LOTO (Lockout/Tagout/Isolation)

What is LOTO isolation?

LOTO is far more than attaching a padlock to a switch. It's a systematic process for achieving a "Zero Energy State" where all energy sources—active, stored, and potential—have been identified, disconnected, dissipated, and restrained.

Data from Safe Work Australia shows that plant-related incidents involving uncontrolled energy releases remain a leading cause of workplace amputations and fatalities. Failure to effectively isolate plant appears repeatedly in coronial inquests and regulatory prosecutions as a primary causal factor.

In Australia, you won't find a single "LOTO regulation" like the US OSHA standard. Instead, isolation requirements are embedded within the broader plant safety framework of the Work Health and Safety Act 2011 and supporting regulations. The intent is identical: prevent the catastrophic consequences of unexpected startup by ensuring no one can energize plant while people are working on it.

Your legal obligations

Primary duty under the WHS Act

Section 19 of the WHS Act imposes a primary duty on you as a Person Conducting a Business or Undertaking (PCBU). You must ensure, so far as is reasonably practicable, the health and safety of your workers. This explicitly extends to providing safe plant and safe systems of work.

You can't simply hand out locks and tags. You must provide a complete system—hardware, procedures, training, and verification—that ensures your plant is isolated before maintenance occurs.

Regulation 210: Lockable isolation points

Regulation 210 of the Model WHS Regulations mandates that operator controls on plant must be able to be locked into the "off" position to enable disconnection of all motive power. This requirement makes all industrial machinery supplied in Australia must be capable of accepting a lockout device.

Any machinery that relies solely on a start/stop button or software command for shutdown is non-compliant. Control circuits are susceptible to software bugs, contact welding, and electromagnetic interference—they cannot be relied upon for isolation.

Regulation 208: Guarding and isolation

When maintenance, cleaning, or repair requires access to normally guarded areas, you have two options: use interlocked physical barriers that automatically deactivate the plant, or isolate the plant completely. This regulation effectively removes the option of working on live plant for routine maintenance.

Worker responsibilities

Section 28 creates reciprocal duties. Your workers must take reasonable care for their own health and safety and comply with your reasonable instructions. A worker who knowingly bypasses an isolation procedure or fails to apply their personal lock breaches the Act and faces potential personal liability.

Understanding hazardous energy

To effectively isolate plant, you must understand what you're controlling. "Energy" extends far beyond electricity—a comprehensive isolation identifies all energy sources including stored and potential energy.

The critical danger of stored energy

A critical failure mode in LOTO is neglecting stored energy. Unlike active energy supplied from an external source, stored energy resides within the machine itself and remains dangerous after the power is cut.

Hydraulic accumulators store fluid under pressure to dampen pulsations or provide emergency power. Closing the supply valve from the pump does not depressurize the accumulator. If a hose is disconnected downstream, the accumulator can discharge its entire volume in seconds, driving a cylinder with lethal force.

Variable Speed Drives (VSDs) contain large capacitors that retain a lethal electrical charge for minutes after main power is cut. Isolation procedures for VSDs must include a mandatory wait time (often 5-10 minutes) or soft-discharge verification before covers are removed.

A raised dump truck bed or press brake ram held up by hydraulic pressure possesses significant potential energy from gravity. If the hydraulic hose bursts during maintenance, gravity accelerates the load downward. Physical chocks or props must be inserted to mechanically block descent—hydraulic pressure alone is not a control.

The 9-step isolation procedure

A compliant isolation follows a rigorous workflow designed to create multiple layers of defense against human error. Each step builds verification into the process.

Step 1: Preparation and scoping

Define the scope of work and identify the equipment. Consult P&IDs (Piping and Instrumentation Diagrams) and electrical single-line diagrams to trace all energy sources. Generate a written Permit to Work or Isolation Matrix at this stage to document what will be isolated and why.

The risk here is "scope creep" where work extends to nearby machines that weren't isolated. Clear boundaries prevent this.

Step 2: Notification

Notify all affected parties including operators who need to know why their machine is stopping and downstream processes that might be affected by loss of flow. Failure to notify can create new hazards like tank overflows or process upsets.

Step 3: Shutdown

Shut down the plant using normal operating controls (the Stop button). This ensures the machine is not under load when you throw the main isolator, reducing the risk of arc flash and mechanical stress on switchgear.

Step 4: Isolation (de-energisation)

Operate the isolation devices—turn rotary handles to "OFF," close gate valves, disconnect power supplies. This is the physical disconnection required by Regulation 210.

