Chapter 2 — Safety first: permits, consequence and who decides
Lesson map
Lesson 02 published. Map, example, EX005.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Safety systems are not security tools"]
N2["2.2 Permits and lockout"]
N3["2.3 Who decides"]
N4["2.4 Stop conditions"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX005"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Safety systems are not security tools"]
N2["2.2 Permits and lockout"]
N3["2.3 Who decides"]
N4["2.4 Stop conditions"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX005"]
[Learning outcomes]
|
v
[2.1 Safety systems are not security tools]
|
v
[2.2 Permits and lockout]
|
v
[2.3 Who decides]
|
v
[2.4 Stop conditions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX005]
Learning outcomes
You will (1) explain how permits to work and lockout protect people; (2) state who has authority to stop or change the line; and (3) apply the rule that security work never bypasses safety controls.
2.1 Safety systems are not security tools
Light curtains, emergency stops and guard interlocks keep hands away from moving parts. They are designed and verified by safety engineers and they must keep working whatever happens to the network. A security technician never disables, bridges or reconfigures them, even "temporarily for testing".
On HPFL that covers the light curtains at the wrapper infeed, the emergency stops along the line and the interlocks on guard doors. If a security task seems to need one of them changed, the task is wrong, not the safety device. Stop and ask the supervisor, and record the question.
2.2 Permits and lockout
Work on a running plant needs a permit: a written record of who does what, where, when, which hazards exist and how they are controlled. Lockout/tagout isolates energy before hands go into a machine. Plugging a laptop into the wrapper's switch is also work on the plant: it can change traffic the PLC sees, so it goes through the same permit process.
The permit names the person in charge, the time window and what will be touched. At HPFL Tomás's permit for photographing the wrapper cabinet said that no tools would go inside and no connections would be made. Writing that down protects him as well as the line, because everyone knows what the task did and did not include.
2.3 Who decides
The shift supervisor decides whether the line runs. The controls engineer owns PLC programs. The quality manager decides whether product is safe to ship. Security staff advise and report; they do not make those decisions alone. Knowing this chain saves time in an incident because you call the right person first.
At HPFL that means a quality concern goes to the quality manager, a question about PLC logic to the controls engineer, and anything about stopping the line to the shift supervisor. Keep their names and numbers on the site sheet. When unsure who decides, ask the supervisor first; they will know who else to involve.
2.4 Stop conditions
Every task has written stop conditions: for example, stop if any alarm appears that is not explained, if an operator asks you to stop, or if a device behaves differently from the plan. Stopping is never a failure.
Write the stop conditions on the permit before starting, and agree them with the supervisor. When one occurs, stop work, make the area safe, tell the supervisor and record what happened. A task can resume later under a new or amended permit. Pressing on because the job is nearly finished is how small surprises become incidents.
Worked example (synthetic HPFL)
Tomás needs to photograph the wrapper cabinet labels for the inventory. He asks the supervisor, who issues a permit for 10:00–10:20 during a planned film change, notes "cabinet door open, no tools inside, no connections", and names the electrician who opens the panel. Tomás photographs, the electrician closes the door, the permit is signed off.
Synthetic case — HPFL. The permit and times are invented.
Errors and limits
Permit forms vary by site; follow the local one. A permit does not make an unsafe task safe; it only records that hazards were considered.
Exercises
- EX005 — Light curtain request. A colleague suggests bridging the wrapper light curtain while testing network traffic. What do you do? Rubric: 3 = refuse, safety systems untouched, escalate to supervisor/safety engineer; 2 = refuse only; 1 = ask for permission to bridge; 0 = agree.
- EX006 — Why a laptop needs a permit. Give one technical reason connecting ENG-LT to the line switch needs a permit. Rubric: 3 = can alter traffic/broadcasts seen by PLCs or push changes, affecting process; 2 = generic risk; 1 = "rules say so"; 0 = none.
- EX007 — Matching decisions to people. Who decides (a) whether the line runs, (b) whether a PLC program changes, (c) whether product ships? Rubric: 3 = supervisor, controls engineer, quality manager; 2 = two right; 1 = one; 0 = none.
- EX008 — Writing stop conditions. Write three stop conditions for photographing cabinet labels. Rubric: 3 = three specific, observable conditions; 2 = two; 1 = vague; 0 = none.
Synthesis
Safety controls are untouchable, permits record the work, and named people make operational decisions.
Continue studying — chapter 02 of 18
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →