23 ms·

Lockout-Tagout

136 points by restlessdesign 7y ago

sunkenvicar 7y ago
This is a large part of my job because all equipment must be locked out before it is serviced.
asperous 7y ago
https://www.oregonlive.com/silicon-forest/2018/10/intel_sued_for_1_million_in_wo.html https://www.oregonlive.com/silicon-forest/2018/10/intel_sued... Pretty recent death caused partially by not following this procedure.
zxcvgm 7y ago
John Ward recently did a video on various lockout-tagout devices for electrical systems: https://youtu.be/3fMueAINzcI https://youtu.be/3fMueAINzcI
Intermernet 7y ago
This is unofficially gaining a 3rd step: "Try out". Sometimes people fail to properly lock and tag, and it's usually worth physically testing that the equipment is actually disabled before someone is injured or killed due to incorrect locking / tagging. EDIT: This is obviously mentioned in the article! Mea culpa ;-)
- Semiapies 7y ago
  Hey, it definitely won't kill anyone to reiterate it.
frankwiles 7y ago
When I started at the Lawrence Journal-World (the company who Open Sourced Django) I was forced to watch a really old cheesy video about Lock-Out Tag-Out which at the seemed stupid for a web developer. Then I was walked to the office past some of the biggest machines I’d ever been near to that point in my life. Then I got it. It definitely saved a few peoples limbs at that company alone.
- Cthulhu_ 7y ago
  In software development the closest equivalent I can think of would be locking files in older version control systems like SVN.
geekamongus 7y ago
Side note: The most secure locks that Master makes (in regards to being pick resistant) are their LOTO padlocks, and they are usually about $10. Most of their other consumer locks are pretty easy to bypass with basic picks, but get marketed as being the "best" in security and cost a lot more.
- black6 7y ago
  In my experience this is not true. Some LO/TO locks even have plastic shackles and bodies (for the obvious electrical work). They’re not supposed to be pick proof and super secure—they’re a visual and physical reminder that the system is secured for worker safety. If a lock needs to be removed by someone other than the lock owner there is an OSHA process to remove out that involves cutting and discarding that particular lock.
  - n0ric 7y ago
    I recommend watching LockPickingLawyer's video on the lock the parent comment is talking about: https://youtu.be/y4XGY0_cwcM https://youtu.be/y4XGY0_cwcM. Master used a very pick resistant core for their LOTO locks but skimped out on the higher priced general-use models.
    - black6 7y ago
      That is baffling as he says in the video! I’ve never seen anyone on any worksite I’ve been on trying to pick a LO/TO lock, so I just assumed the cores were just as insubstantial.
      - jsmith45 7y ago
        I suspect it is very deliberate. Their normal cores are so shitty that there is a reasonable chance that the wrong key will work to open the lock, especially if somebody is trying to open it quickly. With LOTO locks, Bob could die if Alice's key works on Bob's lock. (e.g. both on working on equipment powered by different circuit breaks, and Alice confuses the breakers, and removes the lock from BOB's breaker, because her key happened to work on it). A few reports of that happening, and their LOTO locks could be banned from many worksites due to unions rightfully insisting on it. So it actually is worth having better cores to ensure only the correct keys will work.
beart 7y ago
I started up a piece of industrial equipment that some one was working on just out of site. He didn't lock it out or even disconnect the power at the switch right next to him. He screamed at me when his arm almost got ripped off. It's an amazing mix of terror for having almost hurt someone and rage at that same person for putting you in that position.
taneq 7y ago
After working in mining for a long while, where this kind of isolation procedure is standard and is taken very seriously (pretty much any breach of procedure is an instantly firable offense) it's terrifying coming back home and seeing people working on house wiring etc. with nothing more than a turned-off circuit breaker protecting them from electrocution or other injury. I've seen some trades start to pick up isolation procedures but they're generally still far behind industry best practices.
- ebiester 7y ago
  How would you recommend people working on their own house implement anything more than turning off the circuit breaker? (I'm not doing anything electrical in general, but sometimes small fixes are necessary for home owners.)
  - devb 7y ago
    I think OP is referring to a job site where people coming and going have access to the panel. If you're home alone or only have a small handful of people to keep in contact with then it's far less of an issue.
    - taneq 7y ago
      In those cases you're 'probably fine' but if someone gets home while you're working, sees that the power is out, and goes to check the circuit breaker (as you've probably trained them to do) then you could still get zapped without warning.
      - Gibbon1 7y ago
        That's why central air conditioners are supposed to have a disconnect within sight of the unit.
        Scoundreller 7y ago
        I thought it was for easy-money from new/unfamiliar home-owners. https://youtu.be/fUAIBZKeK74 https://youtu.be/fUAIBZKeK74 For the Dateline Special.
downerending 7y ago
Too lazy to include a link, but I believe when work is done on electrified train rails, they attach a huge bar across the power rails to short them. If they're inadvertently powered, breakers elsewhere trip. (Or, worst case, the bar melts?)
- devb 7y ago
  They also make LOTO derails to keep the train from running you down: https://www.yesterdaystractors.com/cvphotos/cvphoto33914.jpg https://www.yesterdaystractors.com/cvphotos/cvphoto33914.jpg
- NamTaf 7y ago
