Help Me Make Sense Of Title 29 of OSHA's Code of Regulations (CFR) Part 1910.147

I am seeking advice from LOTO experts, and lawyers.

I was recently hired by a global mining company to conduct a hydraulic safety workshop for the company's hydraulic training instructors. One of the most controversial topics I cover whenever I conduct a hydraulic safety workshop is the matter of stored hydraulic energy post LOTO. The matter is controversial because it runs head on into Title 29 of OSHA's Code of Regulations (CFR) Part 1910.147. Part 1910.147, addresses the practices and procedures necessary to disable machinery or equipment, thereby preventing the release of hazardous energy while employees perform servicing and maintenance activities. The standard outlines measures for controlling hazardous energies—electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and other energy sources. 

The fact is, there is no way, as OSHA puts it, to "prevent the release of hazardous hydraulic energy" while employees perform servicing and maintenance activities on hydraulic systems. There isn't now, and what's more, there never has been!

The day after I covered the topic of stored hydraulic energy one of my students handed me a document titled "824H Wheel Dozer System Pressure - Release," and asked me to explain it to them. This is the part of my job that I dislike the most because the discussion never ends well.

Accordingly, I am appealing to safety professionals, LOTO experts, and lawyers to weigh in on this controversial topic. Please read the following procedure, and my comments, and let me know how I should respond to my students.

Here is what the manufacturer recommends (in italics):

Personal injury can result from hydraulic oil pressure and hot oil.

Hydraulic oil pressure can remain in the hydraulic system after the engine has been stopped. Serious injury can be caused if this pressure is not released before any service is done on the hydraulic system.

Make sure all the work tools have been lowered to the ground, and the oil is cool before removing any components or lines. Remove the oil filler cap only when the engine is stopped, and the filler cap is cool enough to touch with your bare hand.

WARNING

Escaping fluid under pressure, even a pinhole size leak, can penetrate body tissue, causing serious injury, and possible death. If fluid is injected into your skin, it must be removed

NOTICE

Care must be taken to ensure that fluids are contained during performance of inspection, maintenance, testing, adjusting and repair of the product. Be prepared to collect the fluid with suitable containers before opening any compartment or disassembling any component containing fluid.

1.  Permit only one operator on the machine. All other personnel should be kept away.

2.  Move the machine to a smooth, level surface. Move the machine approximately ten feet in the forward direction. Then, move the machine approximately ten feet in the backward direction. Park the machine. Connect the steering frame lock so that the machine cannot articulate. Power down the lift linkage to raise the front wheels off the ground. Then, raise the lift linkage to lower the front wheels to the ground. Lower the bucket to the ground.

3.  Turn the engine Start switch to the off position.

4.  Engage the parking brake. Place blocks in front of the wheels and behind the wheels.

5.  Depress the brake pedal repeatedly. This will relieve any pressure that may be present in the braking system.

6.  Move the steering wheel several times in both directions to relieve the pilot pressure in the steering system. If you are servicing the steering cylinders, the steering valve, or the steering hoses, slowly crack the lines to purge any trapped oil that may be in the steering system.

7.  Turn the key switch to the on position. Do not start the engine. Move the implement control levers several times through the full range of travel. This will relieve any pressure that may be present in the implement hydraulic system. Turn the key start switch to the off position.

Note: There may be some pressure that is trapped in the tilt cylinder circuit. Relieve this pressure before servicing the implement hydraulic system. To relieve this pressure, slowly crack the hydraulic lines to the tilt circuit. This will remove any trapped oil pressure in the tilt circuit.

Now, let’s deal with the controversial points:

Step 5 – Notice, there is no reference to any type of instrument that confirms the brake pressure is relieved.

Step 6 – Again, there is no reference to an instrument to confirm that the pilot pressure in the steering system is relieved.

The most dangerous aspect of steps 5 and 6 is that person performing the work must assume that depressing the brake pedal repeatedly, and moving the steering wheel several times, relieves the pressure. If there is a problem with either system’s accumulators, the results will be the same and leave the person facing a very grave situation. 

The most controversial aspect of the entire procedure is that Caterpillar allegedly defies their own warning that "escaping fluid under pressure, even a pinhole size leak, can penetrate body tissue, causing serious injury, and possible death," and recommends that a person perform a procedure that actually creates a pinhole leak in a hydraulic system while their hands, and face, are within inches of the leak.

Step 7 – Once again, Caterpillar recommends moving the levers several times through the full range of travel to relieve any pressure that may be present in the implement hydraulic system. However, there is some uncertainty as to whether the procedure relieved the pressure, so again, Caterpillar allegedly defies their own warnings, and recommends that the person slowly crack the hydraulic lines to remove trapped oil pressure in the tilt circuit.

