I think I've come up with a way to make the Graceport things work. The basic problem is that you have to be able to verify correct operation of the device before AND after testing. Doing it before is pretty easy. The problem is detecting that the device is still functioning after LOTO. The idea we had is to wire up a 3 or 4 pole push button switch that temporarily connects the device to a separate power source. Thus we can quickly test before and after.

There is no standard out there that I've found specifying what is acceptable for voltage testing below 1000 VAC. About the only thing I have found is that "Wiggies" are a recipe for destroying all of your electronics (inductive kick), and that none of the noncontact voltage meters out there are supported by their own manufacturers as acceptable to testing for absence of voltage due to the number of potential false positives and negatives.

Now you have a second source to the equipment and this will have to be locked out and tagged out prior to working on the equipment. How do you test to verify that the second source is not connected?

Wow... this is absolutely the worst thing to do from a safety standpoint. Jog or test switches wired to bypass the normal starter "start" circuit is very dangerous especially with PLC control logic. Many times control logic uses contactor aux switches as inputs to start sequence operations (i.e. turn on other processes, pump equipment, etc). By bypassing the engineered logic and safety controls can result in unexpected equipment start ups out of sequence. Very dangerous.
The following is a true story:

A machine operator is running a PLC controlled conveyor feed system for a 600 hp paper pulper. The conveyor stops because one of the photoeyes detects a 450 pound bail of pulp is not properly aligned on the conveyor. The operator fails to see it and can't figure out why it stopped. Instead of calling maint dept, he calls his production supervisor and they enter the MCC room. The supervisor finds the conveyor starter - the starter door has a loto "test switch". The supervisor thinking it will fix the problem, proceeds to actuate the test switch which is wired to the contactor coil and bypasses the plc and all safety interlocks. Long story short... the conveyor starts, the plc logic locks in the run circuit and the 450 pound bail launches itself off the belt and destroys two $3,500 HMI panels and rips a $15,000 belt. Machine down time 9 hours. Lucky nobody was in the area when the 450 pound bail fell off. It could have been stopped if the operator station control panel E-stop was pushed except there wasn't anyone there to hit the button. Next day all the starter LOTO test bypass switches in the paper mill were removed.

This is the "Wet paint sign" mentality... people always touch to see if its actually wet paint.

Proper LOTO:
1) Shut off and lock out starter.
2) Return to equipment control panel and push start to verify the right equipment was loto and didn't start.
3) Verify all energy sources are off.

You should take care that the LOTO procedure does not disable the control circuit so that Step 2 does not really verify the main disconnecting means if a separate motor disconnecting means is used.

We had a client who added 4 kV disconnect switches on the load side of the starters to use as a LOTO motor disconnecting means. The client put an auxiliary switch from the 4 kV disconnect switch in the motor starter circuit to prevent the motor disconnect from being energized when the 4 kV disconnect was open.

We recommended eliminating this interlock because if the main disconnect contacts did not open, but the auxiliary switch did, then verifying the the LOTO by pushing the start at the control panel would not show that the main disconnect contact was open, only that the control circuit was disabled. Work cannot be done on the motor disconnect itself without applying LOTO with the motor starter disconnecting means, which de-energizes the starter and the motor disconnect.

A kerf key system would be my recommendation that interlocked the 4160v motor local disconnect and the starter. I've seen quite a few 480v starter disconnect aux switches fail.

Reading through this chain and several others (e.g., “PPE With Covers ON,� “returning loto to energized position,� “Is FR PPE required for 'all' deadfront operations?,� Arc Flash Risk Assessment Methodology,� etc.), it seems to me that there is no consensus as to what level of PPE should be required or what can be deemed entirely safe without PPE when operating disconnects, circuit breakers, etc. Some of the many postings are dated before the 2012 edition of NFPA 70E, and collective knowledge continues to evolve. Thus, I’ll present a draft procedure with some questions at the end and gladly welcome all feedback as to whether the procedure is reasonable/practical, too conservative, too risky, too complex for operators/non-electrical persons, missing something, or entirely off the mark for any items.

