|
|
|
Director, Office of Nuclear and
Facility Safety
|
U.S. Department of
Energy
|
Washington, DC
20585
|
|
DOE/EH-0530
|
Issue No. 96-05
|
December 1996
|
Lockout/Tagout
Programs
Contents
Notice Summary
Lockout/tagout programs are used at Department of Energy
(DOE) facilities to protect personnel from injury, protect
equipment from damage, and maintain plant systems. These
programs are designed to identify, isolate, and control
sources of hazardous energy and material that could
adversely affect personnel safety during equipment
operation, maintenance, or modification.
This notice provides lockout/tagout program requirements
identified in DOE Orders and the Code of Federal Regulations
(CFR). These requirements have been in effect for several
years (since 1990) and should already be in place at DOE
facilities. For DOE nuclear activities, lockout/tagout
program requirements are largely covered by the Work
Processes section of the DOE Quality Assurance Rule (10 CFR
830.120) and thus could potentially be subject to Price
Anderson Act enforcement actions when violations occur.
The notice also describes events in which violations of
lockout/tagout programs resulted in injuries or equipment
damage and adversely affected facility operations. The
causes and significance of these events are described along
with lessons learned.
The DOE and Occupational Safety and Health Administration
(OSHA) standards cited herein, provide requirements related
to lockout/tagout programs. The DOE Guide to Good
Practices for Lockouts and Tagouts1 can
assist DOE field offices, management and operating
contractors, and integrated management contractors in the
development and review of lockout/tagout programs. It is
important to note that for non-nuclear activities, if
conflicts are discovered between OSHA requirements and those
cited by DOE Orders or the Guide referenced above, OSHA
shall take precedence because the OSHA CFR is law and is
applicable to DOE facilities. For nuclear activities, the
DOE Quality Assurance Rule (10 CFR 830.120) takes
precedence.
Applicability
This notice applies to DOE facilities that perform
lockout/tagout activities. The notice should be processed as
an external source of lessons-learned information as
described in DOE-STD-7501-95, Development of DOE Lessons
Learned Programs. 2 The Office of Nuclear and
Facility Safety encourages DOE managers to examine their
lockout/ tagout programs in view of this information.
Lockout/Tagout Program
Requirements
A comprehensive, effective lockout/tagout program shall
be developed at each DOE facility to control potentially
hazardous energy. The program should consist of two distinct
but related processes-the identi-fication and control of the
hazard by facility management, and the communication and
responsibility of the worker performing servicing or
maintenance. The program should include detailed
administrative procedures, personnel training, uniquely
identifiable tags, and periodic inspections.3
Lockout/tagout programs should include the following
elements.
- Procedures should be developed, documented,
validated, and used to control hazardous energy or
material.
- Training should be provided and documented to ensure
that the purpose and function of the program are
understood by all personnel and that they have the
knowledge and skills required to identify proper lockout/
tagout boundaries and safely install and remove locks and
tags.
- Lockout and tagout devices should be singularly
identifiable and should be used only for controlling
energy and no other purpose. These devices should be
durable enough to withstand the environment; standardized
as to color, shape, and size; and substantial enough to
prevent removal without excessive force.
- Managers should inspect energy control procedures at
least annually to ensure that procedures and
lockout/tagout program requirements are being followed.
Supervisors should inspect work-boundary isolation
devices to verify that tagout devices are properly
installed and provide the required
protection.1,3,4
- Workers should inspect installed lockout/tagouts
prior to starting work on equipment that has been
isolated to verify that isolation and de-energization
have been accomplished.
- The lockout/tagout program should also provide for
independent verification3,5 of the removal
from service and the restoration to service of
safety-related and other specifically identified facility
equipment.
- Existing lockout/tagouts should be reviewed during
shift turnover.
