Safety disconnect system as a lockout energy isolating device

NOTICE: This is an OSHA Archive Document, and may no longer represent OSHA Policy. It is presented here as historical content, for research and review purposes only.

January 5, 1998

Mr. Richard J. Hackman
The Proctor & Gamble Company
Ivorydale Technical Center
[Recipient address omitted]
Dear Mr Hackman:

This is in response to your November 8, 1996 letter and enclosure, requesting interpretation/variance with the energy isolation device requirements of 29 CFR 1910.147. Please accept our apology for the delay in responding.

In your letter you described a safety disconnect system ("system") which protects directly wired load circuits to (functionally interconnected) process machines from being energized by an electrical source. Also, you stated that this system is intended for use with process machines where it is impractical to provide manually-operated disconnects at every point of access. Further, you disclosed that direct power interruption on the large drives of these process machines is infeasible because the disconnects require a significant effort to operate, are difficult to position in the (production) line layout, and are not constructed for frequent use.

As noted in your letter, the safety disconnect system includes the following four basic, component groups: a power contactor, a control power transformer and fuses, voltage sensing relays, and a safety lockout switch with verification light. An optional component is used to establish a required neutral point for the voltage sensing relays, if the power being monitored is derived from an ungrounded system.

The following system safety features are noted relative to the results of the failure analysis included in your letter:

• The system measures and ensures no motive force to the drive system.

• The system provides fail-safe verification, that is, defaults to the safe position.

• Verification is provided by a system which actively confirms zero-energy state to the drives before the verification light comes on.

• When an individual initiates the lockout sequence by opening the system switch and placing a lock on it, then the verification light will come on, if the machine is at a zero-energy state.

• If the light goes out due to bulb failure while an authorized employee is performing servicing and maintenance on the machine, the system remains safe because the switch is open and locked out.

• The system is designed such that failure of any component in the system will not result in the light coming on when the machine is in an unsafe mode.

• The system is contained in sealed, protected box.

• The equipment used is certified by a nationally recognized testing laboratory.

• An independent laboratory did a system risk analysis and determined the proposed system presented the lowest risk to the operator.

Based on the information enclosed in your letter, your "safety disconnect system" has been evaluated as an inherently fail-safe system which performs the same function as an energy isolating device identified in paragraph 1910.147(b). When used as an energy isolating device, this "safety system" must be addressed in the energy control program required in §1910.147(c)(1).

Of particular concern is other hazardous energy sources which are not isolated by the safety disconnect system. For example, the machine glue heaters are directly connected (on the supply side of the safety disconnect system) to the hazardous electrical energy source. Potential employee exposure to glue heater hazardous electrical and thermal energy during servicing and maintenance of machines must be addressed in the energy control program.

We appreciate your interest in employee safety and health. If we can be of further assistance, please contact the Office of Safety Compliance Assistance, Mr. Ronald J. Davies, telephone (202) 219-8031, extension 110.

Sincerely,

John B. Miles, Jr., Director
Directorate of Compliance Programs