Below are select excerpts (not all steps included) from a "draft" update to a company CONTROL OF HAZARDOUS ENERGY PROGRAM, which is to be used for general lockout/tagout (LOTO) (Subchapter J; per OSHA 1910.147 Appendix A, Typical minimal lockout procedures) such as to change a saw blade and not for an electrical lockout (Subchapter S) directly in accordance with NFPA 70E. Note: arc flash labels could be generated by either of the two methods allowed in NFPA 70E (2012 ed.), i.e., mostly from assigning Hazard/Risk Categories from Tables 130.7(C)(15)(a) & (b) and sometimes from Incident Energy Analysis using Annex D engineering calculations.

**************************************************
Excerpts of draft LOTO procedure:

VIII. ENERGY CONTROL PROCEDURES (SEQUENCE OF LOCKOUT)

2. If the equipment is in operation shut it down using normal shutdown procedure. Turn the equipment off if there is an on/off switch. This is to ensure the electrical load has been shed before any operating electrical energy-isolating device in step 3.

3. Open the circuit breaker (CB), disconnect switch or other energy-isolating device or valve (i.e., turn to the “OFF� or opened position). Toggle switches, push buttons, and other types of control switches are not energy isolating devices. Operation of electrical circuit breakers and disconnect switches are considered interactions with equipment that “may� cause an arc flash. When operating disconnects or circuit breakers (i.e., opening to OFF or closing to ON), stand to side of enclosure (on same side as switch so not reaching across equipment), hold breath, and turn face and body away (even with PPE on). PPE or additional constraints will be required as follows:
a. Disconnect or CB less than 100 Amps * – no additional PPE required other than normal PPE for normal duties.
b. Disconnect or CB 100 Amps to less than 400 Amps * - arc flash PPE Level 0** required (includes long sleeve shirt (nonmelting, natural fiber such as 100% cotton with fabric weight of at least 4.5 oz/yd^2), heavy duty leather gloves, etc.). PPE Level 2** if at motor control center (unless lower hazard calculated and listed on arc flash label or otherwise documented by an Arc Flash Hazard Assessment/Analysis document).
c. Disconnect or CB 400 Amps and above – Only to be performed by qualified electrical workers using arc flash PPE with minimum rating of highest Hazard/Risk Category (PPE Level**) listed on arc flash label on that particular equipment.
* - 3a and 3b above assume equipment in good working condition with all covers properly and securely fastened and with no missing hardware or openings exposing interior parts or not properly sealed.
Otherwise, regardless of amperage size of circuit, 3c shall be followed if:
- equipment is not in good condition or has “exposed� interior electrical parts;
- if there is any evidence of previous arcing (burn marks on equipment);
- if amperage of circuit is not marked or unknown; or
- for operating disconnects or CBs on 480 volt main distribution panels/switchboards and switchgear and on all equipment operating above 480 volts.
** - Refer to company Arc Flash Safety Program for PPE requirements.

XV. RESTORING EQUIPMENT TO SERVICE

6. Verify that the controls are in neutral and normal startup switch(es) are in “OFF� or opened position(s) to avoid having an electrical load when operating the electrical energy-isolating device in step 8.

7. Remove locks and tags.

8. Close the circuit breaker, disconnect switch or other energy-isolating device or valve (i.e., turn to the “ON� or closed position). See step 3 in section VIII. ENERGY CONTROL PROCEDURES (SEQUENCE OF LOCKOUT) for procedural and PPE requirements. Note that 3c shall be followed if any electrical work was done on any components of locked out electrical circuits (such as re-wiring a motor) regardless of amperage size of circuit.