Step 5: Dissipation of stored energy

This is often the most critical step for preventing crush injuries. Bleed hydraulic pressure to tank, vent air receivers, insert mechanical chocks or pins to support gravity loads, and wait for flywheels to run down. Never assume stored energy has dissipated—verify it.

Step 6: Application of lockout and tagout

Apply your personal lock and Personal Danger Tag (PDT) to the isolation device. The fundamental principle is "One Person, One Lock." If five people are working, five locks must be applied (often using a multi-lock hasp). This ensures the plant cannot be started until the last person removes their lock.

Step 7: Verification (the "try start")

Also known as "Test for Dead" or "Try Step." Attempt to start the machine using normal start controls and verify it does not start. Return controls to "OFF" position.

For electrical systems, use a voltage tester to prove zero volts on all phases. Follow the "Test the tester, Test the circuit, Test the tester again" protocol. This step catches the common error of isolating the wrong motor in a bank of identical machines.

Step 8: The work activity

Proceed with maintenance, cleaning, or repair. The isolation must remain in place for the entire duration. If conditions change or unexpected hazards are discovered, stop work and reassess.

Step 9: De-isolation and restoration

Check the work area is clear of tools and personnel. Replace all guards and safety devices. Remove personal locks and tags (only by the owner, never by someone else). Notify affected parties, then re-energize and restart following the correct sequence.

LOTO hardware and devices

The integrity of your isolation system depends on quality hardware and standardization. Inconsistent equipment creates confusion and undermines the system.

Padlocks

Standardize padlocks by color to indicate function. A common Australian convention is:

• Red: Personal Danger Lock (protects a life)
• Yellow: Equipment/Transition Lock (protects the machine/isolation point)
• Blue: Coordinator/Master Lock

Locks must be "Keyed Different" (KD) so no one key opens another person's lock. "Keyed Alike" (KA) sets are strictly for single users with multiple locks, but create risk if mixed up.

Personal Danger Tags (PDT)

Australian standards distinguish clearly between tag types. A Personal Danger Tag is usually red/white/black with "DANGER DO NOT OPERATE." It must carry the name, photo (optional), and date of the person working. It acts as a personal prohibition notice and must always accompany a personal lock.

An Out of Service Tag (OOS) is yellow/black with "CAUTION OUT OF SERVICE." It indicates the device is faulty or under repair but does not provide personal protection for someone inside the machine. It doesn't require a lock, though locking it is best practice.

Hasps and valve lockouts

Multi-lock hasps (scissors) allow multiple padlocks to be attached to a single isolation point. They're essential for group isolation. Valve lockouts include clamshells for gate valves and cable lockouts for ball valves—these prevent valve handles from being moved.

Group isolation with lockboxes

For large machinery with many isolation points and many workers (like a dragline with 20 energy sources and 50 workers), a lockbox system manages complexity:

1. The Isolation Officer isolates all 20 points and applies Yellow Equipment Locks
2. The keys to these 20 locks are placed inside a Lockbox
3. The Isolation Officer verifies the zero energy state
4. Each of the 50 workers places their Red Personal Lock onto the outside of the Lockbox
5. The box cannot be opened to retrieve keys until the last personal lock is removed

Technical standards compliance

Australian Standards provide the engineering benchmarks for isolation design and performance. Compliance with these standards demonstrates you've met your duty under the WHS Act.

AS 4024.1603: Prevention of unexpected start-up

This standard, part of the Safety of Machinery series, specifies that isolation devices must:

• Ensure reliable disconnection from the energy supply (breaking electrical contacts by sufficient distance to prevent arcing)
• Have clear, unambiguous visual indication of the "OFF" or "OPEN" position
• Be capable of being locked in the "OFF" position
• Not be capable of being locked in the "ON" position

The standard distinguishes between "control guarding" (interlocks) and "isolation." An interlocked gate that stops a machine when opened is not an isolation device because it acts on the control circuit, not the power circuit. For full body access or major maintenance, full isolation is required.

AS/NZS 4836: Safe working on low voltage installations

For electrical work, this standard reinforces the "Test for Dead" rule—all conductors must be treated as energized until proven de-energized by recognized test procedures. It also mandates Personal Protective Equipment like insulating gloves and flame-retardant clothing during isolation and testing, as the risk of arc flash is highest during switching operations.

Common failure modes

Despite robust regulations, LOTO failures continue to occur. Understanding these failure modes is essential for prevention.

