How to Run a Stored Energy Verification Walkdown Before Maintenance Starts

A stored-energy verification walkdown is the short pre-job route that checks every place where energy can stay hidden after the team thinks the equipment is safe. It matters because the lock, the tag, and the permit are only signals until the crew proves the machine state in the field.

Most maintenance incidents do not begin with a dramatic failure. They begin when a team accepts a familiar shutdown pattern, a signed permit, or a visible lock as proof that energy is gone. James Reason's work is useful here because the last visible error usually sits on top of latent conditions that were already in place.

This guide is for maintenance supervisors, permit issuers, planners, and EHS managers who need a repeatable way to slow the job down just enough to keep hidden energy from becoming the first contact. Across 25+ years leading EHS in multinational operations, Andreza Araujo has seen the same pattern repeat: when one person owns the verification step, the job gets safer before the wrench turns. As she writes in Safety Culture: From Theory to Practice and The Illusion of Compliance, a clean record can still hide an unchanged risk.

ISO 45001 asks organizations to control operational risk, but the field only believes the control when the equipment itself confirms it. That is why the walkdown should be treated as a decision step, not as an extra signature.

What you need before starting

Before you walk the line, make sure the permit is current, the boundary is clear, the drawings match the equipment, and the team can reach every isolation point without guessing. If the map is wrong or the access is blocked, the walkdown is not ready yet.

• A current work order or permit.
• The latest isolation diagram or line sketch.
• Access to valves, breakers, vents, drains, bleeds, and relief points.
• One person with stop authority.
• One person who will verify the handback before restart.

The routine gets stronger when the crew can name the same equipment, the same controls, and the same stop condition without reading from the form. If that is not true, the walkdown is still a planning problem, not a field control.

Step 1: Define the exact job boundary

Start by writing the job boundary in one sentence. Name the equipment, the upstream and downstream interfaces, the task that will happen, and the parts that will not be touched. A boundary that is too broad creates noise, while a boundary that is too narrow hides the condition that matters.

The practical test is simple. If a maintainer, planner, and operator describe different boundaries, the team has not finished the job design. The walkdown only works when the group can point to the same asset and the same limits without improvising.

The common error is to use the asset name as if it were the boundary. A pump, a panel, or a conveyor is not enough by itself, because the risk often sits in the connected line, the remote feed, or the adjacent system that still shares energy with the work face.

Before moving on, ask the team to repeat the boundary without looking at the form. If they need to debate the basics, stop and rewrite the scope before anybody touches the equipment.

Step 2: Map every stored energy source

List every source that can stay active after the main source is off. That includes electrical, mechanical, hydraulic, pneumatic, thermal, chemical, gravitational, spring, vacuum, and trapped product energy. If the job can move, rotate, pressurize, heat, or fall, it has a stored-energy question that deserves attention.

Do not stop at the obvious source. Many bad surprises come from secondary lines, trapped pressure, suspended parts, loaded springs, residual heat, or a shared supply that was not visible on the first pass. The walkdown exists because the first pass is usually too optimistic.

Andreza Araujo's view in The Illusion of Compliance is relevant here because paperwork can make the team feel done before the field is done. A clear diagram helps, but it does not prove that the pressure is relieved or the load is secured.

If the team cannot name the energy source and the control that removes it, the work is not ready for execution. Hidden energy should be treated as a live condition until the crew proves otherwise.

Step 3: Assign one verification owner

Name one person who owns the verification step from the field walk to the restart handback. This person is not simply a signatory. The owner is the one who can stop the task, request another check, and refuse restart until the state is clear.

The owner should be chosen for judgment and access, not for title. The most senior person in the room may have authority, but the best owner is often the person who knows the equipment, can reach the isolation points, and can challenge a mismatch without waiting for permission.

Across more than 250 cultural transformation projects, Andreza Araujo has seen that weak routines survive when responsibility is shared in theory and blurred in practice. A verification owner prevents that drift because the job now has one named person who must answer for the state of the equipment.

The common error is committee ownership. When everyone is responsible, nobody is responsible at the moment the crew needs a decision. The walkdown should end with one name, one role, and one stop condition.

Step 4: Walk the equipment in work sequence

Walk the route in the same sequence the work will follow, not in the easiest sequence on the drawing. Start where energy enters, move through the isolation points, continue to the work face, and then check the first point the crew will touch. The sequence matters because a diagram can hide the exact valve, breaker, or bleed point that the craft must actually use.