9. Notify all Affected employees that the lockout condition has been cleared.

10. Turn on the equipment using normal startup procedure using normal on/off switch(es) as applicable and verify equipment is operating properly.
**************************************************
Additional comments/questions:
1. I saw a photo of a guy with a 3rd degree burn allegedly from a 480V, 60A disconnect. I do not know if he was operating the disconnect under general LOTO or if he was working on it with exposed, energized parts. Are there any statistics for unqualified persons (operators, staff, et al.) being injured or killed while operating disconnects or circuit breakers under general LOTO?

2. Per NFPA 70E (2012 Ed.) Table 130.7(C)(15)(a), the Hazard/Risk Category is 0 for "Circuit breaker (CB) or fused switch operation with covers on" with no insulated gloves or tools required either. This seems too high in some cases and two low in others. Is there guidance that relaxes below PPE Level 0 when potential probability and severity are very low and requires above PPE Level 0 as risks become more unacceptable—perhaps based on listing types of equipment, voltages and amperages? Does anyone have such other specific guidance that is simple, clear, concise, and both practical and reasonably safe for use with general LOTO?

Wiring a jog/run button directly across the motor contactor is a huge safety issue by itself, especially if you are also bypassing the overload relay. Be careful that any time you do this that you have looked at all interlocks that are being bypassed.

That being said the most common and best way I like to do it is with a jog/off/auto (JOA) switch. The jog function is spring loaded so that it cannot be used for production purposes. There are a couple equally valid ways of wiring this. One is to wire the inputs back to the PLC and have the PLC do "jog" control. The other is to wire a separate manual output and an auto output to the switch which selects between them.

From a safety/reliability point of view, humans have a reliability in non-stress, non-emergency conditions of around 10^-1 (they do the right thing 90% of the time). PLC's, contactors, and PB's all run around 10^-5 or better (usually orders of magnitude better) so the old concern about providing manual bypasses around a PLC is outdated. Humans are much more likely to mess up a manual override than hardware failures. 3 Mile Island is a testament to humans "knowing better" and manually overriding safety systems.

This is true. Operating a disconnect is far less risky though from a risk (likelihood of failure) point of view than pushing a start button mounted on the same panel. Racking out a draw out circuit breaker is just about the most risky thing you can do with respect to disconnecting power, roughly an order of magnitude greater risk than opening/closing the circuit breaker itself. And disconnects are about 1 order of magnitude safer than circuit breakers. From IEEE data on reliability if we use 10^-5 to 10^-6 as the likelihood cutoff when the risk is a fatality. then we need to be concerned about wearing PPE when racking breakers and depending on where you are standing, triggering contactors to open or close. Outside of those when it comes to disconnecting power for LOTO purposes, the probability of injury in the first place is a tolerable risk. IF on the other hand you are doing one of those activities then it becomes important to look at the arc flash hazard. If the hazard is >1.2 cal/cm^2 then you need to be wearing appropriate PPE. If not, then "category 0" is the order of the day. The whole idea of "reducing PPE" that is encoded in the tables in 70E is ridiculous. If the arc flash hazard is not being reduced such as by increasing working distance, then PPE should not be reduced. Either PPE is required (because the probability of an arc flash hazard is too likely to be an acceptable risk) or it's not.

Now since virtually all plants consider racking breakers to be a qualified personnel only task, with the possible exception of pushing starter buttons, the whole argument about wearing arc flash PPE for Subchapter J (non-electrical) or O (non-maintenance) lockouts is silly and misses the obvious...not what is the hazard but what is the risk.

Taking a knee jerk reaction of assuming that the likelihood is ALWAYS intolerable results in silly results like the idea that you can't enter an electrical room without PPE or the idea that the secretary has to suit up in a 40 cal/cm^2 suit to turn on a light switch.



While true, are you going to require arc flash PPE to turn on a light switch or a coffee maker? Again, what's the risk here? Is it tolerable?


If a breaker fails, it will see the short circuit current of the system upstream until the upstream breaker fails. Even if we assume that all interactions with equipment are inherently dangerous, this does not address the hazard which may or may not require PPE. Hence the reason the tables in 70E are written quite a bit differently and include maximum fault current and opening times.



