What you will learn from this Safety Alert:

1. Reasons why, in our opinion, hydraulic systems do not comply with OSHA's lockout standard with respect to safe de-energization and verification.
   
   
2. The inherent safety hazards of discharging stored hydraulic energy directly to atmosphere.
   
   
3. What precautions you must take if a safe means of de-energizing a hydraulic system is not an inherent product of system or machine design.
   
   
4. Misconceptions about hydraulic systems and stored energy.
   
   
5. What options are available to you to facilitate safe and verifiable hydraulic system de-energization.
   
   
6. What you can do to prevent accidents associated with de-energizing a hydraulic system.

A mill maintenance technician, with some hydraulic training, was injured in an accident at a sawmill.

The accident occurred when he was in the process of removing a hydraulic cylinder from a production machine to replace the gland seals that were reportedly leaking.

When he loosened the hose-end connector to remove the hose from the closed-end of the cylinder, a stream of oil unexpectedly discharged from the connector at extreme velocity, striking him in the face. The oil penetrated his cheek, and spilled into his mouth.

The victim continued to work, and did not report the incident to his supervisor.

He said that the taste of hydraulic oil remained in his mouth for approximately three days after the accident, as it secreted into his mouth from the pinhole-sized wound in his cheek.

The victim needed to remove the cylinder from the machine to replace the gland seals. The cylinder was mounted in the vertical position, and the rod-end was connected to a relatively heavy structure. There was a counterbalance valve circuit module located in the sub-plate mounted, directional control valve assembly located approximately 75 feet from the cylinder (see illustration A). In preparation for the cylinder removal, the victim started the pump and lowered the load (retracted the cylinder rod) to the rested position to remove the pressure. There was no means of verifying if the pressure was depleted. He locked the power unit out in accordance with his company’s lockout protocol. He proceeded with the task of removing the cylinder. When he loosened the connector, a "jet" of oil unexpectedly discharged from the connector and struck him in the face causing the injury. The victim was surprised that the oil discharged from the connector with such intensity when he loosened it. He was certain that there would be no pressure in the transmission line/system based on the fact that he had lowered the cylinder to its rested position. This is where many people make an error in judgement. And more importantly, why hydraulic system de-energization and verification is absolutely critical. There are two dynamics that enter into the equation: First, a hydraulic hose is pliable. Consequently, when it is subjected to pressure it expands, and in fact it shortens. Secondly, hydraulic oil is compressible to a limited degree. Put these two dynamics together, and you have the making of an accumulator - a device that stores energy.

Illustration A

If there is a counterbalance valve in the line between the cylinder and the directional control valve, it becomes, in a sense, a "pressure-trap." Consequently, the lowest pressure in the line when the machine is shut off, and the cylinder is at the resting position, is the pressure setting of the counterbalance valve. In this case the pressure setting of the counterbalance valve was 1200 PSI (83 bar) - enough stored energy to provide a lethal shot of oil to an unsuspecting bystander. Almost every manufacturer gives a stern warning about the consequences of exhausting hydraulic oil to atmosphere. Typically, they tell you to move levers, etc., to deplete the stored energy. Ironically, there is not one instance that we are aware of, in which, after following a manufacturer's recommendations for system de-energization, the system is in fact de-energized, and moreover, de-energization is verifiable. Consequently, there is little doubt that luck plays a role in whether or not there is or is not stored energy in a hydraulic system when it comes to servicing or repairing a hydraulic system. This problem has prevailed in the fluid power industry for more than four decades.

Contributing factors:

This accident was not formally investigated to determine root-cause. However, it is an extremely common type of accident.
The reason: Less than 1% of the hydraulic systems in existence comply with OSHA’s standard for lockout with respect to de-energization and verification - it is a grave problem!

What does OSHA’s standard say? With reference to OSHA’s booklet (ref. 3120) titled, "Control of Hazardous Energy (Lockout/Tagout)," OSHA specifically mentions hydraulic systems.

Under sub-heading "Scope and Application" (page 3), OSHA states:

"The lockout/tagout standard applies to general industry employment and covers the servicing and maintenance of machines and equipment in which the unexpected startup or the release of stored energy could cause injury to employees. The standard applies to any source of mechanical, hydraulic, pneumatic, chemical, thermal, or other energy, but does not cover, electrical hazards."

It is referred to again on page 6 under sub-heading "Provisions of the Standard."

The question is, are hydraulic-powered industrial and mobile machines designed and built to accommodate OSHA’s standard, i.e. to facilitate total and verifiable de-energization? The answer is, in less than 1% of cases.

Every indication points to industry-wide ignorance as being the reason why the problem manifests itself:

This chart shows critical communication paths that are evidently non-existent, thereby eliminating vital safety checks and balances.

Misconceptions about hydraulic systems and stored energy:

1. If a hydraulic pump is shut off there is no pressure in the system.
   TRUE/FALSE
   A hydraulic system has the inherent capability to store energy even when the pump is shut off. Depending on the system design, a hydraulic system can store energy in one or more "pockets" within a system. In addition, certain types of valves, eg. counterbalance and pilot-operated check valves are "pressure traps." Consequently, it is wise to error on the side of safety - assume that there is stored energy in a hydraulic system when the pump is shut off.
   
   
2. When a hydraulic pump is shut off the stored energy immediately dissipates within the system.
   TRUE/FALSE
   There are certain design configurations that will allow pressure to immediately dissipate when the pump is shut off. However, there are an equal number of design configurations that don't.
   It's not possible to visually determine if a system does or does not store energy. Consequently, it is safer to assume that energy is stored when the pump is shut off.
   
