims management; 2) almost daily efforts to find scarce resources for retrofitting uncontrolled hazards associated with design gaps. Of special significance is the fact that burden costs, which can be extreme, must be maintained during the facility’s life expectancy. One example of how burden cost can add up over time is using portable ladders in a typical manufacturing setting. Based on the author’s experience, the burden cost for a new 500,000-sq-ft facility that has a planned lifespan of 50 years with intent to use portable ladders can run as much as $9.3 million. As an alternative, proven solutions to design out the 17 defined routine ladder tasks (for 175 ladder users) in the concept stage would require a one-time capital investment of $500,000. This is a noteworthy net positive capital investment and can prevent the facility from ever having a serious portable ladderrelated mishap. Any capital project always has two monetary spends. The first spend (pay now) is the cost of the new design, and the second spend (pay later) is the long-term burden costs. Long-term burden costs often far exceed the cost of an original design solution that would have eliminated the entire hazard category. The most commonly seen burden costs linked to a facility’s life expectancy are injury claim costs, compliance maintenance costs, retrofit costs, business interruption, operating inefficiencies, resource management and manpower costs. Many organizations continue to report falls from portable and fixed ladders, which are reflected in past and current data reported by OSHA and the Bureau of Labor Statistics. Often, falls from ladders can become life-ending or life-altering. Portable ladders also continue to appear on OSHA’s top 10 violations list. When looking at portable ladder use, the ladder and its user are both considered lower-level controls. A safe ladder and safe ladder user do not mean low severity, which is why ladder-related fatalities continue to be a commonly reported mishap. In 15 ByDesign www.asse.org 2014 Business Value & Benefits Gained from PTD A second key selling point for PTD is the benefits derived from safe project delivery. Safe designs offer organizations many benefits. For example, the new plant built in China incorporated many proven solutions into its design and saw these additional benefits: 1) Project came in $10 million under budget. 2) Reduced energy consumption. 3) Zero waste to landfill and overall net positive impact on the environment. 4) Plant sold out of its product line and achieved full production capacity ahead of plan. 5) High worker morale. 6) Operating efficiency targets achieved well ahead of plan. 7) Fifty innovative proven solutions incorporated into design (many hazard categories avoided or eliminated). 8) Plant design and all job tasks achieved an acceptable risk rating. 9) No reported serious mishaps or near-miss events since plant startup in 2011. 10) CEO and business leadershiplevel recognition given to the design team and project champion. The China project team is proud of the new facility, the project teamwork displayed and the outcome achieved. Proven solutions that avoid risk and eliminate hazards in design must be our legacy, not programs and firefighting. Knowing that 350 employees of a new facility can go 16 ByDesign www.asse.org 2014 home to their families at the end of each workday injury- and illness-free is the true reward. As SH&E professionals, walking into a new facility or operation during a ribbon-cutting event with the customer and other leaders and professionals reinforces the long-term impact our efforts have on those who will be working with the new design for years to come. SH&E professionals can showcase their overall value to organizations by designing to acceptable risk through sustainable high-level controls. Building a Proven Solutions Library PTD is a culmination of proven solutions (safe designs) to avoid risk and to eliminate hazards in new designs/redesigns. When the SH&E community works in partnership with engineers and designers over the next decade to incorporate proven solutions into designs, the net positive results will be the prevention of life-ending and life-altering mishaps globally. Establishing proven solutions is critical work that places SH&E professionals in the preoperational stage of risk management. Many resources are available to help SH&E professionals develop a proven solutions library. These include: 1) internal organizational data analysis related to design; 2) NIOSH; 3) ASSE’s Body of Knowledge; 4) ANSI/ASSE Z590.3-2011; 5) ASSE Risk Assessment Institute; 6) Design for Construction Safety; 7) Construction Industry Institute; 8) ASSE’s PTD Symposium; 9) OSHA; 10) lessons learned from completed design projects; ©ISTOCKPHOTO.COM/ARTYFREE fact, portable ladder use is a highrisk task. Our focus must shift from ladder compliance programs to ladder avoidance through design. The author uncovered a significant risk factor when performing an in-depth review of previously unseen causal factors related to poor design. The key risk factor discovered was the impact a congested or restricted access workspace has on worker safety. As most organizations and businesses attempt to cut project costs, a common approach is to reduce floor space or the facility’s footprint. This approach generally results in less workspace and/or restricted access to equipment for maintenance activities. It forces the facility’s operations management to purchase portable ladders because no workspace or access was provided for alternative safer designs, such as stairways, personal lifts and hoisting equipment. PTD Action Steps SH&E Professionals The SH&E community should take these actions to drive a cultural revolution around PTD. The rewards and benefits will be many, but the most noteworthy outcome will be the prevention of life-ending and lifealtering mishaps. SH&E professionals should follow these steps: 1) Create a design safety checklist from organizational incident data linked to design gaps. 2) Establish a personal goal to spend more time in the preoperational stage of occupational risk management. 3) Develop a critical skill set around PTD and risk assessment. 4) Apply a high level of control decision making in the design process with special focus on severity reduction. 