All employers are required by law to ensure the safety and health of their employees. At the centre of all occupational safety measures is the risk and stress assessment.
The cement industry produces and supplies one of the most important building materials in the world. In Germany alone, 22 companies with 3400 employees produced 34 million t of cement at 53 locations in 2017 . Implementation of the high quality requirements imposed on this standardized product presents a challenge, both in terms of the technological implementation and in terms of employee safety.
Using the example of one of the most dangerous jobs in the cement works, this article explains how a systematic integration of effective occupational safety measures into the process can be achieved with the aid of the risk and stress assessment.
2 Legal background
Protection against accidents and work-related illnesses is the subject of numerous laws and regulations in Germany. In addition to the design of industrial premises and construction sites and the operation of machinery and equipment, laws regulate the handling of working materials, length of working hours and the employment of adolescents, pregnant women and mothers, to name just a few topics. With only a few exceptions, all these requirements are directed at the employer. In contrast, the manufacture or distribution of safe machinery in Germany and Europe is the responsibility of the manufacturer or the company importing to the European market. The construction of machines for own-company use is subject to the same requirements, in which case the employer is at the same time legally in the role of the machine manufacturer.
In addition to this public-law responsibility, the latter is also liable under private law to his employees for the consequences of industrial accidents and occupational diseases. In Germany, this liability is covered by the statutory accident insurance, which every employer has to be a member of. The employers’ liability insurance associations as corporations under public law indemnify employees on the basis of the Social Security Code (Sozialgesetzbuch VII). The indemnification covers treatment, rehabilitation and possible retraining costs, as well as the payment of disability benefits and survivors’ pensions. The contribution to the employers’ liability insurance association is levied on member companies on the basis of the expenses incurred by the association in the previous year. In contrast to the other branches of social insurance, the contribution is fully borne by the member company. The contribution structure of the professional associations is based on the accident and occupational disease occurrences in the respective member industry. On the one hand, this guarantees solidarity-based pay-as-you-go financing and, on the other hand, fairness of contributions for the individual sectors of industry. This regulation prevents prohibitive financial burdens on individual companies after cost-intensive accidents. Nevertheless, the total costs must be borne by all member companies, so that any significant reduction in the often high (in many cases not inconsiderable) contributions to the employers’ liability insurance association is possible only through the prevention of industrial injuries and occupational diseases in the member companies.
In Germany, cement plants are insured with the employers’ liability insurance association of the Raw Materials and Chemical Industry, the German abbreviation being BG RCI. BG RCI’s prevention department supports its member companies in their efforts to provide safe working and production conditions in a variety of ways. In addition to seminars and training programs for safety specialists, safety officers, executives and employers, etc. and an individual counseling service, the Association provides numerous guidelines, checklists and specialist publications. In the companies, the responsible supervisors give the necessary emphasis to the advice by providing effective in-plant safety work, thereby achieving cost reductions for the member companies in individual cases.
This article refrains from a detailed discussion of possible reasons for more or less extensive efforts to ensure occupational health and safety. The following well-known quote from Werner von Siemens dating from 1880 should be sufficient: “The prevention of accidents must not be regarded as a regulation prescribed by law, but as a dictate of human obligation and sound economic sense.” 
3 The risk assessment
In the past, government rules and accident prevention regulations were expressed in concrete terms and left little scope for individual solutions, but today the laws, ordinances and regulations centre around the risk and stress assessment.
In the words of the Federal Institute for Occupational Safety and Health (BAuA), “the legislator grants those responsible a broad scope for the implementation of the Occupational Health and Safety Act. The law does not specify in detail how the risk assessment is to be carried out, but instead only sets out the relevant principles. This means that there is no “right” way to conduct a risk assessment. Depending on the local conditions, different approaches are possible. 
Since the entry into force of the first version of the Occupational Health and Safety Act, the employers’ liability insurance associations have revised their documentary support material for the risk assessment several times, so that the documentation now available is well-tried and designed to involve the employees in every single step. The risk assessment is most appropriately carried out and documented in seven steps (Figure 1):
1. Recording of the company organization
2. Compilation of activities
3. Determination of possible hazards and stresses
4. Determination of the risk
5. Definition of protective measures
6. Implementation of the measures
7. Verification of their effectiveness
It would be beyond the scope of the article to go into detail on the fundamentals of and the variations in the risk and stress assessment. There are many informative publications covering this topic. It should be noted, however, that there are well-known and proven protective measures for many operational activities, which are based on technical rules, standards, etc.. For those activities and the correspondingly applicable protective measures, the author of the technical rules anticipated the effectiveness test, so that this step can be omitted in the risk assessment. If the activity to be assessed consists exclusively in the operation of a machine, it can be assumed that the machine has been designed safely in accordance with the Product Safety Act and that protective measures against the residual hazards from the operating instructions are evident.
