Archived - Decision: 95-015 CANADA LABOUR CODE PART II OCCUPATIONAL SAFETY AND HEALTH

Review under section 146 of the Canada Labour Code, Part II,

of a direction issued by a safety officer

Decision No.95-015

Applicant: R. J. Corfe

Assistant Vice-President

The St. Lawrence Seaway Authority

Niagara Region

St. Catharines, Ontario

Mis en cause: Julie D. Bottoni

Safety Officer #1713

Human Resources Development Canada

Ontario Region

Respondent: Gary Wilson

Co-chairman safety committee

Canadian Auto Workers

Local 4212

Before: Bertrand Southière

Regional Safety Officer

Human Resources Development Canada

A hearing was held in St Catharines on July 20, 1995. In attendance were:

- Joel Fournier, Service person 9 President, local 4212

- John Thomas Wickabrod Jr., Operations Union safety rep.

- Gary Wilson, Co-chairman, occupational health & safety committee, local 4212

- Vince Hearn, Union member

- Julie Bottoni, Safety Officer, HRDC, Labour Program

- Wayne Page, Technical adviser/OSH, HRDC, Labour Program

- R. Noel, Safety Officer, HRDC, Labour Program

- Peggy Wright, Safety Officer, HRDC, Labour Program

- W. Bruce Tkachuk, Safety Officer, St Lawrence Seaway

- R. J. Corfe, Co-chairman, occupational health & safety committee, Niagara region, St Lawrence Seaway Authority

- John Teravich, Manager, Central Area, St Lawrence Seaway Authority

- Larry Malone, Electrical Manager, St Lawrence Seaway Authority

- Bill Valedis, Independent Consultant, PLC system

Background

The engineering report titled "Investigation of flight lock controls"

dated June 1, 1995, and prepared by the Investigation Committee, gives

a brief description of the incident which was at the root of the

direction:

"On April 11, 1995, Lock 6W was dumped into Lock 5W with valves (11,

12) at the upper end of Lock 6W open. This resulted in major

flooding and could have caused injury and loss of life." (from page

1 of report)

A second incident is also described in this report:

"On April 13, 1995, valves 9 & 10 of Lock 6 reopened on their own."

(from page 1 of report)

The report goes on to say:

"These two major incidents, plus the numerous other minor incidents

at the LWC (Lock Wall Control) of the flight locks, caused

management to set up an Investigation Committee to determine the

cause and recommend solutions.

The Investigation Committee was composed of:

Larry Malone Engineering Services, St Catharines - Chairperson

Pat Vinelli Operational Services, Cornwall

Dave Shaw Central Area, St Catharines

Bill Valedis Independent Technical Expert."

The report of the Investigation Committee as well as other documents

submitted by the employer are on file in this case.

It is my understanding that the operation of the locks is controlled by

a computer system. Essentially, the computer handles the sequencing of

the various elements when a ship goes through a lock. This involves

the operation of components of the lock system such as lock gates, ship

arresters, valves, etc. I gather, from the documents in my possession,

that this computer system has failings, which failings were at the

origin of the incidents referred to above.

Following the incidents referred to previously and as an interim

measure, it was decided to use a manual step by step procedure

incorporating a manual lockout of each piece of equipment. The lockout

involves manually cutting the power to the valve operators. This

ensures that, even if the computer sends an erroneous message, for

instance to open the valves while in fact the valves should remain

closed, the valves will not open: they are disabled at the source.

The consultant retained by the employer, Mr. Valedis, after an

examination of the automated control system, suggested that, until the

computer system was totally debugged, a "temporary valve control

disable" or "soft disconnect" be put in place as a replacement for the

manual lockout of the valve motors. This feature, when activated,

would prevent any command in the PLC (programmable logic controller)

from operating the valve.

The employer decided to implement the consultant's suggestion. As

recommended by the Investigation Team, the "temporary valve control

disable" was subjected to three levels of testing: a test of the logic

at the office, a field test by the engineering team and finally,

operational tests by the operation testing team. On May 26, 1995, the

employer proceeded to implement the "temporary valve control disable"

function for the east side of the flight locks. However, following a

refusal to work, the implementation was postponed for the weekend. On

Monday morning, May 29, 1995, Julie Bottoni, a safety officer with

Human Resources Development Canada, was informed of the refusal to

work. The safety officer conducted an inquiry on May 30, 1995, and as

a result, issued a direction to the employer (appendix 1).

Submission for the employer

The employer submits that the direction was not based on the facts at

hand. The "soft disconnect" has been tested extensively by technical

personnel and by employee representatives and has been found to work

all the time. The "soft disconnect" is outside of the logic path and

replicates the manual power disconnect. Also, the direction does not

address the refusal to work at time of refusal.

Submission for the employees

The union submits that, in their opinion, the system is faulty, the

wiring is faulty, the logic is faulty. The "soft disconnect" goes

through the computer which the employees do not trust. In contrast,

the manual disconnect is direct and definitive.

