Hazardous Energy Control (LOTO)

Microsoft establishes the Hazardous Energy Control (Lockout/Tagout (LOTO)) Program for compliance with applicable regulations such as OSHA’s "Control of Hazardous Energy", 29 CFR 1910.147. It is intended to prevent accidents and injuries that could result from the unintended activation of equipment during maintenance or servicing. This Program is intended to ensure that personnel effectively isolate equipment from energy sources prior to service and maintenance and to prevent equipment from unexpected startup, energizing, or releasing stored energy.  

This Program applies to all Microsoft operations that require servicing or maintenance of machines or equipment. Energy sources may be electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other types of energy.  Servicing and maintenance tasks include but are not limited to constructing, installing, setting up, adjusting, inspecting, modifying, maintaining and/or servicing machines or equipment, including lubrication, cleaning or unjamming of machines or equipment, and making adjustments or tool changes.  These types of tasks can cause an unexpected release of energy, and result in injury to human health or the damage to equipment or facilities.  

1.1 Exclusions 

LOTO procedures do not apply under the following three conditions:  

1. Work on cord and plug-connected electrical equipment, in which there is a single energy source:   

   1. All the hazardous energy is controlled by unplugging the equipment; and, 

   2. The plug remains under the continuous positive control of the worker performing the servicing, maintenance, or modification. Note: The use of a plug LOTO device is strongly recommended. See Appendix A for an example of a cord and plug LOTO device.

2. Operations on energized equipment (e.g., measuring, troubleshooting, calibration), where continuity of service is essential to safety, or shutdown of the system cannot be reasonably accomplished. Supervisor approval is always required for such operations, and documented safety procedures that provide an equivalent level of safety must be established and followed.
   
3. Minor tool changes, adjustments, and other minor servicing activities that take place during normal operations, provided that (a) such activities are routine, repetitive, and integral to the use of the equipment and that (b) the work is performed using alternative measures that provide effective personnel protection. 

2.1 Hazardous Energy Control Procedures

2.1.1 Regulatory Requirements

Regulations applicable to LOTO may vary depending on federal, state, and local jurisdictions.

Requirements for construction or maintenance work on electrical systems must follow the requirements in National Fire Protection Association (NFPA) 70E. For more information on the regulations affecting LOTO at a specific location, please contact the LOTO Site Administrator.

2.2.1 Prevention and Control

2.2.2.1 Written LOTO Program

Each Microsoft location included in the scope of this procedure must develop a site-specific LOTO program (“Site Plan”). Once developed, the program must be made available to all personnel potentially affected by the procedure, including employees, contractors, or regulatory agency personnel. The site-specific program must include the following:

• Program purpose and scope

• Personnel roles and responsibilities

• Definitions of terms critical to an understanding of the program, or those terms not commonly understood.

• Identification of authorized and affected employees for processes or equipment. Authorized and affected employees may be the same person when the authorized employee's duties also include performing work on a machine or equipment upon which lockout/tagout is implemented.

• Summary of the workplace survey and hazard assessment.

• Energy control procedures including general rules for program implementation, and requirements for:

  • LOTO procedures for machines, processes, or equipment if operation could result in injury to human health or the workplace environment.

  • Restrictions for operation, energizing, or removal of energy-isolation devices for equipment in LOTO.

• Descriptions of

  • Methods for LOTO preparation and application.

  • Verification of isolation through testing or “trying”.

  • Procedures for group LOTO.

  • Transfer of LOTO protection between shifts. This covers situations when equipment requires long-term lockout.

  • Energized testing and positioning (running adjustments). This covers situations where personnel temporarily remove LOTO devices from the equipment and energize it for testing or positioning. Authorization for energized testing must be obtained from the LOTO Site Administrator.

  • LOTO removal procedures.

2.2.2.2 Workplace Survey and Hazard Assessment

A site-specific LOTO program begins with a survey of energy-source hazards present at the workplace. The survey should include the following:

• Collection of unique identifiers for any machines, processes, and equipment that will be included in the plan.

