U.S. Department of Labor
Process: Hazardous Energy
Control of Hazardous Energy in Shipyard Employment
What is hazardous energy?
Hazardous energy is any energy source, including mechanical, pneumatic, hydraulic, electrical, chemical, and thermal energies, that could cause injury to workers. Other forms of hazardous energy include power transmission apparatuses, counterbalances, springs, pressure, and gravity. During the servicing of machinery, equipment, or systems, workers may be seriously injured or killed if employers do not properly control hazardous energy. Injuries may include electrocutions, burns, lacerations, amputations, and fractures of body parts. Approximately 30% of all serious incidents in shipyard employment are a result of failure to control hazardous energy (76 FR 24617, May 2, 2011 (PDF*)). Proper lockout/tags-plus practices and procedures safeguard workers from the release of hazardous energy.
What is lockout/tags-plus?
Lockout/tags-plus applications include the use of either a lock, or a tag applied to all energy-isolating devices, plus an additional safety measure (tags-plus) during shipyard servicing operations to protect workers on land and on vessels and vessel sections. Examples of additional safety measures include, but are not limited to: removing an isolating circuit element; blocking a controlling switch; blocking, blanking, or bleeding lines; removing a valve handle or wiring it in place; opening an extra disconnecting device. Finding and rendering safe all potentially hazardous energy sources with the appropriate energy-isolating devices and additional safety measures is essential to the success of an energy control program.
When is lockout/tags-plus not required?
Lockout/tags-plus applications are not required for work performed on electrical equipment connected with a cord and plug, as long as the plug is under the exclusive control of the worker performing the servicing. Another exemption exists for minor servicing activities performed during normal production operations, provided the activity is routine, repetitive, and integral to the use of the equipment. When equipment is unplugged and under the exclusive control of the worker performing the servicing (1915.89(a)(4)(i)), the risk of the equipment starting up or releasing hazardous energy no longer exists. Alternatively, while the potential still exists for energization or startup of the machinery, equipment, or system, or for the release of hazardous energy, during minor servicing activities, situations exist -- such as making fine adjustments to equipment -- where it is necessary for the power to be on. In addition, lockout/tags-plus does not apply to certain aspects of troubleshooting, such as checking the repair on a piece of production equipment. Although such servicing activities are exempt from the use of lockout/tags-plus applications, employers still must provide workers with an effective means of protection when they perform these activities.
Locks or Tags-plus?
As a general rule, if the machinery, equipment, or system is capable of being locked out, employers must use locks as part of the overall energy-control program. OSHA considers machinery, equipment, or a system that has a hasp or other attachment capable of accepting a lock, or that incorporate a locking mechanism, to be "capable of being locked out." Other equipment without such locking capability may still be "capable of being locked out," but only if the employer can perform lockout without the need to dismantle, rebuild, or replace the energy- isolating device, or without permanently altering its energy control capability. Energy-isolating devices that are not able to accept a lock must use a tags-plus system; however, if employers wish to modify or retrofit the equipment to accommodate a locking device, OSHA encourages, but does not require such modifications.
Employers may prefer to implement a tags-plus program instead of lockout for machinery, equipment, or systems that are capable of being locked out. However, this alternative is only acceptable when the employer can demonstrate that the complete tags-plus program will provide workers the equivalent level of safety to that obtained by using a lock.
What are the key components of an energy control program?
- General procedures for the use of lockout/tags-plus systems (1915.89(c))
- Procedures for protecting workers involved in servicing operations (1915.89(d) through (m))
- Specifications for locks and tagout hardware (1915.89(n))
- Worker information and training procedures (1915.89(o))
- Incident investigation procedures (1915.89(p))
- Program audit procedures (1915.89(q))
NOTE: The lockout/tags-plus program must be made available to workers in written form, and appropriate training provided in a manner and language that they can understand.
What is the purpose of an energy-control program?
A comprehensive energy-control program is essential to protect workers in shipyard employment -- due to the complexity of the worksite, the large number of workers involved in the work force, the involvement of multiple employers, and the vast array of machinery, equipment, and systems that workers may be servicing. Although the energy-control program applies to all workers, it is directed primarily at those workers who have the greatest exposure to hazardous energy, which include authorized and affected employees. When the potential exists for the energization or startup of the machinery, equipment, or system, or the release of hazardous energy during the servicing of a piece of machinery, equipment, or system, all sources of energy must be identified, isolated, and rendered inoperative. Therefore, each source of energy must have a lock or tags-plus system applied to it.
