Lockout and hazardous energy

In her second week Tamsin went with Ray to the Marlowe Apartments on Route 7 to change a worn pump motor coupling on the hydraulic power unit. Before Ray touched the unit, he spent twenty minutes on something that looked to Tamsin like doing nothing: he ran the car down onto its buffers, opened and locked the mainline disconnect, tested it, closed the oil line shut-off valve, relieved the pressure in the valve body, checked the gauge and wrote each step on the lockout sheet. Then the coupling took fifteen minutes. "The twenty minutes is the job," he said. "The coupling is the easy part." This lesson explains what hazardous energy is on elevating devices, how lockout controls it, and what to do when the work needs the car to move.

What hazardous energy is

Hazardous energy is any energy that can cause injury if it is released unexpectedly while someone is working on a machine. On elevating devices, it comes in more forms than on most machines, and some of it remains after the main power switch is off.

The key idea is that switching off the power does not make an elevator safe. A traction car with its brake held open by hand will move under the out-of-balance weight from Lesson 3. A hydraulic car with its power off is still held up by oil, and opening a fitting will let it fall. A drive that has been switched off can still hold a lethal charge in its capacitors. The car light and fan are often fed from a separate disconnect so that passengers are not left in the dark, which means a mechanic who opens only the mainline disconnect may still meet live wires in the car operating panel.

The rules

In British Columbia, the requirements for controlling hazardous energy are in Part 10 of the Occupational Health and Safety Regulation, which WorkSafeBC enforces. They require that machinery or equipment be locked out when its unexpected energization, start-up or release of energy could cause injury, that each worker doing the work apply a personal lock, and that the employer have written procedures. CSA Z460, Control of hazardous energy: lockout and other methods, gives the detail of a good program, including when other methods may be used in place of lockout. Northcrest's written lockout procedures for each type of equipment are based on both.

Elevator work raises a problem that most lockout programs do not: much of the work needs the car to move. A mechanic cannot adjust a door operator, check a landing switch or inspect ropes with the mainline locked off. The rules allow for this when the work is done under alternative measures that give effective protection, and in the elevator trade those measures are the stop switches, inspection operation and the procedures in Lesson 8. The decision is made at the JHA, step by step: for each step, does the car need to move? If not, lock it out. If so, control its movement with the protective devices built for that purpose, and lock out everything that does not need to be live.

The lockout sequence

Northcrest's lockout procedure has eight steps. They are the same on a traction elevator, a hydraulic elevator and an escalator, although the details of steps 3 to 6 differ.

• 1. Prepare. Identify every energy source for the unit and the work, using the procedure for that equipment, the wiring diagrams and a walk-through. Gather locks, tags, hasps and a tested voltage tester.
• 2. Notify. Tell the building contact and anyone affected that the unit will be out of service, and put out-of-service signs and barricades at every landing.
• 3. Shut down. Bring the car to the position the work needs, using normal controls: often the lowest landing with the car on or near its buffers, or a floor that gives safe access to the machine.
• 4. Isolate. Open the mainline disconnect and any other disconnects: car lights and fan, door operator supply if separate, battery units, emergency power transfer. On a hydraulic unit, close the shut-off valve in the oil line.
• 5. Lock and tag. Each worker places a personal lock on each isolating device, with a tag giving their name, the date and the reason. A hasp lets several workers lock the same device. Each worker keeps their own key.
• 6. Release or restrain stored energy. Land the car or block it; support the counterweight if the work affects it; relieve hydraulic pressure; wait for capacitors to discharge; restrain springs.
• 7. Verify. Try to start the unit with the normal controls, check that nothing moves, then return the controls to off. Test for the absence of voltage at the point of work with a tester checked on a known live source before and after.
• 8. Work, then restore. When the work is complete, remove tools and material, replace guards, tell everyone the unit is about to be re-energized, then each worker removes their own lock. Test the unit before returning it to service.

Two parts of the sequence are skipped more often than the others: step 6 and step 7. Mechanics who have opened a disconnect hundreds of times sometimes stop there, and both the stored energy and the possibility of a wrong disconnect remain. Northcrest's rule is that the lockout is not complete until it is verified, and the verification is written on the lockout sheet.

