|Topic: Less than 1% of all hydraulic systems comply with OSHA's standard for lockout with respect to de-energization and verification. So what do people do when they need to work on a hydraulic system? They "crack" connectors and release stored energy directly to atmosphere at the risk of severe, debilitating injury or death - it is a common, accepted practice that must be stopped now!
What you will learn from this Safety Alert:
- Reasons why, in our opinion, hydraulic systems do not comply with OSHA's lockout standard with respect to safe de-energization and verification.
- The inherent safety hazards of discharging stored hydraulic energy directly to atmosphere.
- What precautions you must take if a safe means of de-energizing a hydraulic system is not an inherent product of system or machine design.
- Misconceptions about hydraulic systems and stored energy.
- What options are available to you to facilitate safe and verifiable hydraulic system de-energization.
- What you can do to prevent accidents associated with de-energizing a hydraulic system.
|A mill maintenance technician was injured because he was unable to verify if the hydraulic system he was working on was at "zero energy state" . . .
A mill maintenance technician, with some hydraulic training, was injured in an accident at a sawmill.
The accident occurred when he was in the process of removing a hydraulic cylinder from a production machine to replace the gland seals that were reportedly leaking.
When he loosened the hose-end connector to remove the hose from the closed-end of the cylinder, a stream of oil unexpectedly discharged from the connector at extreme velocity, striking him in the face. The oil penetrated his cheek, and spilled into his mouth.
The victim continued to work, and did not report the incident to his supervisor.
He said that the taste of hydraulic oil remained in his mouth for approximately three days after the accident, as it secreted into his mouth from the pinhole-sized wound in his cheek.
|Events that led up to the accident:
- The victim needed to remove the cylinder from the machine to replace the gland seals.
- The cylinder was mounted in the vertical position, and the rod-end was connected to a relatively heavy structure.
- There was a counterbalance valve circuit module located in the sub-plate mounted, directional control valve assembly located approximately 75 feet from the cylinder (see illustration A).
- In preparation for the cylinder removal, the victim started the pump and lowered the load (retracted the cylinder rod) to the rested position to remove the pressure. There was no means of verifying if the pressure was depleted.
- He locked the power unit out in accordance with his companys lockout protocol.
- He proceeded with the task of removing the cylinder.
- When he loosened the connector, a "jet" of oil unexpectedly discharged from the connector and struck him in the face causing the injury.
- The victim was surprised that the oil discharged from the connector with such intensity when he loosened it. He was certain that there would be no pressure in the transmission line/system based on the fact that he had lowered the cylinder to its rested position.
This is where many people make an error in judgement. And more importantly, why hydraulic system de-energization and verification is absolutely critical.
There are two dynamics that enter into the equation: First, a hydraulic hose is pliable. Consequently, when it is subjected to pressure it expands, and in fact it shortens. Secondly, hydraulic oil is compressible to a limited degree. Put these two dynamics together, and you have the making of an accumulator - a device that stores energy.
If there is a counterbalance valve in the line between the cylinder and the directional control valve, it becomes, in a sense, a "pressure-trap." Consequently, the lowest pressure in the line when the machine is shut off, and the cylinder is at the resting position, is the pressure setting of the counterbalance valve.
In this case the pressure setting of the counterbalance valve was 1200 PSI (83 bar) - enough stored energy to provide a lethal shot of oil to an unsuspecting bystander.
Almost every manufacturer gives a stern warning about the consequences of exhausting hydraulic oil to atmosphere. Typically, they tell you to move levers, etc., to deplete the stored energy.
Ironically, there is not one instance that we are aware of, in which, after following a manufacturer's recommendations for system de-energization, the system is in fact de-energized, and moreover, de-energization is verifiable.
Consequently, there is little doubt that luck plays a role in whether or not there is or is not stored energy in a hydraulic system when it comes to servicing or repairing a hydraulic system.
This problem has prevailed in the fluid power industry for more than four decades.
This accident was not formally investigated to determine root-cause. However, it is an extremely common type of accident.
The reason: Less than 1% of the hydraulic systems in existence comply with OSHAs standard for lockout with respect to de-energization and verification - it is a grave problem!
What does OSHAs standard say? With reference to OSHAs booklet (ref. 3120) titled, "Control of Hazardous Energy (Lockout/Tagout)," OSHA specifically mentions hydraulic systems.
