Lockbox Systems for Multi-Crew, Multi-Shift Lockouts

Four mechanics on one press can share a hasp. A two-week outage with 25 people, 14 isolation points, three shifts and two contractors cannot. On a job that size, the danger stops being a missed valve and starts being a lost track of who is exposed. Paper mills, refineries, food plants, power houses and large HVAC plants all run jobs like this. Under 29 CFR 1910.147(f)(3), each worker still needs protection equal to their own personal lock. This covers how crews do that, using OSHA's enforcement directive, CPL 02-00-147, as the guide. Those examples are not the only legal methods, and your employer's written procedure decides which one you use.

What You Will Be Able to Do

• Choose between a hasp, a lockbox, satellite boxes and a job lock.
• Explain what the primary and principal authorized employees each answer for.
• Run the sequence for a master lockbox with crew satellite boxes.
• Keep protection continuous through a shift change.
• Bring contractors and temporary workers into a group lockout.

Why Lockboxes Exist

A lockbox holds the keys to the equipment locks. Workers then lock the box, not each isolation point. The math shows why this matters.

Worked example: A job has 14 isolation points and 25 workers.

1. If each worker locks each point: 14 x 25 = 350 lock placements, and 350 more removals.
2. With a lockbox: 14 equipment locks, plus 25 personal locks on the box = 39 placements.
3. Nobody has to walk the whole system with a pocket full of locks. Each worker's single lock keeps all 14 points closed, because the keys stay in the box until the last lock comes off.

Who Answers for What

The rule puts primary responsibility on an authorized employee for a set number of workers. On a large job, the directive describes these roles:

Titles vary by plant. Some call the primary the lockout coordinator or job owner. When more than one crew, craft or department is involved, the rule requires one person to hold overall control of the job.

The Four Common Setups

The directive shows four types, from small to large.

Type D is added to the others. A job often uses all three of B, C and D at once.

Running a Master and Satellite Lockbox

Here is the sequence for a job with several crews.

1. The primary prepares. They confirm the procedure, the list of isolation points and the crews on the job.
2. Operations shuts down. Notify affected employees first.
3. Isolate and lock. The primary, or people working under them, lock each isolation point. Log each one on a sheet: point ID, position, lock number.
4. Release stored energy. Bleed, block, drain and discharge, following the procedure.
5. Verify. Confirm that isolation worked, point by point.
6. Put the keys in the master box. Check the key count against the sheet.
7. Apply the job lock if the job crosses shifts.
8. Each crew leader locks the master box, and puts the key to that lock in the crew's satellite box.
9. Each crew member locks the satellite box before starting work.

Taking it down runs in reverse. A crew leader's key stays trapped in the satellite box until every crew member's lock is off it. The crew leader's lock stays on the master until then. The keys in the master box cannot come out until every crew lock and the job lock are gone.

Warning: The box only protects you if your own lock is on it. Being on the crew list is not protection. OSHA's directive is clear that accounting for people by word of mouth is not equal to a personal lock.

Verification on a Large Job

On a smaller job, each worker verifies the isolation or watches it done. OSHA accepts an alternative for complex jobs with many workers and many isolation points. The primary verifies the isolation before workers add their locks. But each worker must then be told they have the right to verify it themselves, and be allowed to if they choose. That check happens after they put their lock on, and before they start.

Use that right when you are new to the system, the job has changed, or something does not look right. Ask to see the sheet, the gauge or the open disconnect. Nobody should treat that as an insult.

Tracking Who Is Exposed

The primary must be able to learn the exposure status of each person in the group. That means knowing who is still working on the equipment at any moment. A lock on the box answers it, and a sign-in board or log can back that up. Neither one replaces the other.

Rules that keep this honest:

• Nobody signs on or off for someone else.
• Nobody puts on or takes off another person's lock, except under the absent-worker procedure.
• You put your lock on when you start, and you take it off when you stop.
• A worker who moves to a different system locks onto that system's box too.

Scope changes. Work grows during outages. If a crew needs to open a line that is not on the isolation list, stop. The primary adds that point, isolates it, verifies it and adds its key to the box before anyone opens it. An isolation list is only good for the boundary it describes.

Shift Changes

The rule requires continuity of protection, with an orderly transfer between outgoing and incoming workers. There can be no gap. The directive lists four accepted methods.

