Lock-out Tag-out

What is Lock-out Tag-out?

Lock-out Tag-out (LOTO) is a safety procedure in which every energy source of a machine or installation is switched off, locked in the off position with a personal padlock and marked with a tag, so that nobody can start the installation unexpectedly while maintenance, repair or cleaning is under way. It is not only about electricity: compressed air, hydraulic pressure, loaded springs, gravity, heat and chemicals must also be brought to a zero-energy state. LOTO is therefore a core element of machine safety and of industrial safety, alongside the work permit and the LMRA.

🧠 Why is LOTO needed?

During maintenance, people stand inside the danger zone of a machine, in places that guards are designed to keep them out of during normal operation. Accidents almost always happen in the same few ways:

• Someone else switches it on - an operator or colleague does not know work is in progress and starts the machine from an HMI or control panel.
• Automatic start - a PLC program, timer or level control starts a pump or conveyor as soon as a condition becomes true.
• Stored energy - a cylinder drifts down, a spring releases or a capacitor in a variable frequency drive is still charged after switch-off.
• Wrong isolation - the technician opens the wrong circuit breaker or overlooks a second supply.

The US Occupational Safety and Health Administration (OSHA) names craft workers, electricians, machine operators and labourers as the groups most at risk. The principle of one person, one lock, one key ensures that only the person standing in the danger zone can release the installation again.

🔧 How does a LOTO procedure work step by step?

The US regulation OSHA 29 CFR 1910.147 prescribes a fixed sequence, which also forms the basis of European procedures:

Verification is the most important step and the one most often skipped. A switch in the off position proves nothing if the wiring differs from the drawing.

🔐 What counts as energy isolation and what does not?

OSHA defines an energy isolating device as a mechanical device that physically prevents the transmission or release of energy, such as a circuit breaker, disconnect switch, line valve or block. Push buttons, selector switches and other control-circuit devices explicitly do not qualify. In automated installations that distinction is crucial:

An interlock or safety relay protects people during short interventions in normal operation, such as clearing a minor jam. For maintenance where someone works inside the machine for longer or with their whole body, physical isolation with a padlock is the norm.

🧱 Which laws and standards apply to LOTO?

LOTO is not a term used in Dutch legislation, but the obligation follows from several rules:

For electrical work, EN 50110-1 contains the well-known five safety rules: disconnect completely, secure against reconnection, verify the absence of voltage, earth and short-circuit, and protect against adjacent live parts. Lock-out is the second rule. NEN 3140 adds roles such as the person responsible for the installation (installatieverantwoordelijke), the person responsible for the work (werkverantwoordelijke) and the skilled person, which determine who may isolate.

🏭 How do you organise LOTO in practice?

A working LOTO programme is more than padlocks in a cabinet. The elements OSHA requires are a useful framework in Europe as well:

• Machine-specific instructions - one card per installation with photos of each isolation point, the energy type and the verification method. Store them in the CMMS so that every work order refers to the right card.
• Standardised padlocks - recognisable by colour or shape, used only for LOTO, marked with the owner’s name and durable in the environment.
• Group lockout - for a team, a coordinator locks the isolation points and puts the keys in a group lock box, to which every technician attaches a personal padlock.
• Shift change - an explicit handover, so there is never a moment when nobody controls the installation.
• Removing an absent person’s lock - only through a documented procedure in which the supervisor first verifies that the owner is no longer on site and informs them.
• Annual inspection - OSHA requires another authorised employee to review each procedure at least once a year.
• Training - authorised technicians learn to carry out the procedure; other staff learn never to ignore a lock or tag.

LOTO connects with other tools. When working in a confined space, you also isolate pipelines with blind flanges. A risk assessment determines which energy sources exist, and a near miss involving LOTO belongs in incident management.

🔄 What does LOTO mean for IT/OT?

In a modern plant, an installation can start in more ways than with the button on the machine. A SCADA operator in the control room, a batch recipe, a supplier with remote access or an automatic restart after a network outage can all set a motor moving. Physical isolation neutralises every one of those commands, but only if the lock hangs on the right point.

Practical measures where IT and OT meet:

• Make the status visible - show in the HMI that an installation is under LOTO, but never rely on that software indication as protection.
• Block remote access - do not allow remote work on the same installation during LOTO, and tie this to your remote maintenance policy.
• Manage changes - a new supply, an extra MCC bucket or a rebuilt control cabinet means an updated LOTO card through change management.
• Digital LOTO - electronic permit systems link work orders, isolation points and padlocks, but the physical lock remains decisive.

Maintenance on sensors and actuators also calls for LOTO when moving parts or process pressure are nearby.

❓ Frequently asked questions

What is the difference between lock-out and tag-out?

Lock-out is physically locking an energy isolation point with a personal padlock so that it cannot be operated. Tag-out is attaching a label with name, date and reason. A tag alone provides no physical protection, and OSHA only permits tag-out on its own if locking is genuinely impossible or demonstrably just as safe.

Is Lock-out Tag-out mandatory in the Netherlands?

Lock-out Tag-out is not named in the Dutch Working Conditions Act, but the Working Conditions Decree requires that work equipment can be separated from every energy source and that maintenance is carried out safely. Electrical work falls under NEN-EN 50110-1 and NEN 3140, where securing against reconnection is one of the five safety rules. In practice, the Dutch Labour Inspectorate therefore expects a lockout procedure.

Is an emergency stop enough to work safely on a machine?

No, an emergency stop is a means for emergencies, not energy isolation. After a reset the control system can restart the machine, and the supply remains present. For maintenance you must physically isolate and lock the energy sources with Lock-out Tag-out.

Who may remove a LOTO padlock?

A LOTO padlock may only be removed by the person who applied it. If that person cannot be reached, a supervisor may remove the lock only through a documented procedure that first establishes that the owner is no longer inside the installation.

What is group lockout in LOTO?

In group lockout, a coordinator locks all isolation points and places the keys in a group lock box. Each technician then attaches their own padlock to that box. The installation stays locked until the last person has finished and removed their lock.

Does a PLC stop or Safe Torque Off count as LOTO?

No, a stop via a PLC, HMI or SCADA is a control function that software or another user can override. Safe Torque Off prevents a motor from producing torque, but the variable frequency drive stays energised. LOTO requires a physical isolating device, such as a lockable main disconnect or valve.

📌 In summary

Lock-out Tag-out protects people against the unexpected release of energy during maintenance. The procedure combines physical isolation, personal padlocks, warning labels, dissipation of stored energy and mandatory verification. In the Netherlands the obligation follows from the Working Conditions Decree, NEN 3140 and machinery legislation, and in automated plants LOTO is also the only reliable protection against a start triggered by software or from a remote location.

Lock-out Tag-out means isolating every energy source physically, locking it with your own padlock and verifying that no energy remains before you start work.