Safety, Health, Environment and Ethical Governance

Introduction

Total Productive Maintenance (TPM) is often associated with equipment effectiveness, autonomous maintenance and planned maintenance. However, maintenance excellence is incomplete unless work is performed without injury, ill health, environmental harm or unethical concealment. Safety, health and environmental (SHE) performance is therefore not an auxiliary activity; it is a strategic condition of reliable production. A machine that delivers high availability but exposes workers to uncontrolled energy, releases pollutants or encourages falsification is not a productive asset.

The strategic aim is to create a maintenance system in which hazards are designed out where possible, controlled systematically where they remain, and reported honestly when controls fail. This requires integration among maintenance engineering, operations, human resources, procurement, environmental management, legal compliance and corporate governance.

A useful principle is:

Production may be interrupted to control serious risk, but serious risk must never be normalised to protect production.

This chapter explains the principal methods for achieving zero-accident and environmentally responsible maintenance: hazard analysis, permit-to-work, lockout/tagout, statutory compliance, human factors, contractor governance, energy efficiency, ethical reporting and accountability.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the relationship between TPM, safety, occupational health and environmental performance.
2. Apply hazard identification and risk assessment to maintenance tasks.
3. Design an effective permit-to-work and lockout/tagout system.
4. Evaluate human, organisational and contractor-related contributors to incidents.
5. Integrate environmental controls and energy efficiency into maintenance decisions.
6. Develop ethical reporting, assurance and accountability mechanisms.
7. Critically assess the limitations of zero-accident programmes and compliance-only approaches.

1. SHE as a Strategic Dimension of TPM

TPM seeks to maximise the productive life-cycle value of equipment. This value is constrained by three conditions: equipment must be available, it must perform as intended, and it must not create unacceptable risk. Safety and environmental performance should therefore be treated as leading dimensions of equipment management rather than as consequences measured after production results.

A mature TPM system links maintenance activities to the following outcomes:

The frequently used aspiration of “zero accidents” should be interpreted as a prevention commitment, not as proof that accidents are impossible. Incident counts may fall because hazards are controlled, but they may also fall because workers are discouraged from reporting. A responsible organisation consequently monitors both lagging indicators, such as injuries and spills, and leading indicators, such as completed risk assessments, quality of isolation audits, corrective-action ageing and near-miss reporting.

2. Hazard, Risk and the Hierarchy of Controls

A hazard is a source or situation with the potential to cause injury, ill health, property damage or environmental harm. Risk is the combination of the likelihood of an unwanted event and the severity of its consequence. Risk assessment is not a numerical exercise alone; it is a structured process for understanding what can go wrong, who or what can be affected, and which controls are dependable.

A common screening model is:

where R is the risk score, L is a likelihood rating and S is a consequence-severity rating. The ratings may be ordinal, for example from 1 to 5. The product is a prioritisation aid, not a physical probability. It is applicable only when the organisation defines the rating scales consistently and does not treat the result as an exact estimate of risk.

For example, if exposure to unexpected movement is rated likelihood 3 and severity 5, the screening score is:

A score of 15 may require immediate control under the organisation’s matrix. The calculation does not justify accepting the hazard; it helps determine the urgency and level of approval.

2.1 Hazard identification methods

Maintenance hazards can be identified through:

• task safety analysis or job safety analysis;
• historical incident and near-miss review;
• failure mode and effects analysis (FMEA);
• hazard and operability study (HAZOP) for process systems;
• what-if analysis and checklist review;
• workplace inspections and worker consultation;
• safety data sheet review;
• energy and environmental aspect assessments;
• observation of actual work rather than reliance on written procedures.

A task analysis should identify normal, abnormal, start-up, shutdown, testing, emergency and post-maintenance conditions. It should consider mechanical, electrical, hydraulic, pneumatic, thermal, chemical, gravitational, radiation, biological, noise, ergonomic and stored-energy hazards.

