Isolate, de-energise, lockout and tagout plant
Workers can suffer serious injuries or die when plant accidentally activates or stored energy releases. To help keep workers safe, employers must isolate, de-energise, lockout and tagout plant before maintenance work or repairs.
Background
This information about the need to isolate, de-energise, lockout and tagout plant aims to help workplaces develop safe isolation procedures to reduce the risk of death or injury during plant inspections, repairs, maintenance, assessments, adjustments or cleaning.
This information considers the specific legislative duties applying to employers, contractors, self-employed people, employees and people in control of workplaces or people in control of access to workplaces.
Preventing death and injuries
Plant is a general name for equipment, machinery, appliances, tools and implements. Every year, people at work are injured, sometimes fatally, when plant inadvertently activates or stored energy releases during inspection, repair, maintenance or cleaning. Introducing and following effective isolation procedures can prevent these injuries.
Plant isolation procedures
An isolation procedure is a set of steps to be followed to keep plant and its components from being set in motion or to prevent the release of stored energy, including electricity, heat, steam and fluids.
When developing plant isolation procedures, employers should consult with health and safety representatives (HSRs), plant operators and people who adjust, clean, maintain, repair or inspect the plant. If possible, plant manufacturers, suppliers and people who designed and installed the plant should also help develop the procedure. If a workplace does not have the expertise to develop procedures, the employer should engage qualified people to do so.
The effectiveness of isolation procedures relies on:
- Having the isolation procedure documented and accessible to the relevant people in the workplace.
- Providing information, instruction and training to workers involved with the plant.
- Appointing a person as a supervisor to make sure the workplace strictly follows isolation procedures.
Requirement to conduct a risk assessment
Lockout and/or tagout for the isolation of plant for inspections, repairs, maintenance, assessments, adjustments or cleaning should not be undertaken until a risk assessment is completed. The risk assessment will confirm whether plant can be substituted, or whether permanently fixed guards, an interlocked system or other non-administrative guarding systems are reasonably practicable methods to remove all sources of energy from the plant to make it safe. If those methods are not reasonably practicable, then a lockout and/or tagging out is an option for the isolation of plant for inspections, repairs, maintenance, assessments, adjustments or cleaning.
Requirement for interlocked guarding
For effective isolation, de-energising, lockout and tagout of plant, the plant should, where reasonably practicable, be interlocked in accordance with the guarding hierarchy of controls outlined in the Occupational Health and Safety Regulations 2017 (OHS Regulations 2017). See the Compliance code: Plant for more information about the guarding hierarchy.
Interlocked guards
An interlocked guard - 'the interlock' - is a barrier connected to the plant's power or control system. The interlock prevents the plant from operating unless the guard is closed. The interlocking system may be mechanical, electrical, hydraulic, pneumatic or a combination of these systems.
Where reasonably practicable, interlocked guards should be part of a plant's isolation controls.
Interlock guards work with an interlocking device so that, together with the plant's control system, they can have a number of the following functions:
- The hazardous areas covered by the guard cannot operate until the guard is closed.
- If the guard is opened while hazardous plant functions are operating, a stop command will either shut off the power to the guarded area, or effectively isolate the area being guarded.
- The interlocking system incorporates 'run-down' guards that close and lock and remain locked until the risk associated with the guarded hazardous function has disappeared. This type of interlocking guard is recommended when moving parts take time to come to rest.
- When the guard is closed, the hazardous machine functions covered by the guard can operate, but closing the guard does not by itself start the hazardous plant function. In this case the plant must be manually restarted via appropriate operator controls.
Interlocked guards are ideal for situations where regular operational access to the guarded area is required, for example, to clear jammed material or loading materials into a machine, as long as:
- The interlocking system is reliable or has a back-up system.
- The interlocking system is designed to be 'fail safe'. If there is a failure in the interlocking system, the machine cannot operate.
- Where the guarded danger areas take time to come to rest, the interlocking system prevents access to the danger area until any moving parts have stopped.
Where guards are power operated, the employer should consider any hazards introduced by the powered movement of the guard.
Isolation procedure
Isolation procedures in each workplace may vary because of differences in plant, power sources, hazards and processes. However, every isolation procedure should include the following basic steps:
The operation of a single switch or valve can usually shut down plant that has a single energy source. More complex plant may have to be shut down in a sequence, for example, one conveyor before another, or by shutting down several energy sources.