Don't use the word exposed without explaining it. You wouldn't believe how much trouble this causes. Otherwise agree with the approach...this is no longer serviceable except by qualified personnel.



Interesting...you consider there to be an arc flash hazard in some cases when opening a disconnect but not closing it?? If anything given that it is pretty darned likely that there was not a short or arcing fault when it was opened (serviceable requirement above), the chance of such occurring is pretty slim. But closing onto equipment that just had maintenance performed on it...wow, this makes no sense. In my opinion there is far greater risk of finding an arcing fault during closing than opening events. Whether again that risk is tolerable or not is another issue.



For all industries, the ESFI recently did a report where they were finding a rate of 0.2 shock fatalities per 10K employees per year and 0.1 arc flash fatalities. This does not break it down by activity but does give you a data point overall. ESFI also has data by industry if you want to further break it down. Construction is about 60% of the fatalities if I recall correctly.

Going from the other direction, IEEE Gold Book has failure rate data for the devices you are referring to that indicates the percentage of failures that are due to arcing failures vs. other types. It also has data indicating failures during specific activities such as during opening or closing but doesn't indicate the mode of failure (arcing, etc.) so you can't correlate the two but just pick whichever gives you the lower probability of failure and assume 100% of failures are attributed to the undesirable consequence.

Taking this approach, and using industry standards for tolerable risks to fatalities, the probabilities for the activities you are referring to are around 10^-6 or lower based on IEEE 493 data for arcing faults. Granted the IEEE Gold Book data is very old and refers to a lot of out of date equipment, but then again, that's the stuff most of us are concerned about anyways.



No. The issue at hand is that the melting/ignition temperature for many types of synthetic fabrics is extremely low. You are below the 1.2 cal/cm^2 point so likely you could consider dispensing with the long sleeve shirt and glove business and still be within the intention of 70E but since there are no rules for this you are going to have to stand on your own two feet or quit trying to apply a standard developed for Subchapter S in Subchapter J conditions.

Alright, I will date myself, as a young summer hire at Bethlehem Steel; Cornwall and Grace mines,we were taught never ever to stand in front of a switch when operating it, we stood to the right and used "Left Hand to operate." One day at Grace an electrician called the crusher plant and asked "are you shut down". "Yes, I am." However the primary crusher large synchronous motor was running, It just was not crushing ore. Well, need I say a synchronous motor with no load running with a leading power-factor is not what the switch manufacture considers no-load. The electrician stood to the side of the no-load 4,160 Volt, 600 Ampere no-load break disconnect, operated and all the guts went flying out the front. Since he was standing to the side in cotton clothing with safety glasses and hard hat, he was not injured. I was shown the remains of the switch by the Electrical Foreman. He asked me, "Do you see why we should not stand in front of any disconnect when we operate it?" I suggest all electricians and employee operators should be trained and shoid be wearing cotton clothing, hard hats and safety glasses. These was Bethlehem Steels rules 55 years ago, and things have gotten more, not less dangerous.

Lots of confusion here. LOTO is what is defined in OSHA Subchapter J. This is a general lockout for general maintenance purposes. Something similar is also defined in Subchapter R (1910.269) for generating stations. "Service", machine adjustment, etc., where guards have to be removed or workers have to be in what is effectively harms way is slightly different and qualifies for "alternative" methods (ANSI Z 244.1). This is a Subchapter O "lockout". Putting equipment into an electrically safe work condition is far more stringent than any of these and is most similar to confined space procedures in that you are working with a hazard that may not be visible. This is defined in Subchapter S, although there are also at least two more variants of it defined in Subchapter R (269), and frankly the Subchapter R versions are better written.

