NIOSH: Preventing Fatalities

Number of Workers Killed
No detailed national data are available on the number of workers killed each year by contact with uncontrolled Hazardous Energy. However, during the period 1982 - 1997, NIOSH investigated 1,281 fatal incidents as part of their FACE Program. Of these, 152 involved installation, Maintenance, service, or repair tasks on or near machines, equipment, processes, or systems. Because the FACE program was active in only 20 States between 1982 and 1997, these fatalities represent only a portion of the U.S. workers who were killed by contact with uncontrolled hazardous energy.

Current Occupational Safety and Health Administration (OSHA) standards for general industry are established to prevent injuries and fatalities from contact with Hazardous Energy [29 CFR 1910.147]. This standard requires employers to "establish a program consisting of energy control procedures, employee training and periodic inspections to ensure that before any employee performs any Servicing or Maintenance on a machine or equipment where the unexpected energizing, startup or release of Stored Energy could occur and cause injury, the machine or equipment shall be Isolated from the Energy Source, and rendered inoperative."

Other OSHA standards for general industry cite the need for de-energizing electrical energy and locking and tagging electrical circuits and equipment before performing Maintenance and Servicing tasks. The following OSHA standards contain Lockout/Tagout-related requirements:
1910.146 - Permit-Required Confined Spaces
1910.177 - Servicing Multi-Piece and Single Piece Rim Wheels
1910.178 - Powered Industrial Trucks
1910.179 - Overhead and Gantry Cranes
1910.181 - Derricks
1910.213 - Woodworking Machinery
1910.217 - Mechanical Power Presses
1910.218 - Forging Machines
1910.261 - Pulp, Paper, and Paperboard Mills
1910.262 - Textiles
1910.263 - Bakery Equipment
1910.265 - Sawmills
1910.269 - Electric Power Generation, Transmission, and Distribution
1910.272 - Grain Handling
1910.305 - Wiring Methods, Components, and Equipment for General Use
1910.306 - Specific Purpose Equipment and Installations
1910.333 - Selection and Use of Work Practices

OSHA standards for construction also contain requirements for protecting workers from electrical hazards [29 CFR 1926.416 and 29 CFR 1926.417]. These standards require that workers exposed to any part of an electrical power circuit be protected through de-energizing and grounding the circuit or through appropriate guarding. These standards also require that all de-energized circuits be rendered inoperable and tagged out.

Workers may be exposed to Hazardous Energy in several forms and combinations during installation, Maintenance, service, or repair work. A comprehensive hazardous Energy Control Program should address all forms of hazardous energy [NIOSH 1983]:
  •  Kinetic (mechanical) energy in the moving parts of mechanical systems
  •  Potential energy stored in pressure vessels, gas tanks, hydraulic or pneumatic systems, and springs (potential energy can be released as hazardous kinetic energy)
  •  Electrical energy from generated electrical power, static sources, or electrical storage devices (such as batteries or capacitors)
  •  Thermal energy (high or low temperature) resulting from mechanical work, radiation, chemical reaction, or electrical resistance

As part of the FACE Program from 1982 through 1997, NIOSH investigated 152 fatal incidents in which workers contacted uncontrolled Hazardous Energy. The following case reports summarize five of these investigations.

Case No. 1 - Uncontrolled Kinetic Energy
A 25-year-old male worker at a concrete pipe manufacturing facility died from injuries he received while cleaning a ribbon-type concrete mixer. The victim's daily tasks included cleaning out the concrete mixer at the end of the shift. The clean-out procedure was to shut off the power at the breaker panel (approximately 35 feet from the mixer), push the toggle switch by the mixer to make sure that the power was off, and then enter the mixer to clean it.