   
3. If you activate a manual directional control valve when the hydraulic pump is shut off the system will bleed off.
   TRUE/FALSE
   If a hydraulic system is equipped with certain types of valves, eg. counterbalance valves or pilot-operated check valves, they typically do not function unless the pump is operating. Consequently, by activating a directional control valve when the pump is not running renders these valves inoperable. They, in effect, become "pressure traps."
   In addition, many directional control valves are manually controlled and pilot-operated. These valves do not operate unless there is pilot pressure, which is only available if the pump is operating.
   
   
4. Activating the override pushpin on a solenoid-operated, directional control valve while the pump is shut off, will de-energize a hydraulic system.
   TRUE/FALSE
   An override pushpin is provided to mechanically override a solenoid-operated, directional control valve. It operates in a similar manner to a lever-operated valve. Once again if the system is equipped with any load-holding valve, even though the spool can be moved with the aid of a push-pin, the load-holding valves become "pressure traps." In addition, larger solenoid-operated valves are pilot-operated. Consequently, the override push-pin will have no effect if in the event the pump is shut off, which leaves the system without pilot pressure.
   
   
5. A hydraulic system can be de-energized by "cracking" (loosening) a connector and allowing the stored energy to vent to atmosphere.
   TRUE/FALSE
   It is a well-known fact that exhausting high pressure oil to atmosphere can cause severe injury or death, if while doing so oil penetrates the skin.
   It can also present an extreme fire hazard if the oil comes into contact with an ignition source.
   In addition, certain connector designs are not conducive to "careful" cracking. Accordingly, high pressure hydraulic oil should NEVER be vented to atmosphere - the outcome is always uncertain!
   
   
6. If an accumulator is installed in a hydraulic system, it will automatically de-energize when the pump is shut off.
   TRUE/FALSE
   Many hydraulic systems are equipped with accumulators for the very purpose of storing energy in the event of an unexpected power failure that renders the pump inoperable.
   These types of systems have to be equipped with some type of manual de-energization device. The problem is that the majority of these manual de-energization devices have no means of de-energization verification. In many cases people rely on "sound" as a means of determining if and when an accumulator has dispensed of its stored energy.
   There are some hydraulic systems that are equipped with automatic accumulator de-energization devices. Many of these work in conjunction with timers. Again, there is generally no way of verifying if the stored energy is depleted.
   NOTE: Some hydraulic systems have pressure gauges. It would be unwise to use onboard pressure gauges to indicate if there is or is not stored energy in a hydraulic system for two reasons: first, the gauge could be damaged or simply aged, and secondly, the placement of the sensing line might be in a part of the circuit where it cannot detect stored energy. It is imperative therefore, to verify accumulator de-energization with reliable instrumentation; also, the person using the instrumentation ought to know where to look for stored energy.
   
   
7. Air-bleeding a hydraulic cylinder can be accomplished by "cracking" a connector and cycling the cylinder.
   TRUE/FALSE
   Once again, air-bleeding is typically accomplished by exhausting the air/oil to atmosphere. Exhausting high pressure oil to atmosphere can cause severe injury or death if oil penetrates the skin.
   It can also present an extreme fire hazard if the oil comes into contact with an ignition source.
   In addition, certain connector designs are not conducive to "careful" cracking.
   Accordingly, high pressure hydraulic oil should NEVER be vented to atmosphere.

Suggestions on how to prevent this type of accident:

A.	Make safe and verifiable de-energization the focus of system design. The design must include a means of safely removing any and all "pockets" of potentially hazardous hydraulic energy (see illustration B). In addition, if there is a possibility of re-accumulation of stored energy to a hazardous level, verification of isolation must be continued until the servicing or maintenance is completed, or until the possibility of such accumulation no longer exists.	Illustration B
B.	Install a suitable product such as SAFE-T-BLEED® (www.safe-t-bleed.com) which is designed specifically for the purpose of bringing a hydraulic system into compliance with OSHA's lockout standard.
C.	Make lockout and de-energization training mandatory for all personnel who work on and around hydraulic systems - people who work on and around hydraulic systems must understand how and why hydraulic systems store energy.
D.	Write a Job-Safety-Breakdown (JSB) for locking out and de-energizing hydraulic machines - good written communication is vital to support and reinforce verbal communication.
E.	Have lockout and de-energization "drills" to insure that personnel know exactly how to make a machine safe to work on - some lockout situations are complex in that a person might need to lockout numerous machines to make the situation safe (see illustration C). This is an actual machine. Routine maintenance and repair have to be carried out in area "A." To lock the machine out safely, it is necessary to lockout mechanisms 1, 2, 3, 4, and 5 individually. Failure to do so could result in severe injury or death. It would be wise to have periodic lockout "drills" on these types of machines.Telling your maintenance and service personnel how to conduct the service or repair in a classroom setting is one thing, doing it under the demanding pressures of a "downed" production machine is another. When it comes to safe lockout, there is absolutely no room for error!	Illustration C
F.	Make the "cracking" of connectors to remove stored energy a serious safety violation, and punish those who do it accordingly.
G.	If a hydraulic machine is not designed to facilitate safe de-energization and verification, don't risk your life. Call the respective machine manufacturer for help. If you are told to "crack" a connector, refuse - it could kill you!
H.	When purchasing or specifying hydraulic machinery or equipment, ask the supplier or manufacturer, if it complies with OSHA's standard for lockout with respect to safe de-energization and verification. If it does not, make the purchase of that machinery or equipment subject to compliance.
I.	Contractors MUST obey your safety rules. In many cases, untrained service and repair personnel who are hired to work on your hydraulic machines do not follow good safety practices. In many cases, they have absolutely no training themselves. Ask about employee training and certification before hiring a contractor. Outside contractors are looked upon by your employees as "experts." They are generally called upon to do either warranty work, or because your personnel are not qualified to do the work themselves. If they are going to mentor your personnel, it is critical that they lead by example, especially when it comes to safety.