Overlap is the simplest when shifts meet. The incoming worker locks on first, then the outgoing worker locks off.

Job locks and transfer locks. A job lock is the first lock on the box and the last one off. Each shift's primary holds a key to it, and no one else does. While it stays on, outgoing workers can take their personal locks off and go home. The system stays isolated overnight, even with no personal locks on the box. Nobody may start work until they have added their own lock and confirmed the isolation is still good.

Continuity devices are treated differently from personal locks in one way. They may be marked with a department, such as "Maintenance," rather than a person. The person who removes one may not be the person who applied it, as long as the written procedure allows that. The hardware still has to meet the same durability and strength rules as any other lock.

Worked example: A job runs across three 8-hour shifts with no overlap between second and third.

1. At 11:00 p.m., second-shift workers finish and remove their personal locks. The job lock stays on.
2. Between 11:00 and 11:15, nobody is working in the system. It is still isolated.
3. The third-shift primary reviews the isolation sheet and the handoff notes with the second-shift primary. Both are told about any open lines or changes.
4. Third-shift workers learn the type and size of the energy involved, then lock onto the box.
5. They verify that the isolation is still good, then start work.

Step 4 matters. A worker who arrives after a shutdown must still know the hazards and controls. Being told "it's already locked out" is not enough.

A good handoff note covers what is open, what is blocked, what changed, and what the next shift should watch, such as a gauge that has been creeping up.

Contractors and Temporary Workers

Outside personnel include contractors, service reps and workers from a staffing agency. Under 1910.147(f)(2), the host and the outside employer must tell each other about their lockout procedures, and the host must make sure its own workers understand and follow the restrictions in the contractor's program.

The outside employer may use the host's procedure, its own, or a combination, as long as the result meets the standard. A common setup has the host isolate its equipment, and the contractor's workers add personal locks to the group box. They then verify the isolation before they begin.

Before the contractor starts, settle:

1. Whose procedure applies, in writing.
2. Who isolates and who verifies.
3. Whose lock hardware goes on the box, and how you tell it apart.
4. Who the contractor's crew leader answers to.
5. What happens if a contractor's worker leaves the site with a lock still on.

A contractor who has never seen your plant does not know your hidden energy sources, so walk them through. Never assume their lock program matches yours.

Ending the Job

1. Each worker finishes, clears tools and removes their own lock.
2. Crew leaders check that their crew is out, then remove their own locks.
3. The primary walks the system. Guards go back on, blanks come out, and valves are checked against the sheet.
4. The job lock comes off, and the keys come out of the master box.
5. Count the keys and match each one to its lock on the sheet.
6. The primary notifies operations and affected employees, and the restart follows the procedure.

Partial restarts. Sometimes part of a system goes back into service while another part stays down. Treat that as a new boundary. Update the sheet, confirm that nobody working on the rest depends on what is coming back, and verify again.

Common Mistakes

Check Your Understanding

1. A job has 8 isolation points and 12 workers. How many lock placements does a lockbox save compared with each worker locking each point?

Without a box: 8 x 12 = 96. With a box: 8 + 12 = 20. That saves 76.

2. You arrive for night shift. The job lock is on the box, and no personal locks are on it. May you start?

Not yet. Learn the hazards and controls, add your personal lock, and confirm that the isolation is good.

3. A pipefitter on your crew says, "Just tell the leader I'm in there, I lost my lock." What do you say?

No. He needs a lock on the box before he works. A verbal note does not give him equal protection, so he gets a replacement lock first.

4. Halfway through an outage, a crew needs to pull a pump that is not on the isolation list. Who acts?

The crew stops and tells the primary. The primary adds the isolation, verifies it, and puts the key in the box before the pump is touched.

5. A contractor's crew shows up with their own locks and wants to go straight to work. What has to happen first?

The host and contractor must exchange lockout procedures, and agree who isolates and how the contractor's workers join the group lockout. Then the crew locks on and verifies.

Key Takeaways

• Lockboxes let each worker protect themselves with one lock, however many isolation points there are.
• A primary answers for the whole job, and each crew has someone who knows who is exposed.
• Each worker's personal lock is required. A list or a verbal check is not equal protection.
• Continuity devices such as job locks protect the system between shifts, and do not replace your own lock.
• Each worker on a new shift learns the hazards, locks on, and confirms the isolation before starting.
• Contractors and temporary workers are covered, so settle the procedure with them before work starts.