Lockout/Tagout & Energy Isolation

Lockout/tagout is the procedure that makes a machine physically incapable of hurting you, and then proves it.

Both halves matter and the second one is the half people skip. Applying a lock is an intention. Verifying zero energy is the only thing that turns that intention into a fact, and it is the step that separates a procedure that works from a procedure that has been performed.

Three things, in order

Identify every energy source feeding or stored in the machine. Isolate each one at a device that can be locked. Verify that the machine is now at zero energy, by test rather than by assumption.

Chapter 1 built the first of those — the habit of cataloguing energy rather than machines. This chapter is what you do with that list.

Lockout and tagout are not two names for the same thing

A lock physically prevents the isolator from being operated. A tag is a written warning that says do not operate, and stops nothing at all.

Put them in Chapter 1's hierarchy of controls and the difference is stark: a lock is an engineering control, and a tag is an administrative one. A tag works only if the person who finds it reads it, understands it, believes it, and chooses to obey it. That is four opportunities to fail, and every one of them has happened.

Tag-only isolation exists for the genuine cases where a device cannot accept a lock. It is a much weaker control, it needs extra measures around it, and it should never be the default because somebody could not find a lock.

Every source gets its own isolation

The picture is the argument. A learner who has only ever seen a main disconnect tends to imagine isolation as one action, in one place, done once. On a real machine it is a set of actions in different places, belonging to different trades, and some of them do not involve an isolator at all.

| Energy | Isolation device | What is still live afterwards | | --- | --- | --- | | Electrical | Lockable disconnect or breaker | Drive DC bus, capacitors, UPS, control supply fed from elsewhere | | Pneumatic | Lockable valve with a bleed | Everything downstream until bled — cylinders park mid-stroke | | Hydraulic | Lockable valve | Accumulators, and any load held up by pressure | | Gravitational | None — needs a mechanical block or pin | The load, until it is physically supported | | Stored mechanical | None — needs release or restraint | Springs, tensioners, wound take-ups | | Thermal | Isolation stops the input, not the heat | Anything hot, for as long as it takes to cool | | Rotational | None — needs coast-down time | Fans and flywheels, for seconds to minutes |

Read the third column as the chapter's real content. Isolation deals with the supply. Stored energy is a separate problem that has to be dealt with separately, and it is where the isolation-shaped hole in most people's mental model sits.

Verification is a test, not a feeling

Once everything is locked and the stored energy is released, you prove zero energy. There are two independent tests and you want both, because they check different things.

The try-out. Attempt to start the machine by its normal controls, then return them to off. If it does not start, you have proved the control path is broken.

The instrument test. Measure at the point you are about to work on, with a meter you have proved live-dead-live (Chapter 3). If you read zero, you have proved the power path is broken.

Neither substitutes for the other. A machine can fail to start because a PLC output is de-energised while the terminals you are about to touch sit at full supply voltage — the try-out passes and the circuit is live. Equally, a meter on one conductor tells you nothing about a second supply feeding the same machine from a panel around the corner.

Group lockout, when more than one person is exposed

One lock per isolation point works for one person. As soon as a second trade is involved, you need a way to guarantee no isolation can be lifted while anybody is still exposed — and you need it to be a physical guarantee, not a recollection.

The property that makes this work is that the box is a choke point. There is no route from "work finished" to "machine live" that does not pass through every individual removing their own lock. Nobody has to remember who is still inside, because the hardware remembers.

The same logic scales down. Even working alone, your lock is what stands between a well-meaning colleague and a machine with you inside it.

Isolations that outlive a shift

Work does not always finish before the shift does, and a half-finished isolation is one of the more dangerous objects on a plant — it looks safe and its owner has gone home.

Sites handle this with a formal transfer: a continuity or transfer lock applied by the outgoing person and accepted by the incoming one, recorded in writing, with the machine's state described rather than assumed. What must never happen is the isolation quietly persisting with nobody's name against it, or a supervisor cutting a lock off at end of shift to get the line back.

Restoring is a procedure too

The work being finished is not the end. Restoration has its own sequence and its own failure mode, which is that everybody's attention has already left.

Check the machine is mechanically complete — guards refitted, tools out, parts back. Check that every person is physically clear, by looking, not by asking the room. Notify the affected people that it is coming back. Then each person removes their own lock, and only then is energy restored, stored-energy blocks withdrawn, and the machine restarted under control.