  I'm not sure how this works for electrified rails (i.e. a third-rail that provides power to the engines), however for a standard rail line (i.e. just 2 tracks, with either an overhead providing electricity, or diesel engines) is used as a method of safety using the track signalling. Specifically, in many rail signalling network systems, a signal will turn red when it detects a short between the two rails in its section (i.e. an axle rolls into it). It will then turn back green when that short disappears. Workers can therefore clip something between both rails, which triggers the signal relay and makes the signal light green. This is absolutely not isolation & lockout though, because it doesn't actually remove the energy source. That's not to say it's not a valuable process though, but an isolation & lockout for this sort of circumstance either involves locking the track switches to direct traffic away from the worksite, or installing a derailer [1] on the track that phyiscally throws the train off the rail into the dirt so it stops well clear of the work site. The above obviously doesn't work if you're working on a running system, though (which does happen, occasionally). In that instance, the track clip lets trains stop at the red light, radio to the worksite, have the worksite clear, then remove the clip, let the train through, then resume work. It's different levels of safety for different perceived risks. [1]: https://en.wikipedia.org/wiki/Derail https://en.wikipedia.org/wiki/Derail
  - tialaramex 7y ago
    Track circuit operating clips are used for the system you're talking about, they're just a pretty simple arrangement of giant spring clips with a deliberately short lead between them, workers are trained to apply the clips starting with the side away from the third rail, the lead is too short to make it possible to connect the third rail to the running rail if you've done it this way. The big metal bar is different, as the poster explained it will short the (supposedly dead) power circuit in a third rail system, taking several hundred volts at quite a lot of amps until the short is detected, hence it can't just be a couple of metal clips and a cheap cable like TCOC. If some idiot re-enables power to the circuit or a fault elsewhere re-energises it despite it notionally being switched off, the bar will turn that into a full short and everybody will know there's a problem, although I'm not sure that would save anybody who happens to actually be touching the now surprisingly live rail at the time it's energised. On overhead systems there is similarly an arrangement where a worker - after confirming that the power is supposedly dead - ensures this is true by physically grounding it. Again it's a failsafe.
RandomBacon 7y ago
Always verify the equipment you are working on is still physically LO-TO. I heard a story about one person who LO-TO a breaker on Friday, and Monday it had power when he went to work on it. The guy went to check the breaker, and the breaker was sitting on the ground with the lock still attached, and a new breaker in its place.
- csours 7y ago
  Hooo boy. I think there might be a few more breakers on the ground if that was me.
  - Gibbon1 7y ago
    You misspelled 'teeth'
- ISL 7y ago
  Oh, wow. That's tantamount to attempted manslaughter.
- TheCapn 7y ago
  Always verify the motor/equipment you're locking out is prevented from running! Coworkers and I were just dishing commissioning job horror stories where folks get too antsy to run their facility and start bumping motors while people are still working elsewhere. Just because that breaker is labelled to run a specific motor, unless its been verified, it might be wired to the wrong motor, or the labelling is wrong or any other host of oversights. Had a manager come in, and run his motor. The electrician who was elsewhere in the facility straddling a auger watched it suddenly spin beneath his feet because the lock he put on a breaker was not physically wired to that motor (had not yet been tested). Lots of horror stories from that particular site. Always verify YOURSELF. Don't trust other people's word
- drdeadringer 7y ago
  This is one of my pet peeves: you are in the middle of a test, or maintenance, or similar ... then the weekend could come, it could be a simple bathroom break and you're at a good spot to pause for five minutes. You come back, and someone has somehow messed with your equipment. Obviously no one is using anything, everything must be available! They could have done anything from disconnect a cable to outright taking everything over for their own pet curiosity project -- all non-priority, of course. Total break of configuration to say the least, to speak nothing of potential safety issues to people or equipment. I have had multiple people ignore multiple "test in progress", "do not touch" signs and indicators multiple times for [honestly] no good reason, LO-TO or not. If I had the authority to ban them from the area unless escorted I would have. High priority emergency? Yes boss, I'll wait to finish or redo from scratch whatever I was doing for you. But if you're low on battery and want more Stardew Valley? You can wait or go somewhere else. /rant
zwilson 7y ago
Ex oil and gas health, safety, and environmental advisor, turned software engineer. This was a critical turning point for safety in almost every industry. Here's an unfortunate, but memorable example of its real-world importance: https://www.theguardian.com/us-news/2015/aug/12/bumble-bee-foods-settlement-man-cooked-death-tuna https://www.theguardian.com/us-news/2015/aug/12/bumble-bee-f... #edit: Oxford comma ocd
NamTaf 7y ago