• Identification of process interaction at a location, and whether energy sources upstream in the process pose a hazard to downstream personnel, machines, or equipment.

• Identification of the energy source, including the magnitude of energy, for each machine, process, and piece of equipment. The energy source may include one or more of the following:

  • Electrical

  • Hydraulic

  • Pneumatic

  • Kinetic or mechanical

  • Stored (potential) energy (e.g., raised devices, or springs under tension)

  • Steam or thermal

  • Chemical

• A description of the device (or devices) required to isolate the energy for each machine, process or equipment.

2.2.2.3 Energy Control Procedure

An energy control procedure must be developed for all equipment that has hazardous energy sources which require servicing, maintenance, or repair. The energy control procedure must include the following:

• Type and magnitude of the energy associated with the equipment.

• Hazards of the energy to be controlled and the degree of potential danger from those hazards

• Method or means to control the energy.

• Energy isolation locations.

• How the isolation is verified (list testing procedures, including equipment used when applicable).

• A description of the energy isolation devices that are required to perform proper lockout/tagout (LOTO).

• Unusual or extenuating conditions or situations that will result from the isolation.

• Personnel responsibility descriptions, either specifically by name or by job description, for each piece of equipment.

2.2.2.4 Group Lockout

When multiple LOTO-Authorized Employees perform servicing, maintenance, or modification on the same piece of equipment or apparatus, the supervisor or manager will determine if the use of a group LOTO procedure is appropriate. Steps for the safe completion of a Group Lockout are defined below:

1. The project supervisor determines that a group LOTO procedure is appropriate.
2. The supervisor will convene a meeting of all members of the group to be covered under the procedure.
   1. The supervisor must define and describe the tasks to be performed.
   2. The supervisor must delegate primary responsibility to a Principal LOTO Authorized Employee for a specified group of employees working under the protection of the group LOTO procedure.
   3. Each member of the specified group must be trained and LOTO-Authorized.
3. The Principal LOTO-Authorized Employee is responsible for ensuring that each step of the equipment-specific written procedure has been completed.
4. The Principal LOTO-Authorized Employee must apply his or her personal LOTO lock(s) and tag(s) to the energy-control device(s) and indicate on the tag(s) that a group LOTO is in effect.
5. The Principal LOTO-Authorized Employee must place his/her key(s) inside of a gang lockbox. The gang lockbox must be constructed in such a way as to permit multiple locks to be attached to the outside of the enclosure, preventing it from being opened until all locks are removed.
6. The Principal LOTO-Authorized Employee must also place a LOTO lock and tag on the outside of the gang lockbox.
7. All other workers performing work on the equipment must ensure that each step of the equipment-specific written procedure has been completed, and then lock and tag the gang lockbox in a manner that prevents access to the key inside until all locks have been removed.
8. When the work has been completed and after each worker has removed his/her respective lock from the gang lockbox, the designated LOTO-Authorized Employee removes his or her LOTO lock from the outside of the gang lockbox, obtains the keys from the lockbox, and returns the equipment to service.

2.2.2.5 LOTO Devices

The Site LOTO Administrator will issue or approve any lockout devices used by Microsoft personnel, contractors or vendors to isolate, secure, or block machines or equipment from energy sources.

• Lockout devices must be singularly identified as the only devices used to control energy, and not used for other purposes.

• All tagout devices will be durable, standardized, substantial and identifiable, as required by applicable regulations.

• Tags may only be used once. The date, name of employee, and remarks sections on the tag must be completed.

• The site-specific LOTO program must describe the process for issuing or approving LOTO devices, and how LOTO devices comply with Microsoft and regulatory requirements.

Note: Please review Appendix A for examples of approved tags for use during LOTO.