The following lockout/tagout program implementation
methods are used at many DOE facilities.1
Individual-Controlled Lockout/Tagout-This method
of lockout/tagout is used when workers are responsible for
operation and routine maintenance of an individual piece of
equipment, such as milling machines, lathes, presses, and
other machines. The use of this program may or may not
require specific procedures to identify and control the
hazards. A procedure is not required when there is a simple
system, a single energy source, no other workers are
affected, and there have been no accidents involving the
equipment. This method of lockout/tagout requires the
individual worker to be responsible for taking all necessary
actions to ensure personal safety and the safety of others
during maintenance.
Centrally Controlled Lockout/Tagout -This method
of lockout/tagout is generally used at DOE facilities where
highly integrated systems and significant hazards require
that plant activities be centrally controlled by an
operations group or other group with operations knowledge.
The primary characteristic of a centrally controlled
lockout/tagout system is a central tagging authority,
typically the operations group. To be effective, this group
must be cognizant of all lockout/tagout activities,
including removal from service and restoration of systems
and components.
Central control of lockout/tagouts is essential at these
facilities because failure to understand and consider system
interfaces, interrelationships, and operability requirements
when isolating and restoring safety-related systems and
components could result in reduction of safety margins below
acceptable limits and failure to maintain safe working
boundaries.
It is important not to mix the features of these two
types of programs. For example, a worker may be familiar
with a piece of equipment but may not be trained on the
system interfaces and interactions or understand the
facility drawings or logic schemes. This lack of knowledge
or experience could affect the safe operations of the
facility.
Events Summary
Operating Experience Analysis and Feedback engineers
reviewed the Occurrence Reporting and Processing System
(ORPS) database and found 335 reports on
lockout/tagout-related events. The number of reported events
from the first quarter of 1994 through the second quarter of
1996 shows a decreasing trend.
Lockout/tagout events typically are conduct of operations
events; specifically the failure to follow procedures. Most
of these events can be classified in at least one of the
following categories.
- Inadequately defined lockout/tagout
- Incorrectly applied lockout/tagout
- Unauthorized lockout/tagout removal
- Lockout/tagout removed before work completed
- Work performed without lockout/tagout
The Defense Programs (DP) Occurrence Analysis Report for
the first quarter of 1996 showed that 358 out of the 1,448
DOE-wide occurrence reports reviewed by DP staff were
categorized as conduct of operations. Lockout/tagout
problems accounted for 9 percent of these
events.8 The DP Monthly Summary Report of ORPS
for June 1996, showed that lockout/tagout events accounted
for 10 percent of all conduct of operations events. The
number of lockout/tagout events reported in June equaled the
12-month average of 13 events.
Inadequately Defined
Lockout/Tagout
On February 5, 1996, at Savannah River, two construction
workers were nearly shocked during construction of a
scaffold on a crane catwalk. The workers were coiling a wire
rope being used as a lifeline when the rope contacted the
480-volt bus bars on the crane. Electricians had
de-energized and locked out all loads on the crane except
the 110-volt receptacles, lighting, and the bus
bars.9
Investigators found that the work planners insufficiently
identified the scope of work for the lockout because they
assumed no work would be performed above the bus bars. The
electrical lockout reviewer thought the bus bars were
shielded. In the pre-job briefing, workers did not
specifically state that the bus bars were energized.
An adequate review of documentation by engineering,
operations, maintenance supervision, or affected workers may
have, revealed the deficiencies contained in the
lockout.
Corrective actions included the following:
- Revised the work package to require locking out the
bus bars when installing and removing lifelines from the
crane.
- Posted crane safety instructions at the crane ladder
and a Danger High Voltage sign over the bus bars.
- Conducted safety meetings on the event and issued
lessons learned.
Incorrectly Applied
Lockout/Tagout
On March 3, 1994, at the Idaho Advanced Test Reactor, an
operator locked the power supply breaker for the
reactor-safety rod drive closed instead of locking it open
in accordance with the tagging instructions. He hung a tag
stating the breaker should be in the open position and made
a log entry that the breaker was locked and tagged
open.10
During normal reactor outages the breaker was routinely
locked and tagged in the closed position to ensure power to
the safety rods could not be interrupted. The operator's
"mind set" from these previous tagouts led him to lock the
breaker in the wrong position. Although a second independent
verification was made, the verifier failed to identify the
lockout error because of complacency or lack of rigor.
