This Alert describes five fatal incidents in which workers contacted uncontrolled hazardous energy during installation, maintenance, service, or repair work. To prevent such deaths, the recommendations in this Alert should be followed by every employer, manager, supervisor, and worker who installs, maintains, services, or repairs machines, equipment, processes, or systems. NIOSH requests that trade journal editors, safety and health officials, and others responsible for worker safety and health bring this Alert to the attention of employers and workers who are at risk.

Only the worker who installs a lock and
tag should remove them after work is
complete and inspected.

Number of Workers Killed

No detailed national data are available on the number of workers killed each year by contact with uncontrolled hazardous energy. However, during the period 1982–1997, NIOSH investigated 1,281 fatal incidents as part of their FACE Program. Of these, 152 involved installation, maintenance, service, or repair tasks on or near machines, equipment, processes, or systems. Because the FACE program was active in only 20 States between 1982 and 1997, these fatalities represent only a portion of the U.S. workers who were killed by contact with uncontrolled hazardous energy.

Contributing Factors

Review of these 152 incidents suggests that three related factors contributed to these fatalities:

• Failure to completely de-energize, isolate, block, and/or dissipate the energy source (82% of the incidents, or 124 of 152)

• Failure to lockout and tagout energy control devices and isolation points after de-energization (11% of the incidents, or 17 of 152)

• Failure to verify that the energy source was de-energized before beginning work (7% of the incidents, or 11 of 152)

In a study conducted by the United Auto Workers (UAW), 20% of the fatalities (83of 414) that occurred among their members between 1973 and 1995 were attributed to inadequate hazardous energy control procedures specifically, lockout/tagout procedures. The energy sources involved in these fatalities included kinetic, potential, electrical, and thermal energy [UAW 1997].

Current Occupational Safety and Health Administration (OSHA) standards for general industry are established to prevent injuries and fatalities from contact with hazardous energy [29 CFR* 1910.147]. This standard requires employers to "establish a program consisting of energy control procedures, employee training and periodic inspections to ensure that before any employee performs any servicing or maintenance on a machine or equipment where the unexpected energizing, start up or release of stored energy could occur and cause injury, the machine or equipment shall be isolated from the energy source, and rendered inoperative."

Other OSHA standards for general industry cite the need for de-energizing electrical energy and locking and tagging electrical circuits and equipment before performing maintenance and servicing tasks. The following OSHA standards contain lockout/tagout-related requirements:

OSHA standards for construction also contain requirements for protecting workers from electrical hazards [29 CFR 1926.416 and 29 CFR 1926.417]. These standards require that workers exposed to any part of an electrical power circuit be protected through de-energizing and grounding of the circuit or through appropriate guarding. These standards also require that all de-energized circuits be rendered inoperable and tagged out.

Workers may be exposed to hazardous energy in several forms and combinations during installation, maintenance, service, or repair work. A comprehensive hazardous energy control program should address all forms of hazardous energy [NIOSH 1983]:

• Kinetic (mechanical) energy in the moving parts of mechanical systems

• Potential energy stored in pressure vessels, gas tanks, hydraulic or pneumatic systems, and springs (potential energy can be released as hazardous kinetic energy)

• Electrical energy from generated electrical power, static sources, or electrical storage devices (such as batteries or capacitors)

• Thermal energy (high or low temperature) resulting from mechanical work, radiation, chemical reaction, or electrical resistance

As part of the FACE Program from 1982 through 1997, NIOSH investigated 152 fatal incidents in which workers contacted uncontrolled hazardous energy. The following case reports summarize five of these investigations.

Case No. 1—Uncontrolled Kinetic Energy

A 25-year-old male worker at a concrete pipe manufacturing facility died from injuries he received while cleaning a ribbon-type concrete mixer. The victim's daily tasks included cleaning out the concrete mixer at the end of the shift. The clean-out procedure was to shut off the power at the breaker panel (approximately 35 feet from the mixer), push the toggle switch by the mixer to make sure that the power was off, and then enter the mixer to clean it.