2.2.3 Training

Each location must train employees authorized to perform LOTO and ensure contracted personnel have been provided site-specific information and have equivalent training. Managers or supervisors must train authorized personnel at initial assignment and retrain if changes in procedures or work assignments occur. Microsoft OHS has defined training to meet regulatory requirements for LOTO. To obtain training, contact Global OHS  The training program must include the following information: 

The training program must include the following information:

• An online overview of LOTO requirements and hands-on instruction of the applicable Site Plan.

• Applicable federal, state or local regulations.

• Summary of the LOTO program and how to access the written program.

• Identification of authorized personnel.

• Energy-isolation procedures, including general steps to de-energize, test, and reenergize machines; and machine-specific LOTO procedures for authorized employees.

• Situations for implementing single LOTO devices versus group LOTO devices, and approved procedures for transferring LOTO to the next shift.

• Machines that cannot be locked out (approved for tagout).

• Procedures for protection of affected personnel.

• Procedures for responding to and reporting an incident.

2.2.4 Audits and Inspections

Each established site-specific LOTO Plan must be audited annually and updated as needed to correct identified deficiencies. The periodic inspection must be performed and documented by a LOTO-Authorized Employee other than the one utilizing the procedures being inspected.

Inspection results must be shared with all authorized employees and with Microsoft OHS.

Site Plan Administrators must review any past incidents that occurred since the previous inspection. Inspections must be documented, and include the inspection date, inspected equipment, the Administrator’s name, and the names of all authorized employees. Following an inspection, additional training or other remedial actions must be implemented as required to correct deficiencies.

Managers and supervisors should be consulted about program improvement opportunities and involved in implementation of needed compliance improvements. The Site Plan should be updated as needed to reflect compliance improvements resulting from the annual inspection.

2.3.5 Reporting Electrical Incidents

Any incident involving unintended contact with or release of energy from energized sources (i.e. electrical shock, depressurization, chemical spills, and hydraulic or pneumatic failure) must be reported to Microsoft OHS. Such incidents are regarded as serious and require formal investigation by Microsoft OHS.

2.2.6 LOTO Sample Documents

Appendix B contains a Sample LOTO Site Plan Program Outline to assist in the development of a site-specific LOTO program.

Appendix C contains a Sample Energy Control Procedure that can used to create a specific shutdown and powering up procedures for each applicable machine, process, or equipment (unless it meets the exclusion criteria.

Appendix D contains a Sample Contractor LOTO Validation to provide guidance for the Site LOTO Administrator in the determination of complaint contractor or vendor LOTO Programs.

Appendix E contains a Sample Forcible Lock Removal Process for use under emergency situations requiring the forcible removal of a LOTO device.

At Microsoft, data and documents are retained in compliance with the retention times set out in our Corporate Retention Schedule

The following terms are used in this document.  The definitions below are used in the scope of this document but local regulatory definitions override if there is a conflict. 

Affected Personnel: An individual who 1) uses a machine or equipment on which servicing, maintenance, or other work is performed under Lockout/Tagout or 2) works in an area where equipment is locked out.   

Authorized Personnel: An individual specifically trained to properly lock out or implement a lockout/tagout system procedure on specific machines or equipment. Authorized and affected employees may be the same person when the authorized employee's duties also include performing work on a machine or equipment upon which lockout/tagout is implemented.   

Double Block and Bleed: The closure of a line, duct, or pipe by closing and locking and tagging two in-line valves and by opening and locking/tagging a drain or vent in the line between the two closed valves.  

Energized: Equipment or machines connected to an energy source or containing residual or stored energy.  

Energy Isolating Device:  A mechanical device that may be used to physically prevent the transmission, flow, or release of energy, including but not limited to the following:  

• Electrical circuit breakers; 

• Slide gate; 

• Disconnect switches; 

• Piping flanges;   

• Control switches; and 

• Other similar devices.  

Energy Source: Any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal, potential, or other energy.   

Lockout: The placement of a lockout device and tag on a lockout device ensuring that the energy isolation device and equipment cannot be operated until the device is removed.   

