Lockout tagout: the procedure, step by step

Most machines that hurt maintenance staff were not running when the job started. They were stopped, and then something changed: someone pressed a start button, a valve opened, a ram drifted down under gravity, a capacitor held its charge. OSHA's overview of hazardous energy gives examples that every plant will recognize: a steam valve that opens automatically and burns workers repairing a pipe, a jammed conveyor that releases and crushes the worker clearing it, an electrical short that shocks someone repairing equipment.

The control of hazardous energy, usually called LOTO, is the answer to that problem. In the US it is required by OSHA's standard 29 CFR 1910.147 for servicing and maintenance in general industry. In the UK, HSE's guidance HSG253 covers the safe isolation of plant and equipment. In India, the OSH Code 2020 requires employers to provide plant and systems of work that are safe and without risk to health, along with the information, instruction, training and supervision needed; a written isolation procedure is how most plants meet that duty for maintenance work.

When a crew works on the same machine, every person needs the same protection as if they had locked it out alone. OSHA 3120 is clear on how: each authorized employee affixes a personal lock to a group lockout mechanism, instead of relying on a supervisor or other person to protect them.

• One authorized employee has primary responsibility for the group. They apply the isolations and put the keys to the isolation locks in a group lockbox.
• Every worker adds their personal lock to the lockbox before starting work, and removes it only when they have finished.
• The isolation locks cannot come off until every personal lock is off the box.
• Where more than one crew or craft is involved, one person coordinates the whole job.
• Contractors and the host plant tell each other their procedures, and the host makes sure its own employees understand and follow the contractor's.

Release is where many incidents happen, because the job is finished and people relax. The standard requires that before devices are removed and energy restored, the work area is inspected so non-essential items are removed and machine components are intact, that employees are safely positioned or removed, and that affected employees are notified once the devices are removed and before the machine is started.

Each lock is removed by the employee who applied it. The standard allows an exception only when that person is not available, under a specific written procedure: the employer verifies the person is not at the facility, makes all reasonable efforts to tell them their lock has been removed, and ensures they know before they resume work. Cutting a lock because someone went home without removing it should be rare and recorded.

Three levels of training

1910.147(c)(7) requires training so employees understand the purpose and function of the energy control program. Authorized employees, who apply locks, learn to recognize hazardous energy, the type and magnitude of energy in the workplace, and the methods for isolation and control. Affected employees, who operate or work near the machines, learn the purpose and use of the procedure. All other employees in the area learn not to restart or re-energize locked out equipment. Retraining is required when job assignments, machines or processes change, when procedures change, or when an inspection shows gaps in knowledge.

Annual periodic inspection

1910.147(c)(6) requires the employer to inspect each energy control procedure at least once a year. The inspection is done by an authorized employee other than the ones using the procedure being inspected. The employer certifies it, recording the machine, the date, the employees included and the person who inspected. Treat this as a real check: watch a lockout being done on the machine, compare it to the written procedure, and correct the procedure or the practice.

• Using the stop button as isolation. Control circuit devices are not energy isolating devices. A PLC can restart a machine; a locked disconnect cannot.
• Forgetting the second source. A backup supply, an air receiver, a gravity-loaded ram, a heat source. The isolation list must name every one.
• Skipping the try-out. Locking the wrong isolator is easy when labels are missing. Verification catches it.
• Leaving controls in the start position after the try-out. When the locks come off, the machine starts. Always return controls to off.
• One lock for the crew. A supervisor's lock protects nobody else. Every person on the job needs their own lock on the isolation or on the group box.
• Generic procedures. A single plant-wide poster does not tell a technician which valve to close on this machine.
• Annual inspection on paper only. Signing a form without watching a lockout being done defeats the purpose of the inspection.
• Tagout where a lock would fit. Tags do not physically stop anyone. If the device can take a lock, use one.

The EHS module in MaintenanceIQ is licensed and switched on per site. It includes a lockout isolation register with personal locks and a no lock, no release rule, so an isolation cannot be released while a personal lock is still on it. Work permits sit in the same module, with gas tests, named crew and a gated handback.

Because the EHS registers sit beside the maintenance work order and the machine's history, the isolation for a repair and the repair itself are on the same record. See the EHS module for the full list of registers, including HIRA, permits and competency.