No one witnessed the event, but investigators concluded that the mixer operator had shut off the main breaker and then made a telephone call instead of following the normal procedure for checking the mixer before anyone entered it. The victim did not know that the operator had de-energised the mixer at the breaker. Thinking he was turning the mixer off, he activated the breaker switch and energized the mixer. The victim then entered the mixer and began cleaning without first pushing the toggle switch to make sure that the equipment was de-energized. The mixer operator returned from making his telephone call and pushed the toggle switch to check that the mixer was de-energized. The mixer started, and the operator heard the victim scream. He went immediately to the main breaker panel and shut off the mixer.

Within 30 minutes, the emergency medical service (EMS) transported the victim to a local hospital and then to a local trauma centre. He died approximately 4 hours later [NIOSH 1995].

Case No. 2 - Uncontrolled Electrical Energy
A 53-year-old journeyman wireman was electrocuted when he contacted two Energized, 6.9-kilovolt bus terminals. The victim and two co-workers (all contract employees) were installing electrical components of a sulfur dioxide emission control system in a 14-compartment switch house.

The circuit breaker protecting the internal bus within the switch house had been tripped out and marked with a tag, but it had not been secured by locking. This procedure was consistent with the Hazardous Energy control procedures of the power plant.

The victim and his co-workers were wiping down the individual compartments before a pre-startup inspection by power plant personnel. Without the knowledge of the victim and his co-workers, power plant personnel had Energized the internal bus in the switch house. When the victim began to wipe down one of the compartments at the south end of the switch house, he contacted the A-phase bus terminal with his right hand and the C-phase bus terminal with his left hand. This act completed a path between phases, and the victim was electrocuted.

A co-worker walking past the victim during the incident was blown backwards by the arcing and received first-degree flash burns on his face and neck. A second co-worker at the north end of the switch house heard the explosion and came to help. He notified the Contractor's safety coordinator by radio and requested EMS. The EMS responded in about 15 minutes and transported the victim to a local hospital emergency room where he was pronounced dead [NIOSH 1994].

Case No. 3 - Uncontrolled Kinetic Energy
A 38-year-old worker at a county sanitary landfill died after falling into a large trash compactor used to bale cardboard for recycling. The cardboard was lifted 20 feet by a belt conveyor and fed through a 20- by 44-inch opening into a hopper. The hopper had automatic controls that activated the baler when enough material was collected in the baling chamber. When the baler was activated, material in the chamber was compressed by a ram that entered the chamber from the side. Excess material above the chamber was trimmed by a shearer.

On the day of the incident, cardboard jammed at the conveyor discharge opening. Without stopping, de-energizing, or locking out the equipment, the victim rode the conveyor up to the discharge opening to clear the jam. He fell into the hop per and the baling cycle was automatically activated, amputating his legs. The victim bled to death before he could be removed from the machine [Colorado Department of Public Health and Environment 1994].

Case No. 4 - Uncontrolled Potential Energy
The 32-year-old owner of a heavy equipment Maintenance business died after a wheel and tire assembly exploded during repair work. The victim was re-moving the assembly from a test roller when it exploded and struck him with the flying split rim of the wheel.

The test roller was a large, two-wheeled cart that carried about 60,000 pounds of concrete weights. The roller was used in highway construction to test road surfaces for proper compaction. The victim had been working as a subcontractor to repair the wheel and tire assembly, which had been smoking earlier in the day and was believed to be rubbing against the concrete weights. The assembly consisted of a two-piece outside rim and an inside ring retainer that was held together and mounted on the axle by 20-wheel bolts and nuts. The normal air pressure for the mounted tire was 70 psi.

The victim raised and Blocked the roller. Without discharging the air from the tire and using no personal protective equipment, he began to remove the wheel nuts using a pneumatic impact wrench. He had no training or experience with this type of work or in the Servicing of this type of wheel. He did not realize that only some of the bolts held the wheel-tire assembly to the axle. The remainder held the outer half of the rim to the inside half, securing the tire to the wheel. As the victim removed the nineteenth wheel nut, the pressurized air in the tire discharged explosively, causing the split rim to fly off the wheel and strike him. He died from cerebral contusions and lacerations [Minnesota Department of Health 1992].

