Plant Safety & Situational Awareness
Hazard recognition, permits, PPE, and working around live process equipment.
- Hazard versus risk
- Finding every energy source
- The hierarchy of controls
- Permits and their conditions
- Working around live plant
What it is
Situational awareness is a diagnostic skill. It is not a poster, and it is not the ten seconds of nodding you do before signing a form.
It is the ability to walk up to a machine you may never have seen and answer three questions before you touch anything: what here can move, what here can release, and who else is working on this. Everything else in this chapter is a method for answering those three reliably, under time pressure, on a plant that is still running around you.
The reason it is the first chapter is that every other skill in this course assumes it. You cannot measure a circuit you have not made safe to approach, and a diagnosis is worth nothing if arriving at it puts you in hospital.
Hazard and risk are not the same word
A hazard is something with the potential to cause harm — stored pressure, a rotating shaft, 400 V, a chemical, a load suspended overhead. Hazards are properties of the plant. They are there whether or not anybody is present.
Risk is the chance that a particular hazard harms a particular person doing a particular thing. Risk depends on you: where you are standing, what you are about to do, what you know, and what you have controlled.
The distinction matters because it tells you what you can change. You very rarely get to remove a hazard on a callout at two in the morning. You almost always get to change the risk.
The plant does not know you are there
This is the sentence worth carrying out of the chapter. A machine has no awareness of you. It has a sequence, a set of inputs, and a PLC that will do exactly what it was told the moment its conditions are met.
That has a consequence people learn late and expensively: a machine that is not moving is not the same as a machine that is safe. It may be waiting on a sensor. It may be part-way through a cycle with a timer running. It may be under remote control from a station you cannot see. It may be stopped only because upstream has starved it, and upstream is about to recover.
Stillness is not a safety condition. Isolation is, and that is Chapter 2.
How it works
Energy is the thing you are actually looking for
Almost every serious injury on a plant is stored or transmitted energy arriving somewhere a person is. So the useful habit is to stop cataloguing machines and start cataloguing energy.
| Energy | Where it hides | What tells you it is there | | --- | --- | --- | | Electrical | Supply, control transformers, drives, capacitors, batteries, UPS | Panel labels, drive DC-bus warnings, humming, warmth | | Pneumatic | Receivers, accumulators, lines downstream of an isolator | Gauges, hissing, cylinders parked mid-stroke | | Hydraulic | Accumulators, lines, jacked or raised assemblies | Pressure gauges, warm oil, a load held up by nothing visible | | Gravitational | Raised platens, lift tables, counterweights, suspended loads | Anything above head height that is not mechanically blocked | | Stored mechanical | Springs, tensioned belts, take-ups, wound-up drives | Take-up screws, spring returns, tensioners | | Thermal | Steam, hot oil, heaters, motors that have been running | Lagging, warning triangles, your own hand at 300 mm | | Chemical | Process lines, CIP circuits, coolant, batteries | Line labels, smell, PPE stations nearby | | Rotational inertia | Fans, flywheels, large rotors after stop | Coast-down time — some fans run for minutes |
The list matters more than it looks. The commonest fatal mistake is not failing to isolate — it is isolating one energy source, feeling protected, and walking into a second one that was never on the list. Electrical isolation on a machine with a raised platen and a charged accumulator has controlled a third of the problem.
The hierarchy of controls, and why PPE is at the bottom
When you are deciding whether a job is safe to do, you are really asking which control is protecting you and how much weight it will bear.
Read it as a reliability ranking, not a menu. Elimination and substitution act on the hazard and keep working when everybody is tired. Engineering controls — a fixed guard, an interlock, a physical isolator — work whether or not you remembered them today. Administrative controls — procedures, permits, training, signage — only work if a human reads and follows them. PPE works only if it is present, worn, correct for the hazard, and undamaged.
