Energy Isolation Procedure and Lockout Tagout Procedure

Table of Contents

1.	Purpose
2.	Scope
3.	Definitions
4.	Summary
5.	Procedure
6.	Related Information
7.	Change Log
Appendix A	Typical Danger Tags
Appendix B	Periodic Inspection of Energy Control Procedures
Appendix C	Operational Tags* Not Associated With Permits
Appendix D	Safety Work Permit – Group Lockout Signatures

1. PURPOSE

This procedure establishes a standard for applying lockout and/or tagout to energy isolating devices for the purpose of preventing injuries during inspection, maintenance, repair, modification, construction, or any other work on such systems which requires isolation for safe working. These injuries could be caused by the unexpected energization, start-up, or release of stored energy in the equipment with which they are working.

2. SCOPE

2.1        This procedure applies to all Company ‘ sites, operations, manufacturing, construction, pipeline activities and service/maintenance activities on third party sites. It covers both employees and contractors.

3. DEFINITIONS

3.1       Authorized Person is a competent person who is appropriately trained (and may be appointed by the Facility Manager) to carry out energy isolation in accordance with this procedure. Authorization for electrical isolation is as defined in procedure 01.05.20 “Electrical Safe Work Practices.”

3.2        Competent Person is a person having sufficient technical knowledge or experience to recognize hazards and complete assigned tasks safely. Each operating group shall define competency levels for each isolation task.

3.3        Danger Tag (Tag): A unique tag for identifying isolation points. Danger Tags, illustrated in Appendix A (Form 2027 or local language equivalent), must be used for lockout tagout as described in this procedure and not for any other purpose. Other forms of Danger Tags may be used for other purposes (that is, tagging broken tools out of service, identifying barricades, prohibiting operation of a valve for operational reasons) but must be unique and different from those used for lockout tagout.

3.4        Double block and bleed is a valve arrangement (two or more block valves) to provide isolation of the live process system from the work area. The space between the block valves is continuously depressurized by one or more bleed/drain valves to divert any hazardous fluid leakage. The blocked volume should be relatively small with the bleed/drain valve located in close proximity to the block valves. All of the associated valves in this arrangement shall be locked and tagged in position.

3.5       Energy Source is a source of any type of energy which is capable of causing injury to workers. Some examples of energy sources are as follows (not all inclusive):

• Electrical
• Communications (that is, Remote starting equipment)
• Hydraulic
• Pneumatic
• Thermal
• Chemical
• Mechanical
• Stored energy

3.6        Grounded (earthed) means connected to the general mass of earth in such a manner as will ensure at all times an immediate discharge of electrical energy without danger.

3.7        Group Locks: A single group lock may be used in lieu of multiple personal locks (unless prohibited by legislation). Names of individuals covered under the group lock must be logged on Appendix D.

3.8       High voltage is 1001 volts and higher.

3.9        Isolating Device is a device which prevents the unwanted operation, pressurization, commissioning, etc., of an energized system which could result in the death, injury, or ill health of personnel working on or near that system. Examples of isolating devices could be, but are not limited, to the following:

• Manual block valves
• Process flow blanks/blinds
• Electrical breakers/disconnects
• Blind Flanges
• Gagging pins

Note: Check (non-return) valves ARE NOT isolating devices.

3.10      Isolation Plan is a detailed, written plan for isolating equipment, which because of its function or nature may present unique isolation requirements or challenges. Example methods of isolation plans may include JSAs, Work Instructions, operating/maintenance procedures, and P&IDs. Isolation plans may be required in addition to Safety Work Permits and isolation registers.

3.11     Isolation Register is a log used to track the installation of lockout devices and danger tags. Isolation registers are incorporated into the safety work permit form itself. For additional space, use Safety Work Permit Addendum (Appendix E, 25-010530 Safety Work Permit).

3.12      JSA/Workplace Risk Assessment (25-010501) – Risk Assessment is a process of assessing specific activities and work processes for hazards and risks. It is a systematic method of:

• Analyzing work activity.
• Identifying hazards, hazardous situations, and potentially hazardous events.
• Evaluating risks by considering the likelihood of hazardous events and the nature and severity of the harm that may result. and
• Reviewing existing and possible control options and action priorities.

3.13      Lockout/Tagout/Try (sometimes referred to as:  LOTO or Lockout/tagout) is the placement of a lock and danger tag on an isolating device indicating that the isolating device and its system shall not be operated or removed until the lock and danger tags are removed. Then Try to start the equipment (for electrical isolations) or Try to find residual pressure or chemicals in the process by checking bleed valves or other sources. Note when ‘TRYing’, attention should be paid to the potential change in the status of interlock/trip devices. Ensure that equipment and personnel are clear prior to “TRYing” equipment before commencing work in the field.

3.14      Lock Box – A plastic or metal box designed to allow for permit and personal locks to be attached and for the key(s) associated with the locks on the isolation devices in the field to be contained inside.

3.15      Lockout Device is a substantial device used to secure an isolating device and prevent its operation. This includes devices such as padlocks, multi-lock hasps, locking valve handwheel covers (clamshells), chain and cable. Lockout devices must be unique and different from those used for other purposes and may not be used for any other purpose.

3.16     Low Voltage is between 31 and 1000 volts.

3.17     Permit (Operations) Lock:  Lock installed as part of the isolation process by the Permit Issuer. The Permit Lock can be removed only when the work is completed and the permit is closed out.

