Isolation planning II: certificates, group lockout, verification and overrides

Once the isolation standard tells the planner what level each point needs, the plan has to become something that can be applied, locked, checked and later removed without error. HSE-210 explained lockout devices, group lockout and verification for machinery, and HSE-221 described the entries on an isolation certificate and how certificates link to permits. This lesson applies those tools to process plants and field sites: finding every isolation point, locking valves and actuated equipment, managing group lockout across several contractors, proving that a process isolation works, controlling safety system overrides and keeping long-term isolations under control.

Finding every isolation point

The most dangerous isolation error is the point nobody listed. The CER's 2022 advisory described gas flowing back into a compressor because key isolation points were missed. Missed points usually come from three sources: out-of-date drawings, connections that are hard to see in the field such as instrument lines and utility hookups, and paths that run backwards, for example through a common drain or vent header, a relief header or a bypass. A systematic way to find them is to start at the equipment to be worked on and trace outward along every connection until each path reaches an isolation device, noting any path that reaches a live source without passing one.

The program below does exactly that on a small, invented piping network around the Kettle Creek inlet scrubber. Each line is a connection between two items, and each block valve is marked. Starting from the scrubber, the program follows every connection, stops at block valves (which become isolation points), and reports any live source it can reach without crossing a valve.

# Trace from equipment to find every isolation point (invented network around a scrubber).
from collections import deque
edges = [  # (a, b) connections
    ("scrubber", "V1"), ("V1", "inlet header"),                  # process inlet
    ("scrubber", "V2"), ("V2", "compressor suction"),            # process outlet
    ("scrubber", "V3"), ("V3", "closed drain header"),           # liquid drain
    ("scrubber", "PSV"), ("PSV", "flare header"),                # relief path, no block valve
    ("scrubber", "LT tap"), ("LT tap", "V4"), ("V4", "level transmitter"),
    ("scrubber", "N2 hose conn"), ("N2 hose conn", "nitrogen utility"),  # no valve fitted
]
VALVES = {"V1", "V2", "V3", "V4"}
SOURCES = {"inlet header", "compressor suction", "closed drain header", "flare header", "nitrogen utility"}

graph = {}
for a, b in edges:
    graph.setdefault(a, set()).add(b)
    graph.setdefault(b, set()).add(a)

seen, queue, isolation_points, open_paths = {"scrubber"}, deque([("scrubber", ["scrubber"])]), set(), []
while queue:
    node, path = queue.popleft()
    for nxt in sorted(graph[node]):
        if nxt in seen:
            continue
        seen.add(nxt)
        if nxt in VALVES:
            isolation_points.add(nxt)          # stop here: this valve isolates the path
            continue
        if nxt in SOURCES:
            open_paths.append(path + [nxt])     # reached a live source with no valve
            continue
        queue.append((nxt, path + [nxt]))

print("Isolation points found:", ", ".join(sorted(isolation_points)))
for p in open_paths:
    print("No valve on path:", " -> ".join(p))

Isolation points found: V1, V2, V3, V4
No valve on path: scrubber -> N2 hose conn -> nitrogen utility
No valve on path: scrubber -> PSV -> flare header

The program finds the four block valves, but it also reports two paths with no valve at all: the relief path through the pressure safety valve to the flare header, and the nitrogen hose connection to the nitrogen utility. Both need action. The flare header can back-flow gas into an opened scrubber, so the relief path needs a blind or the flare header must be confirmed at safe conditions under the standard; and the nitrogen hose must be physically disconnected and capped. Real plants are far larger than this toy network, but the logic of tracing every path to an isolation device is the same, and some electronic isolation systems do it automatically from the plant model.

Locking valves and actuated equipment

Process valves are locked with chains and padlocks through the handwheel, with lockout covers that enclose the handle, or with purpose-made valve lockout devices. The lock must actually prevent the valve from being moved; a chain loose enough to let the wheel turn is not a lockout. Car seals, which are numbered breakable seals used to show that a valve has been left in a required position such as open under a relief valve, are not personal locks. They manage valve positions for process safety but do not protect a worker, and they should never be confused with lockout.

Actuated valves need special care. An air-operated or hydraulic valve can be moved by its actuator even when its handwheel is locked, if the actuator overpowers the lock or there is no manual override. The isolation plan should close the valve, isolate and bleed the air or hydraulic supply to the actuator, lock the supply isolation, and where possible fit a mechanical lock to the valve. Motor-operated valves are isolated electrically by a qualified person and locked at the motor control center, with the valve also locked mechanically if it has a handwheel. Pasadena is the reminder of what happens when an actuated valve's power source is left connected.

Labels that match the drawings

An isolation plan that says close valve FV-1107 is only useful if the valve in the field carries the same tag. The CER's 2022 advisory found valves and electrical devices that were unlabeled or labeled differently from the drawings. Good practice is to tag every valve that may be used as an isolation point with a durable tag matching the P&ID, to check tags during the walk-down, and to raise a work request to fix any mismatch before the job rather than writing a note on the permit. Electrical isolation points at motor control centers need the same discipline.

Group lockout with several contractors

On a large job, a mechanical contractor, an electrical contractor, an inspection company and the operator's own maintenance crew may all depend on the same isolations. Group lockout lets them share one set of isolation locks without each person locking every point. A common arrangement on oil and gas sites works like this: the isolating authority applies company isolation locks to every point and puts the keys in a lockout box; the isolating authority applies a lock to the box; each crew supervisor or each worker, depending on the company standard and the jurisdiction's rules, applies a personal lock to the box before starting work; nobody can remove the isolations until every personal lock is off the box; and each personal lock is removed only by the person who applied it. HSE-210 explains the variations allowed under lockout rules.