5) Develop and use a proven solutions library that achieves risk avoidance or hazard elimination in design. 6) Identify and share long-term burden costs related to poor design for decision making with leaders and design teams. 7) Work to dispel common PTD myths. 8) Eliminate barriers to safe work through design. 9) Capture and communicate the benefits of safe design. 10) Make your legacy one that leaves a lasting net positive impact on the organization. assessment (B11.0). Houston, TX: B11 Standards Inc. ANSI/ASSE. (2011). Prevention through design: Guidelines for addressing occupational hazards and risks in design and redesign processes (Z590.3). Des Plaines, IL: ASSE. ANSI/ASSE/AIHA. (2012). Occupational health and safety management systems (Z10). Des Plaines, IL: ASSE. Conclusion Incorporating proven solutions into design is critical to the prevention of life-ending and life-altering mishaps. Proven solutions have global application and bring demonstrated value on many fronts when such an approach is adapted as part of an organization’s PTD culture and process. The pace of injury/illness prevention improvement during one’s lifetime is directly linked to the speed of change led and driven by the SH&E profession. Risk assessment and PTD must be at the forefront of these efforts. The SH&E community has the responsibility, creativity and power to support injury-free lives around the world. • David Walline, CSP, is a global safety leader for Owens Corning in Toledo, OH. Walline is a 35-year professional member of ASSE. Prevention through design (PTD), fatal and serious injury prevention and risk assessment have been his primary career focus. He has developed and implemented global risk assessment, PTD processes and training programs within organizations and also influenced the design and risk mitigation levels of projects worldwide. In June 2012, Walline received the CSP Award of Excellence from the Board of Certified Safety Professionals. He was a contributor to and served on the review committee for ANSI/ASSE Z590.3-2011, Prevention Through Design: Guidelines for Addressing Occupational Hazards and Risks in Design and Redesign Processes. He is chair of ASSE’s Risk Assessment Committee, which manages ASSE’s Risk Assessment Institute. He also served on the planning committee for and presented at ASSE’s PTD Virtual Symposium in February 2013. References ANSI. (2010). Safety of machinery: General requirements and risk Reprinted with permission from the proceedings of ASSE’s 2013 Fatality & Severe Loss Prevention Symposium. Safety 2014 Chapter Night Out A re you attending Safety 2014 in Orlando, FL? Don’t miss the Chapter Night Out on Tuesday, June 10 (7 p.m. to 11 p.m.) at WonderWorks. Sponsored by ASSE’s Central Florida Chapter, the event is a great way to meet other ASSE members and enjoy an entertaining evening as you explore exhibits throughout the upside down build­ ing that houses the indoor amusement park for the mind. The registration fee (adult $75; child, ages 4 to 12, $49.50) includes dinner buffet, dessert, unlimited soft drinks and the entire facility reserved exclusively for ASSE. 17 ByDesign www.asse.org 2014 ©WONDERWORKS 11) engineering and design community; 12) vendors and suppliers; 13) hourly workers; 14) benchmarking; 15. Safety in Design. Fall Hazards By Thomas Kramer, P.E., CSP Do Not Be Fooled by Falls Identifying Risk A fall protection program’s ultimate goal is to create a safer environment for workers. However, until all hazards are identified, it is difficult to develop an effective strategy to reduce risk. Fall hazards can be classified into three main categories: 1) Means of access. This is the manner of moving from one level to another. Examples include noncompliant ramps, runways and walkways; fixed stairs; fixed or portable ladders; and personnel lifts. 2) Locations. These are specific areas of immediate exposure to a fall hazard. Examples include unprotected sides, leading edges, elevated walkways, excavations, floor and wall openings, elevated conveyors, scaffolding, lights, overhead mechanical and electrical runs, roofs, pipe racks and tanks. 3) Tasks. These are actions that workers perform that expose them to a potential fall hazard, such as removing a guardrail when hoisting material up to a mezzanine. These hazards typically fall within three general categories: construction, production and maintenance. When identifying risk, it is also important to consider hidden hazards or hazards that are not always easy to recognize. Examples of hidden hazards include: •guardrail size, height, spacing and strength requirements; •roof edges; •swing gates on ladders; •access ladders or stairs between levels; •smoke/heat relief vents; •skylights; •paint booths; •false ceilings; •newly installed fall protection systems that may prove inadequate. Identification Methods It is infeasible to identify every hazard within a large facility or complex, but it is important to identify as many hazards as possible so that the fall hazards can be thoroughly evaluated. The four main methods of identification are: 1) suggestion programs; 2) use of statistics; 3) facility walkthrough; 4) wall-to-wall facility survey. Suggestion Programs Suggestion programs are the most cost-effective method used to identify fall hazards. They identify areas of particular interest through worker participation. These interest areas typically contain job tasks that workers feel uncomfortable performing because they know they are at risk of a fall. This method also allows a large group of workers to participate in the process. Although not trained in the identification of fall hazards, many workers know which frequently accessed areas are hazardous. An organization’s employees are often a wealth of information about continuous improvement. 