The trap is that the ranking runs almost exactly opposite to visibility. Nobody photographs a well-designed interlock. Everybody notices a missing glove. Sites under pressure drift down the hierarchy because the bottom is the part that can be audited from a distance — which is how a plant ends up with excellent PPE compliance and a guard that has been defeated for two years.
Permits are a conversation with a record attached
A permit to work is not paperwork. It is a structured conversation between the person who owns the plant and the person about to work on it, and the document is only the receipt.
The permit types you will meet most often:
- Hot work — welding, grinding, cutting, anything producing sparks or flame. Usually carries a fire watch and a defined period after the work stops, because ignition is often delayed.
- Confined space — anywhere with restricted entry and exit and a potential atmosphere problem: tanks, silos, pits, some large machine enclosures. Atmosphere testing, a standby person, and a rescue plan are the substance; the form is not.
- Working at height — anything where a fall is possible, which includes far more of a plant than people expect.
- Line breaking — opening any pipe or vessel that has contained a product, chemical, steam or pressure.
- Electrical work — live working in particular, which normally needs a specific authorisation, not just a general permit.
What actually makes a permit work is its conditions and its validity. A permit says what has been isolated, what has been tested, what must stay in place, and for how long. When those conditions change — a shift ends, a second crew arrives, an isolation is lifted, the atmosphere test ages out — the permit is no longer telling the truth about the plant, whatever it says on the paper.
Reading a live process area
Working around running plant is a normal part of the job. Being deliberate about it is what separates a technician who does it for thirty years from one who has an accident in the first two.
Use your senses as instruments, and know what each one is worth. Sound is the fastest and most sensitive channel you have — you will hear a bearing, a leak or a motor labouring long before an instrument shows it. Smell catches hot insulation, burning belts and coolant. Sight catches the slow things: a browned terminal, a hydraulic weep, a build-up where product is escaping. Touch is the one to be careful with, because the temperatures that damage a hand arrive faster than the reflex to move it.
Know where you are standing. Not in a line of fire, not under a suspended load, not inside the swing of a robot or the pinch of an infeed, not where an opening door will trap you. Ask yourself where you would go if something let go right now, and make sure that place exists before you need it.
Know how the machine starts. Remote start from an HMI at the other end of the line, an automatic restart after a fault clears, and a colleague pressing reset without knowing you are inside are three routes to the same injury.
What normally fails
Situational awareness does not usually fail in a dramatic way. It erodes, and the erosion is comfortable — which is exactly why the failure modes below are worth studying as failure modes rather than as character flaws.
- Symptom
- A shortcut that everyone takes, has always worked, and nobody can remember deciding to adopt
- Likely cause
- Normalisation of deviance — a deviation that produces no consequence becomes the new normal, then the baseline for the next deviation
- How common
- Very common
This is the single most reliable predictor of a serious incident, and it feels like competence from the inside. The guard has been off for a year and nobody has been hurt, so removing it reads as experience rather than risk. Ask how long the practice has been running and what changed when it started — usually a production pressure that has long since passed.
- Symptom
- Somebody puts hands into a machine that is stopped and it moves
- Likely cause
- Stillness mistaken for a safe state — the machine was waiting, not finished
- How common
- Very common
Waiting on a sensor, mid-sequence with a timer, starved by an upstream stoppage, or under remote control. The machine was doing exactly what it was designed to do. Nothing failed except the assumption. This is the failure Chapter 2 exists to prevent.
- Symptom
- A valid permit describes a plant that no longer looks like that
- Likely cause
- Conditions changed after issue — a shift handover, a second crew, an isolation lifted, an atmosphere test that has aged out
- How common
- Common
Permits fail far more often by going stale than by being wrong when written. The document is a snapshot; the plant is not. Treat the conditions on it as claims to re-verify at the point of work, not facts already established.