3.18      Personal Lock: Locks installed by individuals conducting work under a work permit. Personal Locks are installed in addition to the Permit (Operations) Lock. Sites/locations staffed with only one person, for example, package plants, customer stations technicians may use either Personal locks or Permit locks as long as the individual protected has possession of the only key to the lock.

4. SUMMARY

4.1       Whenever performing inspection, maintenance, repair, modification, construction, or any other work activities that could expose personnel to any hazard due to contact with gas, fluid, solid, electricity, energy, or other mechanical motion, etc., the system must first be isolated and made safe using the lock/tag/try methodology.

4.1.1     In general, once all the potential hazards have been identified it will be necessary to consider how they can be separated or isolated from the equipment or part of the plant to be worked on.

4.1.2     The person responsible for the equipment and the work to be done must determine the hazard(s) both to personnel and equipment by reviewing current drawings, P&IDs, specifications, and by experience or other means, and by a physical inspection of the work site. This person can then determine the valves to be closed or opened, and the electrical switches to be opened, etc., to provide a safe working environment.

4.2       Isolation Overview

4.2.1    Machinery

4.2.1.1 Machinery should be isolated from its power supply (electric, pneumatic, steam or hydraulic), or if engine-driven, the starting system or engine should be disconnected. Where necessary, the machinery should be prevented from moving, for example, from gravity fall or release of pressure, by positive physical means.

4.2.2    Pressurized Systems

4.2.2.1 Pressurized systems of all kinds should be isolated and proved depressurized.

4.2.3    Chemical Systems

4.2.3.1 Chemical systems, where pipework, vessels, or tanks contain fluids or materials which are hot, very cold, flammable, toxic, corrosive, or otherwise present exposure to personnel who will be working on the system, must be isolated from their sources of supply, drained, purged, and decontaminated as necessary.

4.2.4    Electrical Systems

4.2.4.1 Electrical systems capable of causing a hazard to personnel working on them or of igniting a flammable atmosphere must be isolated and proved de-energized. Electrical systems must also be grounded (earthed) where applicable.

4.2.5    Safety and Emergency Systems

4.2.5.1 Safety and emergency systems may require isolation or inhibition for maintenance. Where the intention is to avoid unnecessary operation of alarms or emergency systems, inhibition or manual control is preferred.

5. PROCEDURE

5.1       Methods to Determine the Hazards

5.1.1     An authorized person must determine the hazard both to personnel and equipment by a review of Piping and Instrument Diagrams (P&ID), drawings, specifications, other relevant documents, AND BY A PHYSICAL INSPECTION OF THE AREA.

5.2       Methods to Isolate the Work Area

5.2.1     The work area can be isolated in a number of ways. In order of decreasing levels of safety, they are:

1. Remove piping spool (physical disconnection) and fit blank(s)/blind(s).
2. Fit blank(s)/blind(s).
3. Double Block Valve and Bleed Valve subject to initial monitoring of the bleed valve outlet to ensure the integrity of the isolation.
4. Single Valve Isolation with verification

Note: Single Valve Isolation comprises the closure of a single, high-integrity block valve and verification that the valve has tightly closed. The downstream process system may then be vented/purged, disconnected, or further isolated via another isolation device. For higher risk potential hazardous pressure systems, single-valve proper sealing integrity shall be ascertained by conducting a downstream verification test of the isolated process system (for example, vacuum decay, pressure rise, bubble test hazardous gas analysis, or equivalent test). The verification test shall be able to detect leakage of the single isolation valve at the lower limit of acceptable personnel exposure as determined from the fluid hazard characteristics. This may be accomplished by adjusting the vacuum retention duration, pressure rise duration, or analyzer detection sensitivity accordingly.

5.2.1.1 For further information on the above isolation methods please refer to Engineering Standard 28-2S807 Hazardous Process System Mechanical Isolation.

5.2.2    Other methods of isolation may be used depending on the hazards of the specific systems (see Section 5.3).

5.2.3     The most effective isolation method reasonably practicable should be selected, taking into account the fact that there may be risks in achieving a higher standard that outweighs the risks involved in using a lower one.

5.2.4    DO NOT RELY ON:

1. CHECK VALVES to isolate.
2. PRESSURE GAUGES being accurate.
3. BALLOON type plugs.
4. PURGES unless constantly monitored.
5. SPRUNG FLANGES to give bleed.
6. AUTOMATIC GLOBE VALVES with pressure under the seat unless CLAMPED.
7. BLEED VALVES staying clear.
8. CONTROL VALVES to isolate unless additional precautions have been taken include the following.

• The valve is rated for full closure isolation or has been verified as adequate for the isolation by the appropriate support engineering group.
• The valve is designed to fail closed or “in position” (as first choice) or
• The valve is physically secured in the isolation position (as second choice)
• The valve stem is inspected to verify the valve closes completely. If the valve has a minimum stop, then the physical valve stop must be removed, and the valve stem must be re-inspected to verify the valve is closed completely.
• The operating source (air, power, etc.) is physically disconnected from the actuator and connection points are locked against reconnecting the operating source. (For example, a barrier such as a lockable plug or wrap around the valve actuator operating power connection is applied and locked/tagged to prevent reconnection of the air supply to the valve actuator.)
• A specific control valve isolation plan has been developed for that specific valve which has been approved by the facility or line manager. Such a plan must provide the detail of the appropriate method to position the control valve, block, lock and secure the valve when used for energy isolation, including any restrictions or limitations surroundings its use for energy isolation.

