In the Matter of the Appeal of:

6200 Franklin Boulevard
Sacramento, CA 95824


����������������������������� Employer


Docket No .





The Occupational Safety and Health Appeals Board (Board), acting pursuant to authority vested in it by the California Labor Code and having taken the petition for reconsideration filed in the above-entitled matter by Campbell Soup Company (Employer) under submission, makes the following decision after reconsideration.


From June 29 through July 25, 2000, the Division of Occupational Safety and Health (the Division), through Compliance Officer Donald Woosley, conducted an accident investigation at a place of employment maintained by Employer at 6200 Franklin Boulevard, Sacramento, California (the site).

On October 5, 2000, the Division issued to Employer Citation 1, alleging a serious violation of section 3328(g) [maintaining equipment and machinery in safe operating condition] of the occupational safety and health standards and orders found in Title 8, California Code of Regulations.1 A civil penalty of $2,700 was proposed for the alleged violation.

Employer filed a timely appeal contesting the existence and classification of the violation and the reasonableness of the abatement requirement and proposed penalty.

On August 3, 2001, a Board Administrative Law Judge (ALJ) conducted a hearing of the appeal. On September 20, 2001, the ALJ issued a decision denying Employer's appeal from the citation.

On October 25, 2001, Employer filed a petition for reconsideration of the ALJ's decision. On November 26, 2001, the Division filed an answer to Employer's petition. The Board took Employer's petition under submission and stayed the ALJ's decision on November 29, 2001.


At the site, Employer makes soups and, in conjunction with the Sacramento Municipal Utility District (SMUD), operates a power co-generation plant. The co-generation plant equipment included a tank containing lime and water (the tank) that is used to soften water before it reaches the fuel pumps for the co-generation plant boilers.

The cylindrical tank is 58 feet tall, 14 feet in diameter, has a capacity exceeding 50,000 gallons and stands upright, slightly above the plant floor, on steel beam supports. The bottom of the tank is cone shaped and terminates in a valve-controlled discharge port. The normal operating temperature of the water and lime is between 212 and 225 degrees Fahrenheit. The tank's exterior is covered with a blanket of insulating material and an outer shell of aluminum.

Employer put the tank in service in 1985 or 1986 and has been responsible for its maintenance ever since. Aaron Japitana, Employer's Power Utility Manager, testified that the power utility department maintained the tank and that he was unaware that there had been "any problems" with the tank before it ruptured on May 31, 2000.

In 1997, SMUD and Employer discussed the possibility of SMUD assuming responsibility for the maintenance of the tank and other tanks, boilers, and appurtenances comprising the co-generation plant equipment. In connection with those discussions, SMUD had DelCal Operating Company inspect the exterior and interior of tanks and boilers and BetzDearborn take and analyze samples of deposits found in the boilers.

On July 1, 1997, DelCal sent SMUD a written report of its findings. With respect to the tank, which is designated "Softener Tank # 1", the report states:

The weld repair on top section of cone, south side of tank, was cleaned up during this outage2. The vacuum breaker was replaced along with the section of Deaerator around the vacuum breaker repaired. There was significant pitting and corrosion also noticed in the softener. Thickness readings were taken around the weld repair on the cone section and at the Deaerator vacuum breaker location. These readings were as follows:

West Side of weld repair on cone section-0.250" West Quadrant of Deaerator vacuum breaker repair-0.135"

This is a major metal loss on the roof of the Deaerator and has been an ongoing problem for CSC. This will need to be corrected and further replacement prior to acceptable turnover.

CSC has received code paperwork for the repairs on Softener Tank #1 and will forward to DelCal.

SMUD did not assume maintenance responsibility for the co-generation plant equipment. Plant Maintenance Manager Walter Lynch did not see the DelCal report until after the tank ruptured. He testified that the report went to Employer's engineering and corporate units and that all of the problems identified in the report were corrected before the tank was returned to service at the end of the 1997 summer outage. Compliance Officer Woosley agreed that certain repairs had been made. He was uncertain about the extent to which the "significant pitting and corrosion" detected inside the tank had been corrected, but acknowledged that he had no proof that it had not been corrected.

