Safety & work procedures: turning invisible hazards into visible rules
Safety is not a chapter, it is the precondition of all work.
1. First build physical intuition: what hurts people is never the ‘equipment’, but energy
Safety discussions on the paper-machine floor often stall at unexecutable phrases like ‘be careful’. To turn them into enforceable rules, switch perspective: reduce every hazard on site to the form and path of energy. The paper machine has only five types of energy that hurt people, each with fixed exposure locations and fixed control means.
| Energy | Form present | Typical injury & exposure point |
|---|---|---|
| Mechanical energy | Rotating rolls, reciprocating blade holders, moving fabric/felt, crane potential energy | Entanglement, crushing, cutting; nip, roll gap, rewinder, slitter, drive shaft |
| Thermal energy | Steam (1.0 MPa saturated ≈ 184 ℃), dryer surface (100–140 ℃), hot air, hot oil | Scald, steam-jet cutting; condensate, flange, manhole, damaged insulation |
| Pressure energy | Hydraulic (16–25 MPa), pneumatic (0.6 MPa), trapped stock pressure, accumulator | High-pressure jet penetrating skin, part ejection; hose coupling, accumulator, stock valve |
| Chemical energy | Caustic, acid, hydrogen peroxide, biocide, sizing & coating chemicals | Chemical burn, respiratory injury; unloading, dilution, dosing, cleaning |
| Potential & asphyxiation | Stock chest, white-water tank, sump, dryer cavity (hypoxia & toxic gas) | Fall, drowning, poisoning asphyxiation; entry for cleaning & maintenance |
The value of this model: every work procedure can be written as a three-part ‘which energy to isolate + how to verify + who confirms’. A procedure that can’t state these three parts is essentially just a wish.
Which energy to isolate: mechanical (press drive & adjacent guide rolls), pressure (hydraulic loading & pneumatic tensioning), thermal (steam & hot roll face) — three coexist; isolating only mechanical energy is the most common omission.
How to verify: after drive LOTO, test-start to confirm no movement; after hydraulic depressurization, confirm gauge at zero and actuate actuator; after pneumatic depressurization, manually push the press roll to confirm free; thermal surface measured <40 ℃.
Who confirms: worker self-check + supervisor recheck + record on file (with time and signature). With all three parts complete, the procedure is executable; missing any one, the site will improvise, and ‘improvising’ is the standard opening of accidents.
2. LOTO: five steps and the six-energy list
LOTO (Lockout/Tagout) is the industry-wide energy-isolation procedure, but it is most easily reduced to formalism — because most accidents are not ‘no tag hung’ but a tag hung yet one energy path missed. So the crux is not the procedure’s name, but whether the ‘energy list’ is complete.
Standard five steps: notify (inform affected posts and adjacent processes) → stop (normal shutdown sequence, not substituting emergency stop) → isolate (disconnect all energy sources and physically lock) → bleed & verify (relieve residual energy, dual verification by instrument and test-start) → work & restore (who locks unlocks, count personnel and tools before restoring).
| Energy source | Isolation point | Verification method (all required) |
|---|---|---|
| Electric | MCC drawer, disconnect switch, VFD DC bus | Verify phase by phase with voltage tester/multimeter; VFD needs bus discharge wait (≥5 min) |
| Steam | Main steam valve + each section inlet valve, blind flange between the two | Gauge at zero; confirm no pressure via condensate bypass; high-temp part cooled below 40 ℃ |
| Hydraulic | Pump stop + shut-off valve + accumulator bleed | Gauge at zero; accumulator dedicated bleed valve open; actuate once to confirm no movement |
| Pneumatic | Air supply valve + quick-exhaust valve | Gauge at zero; manually actuate actuator to confirm no resistance |
| Stock & water | Pump stop + inlet/outlet valve closed | Open drain valve to confirm no flow; confirm overhead tank emptied |
| Gravity / potential | Lowered to bottom and mechanically supported | Support pin inserted; hydraulic lock valve confirmed |
One person, one lock, one key: lock count matches worker count, no one unlocks for another, key never leaves the person. Shift handover requires lock change: cross-shift work must re-confirm energy state and replace locks — cannot ‘previous shift locked, I continue’. Test-start only by the locker: the test-start verifying zero energy must be operated by the locker personally with continuous call-out; any test-start failure requires re-isolation — cannot ‘press it once more’.