Corrective action for this event included disciplinary
action for the operator and verifier who incorrectly
performed the tag and lockout.
Unauthorized Lockout/Tagout
Removal
On June 16, 1996, at the Yucca Mountain Site Geological
Disposal, an electrician removed a tag and energized a
transformer without authorization from the tagout holder.
Electricians had placed the caution tagout on a distribution
cutout switch for the transformer after completing the
extension of a 12 kV power line.11
The electrician who cleared the tagout was unsure of the
reason for the tag and did not know the owner of the tag. He
failed to follow the instructions on the tag that required
contacting the power dispatcher.
Corrective actions included the clarification of the
lockout/tagout policy and training of affected personnel on
lockouts and tagouts.
Lockout/Tagout Removed Before Work
Completed
On July 31, 1996, at the Rocky Flats Environmental
Technology Site, stationary operating engineers removed a
lock and tag from a chilled water pump before the assigned
electrician verified that the work was complete and restored
the electrical wiring. After the stationary operating
engineers removed the lock and tag, an electrician noticed
that the electrical leads for the pump motor were not
connected in the coverbox.12
The work order did not direct the craftsmen to lift leads
at the pump motor cover box; they lifted them as an added
precaution. However, the craftsmen did not log this fact and
failed to re-land the leads before the lock and tag was
cleared.
Corrective actions included the following:
- Formulated a wire-removal policy for lifting and
landing electrical wires.
- Provided lockout/tagout training to lockout/tagout
personnel.
- Briefed all personnel on the event and issued lessons
learned to other facility managers.
Work Performed Without
Lockout/Tagout
On June 17, 1994, an electrician working on a 480-volt
distribution panel at Oak Ridge Y-12 Plant inadvertently
contacted an energized 480-volt phase conductor with a
ground wire. He received serious flash burns over 13 percent
of his body from the electrical arc blast.13
A Type A Investigation Board determined that the
electrician was not working under a high-voltage
lockout/tagout that completely isolated electrical energy to
the 480-volt main distribution panel. The Board also
determined that the need for the lockout/tagout was not
identified in the job-planning checklist, nor was personal
protective equipment or equipment for safety-related work
practices defined. The Board found the requirements of 29
CFR 1910.331-33515 had not been met; the
work-planning process was not effective; and the job hazard
analysis was informal and undocumented.
Corrective actions included the following:
- Revised instructions for planning electrical work to
ensure that the need for lockout/tagout, hold points, and
personal protective equipment are addressed.
- Developed instructions and criteria for evaluating
low-voltage electrical work to determine when
high-voltage energy isolation should be considered.
- Provided High-Energy Awareness Training to Y-12
electricians.
- Performed written job hazard analysis for activities
where "on or near" electrical work exists or could exist.
- Took disciplinary action against personnel whose
actions contributed to the accident.
Significance of Events
A review of the Computerized Accident/ Incident Reporting
System (CAIRS) database revealed that lockout/tagout events
have led to 2 deaths, 1,661 lost work days, and more than
$3.5 million in property damage. The Department of Labor
estimates that compliance with the lockout/tagout standards
in 29 CFR 1910.147 would prevent about 120 fatalities,
28,000 serious injuries, and 32,000 minor injuries each
year.14
Lessons Learned
Almost all lockout/tagout events are avoidable. Only 12
percent of lockout/tagout events reported in ORPS involved
equipment or material problems. The majority occurred during
normal operations (54 percent), followed by maintenance (20
percent), and construction (11 percent). Figure 1 shows the
distribution of lockout/tagout events by nature of
occurrence for the facility condition category.
Figure 1. Lockout/Tagout Events
By Nature of Occurrence
The most frequent root cause of these events was
attributed to management issues (44 percent). Figure 2 shows
the distribution of root causes.
Figure 2. Root Causes of
Lockout/Tagout Events
There is a common thread in lockout/tagout events: at the
beginning of the lockout/ tagout process, work planning,
hazards analysis, and barrier analysis were inadequately
performed. In many cases, electrical and piping system
drawings were not accurate, or the reviews performed were
not adequate to ensure that proper boundary protection would
be provided against high-energy system hazards.