Isolation procedures should identify all energy sources likely to re-activate the plant and place people at risk. The energy sources include:
- electricity, including mains, solar and generator
- fuels
- heat
- steam
- fluids under pressure, such as water, air or hydraulic oil)
- stored energy
- gravity
- radiation
Where possible, workplaces should use original designer and installer 'as built' diagrams of plant installations showing location and details of various plant components, isolation points, switches, valves, energy lines, pipes, power sources and control points, including computers, as part of the isolation procedures.
If original designer and installer 'as built' diagrams of plant installations are not available, workplaces should develop new diagrams/photographs.
Shutting the plant down may require identifying other hazards and minimising or removing the risk of injury. For example, associated equipment may need to be locked-out to prevent re-activation, or valves on pipes and lines carrying gases or fluids may need to be locked shut or blanked off.
Depending on the plant, other hazards may include:
- hazardous substances, such as gases, acids, alkalis and solvents
- falls
- burns
- asphyxiation
- impact
All plant that could require an isolation procedure should have appropriate isolation points for all energy sources so work on the plant can proceed safely.
It is important to identify all isolation points in a system, as it may be necessary to use a local isolator to shut down a specific part of the machine, a motor for example, while the rest of the associated plant remains in operation.
Emergency stop buttons, lanyards and similar stop devices on their own are not satisfactory isolation points. It is dangerous to rely solely on emergency stopping devices, because they are not designed for frequent use, cannot be locked out in all cases and may allow energy to be re-activated. They may also allow control circuits to remain live. Consider remote control rooms and process computers when identifying isolation points.
The person in control of the workplace should also identify a person (or persons) who knows and understands the complexities of the plant and appoint that person (or persons) to coordinate the isolation of all energy sources and hazards at the plant.
Identify and isolate all electricity sources, bearing in mind some plant will have several control stations and sections of plant may have independent electricity sources. If programmable logic devices control the equipment, then it is essential to use local isolating switches to achieve secure and safe isolation. Do not rely on programmable logic devices for the isolation of equipment, unless the device has been certified as a programmable logic controller (PLC) which can reliably isolate equipment by activating its controls.
Exception: Where equipment connects via a plug and socket, only a competent person, such as an electrician, should isolate and disconnect all electricity supply to an item of plant, not just the control circuit. Having a competent person isolate and disconnect electricity supply makes sure equipment cannot be energised via another source or control system.
Take any of the following steps necessary to guard against energy remaining in the plant after it has been isolated from its energy sources:
- Inspect the plant to make sure all parts have stopped moving.
- Install ground wires.
- Relieve trapped pressure.
- Release the tension on springs, or block the movement of spring-driven parts.
- Block or brace parts that could fall.
- Block parts in hydraulic and pneumatic systems that could move from the loss of pressure.
- Bleed the lines and leave vent valves open.
- Drain process piping systems and close valves to prevent the flow of hazardous material.
- Use a blank flange to block a line where there is no valve.
- Purge reactor tanks and process lines.
- Dissipate extreme cold or heat, or provide protective clothing.
- If stored energy can re-accumulate, monitor it to make sure it stays below hazardous levels.
Lockout devices
A wide range of devices are available for locking out energy sources and other hazards. As well as interlocked guards, lockout devices can include:
- padlocks and chains
- safety lockout jaws or hasps which use multiple padlocks
- switches with a built-in lock
- lockouts for circuit breakers, fuses and valves
Only devices that incorporate a lock or can accommodate one or more padlocks are suitable for locking out energy sources.
One person, one lock
If more than one person is working on the same plant, each person should attach their own lock to prevent the energy isolator being opened before all locks have been removed or opened. The isolation procedure should identify common lockout points to make sure energy cannot be restored while someone is still working on the plant.
If two or more people are working on plant that is isolated through several lockout points, each person should attach a lock and tag to each lockout point.
The need for multiple locks on each lockout point can be avoided by using a lock box. The lock box system uses only one lock at each lockout point. Keys to the locks of the plant's lockout points are inside a box which is locked by all the individual locks of people working on the same plant.
One lock, one key
Each person working on the plant should have their own lock, key and tag. There should be no duplicate key available for any lock, except a master or duplicate key for use in an emergency. The master or duplicate key should be secured and not readily available except in an emergency.
During plant inspection, repair, maintenance, cleaning or adjustment, each person should only hold the one key to their lock. That person is responsible for both locking and unlocking the lockout device.
Multiple energy sources
If more than one energy source or hazard has to be locked out to enable safe shutdown of the plant, the same person should hold the single key to each lockout device.
A tag is not an effective isolation device. A tag acts only as a means of providing information to others at the workplace. A lock should be used as an isolation device, however where a lock is used a tag should also be incorporated to explain the purpose of the lockout.
