1. Does a Low ORI Really Mean Your Company is Safe?
Catastrophic Accidents in Conscientious Companies
David R. Paoletta, CSP, CHMM
Tetra Tech NUS Inc.

2. David R. Paoletta, CSP, CHMM
Does a Low ORI Really Mean Your Company is Safe?
AGENDA
• How We Measure “Safety”
• Accident Causation Factors Formula
• Incident #1: Utility Company: Electric Flash due
to Improper Work Controls
• Incident #2: Municipal Wastewater Plant
Explosion
• Similarities in Causal Factors
• Proactive use of the Causal Factors
• Conclusions: Towards a True Culture of Safety

3. How We Measure Safety
Typical Measures
• Traditional: Lost time injury, Frequency rate, WC
Multiplier and % budget for Safety
• Transitional: Trend analysis and savings
achieved through prevention
• Modern: Performance to standards or
benchmarks, positive measures of health and
safety (i.e. number of audits conducted and
scores of audits conducted)

4. How We Plan For Risk
Typical Statistical Techniques
• Predictive modeling: Simple linear
regression; Correlation analysis, etc.
• Markov models: Reliance on the Markov
assumption to represent sequences of
events (according to this assumption, the
occurrence of the next event depends only
on a fixed number of previous events).

5. How We Plan For Risk
Much of the research into humans' risk-
avoidance machinery shows that it is
antiquated and unfit for the modern world.
If someone narrowly escapes being eaten
by a tiger in a certain cave, then he learns
to avoid that cave. Yet vicious black
swans by definition do not repeat
themselves. We cannot learn from them
easily.
Naseem Taleb

6. Nassim Nicholas Taleb 2007
How We Measure Safety
Asymmetrical Risk
Basing your perception of “acceptable” risk on
past performance underestimates the effect of
the unlikely but catastrophic event (black swan)
that can cause a fatality or total system failure.
What’s the plan
for a 6 Sigma
event?

7. Nassim Nicholas Taleb: The Black Swan 2007
The Black Swan Theory
The term Black Swan comes from the
assumption that 'All swans are white'. In
that context, a black swan was a metaphor
for something that could not exist.
Black Swan events cause losses beyond
that predicted by our defective risk
models.

8. Nassim Nicholas Taleb: The Black Swan 2007
The Black Swan Theory
Black Swan Event criteria:
• The event is a surprise.
• The event has a major impact.
After the fact, it is usually the case that the
event is rationalized by hindsight, as if it
was expected to occur.

9. Nassim Nicholas Taleb: The Black Swan 2007
The Black Swan Theory
Management Impact
Our system of rewards is not adapted to
black swans.
• We can set up rewards for activity that
reduces the risk of certain measurable
events, like cancer rates. But it is more
difficult to reward the prevention (or even
reduction) of a chain of bad events (war,
for instance).

10. How We Measure Safety
Asymmetrical Risk = the impact of an unexpected
failure i.e a 6σ “Black Swan” event
• Are systems capable of producing Black Swan
events identified and in control?
• How can organizations dodge the Black Swans?

11. Nassim Nicholas Taleb 2007
Does a Low ORI Really Mean Your Company is Safe?
Incident Background Information
Both companies involved report lower than industry
average ORI and Days-Away rates.
One company is a Utilitiy that require an average of six-
years of on-the-job Apprentice training to qualify to be a
Journeymen Lineman. Most Linemen work in the craft
until they retire.
Utility companies must comply with 29 CFR 1910.269 –
which was written specifically for Electric Power
generation and Transmission operations.

12. Safety Assessment: A Quantitative Approach, A. Raouf and
Safety Incident Causation Factors
AL = ∫ (W),(O),(P),(S)
Where:
AL = Accident Level (degree of losses)
W = Workers Characteristics (physical abilities, teamwork, skills, interests, personality)
O = Machine/systems/equipment Characteristics (mechanical actions, location of
controls, quality of maintenance)
P = Physical Environment (temperature, humidity, illumination, housekeeping)
S = Social Environment (regulations, formal rules, company culture)

13. Safety 24/7, G. Anderson & R. Lorber, 2006.
Safety Incident Causation Factors
W = Workers Characteristics:
• Age
• Gender
• Time on the job
• Level of Training
• Physical/intellectual ability
• Job Skills
• Level of Commitment to Safety –
– Level I: Will comply when it’s convenient
– Level II: Will comply when directed to
– Level III: Will comply because they believe for self and family
– Level IV: Will comply because they believe for self and family & other
workers

