An effective, easy-to-use lockout system is essential for ensuring worker safety during maintenance outages at hydro facilities. Two utilities — Exelon Power in the U.S. and BC Hydro in Canada — share their experiences and lessons learned when implementing a lockout system for their hydro plants.
By Kevin J. O’Neill and J. Eric Steinson
In the past, hydro facilities have been required by law to use a tagout program to avoid energizing a power source on a piece of equipment that is undergoing maintenance or rehabilitation. However, a tagout system alone, which involves placing a tag on the energy source for a piece of equipment, often is not enough to guarantee worker safety. Recent legislation in both the U.S. and Canada has led many hydro project owners to move toward a more reliable means of ensuring worker safety, which involves implementing a lockout program.
 |
A lockout provides an extra level of protection by physically preventing activation of a power source on a piece of equipment. A lockout can range from an actual physical restraint (such as a chain and lock) to removal of a valve handle.
In this article, two utilities — Exelon Power in the U.S. and BC Hydro in Canada — with recent experience in implementing a lockout program share their reasons, the work performed, and lessons learned.
Exelon Power
In the U.S., the Occupational Safety and Health Administration (OSHA) is the federal agency in charge of preventing work-related injuries, illnesses, and deaths. OSHA fulfills this role by issuing and enforcing standards for workplace safety and health.
In 1994, OSHA issued new regulations specific to electric utilities regarding how equipment, once powered down, can be secured in the off position. Before this time, the electric industry worked under its own long-standing rules, which required equipment with an electrical energy source be both tagged out (to indicate it was safely deenergized) and to ensure personnel would not accidentally reactivate the equipment. OSHA only required tagout protection for equipment with a mechanical energy source.
OSHA issued the new rules but did not lay out a specific program for companies to follow to comply with the new regulations. Companies could implement their own procedures, so long as they satisfied OSHA’s requirements.
OSHA updated these regulations in 2003, when it issued official instructions on enforcement of the electric power generation, transmission, and distribution standard. OSHA held hearings and heard comment on further revisions but has not yet published any updates.
Traditionally, Exelon Power used a simple tagout system on devices with a mechanical energy source at its two hydro plants — 548-MW Conowingo and 880-MW Muddy Run pumped-storage. OSHA’s definition of a tag, which basically acts as a caution, is, “a prominent warning device that can be securely fastened to an energy-isolating device to indicate the energy-isolating device and the equipment being controlled.” An energy-isolating device is equipment that serves as a blocking point for the transmission, conduction, or release of any energy source.
Implementing secondary restraints
In late 2005, Exelon implemented a program to provide safety equivalent to OSHA’s lockout requirement. To improve the effectiveness of its tags, Exelon uses what essentially amounts to locks on tags. A lock, according to Exelon, is a device that uses “a positive means such as a key or combination lock to hold an energy isolating device in a safe position and that prevents the energizing of a system or equipment.” These locks also are known as secondary restraints. Secondary restraints is not an official OSHA term, but it is used by most industries and carries a functional definition. For example, a secondary restraint could be a lock and chain, a device that covers a valve handle, or removal of the handle and tagging of the system.
At Exelon, a secondary restraint demonstrates that the level of safety achieved in a tagout program is equivalent to the safety obtained by the use of a lockout program. Means to be considered to achieve this level of safety include implementation of additional safety measures (e.g., removing an isolating circuit element, blocking a controlling switch, opening an extra disconnecting device, or removing a valve handle) or the use of physical restraints to reduce the likelihood of inadvertent energizing.
The secondary restraint requirement means mechanically isolating an energy source to provide additional worker protection. Energy sources include water, steam, oil, pressurized air, and electricity.
Secondary restraints are required on primary energy sources where the component is capable of being restrained. Examples of secondary restraints Exelon uses include placing locked covers on knobs or using a chain to lock a valve. The main purpose is to ensure that equipment cannot be activated by an accidental bump.
Exelon requires that a five-step process is followed before any work can be done on units at its stations. Responsibility begins with the operations manager, who is responsible for the purchase and use of secondary restraints. Others responsible for implementing the program include the clearance order writer, approver, hanger, and holder. Their responsibilities are:
— Clearance order writer ensures that the clearance order’s special instructions note that “Secondary restraints are required for all primary energy sources.” If a secondary restraint cannot be applied to a particular situation, an additional note must be placed in the special instructions, detailing the exception. The writer also must ensure that the proper secondary restraint for the clearance order is on hand.
— Clearance order approver ensures that the writer has noted, in the special instructions of the clearance order, that secondary restraints are required for all primary energy sources.
— Clearance order hanger applies secondary restraints to all primary energy sources included in the scope of the clearance. This includes using the proper secondary restraint for the component that is to be isolated.
— Clearance order holder performs an equipment walk-down and verifies all isolation points are properly tagged and aligned before work can start. This walk-down includes ensuring that secondary restraints are in place.
Applying secondary restraints during an outage
Bill Patton, an operations foreman, was the operations outage coordinator for a month-long outage in the spring of 2007 at Exelon’s Muddy Run plant in Pennsylvania. To prepare for the outage, Patton needed a month. Patton had more than 55 clearance orders for the outage. In total, those clearance orders accounted for hundreds of secondary restraints.