18 ByDesign www.asse.org 2014 ©ISTOCKPHOTO.COM/ZOG F all hazards present two conflicting realities: significant fall incidents do not happen often, but when they do occur, they are catastrophic and costly. Just like most people did not think black swans existed, most organizations do not think they will ever have a fall fatality at their facility. In this way, fall fatalities can be viewed as black swan events. A black swan event is defined as one that meets the following criteria: •Rarity: Low probability of occurring. •Extreme impact: Consequences are significant or catastrophic. •Retrospective predictability: In looking back, they can be easily explained or predicted. The rarity of incidents can lull both management and workers into a false sense of security. But, managing the major risks presented by falls is a smart and ethical business investment—in addition to a legal requirement. Although regulatory agencies and standards committees highlight the value of fall hazard surveys or risk assessments as a critical step in a successful fall protection program, many organizations around the world do not address fall hazards or do so haphazardly. Many still devote money, time and resources toward the first fall hazard brought to their attention, while ignoring highrisk items. To avoid a black swan fall fatality, fall hazard risk must be systematically managed. Properly identifying and evaluating fall hazards can help one more intelligently prioritize projects—with risk and other factors considered. A clear picture of the hazards can help one best decide how to address them based on level of risk, priorities and budget—not on a first-come, first-served basis. A downside of the suggestion program method is that it is the least comprehensive. The method will identify some, but definitely not all, fall hazards. Often, it takes the skills of an experienced competent person in fall protection to identify hazards that the suggestion program method misses. Statistics A thorough review of statistics can help identify specific fall hazard exposures. The statistics are based on incidents that have resulted in citations, injuries and fatalities. Organizations can learn from these statistics and can apply them to similar situations. For example, statistics show that roof fall hazards account for approximately 20% of all fall fatalities. Therefore, one action item may be to identify roof fall hazard exposures. While this is beneficial, using the statistics method leaves out other hazards that do not fall into high-profile categories. Bureau of Labor Statistics provides much information relative to surfaces on which fall hazards occur. Also, NIOSH collects information and creates reports on certain occupational fatalities so the public can better understand how the incident occurred, learn from the mistake and share with others. NIOSH publishes these FACE reports on its website. Facility Walkthrough The facility walkthrough method is more facility-specific than the suggestion or statistics methods. However, this method is still not a complete comprehensive fall hazard survey. During a facility walkthrough, a competent or qualified person is brought in to serve as an objective set of eyes. The objective is to identify typical hazards—not every hazard. This individual also prioritizes typical hazards from a risk standpoint and estimates abatement methods and costs. This method allows the organization to estimate the order of the magnitude cost for a facility. Remember that because only typical hazards are identified, the number of hazards and the cost for abatement are only an estimate of the order of the magnitude. Wall-to-Wall Facility Survey The wall-to-wall, or in some cases, an inside-thefence facility survey is the most comprehensive method to identify hazards. This method requires competent or qualified persons with significant industry and fall hazard survey experience. Again, the competent or qualified persons’ goal is to objectively identify as many hazards as possible. Due to the vast amount of information collected, this method requires an experienced team and preplanning so that data can be collected and managed efficiently. Once data are collected, identified hazards must be ranked and prioritized before an abatement plan can be implemented to address the hazards. With the goal of identifying as many hazards as possible, this method goes beyond a typical survey. The wallto-wall facility survey is therefore the method of choice. Table 1 Typical Risk Assessment Code Chart 19 ByDesign www.asse.org 2014 Once fall hazards and the potential risks associated with them are identified, evaluated and ranked, leadership can use the information to create a validated budget, schedule and abatement strategy. Risk Assessment & Ranking A wall-to-wall facility survey or risk assessment focuses on the highest risk. The more efficiently risk is reduced, the better. So, rather than devoting resources to the most obvious hazards, organizations can use the risk assessment process to systematically identify, evaluate and control fall hazards. By directing the budget to the highest-risk items, organizations can then achieve maximum risk reduction for the investment made. During a comprehensive fall hazard risk assessment, detailed data are gathered on fall hazards. The data are analyzed to determine the probability and severity each hazard presents. In terms of probability, various factors must be considered: frequency of task, exposure time, number of workers exposed and likelihood of falls based on external influences. Severity is measured by determining fall distance and likely obstructions impacted during a fall. Many times, risk assessments are conducted using a simple risk matrix (Table 1, p. 19). However, especially for locations with hundreds or thousands of hazards, the information gained from such an assessment is not granular enough to be effective in long-term planning. Often, dozens of hazards will fall into one category, giving the program manager no indication of which hazards to abate first. When conducting a more granular risk assessment, the resulting data are organized into a prioritized list of hazards. This list can be organized by location, maintenance task and type of solution proposed—or in any other way that helps the organization manage abatements. Once fall hazards and the potential risks associated with them are identified, evaluated and ranked, leadership can use the information to create a validated budget, schedule and abatement strategy. Since organizations may not be able to address every hazard, the prioritized list provides guidance on what, when and how to abate hazards. This risk assessment method transforms an overwhelming list of hazards into a manageable plan with a beginning and end point. Program managers can use this information to report metrics on the amount of risk reduced for a given investment. Conclusion