Using E-Stops in Lockout Procedures

Disconnect Switch with Lock, Tag, and Gang-hasp
An elec­tri­cal rotary dis­con­nect­ing device han­dle with a typ­i­cal lock, tag, and gang-hasp.

Con­trol of haz­ardous ener­gy is one of the key ways that main­te­nance and ser­vice work­ers are pro­tect­ed while main­tain­ing indus­tri­al equip­ment. Not so long ago we only thought about ‘Lock­out’ or ‘Lockout/Tagout’ pro­ce­dures, but there is much more to pro­tect­ing these work­ers than ‘just’ lock­ing out ener­gy sources. Inevitably con­di­tions come up where safe­guards may need to be removed or tem­porar­i­ly bypassed in order to diag­nose prob­lems or to make crit­i­cal but infre­quent adjust­ments to the equip­ment, and this is where Haz­ardous Ener­gy Con­trol Pro­ce­dures, or HECP, come in.

One of the ques­tions I often get when help­ing clients with devel­op­ing HECPs for their equip­ment is, “Can we use the emer­gency stop cir­cuit for lock­out?” As usu­al, there is a short answer and a long answer to that sim­ple ques­tion!

The Short Answer

The short answer to this ques­tion is NO. Lock­out requires that sources of haz­ardous ener­gy be phys­i­cal­ly iso­lat­ed or blocked. Con­trol sys­tems may be able to meet parts, but not all of this require­ment. Read on if you’d like to know why.

The Long Answer

Lockout

Lock­out pro­ce­dures are now grouped with oth­er adjust­ment, diag­nos­tic and test pro­ce­dures into what are called Haz­ardous Ener­gy Con­trol Pro­ce­dures or HECP. In the USA, OSHA pub­lish­es a lock­out stan­dard in 29 CFR 1910.147, and ANSI pub­lish­es ANSI Z244.1.

Down­load ANSI stan­dards

In Cana­da, we didn’t have a stan­dard for HECP until 2005 when CSA Z460 was pub­lished, although all the Provinces and Ter­ri­to­ries have some lan­guage in their leg­is­la­tion that at least alludes to the need for con­trol of haz­ardous ener­gy. In the Province of Ontario where I live, this require­ment shows up in Ontario Reg­u­la­tion 851, Sec­tions 42, 75 and 76.

In the EU, con­trol of haz­ardous ener­gy is dealt with in ISO 14118:2000, Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up.

Down­load ISO Stan­dards

If you have a look at the sec­tions of the Ontario reg­u­la­tions, they don’t tell you how to per­form lock­out, and they make lit­tle men­tion of what to do with live work for trou­bleshoot­ing pur­pos­es. The US OSHA reg­u­la­tions read more like a stan­dard, but because they are in leg­is­la­tion they are pre­scrip­tive. You MUST meet this min­i­mum require­ment, and you may exceed it.

Let’s look at how “lock­out” is defined in the stan­dards.

Cana­da (Ontario) USA (OSHA) Euro­pean Union
Lock­out — place­ment of a lock or tag on an ener­gy-iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, there­by indi­cat­ing that the ener­gy-iso­lat­ing device is not to be oper­at­ed until removal of the lock or tag in accor­dance with an estab­lished pro­ce­dure.

CSA Z460, 2005

Lock­out. The place­ment of a lock­out device on an ener­gy iso­lat­ing device, in accor­dance with an estab­lished pro­ce­dure, ensur­ing that the ener­gy iso­lat­ing device and the equip­ment being con­trolled can­not be oper­at­ed until the lock­out device is removed.

Tagout. The place­ment of a tagout device on an ener­gy iso­lat­ing device, in accor­dance with an estab­lished pro­ce­dure, to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

29 CFR 1910.147

2.14 lockout/tagout: The place­ment of a lock/tag on the ener­gy iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, indi­cat­ing that the ener­gy iso­lat­ing device shall not be oper­at­ed until removal of the lock/tag in accor­dance with an estab­lished pro­ce­dure. (The term “lockout/tagout” allows the use of a lock­out device, a tagout device, or a com­bi­na­tion of both.)

ANSI Z244.1–2003

 

3.3 iso­la­tion and ener­gy dis­si­pa­tion

pro­ce­dure which con­sists of all of the four fol­low­ing actions:

a) iso­lat­ing (dis­con­nect­ing, sep­a­rat­ing) the machine (or defined parts of the machine) from all pow­er sup­plies;

b) lock­ing (or oth­er­wise secur­ing), if nec­es­sary (for instance in large machines or in instal­la­tions), all the iso­lat­ing units in the “iso­lat­ed” posi­tion;

c) dis­si­pat­ing or restrain­ing [con­tain­ing] any stored ener­gy which may give rise to a haz­ard.

NOTE Ener­gy con­sid­ered in c) above may be stored in e.g.:

  • mechan­i­cal parts con­tin­u­ing to move through iner­tia;
  • mechan­i­cal parts liable to move by grav­i­ty;
  • capac­i­tors, accu­mu­la­tors;
  • pres­sur­ized flu­ids;
  • springs.

d) ver­i­fy­ing by using a safe work­ing pro­ce­dure that the actions tak­en accord­ing to a), b) and c) above have pro­duced the desired effect.