2.2 Hierarchy of controls

Controls should be selected in the following order:

1. Elimination: remove the hazardous task or energy source.
2. Substitution: replace a hazardous chemical, process or tool with a safer alternative.
3. Engineering controls: guards, interlocks, containment, ventilation, isolation devices and remote operation.
4. Administrative controls: procedures, scheduling, training, supervision, signage and permit systems.
5. Personal protective equipment (PPE): respirators, gloves, eye protection, hearing protection and protective clothing.

PPE is important but is the least reliable level when used alone because it depends heavily on correct selection, fit, condition and human behaviour. A TPM improvement team should ask first whether access, lubrication, inspection or cleaning can be redesigned to eliminate exposure.

3. Permit-to-Work as a Control of Non-Routine Risk

A permit-to-work (PTW) system is a formal authorisation process for hazardous or non-routine work. It communicates the work scope, hazards, precautions, responsible persons, validity period and conditions for suspension or closure. A permit is not a substitute for risk assessment or isolation; it is an administrative framework that confirms those controls have been established.

Typical permits include:

• hot-work permit for welding, cutting or spark-producing tools;
• confined-space entry permit;
• electrical work or energised-work permit where legally permitted;
• line-breaking or process-opening permit;
• excavation permit;
• work-at-height permit;
• lifting and crane-operation permit;
• radiation or hazardous-material permit.

3.1 Essential elements of a permit

An effective permit identifies:

• exact equipment, location and task boundaries;
• competent persons and the permit issuer;
• hazards and required controls;
• isolation points and verification method;
• atmospheric testing requirements and results;
• fire protection, rescue and emergency arrangements;
• PPE and tools;
• simultaneous operations that may create conflict;
• start and expiry times;
• handover, suspension and revalidation rules;
• final inspection, housekeeping and return-to-service approval.

Permit quality depends on field verification. A permit signed in an office without checking the worksite can create false confidence. The issuer and performing authority should jointly confirm that conditions match the document. Permits must be suspended when conditions change, alarms occur, weather deteriorates, the work scope expands or personnel no longer understand the controls.

4. Lockout/Tagout and Control of Hazardous Energy

Lockout/tagout (LOTO) is a controlled method for preventing the unexpected energisation, start-up or release of stored energy during maintenance. Energy may be electrical, mechanical, hydraulic, pneumatic, chemical, thermal, gravitational or process-related.

A robust LOTO sequence is:

1. Prepare: identify every energy source and affected equipment.
2. Notify: inform operators, contractors and other affected persons.
3. Shut down: stop the equipment using the normal control.
4. Isolate: open disconnects, close valves, block movement or otherwise separate the equipment from energy.
5. Apply locks and tags: each authorised worker applies a personal lock where the system requires personal control.
6. Dissipate or restrain stored energy: discharge capacitors, bleed pressure, lower suspended loads, block moving parts and allow hot surfaces to cool.
7. Verify zero energy: attempt start-up using normal controls, test for electrical absence with an approved method, and return controls to the off position. Verification must be performed by a competent person.
8. Perform work under controlled conditions.
9. Restore safely: inspect, replace guards, remove tools, account for personnel, remove locks according to procedure, notify affected persons and conduct a controlled restart.

The distinction between isolation and verification is fundamental. An open switch or closed valve is not proof that hazardous energy is absent. Cross-connections, wrong identification, leaking valves, back-feed and stored energy can defeat assumptions.

Group work requires special discipline. Each worker should have personal protection from re-energisation, normally through a group lockbox or equivalent arrangement. The system must define how locks are removed when a worker is absent, how shift handovers occur and who authorises exceptional removal.

5. Statutory Compliance and Management of Change

Legal obligations vary by jurisdiction, but maintenance organisations commonly face requirements concerning occupational safety, machinery guarding, electrical safety, pressure systems, lifting equipment, hazardous substances, work at height, confined spaces, fire protection, waste, emissions, water discharge, noise and emergency preparedness.

Compliance should be managed as a controlled system rather than as a collection of certificates. A compliance register should record:

Statutory inspection is not equivalent to safe operation between inspections. A pressure vessel may pass its scheduled examination yet develop a dangerous condition later. Compliance is a minimum boundary; risk management must also consider credible changes in condition.