No one witnessed the event, but investigators concluded that the mixer operator had shut off the main breaker and then made a telephone call instead of following the normal procedure for checking the mixer before anyone entered it. The victim did not know that the operator had de-energized the mixer at the breaker. Thinking he was turning the mixer off, he activated the breaker switch and energized the mixer. The victim then entered the mixer and began cleaning without first pushing the toggle switch to make sure that the equipment was de-energized. The mixer operator returned from making his telephone call and pushed the toggle switch to check that the mixer was de-energized. The mixer started, and the operator heard the victim scream. He went immediately to the main breaker panel and shut off the mixer.

Within 30 minutes, the emergency medical service (EMS) transported the victim to a local hospital and then to a local trauma center. He died approximately 4 hours later [NIOSH 1995].

Case No. 2—Uncontrolled Electrical Energy

A 53-year-old journeyman wireman was electrocuted when he contacted two energized, 6.9 -kilovolt buss terminals. The victim and two coworkers (all contract employees) were installing electrical components of a sulfur dioxide emission control system in a 14-compartment switch house.

The circuit breaker protecting the internal buss^† within the switch house had been tripped out and marked with a tag—but it had not been secured by locking. This procedure was consistent with the hazardous energy control procedures of the power plant.

The victim and his coworkers were wiping down the individual compartments before a prestartup inspection by power plant personnel. Without the knowledge of the victim and his coworkers, power plant personnel had energized the internal buss in the switch house. When the victim began to wipe down one of the compartments at the south end of the switch house, he contacted the A-phase buss terminal with his right hand and the C-phase buss terminal with his left hand. This act completed a path between phases, and the victim was electrocuted.

A coworker walking past the victim during the incident was blown backward by the arcing and received first-degree flash burns on his face and neck. A second coworker at the north end of the switch house heard the explosion and came to help. He notified the contractor's safety coordinator by radio and requested EMS. The EMS responded in about 15 minutes and transported the victim to a local hospital emergency room where he was pronounced dead [NIOSH 1994].

Case No. 3—Uncontrolled Kinetic Energy

A 38-year-old worker at a county sanitary landfill died after falling into a large trash compactor used to bale cardboard for recycling. The cardboard was lifted 20feet by a belt conveyor and fed through a 20- by 44-inch opening into a hopper. The hopper had automatic controls that activated the baler when enough material collected in the baling chamber. When the baler was activated, material in the chamber was compressed by a ram that entered the chamber from the side. Excess material above the chamber was trimmed by a shearer.

On the day of the incident, cardboard jammed at the conveyor discharge opening. Without stopping, de-energizing, or locking out the equipment, the victim rode the conveyor up to the discharge opening to clear the jam. He fell into the hopper and the baling cycle was automatically activated, amputating his legs. The victim bled to death before he could be removed from the machine [Colorado Department of Public Health and Environment 1994].

Case No. 4—Uncontrolled Potential Energy

The 32-year-old owner of a heavy equipment maintenance business died after a wheel and tire assembly exploded during repair work. The victim was removing the assembly from a test roller when it exploded and struck him with the flying split rim of the wheel.

The test roller was a large, two-wheeled cart that carried about 60,000 pounds of concrete weights. The roller was used in highway construction to test road surfaces for proper compaction.

The victim had been working as a subcontractor to repair the wheel and tire assembly, which had been smoking earlier in the day and was believed to be rubbing against the concrete weights. The assembly consisted of a two-piece outside rim and an inside ring retainer that was held together and mounted on the axle by 20 wheel bolts and nuts. Normal air pressure for the mounted tire was 70 psi.

The victim raised and blocked the roller. Without discharging the air from the tire and using no personal protective equipment, he began to remove the wheel nuts using a pneumatic impact wrench. He had no training or experience with this type of work or in the servicing of this type of wheel. He did not realize that only some of the bolts held the wheel tire assembly to the axle. The remainder held the outer half of the rim to the inside half, securing the tire to the wheel. As the victim removed the nineteenth wheel nut, the pressurized air in the tire discharged explosively, causing the split rim to fly off the wheel and strike him. He died from cerebral contusions and lacerations [Minnesota Department of Health 1992].