3. Nip map: the most dangerous on the paper machine is the ‘gap’
Almost all mechanical injuries on the paper machine occur between two moving parts: roll-to-roll nip, roll-to-wire wrap angle, blade-to-roll contact line, chain and sprocket, belt and pulley. These positions cannot all be guarded during production (need threading, observation, part changes), thus forming a special risk — legitimate exposed nip: guarding may be an openable interlocked hood, or a ‘procedure requiring stop during work’, but one of them must exist.
The three most dangerous moments on site are almost all about ‘handling anomalies’: threading (hand or threading rope near the nip), clearing wraps (felt edge, roll-face wrap, blade jam), post-break recovery (sheet piling between dryer cylinders, personnel entering the dry end). The common trait of these three is ‘urgency’ — production must resume, so people cut corners. So what the procedure must pin down is the substitute action, not a ban: use threading air and rope, not hands; clear wraps only with LOTO, not ‘just thirty seconds’; handle dry-end sheet pile with a dedicated hook from the safe side, not standing on the fabric/felt. If the substitute action isn’t given, the ban will surely be bypassed — this is the most basic reality in safety-procedure design.
4. Confined space: none of the four conditions, no entry
Stock chest, white-water tank, sump, dryer cavity, pipes and tanks are the most typical confined spaces in a paper mill. Their danger is not ‘invisible’ but all normal on entry, too late on incident: hypoxia gives no warning (a person loses judgment within 30 seconds), H₂S numbs the sense of smell at low concentration (‘can’t smell it’ is precisely the danger signal), and gas from pulp fermentation can instantly displace oxygen.
Four admission conditions, none may be omitted: isolation & cleaning (per LOTO disconnect agitator and in/out flow, and thoroughly flush) → ventilation (forced mechanical ventilation for no less than the required duration, continuous throughout the work) → testing (before entry and periodically during work, detector within calibration validity) → attendance & rescue (dedicated external attendant + tripod/rescue rope + communication; rescuer must not enter unprotected).
| Indicator | Safe range | Note |
|---|---|---|
| Oxygen content | 19.5%–23.5% | Below 19.5% hypoxia, above 23.5% supports combustion; oxygen-rich environment clothing ignites easily |
| Hydrogen sulfide H₂S | < 10 ppm | Evacuate above 10 ppm; above 100 ppm instantly fatal, and at high concentration smell fails |
| Carbon monoxide CO | < 25 ppm | Mainly from incomplete combustion and cross-gas from adjacent areas |
| Combustible gas LEL | < 10% LEL | Solvent-type chemicals and cleaner residues are common sources |
One often-overlooked addition: the attendant must not double as other work, must not leave line of sight, must not ‘lend a hand on the side’. Among confined-space deaths, a large share include a companion who went in to rescue. So the procedure must pin one line: the attendant has only two actions — watch the person, call for help; under no circumstance enter; rescue is performed by properly equipped personnel with positive-pressure respirators after external preparation.
5. Steam & dryer cylinder: the physical nature of thermal-energy injury
The danger of steam lies in its ‘invisible high energy density’. 1 kg of 1.0 MPa saturated steam carries about 2,780 kJ of heat; on leak it expands to hundreds of times its volume, forming a high-speed jet — it can cause deep scald within tens of centimeters, and being a gas, a small gap in protective clothing can let it penetrate. So the core of steam-system work procedure is not ‘be careful of heat’ but three steps of cooling and depressurization: close valve to isolate → bleed to depressurize → wait for cooling to workable temperature (generally <40 ℃); all three need instrument readings for confirmation, not ‘touch to test’.