Management of change (MOC) is essential when equipment, software, materials, procedures, staffing or operating limits change. A seemingly minor modification—such as replacing a motor, changing a lubricant, altering an interlock or bypassing a sensor—may alter energy, fire, chemical or environmental risk. MOC should require technical review, updated drawings and procedures, competence assessment, testing and formal approval before implementation.

6. Human Factors and Organisational Reliability

Incidents rarely result from one careless individual alone. They commonly arise from interactions among design, workload, communication, competence, supervision, incentives and organisational decisions. Human-factors analysis asks why an action made sense to the person at the time, given the available information and pressures.

Important contributors include:

• fatigue from extended shifts or inadequate recovery;
• time pressure and production conflict;
• confusing labels or poor equipment access;
• weak handovers;
• insufficient language or literacy support;
• normalisation of deviations;
• confirmation bias and assumptions about isolation;
• inadequate staffing or competence;
• procedures that do not match actual work;
• incentives that reward output while ignoring risk.

Defences include standardised handovers, pre-job briefings, peer checks, clear equipment identification, ergonomic design, fatigue controls, competence verification and stop-work authority. A pre-job briefing should cover the task sequence, energy sources, simultaneous operations, emergency arrangements, communication signals, changed conditions and each person’s role.

A just culture distinguishes among human error, at-risk behaviour and reckless behaviour. Human error calls for redesign, coaching and stronger safeguards. At-risk behaviour requires understanding of incentives, supervision and barriers. Reckless disregard may require disciplinary action. Treating every event as individual misconduct suppresses learning; treating all misconduct as blameless weakens accountability.

7. Contractor Control

Contractors may perform specialist maintenance, shutdowns, scaffolding, inspection, cleaning or waste handling. Contracting does not transfer the host organisation’s responsibility to provide a safe system. Contractor governance should cover the complete life cycle:

1. Prequalification: assess competence, safety performance, insurance, licences, resources and environmental capability.
2. Scope definition: specify hazards, interfaces, deliverables, reporting and emergency duties.
3. Induction and competence: verify training, authorisations, medical fitness where relevant and language comprehension.
4. Work control: integrate contractors into permits, LOTO, toolbox talks, access control and simultaneous-operations planning.
5. Field assurance: observe work, inspect controls and correct deviations promptly.
6. Performance review: evaluate leading and lagging indicators, learning quality and close-out of actions.
7. Demobilisation: confirm housekeeping, waste removal, documentation and restoration of equipment.

Lowest-price procurement can be dangerous when it removes competent supervision, adequate tooling or realistic work duration. Contracts should reward prevention and quality rather than merely low incident numbers. Incident-rate targets without reporting safeguards may encourage concealment.

8. Environmental Responsibility and Energy Efficiency

Maintenance affects the environment through energy use, lubricant and chemical consumption, leaks, waste generation, emissions, wastewater and noise. Environmental maintenance is preventive maintenance: seals, gaskets, filters, insulation, combustion systems, compressed-air networks and containment systems must be maintained to prevent loss.

A maintenance environmental review should ask:

• What substances can leak, evaporate or be discharged?
• What waste streams arise, and are they correctly segregated?
• Can hazardous materials be substituted or reduced?
• Are spill kits and secondary containment adequate?
• Does equipment operate inefficiently because of fouling, misalignment, leakage or poor control?
• Are used oils, batteries, filters and electronic components managed by approved routes?
• Could maintenance activity disturb soil, drains, water bodies or nearby communities?

Energy efficiency is both an environmental and economic objective. Common opportunities include repairing compressed-air leaks, correcting steam losses, improving motor alignment, maintaining heat exchangers, cleaning filters, optimising lubrication, reducing idle running and using condition-based maintenance. Decisions should consider life-cycle cost rather than purchase price alone.

For an energy-saving intervention, annual energy cost saving can be estimated as:

where C_s is annual cost saving in currency per year, E_s is annual energy saving in kilowatt-hours per year, and p is energy price in currency per kilowatt-hour. The estimate assumes that the saving is measured or credibly modelled and that the energy price and operating hours are appropriately defined.