ISO 14118–2000

As you can see, the def­i­n­i­tions are fair­ly sim­i­lar, although slight­ly dif­fer­ent terms may be used. The ISO stan­dard actu­al­ly pro­vides the best guid­ance over­all in my opin­ion. Note that these excerpts are all tak­en from the def­i­n­i­tions sec­tions of the rel­e­vant doc­u­ments.

One of the big dif­fer­ences between the US and Cana­da is the idea of ‘tagout’ (pro­nounced TAG-out for those not famil­iar with the term). Tagout is iden­ti­cal to lock­out with the excep­tion of the device that is attached to the ener­gy iso­lat­ing device. Under cer­tain cir­cum­stances, the US per­mits the use of a tag with­out a lock to secure the ener­gy iso­la­tion device. This is not per­mit­ted in Cana­da under any cir­cum­stance, and the term ‘tagout’ is not offi­cial­ly rec­og­nized. In Cana­da, the term is often tak­en to mean the addi­tion of a tag to the lock­ing device,  a manda­to­ry part of the pro­ce­dure.

Use of Controls for Energy Isolation

This is where the ‘rub­ber meets the road’ — how is the source of haz­ardous ener­gy iso­lat­ed effec­tive­ly? To under­stand the require­ments, let’s look at the def­i­n­i­tion of an Ener­gy Iso­lat­ing Device.

Cana­da USA EU
Ener­gy-iso­lat­ing device — a mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors; a line valve; a block; and oth­er devices used to block or iso­late ener­gy (push-but­ton selec­tor switch­es and oth­er con­trol-type devices are not ener­gy-iso­lat­ing devices).

CSA Z460, 2005

Note — Bold added for empha­sis — DN

Ener­gy iso­lat­ing device. A mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: A man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er; a dis­con­nect switch; a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors, and, in addi­tion, no pole can be oper­at­ed inde­pen­dent­ly; a line valve; a block; and any sim­i­lar device used to block or iso­late ener­gy. Push but­tons, selec­tor switch­es and oth­er con­trol cir­cuit type devices are not ener­gy iso­lat­ing devices.

Note — Bold added for empha­sis — DN

Tagout device. A promi­nent warn­ing device, such as a tag and a means of attach­ment, which can be secure­ly fas­tened to an ener­gy iso­lat­ing device in accor­dance with an estab­lished pro­ce­dure, to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

29 CFR 1910.147

2.8 ener­gy iso­lat­ing device: A mechan­i­cal device that phys­i­cal­ly pre­vents the trans­mis­sion or release of ener­gy, includ­ing but not lim­it­ed to the fol­low­ing: a man­u­al­ly oper­at­ed elec­tri­cal cir­cuit break­er, a dis­con­nect switch, a man­u­al­ly oper­at­ed switch by which the con­duc­tors of a cir­cuit can be dis­con­nect­ed from all unground­ed sup­ply con­duc­tors and, in addi­tion, no pole can be oper­at­ed inde­pen­dent­ly; a line valve; a block; and any sim­i­lar device used to block or iso­late ener­gy.

2.20.1 tagout device: A promi­nent warn­ing means such as a tag and a means of attach­ment, which can be secure­ly fas­tened to an ener­gy iso­lat­ing device to indi­cate that the ener­gy iso­lat­ing device and the equip­ment being con­trolled may not be oper­at­ed until the tagout device is removed.

ANSI Z244.1–2003

4.1 Iso­la­tion and ener­gy dis­si­pa­tion

Machines shall be pro­vid­ed with means intend­ed for iso­la­tion and ener­gy dis­si­pa­tion (see clause 5), espe­cial­ly with a view to major main­te­nance, work on pow­er cir­cuits and decom­mis­sion­ing in accor­dance with the essen­tial safe­ty require­ment expressed in ISO/TR 12100–2:1992, annex A, 1.6.3.

Note — ISO/TR 12100–2 was with­drawn in Oct-10 and replaced by ISO 12100–2010. — DN Read more on this.

5.1 Devices for iso­la­tion from pow­er sup­plies
5.1.1
Iso­la­tion devices shall:

  • ensure a reli­able iso­la­tion (dis­con­nec­tion, sep­a­ra­tion);
  • have a reli­able mechan­i­cal link between the man­u­al con­trol and the iso­lat­ing element(s);
  • be equipped with clear and unam­bigu­ous iden­ti­fi­ca­tion of the state of the iso­la­tion device which cor­re­sponds to each posi­tion of its man­u­al con­trol (actu­a­tor).

NOTE 1 For elec­tri­cal equip­ment, a sup­ply dis­con­nect­ing device com­ply­ing with IEC 60204–1:1997, 5.3 “Sup­ply dis­con­nect­ing (iso­lat­ing) device” meets this require­ment.