On May 31, 2000, Robert Clark, a boiler engineer and mechanic employed by Employer, was working near the tank when the side of the cone at the bottom ruptured, drenching him with hot water and lime that caused him to be seriously injured. The rupture occurred along a vertical weld line. It ran downward approximately three feet from the horizontal weld line connecting the cone to the cylindrical upper portion of the tank. The horizontal weld line also came apart to some extent, as depicted in a photograph presented by the Division.

Compliance Officer Woosley took several photographs of the tank rupture when he investigated the accident on June 29, 2000, a month after it happened. The photographs show the exterior walls of the tank along a portion of the parted vertical weld line with the thick insulating blanket and parted aluminum shell bent back away from the tank. There is rust along the edges of the plates that had been held together by the vertical weld. And, on the exterior side of each of the plates, along the parted, vertical weld line, there is a dark vertical band of rust and/or corrosion. The bands of rust are approximately 2 to 3 inches wide and contrast sharply with the light color of the contiguous, unaffected portions of the exteriors of the plates.

Injured employee Clark testified that Employer normally emptied the tank and inspected its interior once a year, but he could not recall if that had been done in the year preceding the accident. He also testified that he did not see water dripping from the tank or any other sign of leakage when he walked by the tank shortly before the accident happened.

Power Utilities Manager Japitana testified that he investigated the cause of the accident and concluded that the tank ruptured due to a "structural failure". In his opinion the tank wall failed because it had been weakened by "corrosion and deterioration" produced by a chemical reaction of water and the metal tank wall. He did not know if Employer had inspected the vertical weld that ruptured at any time before the accident. He was informed that SMUD had the tank inspected sometime before the accident and that the defects noted had been corrected, but he was unaware of the results of the inspection until after the accident. According to Japitana, Employer maintained the tank by having the Power Utilities Department employees he supervised visually inspect the tank exterior for leaks or other indications of problems in the ordinary course of their duties and make repairs as necessary.

Plant Maintenance Manager Lynch testified that Employer had no indication the tank was unsafe before the accident. He added that Employer does not routinely inspect the tank pursuant to a preventive maintenance program but boiler operators, like Clark, perform visual inspections each day and make necessary repairs. Employer had kept records of the work done on the tank but they were lost in July 1999 when the records were computerized. To his knowledge, Employer made no preventive maintenance inspections of the tank's interior and did no preventive maintenance on it in the three-year interval between the 1997 DelCal inspection and the May 31, 2000, wall-rupture accident.

Compliance Officer Woosley testified that, during his investigation, Lynch told him that the tank had not been inspected in 2000 because Employer revised its maintenance system that year. In Woosley's opinion, to maintain the tank at the site in "a safe operating condition", as required by section 3328(g), Employer had to examine its exterior and interior at reasonable intervals. His investigation revealed that the tank was unsafe to operate on May 31, 2000 and that Employer was not providing the required level of maintenance, so Employer was cited for violating section 3328(g). The violation was classified as serious because, in Woosley's experience, it was substantially probable that an employee drenched with water heated to between 212 and 225 degrees would sustain burn injuries requiring more than 24 hours of hospitalization for treatment.


Did the Division establish a serious violation of section 3328(g)?


Employer was cited under section 3328(g), which states that, "Machinery and equipment in service shall be maintained in a safe operating condition."

Employer acknowledges in its petition that the tank was machinery or equipment, that it was in service on May 31, 2000 when it ruptured, and that employee Robert Clark was exposed to the hazard presented by the tank's unsafe condition on that day. It contends, however, that the evidence does not support the ALJ's finding that Employer failed to do all that it was obligated to do by section 3328(g) to maintain the tank in a safe operating condition. We disagree.

The rupture of the tank tended to indicate that it was not in a safe operating condition when and before that happened. Power Utilities Manager Japitana was experienced in the maintenance of tanks, boilers and other related equipment, and managed the department directly responsible for maintaining the tank. He testified that he investigated the accident just after it occurred and found rust and corrosion around the weld line that he believed to have been responsible for its failure.

In the one month interval between May 31, 2000 when the weld gave way and June 29, 2000 when Woosley took photographs introduced into evidence depicting extensive rusting and corroding on the edges of the parted weld line and the exterior of the tank walls adjacent to the weld line, the ruptured tank could not hold water and was empty, minimizing the opportunity for water to react with the steel tank walls and cause oxidation or corrosion. Therefore, we believe that the most reasonable inference is that all or most of the rust depicted in the photographs occurred, over time, before the weld ruptured, and it is found that the photographs support Japitana's testimony as to the cause of the rupture. We further find that by allowing the rusting and corroding, Employer did not maintain the tank in safe operating condition on and before May 31, 2000.

