CANADA LABOUR CODE
PART II
OCCUPATIONAL SAFETY AND HEALTH
Review under section 146 of the Canada Labour Code, Part II,
of a direction issued by a safety officer
Decision No. 95-015
Applicant: R. J. Corfe
Assistant Vice-President
The St. Lawrence Seaway Authority
Niagara Region
St. Catharines, Ontario
Mis en cause: Julie D. Bottoni
Safety Officer #1713
Human Resources Development Canada
Ontario Region
Respondent: Gary Wilson
Co-chairman safety committee
Canadian Auto Workers
Local 4212
Before: Bertrand Southière
Regional Safety Officer
Human Resources Development Canada
A hearing was held in St Catharines on July 20, 1995. In attendance
were:
- Joel Fournier Service person 9
President, local 4212
- John Thomas Wickabrod Jr. Operations
Union safety rep.
- Gary Wilson Co-chairman, occupational health &
safety committee, local 4212
- Vince Hearn Union member
- Julie Bottoni Safety Officer, HRDC, Labour Program
- Wayne Page Technical adviser/OSH, HRDC, Labour
Program
- R. Noel Safety Officer, HRDC, Labour Program
- Peggy Wright Safety Officer, HRDC, Labour Program
- W. Bruce Tkachuk Safety Officer, St Lawrence Seaway
- R. J. Corfe Co-chairman, occupational health &
safety committee, Niagara region,
St Lawrence Seaway Authority
- John Teravich Manager, Central Area, St Lawrence
Seaway Authority
- Larry Malone Electrical Manager, St Lawrence Seaway
Authority
- Bill Valedis Independent Consultant, PLC system
Background
The engineering report titled "Investigation of flight lock controls"
dated June 1, 1995, and prepared by the Investigation Committee, gives
a brief description of the incident which was at the root of the
direction:
"On April 11, 1995, Lock 6W was dumped into Lock 5W with valves (11,
12) at the upper end of Lock 6W open. This resulted in major
flooding and could have caused injury and loss of life." (from page
1 of report)
A second incident is also described in this report:
"On April 13, 1995, valves 9 & 10 of Lock 6 reopened on their own."
(from page 1 of report)
The report goes on to say:
"These two major incidents, plus the numerous other minor incidents
at the LWC (Lock Wall Control) of the flight locks, caused
management to set up an Investigation Committee to determine the
cause and recommend solutions.
The Investigation Committee was composed of:
Larry Malone Engineering Services, St Catharines - Chairperson
Pat Vinelli Operational Services, Cornwall
Dave Shaw Central Area, St Catharines
Bill Valedis Independent Technical Expert."
The report of the Investigation Committee as well as other documents
submitted by the employer are on file in this case.
It is my understanding that the operation of the locks is controlled by
a computer system. Essentially, the computer handles the sequencing of
the various elements when a ship goes through a lock. This involves
the operation of components of the lock system such as lock gates, ship
arresters, valves, etc. I gather, from the documents in my possession,
that this computer system has failings, which failings were at the
origin of the incidents referred to above.
Following the incidents referred to previously and as an interim
measure, it was decided to use a manual step by step procedure
incorporating a manual lockout of each piece of equipment. The lockout
involves manually cutting the power to the valve operators. This
ensures that, even if the computer sends an erroneous message, for
instance to open the valves while in fact the valves should remain
closed, the valves will not open: they are disabled at the source.
The consultant retained by the employer, Mr. Valedis, after an
examination of the automated control system, suggested that, until the
computer system was totally debugged, a "temporary valve control
disable" or "soft disconnect" be put in place as a replacement for the
manual lockout of the valve motors. This feature, when activated,
would prevent any command in the PLC (programmable logic controller)
from operating the valve.
The employer decided to implement the consultant's suggestion. As
recommended by the Investigation Team, the "temporary valve control
disable" was subjected to three levels of testing: a test of the logic
at the office, a field test by the engineering team and finally,
operational tests by the operation testing team. On May 26, 1995, the
employer proceeded to implement the "temporary valve control disable"
function for the east side of the flight locks. However, following a
refusal to work, the implementation was postponed for the weekend. On
Monday morning, May 29, 1995, Julie Bottoni, a safety officer with
Human Resources Development Canada, was informed of the refusal to
work. The safety officer conducted an inquiry on May 30, 1995, and as
a result, issued a direction to the employer (appendix 1).
Submission for the employer
The employer submits that the direction was not based on the facts at
hand. The "soft disconnect" has been tested extensively by technical
personnel and by employee representatives and has been found to work
all the time. The "soft disconnect" is outside of the logic path and
replicates the manual power disconnect. Also, the direction does not
address the refusal to work at time of refusal.
Submission for the employees
The union submits that, in their opinion, the system is faulty, the
wiring is faulty, the logic is faulty. The "soft disconnect" goes
through the computer which the employees do not trust. In contrast,
the manual disconnect is direct and definitive.