If a repaired compressed-air system saves 12,000 kWh per year and energy costs 0.15 currency units per kWh:

A complete appraisal should also include maintenance cost, implementation cost, service life, production effects and uncertainty. Energy efficiency must never be achieved by disabling ventilation, reducing essential cooling or creating a safety hazard.

9. Ethical Reporting, Assurance and Accountability

Ethical governance requires accurate information, transparent decisions and protection for people who raise concerns. Maintenance records influence risk decisions, regulatory submissions, spare-parts purchasing, warranty claims and production planning. Falsifying a work order, backdating an inspection, hiding a failed alarm or misclassifying waste can expose people and the organisation to serious harm.

A credible reporting system has the following characteristics:

• simple channels for hazards, near misses, environmental events and concerns;
• confidential or anonymous options where appropriate;
• non-retaliation protections;
• prompt triage based on potential consequence, not only actual injury;
• evidence-based investigation;
• feedback to reporters and affected workers;
• independent escalation for conflicts of interest;
• retention of traceable records.

Investigations should seek system causes rather than assign blame prematurely. Methods such as barrier analysis, causal-tree analysis and the “five whys” can be useful when applied critically. The question is not merely “Who failed?” but “Which barriers were absent, ineffective or bypassed, and why was that condition permitted to persist?”

Accountability operates at several levels. Senior leaders set resources, priorities and incentives. Managers design work systems and approve risk. Supervisors translate requirements into field control. Workers and contractors follow procedures, identify changing conditions and exercise stop-work authority. Accountability must be matched with authority, competence and resources; assigning responsibility without control is unjust.

10. Integrated Performance Measurement

A balanced SHE-TPM dashboard should combine outcome and process measures.

Rates must be interpreted carefully. A common injury frequency rate is:

where IFR is the injury frequency rate, N is the number of defined injuries, K is a reporting constant selected by the organisation, and H is total hours worked. The unit is injuries per K hours. The constant and injury definition must be stated because organisations use different conventions. A rate is not meaningful for comparison unless definitions, exposure hours, reporting practices and workforce composition are comparable.

Metrics can become dysfunctional when managers reward low reported incidents without checking reporting health. Useful assurance therefore triangulates records with worker interviews, field observations, maintenance backlogs, permit quality, equipment condition and independent audits.

11. Applied Case: Solvent-Pump Maintenance During a Planned Shutdown

The following is an illustrative case based on common industrial conditions.

Background

A chemical plant planned to replace the mechanical seal on a solvent transfer pump. The pump was connected to a storage vessel and a return line. Previous maintenance had been completed without injury, and the shutdown schedule allowed only six hours for the task.

Problem

The work order identified electrical isolation but did not clearly identify process isolation, residual pressure or solvent vapour. The contractor proposed beginning immediately after the operator stopped the pump. Production management was concerned about schedule delay.

Analysis

A task review identified several energy and exposure pathways: electrical supply, pressure in the line, gravity flow from the vessel, trapped solvent, vapour ignition, rotating parts and contaminated waste. The initial permit was inadequate because it did not require atmospheric testing or independent verification of valves. The schedule also encouraged premature work commencement.

Approach and solution

The maintenance manager stopped the job and convened operations, maintenance, the contractor supervisor and the environmental coordinator. They:

1. updated the task risk assessment;
2. isolated and locked the electrical supply;
3. closed, locked and independently verified process valves;
4. drained and flushed the line into an approved recovery system;
5. tested the atmosphere before opening the line and periodically thereafter;
6. issued a line-breaking and hot-work exclusion permit;
7. established spill containment and hazardous-waste arrangements;
8. required personal locks for all authorised workers;
9. conducted a pre-job briefing and confirmed emergency communication;
10. revised the schedule and authorised restart only after guard replacement and leak testing.

The seal replacement took an additional two hours. A small valve-passing condition was discovered during verification and repaired before the line was opened. The maintenance team also found that the original procedure did not require documented valve verification.

Outcome

No exposure, spill or injury occurred. The plant recorded a potential serious event because the initial plan could have exposed workers to flammable vapour and pressure. The site updated isolation drawings, added a line-break checklist, trained permit issuers and included valve-passing tests in future shutdown planning.