The Division does not have to prove that an employer knows of a non-compliant condition to establish the existence of a safety order violation. (See Gaehwiler Construction Co., Cal/OSHA App. 78-651, Decision After Reconsideration (Jan. 7, 1985).)
Under certain circumstances, the Board has relieved cited employers of responsibility for violations that were hidden from view or "latent."

In Guy F. Atkinson Company, Cal/OSHA App. 76-360, Decision After Reconsideration (March 31, 1981), the Division cited the employer, a general contractor for a construction project, because its employee was exposed to the hazard created by use of a grounding rod that extended into the earth only 5 feet-3/4inch instead of the 8 feet then required by section 2395.83(b).
All but the top 6 to 8 inches of the rod had been driven into the ground by the electrical subcontractor, the projecting top end was marked to indicate that the rod was 10' long, and the general contractor's testing device indicated that the rod was within the allowed electrical tolerance. To detect the violation it would have been necessary for the general contractor to "undo the work of the subcontractor" by digging up and measuring the rod. The Board held that, "[u]nder these circumstances, Employer could not reasonably have discovered the grounding rod was short and thus cannot be held responsible for the violation." (Ibid., p. 5.)

The rationale of the Board's decision in Guy F. Atkinson was that if one employer creates an unsafe condition at a site that a second employer cannot discover without undoing the first employer's work and the second employer exercises reasonable diligence to determine if an unsafe condition exists before exposing its employees to the latent hazard, the second employer should be relieved of responsibility for the violation.

In Pool Well Servicing Co., Cal/OSHA App. 80-1127, Decision After Reconsideration (Dec. 7, 1984.) the employer was using a truck-mounted derrick to pull pipe casing from an abandoned well. The employer's supervisor inspected the area before setting up the rig on its tires and outriggers on ground that appeared to have been the base for the oil well's concrete slab. The "foundation" was solid and supported the rig for a day and a half while loads of pipe weighing up to 60,000 pounds were pulled from the well. Then, while pulling up a 40,000-pound load, "one jack pad sank into the ground causing the rig to topple over." (Ibid, p. 2.)

The Division cited the employer in that case under section 6568(b), which required the derrick to be, "supported by a substantially constructed foundation…[while in operation]." At the hearing, the Division presented evidence to prove that the jack pad sank because the derrick's foundation had not been substantially constructed. The employer presented conflicting evidence tending to prove that the foundation was substantially constructed, but, without the employer's knowledge, had been undermined by an undetectable "rat hole" left by a prior well drilling operation. The ALJ found that the Division failed to prove its version of what had caused the jack pad to sink by a preponderance of the evidence and granted the appeal.

The Board affirmed the ALJ's decision, finding that the employer's evidence tending to prove that a "rat hole" which "could not have been disclosed by Employer prior to its operations…." (Ibid., p. 3) caused the foundation failure was just as plausible as the Division's conflicting evidence.

The Board's reasons for upholding the ALJ's decision to grant the appeal in Pool Well Servicing parallel the Guy F. Atkinson rationale. The Board found a plausible alternative to the Division's theory in the "rat hole" undermining by another contractor, with consideration given to the employer's inability to discover the "rat hole" in that the supervisor searched the site for a solid set-up foundation, and the foundation's sufficiency during the first day and one-half of operations.

In the present case, the unsafe condition of Employer's tank was not caused by the unknown and unsuspected act of some other employer. It was caused by Employer's use of the tank. The continuing rusting and corroding of the tank was not an unsafe condition that Employer could not have discovered at all, as found in Pool Well Servicing, or that Employer could only have discovered by undoing the work of another employer who had caused the unsafe condition, as in Guy F. Atkinson. Additionally, unlike the employers in those cases, Employer in this case did not do what was foreseeably and reasonably necessary to determine that the tank was safe before exposing its employees to the hazard of its unsafe condition preceding the rupture.
Anheuser-Busch Companies/Anheuser-Busch, Inc., Cal/OSHA App. 84-113, Decision After Reconsideration (July 30, 1987) is more to the point. In that case, a microswitch on a safety device designed to prevent the build-up of excessive pressure in a compressor malfunctioned. The microswitch could only be seen and reached by removing other parts of the compressor. The employer addressed related problems but did not find the broken switch. Consequently, when the compressor was restarted the pressure increased excessively and the compressor blew.