Note: Closing the control valve and only tagging the valve open/close switch with a Danger Tag is NOT considered positive valve lock-out and is not allowed under this procedure.

5.3       Criteria to Consider Before Deciding Isolation

• The system medium.
• Its pressure.
• Its temperature.
• The system volume behind it.
• The system design parameters, for example, it might be all welded with no flanges or removable spool, or it may have a single isolation valve only.
• The effect on personnel and the surrounding area in the event of an isolation failure. Then choose the safest and most appropriate system of isolation.

5.3.1     Equipment, which because of its function or nature cannot be isolated in a normal manner, will be isolated according to a written specific isolation plan for that equipment and approved by site management or their designee. Examples of such requirements include, but are not limited to, equipment and isolations associated with high voltage electrical isolation and permit required confined space entry. The plan should include any additional precautions that are necessary such as:

• Ventilation
• Monitoring
• Personnel protection necessary
• Area barricaded
• Special tools, etc.

5.3.1.1 The equipment needs to be checked as being clean and free of flammable / toxic / asphyxiating / corrosive/ cryogenic /hot or other hazardous substances / dusts / fumes / or vapors before work can be authorized unless the hazard is otherwise controlled to a safe level.

5.3.1.2 Refer to the appropriate EH&S standard when developing specific isolation plans. Also refer to procedure 25-010550 Equipment / Line Opening and Clearing for additional precautions to avoid injury or acute exposure to personnel during the opening of process and/or utility equipment and lines for repairs, revisions or replacements after proper line preparation.

5.4       Lockout/Tagout Process

5.4.1    Preparation for Shutdown

• The person responsible for the equipment in conjunction with the Issuer of the Safety Work Permit must determine the energy source(s), by review of drawings, P&IDs, specifications, experience or other means, and by a physical inspection of the work site. This responsible person can then determine the valves to be closed or opened, the electrical switches to be opened, or other isolation methods required to provide a safe working environment.

Depending upon the complexity of the isolation required a more detailed Isolation Plan may be required to plan, document and approve the isolation strategy.

• All affected employees and/or contractors must be notified prior to the issuing of the Safety Work Permit.
• In order to clearly understand the work scope and related equipment isolations, the work area shall be jointly visited by the Permit Issuer and Permit Receiver to discuss the work to be done.
• All isolations and Danger Tags, including any locks, plugs, gagging pins, or blind flanges, etc., must be entered on the Isolation Register.
• Bypasses, in accordance with 01.05.24 Bypass Policy, must be tagged and entered on the Isolation Register.

5.4.2    Shutdown of Equipment/Energy Isolation

• Shutdown procedures must be used to avoid any additional or increased hazard to employees due to the de-energization process.
• All energy isolating devices that are needed to control energy must be physically located and operated to isolate the equipment from the energy source.

5.4.3    “LOCK—TAG—TRY” – Verification of Isolation

• A physical inspection of the work site must be made by the Company  designated employee (for example, Permit Issuer) and the exposed worker(s) to be sure that the isolating devices are installed and that isolation and de-energization has been accomplished.
• The equipment must be checked for proper isolation and de-energization through the use of “LOCK—TAG—TRY.”

1. Lock and Tag the equipment to isolate the energy source. The tag indicated in Appendix A must be used. Streamers such as ‘BLIND INSTALLED’ or ‘BLEED OPEN’ may be used for ease of identification. However they do not replace the need for locks and Danger Tags on the isolating device.

2. Then Try to start the equipment (for electrical isolations) or Try to find residual pressure or chemicals in the process by checking bleed valves or other sources.

Note: When ‘TRYing’, attention should be paid to the potential change in the status of interlock/trip devices. Ensure that equipment and personnel are clear prior to “TRYing” equipment before commencing work the field.

• If there is a possibility of re-accumulation of stored energy, verification of isolation shall be continued until the servicing or maintenance is completed, or until the possibility of such accumulation no longer exists.

5.5       Lockout Requirements

• Lockout procedures must also follow Safety Work Permit (25-010530) standard.
• When lockout is used, the lock must have a Danger Tag on it to identify the lock with the associated Safety Work Permit. The Danger Tag must be filled out as described in Section 5.6.
• Sites shall have systems in place to manage locking devices that are used for isolation purposes. This system shall ensure that one type/model of lock is used for one purpose and a distinct type/model is used for other purposes. All site personnel and contractors shall be aware of this system. Distinct locks should be used for the following:

1. • Permit locks.
   • Personal and group locks.
   • Other locks, for example, process, operational, or utility locks.

• Locks must be installed on equipment to lock out the energy source(s) as follows:

1. • Personal locks must always be installed by each person working on the energy source in addition to Permit locks. Group locks are allowed in place of personal locks per Section 5.10.6.
   • Lock boxes (See Section 5.10.5) may be used to manage the large amounts of Personal locks that may be required for large lockouts (such as those that may be required for a Master Permit).
   • Group locks may be used instead of Personal locks, unless prohibited by local/state/country legislation. Consult your regional health and safety support person for guidance regarding applicability to your location.

For example, Group locks may not be used instead of Personal locks in the state of Oregon. Under Oregon State Occupational Safety and Health regulations, each worker in a crew must individually apply padlocks to isolate equipment or systems.

