Who signs off the restart? Handover after a breakdown

It's ten to six. The engineer has swapped the gearbox on the infeed conveyor. They tell the shift manager it's done, pack their tools and head for the car park. The shift manager tells the team leader it's fixed. The team leader tells an operator to start it up.

Nobody has checked the guard on the drive end. Two of its bolts are in a tray on the floor. The operator's lock is still on the isolator, so someone cuts it off to save time.

Everyone in that chain thought somebody else had signed it off. Nobody had.

The restart is the most dangerous moment of a breakdown. The fix is done, everyone is in a hurry, and the machine is about to move with people still near it. So one named person has to own it.

One name, every time

Here's our view. Every restart after a breakdown needs one person who says "it's safe to run" and puts their name to it. Production can push for it. Maintenance can say the fix is done. But one person, named before the night starts, makes the call.

It usually works best as a two-step handback. The person who did the work hands the machine back. The person who runs the area accepts it. Both sign. If either isn't happy, it doesn't run.

HSE's guidance on permit systems lists a common failure on major hazard sites: "failure to hand-over plant in safe condition on completion of work". It also asks whether there's a formal procedure for handing the plant back to operation (HSE, permit to work). Your site may not run permits for every breakdown. The handback still matters on every one. If you do use permits, our post on running a permit to work covers closing one out.

Locks come off in the right order

The handback starts with the locks. Each person takes off their own lock, and only once they're clear. Nobody removes someone else's lock, and nobody cuts one off because its owner has gone home. If that happens, stop and find the person. Our guide to safe isolation goes through the full sequence.

Before the last lock comes off, walk the machine:

• every guard back on, with every fixing in
• tools, rags and spare parts out of the machine, counted back into the bag
• no links, bridges or tape left in the safety circuit
• air, hydraulics and anything else that was bled down, ready to come back up
• people clear, and the area around the machine told it's about to start

Prove the safety devices work

A fix can disturb a guard switch, a light curtain or an e-stop even when nobody touched them on purpose. Cables get moved. Brackets get knocked. A sensor gets realigned to fit the new part.

So test them before production takes it back. Open each interlocked guard and check the machine stops. Check the e-stops. Break the light curtain. HSE's code of practice says a functional test may be needed to check that "interlocks, protection devices, controls etc are working as intended" (L22, paragraph 89).

PUWER also asks for an inspection after "exceptional circumstances which are liable to jeopardise the safety" of the kit (regulation 6). A crash, a major failure or a big repair can count. The result has to be recorded. If you're not sure, treat it as one.

Lifting kit has its own rule. After damage, failure or the repair of critical parts, HSE says a LOLER thorough examination may be needed before it goes back to work (HSE, thorough examinations). A truck with a new mast chain is a good example. Talk to your examiner.

Run it with everyone stood back

First run at slow speed or in manual if the machine has it. Watch, listen, feel for heat. Then run it with product, with the engineer still there. A fix that works empty doesn't always work loaded.

A callout engineer who leaves at the first good cycle can cost you here. If the new gearbox runs hot after twenty minutes, you want them on site, not on the M6. Agree before they start that they'll stay for the first proper run, and pay for that time. It's cheaper than a second callout.

Tell the next shift what changed

The handback isn't finished when the machine runs. The operators need to know:

• what failed and what was replaced
• anything to watch for, like a new noise or a temporary fix
• any limits, such as reduced speed or one product only until a part arrives
• who to call if it plays up

Temporary fixes need a date and an owner. A bodge that nobody tracks becomes the way the machine is built. See how temporary fixes become permanent.

Then write it down. If the machine has a maintenance log, PUWER says it must be kept up to date (regulation 5). The note also feeds your breakdown debrief the next morning, and the handover between your own engineers. We've covered that in shift handovers between maintenance engineers.

When it's a contractor's job

If an outside engineer did the work, the same rules apply. You and their employer have to co-operate with each other on safety while they're on your site (Management Regulations, regulation 11). In practice that means agreeing the handback before they start. Who tests the guards? Who signs? Who stays for the first run?

Don't let the restart fall into the gap between their job sheet and your shift manager. Their sign-off says the repair is done. Yours says the machine is safe to run.

What to do on Monday

1. Name the person on each shift who accepts a machine back after a breakdown.
2. Put a handback checklist at your critical machines: locks, guards, tools, safety device tests, first run.
3. Make "nobody removes another person's lock" a rule with no exceptions, and say what to do instead.
4. Tell every callout engineer, before they start, that they stay for the first loaded run.

* Paragraph numbers refer to L22, fourth edition (2014, amended 2018).