The Isolator Nobody Locked
You are the maintenance planner at a bakery in Nicosia. On Friday 14 February an electrician was replacing the bearing in the planetary head of dough mixer 2 during the Friday night production gap. The plant has four mixers and one isolator board. The board holds three padlocks and the keys are kept in the shift supervisor's office; that afternoon the supervisor was at a supplier meeting in Limassol and the keys stayed in the office. The mixer is isolated by a local rotary switch, not by the breaker. A cardboard 'Danger – do not operate' sign had been taped over the start button, but it fell off. At about 22:40 a fitter, believing the repair was finished, pressed start while the electrician's right hand was still inside the guard. No one was injured; the machine ran for about two seconds before it was stopped. Production restarts at 05:00. The safety officer requires a near-miss report within 24 hours and a five-minute toolbox talk at the next shift change.
1. Identify the control failures in this event and rank them. Justify your ranking.
Read the worked answer
1 (primary) - The isolation was not secured: no lock was fitted. The padlock system existed but was unusable in practice, because all three locks sat on the board and the keys were in an office with an absent supervisor. A lock is the only barrier that stays with the person at risk and cannot be removed by someone who does not hold the key. Everything else failed around this failure; this is the one that would have prevented the event on its own.
2 - The warning device was not a tag and was in the wrong place. A cardboard sign taped over the start button is not a lockout tag: it does not say who is working, when the work started, or who may remove it, and tape fails. It was also on the start button rather than at the isolation point, so even if it had stayed up, anyone operating the rotary switch would not have seen it.
3 - No formal handover or permit-to-work. The fitter believed the repair was finished; the electrician had told the supervisor, who was not on site. Nobody had authority to declare the machine back in service, and there was no signed hand-back. Contributing factor: no named deputy for the supervisor, so the whole lockout system depended on one absent person.
Ranking logic: remove failure 1 and the event cannot happen; remove failure 2 or 3 and the event is still possible.
2. Write the four lines you would put in the near-miss report - what happened, immediate cause, underlying cause, corrective action - each line under 20 words.
Read the worked answer
What happened: At 22:40 on 14 February a fitter started mixer 2 while an electrician's hand was inside the planetary guard.
Immediate cause: The isolator was not locked, and no tag identified the electrician as the person working on the machine.
Underlying cause: Keys were held by an absent supervisor, and the plant has no permit-to-work for work inside a guard.
Corrective action: Issue personal locks to all trades, fit a key cabinet at the board, and sign off every hand-back before start-up.
Why written this way:
- Each line answers exactly one of the four report questions, so a reader can extract the facts without reading the whole narrative.
- No names and no blame words ('careless', 'failed to') - a near-miss report is evidence, and blame language makes the next witness less willing to speak.
- Times, machine numbers and body position are included because they are checkable; the electrician's right hand matters if the machine's guard is later examined.
- The corrective actions are things the plant can actually buy and install, not 'remind staff to be careful' - reminders are not controls.
3. A colleague says in the canteen: 'The sign fell off. That's not our fault.' Write the two or three sentences you would use in the toolbox talk that answer this without blaming any individual.
Read the worked answer
Suggested words for the toolbox talk:
'The sign was our last barrier, and it was never meant to be our first one. A sign can fall off, or be taped over the wrong button, or simply not be read - a lock cannot be opened by someone who does not hold the key. If the only thing between a man's hand and a start button is a piece of cardboard, then we have already lost the argument, and the question is not why the sign fell but why there was nothing behind it.'
Why this works:
- It accepts the colleague's fact (the sign did fall) instead of arguing with it, which keeps the group listening.
- It moves the discussion from fault to barrier: the issue is not who is to blame for the tape, but how many barriers stood between the fitter's hand and the button. That is a systems question, and everyone in the room can answer it.
- It avoids naming the fitter or the electrician, so nobody is put on the defensive in front of their shift.
- It ends on a practical test the group can apply to any job: what is behind the sign? A toolbox talk that leaves one checkable question in people's heads is worth more than a list of rules.