- Symptom
- Nobody knows where you are, and nobody would notice for hours
- Likely cause
- Lone working that was never planned as lone working — it just ended up that way on nights or during a callout
- How common
- Common
Rarely a decision, usually a drift. The risk is not that lone working is always wrong; it is that the controls that make it acceptable — someone knowing your location, a check-in interval, a radio — are absent because nobody framed it as lone working in the first place.
- Symptom
- Handover happens in a corridor and the incoming shift starts work on a machine mid-isolation
- Likely cause
- An isolation, a permit or a partial strip-down that lived in one person's head
- How common
- Common
Shift change is where the plant's memory is thinnest. Anything half-done at handover — a lock still on, a guard removed, a fuse pulled and pocketed — must exist as a physical, visible state and a written note, not as something the outgoing technician meant to mention.
- Symptom
- Excellent PPE compliance and a defeated interlock on the same machine
- Likely cause
- Drift down the hierarchy of controls, because the bottom band is the one that can be audited from across the floor
- How common
- Occasional
The plant looks safe in a walk-round and is not. Defeated interlocks, bypassed light curtains and taped-over sensors are the signature. They are almost always symptoms of a machine that cannot be set up or cleared without defeating them — which is a design and process problem, not a discipline problem.
How to troubleshoot it
This is not a fault-finding sequence. It is the sequence you run on arrival, before any of the fault-finding in the rest of the course begins. It costs three or four minutes and it is the cheapest thing in this course.
Stop at the boundary and look before you enter
SafetyDo not walk into the cell while you are still reading the work order. Stop at the edge and spend thirty seconds: what is running, what is stopped, what is raised, what is leaking, where are the other people, what does it smell like. You will never have a cheaper opportunity to notice something wrong, because from here you can still leave without having committed to anything.
Find out what the machine is supposed to be doing right now
Not what it is doing — what it believes it is doing. Is it in auto or manual? Faulted, or waiting? Mid-cycle with a timer running? Under local control, or can somebody start it from an HMI two hundred metres away? A stopped machine in auto with a satisfied fault is a machine about to run.
List every energy source, out loud if it helps
SafetyElectrical, pneumatic, hydraulic, gravitational, stored mechanical, thermal, chemical, rotational. Walk the list rather than trusting recall, because the one that hurts you is by definition the one you did not think of. Note which have residual energy that outlives their isolator — accumulators, capacitors, raised loads, coasting rotors.
Find out who else has an interest in this machine
Operators, another trade, a contractor, the shift that just left, a control engineer working remotely. Ask, and ask specifically: is anyone else working on this, and is anything already isolated or removed? A second person's half-finished work is invisible to you and will not announce itself.
Decide whether it genuinely needs to be live
SafetyMost work does not. Some diagnosis genuinely does — a fault that only exists while running cannot be found on a dead machine. Make that a decision rather than a default: if it must be live, it needs the correct authorisation, the correct PPE, and wherever possible a second person. If it does not, isolate it and stop thinking about it. See Chapter 2.
Get the permit, then check its conditions still hold
SafetyRead what it actually says is isolated and tested, and then verify that independently at the plant. A permit is a claim about the state of the machine at the moment it was written. Your life is being staked on the claim still being true now, and the gap is measured in shifts.
Set up your exit and your communications before you start
Where you would move if something let go, and whether that route is still clear once you have put a toolbox down in it. Whether anyone knows you are in there. Whether you can call for help from where you will actually be — inside a machine, on your knees, with the radio in a bag by the panel is not communications.
Re-run this whenever anything changes
SafetyA second person arrives, the shift changes, production restarts an adjacent line, you move to a different part of the machine, or the job turns out to be something other than what you were called for. Any of those invalidates the assessment you made on arrival. The most dangerous moment on most jobs is not the beginning — it is the point where the job quietly became a different job.
Common technician mistakes
None of these come from not caring. Every one of them has a reason that makes sense in the moment, which is precisely why knowing the reason is the defence.