Worker understanding and involvement in lockout/tagout
process can also play an effective role in the prevention of
lockout/tagout events. The worker is responsible to verify
that the boundaries adequately isolate the hazard and no
energy exists. The process of boundary isolation
verification by the worker would assist in the
identification of inadequate lockout/tagouts.
Personnel training is an important component of an
effective lockout/tagout program. Workers often do not
receive the safety information and training they need; even
on jobs that involve dangerous equipment, where training is
clearly essential. A Bureau of Labor Statistics survey
showed that of 554 workers injured while servicing
equipment, 61 percent indicated they had not been informed
about lockout procedures.15 Lockout/tagout
training and refresher training were the most frequently
recommended corrective actions reported in ORPS. Figure 3
shows the distribution of corrective actions for
lockout/tagout events.
Figure 3. Lockout/Tagout Corrective
Actions
Managers must identify corrective actions that will
correct the problem. They should track corrective actions
through completion and review of their effectiveness in
preventing recurrence of the problem.16
The process for performing lockout/tagouts should be
formal and well planned. Supervisors, safety engineers, and
cognizant engineers should review the process where
applicable. Lockout/tagouts should be performed only by
qualified personnel.
Recommendations
Development and implementation of an effective
lockout/tagout program is advantageous in reducing injuries.
Personnel safety should be the highest priority for all DOE
operations. Managers at DOE facilities should ensure that
their lockout/tagout programs include, as a minimum, the
following elements and recommended practices.17
Recommended Program Elements
- Clearly defined terms and definitions.
- Detailed procedures that describe the logical
sequence of steps necessary to establish and remove,
under normal and emergency conditions, locks and tags.
- Clear assignment of duties and responsibilities for
control and release of locks and tags.
- Extensive training and retraining on lockout/tagout
procedures, forms, tags, and the process. Adequate time
needs to be spent performing practical exercises so that
operators and mechanics can resolve any problems or
questions they have while in a training setting. The
training setting should be appropriate to the knowledge
and skills being acquired.
- Disciplinary action against violators of
lockout/tagout procedures, including a process for
termination of repeat violators.
Recommended Practices
- Permit only personnel qualified through system,
interface, and facility drawing knowledge and through
lockout/tagout training, to install and remove locks and
tags.
- Provide instructions on the use of as-built drawings
or other current documentation in preparing lockout/
tagouts. Steps to be taken in the event these materials
are not available should also be provided.
- Ensure workers are cognizant of lockout/tagout
boundaries, that workers verify these boundaries and no
hazardous energy exists, and that workers remain within
these boundaries during the performance of the work.
- Verify system status before starting the task. For
example, when performing electrical maintenance, the
electrician takes personal responsibility for his/her own
safety by verifying the component and/or circuits in
close proximity are de-energized using an appropriate
electrical test device before start of work.
- General employee training should emphasize that it is
the responsibility of every individual to ensure that
their actions and the actions of others do not violate
lockout/tagout policies and procedures. This may not
prevent violations but is significant in eliminating or
reducing consequences should a lockout/tagout violation
occur.
- Periodically audit active lockout/tagouts to verify
they are still required and that components are locked
and tagged in the correct position.
- Strong disciplinary action for lockout/tagout
violations.
When outside contractors are to perform work covered by
the lockout/tagout program, facility supervisors should
discuss protection requirements with the contractor and
eliminate any differences in interpretation and application
of the procedures. All lockout/tagout protective measures
should be applied in accordance with the facility
procedures. The facility manager should ensure that these
procedures are understood and followed by outside
contractors.1
DOE contract managers may wish to include the facility
lockout/tagout program requirements in contracts.
Final Evaluation
Each year OSHA tallies the number of violations and total
penalties for each of its standards to determine the most
frequently cited regulations. In fiscal years 1994 and 1995,
lockout/tagout citations ranked second only to hazard
communication. In 1994, 5,776 violations were cited; 4,862
were cited in 1995.