14. Safety Assessment: A Quantitative Approach, A. Raouf and
Safety Incident Causation Factors
O = Machine/Systems/Equipment Characteristics:
• Mechanical actions
• Location of Controls
• Layout/design relative to work area
• Quality of Maintenance
• Suitability to the Job
• Available Safety Equipment
• Types of Hazardous Energy
• Engineered/intrinsic safety
• Proper/Improper functionality

15. Safety Assessment: A Quantitative Approach, A. Raouf and
Safety Incident Causation Factors
P = Physical Environment:
• Temperature
• Humidity
• Illumination
• Contamination
• Ventilation
• Noise
• Housekeeping

16. Safety Assessment: A Quantitative Approach, A. Raouf and
Safety Incident Causation Factors
S = Social Environment:
• Regulations
• Formal rules
• Company Culture
• Incentive System
• Supervision and oversight
• Team cohesion/functionality
• Influence of non-work relationships

17. Incident #1: Utility Company: Arc Flash Near Miss

18. 35kV breaker P334
Job assignment: Replace 1200 amp switchblades with 2000
amp switchblades on disconnects P3341 and P3342
associated with breaker P334
Switchblades

19. 1910.269(c) "Job briefing."
The employer shall ensure that the employee in
charge conducts a job briefing with the employees
involved before they start each job. The briefing
shall cover at least the following subjects:
• hazards associated with the job,
• work procedures involved,
• special precautions,
• energy source controls,
• and personal protective equipment requirements.

20. 1: System Operator will open breaker P334
2: Substation electrician will open disconnect switches P3341 and P3342
3: Switchmen will open disconnect at Pole Riser and give confirmation that
switch is open to System Operator
4: After confirmation that pole riser switch is open, the system operator will
instruct the electrician to check that circuit is de-energized and apply
personnel protective grounds
5: After grounds are applied a clearance number is granted and work can
begin.
Clearance Procedure (Hazardous Energy
Control)

21. Pole riser
disconnects for
P334 located in
easement about ½
mile outside of
substation

22. The Fuzzing procedure:
Checking Dead: “Fuzzing”
1: After equipment has been removed from the power source
2: A qualified worker will slowly approach the conductor with a
nonconductive extendo stick and listen for arcing ( a fuzzing
sound…)

23. If no arcing is heard a # 6 ground braid will be attached to the
extendo stick, the stick will then be placed on the conductor to
allow for bleed off before 4/0 protective grounds are installed

24. Incident Description
1: The System Operator opened breaker P334 remotely
2: The Electrician opened disconnect switches
P3341 and P3342
3: Switchmen did not open disconnect at Pole Riser
and did not give confirmation to System Operator
that switch was open
4: The system operator instructed the electrician to
check that circuit was de-energized and apply personnel
protective grounds
5: As the ground was attached - Flash Occurs

25. # 6 Braided ground after flash occurred

26. Incident #1: The Accident Function
P = PHYSICAL ENVIRONMENT
 Workers were remote from System Operations Center
 Humidity and soil moisture content influences ground-fault voltage
 In some areas radio and/or cell phone communication with the System
Operations Center is sketchy or non-existent.
 Pole with disconnects required to deenergize switch being replaced from
transmission line primary voltage was ½ mile from work site in switchyard.

27. Incident #1: The Accident Function
S = SOCIAL ENVIRONMENT
 There is often lack of communication & respect between Linemen and System
Operators.
 Some Utility Company cultures do not support questioning decisions of working
foremen.
 Work crews are often understaffed with Journeymen Linemen
 Field operations considered “routine” are rarely supervised by Management.
 Tailboards are not uniformly documented or taken seriously
 The work crews accepted the company’s excuse that budget restrictions
precluded purchasing voltage detectors.
 Utility crews are so used to working live that they often underestimate the risks of
routine tasks.

28. Incident #1: The Accident Function
O = Machine/system CHARACTERISTICS
 The System Operations center did not have remote SCADA (Supervisory
Control and Data Acquisition) or the capability to see open and shut switches
on this part of the T&D grid.
 The manual switch on the pole riser is designed to provide visual indication
of being open or closed
 Fuzzing can only detect relatively high voltage and is dependent on operator
experience
 Electrical components can be energized from back-feed, induction,
lightening strike, transformers and sources other than their normal, expected
configuration
 Physical modifications to T&D circuits are sometimes not reflected in as-built
drawings or system schematics used for planning work

29. Incident #1: The Accident Function
W = WORKERS CHARACTERISTICS
 It’s common for Journeyman Linemen to assume they know the system better
than System Operations personnel. This leads to not paying attention or asking
questions at job briefings (personal observation)
 Some working foremen do not conduct pre-job safety briefings if they consider
the work to be “routine”.
 The Lineman culture that apprentices learn contributes to a “bulletproof”
attitude towards risk.
 It is assumed that experienced working foremen don’t make mistakes.
 Detailed work procedures (if they exist) are rarely utilized in the field.