Discussion
The direction issued by the safety officer states that "the automated
lockout "Soft Disconnect" has not been established as a fail-safe
method to ensure that incorrect messages are not being sent and
received..." On the other hand, the employer states, in R. J. Corfe's
letter of June 12, 1995:
"John Teravich advised that the first three (3) levels of testing
recommended by the Investigation Team prior to implementation has
been completed for the east side of the flight locks. The first
being a test of the logic at the office, the second being the field
test by the Engineering Team and the third the operational tests by
the Operations Testing Team. He stated that he is moving to the
implementation stage of the recommendation whereby the special
procedures at the east flight locks will not be necessary. David
Shaw was confident with this course of action. Dan Warner noted
that although the Testing Team performed all of the tests and
"could not get the system to fail", he was not prepared to make a
recommendation that we proceed...."
There was an employee representative on the Investigation Team along
with employer's representatives and an independent consultant. There
were also employees' representatives on the Operations Testing Team.
The results of the tests do not support the contention by the safety
officer that "the automated lockout "Soft Disconnect" has not been
established as a fail-safe method..." Furthermore, these test results
have not been disputed by the employees. In spite of the problems with
the computerized controls and the employees' lack of confidence in the
system as a whole, the valve logic disable feature (soft disconnect)
has been demonstrated by tests to provide the same function as the
lockout procedures for the valves.
It is also noted, as raised by R. J. Corfe in his arguments dated April
20(?), 1995, that the safety officer did not make a decision regarding
the refusal to work as required by subsection 129(2) of the Canada
Labour Code.
Decision
Because the argument used by the safety officer to issue her direction
is not supported by facts, I hereby rescind the direction issued to
the St Lawrence Seaway Authority by safety officer Julie D. Bottoni on
June 2, 1995.
Decision given on October 31, 1995.
Bertrand Southière
Regional Safety Officer
IN THE MATTER OF THE CANADA LABOUR CODE
PART II - OCCUPATIONAL SAFETY AND HEALTH
DIRECTION TO THE EMPLOYER UNDER PARAGRAPH 145(2)(a)
On May 30, 1995, the undersigned safety officer conducted an inquiry in
the work place operated by the St-Lawrence Seaway Authority, being an
employer subject to the Canada labour Code, Part II, at 508 Glendale
Avenue, St. Catharines (sic), Ontario, the said work place being
sometimes known as the St. Lawrence Seaway.
The said safety officer considers that the use of a thing constitutes a
danger to an employee while at work:
the automated lockout "Soft Disconnect" has not been established as
a fail-safe method to ensure that the incorrect messages are not
being sent and received and causing phantom type movements of the
lock components and valves which places the lock crew in an unsafe
work environment.
Therefore, you are HEREBY DIRECTED, pursuant to paragraph 145(2)(a) of
the Canada Labour Code, Part II, to take measures immediately for
guarding the source of danger.
Issued at Mississauga, this June 2, 1995.
Julie D. Bottoni
Safety Officer
# 1713
To: St.Lawrence Seaway Authority
508 Glendale Avenue
St. Catharines (sic), Ontario
L2R 6V8
SUMMARY OF REGIONAL SAFETY OFFICER DECISION
Decision No.: 95-015
Applicant: The St Lawrence Seaway Authority, Niagara Region
R. J. Corfe, Assistant Vice President
KEYWORDS:
Automated control; manual lockout; canal lock; St Lawrence Seaway
Authority.
PROVISIONS:
Code: 145(2)(a), 129(2)
SUMMARY:
On April 11, 1995, there was an incident on the Welland Canal when Lock
#6 West dumped into Lock #5 West while the valves at the upper end of
Lock #6 were open. As a result, Lock #5 overflowed and there was a
flood of water in the immediate vicinity causing a fair amount of
material damage. A couple of days later, there was a second incident
where valves seemingly opened by themselves, without consequences
however. The employer, as an interim measure, resorted to a manual
lockout of the valves to prevent a repetition of these incidents. At
the same time, an investigation team made up of representatives of the
employer and of the employees, assisted by an independent consultant
was charged to investigate the incidents and to come up with a
solution. After a preliminary investigation of the computerized lock
control system, the consultant concluded that the hardware and the
software had to be improved and suggested as a safeguard that a valve
control disable function ("soft disconnect") in the computer could be a
substitute to the manual lockout of the valves. After thorough testing
of this function, the employer attempted to implement it at the end of
May 1995. However, this led to a refusal to work by some of the
employees. A safety officer was called in and after investigating,
issued a direction instructing the employer not to use the "soft
disconnect".
The RSO rescinded the direction because the direction was predicated on
the "soft disconnect" not being fail-safe, when all the tests carried
out on the "soft-disconnect" had shown that it worked all the time.
The RSO also pointed out that, contrary to subsection 129(2) of the
Canada Labour Code, the safety officer had not made a decision
regarding the refusal to work.