Lockout Device: A device that physically controls the configuration of an energy isolation point. Lockout devices include but are not limited to the following:  

• Locks 

• Chains 

• Valve covers 

• Circuit breaker hasps 

• Blind flanges 

• Slip blinds, and   

• Multiple lock hasps  

Principle Lockout/Tagout employee: Employee who oversees or leads a group of servicing/maintenance workers during a group lockout.  

Safe Condition Check (Verification that equipment is de-energized): The inspection or test of a system or component performed by the Authorized employee to ensure that the hazardous energy or materials are controlled to prevent injury or accident. Note: This is an essential element of all energy control programs and procedures, which ensures the safety of all potentially exposed personnel.  

Supervisor or Controlling Organization Lock: A lock installed by an authorized supervisor for the purpose of maintaining control of a machine or piece of equipment for a period greater than one work shift.  

Tagout: The placement of a tagout device on an energy-isolating device, in accordance with an established procedure, to indicate that the energy-isolating device and the equipment being controlled may not be operated until the tagout device is removed.   

Tagout device:  Any prominent warning device, such as a tag and a means of attachment, which can be securely, fastened to an energy-isolating device to indicate that the machine or equipment to which it is attached may not be operated until the tagout device is removed. 

6.1 Microsoft Internal References 

• MS Policy 37019-2, Regulatory Compliance 

• MS Policy 37019-5, Regulatory Investigations, Inspections, and Inquiries 

• Microsoft Safety and Accident Prevention Program  

• Microsoft Vendor Code of Conduct

• Microsoft Electrical Safety Program

• Portable Power Tools Program

6.2 External References 

• OSHA, 29 CFR 1910.147, Control of Hazardous Energy (Lockout/Tagout) 

• Washington, WAC 296-803, Lockout/Tagout (Control of Hazardous Energy) 

• California Code of Regulations, Title 8, Section 3314, Control of Hazardous Energy for the Cleaning, Repairing, Servicing, Setting-Up, and Adjusting Operations of Prime Movers, Machinery and Equipment, Including Lockout/Tagout. 

• OSHA, Safeguarding Equipment and Protecting Employees from Amputations, OSHA 3170-02R, 2007 

• OSHA, Control of Hazardous Energy Lockout/Tagout, OSHA 3120-2002 (revised) 

• NIOSH, Guidelines For Control of Hazardous Energy During Maintenance and Servicing, DHHS (NIOSH) Publication 83-125 

• NIOSH Alert, Preventing Worker Deaths from Uncontrolled Release of Electrical, Mechanical, and Other Types of Hazardous Energy, DHHS (NIOSH) Publication 99-110 

• Cal/OSHA,A Practical Guide to Lockout/Tagout for Employers  eTool, Cal/OSHA Division of Occupational Safety and Health (DOSH)\

• NFPA 70E, Standard for Electrical Safety in the Workplace  

Microsoft managers may use this outline to produce a written Lockout/Tagout (LOTO) Site Plan for machines, equipment or processes under their control.  Please refer to Purpose and Scope for information on the applicability of LOTO to a specific area or facility.  The site-specific written plan must be tailored to identify or comply with the following:  

• Federal, state, or local regulations governing LOTO at the facility location  

• Machines, equipment, or processes covered under their program 

• Employees or contractors covered under their program. 

Managers must make the written LOTO Site Plan available to employees, contractors, and corporate or regulatory compliance officers. 

Purpose  

State the purpose of the Site Plan (ensure that personnel render onsite machines and equipment safe through isolating energy sources, prior to service and maintenance, and preventing equipment from unexpected startup, energizing, or releasing stored energy).  

Scope 

Describe the area or facility-specific operations that fall under this Site Plan (servicing or maintenance of machines or equipment when the energy source is electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other types of energy). 

Regulations  

A list of any applicable federal, state and local regulations must be included here.  For example, in the United States, federal regulations for LOTO fall under 29 CFR 1910.147, “Control of  Hazardous Energy (Lockout/Tagout)”.  However, individual states or local municipalities may have additional requirements.  

