Choosing and verifying controls

In February, a crew from another contractor working for Southplains Gas had a close call. Their FLHA listed the hazard 'gas release when cutting the service line,' and the control 'line isolated.' The line was isolated, at one valve. But a second feed, through a bypass the crew did not know about, kept gas flowing into the section. When the crew began to cut, gas came out of the pipe. Nobody was hurt, because the gas detector alarmed and the crew backed off. The investigation found that the form was filled in honestly. The control was real. It just had not been checked.

Leila brought the incident report to Coldwater's monthly safety meeting. 'This is the part of the form where most of the risk is,' she said, pointing to the controls column. 'Finding hazards is hard. Choosing controls that work is harder. And checking that they actually work is the step everybody skips.' This lesson covers all three.

The hierarchy of controls

Controls are not all equally strong. The hierarchy of controls ranks them from most to least effective. You may have met it before; here it is with examples from field work.

• Elimination removes the hazard completely. If the job can be done without the hazard, that is the strongest control. Examples: doing a tie-in with a fitting that does not require cutting into a live line, prefabricating pipe at ground level so nobody has to weld in the excavation, scheduling work for daylight to avoid working in the dark.
• Substitution replaces something hazardous with something less hazardous. Examples: a cold-cutting tool instead of a torch near gas, a water-based coating instead of a solvent-based one, a lighter tool, a lower-pressure test.
• Engineering controls put a physical barrier or device between people and the hazard. Examples: a trench box, guardrails, machine guards, a physical barricade around a swing radius, ventilation in a vault, a backup camera and proximity sensor on a truck, a ground fault circuit interrupter on a cord.
• Administrative controls change how people work. Examples: procedures, permits, training, signs, spotters, job rotation, limiting time in hot or cold conditions, the FLHA itself.
• Personal protective equipment protects the person wearing it. Examples: flame-resistant clothing, hard hats, safety glasses, hearing protection, respirators, gloves, fall protection harnesses.

Alberta's OHS Code sets this order in law. A hazard must be eliminated if that is reasonably practicable. If not, it must be controlled with engineering controls first, then administrative controls, then personal protective equipment, or with a combination of these that gives a greater level of protection.

Why higher is better

The higher controls work on the hazard itself. They do not depend on people noticing the hazard, remembering the rule or wearing the equipment correctly. A trench box protects the worker whether or not they are paying attention. A sign that says 'stay out of the trench when the walls look unstable' only works if someone reads it, believes it and judges the walls correctly.

That links directly to Lesson 5. Elimination, substitution and engineering controls are much more likely to be direct controls, which are the ones needed for high-energy hazards. Administrative controls and PPE are usually indirect. They still matter, and many jobs need them, but they should not be the only controls for anything that could kill.

Why the lower levels still matter

In real field work, many hazards cannot be eliminated or engineered away completely, especially on short jobs. Almost every FLHA will include administrative controls and PPE. The goal is not to avoid them, but to use them in layers on top of stronger controls wherever possible. The crew that plans 'trench box, plus competent person inspection, plus ladder within 7.5 m (25 ft) of every worker, plus hard hats' has four layers. If one fails, the others are still there.

Choosing controls on an FLHA

When the crew reaches the controls column, Dani asks four questions for every hazard, in order:

• Can we get rid of it? Is there a way to do this step without the hazard at all, such as a different method, a different time or a different location?
• Can we make it smaller? Can we use less energy: lower pressure, a lighter load, a shallower excavation, a slower speed, a smaller tool?
• Can we put something between it and us? Is there a barrier, a guard, a box, a lock, a cover, distance?
• What do we do and wear to manage what is left? Procedures, permits, spotters, training and PPE.

Asking in this order stops the crew from jumping straight to 'wear PPE' and 'be careful,' which are the controls people think of first because they are the easiest. Often, the first two questions produce a better plan that is no slower. On the Hillcrest job in Lesson 1, asking 'can we get rid of it?' about the soft ground led the crew to move the truck, which removed the rollover hazard entirely.

What a good control looks like on paper

A control written on the form should pass three simple tests:

• Specific. It says exactly what will be done. Not 'isolate the line' but 'close and lock valves V-12 and V-14, open bleed at the meter riser, confirm zero pressure on the gauge and with the detector.'
• Owned. It is clear who will do it. Some forms have a column for the person responsible; if yours does not, write the name or role next to the control.
• Checkable. Someone walking up to the site could see whether it is in place. A trench box is checkable. 'Stay alert' is not.

Critical controls

Some controls matter much more than others. For each high-energy hazard, there are usually one or two controls that, if they failed, would leave people directly exposed to serious harm. Many industries call these critical controls. The idea comes from mining and process industries, which developed it after studying what actually stopped major incidents. It is now used by many utilities, pipeline operators and contractors.

For Coldwater's common jobs, the critical controls include:

The point of naming critical controls is focus. A busy crew cannot check every control on the form every hour. But they can check the critical ones, every time, before anyone is exposed.

Verifying controls

This is the step the other contractor's crew missed. A control that is planned but not verified is only a hope. Verification means someone checks, in the field, that the control is actually in place and working, before people are exposed to the hazard and again when conditions change.

Many companies now use critical control verification, or CCV, for their highest risks. It works like this:

• For each critical control, the company writes a short list of yes-or-no questions that anyone can check in the field. For a gas isolation: 'Are all feeds to the section identified on the drawing? Is each feed valve closed and locked? Is the section bled to zero? Has zero pressure been confirmed on a gauge and with a detector? Is the detector on and in the work area?'
• Before the work starts, the lead hand or a crew member goes through the questions, looking at the control itself, not at the paperwork.
• If any answer is 'no,' the work does not start until it is fixed.
• Supervisors and managers do the same checks on a sample of jobs, and the results are tracked.

'Show me,' not 'tell me'

The heart of verification is seeing, not asking. 'Is the line isolated?' invites the answer 'yes.' 'Show me the locks and the gauge' invites a walk to the valves. Owen, the superintendent, calls this the 'show me' rule. When he visits a crew, he does not ask whether the controls are in place. He asks someone to show him, starting with the critical ones.

Verification for isolations deserves special care, because stored energy can hide. For mechanical and electrical isolations, the standard practice is often described as 'try, test, verify': try to start the equipment after locking it out, test with an appropriate meter that there is no voltage, and verify that stored energy, such as pressure, springs or capacitors, has been released. For gas lines, it means confirming zero pressure at the work point, not just at the valve, and continuing to monitor while the line is open, because a missed feed or a leaking valve can bring pressure back.

Controls change during the day

A control that was verified at 8 a.m. may not be in place at 2 p.m. Barriers get moved to let a truck through. Spoil piles creep toward the edge. Someone takes off their hearing protection to talk. A valve gets opened by an operator who did not know the crew was there. That is why verification is not a one-time event. Dani's crew re-checks critical controls after every break, every shift change, every change in the work and any time someone new joins. Lesson 9 covers how to handle changes in conditions.