Learning points

The case demonstrates that schedule pressure can create latent risk, that previous incident-free work does not prove safety, and that verification is more reliable than assumption. It also shows why environmental containment and worker safety should be managed together: a loss of containment can injure people, pollute the environment and interrupt production simultaneously.

12. Contemporary Developments and Limitations

Digital maintenance systems can strengthen SHE governance through electronic permits, digital signatures, geofenced equipment identification, sensor-based leak detection, wearable exposure monitoring and automated action tracking. Artificial intelligence may help identify patterns in inspection records or predict abnormal conditions. Nevertheless, digital tools cannot replace field verification, competence or ethical judgement. Poor data produces confident but unsafe recommendations, and automated systems may fail under unusual conditions.

Remote inspection, robotics and augmented-reality work instructions can reduce exposure to confined spaces, height and radiation. Their limitations include cybersecurity, sensor reliability, operator competence and the risk that workers trust a system beyond its validated operating envelope.

Zero-accident campaigns also require critical evaluation. They can inspire prevention, but rigid numerical targets may suppress reporting, blame workers or encourage superficial compliance. A stronger approach combines an aspiration for no harm with open reporting, serious-potential-event learning, robust engineering controls and independent assurance.

Best-Practice Principles

1. Design hazards out before relying on procedures or PPE.
2. Treat every isolation as incomplete until zero energy is verified.
3. Use permits to coordinate work, not to legitimise weak controls.
4. Integrate environmental aspects into every significant maintenance task.
5. Give workers genuine stop-work authority without retaliation.
6. Manage contractors as part of one operating system.
7. Measure leading controls and reporting quality, not only injury totals.
8. Investigate system conditions and barrier failures, not only individual actions.
9. Use management of change for technical, organisational and procedural modifications.
10. Make records accurate, traceable and available for challenge.

Chapter Summary

SHE and ethical governance are strategic components of TPM because maintenance performance is valuable only when it protects people, the environment and organisational integrity. Hazard identification and risk assessment provide the foundation, while the hierarchy of controls prioritises elimination and engineering solutions over administrative dependence and PPE. Permit-to-work systems coordinate hazardous non-routine activities, but they are effective only when supported by field verification. LOTO prevents unexpected energisation and requires identification, isolation, dissipation and verification of every energy source.

Statutory compliance establishes a minimum legal boundary, while management of change ensures that modifications do not introduce uncontrolled risk. Human factors, fatigue, communication, incentives and organisational design strongly influence behaviour. Contractor control must cover selection, competence, work execution and performance review. Environmental responsibility includes pollution prevention, waste control, leak reduction and energy-efficient maintenance. Ethical reporting requires non-retaliation, reliable investigation and accurate records. Finally, balanced performance measurement combines outcomes with leading indicators and independent assurance. Zero harm is best pursued through resilient systems, not through numerical pressure that conceals failure.

Key Terms

Hazard: A source or situation with potential to cause harm.

Risk: The combination of likelihood and consequence of an unwanted event.

Hierarchy of controls: Ordered method prioritising elimination, substitution, engineering, administrative controls and PPE.

Permit-to-work: Formal authorisation and coordination system for hazardous work.

Lockout/tagout: Procedure for isolating and controlling hazardous energy.

Stored energy: Energy retained in a system after normal shutdown.

Zero-energy verification: Demonstration that hazardous energy has been isolated or dissipated.

Management of change: Formal review and approval of changes that may affect risk or performance.

Human factors: Interactions among people, equipment, tasks and organisational conditions.

Just culture: Approach that supports learning from error while retaining fair accountability.

Contractor governance: Controls used to select, integrate, supervise and evaluate contractors.

Environmental aspect: Element of an activity that can interact with the environment.

Secondary containment: Structure that limits the spread of a leak or spill.

Leading indicator: Measure of preventive activity or control quality.

Lagging indicator: Measure of harm or failure that has already occurred.

Serious-potential event: Event that could reasonably have caused severe harm, regardless of actual outcome.