Under sub-heading "Scope and Application" (page 3), OSHA states:
"The lockout/tagout standard applies to general industry employment and covers the servicing and maintenance of machines and equipment in which the unexpected startup or the release of stored energy could cause injury to employees. The standard applies to any source of mechanical, hydraulic, pneumatic, chemical, thermal, or other energy, but does not cover, electrical hazards."
It is referred to again on page 6 under sub-heading "Provisions of the Standard."
The question is, are hydraulic-powered industrial and mobile machines designed and built to accommodate OSHAs standard, i.e. to facilitate total and verifiable de-energization? The answer is, in less than 1% of cases.
Every indication points to industry-wide ignorance as being the reason why the problem manifests itself:
This chart shows critical communication paths that are evidently non-existent, thereby eliminating vital safety checks and balances.
NOTE: Reverse communication regarding safety issues from the maintenance level back to engineering is deemed to be politically incorrect - engineers typically do not entertain design ideas from non-engineers. This problem can best be exemplified by this quote from a professional engineer:
"I've found the ego of many engineers to be the biggest barrier to safety training. Too many engineers refuse to believe stories told them by technicians and shop workers, dismissing them as myths born of fear by the uneducated."
- Name Withheld (Professional Engineer)
- Should schools and colleges be blamed for the problem? - Do engineering schools and colleges teach engineering students safe hydraulic design? All indications are that they don't. This puts engineers at a huge disadvantage - not only do they have to contend with limited instruction in hydraulic system design, but what they do learn apparently fails to address critical safety issues.
- Engineers apparently don't know! - The people who design hydraulic systems generally have no hydraulic safety training. Hydraulic safety is not usually covered in engineering courses, certification courses, and in-service training courses. The net result, hydraulic safety is generally not "designed in" to hydraulic systems.
With the exception of "Safety Factors" which are usually associated with hydraulic component design, there are generally no safety guidelines or safety standards for designing hydraulic systems.
- The fluid power industry apparently has no "governing body" for safety! - There are no checks and balances. For example, people who design and build hydraulic systems generally answer to no-one. The industry apparently has no "governing body" that oversees safety. Engineers have no resources - there are no reference manuals, and no safety institutions from whom they can seek advice at this time!
- Safety professionals apparently don't know! - Once a machine is delivered to a customer, it falls under the umbrella of a corporate safety department. Once again, because of ignorance, safety problems go unnoticed. "Certified" safety personnel cannot detect hydraulic safety problems, because hydraulic safety is apparently not part of any safety certification course.
- Safety auditors apparently don't know! - State and Federal inspectors generally dont have the proper hydraulic training that would help them recognize hydraulic safety problems or hazards.
- Lockout experts apparently don't know! - Lockout experts are perplexed when asked questions about how to safely de-energize a hydraulic system. Not wanting to seem ignorant, they usually recommend that one "carefully" crack a connector. This can be likened to recommending that one "carefully" touch two wires together to check if an electrical circuit is safely disconnected!
- Maintenance people apparently don't know! - This problem leaves maintenance personnel at risk from two points of view: They are generally not properly trained to recognize potential safety hazards associated with hydraulics, and even if they were, hydraulic systems are generally not designed to facilitate safe and verifiable de-energization.
The problem seems to go unnoticed because the people who work on hydraulics dont design them, and the people who design them dont work on them!
The net result is that less than 1% of the hydraulic systems in existence comply with OSHAs standard for lockout with respect to safe de-energization and verification. This leaves people vulnerable to pressure/velocity skin penetration type injuries, and/or burn injuries.
Misconceptions about hydraulic systems and stored energy:
- If a hydraulic pump is shut off there is no pressure in the system.
A hydraulic system has the inherent capability to store energy even when the pump is shut off. Depending on the system design, a hydraulic system can store energy in one or more "pockets" within a system. In addition, certain types of valves, eg. counterbalance and pilot-operated check valves are "pressure traps." Consequently, it is wise to error on the side of safety - assume that there is stored energy in a hydraulic system when the pump is shut off.
- When a hydraulic pump is shut off the stored energy immediately dissipates within the system.
There are certain design configurations that will allow pressure to immediately dissipate when the pump is shut off. However, there are an equal number of design configurations that don't.