Written Energy-Control Program
Employers must develop and follow written programs and procedures to control hazardous energy through the use of lockout/tags-plus applications during the servicing of any machinery, equipment, or system in shipyard employment (.89(b)). The key components outlined on page E5 of this document are essential for an effective program (.89(b)(1) through (b)(6)). Employers may use the model program found in Appendix A to 1915.89 to help develop their written program.
Facilities must provide appropriate training for each worker involved in servicing machinery, equipment, or systems (.89(o)). The job titles indicating the level of worker involvement in servicing are as follows:
- Lockout/Tags-plus Coordinator - A worker designated by the employer to coordinate and oversee all servicing operations during the following scenarios:
- On vessels or vessel sections and at landside work areas when workers are performing multiple servicing operations on the same machinery, equipment, or system at the same time, and
- On the same vessel or vessel section when workers are servicing multiple machinery, equipment, or systems at the same time.
The lockout/tags-plus coordinator also maintains the lockout/tags-plus log (.80(b)(15)).
- Primary Authorized Employee - A worker designated by the employer with responsibility for the safety of each authorized employee in a group performing servicing on the same machinery, equipment, or system (1915.89(k)(1)(i)). Specifically, this worker verifies that all potentially hazardous energy sources are found and made safe with a lock or appropriate energy-isolating devices and additional safety measures (1915.89(k)(1)(ii)), and coordinates each servicing operation with the lockout/tags-plus coordinator, including approval to apply and remove the lockout/tags-plus system (1915.89(k)(1)(iii) and (iv)).
- Authorized Employee - Any worker involved in the servicing of a machine, equipment, or system under a lockout/tags-plus application (1915.80(b)(3)).
- Affected Employee - Any worker who normally operates or uses the machinery, equipment, or system that is going to be serviced under lockout/tags-plus or who is working in the area where servicing is being performed under lockout/tags-plus (1915.80(b)(2)).
Isolation and Deenergization
Two initial steps are necessary before any authorized employee can perform servicing. First, all energy sources must be identified and isolated to ensure the machinery, equipment, or system is inoperative (.89(c)(1)). Next, the machinery, equipment, or system must be tested through the appropriate means to verify that deenergization and isolation of all energy sources is in effect (.89(g)(1)). Periodic testing to verify deenergization and isolation of the machinery, equipment, or system must be conducted until servicing is complete or where the possibility of reaccumulation no longer exists (.89(g)(2)). During group servicing operations, verification is to be performed by the primary authorized employee, and each authorized employee be given the option to verify the deenergization and isolation of all energy sources. Individual employee verification must be granted even when verification is performed by the primary authorized employee (.89(g)(3)).
Lock and Tag Application
For each lockout/tags-plus application, locks and tags used must be distinctly identifiable for the purpose of controlling hazardous energy and not used for any other purpose (.89(n)(2)). For example, employers could use the same color lock or tag for all lockout/tags-plus applications (e.g., red locks for lockout applications only). This also would meet the requirements of 1915.89(n)(3)(ii) to standardize each lock and tag in either color, shape, or size. Locks and tags must also be durable and be able to withstand the environmental conditions to which they are exposed for the maximum duration of the expected exposure. Further, locks and tags must be substantial (.89(n)(3)(iii)) and identifiable (.89(n)(3)(iv)). "Substantial" means:
- Each lock must be sturdy enough to prevent removal without the use of excessive force or special tools such as bolt cutters or other metal-cutting tools.
- Each tag and tag attachment must be sturdy enough to prevent inadvertent or accidental removal.
- Each tag attachment must be non-reusable and designed to have the basic safety characteristics equivalent to that of a one-piece nylon cable tie. This attachment must also be able to withstand at least 50 pounds of unlocking strength, have the ability to be attached by hand, and have self-locking, non-releasable capability.
The requirement for lockout/tags-plus hardware to be "identifiable" means that each lock and tag must clearly identify the authorized employee who applied it, such as stamping the authorized employee's name or identification number on the lock or tag. This action will allow individuals to quickly identify who applied the lock or tag.
Coordination is critical to servicing machinery, equipment, and systems in shipyard employment. As noted earlier, shipyard workers face numerous difficulties that can complicate servicing operations such as:
- large and complex machinery, equipment, and systems aboard vessels and vessel sections;
- machinery, equipment, and systems that have multiple power sources, isolation points, and types of energy; and
- difficulty identifying all energy sources due to faulty engineering drawings and schematics.
