our CODE

Microsoft Cloud Infrastructure and Operations (MCIO)

SPS-101 Energy Isolation Establish and fulfill responsibilities for

Authorizing Energy Marshal, Performing Energy
Every person shall be protected from the unexpected, Isolation Coordinator, Authorized Persons and
Affected Persons.
accidental or uncontrolled release of hazardous energy. People

Use the Safety Performance Specification

framework to develop safe working and
assurance practices for carrying out work
requiring energy isolation.
Process

Use effective tools to forecast, plan, and

execute work safely. These include, but are not
limited to: BIM, personnel lockout/tagout
devices, control locks, lock boxes, blocks,
Design Tools wedges, energy isolation permit, etc.

Written Program Forecasting & Planning Training & Competency

Execution Leadership Engagement Inspections & Audits

Change Management
Incident Lessons Learned
Empower the Future. Save a Life.
 people
Controlling Energy Marshal
Designated MCIO employee who is responsible for the overall Energy Isolation Program Management on a datacenter
campus. The Controlling Energy Marshal can act in an Authorizing Energy Marshal role and is accountable for the
implementation of all forms of Energy Isolation.

Authorizing Energy Marshal

An individual who authorizes Energy Isolation tasks on behalf of and under the supervision of, the Controlling Energy Marshal.

• Ensures program requirements, contract terms and conditions, and applicable regulatory requirements are followed.
• Provides authorization and approval of Energy Isolation Work Permits to the Performing Energy Isolation Coordinator.

For Construction – the General Contractor (GC) appoints

For Datacenter Operations –the Datacenter Operations Manager (DCOM) appoints

Performing Energy Isolation Coordinator

Manages and/or performs the isolation process of stored energy for those directly performing the work.

• Ensures a Hazardous Energy (Level 2) risk assessment to identify exposures to workers is conducted,
• Obtains Energy Isolation Authorization Work Permits from the Authorizing Energy Marshal when conducting any work
which requires the isolation of hazardous energized equipment.
• Ensures the development and implementation of a written equipment-specific energy isolation procedure for all individual
units of energized equipment that will be de-energized.
• Ensures the Authorized Person completes a qualification training process and is authorized by their employer to conduct
energy isolation procedures.
• Conducts a meeting with all workers involved with the energy isolation process to discuss the Level 2 activity risk
assessment and equipment specific energy isolation procedure.
• Ensures adequate information, instruction and competent supervision is available for the Authorized Person during energy
isolating procedures.
• Ensures sufficient energy isolating equipment and correct personal protective equipment are provided.
• Ensures every individual performing work that could be exposed to hazardous energy is protected by their own uniquely-
keyed personal lock.
• Ensures the training of Affected (Unauthorized) Persons to ensure a basic understanding of the dangers associated with
hazardous energy and the importance of not tampering with energy isolation devices.
• Ensures that the required periodic inspections and audits of the implementation and effectiveness of the local energy
isolation program are conducted.

Authorized Person
• Obtains a copy of the Energy Isolation Work Permit from the Performing Energy Isolation Coordinator when conducting
any work which requires energy isolation.
• Notifies all Affected Personnel of energy isolation procedure prior to work commencing.
• Confirms and uses the written Equipment-Specific Energy Isolation Procedure provided by the Performing Energy Isolation
Coordinator for isolating all power sources and for the placement, testing of zero-energy state, and removal of energy
isolation devices.
• Logs each energy isolation procedure with the identity of the equipment, person performing the procedure, date and time
the energy isolation is installed or removed, and equipment is re-energized.

Affected (Unauthorized) Persons

• Shall understand the dangers of hazardous energy, recognize and not tamper with energy isolation devices, and not enter
restricted access zones without approval of the Authorizing Energy Marshal. This level of training shall be provided to all
personnel on site by the respective Performing Energy Marshal Coordinators.

Incident Lessons Learned

Empower the Future. Save a Life.
 people

Construction Prior to
Controlling
Energy Marshal Operational Handover

May be
Multiple
Authorizing GC
Based on
Energy Source Authorizing

Performing Performing Performing Performing Performing

Electrical Mechanical Cx Equip Manuf. Other

Controlling
EM may also
Controlling Construction in
be MSFT Ops Energy Marshal Operational Datacenter
Authorizing

MSFT Ops
Authorizing

GC
Authorizing

Performing Performing Performing Performing Performing

Electrical Mechanical Cx Equip Manuf Other

Incident Lessons Learned

Empower the Future. Save a Life.
 process
Design
A Preliminary Hazard Analysis (PHA) & Final Hazard Analysis (FHA) shall be performed in accordance with DCX-SMP-001 Safety
in Design. The design team will ensure a positive means of energy isolation is feasible and included in the final design. Any
exemptions will be made through the Safety in Design process and requires full concurrence of the core Safety in Design team
to ensure appropriate controls are established for protecting personnel installing, commissioning, maintaining, and operating
the equipment and related systems.

High Risk Activity Forecasting and Planning

Develop a High Risk Activity (HRA) Management Plan in accordance with SAFE-010 HRA Management and the Construction
Safety Policy. At a minimum, the following elements must be described:

• The identification of energy isolation activities in the work scope and schedule;
• The process to be used to identify energy sources or utilities;
• The process to be used to track/update as-built and temporary power drawings/BIM models;
• The process to perform risk assessments for energy isolation activities;
• A process for issuing energy isolation permits;
• Training and authorization requirements for those performing energy isolation activities;
• Protection of work areas, Lockout/Tagout (LOTO) and personal protective equipment;
• Emergency plans;
• Detailed procedures as to how multiple energy sources will be safely mitigated and regulatory requirements specific to
energy isolation activities will be met;
• Process for capturing lessons learned and best practices;
• Energy Isolation Permit audits (at least monthly) and audits of energy isolation program activities;
• Incident and investigation reports for all incidents (include near-misses, property damage, environmental mishaps, and
injuries regardless of the actual or potential severity of those incidents) involving energy isolation activities.