• Safety lockout clips for multiple lock installations must be used for all electrical lockouts (or any other lockout with provision for only a single lock) to allow for installation of the Permit locks, Personal locks or Group locks.
• Lockout clips must be made of durable materials that cannot be broken or separated by hand. Steel is commonly used for lockout devices. Clips made of aluminum or plastic are easily bent and broken and their use is discouraged.
• Chains and cables used to lock valves must be made of substantial materials that cannot be removed without excessive force or unusual techniques. Metal chain or cable meets this requirement. Plastic chain does not.
• Unauthorized removal of a lock is an unsafe act and will result in disciplinary action.

5.6       Tagout Requirements – used with a lock

• If an energy isolating device used to isolate an energy source is capable of being locked out, it must be.
• Tagout procedures must also follow Safety Work Permit procedures as outlined in 25-010530, Safety Work Permits.
• Danger Tags (Appendix A – Form 2027 or local language equivalent) must be used for locking and danger tagging of equipment. These Danger Tags must be unique from other tags on site and not be used for any other purpose.
• To avoid confusion when marking the Danger Tags, the non-applicable portions of the Danger Tag must be completely blacked out rather than circling the applicable portions.
• The tear-off portion of the tag should stay with the Safety Work Permit or the Master Work Permit if this is used.
• The Permit Number must be added to the tags for easy identification in the field where multiple isolations may be used.
• The tear-off portions of the Danger Tags must be attached to the duplicate copy of the associated Safety Work Permit before work starts. The Safety Work Permit must not be issued until the locks and danger tags are in place.
• The permit issuer must ensure that equipment, systems, and/or areas are properly locked and tagged for the work to be done.
• All Danger Tags must be listed on the Safety Work Permit. If more space is required, a reference can be made to the Safety Work Permit Addendum on the work permit.
• After the valves, switches, etc. have been properly positioned, completed Danger Tags must be attached securely to the isolating device.

1. • Where more than one lock and Danger tag has been placed on the same valve, switch, etc., for coverage on two or more Safety Work Permits, care must be taken to remove the lock and Danger Tag numbered for the completed, signed-off, Safety Work Permit only.
   • If a lock and Danger tag is used to protect a group of workers, application and removal of the tag must follow the procedure for removing the lock and Danger Tag (refer to paragraph 5.10.6).

• Valves, switches, hand-jacks, bypasses, etc., must not be operated, nor the Danger Tag and lock removed, until the tear-off portion and the Danger Tag are reunited.

5.7       Tagout Requirements – used without a lock

• Tagout (without Lockout) may only be used in rare circumstances where it is not possible to apply a lock or locking device system to an energy isolation device.
• Where Danger Tags are used on energy isolating devices that are not designed with the capability of being locked, consideration must be given to installing the Danger Tag in such a manner as to provide some type of physical restraint on the device to prevent operation.
• Where Danger Tags cannot be affixed directly to the energy isolating device, the tag must be located as close as safely possible to the device so it will be immediately obvious to anyone attempting to operate the device.
• The use of tagout without lockout may be regulated by local, national or regional legislation and may only be used in compliance with the governing regulating authority.

5.8       Limitations of Danger Tags

• Danger Tags are essentially warning devices affixed to energy isolating devices, and do not provide the physical restraint that is provided by a lock. Danger tags can be mis-read and removed by mistake. Locks cannot be removed unless done so by the person who owns the lock. The use of locks is more error resistant.
• When a Danger Tag is attached to an energy isolating means, it must only be removed by person responsible for it, and it is never to be bypassed, ignored, or otherwise defeated.
• Danger Tags must be legible and understandable by all authorized employees, affected employees, and all other employees whose work operations are (or may be) in the area, in order to be effective.
• Danger Tags and their means of attachment must be made of materials which will withstand the environmental conditions encountered in the workplace and cannot be accidentally removed.
• Danger Tags may evoke a false sense of security, and their meaning needs to be understood as part of the overall energy control program.
• Danger Tags must be securely attached to energy isolating devices so that they cannot be accidentally detached during use. Plastic or nylon ties provide secure attachment; string does not and must not be used.
• Danger Tags must be properly removed during de-isolation to avoid out-of-date tags being left in place.

5.9       Lockout/Tagout Not Associated with Safety Work Permits

• There are times when it may be necessary to apply locks and/or tags for purposes other than Safety Work Permits. There may be equipment needing repair before operating, systems malfunction, notification required to prevent unauthorized operation of a process valve, special reasons for long period isolation, etc.
• Distinctly different locks and tags must be used for this purpose. Lockout/Tagout Danger Tags and locks are NOT to be used for this purpose. Lockout/Tagout Danger tags and locks must be unique and not used for any other purpose on site than Lockout/Tagout for energy isolation for maintenance, service and repair work.
• For these purposes, a uniquely different style lock and tag can be applied without a Safety Work Permit, providing a log of such locks and tags is maintained, see Appendix C for an example log.
• The tag must be filled out with a detailed explanation so the tag may be removed only after careful evaluation if the person responsible for attaching it is not on shift at the time.
• If there is any doubt about anyone other than the person who attached the lock and tag removing the lock and tag and safely operating associated equipment or systems, the site manager or designee and/or the person who attached the lock and tag must be contacted before it is removed.
• See 01.20.16 Policy For Administration of Captive Key and Lock Open Valve Systems for guidelines on the administration of Captive Key systems and locked open valves used in both safety critical and non-safety critical applications.

