Pith. sign in

REVIEW 5 minor 2 references

Design Didn't Prevent These Hazard Exposures

T0 review · 0 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Two shock incidents show design pushed workers to unsafe workarounds.

desk verdict Useful field case study; the design-encouragement claim is plausible but not proven, and the author's own Section IV concedes the main confound. read the letter →

arxiv 2506.03280 v1 pith:MNFTBANF submitted 2025-06-03 physics.ins-det

David. E Mertz (1) ((1) Fermilab) This is my paper
classification physics.ins-det
keywords electricalsafetyPreventionthroughDesignNFPA70EHand-Off-Autocontrolscrowbarassemblyhazardexposureforshockincident
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that equipment design which makes the safe way to work physically awkward is effectively a decision to encourage unsafe work. It supports that claim with two 2024 incidents at a U.S. accelerator laboratory: a maintenance worker reached into a live crowbar assembly to remove an internal mounting bolt and contacted 385 VDC, and electricians opened a 480 V controller to reach internal Hand-Off-Auto switches. The paper presents the retrofits, external grounding studs for the crowbar and external Hand-Off-Auto switches for the controller, as engineering controls that remove the unsafe workaround. It also acknowledges that work planning was inadequate in both cases, while insisting that the design features shaped the unsafe choices. The practical point is that designers and equipment selectors should treat physical obstacles to safe work as a hazard in their own right.

What carries the argument

The analytic machinery is the Hierarchy of Controls from NFPA 70E, applied through a Prevention through Design lens. The paper names concrete physical mechanisms: an ergonomically inaccessible MS connector, a mounting bolt whose only access is inside the assembly, and internal Hand-Off-Auto switches behind a live 480 V panel. Each mechanism converts a safe, compliant procedure into a physically awkward or impossible one, which is what makes workers choose the unsafe alternative.

What would settle it

A reader could test the claim by comparing incident and near-miss rates for identical equipment before and after a retrofit like the external Hand-Off-Auto switch conversion: if units with external controls show the same frequency of energized panel openings or shock contacts during troubleshooting, the design's causal role would not be supported.

Watch

Extended reading notes

Core claim

The paper's central claim is that physical design features can load the dice toward unsafe work even when safety rules and personal protective equipment exist. On its own terms, a design decision that places an obstacle in the path of safe performance whether an inaccessible connector, a mounting bolt inside a live enclosure, or Hand-Off-Auto switches reachable only by opening a 480 V cabinet is effectively a decision to encourage work to be performed unsafely. The paper documents two incidents, identifies exactly which design features made the non-compliant actions the natural path, and shows retrofits that remove the trigger. It also states that work planning was inadequate in both cases, so design is presented as a contributing cause rather than the sole cause.

Load-bearing premise

The argument rests on treating the specific physical features, not the acknowledged planning failures, as a real cause of the unsafe actions in two incidents; if planning or training had been the dominant cause, the design retrofits would be less decisive.

Editorial extensions

If this is right

  • Procurement specifications for controllers should require exterior Hand-Off-Auto switches or equivalent access controls, not only for new builds but for replacements.
  • Design reviews of legacy equipment should look for fasteners and service points inside energized enclosures; those are candidates for retrofitting before an incident occurs.
  • The retrofit decisions imply that engineered access is a higher-priority control than relying on lockout-tagout procedures and personal protective equipment alone.
  • Equipment that is otherwise compliant can still fail its safety purpose if ordinary maintenance requires reaching past live parts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension would be a systematic audit of other installed controllers and RF assemblies for internal-only controls, using the two cases as a search template.
  • The paper's data do not provide a baseline against which to measure the retrofits' effect, so a before-and-after or cross-site comparison would be the logical next step.
  • The general principle, if correct, would apply beyond electrical equipment: any design that makes the safe method physically infeasible will tend to produce unsafe behavior, a claim the two anecdotes illustrate but do not prove.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

0 major / 5 minor

Summary. This manuscript, intended for the IEEE Electrical Safety Workshop, reports two 2024 electrical incidents at Fermilab and argues that equipment design features contributed to unsafe worker actions. In the first incident, a technician replacing a crowbar assembly in the Linac RF station could not reach the MS connector in place, so he shifted the assembly, which required removing an internally located mounting bolt and exposed a 385 VDC printed-circuit-board contact point. In the second incident, a lead electrician opened an energized 480 V sump pump controller with internal Hand-Off-Auto switches without LOTO or PPE to test the pump manually. The author describes retrofits (an external grounding stud for the crowbar assembly and external HOA switches for the sump pump controller) and acknowledges that work planning was also deficient in both cases. The paper concludes that design decisions placing obstacles in the way of safe work effectively encourage unsafe work, referencing NFPA 70E Annex O and the Hierarchy of Controls.

