Publication
Do Your Company's Written LOTO Procedures Sufficiently Detail the Measures for Verifying De-Energization?
Do Your Company’s Written LOTO Procedures Sufficiently Detail the Measures for Verifying De-Energization? [1]
Secretary Of Labor v. CITGO Petroleum Corporation [2] involved a case in which CITGO refinery employees were as- signed the task of isolating a pump from a crude oil unit so it could be serviced by a contractor. CITGO’s employees applied lockout-tagout (LOTO) and the contractor had begun work on the pump when a leak of flammable hydrocarbons was discovered. All employees were evacuated from the area. Approximately 30 minutes later, the leaked material ignited, which caused a fire that resulted in approximately $320 million dollars in damage to the refinery.
CITGO investigated the incident and discovered that the affected system had not been fully isolated. A ten-inch dis- charge valve had not been fully closed due to an internal obstruction thought to be foreign material rather than structural failure of the valve. According to the trial judge, the employer concluded that the root and contributing causes of the ac- cident primarily involved operator error— the failure of its employees to verify “zero energy.” OSHA determined that the site’s written LOTO procedures were inadequate because they did not contain “[s]pecific requirements for testing a machine or equipment to determine and verify effectiveness of lockout devices, tagout devices and other energy control measures” as allegedly required by 29 C.F.R. § 1910.147(c)(4)(ii)(D).
The site had made a significant effort to develop and implement an effective LOTO program. In light of the task-based variability in the required lockout-tagout (LOTO) procedures for complex chemical processes, the employer’s LOTO pro- gram relied upon generally applicable procedures, extensive training, and task-specific safe work permits, which allowed for the customization of LOTO procedures to a particular job. This approach is consistent with accepted industry practice.
The task of removing the pump involved eleven isolation points and multiple energy sources, all of which were identified in the safe work permit. The LOTO process for this task proceeded as follows:
- The responsible employees identified the scope of the work,
- The equipment operator prepared what is known as an “isolation list”, which set out the description and location of each isolation point, the size of the equipment to be isolated, lockset designations, lockbox numbers, and remarks applicable to specific isolation points. During the preparation of this list, employees “walked the line” of equipment within the scope of the isolation and ensured that all necessary isolation points were on the list.
- The isolation list was reviewed by a unit supervisor, who added more isolation points to the list and gave it his approval. Once this occurred, the isolation list became the master isolation list for the project.
- After the master isolation list was prepared, the equipment operators took steps thought to be effective in closing, locking and tagging all of the isolation valves, and inserting all blinds specified in the master list.
- Once a valve was closed or a blind was inserted, the equipment operator signed off on that isolation point on the isolation list to indicate that lockout had been implemented at that location.
- The areas between the isolation points were then drained and/or flushed.
- After the isolation measures were implemented, the equipment operator and the contractor walked the line again to verify that isolation had occurred. The contractor asked CITGO personnel to open a bolted line to further verify that no hydrocarbons remained in the isolated system.
- After 15 minutes, CITGO and the contractor were satisfied that the system was properly isolated and a work permit was issued to the contractor, which authorized performance of the work and provided a checklist to help workers identify job hazards and necessary safety precautions.
The judge’s opinion indicates that neither the master isolation list nor the safe work permit described the measures to be followed in verifying isolation. They were covered in CITGO’s generic LOTO procedure, which stated:
Before starting the work the Equipment Owner and Lead Worker shall review the job and perform a survey to
ensure all energy sources are isolated. The equipment Owner will verify equipment is de-energized by testing all
start/stop controls, and/or visual inspection of energy isolating devices.
In the course of the incident investigation, it was discovered that the valve stem on the partially open valve was still visi- ble after it had been hand-wrenched. Seven full threads of the valve stem extended out from the hand wheel. The valve was in a location that could only reached by a ladder or scaffold, which made visual verification of the position of this particular valve stem difficult.
In other words, it appears that the responsible employee had made the logical, but unfortunately incorrect, assumption that the valve was fully closed when he could no longer turn the hand wheel on the valve stem. That method of verification would not be appropriate in high hazard situations, such as isolation of steam lines, or isolation of a permit space, which requires double block and bleed or line breaking. This case suggests that method of verification also is not appro- priate where there is a credible risk of a valve being blocked open by foreign material and failure of isolation poses a significant risk of harm. Left for another day is the case that addresses the adequacy of a visual check of a valve stem as a means of verification.
Before starting the work the Equipment Owner and Lead Worker shall review the job and perform a survey to
ensure all energy sources are isolated. The equipment Owner will verify equipment is de-energized by testing all
start/stop controls, and/or visual inspection of energy isolating devices.