The sequence itself. Each step exists because skipping it has killed somebody, which is an unusual property for a procedure and worth remembering while doing it.

1. Inventory every energy source before touching anything

   Safety

   Electrical, pneumatic, hydraulic, gravitational, stored mechanical, thermal, chemical, rotational. Walk the list explicitly rather than from memory, and for each one note two things: where its isolation device is, and whether it holds energy after that device is locked. The machine's isolation schedule or its drawings are the source of truth, not the labels on the panel.

2. Notify everyone the shutdown affects

   Operators, the shift running the line, the control room, anyone upstream or downstream who is about to lose a machine. This is not courtesy — an operator who does not know why the line stopped is an operator who will try to restart it.

3. Shut down by the normal method

   Use the machine's own stop sequence rather than pulling the disconnect on a running machine. A controlled stop leaves the machine in a known state, parks axes predictably, and avoids the damage and the surprise stored-energy states that an abrupt kill can create.

4. Isolate every source at its own device

   Safety

   Operate each isolator fully — a disconnect that is stiff and has not quite thrown is a disconnect that has not isolated. For pneumatics and hydraulics that means the isolating valve, not a regulator or a solenoid, because a solenoid is a control device and can be commanded back on.

5. Apply your own lock and tag to each isolation

   Safety

   Your lock, your key, your name on the tag. If more than one person is exposed, the keys go into a lock box and every person's personal lock goes on the box. The tag records who and why; the lock does the work.

6. Release or restrain every stored energy source

   Safety

   Bleed the air and confirm the gauge reads zero. Dump the accumulator. Block or pin raised loads mechanically — a support, not a sign. Let the DC bus discharge for the drive manufacturer's stated time. Let rotating masses stop and confirm they have. Release or restrain springs and tensioners.

7. Verify zero energy — both tests, at the point of work

   Safety

   Attempt a normal start, then return the controls to off: that proves the control path. Then measure at the terminals you are going to touch, with a meter proved live-dead-live: that proves the power path. Do the instrument test where your hands will be, not at the isolator, because the two are only the same point if nothing is fed from anywhere else.

8. Re-verify after any interruption

   Safety

   A break, a shift change, a second crew arriving, or your own absence from the machine for any length of time. You are re-establishing a fact about the present, not repeating a ritual — in the interval, somebody may have needed that machine.

9. Restore deliberately, and in order

   Machine mechanically complete, guards on, tools out, people physically clear — checked by looking, not by asking. Notify that it is coming back. Each person removes their own lock. Then energy on, blocks withdrawn, and restart under control with everybody watching the first cycle.

• Verifying with the start button and stopping there

  Why

  It is a real test that proves a real thing, and it gives immediate, confident feedback: you pressed start and nothing happened. That feeling is the problem, because what it proves is that the control path is broken, and the conductors you are about to touch live on the power path. The two failures look identical from the operator's station and completely different from inside the panel.

• Trusting the label on the isolator

  Why

  Labels are written once and the plant changes forever afterwards. Circuits get moved during modifications, panels get re-used, and schedules get updated last if at all. The label tells you what somebody believed at the time. The meter at the point of work tells you what is true now.

• Isolating the solenoid instead of the supply

  Why

  On pneumatics and hydraulics it is easy to de-energise the valve that is holding a cylinder and treat the resulting stillness as isolation. A solenoid valve is a control device: it can be commanded, forced, or fail. Isolation means the isolating valve, locked, with the downstream side bled.

• Accepting somebody else's isolation because they are more senior

  Why

  Experience does not transfer through a padlock. You cannot see what they inventoried, only that something is locked, and their list may have been complete for the job they were doing and not for yours. Your own lock on the isolation is not a comment on their competence; it is the only thing that makes your safety depend on your own list.

• Treating the DC bus wait as padding

  Why

  A drive's stated discharge time reads like a manufacturer being cautious, and the machine is silent and dark well before it elapses. The capacitors do not care that the disconnect is locked. This is one of the few hazards in this chapter with no external sign at all — nothing looks, sounds or smells different at four minutes than at six.

• Losing the isolation at handover

  Why

  The outgoing technician knows exactly what is isolated, what is stripped, and what is half-finished, and all of it is in their head at the moment they walk out. Anything not physically visible and written down is gone. The next person inherits a machine that looks ready and is not.

Five questions. Each is answerable by reasoning about a situation rather than by recalling a rule, which is the point of the whole course.