Case No. 5—Uncontrolled Kinetic and Thermal Energy

A 33-year-old janitorial worker died after he was trapped inside a linen dryer at a hospital laundry while cleaning plastic debris from the inside of the dryer drum. The cleaning task (which usually took 15 minutes to an hour) involved propping open the door to the dryer with a piece of wood and entering the 4- by 8-foot dryer drum. The melted debris was removed by scraping and chiseling it with screwdrivers and chisels. The dryer was part of an automated system that delivered wet laundry from the washer through an overhead conveyor to the dryer, where it was dried during a 6-minute cycle with air temperatures of 217^° to 230^°F. The system control panel was equipped with an error light that was activated if the dryer door was open, indicating that the dryer was out of service.

On the night of the incident, the victim propped the door open and entered the dryer drum without de-energizing or locking out the dryer. He began to clean the inside of the drum. Although the error light had been activated when the door was propped open, the signal was misinterpreted by a coworker, who restarted the system. When the system was restarted, the overhead conveyor delivered a 200-pound load of wet laundry to the dryer—knocking out the wooden door prop, trapping the victim inside, and automatically starting the drying cycle. The victim remained trapped inside until the cycle was completed and was discovered when the load was discharged from the dryer. He died thirty minutes later of severe burns and blunt head trauma [Massachusetts Department of Public Health 1992].

Review of the NIOSH FACE data indicates that three related factors contribute to injuries and deaths that occur when workers perform installation, maintenance, service, or repair work near hazardous energy sources:

• Failure to completely de-energize, isolate, block, and/or dissipate the hazardous energy source

• Failure to lockout and tagout energy control devices and isolation points after the hazardous energy source has been de-energized

• Failure to verify that the hazardous energy source was de-energized before beginning work

These fatalities could have been prevented if comprehensive hazardous energy control procedures had been implemented and followed.

NIOSH recommends that employers implement the following steps to prevent injuries and deaths of workers who must work with hazardous energy in their jobs:

1. Comply with OSHA regulations.

2. Develop and implement a hazardous energy control program.

3. Identify and label all hazardous energy sources.

4. De-energize, isolate, block, and/or dissipate all forms of hazardous energy before work begins.

5. Establish lockout/tagout programs that
   —require workers to secure energy control devices with their own individually assigned locks and keys—only one key for each lock the worker controls;^‡
   —require that each lock used to secure an energy control device be clearly labeled with durable tags to identify the worker assigned to the lock;
   —make sure that the worker who installs a lock is the one who removes it after all work has been completed; and
   —if work is not completed when the shift changes, workers arriving on shift should apply their locks before departing workers remove their locks.

6. Verify by test and/or observation that all energy sources are de-energized before work begins.

7. Inspect repair work before reactivating the equipment.

8. Make sure that all workers are clear of danger points before re-energizing the system.

9. Train ALL workers in the basic concepts of hazardous energy control.

10. Include a hazardous energy control program with any confined-space entry program.

11. Encourage manufacturers to design machines and systems that make it easy to control hazardous energy.

These recommendations are described in more detail in the following sections.

Employers and workers must comply with OSHA regulations for controlling hazardous energy during maintenance and installation work (see 29 CFR 1910.146, 1910.147, 1910.177, 1910.178, 1910.179, 1910.181, 1910.213, 1910.217, 1910.218, 1910.261, 1910.262, 1910.263, 1910.265, 1910.269, 1910.272, 1910.305, 1910.306, 1910.333, 1926.416, and 1926.417). OSHA standards and accepted safe work practices require employers to ensure that all hazardous energy sources are de-energized before work begins. If these sources cannot be de-energized, OSHA requires employers to protect workers with insulation, guarding, and appropriate personal protective equipment.

Employers should develop and implement a written hazardous energy control program that, at a minimum,

—describes safe work procedures,
—establishes formal lockout/tagout procedures,
—trains all employees in the program, and
—enforces the use of the procedures (including disciplinary action for failure to follow them).

Hazardous energy control programs should outline the following safe work practices:

• Identify tasks that may expose workers to hazardous energy.

• Identify and de-energize all hazardous energy sources, including those in adjacent equipment.

• Lockout and tagout all energy-isolating devices to prevent inadvertent or unauthorized reactivation or startup.