The dryer cylinder is the most concentrated thermal body on the paper machine, and also a pressure vessel. Its work risk has three layers: residual pressure & condensate inside (may still be pressurized after stop, and condensate forms high-temp ponding inside), high surface temperature (100–140 ℃ in normal operation, scald on 1 second contact), rotation & interlock (if drive not isolated during maintenance, the cylinder may be driven by an adjacent section).
6. Chemicals: protect by ‘contact route’, not by ‘toxicity grade’
Paper-mill chemicals’ safety is often underestimated because most are ‘production aids’ rather than ‘hazardous materials’: caustic for cleaning and pH adjustment, hydrogen peroxide and chelating agent for bleaching, biocide for slime control, sizing and coating chemicals for surface treatment. But their injury routes are direct — caustic is more dangerous than acid, because caustic causes saponifying deep burns that water won’t stop; high-concentration hydrogen peroxide on skin instantly whitens and pains; many biocides are strong oxidizers and sensitizers.
| Category | Typical substance & concentration | Protection & first-aid key |
|---|---|---|
| Strong alkali | Sodium hydroxide 32% / 50%, cleaning solution 2%–5% | Face shield + alkali-resistant gloves + apron; on contact flush with copious water ≥15 min, do not neutralize with acid |
| Strong acid | Hydrochloric, sulfuric acid (cleaning & regeneration) | Same as above; acid-mist environment needs acid mask, keep acid and alkali stored in separate zones |
| Oxidizer | Hydrogen peroxide 27%–50%, sodium hypochlorite | Forbid mixed storage with organics/reducers; leak diluted with copious water, no closed container |
| Biocide | Isothiazolinone, bromine types | Strong sensitizer, flush on contact; dosing point must be enclosed with eyewash |
| Sizing / coating | Starch, latex, cross-linker | Slippery floor and microbial growth are main risks; slip prevention and cleaning interval into procedure |
Three universal on-site requirements: eyewash & emergency shower must be within 10-second reach of unloading point, dosing point, and cleaning work point, and tested with water every shift; unloading work requires two or more persons, face shield and chemical suit, unloading hose periodically pressure-tested with anti-disconnect device; dilution order is always ‘alkali into water’ not ‘water into alkali’ — writing this wrong causes splash boiling.
7. System layer: turning rules into actions that won’t be forgotten
Procedures written on paper, accidents often come from the word ‘temporary’: temporary maintenance, temporary cleaning, temporary borrowed labor. So the goal of system design is not ‘stricter’ but making the correct action easier than the wrong one. Four things are most effective:
- Work permit in three levels: routine work (daily inspection, lubrication) uses a standard work order; hazardous work (hot work, working at height, confined space, temporary power, lifting, pipe break) permitted item by item, the permit carrying energy list and verification signature; cross work (multiple trades in one area) needs an on-site coordinator.
- Three-level signage: danger (red, prohibition, e.g. ‘no start’), warning (yellow, caution, e.g. ‘hot surface’), instruction (blue, mandatory, e.g. ‘face shield required’). Signage must sync with site state — leaving a tag up after repair is like planting a mine for the next job.
- Three-minute pre-shift meeting: what to do today, what is the biggest risk, who is responsible for confirmation. Three sentences done beats reading the safety code once.
- Contractor to same standard: outsourced maintenance, cleaning, lifting are high-incident links; on entry they must receive safety briefing, energy isolation executed and signed by plant personnel, work area attended by plant personnel.
One final lesson: safety assessment cannot only penalize, it must also reward. A culture of only penalties makes people hide near-misses and minor injuries; data looks clean while risk shifts to the invisible. The sensible approach is to treat ‘number of reports’ as a positive metric, and penalize ‘violation and concealment’, not ‘occurrence of events’.