Keeping count is harder than it sounds when crews come and go across shifts. The program below keeps a simple ledger of locks applied to and removed from a group lockout box over two days of a compressor overhaul, and shows at any moment how many personal locks are on the box.

# Ledger of personal locks on a group lockout box during a two-day overhaul (invented).
events = [
    ("day 1 06:30", "apply", "isolating authority"),
    ("day 1 07:10", "apply", "mechanical crew A, supervisor"),
    ("day 1 07:15", "apply", "electrician"),
    ("day 1 10:40", "apply", "inspection technician"),
    ("day 1 14:20", "remove", "inspection technician"),
    ("day 1 17:55", "remove", "electrician"),
    ("day 1 18:05", "remove", "mechanical crew A, supervisor"),
    ("day 2 06:40", "apply", "mechanical crew B, supervisor"),
    ("day 2 07:00", "apply", "insulation contractor"),
    ("day 2 15:30", "remove", "mechanical crew B, supervisor"),
]
on_box = set()
for when, action, who in events:
    if action == "apply":
        on_box.add(who)
    else:
        on_box.discard(who)
    others = sorted(on_box - {"isolating authority"})
    state = "no personal locks on the box" if not others else f"{len(others)} personal lock(s) on the box"
    print(f"{when}  {action:<6} {who:<30} {state}")
print("Still on the box at the end:", ", ".join(sorted(on_box)))

day 1 06:30  apply  isolating authority            no personal locks on the box
day 1 07:10  apply  mechanical crew A, supervisor  1 personal lock(s) on the box
day 1 07:15  apply  electrician                    2 personal lock(s) on the box
day 1 10:40  apply  inspection technician          3 personal lock(s) on the box
day 1 14:20  remove inspection technician          2 personal lock(s) on the box
day 1 17:55  remove electrician                    1 personal lock(s) on the box
day 1 18:05  remove mechanical crew A, supervisor  no personal locks on the box
day 2 06:40  apply  mechanical crew B, supervisor  1 personal lock(s) on the box
day 2 07:00  apply  insulation contractor          2 personal lock(s) on the box
day 2 15:30  remove mechanical crew B, supervisor  1 personal lock(s) on the box
Still on the box at the end: insulation contractor, isolating authority

Overnight between the two days, only the isolating authority's lock was on the box. The isolations stayed in place anyway, because the overhaul permits were suspended rather than closed: the lock count shows who is protected, but the permits decide whether the job is finished. At the end of day 2, the insulation contractor's lock is still on the box. The mechanical work is finished and the operator may be keen to restart the compressor, but the isolations cannot be removed until the insulation contractor has been found, confirmed clear of the equipment and has removed their own lock. If that person has left site, most lockout rules allow a lock to be removed by someone else only under a formal procedure: confirming the person is not at the equipment, attempting to contact them, management authorization and informing them before they return to work. Permit systems that link the group lockout box to every dependent permit, as HSE-221 described, make this kind of loose end visible before it becomes a surprise.

Proving a process isolation

Verification is the step that turns an isolation from a hope into a fact. For electrical isolation, the qualified person tests for absence of voltage. For machinery, an attempt to start confirms the isolation, though on oil and gas sites a start attempt on a compressor or pump must be designed so it cannot actually move process fluid if the isolation has failed. For process isolations, verification usually combines several checks:

• opening the bleed between two block valves and confirming flow stops and stays stopped;
• opening a vent or drain on the isolated section and confirming no flow and zero on a calibrated gauge;
• monitoring pressure on the isolated section for a set time, often called a hold or creep test, to catch a passing valve repressuring it;
• gas testing at the opening once it is cracked;
• a second competent person checking each point against the certificate on high-hazard jobs.

The hold test catches the slow leak that HSE-332's passing-valve program showed could repressure a section within an hour or two. A typical company standard might require the isolated section to be watched for 15 to 30 minutes with no pressure rise before the first break on high-hazard work, with the time and readings recorded on the isolation certificate. A rise means a passing valve, and the job stops until the isolation is improved.

Safety system overrides

Maintenance often needs a safety system to be overridden: a level switch inhibited while a vessel is drained, a gas detector inhibited while it is replaced, a shutdown valve bypassed during a test, or a fire and gas zone put in maintenance mode during hot work. Every override removes a layer of protection, and overrides that are forgotten are a recurring cause of incidents. HSE-311 and HSE-332 discussed bypass management in process safety. Within the permit system, good practice is:

• every override is authorized on an override certificate that names the device, the reason, the compensating measures, the approver and the time limit;
• overrides are entered in an override register that the control room reviews every shift;
• overrides on critical safety functions need higher approval, and long overrides need repeated approval;
• compensating measures are specific and in place, such as a person watching a local level gauge or a portable gas monitor beside an inhibited fixed detector;
• the permit for the work that needs the override cannot close until the override is removed and the device is tested back in service.

Long-term isolations

Some equipment stays isolated for weeks or months, waiting for parts, a design change or a turnaround. Long-term isolations drift: people who set them move on, locks are cut by mistake, labels fade, and the reasons are forgotten. The CER advisory described a line that was isolated but not locked and opened during a power outage, which is the kind of failure that long periods without attention make more likely. Companies manage long-term isolations through a register with the reason, the isolation certificate, the responsible person and a review date; periodic field checks that every lock and blind is still in place; conversion of valve isolations to positive isolation if the equipment will be out of service for long; and formal handover when responsible people change.

Isolations that cross boundaries

On oil and gas sites, the isolation for a job may depend on a valve that belongs to someone else: a pipeline company's valve at the plant inlet, a neighboring operator's tie-in, a utility's electrical disconnect or a valve on a well operated by a partner. The plan must identify these, agree in writing who will operate and lock them, and make sure the other party's lock or tag is on the point and listed on the certificate. A phone call saying the valve is closed is not an isolation.