• Isolate, block, and/or dissipate all hazardous sources of stored or residual energy, including those in adjacent equipment.

• Before beginning to work, verify energy isolation and de-energization, including that in adjacent equipment or energy sources.

• After work is complete, verify that all personnel are clear of danger points before re-energizing the system.

Hazardous energy control among work groups must be coordinated when multiple employers are involved in large projects and when shift changes occur during such activities. Outside contractors should work with the facility owner to make sure that an adequate hazardous energy control program is implemented specifically for contract workers.

Employers should use jobsite surveys to ensure that all hazardous energy sources (including those in adjacent equipment) are identified before beginning any installation, maintenance, service, or repair tasks. Hazardous energy includes mechanical motion, potential or stored energy, electrical energy, thermal energy, and chemical reactions. Energy-isolating devices such as breaker panels and control valves should be clearly labeled [NIOSH 1983].

All forms of hazardous energy should be de-energized, isolated, blocked, and/or dissipated before workers begin any installation, maintenance, service, or repair work. The method of energy control depends on the form of energy involved and the available means to control it. Energy is considered to be isolated or blocked when its flow or use cannot occur [NIOSH 1983].

To isolate or block energy, take the following steps:

• Disconnect or shut down engines or motors that power mechanical systems.

• De-energize electrical circuits by disconnecting the power source from the circuit.

• Block fluid (gas, liquid, or vapor) flow in hydraulic, pneumatic, or steam systems by using control valves or by capping or blanking^§ the lines.

• Block machine parts against motion that might result from gravity (falling).

Some forms of energy must also be dissipated after a system has been de-energized. System components such as electrical capacitors, hydraulic accumulators, or air reservoirs may retain sufficient energy to cause serious injury or death even though the component has been de-energized, isolated, or blocked from the system and locked out.

Energy can be dissipated by taking the following steps:

• Vent fluids from pressure vessels, tanks, or accumulators until internal pressure is at atmospheric levels. However, do not vent vessels or tanks containing toxic, flammable, or explosive substances directly to the atmosphere.

• Discharge capacitors by grounding.

• Release or block springs that are under tension or compression.

• Dissipate inertial forces by allowing the system to come to a complete stop after the machine or equipment has been shut down and isolated from its energy sources.

Lockout/tagout programs should be based on the principle of only one key for each lock the worker controls.** This means the following:

—Workers are assigned individual locks operable by only one key for use in securing energy control devices (breaker panels, control valves, manual override switches, etc.).
—Each worker maintains custody of the key for each of his or her assigned locks.**
—Each lock is labeled with a durable tag or other means that identifies its owner.
—When work is performed by more than one worker, each worker applies his or her own lock to the energy-securing device. Scissors- type hasps made of hardened steel are available to facilitate the use of more than one lock to secure an energy control device.
—All de-energized circuits and systems are clearly labeled with durable tags.
—The worker who installs a lock is the one who removes it after all work has been completed [NIOSH 1988].
—If work is not complete when the shift changes, workers arriving on shift apply their locks before departing workers remove their locks.

Because tags can be easily removed, they are not a substitute for locks. Workers are safest with a program that uses both locks and warning tags to prevent systems from being inadvertently re-energized [NIOSH 1988].

Employers should establish and enforce company policies requiring workers to verify that all energy sources are de-energized before work begins. This verification should ensure that all energy sources (including stored energy) are controlled (that is, de-energized, isolated, blocked, and/or dissipated) before work begins. Appropriate testing equipment should be required as needed.

To ensure that equipment will operate as expected when it is re-energized, employers should require qualified persons to inspect completed installation, maintenance, service, or repair work. The inspection should verify that installation, repairs, and modifications were performed correctly and that the correct replacement parts were used. When equivalent or updated parts must be substituted for original parts, the system may need to be modified. Re-energized equipment should be closely monitored for several operating cycles to ensure that it is functioning correctly and safely.

Employers should develop procedures to verify that all persons are clear of danger points before re-energizing the system. Locks and tags should be removed only by the workers who installed them—and only after workers have been cleared from the danger points. This may require visual inspections and searches of areas around machinery or electrical circuits to assure that workers will not be exposed to the release of hazardous energy when equipment is re-energized. Workers should be informed about impending equipment start-up with warning devices they can see and hear. Such devices will help assure that workers are clear before equipment is re-energized.

