More than pressing a button accidentally
The scenario includes inadvertent operation, commands from another station, automatic sequences and movements caused by gravity, pressure or elastic components. The investigation should therefore not focus solely on an electrical fault.
Assessment must examine which parts can move and who may be in their path. Stopped equipment can retain pressure, an elevated load or a tensioned part even when its main supply is disconnected.
When exposure occurs
Cleaning, clearing blockages, adjustments, tool changes, checks and maintenance are particularly relevant. These tasks involve access to areas that remain protected during normal production.
Also review simultaneous activities, shift changes and interconnected equipment. One person may not know that another is working downstream or in a poorly visible part of the installation. Work boundaries must correspond to the complete system that can affect them.
What the Spanish framework requires
Annex I of Royal Decree 1215/1997 requires, subject to its stated exceptions, deliberate action for start-up and identifiable means of separation from energy sources.
Its Annex II requires hazardous interventions to follow stopping or disconnection, verification of the absence of hazardous residual energy and prevention of accidental reconnection. If stopping is not possible, measures must allow safe work or work outside danger zones; this is not general authorisation to intervene while equipment is running.
Stopping, isolation and lockout are not the same
Stopping interrupts operation; isolation separates equipment from energy sources. Lockout/tagout helps prevent improper restoration within a defined procedure. Stored energy requires specific treatment.
An emergency stop or a display showing zero does not by itself demonstrate that intervention is safe. Verification must cover the actual hazards and be planned for that equipment, rather than rely exclusively on operating indicators.
Design, coordination and return to service
Controls, guards and control systems must reduce the possibility of hazardous activation. These are supplemented by defined task boundaries, competent personnel and communication between those intervening and those able to start equipment.
Return to service requires an organised decision: work completed, safeguards restored, people clear of danger and communication following the procedure. Repairing a fault is insufficient if tools remain, interventions are outstanding or workers are in areas that cannot be seen.
What to review after an incident
Identify which energy caused movement, where the command originated, who could act and which barriers were missing or failed. Investigation must include design and organisation alongside individual actions.
If a task routinely requires bypassing safeguards or improvising access, review its method and available resources. Repeating training without correcting that incompatibility leaves the exposure scenario unchanged.
Hypothetical example: cleaning a conveyor
A line stops because there is no material, and someone prepares to remove waste. Assessment shows that the automatic sequence may restart movement when a new item arrives and that another part of the line retains energy.
Competent personnel redefine the intervention and its isolation. The lesson is that a stopped cycle is not equivalent to safe conditions for entering a danger zone.