I'm a mech engineer working with heavy machinery, and isolation & lockout rules everything around me. It's probably the most important method of implementing safeworking at an operational level [1]. I was responsible for rolling it out at the first site at my company, implementing the process and documentation, and then seeding it across to other sites. There's a concept called the hierarchy of hazard control [2]. At the top is eliminating the hazard - just removing it completely. It goes down through substitution, engineering controls, admin controls and then protective equipment is right at the bottom as the least effective method of protection. I&L aims to address the hazards right at the top by eliminating them, which is by far the most effective means of ensuring safety. It does this by following a process: First, isolate the energy source. Secondly, lock that isolation out so it cannot be reactivated. Third, test for dead by showing that a) the isolation cannot be removed, and b) that there is no residual energy source remaining. For example, an electrical isolation point might be a switch, which when thrown firstly breaks the circuit, but then also drains out any capacitors or other residual energy storage. The isolating person throws the switch, locks it out, tries to throw the switch back against the lock to show it's secure, then tests the system for dead by trying to power it up or by testing terminals for a voltage to prove that the energy sources have been drained. Once that's all done, they'll then complete the rest of the process and let others lock on to the system. When someone locks on to an isolated system, there should be sufficient documentation and indication to show that the system is isolated and safe. It might mean that if a mechanical latch is rotated to the 'safe' position, there's a sign that rotates into view from the isolation point so the protected person who is locking on to the isolation can see it, whereas when it's not locked out they cannot. The protected person can in theory go and test the lockout to ensure it's in place, but usually (where I'm at) it's controlled by a dual sign-off process when the above can't be achieved. Then the protected person throws their lock on the isolation point, and that ensures that none of the isolations can be released until they remove their lock. Critically, those who place the isolation are generally a controlled set of people who are trained more highly than the protected person level who just has to know how to verify isolations are in place and then lock on. In general, the people working on the isolated system don't place their own isolations unless it's a simple system/process. The whole process essentially provides a method of accounting for every person working on a system, and letting them be confident that it can't be powered up whilst working on it. It's not supposed to be secure locks. Mine, for example, have plastic casings, and ones designed for electrical work have a plastic bolt which I could probably easily remove with a bit of percussive persuasion. However, you also realistically generally can't stop a malicious person bypassing those safety measures, e.g. by wiring around a circuit-breaker or by undoing some bolts to remove a latch. So it's not intended to stop malicious parties, but it prevents the vastly more frequent case of were someone starts a machine when someone else is working in it. It gets far more complex than all that too, for example covering how you pass secure isolations between shifts, or how you chain together layers of an isolated system to a single isolation point, but the above should hopefully provide some insight into why this stuff exists and why it takes the form it does. [1]: I would consider the concept of 'safety in design' higher overall because that's about removing the hazard from existing at the design stage, but once it exists then I&L is generally the gold standard for dealing with it. [2]: https://en.wikipedia.org/wiki/Hierarchy_of_hazard_controls https://en.wikipedia.org/wiki/Hierarchy_of_hazard_controls
swixmix 7y ago
https://www.osha.gov/laws-regs/regulations/standardnumber/1915/1915.89 https://www.osha.gov/laws-regs/regulations/standardnumber/19...
Igelau 7y ago
Can we talk about how bad that lockout hasp graphic is? It looks like a drunk person broke the last crayon drawing it and just decided to have Inkscape run a trace on what they had.
- defterGoose 7y ago
  I noticed that too. It's like bad, stylized clip-art. They even have an image of a real one further down the article.
symplee 7y ago
Any software patterns comparable to this? (Would help to have a use-case example. And how the pattern helped Vs. what was being done before)
- ganzuul 7y ago
  Database operations. ACID compliance. Could also be safety critical to keep your state stateful.
- pjc50 7y ago
  "Lock" as in mutex? Although those don't come with a tag, which could be very handy when debugging.
  - fredley 7y ago
    Depending on the system, I think you can find out who owns the lock.
- gtkspert 7y ago
  Here's one: https://www.reddit.com/r/announcements/comments/4y0m56/why_reddit_was_down_on_aug_11/ https://www.reddit.com/r/announcements/comments/4y0m56/why_r... Failure to isolate (lock-out) puppet from switching things back on during a migration.
- Cthulhu_ 7y ago
  Locking files in SVN so other people can't edit them until you've unlocked it again. I've never seen it used, and the only references I can think of was where it was just annoying, if not a risk (someone locking a file then leaving over the weekend or the company entirely).
  - PudgePacket 7y ago
    I've seen it used in games. Often serialised assets won't be text diff friendly. Two people editing the same data will conflict and it won't be possible to merge the result. The solution is only one person checks out the file at a time.
alsysadmin 7y ago
I've spent many career years in sysadmin / process automation for manufacturing companies, and LOTO is one of many pieces of proper procedure and process that really impresses me about that industry. I worked at a big steel recycling plant, and the zero tolerance effort put toward safety and generally ensuring that this type of stuff was upheld was impressive. Not locking out a machine, or forgetting your lock on a machine was a fireable offense with like, one warning I think. You certainly didn't want to be the guy who was working on a machine that morning, and left your lock on it when you went home while someone else was working on it. They'd call you and get you out of bed real quick if it meant the machine couldn't start up because your lock is on there and you weren't accounted for. SRE's and operations people can pick up good habits from manufacturing gigs. A lot of the same concepts like uptime, good documentation, procedure, discipline are really important to the business at all levels. When lives are at risk good companies put a large sum of time and money in making sure everyone is on the same page.

