Group lockout, shift changes and contractors

Individual lockout is straightforward: one person, one set of locks, one key. Many real jobs are not like that. A plant shutdown may involve dozens of millwrights, electricians, pipefitters and contractors working on the same production line for days, across several shifts, with hundreds of isolation points. The basic principle does not change: every person exposed must have personal control over the energy. But the method must scale. This lesson covers group lockout, transferring lockout at shift changes, and working with contractors.

The principle of group lockout

In a group lockout, one person, often called the person in charge, the primary authorized person or the lockout coordinator, takes responsibility for isolating and locking the energy sources and verifying the zero energy state. Every other worker then places their own personal lock in a way that prevents the isolation from being undone until they remove it. No one relies on someone else's lock to protect them.

OSHA's 1910.147(f)(3) requires group lockout to provide each authorized employee a level of protection equal to a personal lockout device. Primary responsibility is vested in one authorized employee for a set number of employees working under the protection of a group lockout device such as an operations lock; that person must determine the exposure status of each member; where more than one crew or craft is involved, overall coordination is assigned to one authorized employee; and each authorized employee must affix a personal lockout device to the group lockout device, group lockbox or comparable mechanism when they begin work and remove it when they stop.

How a group lock box works

The most common method uses a group lock box:

• the person in charge isolates each energy source and applies a lock from a set of group locks (often called job or system locks) to each isolating device, with a tag;
• the person in charge controls stored energy and verifies the zero energy state, often with a member of the crew witnessing;
• the keys to all the job locks go into the lock box, which is closed;
• the person in charge puts their personal lock on the box;
• each worker who will be exposed checks the lockout and verification record, may verify for themselves where the procedure allows, and puts their personal lock on the box before starting work;
• no one can get the keys to the job locks until every personal lock has been removed from the box.

The box itself is a substantial steel box with many lock positions. Some boxes have a window so the keys can be seen. A list of the isolation points and their locks, the verification record, and a list of the workers who have locked on are usually kept with the box.

Large and complex jobs

On big shutdowns, several crews may work on different parts of a system at once. Two common arrangements are:

• a single master lock box for the whole job, with each crew leader locking on, and each crew member locking a crew box that holds the crew leader's key (a cascading or daisy-chained arrangement);
• separate group lockouts for separate sections of the system, carefully defined so that the boundaries do not overlap.

In both cases one person coordinates the overall lockout, keeps the master isolation list, and controls any changes. Adding or removing isolation points during the job must be done under that person's control, with the list updated.

Verification in a group lockout

A group lockout depends on the person in charge doing the isolation and verification correctly, so good programs build in checks. A second authorized person may witness or repeat the verification. Each worker may be given the opportunity, or required, to verify before locking on, for example by trying the start controls with the person in charge or checking the gauges. Workers who join a job later must be briefed on what is isolated and must see the verification record before they lock on. If a worker is not satisfied, they do not lock on and start work until their concerns are resolved.

Shift changes

Many jobs last longer than one shift. The lockout must continue without any gap in protection when the off-going crew leaves and the oncoming crew arrives. The basic rule is that the oncoming worker's lock goes on before the off-going worker's lock comes off. A typical procedure:

• the off-going person in charge briefs the oncoming person in charge on the job, the isolation points, the verification and any changes;
• the oncoming person in charge reviews the isolation list and, where the procedure calls for it, re-verifies the zero energy state;
• the oncoming person in charge and crew apply their personal locks to the group box;
• only then do the off-going workers remove their personal locks;
• the transfer is recorded with names and times.

OSHA's 1910.147(f)(4) requires specific procedures during shift or personnel changes to ensure the continuity of lockout or tagout protection, including provision for the orderly transfer of devices between off-going and oncoming employees, to minimize exposure to hazards from unexpected energization or release of stored energy.

Contractors and outside workers

Contractors are a frequent source of confusion. The host employer knows the equipment and its procedures; the contractor brings its own workers, locks and possibly its own program. Before work starts, the two must agree how hazardous energy will be controlled. Good practice includes:

• exchanging information about each other's energy control programs and deciding which one applies, or how they fit together;
• making sure contractor workers understand the host's procedures, restrictions and lock removal rules;
• making sure host employees understand the contractor's procedures where those apply;
• identifying contractor locks clearly, for example by a different color or the company name on the tag;
• including contractors in group lockouts by having them lock on to the group box like everyone else;
• agreeing in advance what happens if a contractor's lock is left on.

OSHA's 1910.147(f)(2) requires the on-site employer and the outside employer to inform each other of their respective lockout or tagout procedures, and requires the on-site employer to ensure that its employees understand and comply with the restrictions and prohibitions of the outside employer's program. On multi-employer worksites, OSHA's multi-employer citation policy can hold several employers responsible.

Common failures in group work

Investigations of group lockout incidents point to a few recurring problems:

• someone works under another person's lock without locking on themselves, usually because they were only going to be there a minute;
• a worker removes their personal lock and leaves, and later returns to the job without locking on again;
• an isolation point is added or removed during the job without updating the list;
• the person in charge changes and the new person does not re-verify;
• contractors are not told about the group lock box and use their own locks on some points only.

Each of these is prevented by the simple rule at the center of the system: if you are exposed, your lock is on.

Records for group lockouts

A group lockout generates records that help everyone. A typical record lists the job, the person in charge, each isolation point with its job lock number, the verification performed and by whom, every worker who locked on and off with times, shift transfers, and any changes to the isolation list. On large shutdowns, the coordinator may use an isolation register or electronic system that tracks hundreds of points. These records let anyone joining the job see exactly what is isolated, and they make it possible to confirm at the end that every lock has been removed and every point restored in the right order.

Group lockout also needs clear communication with operations. The control room or production supervisor should know which equipment is under group lockout, who the person in charge is and when the job is expected to finish, so that no one attempts to start connected equipment that could affect the isolated system.