5.10     Managing Personal Locks and Permit Locks during Lockout/Tagout

5.10.1  General

There are two options available for managing personal* and permit locks during lock/tag/try operations:

1,   Each Permit Lock is backed up by a Personal Lock on each valve/equipment/electrical breaker

OR

2. Each piece of equipment is locked by a Permit Lock and the only key(s) to the Permit Locks are in a lock box which is in turn locked by Personal Locks (or Group Lock) of the person(s) doing the work AND locked by the Permit Issuer. *Group Locks are a substitute for multiple Personal Locks, but would be managed the same as an isolation requiring one Personal Lock, plus use of the Group Lockout Signoff form. See Section 5.10.6.

Key Control:

Under Option 1:

• An individual’s Personal Locks may be keyed alike or differently (or combination locks) as long as the keys are under sole control of the person applying them.
• Permit Locks may be keyed alike or differently as long as the keys are under the sole control of the Permit Issuer.
• Where sets of keyed-alike Permit Locks are used, each work permit would require a set of locks with a different, unique key from other work permits.
• Permit and Personal locks must be keyed differently.

Under Option 2:

• An individual’s Personal Locks applied to the lock box(es) may be keyed alike or differently (or combination locks) as long as the keys are under sole control of the person applying them.
• Permit Locks applied to equipment may be keyed alike or differently as long as:

o  the only key(s) to the Permit Locks are in the lock box; and

o  the lock box is locked by Personal Locks of the person(s) doing the work; and

o  either a Personal Lock of the Permit Issuer or another Permit Lock (keyed differently than any of the Permit Locks installed on the equipment) with the Permit Issuer having sole control of that lock is applied to the lock box.

• Where sets of keyed-alike Permit Locks are used, each work permit would require a set of locks with a different, unique key from other work permits.
• Permit and Personal locks must be keyed differently.

5.10.2  Permit Locks

• Multiple permits on the same equipment will require one Permit lock with a tag for each permit unless work is performed under a Master Work Permit (U.S. only).
• The Permit lock and danger tag should be the first lock and danger tag installed.
• The Permit lock and danger tag should be the last lock and danger tag removed prior to reactivation of the equipment.
• A Permit lock and danger tag must always be installed as part of the isolation by the Safety Work Permit issuer. A Permit lock is NOT a Group lock (see Section 5.10.6).
• The key for the Permit locks must be kept under the control of the person responsible for issuing the Safety Work Permit.
• Sites/locations staffed with only one person, for example, package plants, customer stations technicians may use either Personal locks or Permit locks. Both are not required when only one person is on site and this person is both the individual performing the work and issuing the Safety Work Permit.

5.10.3  Personal Locks

• Each person (Company employee or contractor) performing work on or servicing equipment must install a personal lock on the energy source or sources of that equipment unless Group lock procedures are used (See Section 5.10.6 below).
• Each lock must identify the person applying the lock by initials, name, or number as a Personal lock.
• Personal locks must not used for any other purpose. Combination locks are an acceptable alternative to keyed personal locks.

5.10.4  Removal of Personal Locks and Tags When Individual Is Not on Site

• Each individual must remove their personal locks at the end of each shift or if an individual is no longer working on the job. Replacement personnel on the next shift in which the job is worked must install their Personal lock before beginning work.
• In an emergency situation or when a worker forgets to remove a Personal lock and the worker cannot be located, the lock may be removed using the following steps:

1. • The supervisor in control of the job, such as a technician, must carefully review the circumstances and determine if the lock must be removed and it is safe to do so.
   • All reasonable methods to contact the person whose lock must be removed have failed.
   • If unable to contact the person whose lock must be removed, the job supervisor must contact site management (site or plant manager, assistant site manager, maintenance manager, or shift supervisor).
   • Site management must personally inspect the work area and job progress to ensure that no one is working on the equipment and that no one will be injured if the lock is removed and the equipment energized.
   • Once the site or plant manager is satisfied the equipment is safe, authorization may be made for the removal of the Personal lock.
   • As soon as possible, (but not later than when they report to the work location for the next work shift) the worker whose Personal lock was removed must be informed of the situation.

5.10.5  Lock Boxes

• Lock boxes may be used to manage the large amounts of Personal locks that may be required for large lockouts (such as those that may be required for a Master Permit).
• When using a Lock box, the key(s) to the locks (either Permit locks or work crew leader’s Personal lock method is allowable) attached to the energy isolating devices are locked into a box that is in turn locked with each individual’s Personal lock that is working under the Safety Work Permit.
• This method of lockout management prevents the removal of Permit locks or work crew leader’s Personal locks from energy isolation devices until all Personal locks have been removed from the Lock box.
• Since the use of Lock boxes still provides for individual Personal locks to be used in the energy isolation, the use of a Lock box provides a greater level of energy isolation control than Group locks and its use should be considered before using Group locks.
• The number of the Lock box used in conjunction with a particular Safety Work Permit must be written on the Safety Work Permit.