Case No. 5 - Uncontrolled Kinetic and Thermal Energy
A 33-year-old janitorial worker died after he was trapped inside a linen dryer at a hospital laundry while cleaning plastic debris from the inside of the dryer drum. The cleaning task (which usually took 15 minutes to an hour) involved propping open the door to the dryer with a piece of wood and entering the 4- by 8-foot dryer drum. The melted debris was removed by scraping and chiselling it with screwdrivers and chisels. The dryer was part of an automated system that delivered wet laundry from the washer through an overhead conveyor to the dryer, where it was dried during a 6-minute cycle with air temperatures of 217° to 230°F. The system control panel was equipped with an error light that was activated if the dryer door was open, indicating that the dryer was out of service.

On the night of the incident, the victim propped the door open and entered the dryer drum without de-energizing or locking out the dryer. He began to clean the inside of the drum. Although the error light had been activated when the door was propped open, the signal was misinterpreted by a co-worker, who restarted the system. When the system was restarted, the overhead conveyor delivered a 200-pound load of wet laundry to the dryer, knocking out the wooden door prop, trapping the victim inside, and automatically starting the drying cycle. The victim remained trapped inside until the cycle was completed and was discovered when the load was discharged from the dryer. He died thirty minutes later of severe burns and blunt head trauma [Massachusetts Department of Public Health 1992].

A review of the NIOSH FACE data indicates that three related factors contribute to injuries and deaths that occur when workers perform installation, Maintenance, service, or repair work near Hazardous Energy sources:
  •  Failure to completely de-energize, isolate, block, and/or dissipate the hazardous energy source
  •  Failure to lockout and tagout energy control devices and isolation points after the hazardous energy source has been de-energized
  •  Failure to verify that the hazardous energy source was de-energized before beginning work

These fatalities could have been prevented if comprehensive Hazardous Energy control procedures had been implemented and followed.

NIOSH recommends that employers implement the following steps to prevent injuries and deaths of workers who must work with Hazardous Energy in their jobs:
1. Comply with OSHA regulations.
2. Develop and implement a hazardous energy control program.
3. Identify and label all hazardous energy sources.
4. De-energize, isolate, block, and/or dissipate all forms of hazardous energy before work begins.
5. Establish lockout/tagout programs that:
  •  Require workers to secure energy control devices with their own individually assigned locks and keys - only one key for each lock the worker controls;
  •  Require that each lock used to secure an energy control device be clearly labelled with durable tags to identify the worker assigned to the lock;
  •  Make sure that the worker who installs a lock is the one who removes it after all work has been completed; and
  •  If work is not completed when the shift changes, workers arriving on shift should apply their locks before departing workers remove their locks.
6. Verify by test and/or observation that all energy sources are de-energized before work begins.
7. Inspect repair work before reactivating the equipment.
8. Make sure that all workers are clear of danger points before re-energizing the system.
9. Train ALL workers in the basic concepts of hazardous energy control.
10. Include a hazardous energy control program with any confined space entry program.
11. Encourage manufacturers to design machines and systems that make it easy to control hazardous energy.

These recommendations are described in more detail in the following sections.

Employers and workers must comply with OSHA regulations for controlling Hazardous Energy during Maintenance and installation work (see 29 CFR 1910.146, 1910.147, 1910.177, 1910.178, 1910.179, 1910.181, 1910.213, 1910.217, 1910.218, 1910.261, 1910.262, 1910.263, 1910.265, 1910.269, 1910.272, 1910.305, 1910.306, 1910.333, 1926.416, and 1926.417).

OSHA standards and accepted safe work practices require employers to ensure that all Hazardous Energy sources are de-energised before work begins. If these sources cannot be de-energized, OSHA requires employers to protect workers with insulation, guarding, and appropriate personal protective equipment.

Employers should develop and implement a written hazardous Energy Control Program that, at a minimum:
  •  Describes safe work procedures,
  •  Establishes formal lockout/tagout procedures,
  •  Trains all employees in the program, and
  •  Enforces the use of the procedures (including disciplinary action for failure to follow them).

