Safety · 8 min read
Locked Off but Still Dangerous: The Missing Steps in Steam-System Isolation
A British prosecution following two serious scald injuries shows why lock-off is incomplete until pressure, temperature and trapped liquid are removed and the safe condition is proved at the work point.
What the enforcement case established
Britain’s Health and Safety Executive reported that an employee and a contractor were replacing a leaking gasket in an isolation valve on steam pipework at Kettleby Foods in Melton Mowbray. The gantry did not reach the work point, so both men stepped onto the top of a boiler. When the gasket was removed, hot water escaped and caused serious scald injuries affecting about 4–5% and 9% of their bodies.
HSE found that the task had not been adequately risk-assessed, no documented safe system of work had been provided, suitable isolation and lock-off procedures were not used, supervision was inadequate and the work-at-height controls were insufficient. Samworth Brothers Ltd pleaded guilty and was fined £594,000 on 4 September 2026, with additional costs, surcharge and compensation.
A lock controls movement; it does not remove the hazard
Closing and securing a valve is only one part of isolating a hot-fluid system. Pressure can remain between valves, hot condensate can collect at a low point, a valve can pass, another supply can backfeed, and metalwork can retain dangerous heat. The work party needs protection from the condition at the opening point, not merely assurance that an upstream control has been operated.
For intrusive steam work, the approved plan should address every supply, cross-connection and return path. It should define how the section will be depressurised, drained, vented and cooled, where trapped liquid may remain, and how re-pressurisation will be prevented. The correct isolation standard depends on the plant, inventory and task and must be selected by competent persons.
Prove zero energy where the joint will be opened
HSG253 emphasises isolation planning and the release of hazardous substances during intrusive work. Verification should use suitable proving points and instruments, with acceptance criteria defined before the job. A pressure gauge reading zero is not enough if the instrument can be blocked, out of service or connected to the wrong pocket.
The team should understand what evidence demonstrates zero pressure, acceptable temperature and complete drainage at the actual intervention point. If the condition cannot be proved, the joint must be treated as hazardous. Loosening bolts to discover whether pressure remains transfers verification to the people most exposed and is not an acceptable test method.
Manage contractors through one coordinated system
Employee and contractor involvement can produce divided assumptions about who owns isolation, access and supervision. The site operator understands the energy system; the contractor may control the repair method. Both need one agreed work package that connects the isolation certificate, permit, method statement, access plan and field verification.
The issuing authority and performing authority should walk down the work together. They must agree the boundary, proving method, residual hazards, hold points and response to any change. Supervision should confirm that the planned controls exist at the workface, not simply that the documents carry signatures.
Unsafe access is not a separate paperwork problem
Working from the top of a boiler added a fall hazard to an already hazardous line-opening task. Poor access can also distort posture, slow escape and place a worker directly in the release path. When the installed gantry does not reach the job, the work method must change; the gap cannot be closed by improvisation.
Provide a suitable platform or engineered access arrangement before releasing the task. Check load, stability, guardrails, reach, emergency escape and the interaction with hot surfaces. A job should not receive approval for process isolation while the physical position required to perform it remains unsafe.
A field check before the next line opening
Review one upcoming intrusive maintenance task and ask the team to demonstrate the safe condition. Can they identify every energy source and possible backfeed? Can they show how the system was depressurised, drained and cooled? Is the proving point representative of the component being opened? Is access purpose-designed and can the team retreat safely?
Finally, define the stop conditions: unexpected temperature, pressure return, blocked drainage, mismatched tags, changed scope or unavailable supervision. A professional isolation system makes it normal to pause when the evidence does not match the certificate.
Sources
- UK HSE — Food manufacturer fined after two workers were scaldedPublished 16 September 2026
- UK HSE — HSG253: The safe isolation of plant and equipmentPublished Published 2006; updated 7 August 2025
Daily HSSE updates
Subscribe for practical HSSE updates.
Subscribe for the daily message, selected HSSE news and occasional new-resource alerts from Worksite Safety Hub.