However, if the boundary conditions for the activities in question deviate from the scope of the technical rules or if there are no technical rules or the like for certain plant operations, the effectiveness of each protection measure has to be verified. This is done by calculating the residual risk after the protection measure has been implemented and comparing it with the initial risk of the activity without protective measures. If the residual risk is lower than the initial risk, the measure is effective.
The risk reflects the probability of occurrence and the severity of the expected damage and can be determined using the following matrix. The application will be explained later on the basis of the concrete example (Figure 2).
Protective measures must always be applied in the following order:
1. Elimination of hazards (most effective measure)
2. Technical protective measures
3. Organizational measures
4. Personal Protective Equipment (PPE) (weakest measure)
The measures have to be implemented in accordance with the latest state of the art.
4 Hazards in the cement plant
The hazards associated with extracting raw materials are not addressed here as they are also relevant to many other industries and should not be considered specific to cement production.
The following tasks in a cement plant are among those associated with considerable hazards and stresses:
Working in the preheater tower (PT)
Elimination of blockages in the PT
Working in the kiln
Working in silos
Operation of packing machines
Loading into tankers
Mill maintenance and repair
Fuel use (coal dust, substitute fuels)
When the plant is operating in a trouble-free state, this generally entails less risk potential than maintenance and repair work, while the unplanned elimination of disturbances involves the highest risks.
The following characteristic conditions in cement plants increase the risks involved in numerous jobs: large masses are moved, which requires large equipment and drives as well as extensive storage and intermediate storage capacities for products, fuels and spare parts. Temperatures up to 1400° C are used in the process, therefore all work related to the burning operation and the conveyance of the hot materials is characterized by heat stress, and, in the case of an accident, by burns. When moving around the extensive premises of the plant, the employees are largely exposed to the weather. The three-shift operation required seven days a week due to the continuous burning process is also associated with considerable stresses and increases the risk of accidents.
5 Elimination of blockages in the preheater; risk assessment in individual steps
5.1 Description of the sequence of activities
Control and monitoring of the burning process takes place from the control centre. Beginning or existing blockages in the preheater can be identified by the plant operator on the basis of three parameters, which are continuously recorded via sensor devices installed in the entire preheater: Temperature increase, reduction in cross section at the outlet openings of the respective cyclones or pressure increase or reduction of the negative pressure in the system. In most cases, detached lumps of incrustation lead to the formation of material bridges in the outlet of a cyclone, and the subsequent flow of raw meal builds up on these bridges. Based on the position of the sensors, the operator is able to locate the blockage. After the material feed to the process has been stopped and the pendulum flaps in the discharge chute have been opened, the preheater attendant begins to remove the blockage. To do this, he opens the existing rodding ports above the material blockage and breaks up the reachable lumps of incrustation and material with long rods, compressed air tools, air lances or similar devices.
5.2 Identification of hazards and risk factors
The described procedure is associated with the following hazards: Life-threatening burns all over the body due to hot meal escaping from the rodding port. Depending on the position of the blockage, the temperature of the very finely ground, free-flowing raw meal is around 800 °C. At an average kiln throughput of 200 t/h, tons of hot meal accumulate within a few minutes and can shoot through the kiln into the cooler when the blockage is broken up. Therefore, persons in the entire plant area below the blockage are in danger of suffering lethal burns due to hot meal escaping from the system.
When rodding the blockage, it is also possible that lumps of material could fall onto the rod, causing the held end to jerk upwards and cause serious injury.
The high temperatures in the preheater cause enormous physical stress for employees whose work is strenuous in any case, and is also often carried out in confined spaces. Depending on the location and severity of the blockages, the work can take hours or even days, and is carried out under permanent stress because of the need to stop production.
5.3 Determination of the risk for each hazard factor without consideration of protective measures
In this step, the evaluation matrix shown above is used. The likelihood of coming into contact with escaping hot meal during the described rodding work can be considered moderate to high, depending on the location of the blockage and the rodding port used. Direct contact with hot meal in the expected quantities results in life-threatening burns. The likelihood of people coming into contact with hot meal shooting through the plant section is also medium to high. The severity of the injury is life threatening. With corresponding wind strengths, the risk increases. The hazard factor of hot meal escaping is therefore rated as the highest risk level (traffic light colour “red”), with the consequence that it is absolutely necessary to take comprehensive protective measures.
Injuries caused by the held end of the rod jerking upwards occur with a medium probability and can cause serious injury and permanent bodily harm. Again, the matrix leads to the traffic light colour “red”.