This step forces the team to see the job as it will be done, not as it was imagined in the office. A good walkdown makes the planner, supervisor, and operator stand in the same place at the same time, which is often the first moment they notice a missing label, blocked access, or a shared line that the form ignored.

For a related control sequence, the article How to Run a Pre Startup Safety Review in 8 Steps shows how the handoff changes when the team is already close to restart. The stored-energy walkdown belongs earlier, before the crew has emotionally committed to the task.

The common error is to let the job plan replace the field route. When that happens, the team walks the paper and not the plant.

Step 5: Prove the state of energy, not the presence of a lock

A lock, tag, or closed valve is a control signal. It is not the final proof. The team still needs to prove the actual state of the energy at the point where harm could happen. If the hazard is electrical, test for zero voltage with the correct device. If it is pressure, confirm zero pressure at the point where pressure can still be trapped. If it is motion or gravity, prove that the load cannot move.

The difference matters because a visible control can look complete while a hidden source remains alive. A gauge at zero may still sit downstream of trapped pressure. A breaker can be open while stored charge remains in the circuit. A valve can be closed while product sits in a dead leg or a bypass line.

James Reason's latent-condition lens fits this step because the visible action is often only the last link in a longer chain. The walkdown should test the chain, not just the lock.

Step 6: Separate containment from restart permission

Containment keeps the system from moving. Restart permission says the crew has verified the condition and completed the handback. Those are not the same decision, and the team should never blur them because the job feels urgent.

If the same person isolated the equipment and then greenlights restart without a second check, the group is trusting memory at the exact moment it should trust verification. That shortcut is easy to justify and hard to reverse, which is why the restart owner should be named before the work starts.

When two crews share the same equipment, the handback needs to be written, not guessed. The next crew should know which controls were applied, which energy states were verified, and who is allowed to release the job after the last check.

The common error is to call the equipment safe to begin when the team only means safe to isolate. That language mistake can hide a real control gap.

Step 7: Document deviations in plain language

If anything differs from the plan, write the difference in plain language. Say what was found, where it was found, who saw it, and what extra control is now required. Do not hide the mismatch behind a vague note or a file attachment that nobody will read in the field.

This is where Andreza Araujo's books are useful again. Safety Culture: From Theory to Practice keeps the focus on repeated decisions, while The Illusion of Compliance warns that a clean-looking permit can still mask a weak field control. A deviation note is only useful if it preserves the fact that the control was not as expected.

If the label is missing, write that. If the bleed point still holds pressure, write that. If a shared breaker creates uncertainty, write that and stop. The team can only fix what it names clearly.

The common error is to write a polite sentence that sounds complete but hides the problem. A good deviation record is short, factual, and specific enough that another supervisor could act on it without a phone call.

Step 8: Recheck after the first task or shift

The first cut, first lift, first open, or first test can reveal a missed energy path, which is why the same logic needs a second look after work starts. Recheck after the first task, after a crew change, or after a long interruption. The point is not distrust. The point is to catch the gap before the gap becomes the next incident.

In more than 250 cultural transformation projects, Andreza Araujo has seen that control routines fade when nobody schedules the second look. The first verification feels complete, yet the shift itself changes access, attention, and pressure. A recheck brings the team back to the field instead of letting the job drift on assumption.

The crew should ask the same question again. Is the energy state still what we think it is? If the answer is uncertain, stop and repeat the relevant step before moving on.

The common error is to assume the first proof protects the whole shift. Maintenance work rarely stays static long enough for that assumption to hold.

Final checklist for the supervisor

Use this checklist before the crew starts the task. If any item is missing, stop and fix it first.

• The job boundary is written in one sentence.
• Every stored energy source is named.
• One verification owner is assigned.
• The team walked the equipment in work sequence.
• The actual energy state was proved at the point of risk.
• Containment and restart permission were kept separate.
• Any deviation was written in plain language.
• A recheck is planned after the first task or shift.

A stored-energy verification walkdown works because it turns assumption into a field decision. If the team can prove the state of the equipment, it earns the right to start. If it cannot, the safest decision is still to wait.

For teams that want help turning this into a site standard, Andreza Araujo and ACS Global Ventures can help convert the walkdown into a maintenance routine that operators can actually use. Start at Andreza Araujo.