Falls are a misunderstood safety issue. The reality is that falls can and do cause fatalities and catastrophic losses. Conducting a risk assessment specific to falls can significantly reduce risk to the workforce and organization. • Thomas Kramer, P.E., CSP, is principal at LJB Inc. in Miamisburg, OH. A safety consultant and structural engineer with 18 years’ experience, Kramer specializes in the assessment and design of fall protection systems. He is a member of the ANSI/ ASSE Z359 Accredited Standards Committee for Fall Protection and chairs two subcommittees that develop standards for the design of active fall protection systems (Z359.6 and Z359.17). He also serves as president of the International Society for Fall Protection. Kramer holds bachelor’s and master’s degrees in Civil Engineering, as well as an M.B.A. He frequently speaks on fall protection at international, national and regional conferences. Reprinted with permission from the proceedings of ASSE’s 2013 Fatality & Severe Loss Prevention Symposium. Manufacturing Practice Specialty The Manufacturing Practice Specialty (MPS) began as a branch of the Management Practice Specialty in 2006 and became a practice specialty in 2008. MPS’s goal is to provide a forum for industry-specific issues in manufacturing facilities, such as metalworking, timber and lumber working, food processing, chemical, rubber, plastics and printing/publishing locations. In addition to publishing its triannual technical publication Safely Made, MPS helps develop technical sessions for ASSE’s annual Professional Development Conference, regularly sponsors webinars on timely manufacturing-related topics, holds conference calls and much more. Click here to join MPS today or click here to follow MPS on LinkedIn. 20 ByDesign www.asse.org 2014 Risk Assessment By Bethany Harvey Fall Hazard Risk Assessment & Ranking ©ISTOCKPHOTO.COM/IBLIST I n September 2013, LJB Inc. presented Understanding Risk Assessment & Ranking, a webinar on how best to identify fall hazards and prioritize preventive actions. Speaker Thom Kramer, P.E., CSP, the managing principal at LJB Inc. and chair of ASSE’s Professional Development Conference planning committee, explained that to abate fall hazards, safety professionals need to both evaluate their current methods of risk assessment and identify the top ten risks found in their facilities. According to Kramer, many fall hazards go undetected because workers may believe that a lack of incidents indicates that no risks are present. He warns that some safety initiatives, such as use of PPE and safer equipment, may lead workers to take more risks because they perceive their workplace as being safer than it really is. To effectively assess risks, safety professionals must seek to identify all risks rather than focus on a few categories of risk. For example, while hazards associated with edge distance and slippery conditions are most often taken into consideration, some personnel may overlook more unusual hazards, such as a loose bolt holding a ladder in place on a structure. Once all hazards have been identified, lists of those hazards must be kept for use in prioritizing concerns and in alerting workers to risks they may encounter. Kramer says that just like a grocery list, a list of haz- ards is necessary for remembering what the hazards are, where they are located and how quickly they need to be mitigated. He suggests using a risk matrix (Figure 1) to help determine which hazards require immediate attention. Such a matrix measures the severity of the potential incident against the probability that workers will be exposed to the hazard and can be used for assigning a numerical ranking to every hazard. For example, a hazard to which workers have probable exposure would result in a total temporary disability (TTD) and would receive a ranking of 2, meaning that it requires immediate attention but is not as urgent as a hazard that receives a ranking of 1. Simple risk matrixes have some limitations in their accuracy, so it is important to also calculate the maximum risk reduction possible in respect to the hazards identified and funds available for risk reduction strategies. Kramer stresses the need to identify all risks before mitigating according to a budget because companies run the risk of spending all of their available funds on the first risk they find, which may not be the most critical hazard to address. • Bethany Harvey is a communications and design assistant for ASSE and part of the editorial staff for Professional Safety. She holds a B.A. in Interdisciplinary Communications Mass Media from Elmhurst College. Figure 1 Simple Risk Matrix 21 ByDesign www.asse.org 2014 Human factors By Don Enslow, CSP How Do Human Factors Influence Inherently Safe Design? T ©ISTOCKPHOTO.COM/ABLUECUP he Engineering Practice Specialty is reinforcing the concepts discussed in ANSI/ASSE Z590.32011, Prevention Through Design (PTD): Guidelines for Addressing Occupational Hazards and Risks in Design and Redesign Processes, through various forums available within ASSE to increase visibility and focus on PTD. This article attempts to raise some questions regarding the relationship between what is referred to as inherently safe design (ISD) and the unpredictability of human behavior. By definition, inherently safe implies that the anticipation and quantifiable predictability of human response to workplace environments is integral to ISD. Theoretically, that is the basis and intent for ISD principles. ISD provides concepts to assist engineers and safety professionals in establishing and implementing design processes in anticipation of human error. Various causes and influences related to human factors are inherent to minor and major incidents, and they surface in almost every incident and near-miss. How many times have we documented incident causation factors to include operator inattention, misunderstanding or violation of a procedure, inadequate design specific to operating conditions and operator response, fatigue, ergonomics and the operator’s capability to respond? These causal factors represent only a fraction of contributing causes specific to human factors in incidents. Case Study In the U.S., the highest percentage of accidental loss of life is attributed to the operation of a motor vehicle, and a major contributor