Discussion

The direction issued by the safety officer states that "the automated

lockout "Soft Disconnect" has not been established as a fail-safe

method to ensure that incorrect messages are not being sent and

received..." On the other hand, the employer states, in R. J. Corfe's

letter of June 12, 1995:

"John Teravich advised that the first three (3) levels of testing

recommended by the Investigation Team prior to implementation has

been completed for the east side of the flight locks. The first

being a test of the logic at the office, the second being the field

test by the Engineering Team and the third the operational tests by

the Operations Testing Team. He stated that he is moving to the

implementation stage of the recommendation whereby the special

procedures at the east flight locks will not be necessary. David

Shaw was confident with this course of action. Dan Warner noted

that although the Testing Team performed all of the tests and

"could not get the system to fail", he was not prepared to make a

recommendation that we proceed...."

There was an employee representative on the Investigation Team along

with employer's representatives and an independent consultant. There

were also employees' representatives on the Operations Testing Team.

The results of the tests do not support the contention by the safety

officer that "the automated lockout "Soft Disconnect" has not been

established as a fail-safe method..." Furthermore, these test results

have not been disputed by the employees. In spite of the problems with

the computerized controls and the employees' lack of confidence in the

system as a whole, the valve logic disable feature (soft disconnect)

has been demonstrated by tests to provide the same function as the

lockout procedures for the valves.

It is also noted, as raised by R. J. Corfe in his arguments dated April

20(?), 1995, that the safety officer did not make a decision regarding

the refusal to work as required by subsection 129(2) of the Canada

Labour Code.

Decision

Because the argument used by the safety officer to issue her direction

is not supported by facts, I hereby rescind the direction issued to

the St Lawrence Seaway Authority by safety officer Julie D. Bottoni on

June 2, 1995.

Decision given on October 31, 1995.

Bertrand Southière

Regional Safety Officer

IN THE MATTER OF THE CANADA LABOUR CODE

PART II - OCCUPATIONAL SAFETY AND HEALTH

DIRECTION TO THE EMPLOYER UNDER PARAGRAPH 145(2)(a)

On May 30, 1995, the undersigned safety officer conducted an inquiry in

the work place operated by the St-Lawrence Seaway Authority, being an

employer subject to the Canada labour Code, Part II, at 508 Glendale

Avenue, St. Catharines (sic), Ontario, the said work place being

sometimes known as the St. Lawrence Seaway.

The said safety officer considers that the use of a thing constitutes a

danger to an employee while at work:

the automated lockout "Soft Disconnect" has not been established as

a fail-safe method to ensure that the incorrect messages are not

being sent and received and causing phantom type movements of the

lock components and valves which places the lock crew in an unsafe

work environment.

Therefore, you are HEREBY DIRECTED, pursuant to paragraph 145(2)(a) of

the Canada Labour Code, Part II, to take measures immediately for

guarding the source of danger.

Issued at Mississauga, this June 2, 1995.

Julie D. Bottoni

Safety Officer

# 1713

To: St.Lawrence Seaway Authority

508 Glendale Avenue

St. Catharines (sic), Ontario

L2R 6V8

SUMMARY OF REGIONAL SAFETY OFFICER DECISION

Decision No.: 95-015

Applicant: The St Lawrence Seaway Authority, Niagara Region

R. J. Corfe, Assistant Vice President

KEYWORDS:

Automated control; manual lockout; canal lock; St Lawrence Seaway

Authority.

PROVISIONS:

Code: 145(2)(a), 129(2)

SUMMARY:

On April 11, 1995, there was an incident on the Welland Canal when Lock

#6 West dumped into Lock #5 West while the valves at the upper end of

Lock #6 were open. As a result, Lock #5 overflowed and there was a

flood of water in the immediate vicinity causing a fair amount of

material damage. A couple of days later, there was a second incident

where valves seemingly opened by themselves, without consequences

however. The employer, as an interim measure, resorted to a manual

lockout of the valves to prevent a repetition of these incidents. At

the same time, an investigation team made up of representatives of the

employer and of the employees, assisted by an independent consultant

was charged to investigate the incidents and to come up with a

solution. After a preliminary investigation of the computerized lock

control system, the consultant concluded that the hardware and the

software had to be improved and suggested as a safeguard that a valve

control disable function ("soft disconnect") in the computer could be a

substitute to the manual lockout of the valves. After thorough testing

of this function, the employer attempted to implement it at the end of

May 1995. However, this led to a refusal to work by some of the

employees. A safety officer was called in and after investigating,

issued a direction instructing the employer not to use the "soft

disconnect".

The RSO rescinded the direction because the direction was predicated on

the "soft disconnect" not being fail-safe, when all the tests carried

out on the "soft-disconnect" had shown that it worked all the time.

The RSO also pointed out that, contrary to subsection 129(2) of the

Canada Labour Code, the safety officer had not made a decision

regarding the refusal to work.