5.10.6  Group Locks

• The management of large jobs entailing many Personal locks and multiple shifts may become complicated due to the removal and replacement of numerous Personal locks at each shift change. In such situations, Group locks may be used instead of Personal locks. A minimum of two people may utilize a group lock. Group locks may also be used in conjunction with lock boxes.
• Group Locks may be used only if the owner of the Group Lock inspects the equipment to ensure that isolation device lockout protection is in effect when the permit is issued and whenever the permit is modified. They must also sign on and off the Group Lockout Signatures Form (Appendix D) at the beginning and end of each shift.
• Each person involved in the work and who will be working under the Group lock must also sign on and off the Group Lockout Signatures Form at the beginning and end of each shift.
• The Safety Work Permit Group Lockout Signatures Form (Appendix D) must be available at the work site with the work permit.
• The individual whose lock is placed on the energy isolating device to protect a group must verify that each individual protected by the group lock understands and agrees that they must sign on and off the Group Lockout Signatures Form whenever they are working on the equipment. The individual applying the Group Lock is personally accountable for ensuring the performance of each protected individual in meeting this requirement.
• The individual whose lock is placed on the energy isolating device to protect a group must verify that all energy sources have been eliminated or secured and apply their Personal Lock as the Group Lock or locks. The owner of the Group Lock must be the first individual to sign on the form and the last to sign-off the form. This individual must also verify that everyone in the group has signed the group lockout signature form. The individual responsible for applying the group lock must verify that all workers covered by the group lock, listed on the signature form, have personally signed off the job and there are no individuals working on the equipment prior to releasing the equipment for operation. In the event a person does not sign off and is not available to do so, then the requirements in Section 5.10.4 “Removal of another person’s lock or tag” applies.
• The group lockout leader must remove the Group lock at shift change and the oncoming shift group leader must apply a Group lock to protect the next shift.

5.11     Release from Lockout/Tagout

• After the work is complete, the person responsible for the Lockout/Tagout must verify that nonessential items have been removed from the work area, the equipment is operationally intact, and that no personnel are exposed to hazards before the locks and tags are removed.
• All affected employees must be notified before the removal of lockout/tagout devices.
• When the work has been completed and all workers are clear of the equipment and have been notified, the Safety Work Permit must be returned to the person responsible for issuing the Safety Work Permits. When the tear-off portions of the Danger Tags (attached to the duplicate copy of the Safety Work Permit) have been reunited with the upper portion of the Danger Tags, the Danger Tags may be removed and the system activated.
• After work is completed, the person in charge must verify the following before the last lock and Danger Tag is removed:

1. 3. All personnel are properly informed of the work completion and all personnel locks and danger tags are removed.
   4. All personnel are accounted for.
   5. All personnel are clear of the equipment.

The Isolation register may be used for this verification.

5.12    Restoration of Energy

5.12.1 Full Restoration

• When the Safety Work Permit (25-010530) has been signed off by all groups who have done work the permit has to be accepted and signed by the authorized person as per the requirements of Safety Work Permit procedure.
• All persons involved in carrying out the specified work must be accounted for and be aware they are no longer authorized for work on the equipment involved.
• A visual check must be made to ensure that no hazardous conditions will result in re- energizing of the system.
• Complete the Safety Work Permit regarding worksite inspection, isolation device removal, and recordkeeping.

5.12.2  Temporary Restoration

• Temporary restorations of energy for the purpose of system function checking must be authorized by the Safety Work Permit Issuer.
• All persons involved in carrying out the specified work are accounted for and are aware that they are no longer authorized for work on equipment involved.
• A visual check is made to ensure that no hazardous conditions will result from energizing the system.
• If isolation is to be re-established, then the responsible person must follow all the requirements of Energy Isolation and Lockout/Tagout/Try and Safety Work Permit procedures.

5.13     Continuance of a System Isolation that had a Temporary Delay in Work Scope

• Complete isolation and lockout/tagout Safety Work Permits must be fully reviewed and updated as needed before any work can continue.
• Check all system isolations to ensure no temporary system re-establishment or bypass was implemented.
• Any “Jumpers” or Bypasses applied to electrical or other systems must be done in accordance with procedures outlined in 01.05.24, Bypass Policy.

5.14     Isolation of Specific Types of Energy

5.14.1  Pressurized Systems

• Following the application of lockout/tagout devices to isolating devices, all stored or residual energy must be relieved, disconnected, restrained, or otherwise made safe. If there is a danger that stored energy will re-accumulate to a hazardous level, continue to verify isolation (for example, vacuum decay, pressure rise, bubble test, hazardous gas analysis, or equivalent test) until the servicing or maintenance is completed, or until the possibility of such accumulation no longer exists.
• Before starting work on a machine or equipment, verification must be completed by the TRY step that the isolation and de-energization of the machine or equipment has been effective.
• Final safety steps must be taken during the actual opening or disassembly of the line or vessel. If, for example, a flange or valve bonnet is to be removed, all the bolts should be loosened and the flange split with a wedge in case the gasket is holding the unit together. If a fitting is to be removed, it should be unscrewed several turns and then wiggled to check on depressurization and to possibly relieve any residual pressure. A minimum number of personnel, and only those directly involved in the work, shall be in the vicinity. (Workers should assess the potential for contact and take the appropriate defensive position as well as don the proper protective equipment.)
• The isolated equipment, process, etc., must be clear of residual or stored pressure.

5.14.2      Electrical Supply Isolation

5.14.2.1   Procedure for Electrical Isolation

An isolation shall only be carried out when the competent person responsible for the isolation has verified the following:

1. • That a Safety Work Permit has been prepared giving sufficient description of the work to be done. (unless not required as per Safety Work Permit, 25-010530, Appendix A).
   • That the equipment tag number and description on the Safety Work Permit is correct.
   • The isolation is by physical disconnect or power supply disconnect switch (lockout of control circuits such as On/Off switches or Start/Stop switches is not an acceptable power energy isolation).
   • That the equipment is shutdown and its controls are in the “OFF” position.
   • That no one is already working on the equipment.

Note: Lockout/tagout is not required when working on cord and plug connected electric equipment for which exposure to the hazards of unexpected energization or start up of the equipment is controlled by the unplugging of the equipment from the energy source and by the plug being under the exclusive control of the employee performing the servicing or maintenance.

