One late Friday afternoon not long ago, when I was serving as a ship’s reactor officer, the main propulsion assistant informed me that a red danger tag had been found hanging on the wrong component. What did that mean? It meant a sailor or civilian worker could have been injured or even killed performing maintenance on a live system in the propulsion plant.
At that point, two weeks into the maintenance availability period, the department had hung nearly 1,000 danger tags. This was the second tag found on the wrong component. I was crushed, especially in light of the other errors we had discovered: four danger tags unsigned by the second checker, two tags removed from the wrong components, and several tagout audits that had failed to identify issues critical to the safe performance of maintenance in the propulsion plant.
The tagout requirement for any type of maintenance on board all Navy ships dates from the late 1960s. Before then, as Rear Admiral Harley Francis Cope admitted in the third edition of Command at Sea, published in 1967, “tagout procedures were normally used only in industrial yards and plants and onboard tenders.” More than 50 years later, the program has not changed. Red danger tags are manually tied to valves and switches that would pose a danger to personnel or equipment if operated. Yellow caution tags provide special instructions to follow or precautions to take when operating a component of a system undergoing maintenance.
Human Error Is Unavoidable
As dependable as the tagout system has been, it leaves too much room for human error. Consider, for instance, a single month’s array of errors during a recent aircraft carrier maintenance availability: tags hung on or removed from the wrong system component; tags falling off components; tags not signed after they were hung; tags hung on systems that were still in operation; insufficient tags hung before work was authorized; tagout record sheets left unsigned; correct approval not obtained for tagouts on critical systems; single valve-to-sea not identified; systems inadequately isolated; and electricity still “live” in components after a system has been isolated. This particular aircraft carrier, it must be said, was not having an unusually poor start to the maintenance availability. Such a list is normal for virtually any Navy ship. The same mistakes are repeated continually in different departments, projects, and ports.
In his book Why We Make Mistakes, Joseph T. Hallinan concludes that human beings are biased, overconfident, irrational creatures of habit unaware of their limitations. A 22-year-old will work for 18 straight hours, then try to hang a tagout without realizing he or she has the cognitive ability of a person with a blood alcohol content of .05 percent.1 Most refuse to admit they have limits until they are involved in a near miss or serious accident. For example, when I was a 20-year-old student pilot, I flew into an approaching storm and got lost, even though I had full knowledge of the storm before the flight. I was focused on completing the planned flight, and nothing was going to stop me—except a serious accident. Fortunately, I survived (though I landed at the wrong airport with a bruised ego), and the experience taught me not to overestimate my personal risk management abilities.
Good leaders try to understand the limits of their sailors and prevent them from making poor decisions like mine, but overconfidence can never be completely eliminated, and what is true of a single individual is just as true of a hundred. In a complex maintenance overhaul where the larger departments must tag literally thousands of components over the course of several days, the risk of error rises proportionately.
By now the Navy should have a technologically aided tagout system that eliminates the more common tagout errors. At a minimum, ship systems should be designed with unique component nomenclature. That is not the case today. On most aircraft carriers, a danger tag is hung on the wrong valve in the firemain system about once a month. There are dozens of firemain cutout valves in the plant, all with the FM-GA11 nomenclature. The engineer who simplified the system diagram during the design phase probably thought that was an excellent idea, but it frustrates operators and maintainers and causes problems.
An Electronic Improvement
A design-phase resolution of the problem is of course impossible in an existing ship, but common misidentification errors could be eliminated technologically by using barcodes for each component and associating the barcode’s unique identifier with the component in the Electronic Shift Operations Management System (e-SOMS). That would add a third independent check to eliminate the possibility of human misidentification error. Most ships already have an automatic data-logging process using a portable electronic device that could be upgraded with a simple, hardened barcode reader built to withstand the harsh environment at sea. The first sailor posting the tag would find the component, scan its barcode, and then scan the danger or caution tag’s barcode to validate that they match. With the component-to-tag match authenticated, the first checker would hang the tag on the component in accordance with the Tag-Out Users Manual. The second checker would ensure there is still a “thinking sailor” to catch any electronic transcription errors not previously identified.
The same portable electronic device could be designed with a tagout login process that captures performance-related data on the sailor posting the tag. Information on the present state of sailors’ health, their experience on the system, their sleep the previous night, and how long they have currently been on duty could be analyzed instantaneously, and a data-based risk score assigned immediately. Any sailor scoring above a minimum risk level would then need electronic approval from a watch officer, or even a department head, to continue the tagout process. Such a real-time risk assessment would force a busy duty officer to slow down and evaluate what the sailor is being tasked to do. It could reduce overconfidence errors while also teaching junior officers and sailors risk management. Many would agree the surface navy needs that cultural shift.
Technological improvement may not prevent every possible tagout error, but upgrading the tagout process for 21st-century sailors adept at employing technology to good effect will help significantly. With the Navy set to grow again, it cannot afford to accept the risks of maintaining the newest ships in the fleet with an anachronistic tagout system. It is much cheaper to spend the time and effort now to get this work control process right. The lives of sailors might depend on it.
1. Lissette Calveiro, “Studies Show Sleep Deprivation Performance Is Similar to Being Under the Influence of Alcohol,” The HuffPost, 31 March 2016,