A lockout/tagout program should be an integral part of a
facility safety program. Employees who perform
lockout/tagout operations should be trained in the safe
application of locks and tags. Managers should evaluate the
performance of their lockout/tagout programs to ensure they
are effective in preventing personnel injury.
A Hazard and Barrier Analysis Guide, produced by the
Office of Operating Experience, Analysis and Feedback
provides tools for the identification, evaluation and
implementation of effective barriers to protect workers from
hazards.18 The guide includes a hazard-barrier
matrix that shows the lockout/tagout as one of the most
effective barriers. When implemented properly, the
lockout/tagout provides a high probability (greater than 99
percent) of success for risk reduction.
Regulations and Guidelines
The following documents apply to lockout/tagout programs
used at DOE facilities.
- DOE 440.1 establishes the framework for an effective
worker-protection program designed to reduce or prevent
accidental losses, injuries, and illness. The contractor
requirements of the Order require compliance with 29 CFR
1910, "Occupational Safety and Health Standards," and
1926, "Safety and Health Regulations for
Construction."19
- Section 147 of 29 CFR 1910, "Control of Hazardous
Energy (Lockout/Tagout)," and DOE 5480.19, "Conduct of
Operations Requirements for DOE Facilities," chapter IX,
"Lockouts and Tagouts," establish the minimum
requirements for the control of unexpected energizing of
equipment and the release of stored energy or toxic
material that could cause injury to employees.
3,4,7
- Section 120 of 10 CFR 830, "Quality Assurance
Requirements," contains requirements applicable to
lockout/tagout activities for nuclear activities at DOE
facilities.20
These standards focus on procedures that are necessary to
provide effective control when dealing with potentially
hazardous energy or toxic material sources. OSHA
requirements take precedence if conflicts arise between OSHA
requirements and those of DOE 5480.19 and
DOE-STD-1030-96.1
References
1. DOE-STD-1030-96, Guide to Good Practices for
Lockouts and Tagouts, May 1996.
2. DOE-STD-7501-95, Development of DOE Lessons Learned
Programs, May 1995.
3. DOE 5480.19, Conduct of Operations Requirements for
DOE Facilities, July 1990.
4. 29 CFR 1910.147, The Control of Hazardous Energy
(Lockout/Tagout), January 1990.
5. DOE/EH-0502, Safety Notice on "Independent
Verification and Self-Checking," September 1995.
6. DOE/EH-0298, Report of the Task Group on Electrical
Safety of the Department of Energy Facilities, January
1993.
7. 29 CFR 1910.331-335, Safety-Related Work
Practices, December 1990.
8. DPOAR 96-1, Defense Programs Occurrence Analysis
Report, First Quarter 1996, May 1996.
9. DOE Occurrence Report SR--WSRC-RBOF-1996-0004, "Cable
Contacts Energized Bus Bar During Removal," April 30, 1996.
10. DOE Occurrence Report ID--EGG-ATR-1994-0005,
"Improper Danger Tagout, Verification and Actuation of
250-DC-Volt Electrical Breaker That Supplies Power to ATR
Safety Rods," April 21, 1994.
11. DOE Occurrence Reports HQ--SAYM-YMSGD-1996-0005,
"Lockout/Tagout Procedure Infraction," June 19, 1996, and
NVOO--BNOO-NTS-1996-0010, "Electrical Safety Violation -
Lockout/Tagout", June 19, 1996.
12. DOE Occurrence Report RFO--KHLL-371OPS-1996-0092,
"Incorrect Removal of Installed Lockout/Tagout Prior to
Verifying That Electrical Components Were Operational," July
31, 1996.
13. Type A Accident Investigation Report on the June 17,
1994, "Electrical Arc Blast at Building 9725 Resulting in an
Injury at the DOE Oak Ridge Reservation," August 1994.
14. OSHA Fact Sheet No. 89-32, Control of Hazardous
Energy Sources (Lockout/Tagout), June 13, 1989.
15. OSHA Fact Sheet No. 93-07, Improving Worker
Protection for New Workers, July 1, 1993.