to these incidents is driver inattention. For motor vehicle incidents, human factor influences are relatively obvious; however, for some industrial incidents, they may not be as obvious. Challenges Early in his career, the author investigated an exploIn a perfect world with an unlimited budget and 100% sion and total loss of a hot oil heater on an offshore platpredictability in workplace scenarios/environments, form. The platform and associated process facilities were ISD’s goal would be the norm rather than the exceprecently constructed, and the platform was preparing for tion. History, education and technology have provided start-up and introduction of crude oil for phase separaa sound foundation for improving designs to accomtion into oil, gas and water. The separated oil and gas modate potential failures and human exposure to injuries were then to be introduced into pipelines for delivery to or fatalities. Four challenges that prohibit the execution onshore facilities and marketing. The water was recycled and integration of ISD into management systems and back into the reservoir. processes are perceived cost, lack of management accepTo facilitate separation, crude oil from the reservoir tance, limited competency and understanding of the con- needed to be heated. The expected volume of crude oil cepts, and perceived time/schedule constraints. was estimated to be 50,000 barrels per day for this platInherent to all four of these challenges is human form, and the size and capacity of the hot oil heater (the factors or “the scientific discipline concerned with the design included two heaters for platform operation at understanding of interactions between humans and other 100% capacity) was relatively large to ensure the approelements of a system and the profession that applies the- priate design for that volume of fluid. ory, principles, data and methods to design to optimize As the steps for platform start-up were initiated, it human well-being and overall system performance” was necessary to ignite the pilot flames for the hot oil (International Ergonomic Association, 2000). heaters. The pilots were maintained by ignited gas, and The unpredictability and multitude of influences that their operating controls ensured the appropriate ignitable affect human behavior and, ultimately, human factors, concentration of natural gas and oxygen prior to ignican seem overwhelming. It is important to recognize the tion. The operator responsible for the hot oil heaters was potential risk and exposure to a workplace that does not unable to initiate ignition of the pilots, and start-up was integrate human factors into management systems and delayed. The design of this heater was relatively new, design/process controls. and it was determined that it was necessary to consult with an expert who needed to be summoned immedi22 ByDesign www.asse.org 2014 ately and delivered to the platform via helicopter. This survival. Delaying start-up meant substantial financial created a 2-day delay in the logistics of organizing this and reputational risk. The platform’s geographical locavisit. Anxiety and tension within the operation were tion was susceptible to dramatic changes in weather and heightened, and the expectation for immediate results sea conditions that could delay start-up significantly if from this expert was the critical path for start-up and identified personnel were unable to travel to the platform product delivery. to evaluate the issue. The expert’s technical competence, Upon arrival of the heater expert and an evaluation experience and resume were good relative to his knowlof the pilot ignition controls, it was determined that the edge of control systems and this particular model of hot flame safety controls for the pilot system were inhibiting oil heater. This individual also understood his assignthe ignition system’s ability to work. The recommenda- ment to be to provide an immediate fix to the problem. tion was to defeat the pilot flame safety system and, The critical need was apparent, and if he could provide when it was thought to be appropriate (based on operaa quick solution, he would be a hero. Existing managetor observation), manually initiate the igniter. Under the ment systems and deviation processes from established expert’s observation, the recommended steps were foldesign control systems were not in place to prohibit lowed, which ignited a gas volume behavior that exceeded rational limthat exploded and blew the back of its and increased risk. the heater vessel several hundred In reflecting on this incident, the To better integrate author feet into the sea. Although the explocan recall many situations he sion’s magnitude was significant, no human factors into had been involved with or particione was injured. pated in as an investigator in which the inherently safe human factors influenced a system or At the time of the investigation, the root cause was determined to process that was designed to elimidesign process, be design failure of pilot ignition nate potentially catastrophic events. there must be control system. It was not inherently The most effective ISD is one that obvious to the responsible parties, not allow a system to operate recognition of how will nor was it inherent to the incident under at-risk operating parameters investigation process at the time, to human behavior can after discovering that someone has consider human factors as contributbypassed that control to allow the influence all aspects system to continue operating. ing factors to the incident. Looking back at that incident more than 35 of the operation Suggestions years later, it is apparent that human To better integrate human factors throughout the factors were indeed a major contribinto the ISD process, it is important uting factor. facility’s lifecycle. to recognize how human behavHuman factors influenced the ior can influence all aspects of the management systems, decisions operation throughout the facility’s and behaviors that resulted in the life cycle. A best practice is to initiate a process within undesired outcome. Human factors were also involved in management systems to continually evaluate safety decisions and acceptance during operation design for the systems including engineering and behavior-based prohot oil heaters. From design to construction to start-up, human