
The step where nothing was recorded
Before anyone works inside a machine, its energy has to be isolated and locked off. The client had a procedure and a planning form for it. The form recorded the shutdown, the test and the unlocking, and recorded nothing at all at the step where the people doing the work put their own locks on. That is the step the whole procedure exists to protect.
Not every job needs the full procedure, and saying so is the point
A lockout procedure that is applied to everything gets applied to nothing, because people route around it. So the first thing the work did was define when it is required and when it is not.
Three triggers are considered: production, troubleshooting, and maintenance, servicing or cleaning. The last of those always requires the full procedure. The other two route through a decision, and where the answer is no, the machine falls into one of three categories with a shorter defined routine instead.
Category one is a single isolation point or no contact with dangerous parts. Category two adds a two point interlock plus a tool and protective equipment. Category three, fixed guard or no interlock at all, goes through the full sequence: plan, shut down and isolate, release residual energy, lock and test, personal padlocks, unlock.
The gap in the form
The existing planning template captures the machine name, the isolation categories and point codes at shutdown, the closing position and test marking at the lock and test stage, and the return position and signatures at unlocking.
At the personal padlock stage it captured nothing. No count of how many people are inside the machine, no record of a shift change. That is the stage where a worker attaches their own lock and keeps the key, and it is the stage that stops the machine starting while somebody is still in it.
The revised template adds the number of affected personnel and shift change information at that stage, plus the full energy source list and residual energy points at shutdown, the contractor name and contact details at lock and test, and emergency removal information at unlocking.
What the planning template recorded, and what it now records
Stage by stage comparison of the existing template against the revised one. The third row is the finding.
| Stage | Recorded before | Added |
|---|---|---|
| Personal padlocks | Nothing | Number of affected personnel, shift change information |
| Shutdown and isolation | Machine name, isolation categories, point codes | All energy source categories, residual energy points |
| Lock and test | Closing position, test marking, signature | Contractor name and contact details, supervisor signature |
| Unlocking | Return position, work complete marking, signature | Emergency removal information if it occurred |
Colour, keys and who supplies them
Three padlock colours carry three meanings. Red locks the isolation point and comes from the station, never from somebody personal set. Green is a personal lock belonging to an employee. Grey, always with a tag, is a personal lock belonging to an outside contractor.
The client supplies all of them, including to contractors, explicitly so that nobody arrives without the right equipment and improvises. That is a small procurement decision doing a large amount of safety work.
On keys, two architectures were compared. Every lock keyed differently is safer and harder to administer as isolation points multiply. Locks keyed alike per line is easier and, in the words of the analysis, weaker, because the system can be bypassed. The harder one was recommended. A master key exists for emergencies only, is held where only management can reach it, and its use has to be approved.
The two situations where procedures usually fail
Shift change and emergency lock removal are where a written procedure meets reality, so both were given a step sequence rather than a principle.
At shift change, both the outgoing and the incoming shift must be at the lock box together. Outgoing locks come off first, incoming locks go on after, and the change is recorded on the form. Nobody hands over a key.
For emergency removal, six steps: try to reach the lock owner, obtain management approval if that fails, have a trained person confirm removal is safe, remove with the master key, record it in two places, and tell the affected people and contractors why. The audit trail is the part that makes the exception survivable.
What the client was left holding, and what this work does not contain
A defined end to end procedure with role ownership at each stage, three machine categories with the right routine for each, a revised planning template, a colour and key convention, and six recommendations covering instructions, lock boxes, tags, stations and equipment supply.
There is a deliberate mechanism for the gap where a visual lockout instruction does not yet exist. Rather than blocking the work, the procedure routes it through a trained person plus a responsible manager, records the isolation and residual energy points found, and generates the missing instruction with a target date. The gap closes by being worked through rather than by being audited.
There is no measured result in this work and no number to report. No incident rate, no compliance score, no time saved, no cost. The deliverable is a procedure, and its value is what does not happen afterwards, which is exactly the kind of value that never appears in a figure.
Download the full case study
Have a similar requirement?
Contact us today to learn more about on-demand workforce and accelerate development on your most pivotal projects!
Accelerating Success for Enterprises in 20+ Geographies

Launch Your Sprint with
Download the full report
Enter your email to access this exclusive case study.