16. DOE Lessons Learned Fact Sheet, Corrective Action
Development and Management, August 1996.
17. DOE/EH-0180, Safety Note on "Control of Hazardous
Energy," March 1991.
18. DOE-EH-33 Letter Report (draft), "Hazard and Barrier
Analysis Guide," August 30, 1996.
19. DOE 440.1, Worker Protection Management for DOE
Federal and Contractor Employees, September 1995.
20. 10 CFR 830.120, Quality Assurance
Requirements, March 1994.
Notices Previously Issued
- Technical Notice 94-01, "Guidelines For Valves in
Tritium Service," September 1994.
- Safety Notice 91-1,
"Criticality Safety Moderator Hazards," September 1991.
- Safety Notice 92-1,
"Criticality Safety Hazards Associated With Large
Vessels," February 1992.
- Safety Notice 92-2,
"Radiation Streaming at Hot Cells," August 1992.
- Safety Notice 92-3,
"Explosion Hazards of Uranium-Zirconium Alloys," August
1992.
- Safety Notice 92-4,
"Facility Logs and Records," September 1992.
- Safety Notice 92-5,
"Discharge of Fire Water Into a Critical Mass Lab,"
October 1992.
- Safety Notice 92-6,
"Estimated Critical Positions (ECPs)," November 1992.
- Safety Notice 93-1, "Fire, Explosion, and
High-Pressure Hazards Associated with Drums and
Containers," February 1993.
- Safety Notice 93-02,
"Control of Temporary Modifications," September 1993.
- Safety Notice 94-01,
"Contamination of Emergency Diesel Generator Fuel
Supplies," July 1994.
- Safety Notice 94-02,
"High-Efficiency Particulate Air Filters," August 1994.
- Safety Notice 94-03,
"Events Involving Undetected Spread of Contamination,"
September 1994.
- Safety Notice 94-04,
"Uninterruptible Power Supplies," November 1994.
- Safety Notice 95-01,
"Decision Analysis Techniques," August 1995.
- Safety Notice 95-02,
"Independent Verification and Self- Checking," September
1995.
- Safety Notice 95-03,
"Lessons Learned Programs," October 1995.
- Safety Notice 95-04,
"Post-Maintenance Test Programs," December 1995.
- Safety Notice 95-05,
"Department of Transportation Non- Conformances by Vendor
Shippers," December 1995.
- Safety Notice 96-01,
"Chemical Spills During Loading," April 1996.
- Safety Notice No. 96-02,
"Risk-Based Analysis of Electrical Hazard," May 1996.
- Safety Notice No. 96-03,
"Compressed Gas Cylinder Safety," June 1996.
- Safety Notice No. 96-04,
"Lightning Safety," August 1996.
________________________________________________
This Notice is one in a series of publications issued by
the Office of Nuclear and Facility Safety to share nuclear
safety information throughout the Department of Energy
complex. For more information, contact Richard Trevillian,
Office of Operating Experience Analysis and Feedback, Office
of Nuclear and Facility Safety, U.S. Department of Energy,
Washington, DC 20585, telephone (301) 903-3074. This Safety
Notice should be processed as an external source of
lessons-learned information as described in DOE-STD-7501-95,
Development of DOE Lessons-Learned Programs.
_________________________________________________
Safety Notices are distributed to U.S. Department of
Energy Program Offices, Field Offices, and contractors who
have responsibility for the operation and maintenance of
nuclear and related facilities, and to other organizations
involved in nuclear safety. Written requests to be added to
or deleted from the distribution of Safety Notices should be
sent to Richard Trevillian, Office of Operating Experience
Analysis and Feedback, Office of Nuclear and Facility
Safety, U.S. Department of Energy, Washington, DC 20585,
telephone (301) 903-3074.
The HSS Information Center maintains a file of
Safety Notices and supporting information. Copies can be
obtained by contacting the Info Center, (301) 903-0449, or
by writing to HSS Information Center, U.S. Department
of Energy, EH-72/Suite 100, CXXI/3, Germantown, MD 20874.
|