It's not possible to visually determine if a system does or does not store energy. Consequently, it is safer to assume that energy is stored when the pump is shut off.
- If you activate a manual directional control valve when the hydraulic pump is shut off the system will bleed off.
If a hydraulic system is equipped with certain types of valves, eg. counterbalance valves or pilot-operated check valves, they typically do not function unless the pump is operating. Consequently, by activating a directional control valve when the pump is not running renders these valves inoperable. They, in effect, become "pressure traps."
In addition, many directional control valves are manually controlled and pilot-operated. These valves do not operate unless there is pilot pressure, which is only available if the pump is operating.
- Activating the override pushpin on a solenoid-operated, directional control valve while the pump is shut off, will de-energize a hydraulic system.
An override pushpin is provided to mechanically override a solenoid-operated, directional control valve. It operates in a similar manner to a lever-operated valve. Once again if the system is equipped with any load-holding valve, even though the spool can be moved with the aid of a push-pin, the load-holding valves become "pressure traps." In addition, larger solenoid-operated valves are pilot-operated. Consequently, the override push-pin will have no effect if in the event the pump is shut off, which leaves the system without pilot pressure.
- A hydraulic system can be de-energized by "cracking" (loosening) a connector and allowing the stored energy to vent to atmosphere.
It is a well-known fact that exhausting high pressure oil to atmosphere can cause severe injury or death, if while doing so oil penetrates the skin.
It can also present an extreme fire hazard if the oil comes into contact with an ignition source.
In addition, certain connector designs are not conducive to "careful" cracking. Accordingly, high pressure hydraulic oil should NEVER be vented to atmosphere - the outcome is always uncertain!
- If an accumulator is installed in a hydraulic system, it will automatically de-energize when the pump is shut off.
Many hydraulic systems are equipped with accumulators for the very purpose of storing energy in the event of an unexpected power failure that renders the pump inoperable.
These types of systems have to be equipped with some type of manual de-energization device. The problem is that the majority of these manual de-energization devices have no means of de-energization verification. In many cases people rely on "sound" as a means of determining if and when an accumulator has dispensed of its stored energy.
There are some hydraulic systems that are equipped with automatic accumulator de-energization devices. Many of these work in conjunction with timers. Again, there is generally no way of verifying if the stored energy is depleted.
NOTE: Some hydraulic systems have pressure gauges. It would be unwise to use onboard pressure gauges to indicate if there is or is not stored energy in a hydraulic system for two reasons: first, the gauge could be damaged or simply aged, and secondly, the placement of the sensing line might be in a part of the circuit where it cannot detect stored energy. It is imperative therefore, to verify accumulator de-energization with reliable instrumentation; also, the person using the instrumentation ought to know where to look for stored energy.
- Air-bleeding a hydraulic cylinder can be accomplished by "cracking" a connector and cycling the cylinder.
Once again, air-bleeding is typically accomplished by exhausting the air/oil to atmosphere. Exhausting high pressure oil to atmosphere can cause severe injury or death if oil penetrates the skin.
It can also present an extreme fire hazard if the oil comes into contact with an ignition source.
In addition, certain connector designs are not conducive to "careful" cracking.
Accordingly, high pressure hydraulic oil should NEVER be vented to atmosphere.
Suggestions on how to prevent this type of accident:
|Make safe and verifiable de-energization the focus of system design. The design must include a means of safely removing any and all "pockets" of potentially hazardous hydraulic energy (see illustration B).
In addition, if there is a possibility of re-accumulation of stored energy to a hazardous level, verification of isolation must be continued until the servicing or maintenance is completed, or until the possibility of such accumulation no longer exists.
|Install a suitable product such as SAFE-T-BLEED® (www.safe-t-bleed.com) which is designed specifically for the purpose of bringing a hydraulic system into compliance with OSHA's lockout standard.
|Make lockout and de-energization training mandatory for all personnel who work on and around hydraulic systems - people who work on and around hydraulic systems must understand how and why hydraulic systems store energy.
|Write a Job-Safety-Breakdown (JSB) for locking out and de-energizing hydraulic machines - good written communication is vital to support and reinforce verbal communication.
Have lockout and de-energization "drills" to insure that personnel know exactly how to make a machine safe to work on - some lockout situations are complex in that a person might need to lockout numerous machines to make the situation safe (see illustration C).