Significance. The paper's value lies in its detailed, candid incident narratives and its concrete retrofit descriptions; it gives design engineers and equipment specifiers practical examples of how layout and control placement can erode safe work practices. The author is explicit that design was not the sole cause, and the discussion of the sump pump controller's momentary HOA switch is a particularly strong illustration of how a design can eliminate a standard safe testing procedure. The paper also cites relevant OSHA and NFPA 70E thresholds. Because it is a case study rather than a controlled experiment, it does not offer baseline comparisons, but for its intended venue (an ESW paper) the evidentiary standard is met. The retrofits are logical engineering controls aligned with the Hierarchy of Controls. The manuscript is well-written and would be useful to practitioners; no machine-checked proofs or quantitative models are claimed, which is appropriate for this format.

minor comments (5)
  1. [Abstract and Section V] The abstract promises that 'Design-stage processes that help identify features that will foster rather than compromise safe work practices will be identified as well,' but the body only references NFPA 70E Annex O and the Hierarchy of Controls without describing a concrete process; please either add a short subsection proposing a specific design-review process or revise the abstract to match the actual content.
  2. [Section II A] There is a grammatical error in 'replaced an external terminal strips' which should read 'replaced external terminal strips'; also check 'serval' in Section III B and the malformed reference 'NFPA 70E 350.(9)(3)(b)' where the period appears misplaced.
  3. [Section III B] The finding that the internal HOA switch has a momentary (spring return) action is important and could be used to strengthen the causal argument; consider stating explicitly that this design makes a standard LOTO-based test procedure infeasible, thereby forcing an energized opening, rather than burying the point in a single sentence.
  4. [Section I] Figure 1 (a historical safety switch advertisement) is visually appealing but its connection to the argument is not stated; a brief sentence explaining what aspect of Prevention through Design the advertisement illustrates would help readers follow the introduction.
  5. [Section IV] The paper acknowledges that work planning was inadequate in both incidents, but it does not describe how the incident reviews distinguished design factors from planning factors; adding one sentence on the review methodology (e.g., interviews, inspections, comparison with existing equipment) would increase confidence in the conclusions.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: retrospective incident report with external standards and no fitted parameters or self-referential derivation.

full rationale

This paper is a retrospective case study of two electrical incidents at Fermilab. It makes no predictive or derivational claims in the mathematical sense: there are no equations, no fitted parameters, and no quantity computed from data that is then presented as a prediction. The paper's safety thresholds come from external standards (NFPA 70E, OSHA), not from the incidents themselves. The central argument—that equipment design features such as an inaccessible MS connector, an internal mounting bolt, and internal HOA switches made safe work more difficult and may have encouraged unsafe actions—is an interpretive causal claim about observed events. Even if that causal inference is debatable, it is not circular: the conclusion is not an input to the analysis, and the author explicitly acknowledges the competing factor of inadequate work planning in Section IV. The proposed retrofits are presented as engineering controls, not as validated predictions, and no self-citation is used to justify any load-bearing step. The paper therefore contains no instance where a 'prediction' or 'derivation' reduces by construction to its own inputs.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper relies on established electrical safety standards and on the author's own incident investigation. No free parameters are fitted, and no new physical entities are introduced.

assumptions (4)
  • domain assumption NFPA 70E 2024 electrical safety thresholds and restricted approach boundaries are appropriate criteria for evaluating the incidents.
    The paper uses these thresholds (40 mA, 1 J, restricted approach boundary) to classify the exposures as hazards; this is an external standard rather than a derivation.
  • domain assumption OSHA 29 CFR 1910 lockout/tagout and cord-and-plug exception provisions are correctly applied to the crowbar assembly connections.
    The paper relies on the cord and plug exception in OSHA 1910.147(a)(2)(iii)(A) to justify the MS connector configuration.
  • domain assumption The author's account of the two incidents and the investigation findings is accurate.
    The paper is an incident report by the Fermilab Electrical Safety Officer; no independent verification is provided.
  • domain assumption The Hierarchy of Controls in NFPA 70E 110.1(H)(3) prioritizes engineering controls over PPE.
    Used as the normative basis for preferring external HOA switches and external grounding over PPE-based work.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Design Didn't Prevent These Hazard Exposures." pith.science (2026). https://pith.science/paper/MNFTBANF

