5.3 Crews, shift changes and contractors

1 One lock per person, and what a lockbox is for

1910.147(f)(3)(i) sets the principle for crew work: "When servicing and/or maintenance is performed by a crew, craft, department or other group, they shall utilize a procedure which affords the employees a level of protection equivalent to that provided by the implementation of a personal lockout or tagout device." Equivalent to a personal device — which means every member of the crew has protection they control personally, however many people are involved.

(f)(3)(ii) then names four specific requirements, and together they describe the group lockbox:

• (A) "Primary responsibility is vested in an authorized employee for a set number of employees working under the protection of a group lockout or tagout device (such as an operations lock)."
• (B) "Provision for the authorized employee to ascertain the exposure status of individual group members with regard to the lockout or tagout of the machine or equipment."
• (C) "When more than one crew, craft, department, etc. is involved, assignment of overall job-associated lockout or tagout control responsibility to an authorized employee designated to coordinate affected work forces and ensure continuity of protection."
• (D) "Each authorized employee shall affix a personal lockout or tagout device to the group lockout device, group lockbox, or comparable mechanism when he or she begins work, and shall remove those devices when he or she stops working on the machine or equipment being serviced or maintained."

(D) is the mechanism and it is worth stating in plain terms. The isolating devices are locked with a set of locks whose keys go into a box. Each person working puts their own personal lock on that box when they start and takes it off when they stop. The box cannot open, and the machine cannot be energized, until the last personal lock is gone. Nobody has to remember who is still inside, because the hardware remembers.

2 Shift change: the handover that has to be physical

1910.147(f)(4) is one sentence and it is the hardest one in the standard to comply with by talking: "Specific procedures shall be utilized during shift or personnel changes to ensure the continuity of lockout or tagout protection, including provision for the orderly transfer of lockout or tagout device protection between off-going and oncoming employees, to minimize exposure to hazards from the unexpected energization or start-up of the machine or equipment, or the release of stored energy."

Continuity is the word. There must be no instant at which the machine is unlocked, and there must be no instant at which somebody is protected by a lock they did not apply and cannot remove. The lockbox makes that trivial: the oncoming technician adds a personal lock, the off-going one removes theirs, and the protection never lapses. Without a box, the transfer requires a written procedure that somebody thought about in advance, because the obvious way to do it — "I'll leave my lock on for you" — violates (c)(8) and (e)(3) at once.

The oncoming person also inherits the verification. Their hands are the exposed hands now, and paragraph (d)(6) is written in the singular for that reason. Part 2, Chapter 3 covers the three moments a verification expires; a shift change is the third.

3 Removing somebody else's device: the narrow exception

1910.147(e)(3) starts with the rule: "Each lockout or tagout device shall be removed from each energy isolating device by the employee who applied the device." Then the exception, which exists because people go home, get sent to another site, or are taken to hospital — and it has more conditions than most plants realize.

"When the authorized employee who applied the lockout or tagout device is not available to remove it, that device may be removed under the direction of the employer, provided that specific procedures and training for such removal have been developed, documented and incorporated into the employer's energy control program. The employer shall demonstrate that the specific procedure provides equivalent safety to the removal of the device by the authorized employee who applied it." The procedure shall include at least three elements:

1. 1
   (i) Verification by the employer that the authorized employee who applied the device is not at the facility.
2. 2
   (ii) Making all reasonable efforts to contact the authorized employee to inform him or her that the device has been removed.
3. 3
   (iii) Ensuring that the authorized employee has this knowledge before he or she resumes work at that facility.

Element (iii) is the one with teeth and the one that is almost never done: the person whose lock was cut must know it was cut before they resume work. Otherwise they come back on Monday believing a machine is locked out, and it is not. Subpart S has the same exception in a shorter form at 1910.333(b)(2)(v)(C), requiring the employer to ensure the employee is not available at the workplace and is aware the lock or tag has been removed before resuming work there.

The practical control is the one you can see: a lock with a name on it. 1910.147(c)(5)(ii)(D) requires devices to "indicate the identity of the employee applying the device(s)," which is what makes elements (i) through (iii) possible at all. An anonymous lock cannot be removed lawfully, because nobody can verify who is missing.

4 Contractors, in both directions

1910.147(f)(2) is short and symmetrical. (i): "Whenever outside servicing personnel are to be engaged in activities covered by the scope and application of this standard, the on-site employer and the outside employer shall inform each other of their respective lockout or tagout procedures." Both directions. (ii): "The on-site employer shall ensure that his/her employees understand and comply with the restrictions and prohibitions of the outside employer's energy control program."

That second clause is the one plants get backwards. It is not only that the contractor follows the plant's rules; the plant's own employees must understand and comply with the contractor's restrictions. If a vendor's technician locks a machine under their own program, plant employees are bound by that program's prohibitions.

Where PSM applies, 1910.119(h) goes considerably further, and (h)(1) is explicit that it is aimed at this trade: the paragraph "applies to contractors performing maintenance or repair, turnaround, major renovation, or specialty work on or adjacent to a covered process," and does not apply to incidental services such as janitorial work, food services, laundry or delivery. And for confined spaces, 1910.146(c)(8) and (c)(9) set out the host's five duties and the contractor's three, including the host's obligation to debrief the contractor at the conclusion of the entry — covered in Part 4, Chapter 2.

5 Why telling people is not a control

Return to the hoist technician. He notified the carpenter foreman and the senior superintendent. Both of those are the right people. Neither notification prevented the hoist from being energized, because a notification is information and a lock is a physical constraint. The standard knows the difference: 1910.147(c)(9) requires notification of affected employees in addition to the devices, not instead of them.

There is a second failure in that report, and it belongs to the next chapter: the manufacturer's metal enclosure around the hoist panels had been replaced with a wooden one, described in OSHA's own words as replacing an enclosure "that allowed safer access." Somebody modified the equipment, presumably to make a job easier, and the modification removed a protection. That is what Chapter 4 is about.

The two together — coordination by conversation, and a modification nobody assessed — are the two most common systemic failures in maintenance work. Neither is a mistake by an individual on the day. Both are decisions the organization made earlier and forgot it had made.

6 Six questions for a multi-person job

1. 1
   Who is the authorized employee with primary responsibility for this group, under (f)(3)(ii)(A)?
2. 2
   How do they know who is currently exposed, under (f)(3)(ii)(B)? If the answer is "he counts heads," the answer is a lockbox.
3. 3
   If more than one craft or department is involved, who has overall job-associated control under (f)(3)(ii)(C)?
4. 4
   Where does my personal lock go, and does the machine physically stay isolated until mine comes off, under (f)(3)(ii)(D)?
5. 5
   What happens at the end of my shift — what is the written transfer under (f)(4), and who verifies the machine when they take it over?
6. 6
   If somebody has to leave with their lock still on, what is the documented removal procedure under (e)(3), and who makes sure they know before they come back?

All six are answerable in a two-minute conversation before the job, and all six become unanswerable once the crew is spread across a machine with a panel open and two people inside a guard.