5.14.2.2   Low-Voltage Isolation

• Isolation of Low-Voltage Supplies must be carried out by authorized persons.
• If the work to be carried out is of a mechanical nature then lockable isolators, breakers, or switches shall be locked in the “OFF” or de-energized position. For installations where lockable devices are not provided, another method may be used, if approved by the appropriate electrical engineering support group. Always ensure that the circuit is isolated from all sources of supply.
• Attempt to start (Try) the equipment as a check that the correct equipment has been isolated.
• If the work to be carried out is of an electrical nature, that is, on electrical equipment connections, then the feeder circuit breakers or fused disconnects must be de-energized and locked out. Any local switch shall be in the “off” position. Where circuit breakers or fused disconnects are not available, then alternative methods of creating physical circuit breaks must be carried out, for example, removing links, withdrawing starter, etc.
• Prove the circuit is de-energized by using an approved type of voltage indicator which shall itself be tested in an approved manner immediately prior to and immediately following its use. Always ensure you are wearing the appropriate PPE as identified in the task tables located Appendix 1 of procedure 01.05.20 Electrical Safe Work Practices.
• A danger tag and lock is to be prominently displayed at all points of isolation in accordance with lockout/tagout procedures.
• Complete the isolation register associated with the Safety Work Permit, stating specifically the action taken to isolate the equipment, and giving the time and date.

5.14.2.3   High-Voltage Isolation

If the work to be carried out is of an electrical nature, that is, on electrical equipment connections, high-voltage electrical isolation and permitting must follow procedures described in the Electrical Safe Work Practices – Technical Level For Q – EL/Fully Authorized Personnel 01.05.46.

5.14.3      Machinery Isolation

• In general, hydraulic, pneumatic, and steam powered machinery or valves, etc., should be initially isolated at hydraulic, pneumatic, or steam system valves, and then the supply and return pipes disconnected or otherwise made safe to prevent any possibility of movement of the machinery.
• Engine-driven machinery should be isolated by shutting off the engine fuel supply and then by isolating and locking out all starting systems.
• Where machinery power systems have been disconnected or engines prevented from starting, but there is still a foreseeable risk to people working on the machinery because it may move, a device such as a properly-engineered chock should be fitted to lock the machinery in a safe static position.

5.14.3.1   Steam Driven Machinery

Relative to the steam driver. Ensure that:

• The machinery valve is isolated (including seal steam), machinery and associated piping is depressurized and vented to prevent vacuum forming as the machinery cools.
• Drain any residual hot condensate, (That may flash to steam as pressure is released).
• Steam supply lines to be blinded (Drive and seal steam).
• Physically “chock” the machinery shaft, to prevent rotation.
• Ensure that “barring gear” is disengaged and energy isolated.
• Ensure that lube oil, jacking oil and seal oil systems are shut down and energy isolated.

5.14.4      Cryogenic Equipment Enclosures

• Entry into cryogenic enclosures to conduct maintenance or repair presents many hazards that require either preparation of the process equipment inside the enclosure, such as warming, defrosting, purging, breaking to air, as well as pressure circuit isolation to prevent migration of hazardous material into work area. In each cryogenic enclosure work activity, there may also be problems with preparing the process equipment for the work based on its age, physical condition, and risk of damage from warming or introduction of ambient ( wet) air if the process is opened up or warmed. Therefore, each enclosure entry must be addressed for its special condition and the preparation of the unit and the isolation steps must be considered by experts familiar with cryogenic plant problems.
• Prior to allowing permit required confined space entry into cryogenic equipment enclosures owned and operated by Global Operations, the written isolation plan of the equipment is to be reviewed by a technical team composed of the Company Cryogenics Team Plant Process Engineer  (PPE) and the GSS Pressure Vessels Engineer (PV) . This technical team review is required to ensure that proper isolation is developed and applied for the special problems and circumstances that may be encountered for the specific cryogenic operations at site. At least one of the technical team members should be at the job site to be able to examine the enclosure conditions and isolation systems, be able to communicate with their counterpart and relate site specific observations that may impact the decision around systems isolation and enclosure preparation.
• The written isolation plan must be incorporated into the Confined Space Entry Permit and Written Entry Plan and approved by the Entry Supervisor per 25-010533 Permit-Required Confined Space Entry.

5.15     Training

5.15.1  All employees and contractors involved shall receive appropriate training and retraining in the Energy Isolation and Lockout/Tagout procedures and Safety Work Permit System and shall be assessed to verify their competence against the standards. The training content and frequency is defined in the Training Requirements, Volume 2. Training records must be maintained.

5.16     Assessment

5.16.1  Site Managers are to ensure that local systems are in place to assess the ongoing compliance and effectiveness of this procedure as part of Basic Safety Process (BSP) critical systems audit and a documented assessment annually. (This is likely to be best achieved by reviewing regular samples of Safety Work Permits from both filed and current Safety Work Permits and Isolation Registers to detect breakdown, noncompliance, or lack of understanding). Refer to Appendix B.