Reading stillness as safety
WhyA stopped machine gives every sensory signal of being finished: no noise, no movement, nothing to react to. Your nervous system treats that as safe because in almost every other context it is. The correction is not vigilance, which fades — it is a rule that does not depend on how the machine looks: hands go in after isolation, never before.
Trusting an isolation you did not apply
WhyIt is genuinely reasonable to believe a colleague. The problem is that you cannot see what they isolated, only that something is isolated, and you have no way to know whether they found all eight energy sources or the first three. Personal locks exist for exactly this reason: your protection should not depend on the completeness of somebody else's mental list.
Treating the permit as the thing to be obtained
WhyUnder pressure the permit becomes an obstacle between you and the job, so the goal quietly shifts from being safe to having the paper. The tell is signing without reading the conditions. The permit is a record of a conversation — if the conversation did not happen, the record is a fiction that will be read out at an inquiry.
Wearing the hazard instead of removing it
WhyPPE is the visible control, so it feels like the responsible choice, and reaching for better gloves is faster than arguing for a guard. But choosing PPE where an engineering control was possible means accepting the hazard and betting on equipment that protects one person and fails silently. Ask what you are actually being protected from, and whether that thing needed to be there at all.
Not saying anything because you are new
WhyThe person most likely to spot a normalised deviation is the one who has not normalised it yet, and they are also the one least likely to speak. Being new is not a reason to stay quiet about something that looks wrong — it is the reason you can see it. The question "is it meant to be like that?" costs you nothing and has stopped more incidents than any procedure.
Rushing the last ten minutes
WhyGuards go back on, locks come off, and the machine is handed over — and by then the difficult part is over and the attention has already left. A large share of injuries happen during restoration, not during the work: a guard refitted loose, a lock removed while somebody is still inside, a test run with a tool left in the machine. Treat restoration as a task with its own checks, not as tidying up.
Hands-on challenge
Scenario
Bagger 3 — 'it's stopped, can you just have a quick look'
You are called to Bagger 3. The operator meets you at the guard door and says it has stopped twice this shift, there is no alarm on the screen, and could you just have a quick look because they are behind on the order.
What you can see from the boundary:
- The machine is silent and nothing is moving. The HMI shows the line in AUTO with no active alarm.
- The forming platen is raised, held up on its hydraulic cylinders.
- The air supply gauge on the panel reads 6 bar, and the hydraulic pack is running.
- The heat-seal bar was in production ten minutes ago.
- A spanner and a torch are sitting on the frame beside the infeed. The operator says a fitter "was looking at it earlier".
Write down, in order: which energy sources are present, which of them a single electrical isolation would not control, what you need to establish about other people before you go any further, and what you would say to the operator.
Show how to approach it
There is no fault-finding to do here yet. The whole exercise is what you establish, and in what order, before you touch anything.
- The machine is not stopped, it is waiting. No alarm on the HMI and an operator who says it "just stops" describes a machine sitting on a satisfied condition, not a faulted one. In auto, it will run the moment that condition clears.
- The raised platen is the hazard nobody named. It is held by hydraulic pressure, which is a control, not a block. Electrical isolation does not lower it and does not stop it lowering.
- Two energy sources are already known to be live — hydraulic and pneumatic — and there is a third you have been told about indirectly: the fitter's spanner means somebody has had this apart and may have left something in a non-standard state.
- Somebody else has an interest in this machine and is not here. Find the fitter before you do anything else. Their half-finished work is invisible to you.
- The heat-seal bar is thermal energy that stays hot long after the machine is dead. Isolating the supply makes it safe to touch electrically and not safe to touch at all.
- The correct next action is not a measurement. It is to decline the "quick look" as framed, establish who else is working on it, and then isolate properly — accepting that this takes longer than the person asking would like.
Knowledge check
Five questions. Each one is answerable by reasoning about a situation rather than by recalling a rule, which is the point of the whole course.
Question 1 of 5