Now the confusing part. 70E refers to "hazard analysis" everywhere. This is not what is or should be required and because the terminology is poorly defined, we get confusing results. What OSHA requires under the general duty clause is a risk assessment. There are several of these defined as ANSI standards (PMMI, RIA, TR3., Z244.1) as well as several international standards (IEC 61511, 61508, ISA S88.1, etc.). There are variations in the rigor and the intended scope but they all come down to analyzing the severity of the hazard, and the likelihood of occurrence, which are then combined and equated to a risk. For example, being hit by a meteor is pretty much a fatality. However we do not then erect meteor shields across the company parking lot because the likelihood of this happening is very low; hence, the risk is not zero but is low enough that it is considered an acceptable risk. Similarly although people can and do get caught once in a while in escalators and the injuries can be pretty bad, again the likelihood of a severe injury is pretty low and thus risk is low.

In looking at the various risk assessment methodologies as it applies to arc flash in particular, there is a basic problem. The industry standards at the end of the day attempt to shoot for somewhere around a 1:100,000 chance of a life threatening injury per worker per year for an event such as an arc flash. This is what is considered an acceptable risk. Many of these methodologies such as TR3 or RIA also assume that the frequency of exposure is measured in the number of times per year, and then add a third analysis factor to look at how often those exposures turn into an injury. At this point we don't have enough data to quantify the "shape of the curve" and thus get from exposure to likelihood of injury so that factor would be 100%. We also don't need to worry about injuries less than a life threatening one because we don't have enough data and because it is an exponential curve so the difference between life threatening and no injury is pretty slight. Thus TR3 and RIA for instance would not be good risk assessment models to use. I would recommend IEC 61511 because it is a standard intended for the chemical industry where dangerous conditions are infrequent, less than once a year for the most part. This closely corresponds with electrical equipment failure rates that are similarly less than once a year and sometimes as low as 10^-12 (the assumed reliability of control wiring in the chemical industry).

Another issue that we have though is that there is not a lot of data quantifying how often a hazardous condition (arcing fault) occurs, nor under the conditions in which it occurs. There is some failure data out there though, and it does quantify how often arcing faults occur, but not the source, and includes "average" maintenance conditions. So we do have something to go on as far as how likely it is for equipment defects to turn into an arcing fault. When it comes to human performance, we hit a brick wall. Human performance is known to be pretty fallible though with what numerical data exists, and the failure rates are MUCH higher than 1:100,000 which was the goal. So we may as well consider that any task where human performance relates to the likelihood of an arc flash is 100%. This is the same assumption that is made with regards to shock hazards, so it is definitely not without precedent.

Further, IEEE 1584 does contain just one small section where it refers to actual likelihood data, and it is not the kind of data that we'd like to see. It does a confidence test on the results and shows that depending on how you look at it, there is between a 5 and 10% chance that even with the calculated incident energy value, PPE selected according to ASTM 1959 will NOT result in adequate protection, meaning a 2nd degree or worse burn to the face/chest area. So what we gain by wearing the PPE is an order of magnitude improvement in reduction of the likelihood of injury. If we are looking at a 10% chance of human error (a typical number used in QC circles), then we have a 1% chance of injury, EVEN if arc flash PPE is worn. That is strictly speaking nowhere near the 1:100,000 rating that was required. Thus it turns out that just wearing arc flash PPE is certainly NOT adequate and that we need to design the possibility of injury out of the task.

Using this guidance it becomes practically possible to look at the likelihood and thus RISK of an arc flash in a meaningful way that withstands OSHA scrutiny. Until we get something better from the 70E safety standard, we are on our own to define what are acceptable risks and when.

The following are what I've come up with following the above:
1. Opening/closing molded case breakers that have not tripped: no PPE needed.
2. Reading meters, operating controls, etc., with doors closed: no PPE needed.
3. Opening or closing draw-out breakers with solid grounding: wear PPE.
4. Opening or closing draw-out breakers with resistance grounding: no PPE needed.
5. Withdrawing or inserting draw-out breakers: wear PPE.
6. Taking voltage readings with multimeters where the exposed tips are less than the phase-to-ground and phase-to-phase distance: no PPE needed.
7. Taking voltage readings with multimeters where the exposed tips are more than the phase-to-ground or phsae-to-phase distance: no acceptable PPE.
...