Three levels of risk assessments with corresponding forecasting and collaborative planning meetings will be completed prior to
the execution of any High Risk Activity. Figure 1.1 outlines a typical process workflow that the Authorizing Energy Marshal
should align their own energy isolation planning meeting to ensure coordination with all affected parties.

Figure 1.1 HRA Forecasting & Planning Process Flow

Incident Lessons Learned
Empower the Future. Save a Life.
 process
Energy Isolation
Establish an Energy Isolation Program at the local site that consists of energy control procedures, worker training, program
audits, and periodic inspections. It must clearly outline the scope, purpose, authorization, rules, and techniques to be utilized for
the control of hazardous energy, and the means to enforce compliance including: specific procedural steps for shutting down,
isolating, blocking and securing machines or equipment to control hazardous energy; placement, removal and transfer of
lockout devices or tagout devices and responsibility for them; specific requirements for testing equipment to determine and
verify the effectiveness of lockout/tagout devices, and other energy control measures. The program must address all forms of
hazardous energy and both permanent and temporary installations.

Each Authorized Person must place their own individual, uniquely keyed, locks and tags on systems and/or equipment to
control all hazardous energy sources. Personal verification of energy isolation shall be conducted by the Authorized Person
prior to starting work.
Group lockout/tagout devices must be used when group energy isolation work is performed by different companies, crafts,
departments or groups, and they are operating on the same piece of equipment, or where energy isolation or de-isolation from
one job may affect the safety of another. A documented Energy Isolation Plan shall be developed jointly by all Performing
Energy Isolation Coordinators and reviewed and approved by the Authorizing Energy Marshal.
A centralized LOTO location will be established and managed by the Energy Isolation Coordinator where all LOTO locks and
tags are issued. Drawings depicting the applicable systems and most current energized state are to be posted at the centralized
location and updated on a daily basis, at a minimum.
Removal of each lockout or tagout device shall be done by the Authorized Person who applied the device. The Energy Isolation
Program must include specific procedures for the removal of any energy isolation device by any party other than the
Authorized Person and only for extenuating or safety-critical situations when the Authorized Person is not available. A removal
procedure must be developed and approved by the Controlling Energy Marshal, Authorizing Energy Marshal, Energy Isolation
Coordinator and the Authorizing Authority Safety Manager.
Restoring equipment and systems to service shall be done only after the Authorized Person has inspected the work area to
ensure that: non-essential items have been removed; equipment components are operationally intact; all workers have been
safely positioned or removed; all guards and safety devices have been replaced and verified; and all personnel have been
notified that systems are going to be restored to operational status.

Foreign Object and Debris (FOD)

Develop a site-specific program to control the hazards associated with foreign objects and debris left behind during the
installation, maintenance, and testing of equipment that could result in injury or property damage during energization of
equipment or systems. FOD programs are to include specific inspection criteria and a means to ensure access into equipment
is controlled and the integrity of completed inspections is maintained.

Fatigue Management
A fatigue management plan will be developed to protect workers from the effects of working excessive hours (no more than 10
hours in a single day (8hours for night/third shift) and 60 hours in a week unless authorized by the Controlling Energy Marshal,
the Authorizing Energy Marshal, and the Authorizing Authority's safety management. The plan should consider factors such as
environmental conditions, level ofrisk associated with job task, fit for duty of workers, acclimation of workers to the site,
potential emergency response situations, ad commute times.

Incident Lessons Learned

Empower the Future. Save a Life.
 tools
Lockout/Tagout (LOTO) devices must be singularly identified; be the only devices(s) used for controlling
hazardous energy; not be used for other purposes; and be accompanied by a tag depicting individual name and contact
number. The devices must be able to withstand the environment to which they are exposed, be standardized within the
Energy Isolation Program; be substantial enough to prevent removal without the use of excessive force or unusual techniques
and prevent inadvertent or accidental removal, and indicate the identity of the employee applying the device(s).

Note: Only if the energy isolating devices are not lockable, tagout may be used if approved by the Controlling and Authorizing
Energy Marshals.

Personal locks must be red in color and be accompanied by a tag depicting individual name and contact number.

Control locks which are used to control the unintentional activation of equipment or a system, are typically used to
protect the equipment or a system from damage and could have a limited, but multiple keys, maintained by authorized
personnel. Controls locks should not be colored the same as lockout/tagout devices (red) for individual protection.

Group lockout devices must be used when work is performed by different companies, crafts, departments or groups
that are operating on the same piece of equipment or where energy isolation or de-isolation from one job may effect the
safety of another.

Lock boxes shall be used for group energy isolation when the number of workers exceed the capacity of multi-lockout
devices. All locks used for Energy Isolation will be uniquely keyed. The ONE key used to control the hazardous energy will be
locked inside the lockbox. Each person performing work on the equipment or in the system will apply their individual, unique
lock onto the outside of the lockbox and retain their individual key. Access to the ONE key must not be allowed until all
workers performing work have removed their own locks. Specific procedures must be developed for use during shift or
personnel changes to ensure the continuity of lockout or tagout protection, including provision for the orderly transfer of
lockout or tagout devices between outgoing and incoming employees.

Locks, tags, chains, wedges, key blocks, adapter pins, self-locking fasteners and other
hardware will be provided by the performing authority company for isolating, securing or blocking of equipment from
hazardous energy sources.

Incident Lessons Learned

Empower the Future. Save a Life.