6. RELATED INFORMATION

6.1       Company  EH&S Documents

25-010501        Job Safety Analysis (JSA)/Workplace Risk Assessment

01.05.20           Electrical Safe Work Practices

01.05.24           Bypass Policy

25-010530        Safety Work Permit

25-010533        Permit-Required Confined Space Entry

01.05.46           Electrical Safe Work Practices – Technical Level For Q – EL/Fully Authorized Personnel

25-010550        Equipment / Line Opening and Clearing

01.20.16           Policy For Administration of Captive Key and Lock Open Valve Systems

6.2       Company  Engineering Document

	28-2S807	Hazardous Process System Mechanical Isolation
6.3	Others
	Appendix A Appendix B Appendix C Appendix D	Danger Tags (Form 2027 in the US) Periodic Energy Control Procedures Inspection procedures and form Register for operational tags not associated with a SWP Safety Work Permit Group Lockout Signatures (US Form 2026-3)

Appendix A

Typical Danger Tags (Local language equivalents are acceptable*)

This tag may be used ONLY for Energy Isolation – Lockout / Tagout purposes as described in this standard.

Appendix B – Periodic Inspection of Energy Control Procedures

FREQUENCY OF INSPECTIONS

Periodic inspections of “energy control procedures” assessment (Lock Out/Tag Out and Safety Work Permits) must be conducted annually and documented to ensure that correct procedures are being followed.

SELECTION OF INDIVIDUALS TO PERFORM INSPECTIONS

• Inspections must be conducted by an individual trained and authorized to perform lock out/tag out.
• Inspections must be performed during a Lock Out/Tag Out procedure by a separate individual, not involved in the Lock Out/Tag Out work being performed.
• Operations staffed with a single individual, e.g. Gen Gas plants, Customer Stations, are required to perform a periodic energy control procedure inspection using the best available options and resources (i.e., coordinate inspections with Line Manager or other authorized individual).

DETERMINATIONS MADE DURING INSPECTIONS

• Lock Out/Tag Out inspections must be conducted during an active lock out/tag out activity. It is not acceptable to go back and perform inspections on previously conducted activities or closed Safety Work Permits.
• The individual performing the inspection must determine the following:

1. • Are all Lock Out/Tag Out and Safety Work Permit procedures being followed by site personnel and contractors?
   • Do all the individuals at the site involved in the Lock Out/Tag Out and Safety Work Permit understand their responsibilities under the Lock Out/Tag Out and Safety Work Permits procedures?
   • Where tag out is used instead of lock out, do the employees understand the limitations of Danger Tags when used without locks as described in 25-010532, Energy Isolation and Lockout/Tagout/Try, Section 5.8.
   • Where tagout is used instead of lockout, was it not feasible to lockout isolation devices?
   • Are the Lock Out/Tag Out and Safety Work Permits procedures adequate to provide the necessary protection?

• The Lock Out/Tag Out inspector must observe and talk with the employees (and any contract employees) in order to make these determinations. This may be accomplished with one-on-one discussions or in a group discussion with the entire crew covered by the procedure under observation.

DOCUMENTATION AND FILING OF INSPECTIONS

• The individual performing the inspection must document and file the inspection including the machine or equipment involved, the inspection date, the individuals included in the work under inspection, and the name of the inspector. The attached checklist may be used for this purpose.
• Inspection documentation (including a copy of the Safety Work Permit) must be retained on file for at least one year.

NEED FOR RETRAINING

If the annual Energy Control Procedure Inspection reveals inadequacies in the employee’s knowledge or use of the Safety Work Permit or Lock Out/Tag Out procedures, retraining must be conducted and documented.

Periodic Energy Control Procedures Inspection Form

This inspection/assessment is not valid unless you checked a Lockout/Tagout task that was in progress and you
discussed the relevant items with the individual(s) performing the task in order to verify their understanding of and
ability to execute the requirements. Did you meet these requirements?

1. Lock Out/Tag Out

   1. Preparation for shutdown
      • What was done to prepare equipment for shutdown?
      • This was accomplished by whom?
   2. Shutdown
      Was the shutdown orderly and no personnel were exposed to hazards?
   3. Isolation
      What types of energy sources were locked and/or tagged out? (electrical, mechanical, chemical, etc.)
      Were Personal Locks applied as well as Permit Locks?
      Were Danger Tags appropriately filled out and attached to energy sources?
      Were Locks unique and standardized?
      Were employees aware of the limitations of Danger Tags?
   4. If Tagout alone is used, is Lockout confirmed to be not feasible?
   5. Relief of stored energy
      Was isolation of energy source and relief of stored energy verified?
      How?
      If control valves are used for isolation, has the following been verified:
      • The valve is rated for full closure isolation
      • The valve is designed to fail closed or “in position” (as first choice) or
      • The valve is physically secured in the isolation position (as second choice)
      • The valve stem is inspected to verify the valve closes completely. If the valve has a minimum stop, then the physical valve stop must be removed, and the valve stem must be re-inspected to verify the valve is closed completely.
      • The operating source (air, power, etc.) is physically disconnected from the actuator and connection points are locked against reconnecting the operating source (For Example A barrier such as a lockable plug or wrap around the valve actuator operating power connection is applied and locked /tagged to prevent re connection of the air supply
        to the valve actuator.)
   6. Release from Lock Out/Tag Out
      Prior to lock and Danger Tag removal was a visual check of the area made?
      By whom?
      Were all affected employees informed?
      Were all employees aware of their responsibilities regarding the
      Lock Out/Tag Out procedures?
2. Safety Work Permits
   • Was the Safety Work Permit completed and all applicable sections filled in?
   • Was an adequate review of potential hazards conducted and appropriate safeguards implemented?
   • Were all applicable attachments used? (e.g., Atmosphere and Hot Work monitoring log, Excavation/Underground Work Authorization)

 

Periodic Energy Control Procedures Inspection Form