- Emergency Stop — What’s so confusing about that?
- Checking Emergency Stop Systems
- Busting Emergency Stop Myths
- Guarding Emergency Stop Devices
- Emergency Stop Categories
- Using E-Stops in Lockout Procedures
- Reader Question: Multiple E-Stops and Resets
- Updates to Popular Articles
- New contact block design for Emergency Stop devices from Siemens
- Emergency stop devices: the risks of installer liability
- Testing Emergency Stop Systems
- STO)”>Safe Drive Control including Safe Torque Off (STO)
- Emergency Stop Failures
Control of hazardous energy is one of the key ways that maintenance and service workers are protected while maintaining industrial equipment. Not so long ago we only thought about ‘Lockout’ or ‘Lockout/Tagout’ procedures, but there is much more to protecting these workers than ‘just’ locking out energy sources. Inevitably conditions come up where safeguards may need to be removed or temporarily bypassed in order to diagnose problems or to make critical but infrequent adjustments to the equipment, and this is where Hazardous Energy Control Procedures, or HECP, come in.
One of the questions I often get when helping clients with developing HECPs for their equipment is, “Can we use the emergency stop circuit for lockout?” As usual, there is a short answer and a long answer to that simple question!
The Short Answer
The short answer to this question is NO. Lockout requires that sources of hazardous energy be physically isolated or blocked. Control systems may be able to meet parts, but not all of this requirement. Read on if you’d like to know why.
The Long Answer
Lockout procedures are now grouped with other adjustment, diagnostic and test procedures into what are called Hazardous Energy Control Procedures or HECP. In the USA, OSHA publishes a lockout standard in 29 CFR 1910.147, and ANSI publishes ANSI Z244.1.
In Canada, we didn’t have a standard for HECP until 2005 when CSA Z460 was published, although all the Provinces and Territories have some language in their legislation that at least alludes to the need for control of hazardous energy. In the Province of Ontario where I live, this requirement shows up in Ontario Regulation 851, Sections 42, 75 and 76.
In the EU, control of hazardous energy is dealt with in ISO 14118:2000, Safety of machinery — Prevention of unexpected start-up.
If you have a look at the sections of the Ontario regulations, they don’t tell you how to perform lockout, and they make little mention of what to do with live work for troubleshooting purposes. The US OSHA regulations read more like a standard, but because they are in legislation they are prescriptive. You MUST meet this minimum requirement, and you may exceed it.
Let’s look at how “lockout” is defined in the standards.
|Canada (Ontario)||USA (OSHA)||European Union|
|Lockout — placement of a lock or tag on an energy-isolating device in accordance with an established procedure, thereby indicating that the energy-isolating device is not to be operated until removal of the lock or tag in accordance with an established procedure.
CSA Z460, 2005
|Lockout. The placement of a lockout device on an energy isolating device, in accordance with an established procedure, ensuring that the energy isolating device and the equipment being controlled cannot be operated until the lockout device is removed.
Tagout. The placement of a tagout device on an energy isolating device, in accordance with an established procedure, to indicate that the energy isolating device and the equipment being controlled may not be operated until the tagout device is removed.
29 CFR 1910.147
2.14 lockout/tagout: The placement of a lock/tag on the energy isolating device in accordance with an established procedure, indicating that the energy isolating device shall not be operated until removal of the lock/tag in accordance with an established procedure. (The term “lockout/tagout” allows the use of a lockout device, a tagout device, or a combination of both.)
|3.3 isolation and energy dissipation
procedure which consists of all of the four following actions:
a) isolating (disconnecting, separating) the machine (or defined parts of the machine) from all power supplies;
b) locking (or otherwise securing), if necessary (for instance in large machines or in installations), all the isolating units in the “isolated” position;
c) dissipating or restraining [containing] any stored energy which may give rise to a hazard.
NOTE Energy considered in c) above may be stored in e.g.:
d) verifying by using a safe working procedure that the actions taken according to a), b) and c) above have produced the desired effect.
As you can see, the definitions are fairly similar, although slightly different terms may be used. The ISO standard actually provides the best guidance overall in my opinion. Note that these excerpts are all taken from the definitions sections of the relevant documents.
One of the big differences between the US and Canada is the idea of ‘tagout’ (pronounced TAG-out for those not familiar with the term). Tagout is identical to lockout with the exception of the device that is attached to the energy isolating device. Under certain circumstances, the US permits the use of a tag without a lock to secure the energy isolation device. This is not permitted in Canada under any circumstance, and the term ‘tagout’ is not officially recognized. In Canada, the term is often taken to mean the addition of a tag to the locking device, a mandatory part of the procedure.