The Division cited the employer under section 3328(c). It provides that, "Machinery and equipment with defective parts which create a hazard shall not be used." Employer asserted that the violation should be dismissed because it did not know the microswitch was broken and raised the latent condition defense. The ALJ, relying upon Appeal Board precedent, held that the Division did not have to prove employer knowledge to establish the violation but upheld the latent condition defense upon finding that "[t]here was no proof that any action on the part of the Employer, other than completely tearing apart its system, would have shown the defect." (Ibid., p. 3)

The Board reversed the ALJ for these reasons:

The existence of a broken part, which does not in itself shut down the machine, may not be discoverable absent a program of preventive maintenance, which means the periodic and regular examination of machinery to determine the need for repair of parts before there is a failure. Employer had no such program - its maintenance was limited to the repair of breakdowns other than the regular changing of oil and the like.

The broken microswitch was not a "latent" condition. The switch was hidden in the sense it was out of sight, but it could be brought into sight by opening the compressor to get at the parts, doubtless something that had to be done upon occasion and was clearly a foreseeable need. These facts distinguish this appeal from the latent conditions which were not foreseeable, held by the Appeals Board to avoid citations in Guy F. Atkinson Company, Cal/OSHA App. 76-360, Decision After Reconsideration (March 31, 1981) and Pool Well Servicing Co., Cal/OSHA App. 80-1127, Decision After Reconsideration (Dec. 7, 1984.) (Ibid., p. 3.)

The tank's 11 or 12 years of service by 1997 and the detection (by someone other than Employer) and repair that year of significant pitting and corrosion in the tank, metal thinning and a weakened weld in the cone that had been previously repaired, were sufficient to put Employer on notice that the tank could not "take care of itself" when it was then put back in service.
Plant Maintenance Manager Walter Lynch testified that, to his knowledge, Employer performed no "internal" preventive maintenance on the tank in the three-year interval between the 1997 repairs and the cone wall rupture.

Based upon this evidence it is found that the only action taken by Employer between 1997 and May 31, 2000 to determine if the tank could safely hold the 30,000 to 35,000 gallons of hot water it contained while in service were the informal inspections of its exterior made by employees of the power utilities department when they worked in that area of the plant. And, from the testimony of employee Clark, it is inferred that the inspections consisted of looking at the exterior of the aluminum shell or casing of the tank and on the floor under the tank for signs of leaking.

Relying on visual inspection of the exterior of a tank encased in a thick layer of insulation and an aluminum shell for indications of tank wall weakness is not reasonably calculated to detect seepage or leakage through the underlying tank wall into the insulated space between the tank wall and the aluminum shell. The insulation tends to absorb the water and hold it against the wall of the tank at and around the point of weakness, increasing the rate of oxidation and corrosive deterioration there. Several photographs introduced into evidence show such corrosive deterioration at and around the rupture of the interior metal wall.

As indicated by the Board in Guy F. Atkinson, supra, at p. 3, maintaining machinery or equipment in safe operating condition means taking the action necessary to ensure that the machinery or equipment is and remains in that condition so long as it is in service. Action not taken until the tank is leaking enough for water to work its way through the insulation and find a means of escaping the aluminum shell is action taken to correct or abate an unsafe or potentially unsafe condition of the tank, not action taken to ensure that unsafe conditions do not develop. For this reason, in Anheuser-Busch, supra, the Board found that maintenance limited to the "repair of breakdowns" was an inadequate means of detecting defective parts that did not, at least initially, cause the compressor to stop operating.

Employer argues that Sections 462 (air tanks) and 776 (fired boilers) support its position that the repairs made in 1997 and the exterior inspections it made thereafter were sufficient maintenance of the tank. The cited sections require employers who operate air tanks and fired boilers to have those types of pressure vessels inspected every three years by qualified inspectors to obtain operating permits for them from the Division.