Commonly used warning tags include:
Personal danger tags
A personal danger tag on the isolation devices of an item of equipment is a warning that the equipment is unsafe and that operating the equipment may endanger the person who attached the tag. Personal danger tags should be restricted to employees who will be working on equipment. Destroy all disposable personal danger tags after use.
A personal danger tag should be attached to an isolator in a visible position whenever the isolator is used to lock out an energy source to allow work to be done. The personal danger tag should accompany each lock used in an isolation procedure and should identify the person who put the tag and lock in place, the time and date this occurred and the item of plant being isolated.
The person doing the work should fasten their personal danger tag on all lockout devices involved in the isolation procedure. If more than one person is involved in the work, each person should attach their own lock and personal danger tag to the lockout device. Locks are available that have a personal danger tag incorporated to make sure the tag cannot be removed by any person other than the person who attached it.
Removal of a personal danger tag from an isolating device should be carried out as soon as possible after completing the work. Only the person whose name is written on a personal danger tag should remove the tag. This should be done before leaving the worksite at the end of the shift.
The workplace isolation procedure should include the course of action if a person does not remove a personal danger tag before leaving the worksite.
Where work on plant is not completed by the end of a working shift and the plant is required to remain isolated, arrangements should be made for out of service tags to be placed on each isolating point before the removal of personal danger tags. If work on the plant is to continue during the next shift, there should be a 'hand over' briefing by the shift leaving the site to the shift taking over the work. The briefing should include the status of the work and the removal or replacement of personal danger tags and locks.
Out of service tags
An out of service tag is a notice that states appliances or equipment are out of operation for repairs and alteration, or plant that is still being installed. Do not operate an appliance or equipment with an out of service tag attached. Out of service tags should not be relied upon to provide personal protection.
An out of service tag on an item of plant shows that the plant is unserviceable and should not be used. An out of service tag can be attached to non-powered plant such as ladders, jacks and trolleys and powered plant. Out of service tags should be attached to the main controls if possible, or to a prominent part if there are no controls, such as with damaged ladder.
A competent person with specific knowledge relating to the plant should attach out of service tags. Out of service tags should be placed on devices which isolate energy sources only when those devices are set in the 'off' or 'safe' position.
Before attaching an out of service tag, all required details on the tag should be clearly entered in the spaces provided, with emphasis given to the reason for placing the tag. Tags should be securely fixed so they are clearly visible.
Except in an emergency, out of service tags should only be removed by a person who is both familiar with the plant and fully understands why the tag was placed.
In the absence of any personal danger tag or lock, removal of an out of service tag releases plant for use, and should not be done before ensuring that:
- All people known to have been working on the plant are clear of the plant.
- An inspection of the plant shows that all machinery guards are in place, that all protective devices are functional, that all maintenance tools and aids have been removed, and that the equipment is safe for normal use.
Out of service tags should provide a clear 'DO NOT OPERATE' warning, and warn that failure to obey may cause damage to the equipment and/or injury to a person. It is essential that isolating mechanisms which have out of service tags attached are not switched, manipulated or interfered with while the tags are in place.
Personal danger tags and out of service tags should not be used together on the same item of equipment because they relate to different circumstances. An out of service tag should be removed when a personal danger tag is added, and vice versa. On completion of maintenance, cleaning or other work, remove the tags before the plant returns to operation. Only those people who tagged the controls should remove the tags.
After plant has been shut down, locked out and tagged, all isolated power sources should be tested, first with appropriate instruments and then by trying to re-activate the plant, before any person attempts to start work A person who understands the complexity of the plant, or parts of the plant should do testing and starting the plant, including remote control stations and computers.
It is not safe to assume an isolator has locked out an electricity source just because the isolator is in an open position. While the open position should create an air gap between contact points, electricity can weld the points together. If the contact points become welded together, the points remain connected even when the isolator appears to be open.
Work on the plant should not begin until tests have confirmed it is safe to do so. Before using any instruments that test isolation procedure, employers should make sure the testing equipment is calibrated and working properly.
If plant isolation is not practicable
There may be plant that can only be cleaned, maintained, repaired or adjusted by moving components slowly under power. In this case, the plant should be fitted with controls that allow safe, controlled movement. Employers must develop safety procedures in consultation with HSRs, people who adjust, clean, maintain, repair or inspect the plant and the plant operators. Employers should make sure procedures are strictly followed.
Legal requirements
Employers have responsibilities under the Occupational Health and Safety Act 2004 to ensure they provide a work environment that is safe and without risks to health, so far as is reasonably practicable. The OHS Regulations require that hazards associated with the use of plant be identified and actions taken to control risks. The legislation also places duties on designers, manufacturers and suppliers of plant.