The severity of the described effects on employees may vary slightly depending on the constitution of the individual person, but are highly likely to be serious at least (traffic light colour “red”)
5.4 Determination of the protective measures
When selecting suitable protective measures, the above order of priority must be observed, i.e. at the beginning there must be an attempt to avoid the occurrence of incrustations and thus render the dangerous rodding work unnecessary. The main cause of the formation of incrustations in the preheater is, in addition to the raw material composition, the use of substitute fuels. In 2017, the proportion of secondary fuels used in German cement plants was about 65 % . The formation of incrustations in the process alters with each fuel change. Therefore the most effective measures against the dangers described are not to use fuels that cause serious incrustations and to maintain a very consistent fuel composition.
The routine cleaning of those areas of the preheater where incrustations repeatedly form is a suitable and common method of avoiding cyclone blockages. In addition to the automated use of permanently installed air blast equipment, this is done manually by the preheater attendant, using rods. The risk assessment for this activity shows that the risks are significantly lower, because in normal operation without blockages the negative pressure in the cyclones makes it unlikely that hot meal could escape. However, the operation of air-blast units increases this risk again. Therefore, the air-blast units must be safely shut down group by group, secured against reconnection and depressurized when rodding is being carried out. In addition to the technical implementation of this procedure, it is also necessary for the employees to receive corresponding regular instruction. The physical stresses in this work are also classified as high because of the strenuousness of the work and the high temperatures.
Another technical protection measure is the provision of safe, sufficiently large work platforms, so that the employee can stand in the optimal position when rodding. Appropriate design of the rodding ports, their equipment with self-sealing flaps etc., are ways of limiting body contact with escaping hot meal.
In order to minimize the number of persons at risk, precautions must be taken to prevent access to the danger area. This can be done, for example, by signaling systems operated from the control station (traffic lights, horns, flashing lights or the like), as well as by access barriers at both the preheater tower and to the clinker cooler, and by employee instruction using written operating instructions. It is necessary to appropriately reduce the strain on the employees involved to ensure that no health damage or accidents due to stress-related errors are to be expected. This requires the regular replacement of the personnel carrying out the rodding work, with the result that, depending on the frequency and duration of blockages, a significant number of employees have to be kept available for this work. All these employees must be verifiably trained and instructed in the elimination of blockages. It goes without saying that the persons allocated to perform this work must have an appropriately strong physical constitution.
Although all these protective measures lower the probability of an accident as well as reducing the stress on the individual, the application of the risk matrix without the use of additional personal protective equipment still leads to the result of traffic light colour “red”.
As long as contact with hot meal cannot be excluded with certainty, protection against life-threatening burns is only possible through the use of suitable heat protection clothing (Figure 3). In windy conditions, the protection offered by such clothing is only effective when the rodding is performed on the wind-sheltered side of the preheater. It is obvious that this already strenuous work is made considerably more difficult by such personal protective equipment, so that the above-mentioned personnel replacement intervals have to be kept correspondingly short.
Naturally, the effectiveness of personal protective equipment depends not only on the quality of the protective clothing itself, but also on its correct use and the usage discipline of the employee. These inherent limitations on the increase in safety provided by the still indispensable heat protection clothing mean that only its optimal use can reduce the severity of injury to an acceptable level. The matrix for risk assessment therefore shows the traffic light colour “yellow”.
6 Summarizing evaluation of the possible protective measures
Experience shows that the assessment of hazards and risks leads to different results depending on the individuals involved. The risk and stress assessment procedure described here provides an instrument which excludes inappropriate relativization, while taking account of individual experience and operational circumstances. Its application to the elimination of blockages in the preheater leads to two findings:
Even a correctly conducted risk assessment and the exhaustion of all technically possible protective measures do not necessarily lead to dangerous work becoming non-dangerous. This means that in the documentation relating to the assessment of residual risk, the traffic light colour “red” or traffic light colour “yellow” will remain in force. The responsible persons sometimes shy away from this, but it cannot be avoided. In actual fact, this circumstance compels us to regularly look for more effective security measures and, in the broadest sense, can be seen as a driver of progress in safety technology.
The presented example also shows that company management must participate in the selection of protective measures. The most effective protective measure is careful choice of fuel. Such decisions are not made by employees at the production level or by safety specialists. On the one hand, there is the legal requirement above and beyond economic considerations to do everything technically possible for the creation of safe working conditions. On the other hand, a company could be catapulted out of the market if it made no use of substitute fuels. In addition, non-use of substitute fuels would counteract the demand for the conservation of resources in one of the most energy-intensive industries. Against this background, the risk assessment should take into account and consider both the experience gained from production and the costs associated with the various protective measures, as well as the effects of production downtime and quality fluctuations.
All of this has to be documented in a comprehensible way, especially if it is currently impossible by technical means to reduce the residual risk to an acceptable level. By regularly reviewing and updating the documentation, under participation of both production and management staff, it is possible to integrate new technical procedures and assess them in terms of both the achievable residual risk and of the actual costs involved. As a result, a continuous improvement process is developed, in which the safety and health of employees is treated as a natural aspect of company quality.