@misc{pith2026250603280,
  author       = {Pith},
  title        = {Pith review of: Design Didn't Prevent These Hazard Exposures},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MNFTBANF}},
  note         = {Machine review of arXiv:2506.03280}
}
read the original abstract

Two recent electrical incidents demonstrate how the design of equipment encouraged electrical workers to take actions that violated NFPA 70E principles. The features that encouraged non-compliant work execution will be described, as well as how the equipment was improved to facilitate safe work practices. Design-stage processes that help identify features that will foster rather than compromise safe work practices will be identified as well.

Figures

Figures reproduced from arXiv: 2506.03280 by the authors.

Figure 1
Figure 1. Safety Switch Advertisement II. EQUIPMENT EXAMPLES A. The Legacy Design Among the ranks of exotic equipment is the 400 MeV Linear Accelerator, or Linac, which gives Fermilab’s proton beam its first real burst of speed The protons are propelled by radio-frequency energy through a series of drift tubes in nine vacuum chambers, or “tanks.” The Linac has been in regular operation since 1971, and with a few exceptions, m… view at source ↗
Figure 2
Figure 2. Crowbar Cabinet Each amplifier has a crowbar cabinet, see figure 2, The crowbar cabinet detects arcs in the modulator that drives the RF power amplifier and triggers a mercury-based ignitron switch that instantly shorts the modulator capacitor bank to ground to avoid damaging the power amplifier tube and inhibits further operation of that RF section. Located in the bottom center of this crowbar cabinet is a smaller … view at source ↗
Figure 4
Figure 4. Bottom Right Interior of Crowbar Cabinet [PITH_FULL_IMAGE:figures/full_fig_p002_4.png] view at source ↗
Figures from the paper (5 more)
Figure 5
Figure 5. Figure 5: Crowbar Assembly Interior The crowbar assembly mounting hole is indeed located inside the assembly enclosure, so the LEMT member removed the cover and proceeded to remove the bolt. Prior practice in the Linac had not identified any hazardous energy inside the crowbar a…
Figure 6
Figure 6. Figure 6: MI-40 Duplex Controller Exterior Mounting Bolt Hole 385 VAC Transformer 385 VDC Filter Capacitor Point of Contact [PITH_FULL_IMAGE:figures/full_fig_p003_6.png]
Figure 7
Figure 7. Figure 7: MI-40 Duplex Controller Interior When this incident occurred, failure of this duplex sump pump had caused minor flooding of the MI-40 beam tunnel, which shut down proton beam operation. Measures not relevant to this subject were taken to address possible radiological i…
Figure 8
Figure 8. Figure 8: Retrofitted Mi-40 Duplex Controller Sump pump Hand-Off-Auto Controls 120 VAC 480 VAC [PITH_FULL_IMAGE:figures/full_fig_p004_8.png]
Figure 9
Figure 9. Figure 9: Duplex Controller with External HOA This firm “…saw the need for quality cost effective control panels, suitable for almost any environment. The Series 2 controls were designed to fill that need.” [PITH_FULL_IMAGE:figures/full_fig_p005_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

2 extracted references · 2 canonical work pages

  1. [1]

    29 CFR 1910, Safety in General Industry, Occupational Safety and Health Administration (OSHA), Department of Labor, United States Federal Government

    work page 1910

  2. [2]

    NFPA 70E, 2024 Standard for Electrical Safety in the Workplace, Quincy, MA: NFPA. VII. VITA David E. Mertz, P. E., (S ’82, M ’89, SM ’99) is the Electrical Safety Officer for the U. S. Department of Energy’s Fermi National Accelerator Laboratory in Batavia, Illinois, USA. His electrical career began as a teen, troubleshooting and repairing TVs, stereos, a...

    work page 2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.