When Caterpillar’s experts refer to “cracking the lines,” to relieve the pressure, they are allegedly recommending that the person performing the procedure loosen a hydraulic connector while it may be under sufficient pressure to cause severe injury or death. Ironically, the type of connector employed on the vehicle is a split-flange design, which, if loosened, while under pressure will cause the O-ring seal to unexpectedly burst.

This is a photo (non Caterpillar) of the type of connector the person has to loosen to relieve stored hydraulic energy. Note the four bolts, which retain the two flanges. There is an O-ring seal between the face of the fitting, and the face of the component.

Here are actual photos of a mechanic performing the identical procedure recommended by Caterpillar on a Doosan excavator. These photos were taken while the mechanic was "carefully" loosening the line to relieve stored energy. The top photo taken moments before the explosion. In the bottom photo, the high-pressure oil suddenly breaches the O-ring seal, and discharges a lethal dose of stored hydraulic energy to atmosphere.

Doosan's procedure for relieving the pressure mirrored Caterpillar’s. Moreover, the Doosan excavator was equipped with the identical connectors as those employed on the Caterpillar machine. As you can see from the photos, despite the fact the mechanic loosened the connector "very carefully" to "slowly" relieve the pressure, it is virtually impossible to have a different outcome with this type of fitting. If the mechanic's hand was in the path of the oil, the outcome would have been consistent with Caterpillar's warning: he could have suffered severe injury or death.

After the accident, I wanted to learn how much pressure remained in the Doosan excavator's hydraulic system if a person followed Doosan's recommendations for removing stored energy. I installed a Safe-T-Bleed device (a device for verifying, and removing, stored energy from a hydraulic system non-invasively) in the circuit, and proceeded to follow the manufacturer’s recommendations to remove stored energy. The lowest pressure I could achieve was 500-PSI. According to numerous medical studies, 500-PSI is sufficient pressure to cause a debilitating oil injection injury or death.   

According to my students the subject procedure for making the Caterpillar 824H Wheel Loader's hydraulic system "safe," is one of the most feared tasks mechanics undertake in the course of their work.

Here are my questions to the experts:

1.  Does Caterpillar’s procedure meet a manufacture’s duty of care?

2.  Is there a conflict between Title 29 of OSHA's Code of Regulations (CFR) Part 1910.147, and these recommendations?

3.  Is it reasonable for a manufacturer to warn mechanics about the consequences of discharging high-pressure oil to atmosphere, and then ask them to do it?

4.  Is it reasonable to ask a mechanic to loosen a connector to relieve stored hydraulic energy to atmosphere, even though connector manufacturers would never condone the practice?

5.  Would you permit a person in your company to loosen a line to remove stored hydraulic energy, knowing that it is impossible to control that energy?

6.  Does a person that is aware that loosening high-pressure lines could allegedly injure or kill them have a right to refuse to follow the manufacturer’s recommendations?

7.  If a person gets injured or killed while “loosening lines,” can the manufacturer be held liable, or is the manufacturer “off the hook” because the victim ignored the warnings?

8.  What advice should I give my students regarding this matter?

9. Do you have a suggestion for doing the subject task safely?

By the way, Caterpillar is not alone when it comes to the problem of stored hydraulic energy. ALL hydraulic systems have the same problem, and all people that work on hydraulics can be injured or killed while in the process of "carefully" removing stored hydraulic energy.

I encourage people from Caterpillar to help answer my students' questions.

I thank you in anticipation for your help.

Note: My opinions are based solely on the document given to me by my students, and their opinions about the procedure. Accordingly, I reserve the tight to change my opinions if I am given further information about the procedure.

Copyright Rory S. McLaren 2017

Isn’t it amazing that the same companies that implement a lockout, tagout, tryout safety protocol for their electrical systems; which they police vigorously, have a similar protocol for locking out their hydraulic systems; only, it has a slightly different twist. It’s called lockout, tagout, guess! It’s Russian roulette, except the guns are hydraulic systems, which are loaded with liquid bullets.

Copyright Rory S. McLaren 2017

Add caption

When it comes to hydraulic safety, the fluid power industry doesn’t get into all that offensive “lockout, tagout, tryout,” nonsense, we take; as President Bush once said, a kindler gentler approach: we use the “buddy” system. I also like to refer to it as the “trust me” system.

Ever tried working alongside a colleague on a machine that has only one lock on the breaker; and the safety officer approaches? Try telling the safety officer that there is only one lock on the panel because your colleague “trusts you.” Of course, you will be looking for a job!

Here’s is an example of how the “kindler gentler” approach works – or doesn’t:

Here is an excerpt from a company’s internal accident report:

A mechanic suffered an oil injection injury when he was repairing an oil leak in the steering system on a Caterpillar 793D. The truck was shut down and isolated, however, the hydraulic system did not automatically “drain and depressurize” as designed due to a faulty solenoid. As the mechanic began to loosen the fitting with a wrench the pressurized hydraulic hose blew off the fitting spraying the mechanic with hydraulic oil. Subsequently, the mechanic noticed his thumb swelling and saw what looked like a puncture mark in the soft area of tissue below his thumb. He was transported to the hospital.