This is a large part of my job because all equipment must be locked out before it is serviced.

https://www.oregonlive.com/silicon-forest/2018/10/intel_sued_for_1_million_in_wo.html https://www.oregonlive.com/silicon-forest/2018/10/intel_sued... Pretty recent death caused partially by not following this procedure.

zxcvgm 7y ago

John Ward recently did a video on various lockout-tagout devices for electrical systems: https://youtu.be/3fMueAINzcI https://youtu.be/3fMueAINzcI

Intermernet 7y ago

This is unofficially gaining a 3rd step: "Try out". Sometimes people fail to properly lock and tag, and it's usually worth physically testing that the equipment is actually disabled before someone is injured or killed due to incorrect locking / tagging. EDIT: This is obviously mentioned in the article! Mea culpa ;-)

Semiapies 7y ago
Hey, it definitely won't kill anyone to reiterate it.

frankwiles 7y ago

When I started at the Lawrence Journal-World (the company who Open Sourced Django) I was forced to watch a really old cheesy video about Lock-Out Tag-Out which at the seemed stupid for a web developer. Then I was walked to the office past some of the biggest machines I’d ever been near to that point in my life. Then I got it. It definitely saved a few peoples limbs at that company alone.

Cthulhu_ 7y ago
In software development the closest equivalent I can think of would be locking files in older version control systems like SVN.

geekamongus 7y ago

Side note: The most secure locks that Master makes (in regards to being pick resistant) are their LOTO padlocks, and they are usually about $10. Most of their other consumer locks are pretty easy to bypass with basic picks, but get marketed as being the "best" in security and cost a lot more.