Stop-work authority: Right and responsibility to pause work when controls are inadequate.

Ethical reporting: Honest, timely and non-retaliatory communication of risk, failure or concern.

Barrier: A technical, procedural or organisational control that prevents an unwanted event or limits its consequences.

Review Questions

Short Answer Questions

1. Distinguish between a hazard and risk.
2. Why is zero-energy verification necessary after isolation?
3. List the main stages of a permit-to-work system.
4. Explain why PPE is considered the least reliable level in the hierarchy of controls.
5. Identify two ways in which maintenance can improve environmental performance.

Long Answer Questions

1. Explain how safety, health and environmental management should be integrated into TPM pillars.
2. Describe a complete lockout/tagout process, including group work and restoration.
3. Critically evaluate the role of human factors in maintenance incidents.
4. Develop a contractor-control framework for a major plant shutdown.
5. Discuss the relationship between ethical reporting, performance measurement and organisational accountability.

Analytical / Application Questions

1. A maintenance team plans to open a solvent line after closing one valve and stopping the pump. Analyse the hazards, identify missing controls and design an appropriate permit and isolation sequence.
2. A site reports zero lost-time injuries for three years, but near-miss reporting and safety observations have sharply declined. Evaluate possible explanations and recommend an assurance plan.
3. A compressed-air improvement saves 12,000 kWh annually at an energy price of 0.15 currency units per kWh. Calculate the annual energy-cost saving and explain what additional technical, safety and financial information is needed before approving the project.

Multiple Choice Questions with Answers

Question 1

Which control is highest in the hierarchy of controls?

A. Personal protective equipment

B. Administrative procedure

C. Engineering guard

D. Hazard elimination

Correct Answer: D. Hazard elimination

Question 2

What is the primary purpose of lockout/tagout?

A. To record maintenance hours

B. To prevent unexpected energisation or release of hazardous energy

C. To authorise overtime work

D. To measure equipment availability

Correct Answer: B. To prevent unexpected energisation or release of hazardous energy

Question 3

A risk matrix rates likelihood as 3 and severity as 5. Using R = L × S, what is the screening score?

A. 8

B. 10

C. 15

D. 53

Correct Answer: C. 15

Question 4

Which statement about a permit-to-work system is correct?

A. It replaces the need for energy isolation

B. It is required for every routine office task

C. It coordinates hazardous work and confirms specified controls

D. It guarantees that conditions cannot change

Correct Answer: C. It coordinates hazardous work and confirms specified controls

Question 5

Which action is an example of zero-energy verification?

A. Assuming a valve is closed because its handle is turned

B. Attempting a controlled start and testing for absence of energy

C. Signing the work order before shutdown

D. Removing guards before isolation

Correct Answer: B. Attempting a controlled start and testing for absence of energy

Question 6

Why can a zero-incident target create an unintended risk?

A. It always increases energy consumption

B. It may discourage reporting or encourage concealment

C. It eliminates the need for audits

D. It prevents contractor participation

Correct Answer: B. It may discourage reporting or encourage concealment

Question 7

Which practice best reflects a just culture?

A. Punishing every person involved in an error

B. Ignoring reckless behaviour

C. Distinguishing human error from reckless disregard and improving systems

D. Reporting only injuries that require hospital treatment

Correct Answer: C. Distinguishing human error from reckless disregard and improving systems

Question 8

Annual energy saving is 12,000 kWh and energy price is 0.15 currency units per kWh. What is the annual cost saving?

A. 180 currency units

B. 1,800 currency units

C. 12,000 currency units

D. 80,000 currency units

Correct Answer: B. 1,800 currency units

Question 9

Which is a leading SHE indicator?

A. Number of completed LOTO verification audits

B. Number of injuries already recorded

C. Number of spills that occurred last year

D. Amount of compensation paid

Correct Answer: A. Number of completed LOTO verification audits

Question 10

What is the main purpose of management of change?

A. To accelerate all maintenance work

B. To avoid documenting equipment modifications

C. To review and control risks introduced by changes

D. To replace statutory compliance inspections

Correct Answer: C. To review and control risks introduced by changes