OSHA requires lockout/tags-plus coordination, including a lockout/tags-plus coordinator and a lockout/tags-plus log, when (1) workers on vessels and in vessel sections are servicing multiple machinery, equipment, or systems at the same time (.89(c)(7)(i)(A)); or (2) workers on vessels, in vessel sections, and at landside facilities are performing multiple servicing operations on the same machinery, equipment, or system at the same time (.89(c)(7)(i)(B)). Under both these scenarios the worker(s) assigned the job title of Lockout/tags-plus Coordinator must oversee and approve the application and removal of each lockout and tags-plus system, as well as verify hazardous-energy isolation prior to any servicing operation.
Employers have the discretion to assign a worker to be the Coordinator as his or her sole duty, or as a collateral duty. Further, employers have flexibility to determine whether one Coordinator for each vessel is adequate, or whether one Coordinator serving multiple vessels is appropriate. This decision depends on the size of the vessel, the number of servicing operations, the number of workers working at the same time, or any other factors that could affect the Coordinator's workload.
Example Scenarios: Lockout/tags-plus Coordination
Example 1 – A group of workers is repairing a high-pressure steam line in a location forward of a vessel’s machinery space, while another worker performs additional repairs on the same system in a location two levels below and aft of the vessel’s machinery space. In such a situation, coordination between the separate servicing operations is necessary to avoid harming a worker servicing one part of a system because another worker may restore power to that system without knowledge of the first worker. The presence of a coordinator, who knows the status of each servicing operation, would eliminate the possibility of one worker taking action that would endanger another worker.
Example 2 – A generator aboard a vessel supplies power to the vessel’s propulsion system and to the lighting system for a particular part of the vessel. If the authorized employee secures the generator to permit servicing of both of these systems, and the worker servicing the propulsion system restores power to the generator for testing or troubleshooting, a worker servicing the lighting system at the same time would be at risk of electrocution. The presence of a coordinator, who oversees removal of the lockout/tags-plus system for the two operations, would eliminate this risk.
Employers must develop and maintain lockout/tags-plus logs; however, employers have discretion when selecting the log format. For example, a log may consist of a traditional handwritten log book, or the employer may track lockout/tags-plus applications electronically through a computer software program. Regardless of the format selected, each lockout/tags-plus log must be specific to each vessel, vessel section, or landside work area, and must contain the: location of machinery, equipment, or system identified for servicing; type of machinery, equipment, or system identified for servicing; name of the authorized employee applying the lockout/tags-plus system; date the authorized employee applied the lockout/tags-plus system; name of the authorized employee removing the lockout/tags-plus system; and date the authorized employee removed the lockout/tags-plus system (see 1915.89(c)(7)(iv)).
During group lockout/tags-plus applications, when more than one authorized employee services the same machinery, equipment or system at the same time, the employer must assign responsibility to one primary authorized employee for each group of authorized employees performing servicing (.89(k)(1)).
Each authorized employee in the group must either:
- apply a personal lockout/tags-plus system (.89(k)(2)(i)); or
- use an alternative procedure that affords each authorized employee an equivalent level of protection as having each authorized employee apply a personal lockout/tags-plus system (.89(k)(2)(ii)). Such a method may consist of the signing of a group tag (or a group tag equivalent) before they start servicing, and sign off the group tag (or the group tag equivalent) when they finish servicing (.89(k)(2)(ii)(A)). Another acceptable alternative would be for each authorized employee to attach a personal identification device to a group lockout device before they start servicing, and remove the personal identification device when they finish servicing (.89(k)(2)(ii)(B)).
Alternative 1: Group Tag
Alternative 2: Personal Identification
At multi-employer worksites, the host employer has overall responsibility for protecting workers from hazardous energy (.89(l)(1)). Despite the overall responsibility of the host employer, contract employers may have more control over the lockout/tags-plus program than the host employer as long as the contract between both employers provides the host and contract workers with protection that is equivalent or greater than the level of protection afforded to them by the standard (Note 1 to paragraph (l) of .89(l)).
Host employers must:
- inform each contract employer about the content of the lockout/tags-plus program and procedures in place;
- instruct each contract employer to follow the lockout/tags-plus program and procedures in place; and
- ensure that the lockout/tags-plus coordinator knows about all servicing operations and communicates with each contract employer who performs servicing or works in an area where servicing is being conducted.
Contract employers must:
- follow the host employer's lockout/tags-plus program and procedures;
- ensure that the host employer knows about the lockout/tags-plus hazards associated with the contract employer's work and what the contract employer is doing to address these hazards; and
- inform the host employer of any previously unidentified lockout/tags-plus hazards that the contract employer sees at the multi-employer worksite.