black6 7y ago
In my experience this is not true. Some LO/TO locks even have plastic shackles and bodies (for the obvious electrical work). They’re not supposed to be pick proof and super secure—they’re a visual and physical reminder that the system is secured for worker safety. If a lock needs to be removed by someone other than the lock owner there is an OSHA process to remove out that involves cutting and discarding that particular lock.
- n0ric 7y ago
  I recommend watching LockPickingLawyer's video on the lock the parent comment is talking about: https://youtu.be/y4XGY0_cwcM https://youtu.be/y4XGY0_cwcM. Master used a very pick resistant core for their LOTO locks but skimped out on the higher priced general-use models.
  - black6 7y ago
    That is baffling as he says in the video! I’ve never seen anyone on any worksite I’ve been on trying to pick a LO/TO lock, so I just assumed the cores were just as insubstantial.
    - jsmith45 7y ago
      I suspect it is very deliberate. Their normal cores are so shitty that there is a reasonable chance that the wrong key will work to open the lock, especially if somebody is trying to open it quickly. With LOTO locks, Bob could die if Alice's key works on Bob's lock. (e.g. both on working on equipment powered by different circuit breaks, and Alice confuses the breakers, and removes the lock from BOB's breaker, because her key happened to work on it). A few reports of that happening, and their LOTO locks could be banned from many worksites due to unions rightfully insisting on it. So it actually is worth having better cores to ensure only the correct keys will work.

beart 7y ago

I started up a piece of industrial equipment that some one was working on just out of site. He didn't lock it out or even disconnect the power at the switch right next to him. He screamed at me when his arm almost got ripped off. It's an amazing mix of terror for having almost hurt someone and rage at that same person for putting you in that position.

taneq 7y ago

After working in mining for a long while, where this kind of isolation procedure is standard and is taken very seriously (pretty much any breach of procedure is an instantly firable offense) it's terrifying coming back home and seeing people working on house wiring etc. with nothing more than a turned-off circuit breaker protecting them from electrocution or other injury. I've seen some trades start to pick up isolation procedures but they're generally still far behind industry best practices.

ebiester 7y ago
How would you recommend people working on their own house implement anything more than turning off the circuit breaker? (I'm not doing anything electrical in general, but sometimes small fixes are necessary for home owners.)
- devb 7y ago
  I think OP is referring to a job site where people coming and going have access to the panel. If you're home alone or only have a small handful of people to keep in contact with then it's far less of an issue.
  - taneq 7y ago
    In those cases you're 'probably fine' but if someone gets home while you're working, sees that the power is out, and goes to check the circuit breaker (as you've probably trained them to do) then you could still get zapped without warning.
    - Gibbon1 7y ago
      That's why central air conditioners are supposed to have a disconnect within sight of the unit.
      - Scoundreller 7y ago
        I thought it was for easy-money from new/unfamiliar home-owners. https://youtu.be/fUAIBZKeK74 https://youtu.be/fUAIBZKeK74 For the Dateline Special.

downerending 7y ago

Too lazy to include a link, but I believe when work is done on electrified train rails, they attach a huge bar across the power rails to short them. If they're inadvertently powered, breakers elsewhere trip. (Or, worst case, the bar melts?)

devb 7y ago
They also make LOTO derails to keep the train from running you down: https://www.yesterdaystractors.com/cvphotos/cvphoto33914.jpg https://www.yesterdaystractors.com/cvphotos/cvphoto33914.jpg
NamTaf 7y ago
I'm not sure how this works for electrified rails (i.e. a third-rail that provides power to the engines), however for a standard rail line (i.e. just 2 tracks, with either an overhead providing electricity, or diesel engines) is used as a method of safety using the track signalling. Specifically, in many rail signalling network systems, a signal will turn red when it detects a short between the two rails in its section (i.e. an axle rolls into it). It will then turn back green when that short disappears. Workers can therefore clip something between both rails, which triggers the signal relay and makes the signal light green. This is absolutely not isolation & lockout though, because it doesn't actually remove the energy source. That's not to say it's not a valuable process though, but an isolation & lockout for this sort of circumstance either involves locking the track switches to direct traffic away from the worksite, or installing a derailer [1] on the track that phyiscally throws the train off the rail into the dirt so it stops well clear of the work site. The above obviously doesn't work if you're working on a running system, though (which does happen, occasionally). In that instance, the track clip lets trains stop at the red light, radio to the worksite, have the worksite clear, then remove the clip, let the train through, then resume work. It's different levels of safety for different perceived risks. [1]: https://en.wikipedia.org/wiki/Derail https://en.wikipedia.org/wiki/Derail
- tialaramex 7y ago
  Track circuit operating clips are used for the system you're talking about, they're just a pretty simple arrangement of giant spring clips with a deliberately short lead between them, workers are trained to apply the clips starting with the side away from the third rail, the lead is too short to make it possible to connect the third rail to the running rail if you've done it this way. The big metal bar is different, as the poster explained it will short the (supposedly dead) power circuit in a third rail system, taking several hundred volts at quite a lot of amps until the short is detected, hence it can't just be a couple of metal clips and a cheap cable like TCOC. If some idiot re-enables power to the circuit or a fault elsewhere re-energises it despite it notionally being switched off, the bar will turn that into a full short and everybody will know there's a problem, although I'm not sure that would save anybody who happens to actually be touching the now surprisingly live rail at the time it's energised. On overhead systems there is similarly an arrangement where a worker - after confirming that the power is supposedly dead - ensures this is true by physically grounding it. Again it's a failsafe.