factors played an influencing role in this incident. cesses. Management support is integral to this process’s effectiveness, and it is important to base measurement How many times can incidents be attributed to human and performance on key metrics. The term management factors? How does ISD play a role in the reduction of systems is an all-encompassing platitude that can lose potential risk of human factor failures? perspective in the day-to-day priorities of a workplace. The four challenges identified earlier in this article Management systems can also overwhelm an organizawere apparent in the hot oil heater incident. Perceived cost was a critical factor in the decision-making process to tion when attempting to integrate assurance processes from early design all the way through to final production. defeat the pilot ignition controls. At the time of the inciAccording to the late Trevor Kletz, a chemical process dent, oil prices were significantly lower than today and safety expert, “Some people have forgotten the limitathe world economy was struggling. The start-up of this tions of management systems. All that a system can platform was paramount to corporate financial well-being. do is harness the knowledge and experience of people. To the credit of the responsible platform operator, operaKnowledge and experience without a system will achieve tions were shut down and start-up was delayed until a less than their full potential. Without knowledge and second opinion was obtained. However, criteria for indeexperience, even the best system will achieve nothing.” pendent review focused on start-up, not on safe start-up. Experience has proven that integration of sound manAt the time of this incident, corporate culture and agement systems that reinforce recognition of human expectations within management were based on financial 23 ByDesign www.asse.org 2014 ©NIKOLAI OKHITIN/ISTOCKPHOTO.COM/THINKSTOCK; ©FUSE/ISTOCKPHOTO.COM/THINKSTOCK factors, as well as an appreciation for their influence in sustained safe operations, will provide economic success. The fundamentals are fairly simple; the sustained implementation and reinforcement of these practices and principles can be challenging. As always, it begins at the top. Management must establish the basis for safe operations and focus on continuous improvement. Managers must also have systems in place to measure performance and to correct deviations when required. A key to the successful endorsement of top management relies on their understanding and appreciation of these concepts. If the corporate standard is driven by key management systems and principles, managers will absorb and proactively reinforce the standard. What do good management systems look like? It is difficult to provide a one-size-fits-all template with the variety of processes and business applications that abound in the work environment; however, some fundamental components must be universally addressed. There must be a corporate code of operations that reinforces established safety standards and systems. The established standards and systems, at a minimum, must meet regulatory requirements and must integrate lessons learned specific to internal operations. Within that code of operations, ISD must be integrated into all design applications, whether for new facility start-up or facility renovation, including maintenance turnarounds. An additional component for success is employee involvement. Employees must be competent to provide the service for which they are hired but also must engage and embrace the established corporate standards. It is imperative that they participate in design reviews, hazard analyses, prejob safety assessments and development of standard operating procedures as well as understand management of change principles and standards. If the fundamentals of management and employee participation exist within an operation, performance must be continually measured and performance measurement standards that provide assurance for sustained operation must be integrated. Critical components of performance metrics must include measures and critical components to provide assurance that management systems function properly and that potential hazards are recognized and addressed. Employee recognition for promptly addressing risks is fundamental to sustaining this effort. Metrics also include continued monitoring of nearmiss events and incidents. A critical component of incident management is a sound incident investigation system that includes employee involvement and recognizes incident investigation techniques that focus on root cause processes and on all contributing factors, including human factors. If the investigation process uses a root cause identification process, human factors should be integral to this system. As a result of the investigation and findings, it is imperative that management reinforces the corrective actions and addresses any fundamental system errors that must be changed or calibrated. These fundamental errors may include proposed changes in the design process and evaluation of process safety controls that were thought to be inherently safe. • Don Enslow, CSP, is the process safety management team lead at BP Exploration Alaska. He has more than 35 years’ experience as a safety professional in the oil exploration and production and nuclear power industries. He is a principal member of the NFPA Technical Committee on Gaseous Fire Extinguishing Systems (GFE-AAA), NFPA 12, NFPA 12A and NFPA 2001. 