Lockout tagout: the LOTO program behind the padlock

Lockout tagout — LOTO — is the control of hazardous energy during servicing and maintenance: isolating every energy source feeding a machine, locking each isolation in the safe position, tagging it to say who applied the lock and why, and verifying that the machine cannot start before anyone puts a hand inside it. The padlock is the visible part. The programme around it is what actually prevents the injury.

Most serious incidents in this area do not happen because somebody skipped the lock. They happen because one energy source was missed — stored pressure, a capacitor, a raised load held by gravity, a second feed nobody documented — or because a machine was re-energised while another person was still working on it.

What a lockout tagout program contains

• A written energy control programme: the policy, the responsibilities, and how it is enforced.
• A machine-specific procedure for each piece of equipment, listing every energy source and the sequence for isolating, locking, releasing stored energy and verifying zero energy.
• Devices: locks that are unique to each person, tags, hasps, valve and breaker covers, and a rule that a personal lock is removed only by its owner.
• Group lockout arrangements for multi-person or multi-trade work, with a lock box and a named person controlling it.
• Shift handover rules — the point at which control most often lapses.
• Contractor coordination, so an outside crew and your own people are inside one system rather than two.
• Training by role: authorised employees who apply locks, affected employees who operate the machine, and everyone else who needs to know not to touch.
• Annual review of each procedure, observed in use rather than read at a desk.
• A defined route for removing a lock whose owner is unreachable, requiring verification and management authorisation.

Stored energy is the part that gets missed

Switching off the supply is not isolation. Hydraulic and pneumatic pressure remains in the lines, capacitors hold charge, springs stay compressed, a raised platform or tool remains held by gravity, and thermal energy persists long after the power is off. A machine-specific procedure earns its cost precisely here: it names each of those for that machine and says how each is released or blocked. Verification — attempting a start with the controls, testing for absence of voltage, bleeding down a line and confirming zero on a gauge — is the step that converts a belief into a fact.

Write the procedure at the machine, with the machine in front of you, and have somebody who maintains it walk through it. Procedures written from a manual routinely miss a feed that was added years after installation and appears on no drawing.

Tags are not locks

A tag communicates; a lock prevents. Where an isolation device physically cannot accept a lock, a tag-only approach carries additional requirements and additional risk, and the correct long-term answer is usually to modify the isolation so it can be locked. Treating a tag as equivalent to a lock is a documented cause of serious injury, and it is the shortcut that becomes normal quietly, one machine at a time.

Keeping the procedures usable

A LOTO programme lives or dies on whether the machine-specific procedures are current, findable at the machine, and reviewed. Ettex Docs holds them with version history so the version in force is recoverable and a revision is visible; Ettex Forms collects the annual procedure reviews and the observations that go with them; and Ettex Records keeps the training records per person and per role alongside the equipment file — the same file that holds the permit to work paperwork where the two systems meet.

Plainly: this is documents, forms and records, not a safety system, and none of it is safety advice. What your programme must contain, and the specific requirements for tag-only isolation and for group lockout, come from your regulator and from competent advice.