RandomBacon 7y ago

Always verify the equipment you are working on is still physically LO-TO. I heard a story about one person who LO-TO a breaker on Friday, and Monday it had power when he went to work on it. The guy went to check the breaker, and the breaker was sitting on the ground with the lock still attached, and a new breaker in its place.

csours 7y ago
Hooo boy. I think there might be a few more breakers on the ground if that was me.
- Gibbon1 7y ago
  You misspelled 'teeth'
ISL 7y ago
Oh, wow. That's tantamount to attempted manslaughter.
TheCapn 7y ago
Always verify the motor/equipment you're locking out is prevented from running! Coworkers and I were just dishing commissioning job horror stories where folks get too antsy to run their facility and start bumping motors while people are still working elsewhere. Just because that breaker is labelled to run a specific motor, unless its been verified, it might be wired to the wrong motor, or the labelling is wrong or any other host of oversights. Had a manager come in, and run his motor. The electrician who was elsewhere in the facility straddling a auger watched it suddenly spin beneath his feet because the lock he put on a breaker was not physically wired to that motor (had not yet been tested). Lots of horror stories from that particular site. Always verify YOURSELF. Don't trust other people's word
drdeadringer 7y ago
This is one of my pet peeves: you are in the middle of a test, or maintenance, or similar ... then the weekend could come, it could be a simple bathroom break and you're at a good spot to pause for five minutes. You come back, and someone has somehow messed with your equipment. Obviously no one is using anything, everything must be available! They could have done anything from disconnect a cable to outright taking everything over for their own pet curiosity project -- all non-priority, of course. Total break of configuration to say the least, to speak nothing of potential safety issues to people or equipment. I have had multiple people ignore multiple "test in progress", "do not touch" signs and indicators multiple times for [honestly] no good reason, LO-TO or not. If I had the authority to ban them from the area unless escorted I would have. High priority emergency? Yes boss, I'll wait to finish or redo from scratch whatever I was doing for you. But if you're low on battery and want more Stardew Valley? You can wait or go somewhere else. /rant

zwilson 7y ago

Ex oil and gas health, safety, and environmental advisor, turned software engineer. This was a critical turning point for safety in almost every industry. Here's an unfortunate, but memorable example of its real-world importance: https://www.theguardian.com/us-news/2015/aug/12/bumble-bee-foods-settlement-man-cooked-death-tuna https://www.theguardian.com/us-news/2015/aug/12/bumble-bee-f... #edit: Oxford comma ocd