Hazardous Energy control programs should outline the following safe work practices:
  •  Identify tasks that may expose workers to hazardous energy.
  •  Identify and de-energize all hazardous energy sources, including those in adjacent equipment.
  •  Lockout and tagout all energy-isolating devices to prevent inadvertent or unauthorized reactivation or startup.
  •  Isolate, block, and/or dissipate all hazardous sources of stored or residual energy, including those in adjacent equipment.
  •  Before beginning to work, verify energy isolation and de-energization, including that in adjacent equipment or energy sources.
  •  After work is complete, verify that all personnel are clear of danger points before re-energizing the system.

Hazardous Energy control among workgroups must be coordinated when multiple employers are involved in large projects and when shift changes occur during such activities. Outside contractors should work with the facility owner to make sure that an adequate hazardous Energy Control Program is implemented specifically for contract workers.

Employers should use job site surveys to ensure that all Hazardous Energy sources (including those in adjacent equipment) are identified before beginning any installation, Maintenance, service, or repair tasks. Hazardous energy includes mechanical motion, potential or Stored Energy, electrical energy, thermal energy, and chemical reactions. Energy-isolating devices such as breaker panels and control valves should be clearly labelled [NIOSH 1983].

All forms of Hazardous Energy should be de-energised, Isolated, Blocked, and/or Dissipated before workers begin any installation, Maintenance, service, or repair work. The method of energy control depends on the form of energy involved and the available means to control it. Energy is considered to be isolated or blocked when its flow or use cannot occur [NIOSH 1983].

To isolate or block energy, take the following steps:
  •  Disconnect or shut down engines or motors that power mechanical systems.
  •  De-energize electrical circuits by disconnecting the power source from the circuit.
  •  Block fluid (gas, liquid, or vapour) flow in hydraulic, pneumatic, or steam systems by using control valves or by capping or blanking the lines.
  •  Block machine parts against motion that might result from gravity (falling).

Some forms of energy must also be Dissipated after a system has been de-energised. System components such as electrical capacitors, hydraulic accumulators, or air reservoirs may retain sufficient energy to cause serious injury or death - even though the component has been de-energized, Isolated, or Blocked from the system and locked out.

Energy can be Dissipated by taking the following steps:
  •  Vent fluids from pressure vessels, tanks, or accumulators until internal pressure is at atmospheric levels. However, do not vent vessels or tanks containing toxic, flammable, or explosive substances directly into the atmosphere.
  •  Discharge capacitors by grounding.
  •  Release or block springs that are under tension or compression.
  •  Dissipate inertial forces by allowing the system to come to a complete
  •  Stop after the machine or equipment has been shut down and isolated from its energy sources.

Lockout/Tagout programs should be based on the principle of only one key for each lock the worker controls. This means the following:

  •  Workers are assigned individual locks operable by only one key for use in securing energy control devices** (breaker panels, control valves, manual override switches, etc.).
  •  Each worker maintains custody of the key for each of his or her assigned locks.
  •  Each lock is labelled with a durable tag or other means that identifies its owner.
  •  When work is performed by more than one worker, each worker applies his or her lock to the energy-securing device. Scissors-type hasps made of hardened steel are available to facilitate the use of more than one lock to secure an energy control device.
  •  All de-energized circuits and systems are clearly labelled with durable tags.
  •  The worker who installs a lock is the one who removes it after all work has been completed [NIOSH 1988].
  •  If work is not complete when the shift changes, workers arriving on shift apply their locks before departing workers remove their locks.

Because tags can be easily removed, they are not a substitute for locks. Workers are safest with a program that uses both locks and warning tags to prevent systems from being inadvertently re-energised [NIOSH 1988].

**Use of master keys should be reserved for unusual circumstances when the worker is absent from the workplace. However, if master keys are necessary, keep them under supervisory control. List the proper procedures for using them in the written program for controlling hazardous energy.