# Lockout checklist: the steps must be done in order and none may be skipped
steps = ["prepare", "notify", "shut down", "isolate", "lock and tag",
         "release stored energy", "verify", "work and restore"]

def check(done):
    for i, step in enumerate(steps):
        if i >= len(done):
            return f"incomplete: next step is '{step}'"
        if done[i] != step:
            return f"out of order or skipped: expected '{step}' but found '{done[i]}'"
    return "complete and in order"

record_ok = steps[:]
record_bad = ["prepare", "notify", "shut down", "isolate", "lock and tag", "verify", "work and restore"]
record_part = ["prepare", "notify", "shut down", "isolate", "lock and tag"]
for name, rec in (("Marlowe pump coupling", record_ok), ("draft A", record_bad), ("draft B", record_part)):
    print(f"{name}: {check(rec)}")

Marlowe pump coupling: complete and in order
draft A: out of order or skipped: expected 'release stored energy' but found 'verify'
draft B: incomplete: next step is 'release stored energy'

Gravity: the energy that is always there

Gravity cannot be switched off. On a traction elevator, the car and counterweight are kept in place by the brake, and the brake is only as good as its adjustment and condition. Work that affects the brake, the machine, the drive sheave or the suspension ropes can release the car or counterweight, so the code of practice in the industry is to land or block them first. Typical methods are to land the counterweight on its buffer (which puts the car near the top of the hoistway), to support the car on blocking or with rope clamps applied by a trained mechanic, or to support the counterweight with a block in the pit. Which method is used depends on the work and is set in the procedure, not decided on the day.

The amount of energy involved is large. A counterweight of a few tonnes, high in the hoistway, has as much potential energy as a car dropped several storeys. That energy is released the moment the brake opens or a rope is cut.

# Stored energy in a raised counterweight, and the force the brake must hold
g = 9.81
cwt = 2220                  # counterweight mass, kg
car = 1500                  # empty car mass, kg
h = 60                      # height of the counterweight above its buffer, m
E = cwt * g * h
imbalance = cwt - car       # empty car, counterweight side heavier
print(f"counterweight potential energy: {E / 1000:,.0f} kJ")
print(f"out-of-balance force on the sheave, empty car: {imbalance * g / 1000:.1f} kN")
print(f"equivalent to dropping a {imbalance:,.0f} kg mass from {h} m: {imbalance * g * h / 1000:,.0f} kJ")

counterweight potential energy: 1,307 kJ
out-of-balance force on the sheave, empty car: 7.1 kN
equivalent to dropping a 720 kg mass from 60 m: 424 kJ

Tamsin's reaction to the output was that 1,300 kJ meant little to her. Ray translated: it is roughly the energy of a small car hitting a wall at highway speed. The out-of-balance force of about 7 kN is what the brake holds on an empty car at rest, and it is what moves the car if the brake is lifted by hand. Mechanics who must lift a brake by hand, for example to move a car during a rescue, do so only under a written procedure, with the car's movement controlled and with nobody in the hoistway.

Hydraulic units

On a hydraulic elevator, the car is held up by oil trapped in the cylinder by the valves. The stored energy is the car's weight times its height above the buffers, and it is released by opening any part of the oil system between the cylinder and the valves. The lockout procedure for hydraulic work therefore has extra steps: lower the car onto its buffers, or onto a block or pipe stand sized for the load if the work needs the car above the pit, so that the oil pressure falls to near zero; close the manual shut-off valve in the oil line; open the mainline disconnect and lock it; then relieve the pressure trapped in the valve body by the method the valve maker specifies and confirm on the gauge that it reads zero. Only then are fittings or valves opened. Lesson 12 works through the full hydraulic lockout at Holloway Memorial Hospital.

Hot oil adds a thermal hazard. A busy hydraulic elevator can run its oil at 50 °C (120 °F) or more, and oil sprayed from a fitting under pressure can burn and can be injected through the skin, which is a medical emergency even when the wound looks small.

Group lockout and shift changes

When several workers work on the same unit, each one applies a personal lock to every isolating device, or the crew uses a group lockout box: the person in charge locks out the equipment, places the keys in a box, and each worker places a personal lock on the box. Nobody's lock is removed by anyone else except under a strict procedure that confirms the worker has left the site and is safe, and that is recorded. At a shift change, the incoming crew applies its locks before the outgoing crew removes theirs, so that the equipment is never left without a lock.

At Quayside, where several crews work on different cars in the same group, Lena uses a lockout board at the base of the hoistways that shows every car's status, who has a lock on it and why. It looks bureaucratic. It also means that nobody returns a car to service while someone else is working in its pit.

Tags, signs and what they are not

A tag tells people who locked the equipment and why. It does not, on its own, stop anyone from closing a switch, which is why the rules require a lock wherever a device can be locked. Tag-only systems are allowed only in narrow situations where a lock cannot be applied, and they must give equivalent protection. Out-of-service signs at the landings tell the public and building staff that the unit is not available. They are not lockout either; they prevent confusion, not energization.