8. Emergency response: the first three minutes decide the outcome
Paper-mill injuries share one time characteristic: the consequence is essentially set within the first three minutes. Entanglement injury depends on how fast power is cut and reverse-debugging frees the person; chemical burn depends on how fast you reach water; asphyxiation depends on how fast the attendant finds and calls; scald depends on how fast you leave the heat source and cool. So emergency capability is not ‘is there a plan’ but ‘what can the site accomplish within three minutes’.
| Scenario | First action | Forbidden action |
|---|---|---|
| Entanglement injury | Cut power + lock, reverse-bar to free, call ambulance simultaneously | Force-pull victim, forward jog, touch live before power cut |
| Chemical burn | Nearby shower ≥15 min, remove contaminated clothing while flushing | First use neutralizer, first fetch car to hospital, dry wipe |
| Steam/hot-water scald | Leave heat source, flowing cold water 15–20 min, cover with clean dressing | Apply toothpaste/soy sauce/oil, tear adhered clothing |
| Confined-space unconscious | Attendant calls for help + tripod lift + ventilation, do not enter | Enter pool unprotected to rescue (classic dual-fatality pattern) |
| High-pressure hydraulic oil penetration injury | Go to hospital immediately and state ‘high-pressure injection injury’, forbid squeezing wound | Treat as ordinary cut and observe, delay surgical window |
Three pieces of infrastructure decide the efficiency of these three minutes: eyewash & shower coverage radius (10-second reach), emergency communication & assembly point (workshop is noisy, shouting is useless, needs audible/visual alarm and two-way radio), first-aider scheduling (at least two trained personnel present per shift, day and night). Drill need not pursue ‘big spectacle’; more effective is the single-item drill: randomly pick a point, ask three people ‘what is the first step if something happens here’; if they can’t answer, that’s a corrective item; pick again, see whether the eyewash can be reached and flowing within 10 seconds — if not, also a corrective item.
Each critical equipment (dryer group, hydraulic unit, chemical tank, stock chest) should have an A5 information card at the door: medium & parameters (temperature/pressure/concentration), isolation-point location, first-aid key, nearest eyewash location. Its value is ‘no thinking needed in saving a life’ — under emergency the cognitive capacity drops sharply; being able to follow the card avoids mistakes. Chemical drums in the spare store also need cards: name, concentration, hazard, mixed-storage taboo, leak handling.
Key takeaways of this lecture
- Hazards reduced to five energy types: mechanical, thermal, pressure, chemical, potential & asphyxiation; every procedure must be writable as ‘which energy to isolate + how to verify + who confirms’.
- LOTO five steps: notify → stop → isolate → bleed & verify → work & restore; the crux is whether the six-energy list is complete (electric, steam, hydraulic, pneumatic, stock/water, gravity).
- One person one lock one key, lock change on shift handover, test-start only by the locker — hold these three and most LOTO-failure accidents are avoided; lock count matches worker count, key never leaves person.
- Nip map: press nip, roll-wire wrap angle, blade-roll contact line, rewinder & slitter; three iron rules — hands out of the line, clean only on stop, no interlock bypass.
- Confined space four-piece kit: isolate & clean → ventilate → test → attend & rescue; O₂ 19.5%–23.5%, H₂S <10 ppm, CO <25 ppm, combustible <10% LEL.
- Dryer-cylinder work five serial steps: stop steam & isolate → bleed & depressurize → cool <40 ℃ → drive isolate → work permit; the cylinder cavity is simultaneously managed as confined space.
- Chemicals protected by contact route: strong alkali more dangerous than strong acid; eyewash 10-second reach, tested every shift; dilution always ‘alkali into water’.
- System design goal is not stricter but making correct action easier: graded permit, three-level signage synced, three-minute pre-shift, contractor to same standard.
- The first three minutes of emergency decide the outcome: entanglement cut power then free, chemical burn flush 15 min first, confined-space unconscious forbid unprotected rescue; eyewash 10-second reach, two first-aiders per shift.
- On-site information card (medium parameters, isolation point, first-aid key) lets emergency not depend on thinking; chemicals also carded, stating mixed-storage taboo and leak handling.