The key words in the report are “drain” and “depressurize.” There is no mention of “verification.” Therein lies the problem.

It’s a well-known fact that hydraulic systems have the inherent ability to store energy, post shutdown. Unlike an electrical system, a single hydraulic system can store energy in over 30 “zones,” or “pockets.” However, post lockout an electrician can verify if an electrical system is isolated with a voltmeter. All mechanics have-to go by is “guess” and, believe it or not, OSHA and MSHA are perfectly happy with the status quo.

The fluid power industry utilizes two components for de-energization, and they are both notoriously unreliable: accumulators and solenoid valves. With respect to accumulators, mechanics are told to move levers until the actuator (s) stop moving, and then it’s safe – trust me!

With respect to solenoid valves; as in this case, a solenoid is supposed to activate within a pre-determined time post shutdown, which automatically discharges stored energy from the accumulator (s) – trust me!

The post accident contributing factors/learnings report, written by the company's safety manager, epitomizes how far out of touch safety managers are with regard to hydraulic safety (see my comments, in italics, below each factor).

• Anytime work is performed on a hydraulic system that has been energized - a check of the system status should be made. In this case, a hydraulic pressure gauge could have been used to determine that the system was de-pressurized before work began.

I beg to differ. It would have been necessary to breach the pressurized hydraulic system to install the pressure gauge. Bear in mind that a hydraulic system can store energy in individual "zones" throughout the system. Moreover, if there is a pressure gauge at the pump, it cannot be used to confirm the status of energy elsewhere in a hydraulic system.

• Proper isolation of any piece of equipment should include the de-energizing and "try-step" of associated systems where stored energy exists.

This is wishful thinking on the part of any safety person. It has already been established that Caterpillar's hydraulic system was allegedly unsafe by design because the mechanic could not verify that the solenoid failed to de-energize the hydraulic system. Tryout may work with electricity, but it does not, and cannot, work with hydraulics.

• A safety "stand-down" has been conducted with all the mobile maintenance teams to discuss this incident and confirmation of a zero state for any system before the work begins.

This is a feel good statement that might appease the company's executives, and MSHA, but it makes absolutely no sense. The subject company employs hundreds of hydraulic systems. There isn't a single one that has been modified to bring about a permanent solution to the stored hydraulic energy problem.

Recommendations:

1. The truck was reportedly “shutdown and isolated.” In the world of hydraulics, isolation means “assumed safe.”

2. NEVER trust a manufacturer when it comes to hydraulic system de-energization. We (USA) have the technology to mitigate the problem. However, engineers won't use it because it's not mandatory. It's easy to ignore safety devices when your children's lives aren't on the line.

3. Just because OSHA, MSHA and hydraulic systems designers ignore the problem of stored hydraulic energy, doesn’t mean it can’t severely injure, maim, or kill you.

4. Treat hydraulic systems with the same respect you treat electrical systems. If you cannot verify, with an instrument, that a hydraulic system is de-energized, have a chat with your company’s LOTO expert about stored energy. The quickest way to solve the problem is to have your LOTO expert demonstrate how to de-energize a hydraulic system by loosening a connector, and discharging high-pressure oil to atmosphere. If you find a LOTO expert that has the intestinal fortitude to de-energize to atmosphere, don't forget to film the event.

5. If a hydraulic actuator (cylinder or motor) doesn’t move when you activate the actuator’s control valve, DO NOT assume the system does not contain enough stored energy to severely injure or kill you.

6. Solenoid valves are notorious for seizing, especially when they are under constant pressure, and they have a low operating frequency – NEVER TRUST THEM! Designers should only use mechanical devices, if they are not going to make provisions for verification.

7. Remember, the only reason why you are going to get severely injured or killed while working on a hydraulic system is because the valve needed to give you the ability to verify if a hydraulic system contains stored energy, post shutdown, costs a measly $20.00. The treatment of an oil injection injury averages $75,000.00.

The snake strikes again!

According to a newspaper report, one person is dead and another person injured after an incident at a paper mill. According to the police, the incident involved the release of hydraulic fluid that was under pressure. The report gave no specific details about the accident.

From the point of view of stored hydraulic energy post lockout, a mill is a veritable minefield. All hydraulic systems in mills throughout the country are nothing more, and nothing less, than "snakes waiting to strike," when an unsuspecting person doesn't have the ability, post lockout and tagout, to detect if there is stored hydraulic energy, and loosens a connector, which is under pressure. Even if they could detect pressure, they could not remove it without having to "dodge a liquid bullet."

"Hydraulic safety doesn't just happen it has to be vigorously pursued."