You get the idea. From what it appears to be, 70E is going to be including a similar table in the 2015 edition (it's in the first draft) and the terminology is going to be cleaned up to differentiate between electrical hazards and electrical risks, matching the terminology that is used in international and national standards. At that point we will have an interesting situation because the prevalent attitudes seem to be:

1. With doors closed and latched, risk is minimal. Flies in the face of taking at least some precautions of considering what is known about equipment state such as whether or not it is faulted (and thus by OSHA standards is considered unsafe to simply reset), or there are obvious visible signs of damage or contamination, and whether or not a maintenance program based on standards (as per Article 2xx of 70E) is followed.
2. With doors closed and latched, taking into account the other previously mentioned factors, risk is either minimal or PPE is required.
3. PPE is always required because all electrical equipment is inherently dangerous. This argument is very weak for two reasons. First, it suggests that arc flash PPE is 100% effective while relying on standards that say that it isn't. Second, if we take this position then a standards-based maintenance program is not necessary because we made the assumption that PPE is 100% effective.

What folks need to accept here is that there are ALWAYS risks in every activity no matter what. You can't even lie in bed without having some risks that some random unforseen event occurs which results in death. There are no absolutely guarantees. So what we need to get to is a point of comparing risks. To be able to say that one risk is acceptable and another is not. And not knee-jerking it if while taking what is considered an acceptable risk a negative consequence occurs. However and not just because of the money/time/talent involved not every organization can financially do this. Thus we also need industry standards like the tables in 70E that provide an industry consensus safety standard that we can all adhere to as a starting point and only modify it up or down if we have the resources and documentation to safely do so.

This is NOT a good idea. Motor control is tricky to get "right" with PLC control.

Option 1 is to provide a "local jog" only button.
Option 2 is to provide an HOA switch (hand-off-auto). This has the advantage of a local "off/stop" function AND a local "run" function via the "hand" position (hand=manual run". However this violates the concept of a single dedicated "stop" button, and can cause equipment to spontaneously start unexpectedly whenever interlocks are satisfied. Also you'll find lots of operators that like to just leave it in "hand" thus bypassing any/all automatic controls during normal running, overflowing tanks, etc.
Option 3 is a hybrid with a "JOA" (jog-off-auto) button and the one I recommend using. It has jog but is forced back into a "stop" function which avoids surprises, fooling PLC algorithms, etc.

There are also two ways of wiring these things up. One is to wire the jog/hang function directly to the starter. I've seen it done even to the point of bypassing the overload relay (NEC and OSHA violation). This bypasses ALL safety interlocks provided by the PLC. Also since the PLC can't detect what is going on, it can end up into a "force-run" condition or in a "force stop but it's still running" condition, causing all kinds of chaos to ensue. Although most of these can be programmed around, it's just bad practice. Instead of this, it is vastly safer to wire the jog/hand signal back to the PLC itself. In a full implementation (JOA switches), we have just 4 wires: a neutral, a PLC output to the starter, a PLC input from the jog position, and a PLC input from the auto position. Whether these are hardwired locally or not for additional protection is sometimes done but not necessary with PLC's. I'd encourage it with a DCS since DCS reliability is so poor and a DCS may or may not go to "outputs off" state when it faults. This does require some sort of additional "contactor aux" feedback and if you want to differentiate starter issues may also require overload relay aux contact feedback to allow the PLC to recognize when to clear the "run" command to avoid auto-restarting without operators telling it to restart.

Thank you for outlining the correct safety procedures for working inside the bucket and on the motor. Your step-by-step explanation provides clarity on how to ensure safety during these tasks. It's reassuring to know that there's no need for electrical PPE due to the deadfront nature of the work environment.