24 ByDesign www.asse.org 2014 FY 2013 ly ent Most FrequHA Cited OS Standards leased a list OSHA has re uently cited freq . of its most for FY 2013 . s rd a stand ry r a summa Click here fo CAN’T THINK OF A SOLUTION TO THAT REALLY BIG EHS CHALLENGE? It will be okay with the ASSE Body Of Knowledge Your source for SH&E Answers and Solutions Get started at www.safetybok.org Sponsored by SaFety Management By Scott Stricoff Targeted Metrics for Managing Fatalities & Serious Injuries F or decades, the safety community has adopted conventional wisdom, which holds that a reduction in the incidence of minor injuries will bring about a proportional reduction in the incidence of serious injuries and fatalities (SIFs). This thinking emanates from H.W. Heinrich’s Safety Triangle, a visual construct of Heinrich’s Law, which has informed this paradigm (Figure 1) suggesting that organizations should address minor injuries (and near-misses) as a means of reducing serious injuries and fatalities. Despite the longevity and pervasiveness of this paradigm, the reality that has played out in numerous organizations contradicts many of Figure The Traditional the basic relationships the paradigm espouses. Over the past several years, many organizations have experienced a consistent decline in their occupational injury rates while concurrently experiencing level or even increasing numbers of fatalities and serious injuries. This pattern has been seen at the site, organizational and national levels and raises important implications and questions about how SIF prevention is approached and the validity of this long-held model. Fundamentally, the traditional model claims two basic relationships: 1) Descriptive. An inverse relationship exists between the frequency of an injury and the severity of an injury. 2) Predictive. Reductions in less serious injuries will 1 produce proportionate reductions in more Paradigm serious injuries. In examining these issues, a comprehensive set of data from seven large organizations was studied. The findings of this study showed that while the Heinrich triangle is indeed accurate descriptively (there is a higher incidence of minor injuries than serious injuries), it is not accurate predictively (reducing minor injuries at the base of the triangle does not produce proportional reductions throughout the rest of the tri26 ByDesign www.asse.org 2014 angle). The study further found that a subset of total injuries and exposures is disproportionately responsible for serious injuries and fatalities. Pitfalls of Inadequate Performance Measurement To assess the comprehensive effectiveness of their safety management capability, many organizations have relied primarily on lagging indicators, such as recordable injury rates. The attractiveness of metrics, such as these, is understandable. They are relatively easy to collect, classify and understand, and in many cases, governing bodies mandate the reporting of these metrics. However, this disproportionate focus and overreliance can mask many serious safety issues that lie below the surface of awareness generated by these indicators. Over the past several years, numerous catastrophic workplace incidents have occurred (e.g., BP Texas City, Qinghe Special Steel Corp., Upper Big Branch Mine and Deepwater Horizon) that clearly illustrate this problem. In virtually every case, the catastrophic incident was preceded by extended periods of low, very low or improving recordable injury rates. Prior to these incidents, asking the executives of these organizations, “How are you doing in safety?” would have likely generated a response of “We are doing great. Our injury rates have never been lower.” But clearly, serious safety issues persisted outside of their view. To manage SIFs more effectively, it is important for organizations to measure more than just the incident frequency and severity. They must effectively measure their exposure to the types of incidents that can produce SIFs. This marks a critical shift in focus from lagging indicators to leading indicators for a more proactive approach to preventing SIFs. More specifically, this approach requires establishing methods of classifying exposures and incidents to create a new metric—potential SIFs. By tracking potential SIFs in addition to the traditional measures discussed, an organization can generate a much clearer picture of its progress. Further, sound evaluation of the exposures that contribute to potential SIFs allows for tailored mitigation programs that focus squarely on those areas of concern. Measuring & Classifying Potential All exposures are not equal when it comes to their potential to generate SIF events. Data analyzed in the aforementioned study that examined the validity of Heinrich’s Triangle found that only 21% of the injuries classified as minor had the potential to produce an SIF outcome. That is not to say that the other 79% of injuries are not important but rather that these incidents require a different prevention strategy. To further illustrate this point, consider the following two incidents, both of which produce an identical injury: Incident 1: A worker steps off the bottom step of an outside stairwell onto the ground’s gravel surface. In carrying out this action, he loses traction and sprains his ankle. Incident 2: A worker steps up from the top step of an outside stairwell onto a roof’s gravel surface. As he shifts his weight to the foot in contact with the gravel surface, he loses traction and sprains his ankle. In this case, the most obvious variable that influences potential is where the event occurred. Because the second incident occurred at significant height, the worker could have fallen down the stairs or even off of the roof surface if proper controls were not in place. Because the first incident essentially occurred on the ground, an extended fall would not be a possible outcome. Although these two incidents produced the same injury outcome, the second incident has a higher potential to produce an SIF event, whereas the first incident is not likely to produce anything significantly beyond the relatively minor injury that occurred. Yet in many organizations, these incidents would be identically classified because of the misplaced focus on outcome and lack of attention to potential. To manage SIFs more effectively, it is important for organizations to measure more than just the frequency and severity of accidents. By evaluating and tracking measures such as the quantity, frequency and percentage of injury and nearmiss events occurring inside the organization that have the potential for SIFs, a better sense is gained of the likelihood that a serious, fatal or catastrophic event will occur. Importance of Precursors Precursor events are defined as high-risk situations in which management controls are absent, ineffective or not complied with and which will result in a serious injury or fatality if allowed to continue. Precursors can be identified through proper evaluation of incidents like the ones discussed by studying data on exposure and via careful analysis of injury reports, near-misses, safety observations and audit findings. Creating an SIF precursor metric