Hazard assessment and the job safety analysis

The steam drum crew's first task on Unit 2 is to remove the two drum manway covers so that the inspectors can get inside. Before anyone touches a wrench, Dale gathers the crew at the drum platform, pulls out a pad of forms and starts writing. The form is a job safety analysis, the JSA, and every crew at Riverbend fills one in at the work site for every task, every shift. Kiera has seen it in the orientation as a box on a flow chart. Here she sees what it is for: five people looking at the same piece of equipment and saying out loud what could hurt them and what they will do about it.

Why hazards are assessed

OSHA has no single general standard for hazard assessment, but many of its rules depend on one. The personal protective equipment standard, 29 CFR 1910.132(d), requires the employer to assess the workplace for hazards that call for PPE and to certify in writing that the assessment was done. The confined space, lockout and process safety standards all require hazards to be identified before work starts, and the general duty clause covers recognized hazards that no standard addresses. Plant owners and contractors along the Gulf Coast meet these duties with a written job safety analysis, a JSA, sometimes called a job hazard analysis, prepared for each task and reviewed with the crew at the work site before the shift's work begins.

There are usually two levels. A formal hazard assessment is prepared in advance for each type of work, by the contractor's supervisors and safety staff, often with the owner. It looks at the job as planned: the equipment, the methods, the tools, the expected hazards and the controls. The task-level assessment is done by the crew on the day, at the work site, looking at the job as it actually is. The two are different because the plan and the reality are different. The formal assessment for removing manway covers does not know that this morning there is a scaffold crew working directly below the drum platform, or that the drum is still warm because the cooldown ran late.

The steps of a task-level assessment

Whatever the form looks like, the assessment follows the same steps. Dale's crew works through them in about ten minutes:

• Describe the task and break it into steps. Removing a manway cover: confirm the permit and isolations; check the drum is cool and vented; loosen the cover nuts; support the cover; remove the yoke and bolts; swing or lower the cover clear; secure it.
• For each step, identify what could go wrong. Residual pressure or hot water behind the cover; a burn from hot metal; the cover dropping onto hands or feet; a strain from handling a 150 lb cover; a wrench slipping; a fall from the platform; objects falling onto the scaffold crew below.
• Decide on controls for each hazard, using the most effective control that is practical. Verify the drum vent is open and the drain shows nothing; measure the surface temperature; use a chain hoist from the beam over the manway rather than lifting by hand; keep hands out of the pinch point; barricade the area below; tie off tools.
• Assign who does what, and record it. Each crew member reads the assessment and signs it.
• Review it when anything changes. If the scaffold crew below leaves, or the drum turns out to be wetter than expected, the crew stops and updates the form.

Rating the risk

Many forms ask the crew to rate each hazard. A common method multiplies a likelihood score by a severity score, each from 1 to 5, to give a risk score from 1 to 25. The score is worked out twice, once with no controls in place, the inherent risk, and once with the planned controls, the residual risk. If the residual risk is still high, the job cannot go ahead as planned. Ironbridge's form uses the bands below, which are typical of the industry but not universal.

The score is not the point. The value of the rating is that it makes the crew argue about how likely and how bad each hazard is, and whether the controls really change those answers. A barricade below the platform reduces the likelihood that someone below is struck. A chain hoist reduces the likelihood of a strain or a dropped cover. Neither changes the severity of a cover landing on a foot, which is why the crew also keeps feet clear of the swing path. The code below scores the hazards from Dale's form before and after the controls.

# Risk scores for the manway cover task, before and after controls (likelihood x severity, 1 to 5 each)
hazards = [
    ("residual pressure or hot water", 2, 5, 1, 5),
    ("burn from hot metal",            3, 3, 1, 3),
    ("cover drops on hands or feet",   3, 4, 1, 4),
    ("back strain handling cover",     4, 3, 2, 2),
    ("tool falls on crew below",       3, 4, 1, 4),
]
def band(score):
    return "low" if score <= 4 else "medium" if score <= 9 else "high" if score <= 16 else "extreme"
for name, l0, s0, l1, s1 in hazards:
    r0, r1 = l0 * s0, l1 * s1
    print(f"{name:<34} before {r0:2d} ({band(r0):<7}) after {r1:2d} ({band(r1)})")
worst = max(l1 * s1 for _, _, _, l1, s1 in hazards)
print("residual risk acceptable" if worst <= 9 else "replan the task")

residual pressure or hot water     before 10 (high   ) after  5 (medium)
burn from hot metal                before  9 (medium ) after  3 (low)
cover drops on hands or feet       before 12 (high   ) after  4 (low)
back strain handling cover         before 12 (high   ) after  4 (low)
tool falls on crew below           before 12 (high   ) after  4 (low)
residual risk acceptable

The hierarchy of controls

Controls are not all equal. The hierarchy of controls ranks them from most to least effective. Elimination removes the hazard: if the cover can be opened by the hydraulic davit the plant installed last year, nobody handles it. Substitution replaces the hazard with a lesser one: a battery torque tool instead of a sledge and a slugging wrench. Engineering controls separate people from the hazard: a guardrail, a barricade, a ventilation fan, a hoist. Administrative controls change how people work: procedures, permits, training, warning signs, rotating workers out of the heat. Personal protective equipment, at the bottom, protects the individual when everything above it has not been enough.

Crews drift toward the bottom of the hierarchy because it is the easiest to write down. Wear gloves is quicker to write than rig a hoist. Imran reviews a sample of each crew's forms every day and sends back those that list only PPE for a serious hazard. In later lessons, the same hierarchy appears again for confined spaces, falls, hot work and health hazards, and in every case the strongest controls are the ones that change the work rather than the worker.

Stopping the job

Every worker on an Ironbridge crew has the authority to stop work if they believe it has become unsafe, and to have the concern looked at before work resumes. It is the practical form of the right to refuse. Rosa tells new apprentices that nobody on her crews has ever been disciplined for stopping a job, and that the only wrong answer is to keep working while worried. When work is stopped, the crew makes the area safe, tells the foreman, reviews the hazard assessment, and resumes only when the concern has been resolved and the form updated.

A formal refusal is a stronger step. Under OSHA's rules a worker may refuse work that presents an imminent danger of death or serious injury when there is not enough time to have it corrected through normal channels, and is protected from retaliation for doing so. Most Gulf Coast owners and contractors go further in their own programs, giving every worker stop-work authority for any task they believe is unsafe, and the union agreement backs that up.

A completed assessment

The table below is a shortened copy of the assessment Dale's crew wrote for the manway covers. On the real form each step has its own row, and the bottom of the page holds the signatures of everyone on the crew, the foreman's review and the time.

Common weaknesses

Imran's daily review of the forms finds the same few problems over and over. The first is vagueness: a hazard written as be careful or a control written as use caution, which tells nobody what to do. The second is the missing step: the form covers the main work but not the setup, the cleanup or the trip up the stairs with the tools. The third is the copied form, word for word the same as yesterday's, which shows that nobody looked at the job again. The fourth is the form that nobody discussed: one person filled it in and the others signed without reading it. Each of these turns the assessment back into paperwork. A good assessment is short, specific and argued over, and every name at the bottom belongs to someone who could explain it.

The task-level assessment also connects to the larger systems. If it finds a hazard the permit did not address, such as an isolation missing from the list, the work stops until the permit is corrected. If it finds a hazard beyond the crew's ability to control, such as a scaffold that has been altered, the crew calls the people who can fix it. The form is where the crew notices; the fixes come from the whole site.