Shift or Personnel Changes
Employers must have procedures in place during servicing operations to protect workers during shift or personnel changes. These procedures must allow for an orderly turnover between each authorized employee and provide continuity of hazardous-energy control during the start and end of each workshift, as well as when personnel changes occur during a workshift (1915.89(m)).
When work overlaps several workshifts, a group tag would be effective in protecting workers, allowing for each authorized employee involved in servicing to sign in on the group tag or equivalent (e.g., work permit) at the time of arrival to the job and sign out at departure. The primary authorized employee must review and retain the record of the signature, date, and time for signing in and signing out. Group tags or the equivalent could extend beyond a single shift and may consequently be the responsibility of several primary authorized employees.
In multi-shift group lockout/tags-plus servicing operations, each on-coming authorized employee must have an opportunity to verify that the machinery, equipment, or system has been deenergized and isolated. This allows for oncoming workers to be accountable for their own safety, not forced to depend on the actions of another authorized or primary authorized employee from an earlier shift.
Special notes exist in 1915.89 to address repairs conducted on Navy vessels when the Navy ship's force maintains control of the vessels' machinery, equipment, and systems, and performs the procedures for controlling hazardous energy. Below is a summary of these notes:
- When the Navy ship's force maintains control of the machinery, equipment, or systems on a vessel and implements such additional measures that it determines are necessary, the requirements for additional safety measures specified by .89(c)(4)(ii) and (c)(6)(ii)(B) do not apply. Employers need only comply with the procedures for verification of deenergization and isolation before work commences, as provided in .89(g).
- When the Navy ship's force serves as lockout/tags-plus coordinator and removes the lockout/tags-plus systems or devices, the employer meets the requirements of .89(i) when the employer's authorized employee informs the lockout/tags- plus coordinator that, as required by .89(i)(1), the authorized employee notified all authorized and affected employees that lockout/tags-plus applications will be removed.
- When the Navy ship's force serves as lockout/tags-plus coordinator and maintains control of the lockout/tags-plus systems or devices during startup and prohibits the employer from starting up the machinery, equipment, or system, the employer is in compliance with the provisions of .89(j) when the employer's authorized employee informs the lockout/tags-plus coordinator that, as required by .89(j)(2)(i) and (j)(2)(ii), tools, materials, and non-essential employees have been removed from the work area.
- When the Navy ship's force serves as lockout/tags-plus coordinator and maintains control of the lockout/tags-plus log, the employer meets the requirements of .89(c)(7) when coordination occurs between the ship's force and the employer to ensure that applicable lockout/tags-plus procedures are followed and documented.
- When the Navy ship's force shuts down any machinery, equipment, or system, and relieves, disconnects, restrains, or otherwise renders safe all potentially hazardous energy connected to the machinery, equipment, or system, the employer is in compliance with the requirements of .89(e) when the employer's authorized employee verifies that the machinery, equipment, or system being serviced has been properly shut down, isolated, and deenergized.
- When the Navy ship's force applies the lockout/tags-plus systems or devices, the employer meets the requirements of the .89(f) when the employer's authorized employee verifies the application of the lockout/tags-plus systems or devices.
- When the Navy ship's force serves as the lockout/tags-plus coordinator, performs the testing, and maintains control of the lockout/tags-plus systems or devices during testing, the employer is in compliance with the requirements of .89(h) when the employer's authorized employee acknowledges to the lockout/tags-plus coordinator that personnel and tools are clear and machinery, equipment, or systems being serviced are ready for testing and, upon completion of the testing, verifies the reapplication of the lockout/tags-plus systems.
- When the Navy ship's force maintains control of the machinery, equipment, or systems on a vessel and prohibits the employer from applying or removing the lockout/tags-plus system or starting up the machinery, equipment, or systems being serviced, the employer meets the requirements of .89(k)(1)(iii) and (k)(2) when the employer's primary authorized employee:
(1) Verifies the safe exposure status of each authorized employee, and signs a group tag (or a group tag equivalent), or performs a comparable action, before servicing begins and after deenergization; and
(2) Verifies the safe exposure status of each authorized employee, and signs off the group tag (or the group tag equivalent), or performs a comparable action, after servicing is complete and before reenergization.
- For the purposes of .89(l)(3), the U.S. Navy becomes the host employer when it directly contracts work with a vendor and the Navy ship's force maintains control of the lockout/tags-plus systems or devices.
E-4, E-5, E-6, E-7, E-8, E-9, E-10 and E-11