The "tag-only" fallacy

Historically, some industries relied on tagging without locking. This practice is now widely recognized as insufficient and dangerous. A tag is merely a warning—it provides no physical restraint. Tags can be blown off by wind, removed by cleaners, or ignored by distracted operators.

Current WHS codes state that tag-only isolation is acceptable only if locking is not reasonably practicable (on legacy equipment). Even then, you must demonstrate the tag system provides an equivalent level of safety, often requiring additional measures like disconnecting cables or removing handles.

The "minor servicing" trap

Australian WHS regulations don't have an explicit "minor servicing exception" that waives the duty to guard. For tasks like clearing minor jams where full lockout is impractical due to frequency, the industry accepts the use of interlocked guarding (Category 3 or 4) as a control.

However, this is not isolation. If the task requires putting your whole body into the machine, or if the interlock fails, you're exposed. Risk assessments must carefully delineate when interlocks are acceptable versus when full isolation is mandatory.

Emergency removal of locks

The "lost key" scenario where a worker goes home with their lock still on plant creates operational headaches. Cutting a lock bypasses the primary safety system and requires strict protocols:

1. Attempt to contact the worker to confirm they're not on site
2. Inspect the machine to ensure it's safe to energize and no one else is inside
3. Require authorization from a senior manager
4. Cut the lock using bolt cutters
5. Notify the worker immediately upon their return—before they approach the machine—to prevent them assuming their protection is still in place

Shift handover challenges

Leaving personal locks on unmanned equipment during shift changes can lead to lock-cutting scenarios. Use a "Transition Lock" or "Departmental Lock" (often a different color) to maintain isolation integrity while freeing the personal lock owner. The oncoming shift applies their personal locks before removing the transition lock.

Best practices for implementation

To ensure your LOTO system meets legal requirements and functions effectively, implement these strategic practices.

Create LOTO matrices for every asset

Don't rely on worker memory to find isolation points. Every significant asset should have a dedicated Isolation Matrix or LOTO Procedure Sheet containing:

• Asset ID and name
• Photos of all isolation points (electrical, hydraulic, pneumatic)
• Type of isolation device required (e.g., "Ball Valve Lockout Size 2")
• Method of verification for each point
• Sequence of isolation

Base authorization on competency, not seniority

Permit issuer designation must be based on demonstrated competence in the specific hazards of each area. Only the ammonia plant supervisor should issue permits for ammonia areas. Specific training units like MSMPER200 are often required in resources sectors.

Use visual management

Display active isolations at worksites in weatherproof holders, allowing inspectors and other workers to verify current status. Maintain a central permit board in the control room that mirrors field status using tags, providing a single source of truth for all current high-risk work.

Enforce competency assessment

Training must include practical assessment where workers demonstrate their ability to identify energy sources on actual plant, correctly apply locks and tags, and perform the "Try Start" verification. Apprentices and trainees shouldn't be issued personal locks until deemed competent—they should work under the direct supervision and protection of a competent tradesperson's lock.

Manage contractors carefully

Contractors are at elevated risk due to unfamiliarity with your site. The site host should always isolate equipment first and apply a "Host Lock." The contractor then applies their lock. This ensures you retain control of the asset while the contractor retains control of their personal safety.

For large projects, create a bridging document that aligns the contractor's LOTO system with your system—lock colors, permit procedures, and verification requirements must be clearly understood by all parties.

Conduct field audits, not just paperwork checks

Safety advisors should visit active jobs and ask permit holders to explain their isolation conditions without reading the document. If they can't answer, the communication function has failed regardless of signatures. Verify locks are actually in place, not just signed for. Check that stored energy has been genuinely dissipated, not just assumed.

References

• Safe Work Australia, Model Code of Practice: Managing the risks of plant in the workplace, Australian Government, 2022
• Safe Work Australia, Model Work Health and Safety Regulations, Regulations 207, 208, 210, 213, 2022
• WorkSafe Victoria, Isolate, de-energise, lockout and tagout plant, State Government of Victoria, 2023
• Standards Australia, AS 4024.1603-2006 (R2014) Safety of machinery—Design of controls, interlocks and guards—Prevention of unexpected start-up
• Standards Australia, AS/NZS 4836:2023 Safe working on or near low-voltage electrical installations
• WorkSafe Victoria, More than 150 limbs or digits lost in workplace incidents, Media Release, January 2023
• SafeWork NSW, Code of Practice: Managing the risks of plant in the workplace, NSW Government, 2022
• SafeWork NSW, Plant, Equipment and Machinery Energy Isolation Guidelines, NSW Government, 2023