Roles and Responsibilities  

Personnel with responsibility for oversight or implementation of the LOTO Site Plan must be identified here.  This list need not include the names of specific individuals, but a specific job title and a summary of their role and area of responsibility must be included.  

Authorized and Affected Personnel  

Identify all of the authorized and affected employees for each machine, equipment or process that fall under the LOTO Site Plan.  It is possible that the authorized employee is also the affected employee, if the authorized employee's task involves work on the same machine where lockout/tagout was implemented.  

Workplace Survey and Hazard Assessment  

Summarize the workplace survey and hazard results for energy-source hazards at the workplace. This summary can be presented as a table for easy reference.  Be sure that the summary allows the reader to easily identify the referenced machine, equipment or process on the workplace floor.  This can be done by including photographs or floor maps in the document. 

Energy Control Procedures  

This section must include the rules or requirements for LOTO implementation.  For machines, equipment, or processes that qualify for LOTO, this section must describe step-by-step procedures for LOTO (setup and removal), any operating restrictions, how authorized employees must account for affected employees, and special circumstances, such as group LOTO, multiple shift LOTO transfers, or forcible removal of a lock.  

The LOTO procedures for some machines, equipment or processes may not require specific written documentation, and personnel may use a more generic LOTO procedure instead.  To exclude a tailored written description from the program, the manager must verify that ALL of the following conditions exist:  

1. Regulations applicable to the facility location do not prohibit this exclusion; 

2. Employees will not be endangered by stored or residual energy, or re-accumulation of stored energy, in the machine or equipment after shutting down;   

3. Only one energy source, one that employees can easily identify and isolate, provides energy for the machine or equipment;   

4. Isolating and locking out that single energy source completely de-energizes and deactivates the machine or equipment;   

5. Personnel performing service or maintenance always isolate and lock out the machine or equipment from that energy source;   

6. The use of a single lockout device achieves a locked-out condition;   

7. The authorized employee completing servicing or maintenance retains exclusive control of the single lockout device;   

8. Servicing or maintenance does not create hazards for other employees; and   

9. There have been no accidents that can be attributed to this exception during servicing or maintenance.  

If all of these conditions cannot be met, then the written LOTO Site Plan must contain step-by step instructions for LOTO tailored specifically for the machine, equipment or process.  

Some activities that take place during normal production operations, such as minor tool changes and adjustments, may not require LOTO.  These types of activities must be routine, repetitive, and integral to the use of the machine or equipment during production.  These activities must be called out in the written program, and still must provide an effective means of protecting personnel from harm. 

LOTO Devices 

Provide a summary of information on the lockout/tagout devices used at the site or facility.  This information can also be presented as a table.  Be sure to include how LOTO devices are identified, that the devices comply with regulatory standards (durable, standardized, substantial and identifiable), and information on the process for issuing or approving LOTO devices used by personnel.  

Training  

Information on training frequency and site-specific training content must be incorporated in this section.

Inspections

Two types of annual inspections must be part of the LOTO Site Plan.  The first involves an audit of the equipment-specific procedures. This allows for the identification and correction of deficiencies in the procedure.  The second is an evaluation of the LOTO Site Plan as a whole, to identify and eliminate roadblocks to implementation or communication.

A crucial part of programmatic inspection is the involvement of all levels of personnel, including authorized and affected personnel, supervisors, managers and contractors.  Proper implementation requires upwards and downwards communication, strong reporting requirements (near miss, incident, and accident reports), and effective corrective/preventative actions plans.  These important components should be specifically evaluated in the annual LOTO Plan review.

This electrical LOTO standard operating procedure is provided as a template to help managers and safety coordinators develop procedures for their location.  

Note: You must establish separate machine specific LOTO procedures for working on or around other electrical and non-electrical energy sources. 

Shutdown Process  

The following table describes what personnel should do in an electrical LOTO shutdown process.  

Restoring Equipment to Operating Status  

Once the maintenance or other work has been completed, the equipment can be restored to operating status. Use the following procedure. 

