September 28, 2005

Thank you for your August 24, 2005 memorandum requesting a review of the Exelon Generating Corporation's energy control procedure, which was developed pursuant to the Electric power generation, transmission and distribution, 29 CFR 1910.269, standard's group lockout/tagout (LOTO) requirements. The following information and reply to your question follow:

Background: The Occupational Safety and Health Commission (OSHRC) affirmed a citation against Exelon and stated that the 29 CFR 1910.269(d)(8)(ii)(D) requirement clearly and explicitly mandates the use of a personal tagout device in a group tagging situation because the core concept of LOTO is personal employee protection. Each employee in the group needs to affix his/her personal LOTO device as part of the group LOTO; verbal accountability methods do not afford protection equivalent to that provided by the implementation of a personal LOTO device. As a result, Exelon modified its energy control procedures (described in the court proceedings) to have each worker sign on and sign off of the Worker Tagout Tracking System List (WTTL). See the decisions in the Exelon Generating Corp., LaSalle County Station cases for additional detail — (OSHRC Docket No. 00-1198, 2001 & 2005).

Procedure: Exelon's Out-of-Service (OOS) procedure utilizes a control and accountability system to administratively control hazardous energy sources and to account for authorized employees through a system that consists of a Master Board, Out-of-Service Cards (equipment tagout devices), Personnel Protection Cards (PPC), WTTLs, a Work Package, and a Computerized Tracking System (CTS). The Master Board serves as a workforce coordination mechanism that integrates activities among the Operations and Maintenance Departments. The following is a partial description of the administrative control and continuous employee accountability system.

After all the OOS Cards are applied to the equipment energy isolating devices, a member of the Operations Department places another OOS Card onto the Master Board for that particular OOS Request. Thereafter, a Lead Worker (who has one PPC for his/her crew) hangs his/her PPC on top of the particular OOS Request (that is already on the Master Board), and then he or she puts the crew member names on the WTTL.

Each crew member signs on and off the WTTL for employee accountability purposes, and the WTTL is kept with the Work Package. The Lead Worker, after the work is completed and after all the crew members have signed off, takes their PPC off from its location on top of the corresponding OOS Request. The Maintenance Supervisor is then advised by the Lead Worker that the job is finished and the protection card has been removed. The Lead Worker also gives the Maintenance Supervisor the Work Package/WTTL and, after reviewing the material for completeness, the Maintenance Supervisor coordinates the job completion with Operations Department.

Prior to entering "Closed" in the OOS Request status section of the CTS, operations personnel perform a review the Work Package/WTTL to ensure all employees are accounted for and confirm that the supervisor released the OOS Request and properly entered the job status into the CTS.

Nonetheless, the employees' representative recently expressed serious concern with the company's procedure (or implementation of the procedure) because the WTTL is not affixed to the Master Board and is not transmitted to the Operations Department for review prior to re-energization.

Question: What must happen to the Worker Tagout Tracking List (WTTL) once it is signed by all the workers? In other words, must the WTTL be placed on the Master Board or be given to the operator responsible for re-energizing the power generation equipment after removing all the equipment tags?

Reply: The hazardous energy control procedures used in group lockout situations must provide each authorized employee with the same level of control that he or she would be afforded in a personal LOTO scenario. Thus, group lockout/tagout (LOTO) procedures must assure personal protection for each authorized employee by ensuring that each authorized employee is uniquely accounted for and that each authorized employee is the only person who can release his or her personal LOTO device or equivalent means of controlling hazardous energy sources. For additional information, see paragraph 1910.269(d)(8)(ii) and CPL 02-01-038, Appendix B, Issue #6.

These general principles can be applied to Exelon's situation. Preferably the WTTL would be placed on the Master Board during the course of the servicing and maintenance work so as to conspicuously convey the information regarding the status of authorized employees during any OOS Request. However, the performance-oriented nature of the standard would permit any other reliable and effective method that permits the Operations Department to readily ascertain the status of, and to account for, the maintenance employees through the WTTL over the course of the servicing and maintenance activity. In terms of performance, the Operations Department person(s)-in-charge of the power generation hazardous energy source(s) must be able to readily and reliably ascertain the identity of, and account for, each individual who is being protected by the master control and accountability system.¹

Furthermore, a system operator (or other person charged with removing a machine lock/tag and re-energizing machinery) may not rely on the word of another person, such as a Maintenance Supervisor or Lead Worker, because this practice transfers the personal control from the individual authorized employee performing the work to a middle-man, which is contrary to the intent of the standard. An Operations Department individual, such as a system operator, may not remove equipment tagout devices (OOS Cards) unless he or she first checks an administrative control and accountability device (e.g., WTTL) and verifies that each worker has authorized the lifting of the equipment tagout device (e.g., by signing off the WTTL). Each authorized employee protected by a device must have personal control (e.g., via their signature) over the energy source(s) and authorize the removal of LOTO devices through a master system of administrative control and individual accountability. The authorized employee WTTL sign-offs must be shared with, and reviewed by, the Operations Department because they ultimately control the hazardous energy that could cause serious employee injury or death.

With respect to the Exelon procedure, it appears that the procedure contemplates that the Operations Department personnel will have access to the WTTL because the procedure states that the WTTL is to be maintained with the Work Package, and the Work Package is supposed to be returned to the Operations Department prior to the re-energization of equipment. As such, pursuant to the procedure, prior to closing the status section on the CTS and subsequent LOTO device removal, Operations Department personnel must have access to, and must have reviewed, the authorized employee signatures on the WTTL.

In conclusion, the employee representative's complaint that no one in the Operations Department knows who is on the WTTL appears to reflect a failure in the implementation of the OOS Procedure. If so, a minor change in the manner in which the procedure is implemented (e.g., enforcing a practice that gets the WTTL back to the Operations Department, such as attaching the WTTL to the OOS Request on the Master Board when the job is complete), should allow the Operations Department representative to ascertain the identity of, and to account for, each authorized employee who is being protected by the energy control procedure prior to re-energizing the equipment. In addition, it may be prudent for Exelon to clarify these steps in the procedure to better assure compliance with the provisions of the procedure. On the other hand, if it is not Exelon's intent that procedure require the WTTL (or similar personal accountability device) be returned to the Operations Department for review prior to re-energization of the equipment, the procedure does not provide a level of protection equivalent a personal LOTO scheme, and the procedure must be amended (and subsequently implemented) so as to provide the level of protection required by the standard.

I hope you find this information helpful. Should you have any additional questions, please feel free to contact Walt Siegfried, CSP of my staff, at (202) 693-1850.

¹ Master tags, sign-in/out logs, work permits and other personal accountability devices are personal tagout devices as long as: (1) they identify each authorized employee being protected and (2) the person in charge, system operator, and other relevant persons reliably can ascertain the identity of, and account for, each authorized employee who is being protected by each respective device. If a personal accountability device permits the person in charge, system operator, or other relevant persons to determine whether each authorized employee is either working under the protection of the device or has authorized the removal of the equipment lock/tag, it sufficiently accounts for each individual who is being protected by the master control and accountability system. [ back to text ]