requires having a method for iden- tifying those incidents that are SIF precursors. Three general methods have been employed: •Outcome-based. Using the result as a basis for classification. Although easy to implement, this does not identify SIF precursors accurately, as the previous discussion illustrates. •Judgment-based. Using professional judgment to assess whether the event could have resulted in an SIF. With this approach, it is virtually impossible to achieve consistent classification as different raters will assess potential differently based on their personal judgment about probability and outcome. •Event-based. Using characteristics of the event to identify those with SIF potential. This approach risks missing some SIF precursors but can capture most with consistent screening that can be done at the local level. When using the event-based approach, particular activities more naturally lend themselves to producing higher proportions of precursor events. Examples of these activities include: •operation of mobile equipment and interaction with pedestrians; •entering confined spaces; •performing jobs that require lockout/tagout; •operations that entail suspended loads; •working at height. Beginning with a generic SIF classification decision tree, an organization can perform a one-time customization. A small group applies the generic decision tree to the organization’s incident experience (injuries, near-misses and process safety events). After identifying most events that are defined by the generic tool as SIF precursors and nonprecursors, a group of unclassified events will remain. The small group then conducts a one-time judgment-based assessment of the unclassified events and from those selected as precursors modifies the generic decision tree to create a tree customized to the organization’s exposures. That 27 ByDesign www.asse.org 2014 Conclusion While many organizations have some awareness of exposures, nearmisses and minor injuries that have high potential, few possess the consistent reporting, measurement and tracking visibility needed to address these precursors in sustainable ways. A reliable, effective system to capture, report and address precursors minimizes the elevation of trivial events. While all incidents should be reported and accompanied by some level of investigation, the SIF potential of events must be carefully considered to inform the depth and scope of investigations. The system to address precursors also dispels beliefs that an SIF is just a fluke or unpreventable event. With sound precursor data, leaders who have said, “We do not know where to start” or “We do not know where these events are stemming from,” will be empowered with information that answers these commonplace concerns by showing them a subset of events on which they need to focus. In addition, the system lowers serious injury rates. Having a sharpened focus on events with SIF potential means that resources, which previously had been largely wasted in addressing trivial events, can instead be allocated to reduce exposures to SIFs. The information outlined in this article suggests that significant flaws exist in the way many organizations think about and address serious injuries and fatalities. Further, it suggests that a new metric must be developed for SIF precursors. What gets measured gets managed, so developing and implementing an SIF precursor metric is a key step toward understanding how to better focus various safety interventions toward reducing the frequency of the most serious events. • Scott Stricoff is president of Behavioral Science Technology Inc. in Ojai, CA. Reprinted with permission from the proceedings of ASSE’s 2011 Prove It! Measuring Safety Performance Symposium. ASSE Elections: Vote Today! V oting in the 2014 ASSE Election is underway, and this process is important. In the coming years, the Society will address several critical stra­ tegic issues concerning the path forward for both ASSE and the safety profession. These issues affect not only your practice specialty, but your liveli­ hood. By staying informed and voting, you play an important role in deciding who will lead ASSE. It is a critical responsibility of membership, and ASSE encourages you to: •Get to know the candidates at www.asse and platform statements posted at www.asse .org/elections. Please contact Geri Golonka or Kim McDowell with any questions. .org/elections. •Cast your vote by March 31. Ballots have been sent via e-mail to all mem­ bers except those who elected to receive a mailed ballot. Voting instructions and additional informa­ tion about candidates, along with interviews, bios 28 ByDesign www.asse.org 2014 ©ISTOCKPHOTO.COM/KONSTANTINOS KOKKINIS ©ISTOCKPHOTO.COM/KENISHIROTIE customized decision tree can then be used throughout the organization to drive event-based classification of all incidents, providing a SIF precursor metric. ASSE Practice Specialties GET THE MOST FROM YOUR MEMBERSHIP Academics Manufacturing Construction Mining Consultants Oil & Gas Engineering Public Sector • Network with industry professionals via LinkedIn Environmental Risk Management/ • Engage in conference calls and meetings Fire Protection PRACTICE SPECIALTIES Insurance Ergonomics Training & Communications • Receive triannual electronic technical publications Healthcare Industrial Hygiene Transportation • Access interviews with top industry professionals International Utilities Management • Earn COCs through multiple publication opportunities BRANCHES • Tap into advisory committee guidance and advice • Explore volunteer and leadership opportunities • Receive discounts on group-sponsored webinars Agricultural Human Resources Health & Wellness Military COMMON INTEREST GROUPS • Request group sponsorship on conference speaking proposals Blacks in Safety • Participate in mentoring services Safety Professionals Women in Safety Engineering Engineering Young Professionals in SH&E & the Latino Workforce Learn more about the benefits you receive as an Engineering Practice Specialty member at www.asse.org/ps. Similar benefits are available through all of ASSE’s industry and interest groups. Networking A S S E ® AMERICAN SOCIETY OF SAFETY ENGINEERS Mentoring Industry Guidance 1800 E. OAKTON ST, DES PLAINES, IL 60018 Publications | p: +1.847.699.2929 Leadership | email: customerservice@asse.org WWW.ASSE.ORG