Who does this apply to?

This section applies to all Microsoft locations where external staff or subcontractors work and where an unexpected release of energy to or from any equipment could cause an injury to contractor or Microsoft employees. These guidelines are intended for individuals working at Microsoft sites and/or working on Microsoft equipment at any location.

Objectives

When external staff or subcontractors work on Microsoft machines, equipment or vehicles, their activities have the same or greater potential for exposing facility employees to servicing hazards as would exist if facility employees were performing the work. These hazards can pose a threat to the external staff, subcontractors and facility employees.

The guidelines in this section are intended to help your location prevent incidents associated with those hazards.

1. During contract discussions, a Microsoft representative will be assigned to external staff or subcontractors to ensure:

   • Microsoft expectations regarding LOTO out are communicated to the external staff or subcontractors.

   • The external staff or subcontractors are knowledgeable about the lockout system to be used and associated procedures and rules.

   • External staff or subcontractor employees will be trained in their individual responsibilities and general lockout requirements and/or Equipment Specific LOTO prior to commencing work.

   • Compliance with agreed upon LOTO rules and procedures is expected and will be audited for compliance.

2. Prior to commencing work at the site, all external staff or subcontractor employees will be trained in their individual responsibilities and general lockout requirements. The same policies, procedures and rules that apply to employees apply to external staff or subcontractors as well.

3. When LOTO is required, a the LOTO Site Administrator must do all of the following:

   • Explain each lockout procedure that will be used to complete the job.

   • Put his/her locks on the proper lockout points first.

   • Ensure the proper LOTO has been completed for the work to be done.

   • Remove his/her locks last before the equipment is returned to service.

4. A site representative qualified in LOTO procedures must conduct equipment specific lockout audits to verify the use of proper lock out procedures.

5. In special circumstances, external staff or subcontractor employees may be authorized by the site to place locks without a site representative placing locks first. An Authorized external staff or subcontractor employee is one who has:

   • Been approved as competent to complete unsupervised lockout by the LOTO Site Administrator.

   • Has extensive site experience - minimum one-year equivalent service.

   • Must complete annual site lockout refresher training and demonstrates competency.

   • Is knowledgeable of the equipment where work is being performed and has been fully trained in the facilities LOTO Program and has received Equipment Specific LOTO training on the equipment.

6. In some cases, a group lock box process may be used at the discretion of the site.

7. The lock box process must be in writing and must be reviewed by external staff or subcontractors using the process.

8. External staff or subcontractors may take on primary responsibility for LOTO procedures for new equipment installations under the following conditions.

   • The installation of new equipment is not connected to existing site processes.

   • The equipment is under the sole control of external staff or subcontractor employees.

   • This exception expires when the new equipment is turned over to Microsoft for startup.

Tags will not be used in place of locks where equipment is capable of being locked out. For mobile equipment, businesses will determine which vehicles will use locks versus tags as the preferred method.

Regulatory Interpretation

Whenever external staff or subcontractors are engaged to perform work at a facility on facility machines, equipment or vehicles, facility management must inform external staff or subcontractor representatives of the LOTO procedures used by the facility.

Facility management must also verify that the LOTO procedures to be used by external staff or subcontractors are at least as protective of facility employees as the procedures used by the facility. In addition, facility employees must understand and comply with the restrictions or prohibitions of the LOTO procedures used by external staff or subcontractors.

If any of the steps in the external staff or subcontractor’s procedures fail to cover significant or essential conditions of the workplace which could adversely affect the safety of the facility employees, action must be taken by the Microsoft facility manager to minimize the potential for injury to his/her employees.

Under normal circumstances, a lock or tag must never be removed by anyone except the person whose name appears on the lock or tag.  Some emergency situations, however, may require forcible removal of a lock.  

• Your location should develop and document specific procedures for these cases. 

• A supervisor must be notified before a lock is forcibly removed. 

• The lock must be removed only under the direction of at least two designated persons (for example, the supervisor and an employee), using the documented procedures.