This is an actual machine. Routine maintenance and repair have to be carried out in area "A." To lock the machine out safely, it is necessary to lockout mechanisms 1, 2, 3, 4, and 5 individually. Failure to do so could result in severe injury or death. It would be wise to have periodic lockout "drills" on these types of machines.Telling your maintenance and service personnel how to conduct the service or repair in a classroom setting is one thing, doing it under the demanding pressures of a "downed" production machine is another. When it comes to safe lockout, there is absolutely no room for error!
|Make the "cracking" of connectors to remove stored energy a serious safety violation, and punish those who do it accordingly.
|If a hydraulic machine is not designed to facilitate safe de-energization and verification, don't risk your life. Call the respective machine manufacturer for help. If you are told to "crack" a connector, refuse - it could kill you!
|When purchasing or specifying hydraulic machinery or equipment, ask the supplier or manufacturer, if it complies with OSHA's standard for lockout with respect to safe de-energization and verification. If it does not, make the purchase of that machinery or equipment subject to compliance.
|Contractors MUST obey your safety rules. In many cases, untrained service and repair personnel who are hired to work on your hydraulic machines do not follow good safety practices. In many cases, they have absolutely no training themselves.
Ask about employee training and certification before hiring a contractor. Outside contractors are looked upon by your employees as "experts." They are generally called upon to do either warranty work, or because your personnel are not qualified to do the work themselves. If they are going to mentor your personnel, it is critical that they lead by example, especially when it comes to safety.
All hydraulic machines MUST be designed and built to comply with OSHA's standard for lockout with respect to safe and verifiable de-energization - otherwise they are simply unsafe!
If, in the course of your work, you have to "open" a hydraulic system, and you find that you cannot safely de-energize the system, and/or verify if the system is de-energized, NEVER guess! Call the manufacturer and ask for guidance.
Oil escaping to atmosphere at high velocity can easily penetrate your skin. Skin penetration injuries have been recognized as devastating, and can result in severe injury or death.
|The accidents we report are real, and the victims are real. The safety guidelines we provide are to help companies and individuals work safely with hydraulics. All guidelines we provide are general, and are not intended for one specific hydraulic system or machine.
WHEN YOU PURCHASE HYDRAULIC-POWERED MACHINERY AND/OR EQUIPMENT, WE HIGHLY RECOMMEND THAT ONCE YOU DETERMINE THAT IT CAN DO THE WORK YOU WANT IT TO DO, YOU THEN DETERMINE HOW MUCH SAFETY HAS BEEN BUILT INTO IT BY THE MANUFACTURER. IN ADDITION, WE RECOMMEND THAT YOU, WITH THE INPUT FROM YOUR OPERATORS, MECHANICS, ENGINEERS, PRODUCTION PERSONNEL, AND SAFETY DEPARTMENT, FORMULATE A LIST OF MINIMUM SAFETY STANDARDS FOR THE EQUIPMENT YOU PURCHASE. ALTHOUGH WE LIKE TO BELIEVE THAT MOST MANUFACTURERS ARE CONCEREND ABOUT SAFETY, SOME BELIEVE THAT CERTAIN SAFETY MEASURES ARE AN UNNECESSARY EXPENSE. WE FURTHER RECOMMEND THAT ALL THE SAFETY STANDARDS AND RECOMMENDATIONS THAT YOU DEVELOP SHOULD BE REVIEWED BY YOUR SAFETY DEPARTMENT, ENGINEERING DEPARTMENT, AND BY THE RESPECTIVE MACHINE OR EQUIPMENT MANUFACTURER PRIOR TO MAKING THEM POLICY - TOTAL SAFETY CAN ONLY BE ACHIEVED WITH A TEAM EFFORT.
|The Fluid Power Safety Institute does everything possible to insure that the information and drawings contained in these documents is accurate, and the procedures are deemed safe and reliable. However, these are general recommendations only and might not be applicable to all situations.
You MUST have your engineering department and service department read these recommendations and make the necessary changes for your specific application.
The Fluid Power Safety Institute is not responsible for actions taken by untrained and/or unauthorized persons. ALL hydraulic system service, repair, and troubleshooting should be done by trained, authorized persons ONLY.