NOTE 2 Plug and sock­et sys­tems (for elec­tri­cal sup­plies), or their pneu­mat­ic, hydraulic or mechan­i­cal equiv­a­lents, are exam­ples of iso­lat­ing devices with which it is pos­si­ble to achieve a vis­i­ble and reli­able dis­con­ti­nu­ity in the pow­er sup­ply cir­cuits.

For elec­tri­cal plug/socket com­bi­na­tions, see IEC 60204–1:1997, 5.3.2 d).

NOTE 3 For hydraulic and pneu­mat­ic equip­ment, see also EN 982:1996, 5.1.6 and EN 983:1996, 5.1.6.

ISO 14118–2000

 

BRADY Small Plug Lockout Device
BRADY Small Plug Lock­out Device

As you can see from the above def­i­n­i­tions, all the juris­dic­tions require that devices used for ener­gy iso­la­tion are reli­able, man­u­al­ly oper­a­ble, mechan­i­cal devices. While elec­tri­cal con­trol sys­tems that meet high lev­els of design reli­a­bil­i­ty may meet the reli­a­bil­i­ty require­ments, they do not meet the require­ments for phys­i­cal, mechan­i­cal dis­con­nec­tion of the source of haz­ardous ener­gy. Oper­a­tor devices are specif­i­cal­ly exclud­ed from this use in Cana­da and the USA. Note that plug and sock­et com­bi­na­tions are per­mit­ted in all juris­dic­tions. Lock­out devices such as Brady 65675 Large Plug Lock­out Device, like the Brady Small Plug Lock­out Device shown here and sim­i­lar devices, can be used for this pur­pose. With some plugs, it is pos­si­ble to put a small lock through a hole in one of the blades or pins. In some juris­dic­tions, even the sim­ple act of putting the plug in your back pock­et while con­duct­ing the work is suf­fi­cient.

BRADY Button Locking Device
BRADY But­ton Lock­ing Device

In addi­tion, the ener­gy iso­la­tion device is required to be able to be locked in the off, iso­lat­ed, or blocked posi­tion. There are emer­gency stop but­ton oper­a­tors that can be pur­chased with an inte­grat­ed lock cylin­der, and there are some con­trol oper­a­tor acces­sories avail­able that will allow con­trol push­but­tons and selec­tor switch­es to be locked in one posi­tion or anoth­er, but these do not meet the require­ments of the above stan­dards. They can be used in addi­tion to an ener­gy iso­la­tion device as part of the pro­ce­dure, but not on their own as the sole means of pre­vent­ing unex­pect­ed start-up.

Conclusions

Each machine or piece of equip­ment is required to have a HECP that is spe­cif­ic to that piece of equip­ment. ‘Glob­al’ HECP’s are sel­dom use­ful except as a tem­plate doc­u­ment. Devel­op­ment of HECPs takes some care­ful thought and a thor­ough under­stand­ing of the kinds of work that will need to be done to main­tain and ser­vice the machin­ery. Indi­vid­ual juris­dic­tions have some dif­fer­ences in the details of their reg­u­la­tions, but ulti­mate­ly the require­ments come down to the same thing: Pro­tect­ing work­ers.

Con­trol sys­tem devices such as stop but­tons and emer­gency stop devices are not accept­ed as ener­gy iso­lat­ing devices and can­not be used for this pur­pose, although they may be used as part of the HECP shut­down pro­ce­dure lead­ing up to the phys­i­cal iso­la­tion of the haz­ardous ener­gy sources.

Excel­lent stan­dards exist that cov­er devel­op­ment of these pro­ce­dures and should be ref­er­enced as spe­cif­ic HECP are devel­oped.

5% Dis­count on All Stan­dards with code: CC2011

References

Canada

Ontario Reg­u­la­tion 851, Sec­tions 42, 75 and 76.

CSA Z460-05 (R2010) — Con­trol of haz­ardous ener­gy — Lock­out and oth­er meth­ods

USA

29 CFR 1910.147The con­trol of haz­ardous ener­gy (lockout/tagout).

ANSI Z244.1 — 2003 (R2008) — Con­trol of Haz­ardous Ener­gy – Lockout/Tagout and Alter­na­tive Meth­ods

Down­load stan­dards

Allen-Bradley 8579
Allen-Bradley 8579

International

ISO 14118 2000, Safe­ty of machin­ery — Pre­ven­tion of unex­pect­ed start-up

Down­load ISO Stan­dards

Series Nav­i­ga­tionEmer­gency Stop Cat­e­goriesRead­er Ques­tion: Mul­ti­ple E-Stops and Resets

Author: Doug Nix

Doug Nix is Managing Director and Principal Consultant at Compliance InSight Consulting, Inc. (http://www.complianceinsight.ca) in Kitchener, Ontario, and is Lead Author and Senior Editor of the Machinery Safety 101 blog. Doug's work includes teaching machinery risk assessment techniques privately and through Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ontario, as well as providing technical services and training programs to clients related to risk assessment, industrial machinery safety, safety-related control system integration and reliability, laser safety and regulatory conformity. For more see Doug's LinkedIn profile.