However, requiring employers who operate particularly dangerous machinery or equipment, such as air tanks, fired pressure vessels or cranes or who do particularly dangerous work, e.g., the digging of excavations that are five feet or more in depth, to obtain a permit is an additional safety requirement imposed because of the gravity of the hazards associated with such machinery, equipment and work. Compliance with permit and certification requirements does not relieve employers of the ongoing duty to maintain permit-required equipment and workplaces in safe condition. Thus, the requirement that employer have their air tanks and fired pressure vessels inspected every three years as a condition of obtaining or renewing a permit is not a measure of the frequency, nature or extent of the maintenance an employer must perform on that equipment to keep it in safe operating condition.
If there were no way of determining why the tank ruptured, Employer's argument that the Division failed to prove the tank had not been maintained in safe condition might have merit. Under those circumstances, it might be "equally plausible" that events such as the accidental or intentional introduction of strongly reactive chemicals into the tank or physical damage to it, rather than lack of maintenance, could have caused the tank to rupture. But the unrefuted testimony of Japitana and Woosley's photographs of the extensive corrosion and rust around the weld line that failed, prove, with reasonable certainty, that the unabated rust and corrosion was responsible for the rupture.

For good reason, section 3328(g) does not set specific frequency, nature and extent requirements that employers must follow to maintain the many different types of equipment and machinery they use. They have different requirements and, as section 3328(b) [manufacturer's recommendations] indicates, the manufacturer of a piece of equipment or a machine is most knowledgeable of its inspection and maintenance needs. No manufacturer's recommendations were presented in this case.

Clark, one of the employees responsible for maintaining the tank, described the maintenance done on the tank during the months preceding the rupture as consisting of unprogrammed, undocumented, and cursory examinations of the exterior of the encapsulated tank and the floor beneath it for signs of leakage. We find that by such action, Employer did not maintain the tank in safe operating condition and violated section 3328(g).

Having found a violation, our analysis shifts to its classification. The governing statutory and regulatory provisions read in their entirety provide that a serious violation exists if there is a substantial probability that death or serious injury will result in the event of an accident, unless the employer can establish that it did not, and could not with the exercise of reasonable diligence, know of the violation. (Labor Code § 6432; § 334(c))

Employer contends that the classification of the violation and the amount of the penalty should be reduced because Employer did not know the tank was unsafe before it ruptured and, allegedly, could not have known the tank was in an unsafe condition by exercising reasonable diligence. Employer may have established that it did not have actual knowledge of the condition; however, in our opinion, if Employer exercised reasonable diligence, it could have known that the tank was unsafe well before it ruptured.
We have found already that having power utility department employees look for exterior leaks when in the area was an inadequate means of determining the tank's maintenance needs.

In 1997, after eleven years of service, the tank was found to have significant pitting and corrosion and weld-weakness necessitating repairs. When the tank was put back in service in 1997 it was subjected to the same conditions that had pitted and corroded it before. By then it was far from new and had been repaired at least once3. Under these circumstances, we find it was reasonably foreseeable that the tank's condition could become unsafe after being back in service for less than three years. And, it was Employer's duty to anticipate or foresee that possibility and take it into account. (ARB, Inc., Cal/OSHA App. 93-2084, Decision After Reconsideration (Dec. 22, 1997).)

Employer, through Lynch and Japitana, knew that having power utility department employees look for exterior leaks when in the area was the only means Employer was using to keep itself informed of tank maintenance needs before the rupture. We have already found that means to be inadequate.

If tank maintenance needs could not be determined adequately by more accurate and reliable exterior means, Employer could and should have taken the tank out of service and examined and tested the walls from the inside with a degree of frequency reasonably calculated to warn Employer of the onset of conditions that could render the tank unsafe.

It is reasonable to expect an employer operating a tank filled with 30,000 to 35,000 gallons of scalding water in an area where employees work to take such precautions. By doing so Employer could have learned of the unsafe condition of the tank before it ruptured. Since Employer did not exercise that level of safety diligence we conclude that the violation was properly classified as serious.


The ALJ's decision denying Employer's appeal is affirmed for the reasons stated above and a civil penalty of $2,700 is assessed.

__________________________________ ___________________________________

FILED ON: November 15, 2002

1 Unless otherwise noted, all section references are to Title 8 of the California Code of Regulations.
2 "Outage" refers to the period during the summer of each year that Employer shuts down its operations and takes all machinery and equipment out of service for maintenance and repair.
3 The DelCal inspection report states that DelCal cleaned up an existing weld repair to the cone in 1997.