Use of Controls for Energy Isolation
This is where the ‘rubber meets the road’ — how is the source of hazardous energy isolated effectively? To understand the requirements, let’s look at the definition of an Energy Isolating Device.
|Energy-isolating device — a mechanical device that physically prevents the transmission or release of energy, including but not limited to the following: a manually operated electrical circuit breaker; a disconnect switch; a manually operated switch by which the conductors of a circuit can be disconnected from all ungrounded supply conductors; a line valve; a block; and other devices used to block or isolate energy (push-button selector switches and other control-type devices are not energy-isolating devices).
CSA Z460, 2005
Note — Bold added for emphasis — DN
|Energy isolating device. A mechanical device that physically prevents the transmission or release of energy, including but not limited to the following: A manually operated electrical circuit breaker; a disconnect switch; a manually operated switch by which the conductors of a circuit can be disconnected from all ungrounded supply conductors, and, in addition, no pole can be operated independently; a line valve; a block; and any similar device used to block or isolate energy. Push buttons, selector switches and other control circuit type devices are not energy isolating devices.
Note — Bold added for emphasis — DN
Tagout device. A prominent warning device, such as a tag and a means of attachment, which can be securely fastened to an energy isolating device in accordance with an established procedure, to indicate that the energy isolating device and the equipment being controlled may not be operated until the tagout device is removed.
29 CFR 1910.147
2.8 energy isolating device: A mechanical device that physically prevents the transmission or release of energy, including but not limited to the following: a manually operated electrical circuit breaker, a disconnect switch, a manually operated switch by which the conductors of a circuit can be disconnected from all ungrounded supply conductors and, in addition, no pole can be operated independently; a line valve; a block; and any similar device used to block or isolate energy.
2.20.1 tagout device: A prominent warning means such as a tag and a means of attachment, which can be securely fastened to an energy isolating device to indicate that the energy isolating device and the equipment being controlled may not be operated until the tagout device is removed.
|4.1 Isolation and energy dissipation
Machines shall be provided with means intended for isolation and energy dissipation (see clause 5), especially with a view to major maintenance, work on power circuits and decommissioning in accordance with the essential safety requirement expressed in ISO/TR 12100–2:1992, annex A, 1.6.3.
Note — ISO/TR 12100–2 was withdrawn in Oct-10 and replaced by ISO 12100–2010. — DN Read more on this.
5.1 Devices for isolation from power supplies
NOTE 1 For electrical equipment, a supply disconnecting device complying with IEC 60204–1:1997, 5.3 “Supply disconnecting (isolating) device” meets this requirement.
NOTE 2 Plug and socket systems (for electrical supplies), or their pneumatic, hydraulic or mechanical equivalents, are examples of isolating devices with which it is possible to achieve a visible and reliable discontinuity in the power supply circuits.
For electrical plug/socket combinations, see IEC 60204–1:1997, 5.3.2 d).
NOTE 3 For hydraulic and pneumatic equipment, see also EN 982:1996, 5.1.6 and EN 983:1996, 5.1.6.
As you can see from the above definitions, all the jurisdictions require that devices used for energy isolation are reliable, manually operable, mechanical devices. While electrical control systems that meet high levels of design reliability may meet the reliability requirements, they do not meet the requirements for physical, mechanical disconnection of the source of hazardous energy. Operator devices are specifically excluded from this use in Canada and the USA. Note that plug and socket combinations are permitted in all jurisdictions. Lockout devices such as Brady 65675 Large Plug Lockout Device, like the Brady Small Plug Lockout Device shown here and similar devices, can be used for this purpose. With some plugs, it is possible to put a small lock through a hole in one of the blades or pins. In some jurisdictions, even the simple act of putting the plug in your back pocket while conducting the work is sufficient.
In addition, the energy isolation device is required to be able to be locked in the off, isolated, or blocked position. There are emergency stop button operators that can be purchased with an integrated lock cylinder, and there are some control operator accessories available that will allow control pushbuttons and selector switches to be locked in one position or another, but these do not meet the requirements of the above standards. They can be used in addition to an energy isolation device as part of the procedure, but not on their own as the sole means of preventing unexpected start-up.
Each machine or piece of equipment is required to have a HECP that is specific to that piece of equipment. ‘Global’ HECP’s are seldom useful except as a template document. Development of HECPs takes some careful thought and a thorough understanding of the kinds of work that will need to be done to maintain and service the machinery. Individual jurisdictions have some differences in the details of their regulations, but ultimately the requirements come down to the same thing: Protecting workers.
Control system devices such as stop buttons and emergency stop devices are not accepted as energy isolating devices and cannot be used for this purpose, although they may be used as part of the HECP shutdown procedure leading up to the physical isolation of the hazardous energy sources.
Excellent standards exist that cover development of these procedures and should be referenced as specific HECP are developed.
CSA Z460-05 (R2010) — Control of hazardous energy — Lockout and other methods
29 CFR 1910.147 — The control of hazardous energy (lockout/tagout).
ANSI Z244.1 — 2003 (R2008) — Control of Hazardous Energy – Lockout/Tagout and Alternative Methods
ISO 14118 2000, Safety of machinery — Prevention of unexpected start-up