Muddy Run has a full-time staff of two operators, but Exelon brought in 150 employees — mostly contractors — to execute the outage. Like most companies, Exelon does not allow employees or contractors to affix their own locks at job sites. Instead, they must sign in and out on an authorized employee accountability sheet. Circuits and equipment cannot be reenergized or turned on until everyone is accounted for. Employees or contractors also must sign out if conditions change that make it no longer safe to continue work. Clearances were lifted and reapplied in order to conduct routine testing of equipment as the outage progressed.
The month-long outage at Muddy Run finished on time and there were no OSHA-recordable injuries.
Lessons learned
Strong communication is a key in the success of Exelon’s secondary restraint program. The utility ensures all employees know what a secondary restraint it, what it is used for, and when it is to be used. Exelon covers the topic through job briefings and reinforces it through supervision, including observations by the foreman, supervisor, and manager.
Proper coordination of contract labor is vital. In addition to requiring all contractors to sign in and out on the authorized employee accountability sheet, Exelon had full-time safety representatives on site during the Muddy Run outage to assist craft workers.
BC Hydro
Two factors influenced Canadian utility BC Hydro’s decision to implement a lockout program at its 30 hydro and three thermal plants. First, WorkSafe BC, the workers’ compensation board of British Columbia, is in charge of workplace health and safety in the province. WorkSafe BC was encouraging BC Hydro to implement a lockout program. WorkSafe BC’s lockout regulation contains legal requirements that must be met by all workplaces under its inspectional jurisdiction. This includes most workplaces in British Columbia, except mines and federally chartered workplaces (such as banks, telephone systems, and radio services).
Second, BC Hydro experienced a situation where tags were removed from a generating unit by mistake, allowing the unit to be watered up. As luck would have it, no workers had been inside the unit. However, this incident showed the type of mistakes that could happen with the current tagout system.
Implementing a lockout program
In 2001, BC Hydro decided to adopt a lockout program for its generating stations. Prior to this time, BC Hydro had used a tagout system for decades. Workers had learned it, practiced it, and put their faith in it for a long time. Understandably, there was considerable resistance and concern about implementing a lockout system. To develop a lockout program, BC Hydro put a trusted senior safety manager, Sandy Burpee, in charge of implementation. Burpee is a mechanical engineer from the generation side of the business. He formed a group of 12 workers and managers to develop the code, as he called it. Each area of the business put forth names, and Burpee interviewed all candidates to form a group that could work cohesively. Group members had very different ideas of how things should be done going into the project, but all agreed on a common set of procedures in the end. The project was completed in two years, as scheduled.
 On this wheel valve at an Exelon Power hydro facility, personnel used both a tagout and a chain (secondary restraint) to ensure the valve could not be accidentally operated. This combination provides a level of safety equivalent to a lockout program. |
In the spring of 2003, the resulting Work Protection Practices (WPP) program was implemented. Workers were required to isolate and lock out equipment by one of two methods. They could either place their own locks on the required isolating devices (personal lockout) or have the Person in Charge put together larger isolations. This involved one qualified worker first going to each isolating device to switch and verify the isolation and place a lock, then another worker visually checking the isolation before applying another set of locks (group lockout). The Person in Charge was required for isolation of any high-voltage electrical energy.
Trainers were developed in each of the geographical areas of the province. In general, the trainers were electricians or operators who had experience as the Person in Charge responsible for creating the isolations required for worker protection under the old tagout system. In addition to training the crews, these trainers made sure all the materials were available in their stations for lockouts and ensured that the local operating orders were drafted to apply lockout effectively at each site.
BC Hydro requires each worker to be responsible for ensuring the isolation is appropriate for the work he or she is doing. This is a significant change from the tagout system, where one employee might work under another’s isolation.
With new procedures for isolating the generating units, BC Hydro personnel had to be creative to allow them to work under various situations. Soon after the program was implemented, BC Hydro published a bulletin to help workers apply lockout to the upper section of the generating unit first. Then, once work was under way there, the lower section of the generating unit was locked out with two more sets of locks. Finally, workers removed their personal locks from the original lockout (upper section) for a short time while the keys for the additional sets of locks are placed with the first two keys in the sealed keybox of the lockout board. The workers could then hang their personal locks on the lockout board and work on both the upper and lower sections of the generating unit.
With a new set of procedures, workers also need some assistance keeping track of all the isolating devices used for the various lockouts throughout the plant. A computer application, called eWPP, was developed to do this. It prints out switching orders and lock-out sheets and creates the necessary forms to modify the isolations, if required. This application is available on BC Hydro’s intranet site.
BC Hydro’s WPP governance committee meets monthly to review any incidents at the plants and determine if they involved improper isolation. Incidents, including near-miss incidents, are reported on a regular basis. If improper isolation was a problem, the committee provides information notices or makes rule changes to avoid repeating the situation.
When the lockout system was implemented, BC Hydro set up an audit process to check each of the generating stations every three years for correct implementation of lockout procedures. This audit process has shown that workers are very knowledgeable about lockout and are doing an excellent job of keeping themselves safe on protected equipment.
For many decades, BC Hydro has had a safety rulebook called the Safety Practice Regulations (SPR). In 2007, BC Hydro integrated work protection practices into the SPR. Now, the lockout rules for the generating stations and tagout rules for the distribution and transmission lines are in the same book.
Kevin O’Neill, senior safety professional with Exelon Power, consulted on the utility’s lockout program to ensure it met Occupational Safety and Health Administration regulations. Eric Steinson, P.E., shift supervising engineer with BC Hydro, was a member of the committee that developed the work protection practices for the utility’s lockout program.