NamTaf 7y ago

I'm a mech engineer working with heavy machinery, and isolation & lockout rules everything around me. It's probably the most important method of implementing safeworking at an operational level [1]. I was responsible for rolling it out at the first site at my company, implementing the process and documentation, and then seeding it across to other sites. There's a concept called the hierarchy of hazard control [2]. At the top is eliminating the hazard - just removing it completely. It goes down through substitution, engineering controls, admin controls and then protective equipment is right at the bottom as the least effective method of protection. I&L aims to address the hazards right at the top by eliminating them, which is by far the most effective means of ensuring safety. It does this by following a process: First, isolate the energy source. Secondly, lock that isolation out so it cannot be reactivated. Third, test for dead by showing that a) the isolation cannot be removed, and b) that there is no residual energy source remaining. For example, an electrical isolation point might be a switch, which when thrown firstly breaks the circuit, but then also drains out any capacitors or other residual energy storage. The isolating person throws the switch, locks it out, tries to throw the switch back against the lock to show it's secure, then tests the system for dead by trying to power it up or by testing terminals for a voltage to prove that the energy sources have been drained. Once that's all done, they'll then complete the rest of the process and let others lock on to the system. When someone locks on to an isolated system, there should be sufficient documentation and indication to show that the system is isolated and safe. It might mean that if a mechanical latch is rotated to the 'safe' position, there's a sign that rotates into view from the isolation point so the protected person who is locking on to the isolation can see it, whereas when it's not locked out they cannot. The protected person can in theory go and test the lockout to ensure it's in place, but usually (where I'm at) it's controlled by a dual sign-off process when the above can't be achieved. Then the protected person throws their lock on the isolation point, and that ensures that none of the isolations can be released until they remove their lock. Critically, those who place the isolation are generally a controlled set of people who are trained more highly than the protected person level who just has to know how to verify isolations are in place and then lock on. In general, the people working on the isolated system don't place their own isolations unless it's a simple system/process. The whole process essentially provides a method of accounting for every person working on a system, and letting them be confident that it can't be powered up whilst working on it. It's not supposed to be secure locks. Mine, for example, have plastic casings, and ones designed for electrical work have a plastic bolt which I could probably easily remove with a bit of percussive persuasion. However, you also realistically generally can't stop a malicious person bypassing those safety measures, e.g. by wiring around a circuit-breaker or by undoing some bolts to remove a latch. So it's not intended to stop malicious parties, but it prevents the vastly more frequent case of were someone starts a machine when someone else is working in it. It gets far more complex than all that too, for example covering how you pass secure isolations between shifts, or how you chain together layers of an isolated system to a single isolation point, but the above should hopefully provide some insight into why this stuff exists and why it takes the form it does. [1]: I would consider the concept of 'safety in design' higher overall because that's about removing the hazard from existing at the design stage, but once it exists then I&L is generally the gold standard for dealing with it. [2]: https://en.wikipedia.org/wiki/Hierarchy_of_hazard_controls https://en.wikipedia.org/wiki/Hierarchy_of_hazard_controls

swixmix 7y ago

https://www.osha.gov/laws-regs/regulations/standardnumber/1915/1915.89 https://www.osha.gov/laws-regs/regulations/standardnumber/19...

Igelau 7y ago

Can we talk about how bad that lockout hasp graphic is? It looks like a drunk person broke the last crayon drawing it and just decided to have Inkscape run a trace on what they had.

defterGoose 7y ago
I noticed that too. It's like bad, stylized clip-art. They even have an image of a real one further down the article.

symplee 7y ago

Any software patterns comparable to this? (Would help to have a use-case example. And how the pattern helped Vs. what was being done before)

ganzuul 7y ago
Database operations. ACID compliance. Could also be safety critical to keep your state stateful.
pjc50 7y ago
"Lock" as in mutex? Although those don't come with a tag, which could be very handy when debugging.
- fredley 7y ago
  Depending on the system, I think you can find out who owns the lock.
gtkspert 7y ago
Here's one: https://www.reddit.com/r/announcements/comments/4y0m56/why_reddit_was_down_on_aug_11/ https://www.reddit.com/r/announcements/comments/4y0m56/why_r... Failure to isolate (lock-out) puppet from switching things back on during a migration.
Cthulhu_ 7y ago
Locking files in SVN so other people can't edit them until you've unlocked it again. I've never seen it used, and the only references I can think of was where it was just annoying, if not a risk (someone locking a file then leaving over the weekend or the company entirely).
- PudgePacket 7y ago
  I've seen it used in games. Often serialised assets won't be text diff friendly. Two people editing the same data will conflict and it won't be possible to merge the result. The solution is only one person checks out the file at a time.

alsysadmin 7y ago

I've spent many career years in sysadmin / process automation for manufacturing companies, and LOTO is one of many pieces of proper procedure and process that really impresses me about that industry. I worked at a big steel recycling plant, and the zero tolerance effort put toward safety and generally ensuring that this type of stuff was upheld was impressive. Not locking out a machine, or forgetting your lock on a machine was a fireable offense with like, one warning I think. You certainly didn't want to be the guy who was working on a machine that morning, and left your lock on it when you went home while someone else was working on it. They'd call you and get you out of bed real quick if it meant the machine couldn't start up because your lock is on there and you weren't accounted for. SRE's and operations people can pick up good habits from manufacturing gigs. A lot of the same concepts like uptime, good documentation, procedure, discipline are really important to the business at all levels. When lives are at risk good companies put a large sum of time and money in making sure everyone is on the same page.