When work requires entry into confined spaces such as utility vaults or tanks, employers should incorporate a hazardous energy control program as part of their confined-space entry program—according to OSHA standards [29 CFR 1910.146 and 1910.147] and published NIOSH guidelines [NIOSH 1979, 1987].

Employers should encourage manufacturers to design control valves, switches, and equipment that are easy to access and lockout.

Principal contributors to this Alert were Paul Moore and Tim Pizatella of the NIOSH Division of Safety Research (DSR). Injury data were provided by the Health and Safety Department, International Union, United Auto Workers (UAW). Cases presented in this Alert were contributed by Georjean Madery, formerly of the Minnesota Department of Health; Lyle McKenzie, Colorado Department of Health; and Jon Lifvergren, formerly of the Massachusetts Department of Health. Stephanie Pratt, DSR, provided data analysis, and Larry Reed, Division of Physical Sciences and Engineering, provided many helpful comments and suggestions. Dwayne Smith, formerly of DSR, provided the first working draft of this Alert.

Please direct comments, questions, or requests for additional information to the following:

We greatly appreciate your help in protecting the safety and health of U.S. workers.

Linda Rosenstock, M.D., M.P.H.
Director, National Institute for
   Occupational Safety and Health
Centers for Disease Control and
   Prevention

CFR. Code of Federal regulations. Washington, DC: U.S. Government Printing Office, Office of the Federal Register.

Colorado Department of Public Health and Environment [1994]. Thirty-eight-year-old recycling technician dies as a result of injuries sustained when he fell into a cardboard compactor. Denver, CO: Colorado Department of Health and Environment, Colorado Fatality Assessment and Control Evaluation (FACE) Report No. 94CO029.

Massachusetts Department of Public Health [1992]. Custodian dies in a confined space in a hospital laundry. Boston, MA: Massachusetts Department of Public Health, Massachusetts Fatality Assessment and Control Evaluation (MA FACE) Report No.91–02.

Minnesota Department of Health [1992]. Owner of heavy equipment maintenance business dies after being struck by an exploding split rim of a test roller tire. Minneapolis, MN: Minnesota Department of Health, Minnesota Fatality Assessment and Control Evaluation (MN FACE) Report No.MN9208.

NIOSH [1979]. Criteria for a recommended standard: working in confined spaces. Morgantown, WV: U.S. Department of Health, Education, and Welfare, Public Health Service, Center for Disease Control, National Institute for Occupational Safety and Health, DHEW (NIOSH) Publication No. 80–106.

NIOSH [1983]. Guidelines for controlling hazardous energy during maintenance and servicing. Morgantown, WV: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control, National Institute for Occupational Safety and Health, DHHS (NIOSH) Publication No. 83–125.

NIOSH [1987]. A guide to safety in confined spaces. Morgantown, WV: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control, National Institute for Occupational Safety and Health, DHHS (NIOSH) Publication No. 87–113.

NIOSH [1988]. NIOSH testimony on the Occupational Safety and Health Administrations proposed rule on the control of hazardous energy sources (lockout/tagout), September 8, 1988, OSHA Docket No.S012A. Cincinnati, OH: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control, National Institute for Occupational Safety and Health.

NIOSH [1994]. Journeyman wireman electrocuted after contacting energized switchgear components at power plant West Virginia. Morgantown, WV: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control and Prevention, National Institute for Occupational Safety and Health, Fatality Assessment and Control Evaluation (FACE) Report No. 9410.

NIOSH [1995]. Laborer fatally injured while cleaning concrete mixer Tennessee. Morgantown, WV: U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control and Prevention, National Institute for Occupational Safety and Health, Fatality Assessment and Control Evaluation (FACE) Report No. 9512.

UAW [1997]. An analysis of trends in fatal injuries related to lock-out failure in UAW-represented worker populations. Detroit MI: International Union, United Automobile, Aerospace and Agricultural Implement Workers of America UAW, UAW Health and Safety Department.