30. Incident #1: The Accident Function
ROOT CAUSES OF THE INCIDENT
The switching procedure was violated by not opening the switch on the pole riser.
(This may have been due to inadequate or non-existent pre job tailboard.)
There was failure to double check the switching procedure at the job site by both
system Operations and the working Foreman
 The System Operations Center did not request verification of the status of the
switching procedure before granting the clearance to the Working Foreman.
 The company did not provide proper circuit testing instruments leading to use of a
risky and outdated “fuzzing” procedure.
 Employees did not refuse to perform the “fuzzing” procedure which exposed them
to unguarded transmission voltage.
 The employee using the “fuzzing” procedure did not detect the presence of
primary voltage!

31. Incident #1: The Accident Function
ROOT CAUSES OF THE INCIDENT
At the time of the incident X-Energy Company
was in the process of purchasing voltage
indicators. Previous attempts to purchase the
voltage indicators were cancelled due to budget
constraints.

32. Safety Assessment: A Quantitative Approach, A. Raouf and
Accident Function Analysis: Flash Incident
AL = ∫ (W),(O),(P),(S)
Where: If Then
W = Workers Characteristics (Level IV: follows procedures – OR- Workers
question system status before fuzzing)
O = Machine/systems/equipment Characteristics (Proper Voltage Detector
Available – OR- Disconnect position visible in Control Ctr)
P = Physical Environment (Riser disconnects visible from job site)
S = Social Environment (regulations: 29 CFR 1910.269 applied – OR-
Formal/Informal work procedure control in effect i.e. Foreman or Control
Station intervention – OR – company culture = workers refuse to use “fuzzing”
technique)
AL = NO ARC FLASH/POTENTIAL LOSS OF LIFE

33. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007

34. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007

35. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007
W = WORKERS CHARACTERISTICS
Facility personnel removed one of the damaged metal roofs in 2005 without
incident.
The lead mechanic planned the job to remove the metal roof.
Facility superintendent did not review details of the job and possible hazards.
Employees remembered some methanol system training in 1993, but none
could identify the purpose of the flame arrester or how the tank vented. In
addition, employees could not remember if any of the HAZCOM (Right-to-Know)
training sessions covered methanol hazards.
The employees were not covered under OSHA due to repeal of the Florida
public employee safety law in 2000 and the elimination of City of Daytona Beach
full-time Safety Position (2004).

36. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007
O = Machine/System
CHARACTERISTICS
 The methanol system designer, specified
polyvinyl chloride (PVC) piping, valves, and
fittings for all of the piping in the methanol
system. The PVC piping connected to the
methanol tank mechanically failed in multiple
locations from the upward movement of the
tank caused by the internal explosion.
 The flame arrester plates and housing were
aluminum. Published corrosion data indicates
that methanol corrodes aluminum. The flame
arrester was severely corroded on the interior
surface, the plates were clogged with
aluminum oxide scale, and plates were broken
with portions missing. The flame arrestor was
inoperative.

37. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007
P = PHYSICAL ENVIRONMENT
 The second metal roof, installed over
the methanol storage tank, was about 30
feet above the ground and difficult to
access.
 It was necessary to borrow a man-lift
and crane from other city facilities to
access the roof and lower the cut
sections to the ground.
 Ambient temperature was warm
enough to allow methane to vent from the
flame arrestor, since it is designed to
open to prevent pressurization of the
tank.

38. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007
S = SOCIAL ENVIRONMENT
 The CSB found that the City of Daytona Beach had not implemented a
systematic method for identifying hazards during non-routine work, nor did
the City have a hot – work permit system in effect.
There were no formal written work procedures for the job.
 No requirement for flame arrester maintenance and inspection was
included with the operation and maintenance instructions provided the
City.
 Public sector workers were not regulated under federal or state worker
safety laws in Florida.
 The University of South Florida administers a voluntary private sector
worker safety consultation program for the State of Florida. Because of
restrictions on federal funding, the program is prohibited from offering
consultation to Florida’s public employers.

39. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007
ROOT CAUSES OF THE INCIDENT
The City of Daytona Beach has no program, written or otherwise, to
control hot work at city facilities.
The CSB found no evidence that workers at the Bethune Point WWTP
received any methanol hazard training in the last 10 years.
The City of Daytona Beach does not require work plan reviews to
evaluate the safety of nonroutine tasks.
The methanol tank did not comply with NFPA 30. Valves and their
connection to the tank were PVC instead of steel.
Flame arrester maintenance requirements were not included in the
operation and maintenance manual for the methanol system.

40. US Chemical Safety Board Investigation Report
Incident #2: Wastewater Plant Explosion, 2007
ROOT CAUSES OF THE INCIDENT, Cont.
An improper flame arrester was installed on the methanol tank.
The flame arrester was not inspected or cleaned since its installation in 1993.
No Florida state laws or regulations exist to require municipalities to
implement safe work practices.
No Florida state laws or regulations exist to require municipalities to
communicate chemical hazards to municipal employees.
No state or federal oversight of public employee safety exists in the State of
Florida.

41. Safety Assessment: A Quantitative Approach, A. Raouf and
What If Analysis: Bethune WWTP
AL = ∫ (W),(O),(P),(S)
Where: IF Then
W = Workers Characteristics (Hazard recognition training)
O = Machine/systems/equipment Characteristics (Proper
flame arrestor installed – OR – steel external piping)
P = Physical Environment (Cold day, no crane necessary)
S = Social Environment (Hot Work Permit Required – OR-
Formal/Informal Job Hazard Analysis & Planning in effect
– OR- company culture = Workers question welding
above Methane tank – OR – OSHA regulations in effect)
AL = NO EXPLOSION/NO LOSS OF LIFE

42. Edward Zebrowski 1991
Common Root Causes and What to Do About Them
“What were the decision factors
that prepared the situation for the
eventual catastrophe?”
 Diffuse Responsibilities, with rigid
communication channels and large
organizational distances from the
shop floor.
 Mindset that success is routine,
with neglect of severe risks that are
present
Rule compliance and the belief that
this is enough to assure safety
 Team-player emphasis, with
dissent not allowed, even for evident
risk
 Primary responsibility for safety
rests with each employee and with
management systems that ruthlessly
support & reward safety.
 Job Hazard Analysis and pre-
planning for each and every activity
commensurate with risk.
 Compliance must be a condition of
employment.
 Individuals must be expected to
raise safety concerns and be
rewarded for doing so.

43. Edward Zebrowski 1991
Common Root Causes and What to Do About Them
“What were the decision factors
that prepared the situation for
the eventual catastrophe?”
 Safety analysis and responses
subordinate to other performance
goals in operating priorities
 Lack of emergency procedures,
plans, training and regular drills for
severe events
Hazardous design and operating
features allowed to persist even
though recognized elsewhere as
unsafe
 The company must recognize
safety as the #1 performance metric
to reward employees & managers
(See DuPont…)
 Emergency procedures must be
regularly revised and updated and
realistic training and drills run for all
employees.
 Inspection (self and outside)
documentation of hazards and timely
deficiency correction must be
supported and rewarded with
adequate company resources.

44. Proactive Use of the Causal Factors
The Criteria can be used to assess relative probability of
failure in an organization…
Ap= ∫ (W),(O),(P),(S)
Where inspector gathers the following data:
W = Workers Characteristics (Grade: Training, experience,
staffing levels, overtime)
O = Machine/systems/equipment Characteristics (Quantify:
Maintenance expenditures/frequency, engineering controls, etc. )
P = Physical Environment (Quantify: Common shop hazards)
S = Social Environment (Quantify: Attendance, turnover, union
relations, teams?)

45. Dan Petersen, Safety Management: A Human Approach 20
Towards a True Culture of Safety
Achieving Safety Program Excellence:
 Management accountability: role definition, correct measures of
performance
 Forces daily managerial and supervisory proactive activities
 Actions influence the culture by modeling- “Safety is so important
around here that all managers and supervisors have to do
something about it every day!”
 Employees see it, start to believe it, and act on the desired behaviors
Accountability builds Culture which gets Behaviors resulting in Excellence
A C B E

46. Epilogue: April 2009
• HB 1029, an ASSE sponsored bill to provide OSH
coverage to public sector employees in Florida, The
bill passed unanimously, by a vote of 7-0, in the
House Government Affairs Policy Committee. (Not
yet voted into law…)
• Passing these bills will still be a tough fight, but this
victory could not have been a better beginning.

47. Questions?