In the course of the incident investigation, it was discovered that the valve stem on the partially open valve was still visi- ble after it had been hand-wrenched. Seven full threads of the valve stem extended out from the hand wheel. The valve was in a location that could only reached by a ladder or scaffold, which made visual verification of the position of this particular valve stem difficult.
In other words, it appears that the responsible employee had made the logical, but unfortunately incorrect, assumption that the valve was fully closed when he could no longer turn the hand wheel on the valve stem. That method of verification would not be appropriate in high hazard situations, such as isolation of steam lines, or isolation of a permit space, which requires double block and bleed or line breaking. This case suggests that method of verification also is not appro- priate where there is a credible risk of a valve being blocked open by foreign material and failure of isolation poses a significant risk of harm. Left for another day is the case that addresses the adequacy of a visual check of a valve stem as a means of verification.
OSHA alleged a serious violation, stated as follows:29 CFR 1910.147(c)(4)(ii)(D): The procedures shall clearly and specifically outline the scope purpose,authorization, rules, and techniques to be utilized for the control of hazardous energy, and including, butnot limited to, the following:Specific requirements for testing a machine or equipment to determine and verify effectiveness of lock-out devices, tagout devices and other energy control measures.Crude unit (Vacuum Tower area) – On or about October 23, 2013, employees were required to lock outfor the removal of the 11GT-9A VTB Vacuum Tower Bottoms pump. The written energy control proce-dure (Isolation List – 11GT-9A VTB pump) did not clearly and specifically outline the requirements fortesting a machine or equipment to determine and verify the effectiveness of lockout devices, tagout de-vices, and other energy control measures. Employees were thereby exposed to the hazards associated with releases of petroleum hydrocarbons (Vacuum Tower Bottoms).
According to the trial judge, performance standards, such as the OSHA LOTO Standard, require an employer to identify the hazards peculiar to its own workplace and determine the steps necessary to abate them in light of what is reasonable, with the understanding that the level of detail required must be commensurate with the complexity of the process Because the purpose of the lockout procedure is to guide an employee through the lockout process, general procedures are not acceptable, at least in the context of a complex chemical process. The judge upheld OSHA’s position that a site’s LOTO procedures for verifying isolation must identify the location where verification of isolation is to occur and indicate the method which will be employed to verify isolation.
In light of the general nature of CITGO’s written procedure for verifying isolation, and considering the complexity associated with implementing LOTO in this context, the judge found that procedure to be inadequate, because there was nothing to guide the authorized employees through the entire LOTO process as required by the LOTO Standard. The trial judge also made it clear that an extensive training program is not an acceptable substitute for specific procedures: “To suggest, as Respondent has, that extensive training can take the place of a written procedure runs afoul of the very reason for the requirement in the first place—minimizing the element of human error.”
In this case, the trial judge found the generic verification procedure did not contain “specific requirements for testing a machine or equipment to determine and verify effectiveness of lockout devices ….” Left for another day would be a case where the procedure did contain “specific requirements,” but OSHA determined they were inadequate.
The parties stipulated that the LOTO Standard applied to the isolation of the pump, but it is unclear from the opinion as to what energy sources were contemplated by that stipulation and what energy sources were not adequately controlled. OSHA has provided only ambiguous and seemingly inconsistent descriptions of what it considers to be chemical energy sources as distinguished from thermal energy sources. If OSHA’s suggested definitions of chemical energy sources are read literally, it would appear that almost any failure to empty, flush and decontaminate any item of equipment could be viewed as a failure to comply with the LOTO Standard.
Another potentially challenging area involves the lockout of computer-controlled equipment where, unless the test function overrides the need for certain signals before a test movement is triggered, the pushing of a button would not be expected to detect whether the lockout was effective. In any event, it appears that employers will have to review portions of their LOTO procedures that have previously been taken for granted.
______________________________________________
[1]Lawrence Halprin is a partner at Keller and Heckman LLP, and a member of the firm’s Workplace Safety and Health, Litigation, Chemical Regulation and Environmental Practice Groups. This article is designed to provide general information on the covered topic. It may not be relied upon in making decisions in this area, does not constitute legal advice, and does not create an attorney-client relationship. The author welcomes comments on this article from interested readers.
[2]OSHRC Docket No. 14-0404, March 9, 2016.
[1]Lawrence Halprin is a partner at Keller and Heckman LLP, and a member of the firm’s Workplace Safety and Health, Litigation, Chemical Regulation and Environmental Practice Groups. This article is designed to provide general information on the covered topic. It may not be relied upon in making decisions in this area, does not constitute legal advice, and does not create an attorney-client relationship. The author welcomes comments on this article from interested readers.
[2]OSHRC Docket No. 14-0404, March 9, 2016.