Lockout tagout (LOTO): energy isolation steps, group lockout and lock removal

What lockout tagout means

Lockout is placing a lock on an energy-isolating device, such as a circuit breaker, isolator switch or valve, so it cannot be operated until the lock is removed. Tagout is attaching a tag to that device warning that it must not be operated and saying who isolated it and why. Together they are the core of an energy isolation procedure, sometimes called lock, tag, try.

LOTO is needed whenever someone puts any part of their body where energy could hurt them: servicing a pump, clearing a conveyor jam, changing a cutting blade, cleaning a mixer, or working inside a tank with an agitator. Many machinery deaths happen during exactly this kind of short, "just a quick fix" job, when a colleague restarts the machine without knowing someone is inside, or a line that seemed empty still holds pressure.

Isolation is an engineering control near the top of the hierarchy of control, but it only works if the procedure is followed every time.

LOTO in Malaysian law and guidance

Malaysia does not have a stand-alone LOTO regulation. The duty comes from the Occupational Safety and Health Act 1994: section 15(2)(a) requires plant and systems of work that are safe and without risks to health so far as is practicable, section 15(2)(c) requires information, instruction, training and supervision, and section 18B (in force since 1 June 2024) requires a risk assessment and the controls it identifies. Breaches carry fines of up to RM500,000, up to two years in prison, or both.

The DOSH document that spells out lock and tag rules most clearly is the Industry Code of Practice for Safe Working in a Confined Space 2010. Its isolation section requires:

• de-energisation and lockout or tagout of machinery, mixers, agitators and other moving parts, with extra blocking where stored energy such as springs could release;
• stored hydraulic, pneumatic, electrical, chemical, mechanical and thermal energy reduced to a zero energy condition where practicable;
• where more than one person works inside, a system so that each person locks or tags the isolating device, keeping their own key;
• locks, tags and blanks removed only by the person who fitted them;
• re-energising done by the person who isolated, or another competent person authorised by the entry supervisor or permit issuer.

It also states that closing a valve is not positive isolation for process lines: use a blank, a spade, or at least two locked closed valves with the drain between them locked open. Many companies also base their LOTO programme on the US OSHA standard 29 CFR 1910.147, which sets out the steps below in detail.

The LOTO steps

1. Prepare. Identify every energy source and its isolation point from the equipment-specific procedure or isolation diagram. Know the type and size of energy and how to control it.
2. Notify. Tell the operator, the area authority and everyone affected that the equipment is being shut down and locked out. For hazardous work, get the permit to work and isolation certificate.
3. Shut down. Stop the equipment using its normal stopping procedure, so the shutdown itself does not create a hazard.
4. Isolate. Operate every energy-isolating device: open the breaker or isolator (not just the stop button or control circuit), close and blank or double-block valves, disconnect air and hydraulic supplies.
5. Lock and tag. Each worker fits a personal lock and a tag with their name, date and reason to each isolation point, or to the group lockbox.
6. Release stored energy. Bleed pressure, drain lines, discharge capacitors, lower or block raised parts, release or block springs, let flywheels stop, let hot parts cool. If energy can build up again, keep checking until the work ends.
7. Try out and verify. With everyone clear, try to start the equipment at its local controls, check gauges read zero and, for electrical work, a competent person proves the circuit dead with a tester checked on a known live source before and after. Then return the controls to off.
8. Do the work under the permit's conditions.
9. Restore. Remove tools and materials, refit guards, count everyone out and clear the area, tell affected people, then each worker removes their own lock. Re-energise in a controlled way.

Find every source: stored and hidden energy

The commonest LOTO failure is isolating the obvious source and missing another one. Check for each type:

Pressure equipment can surprise people: a closed valve can pass, and a "depressurised" line can still hold a plug of liquid. The Pressure Systems and Rotating Equipment lessons go deeper on these hazards.

Group lockout and shift change

When a crew works on equipment with many isolation points, a group lockout avoids every worker putting a lock on every isolator:

1. An authorised person (often the isolating authority) makes the isolations and fits locks to each point.
2. The keys go into a group lockbox, which that person also locks, and the isolations are listed on the isolation certificate.
3. Each worker on the job fits a personal lock to the lockbox before starting, after checking or witnessing the isolation and try-out, and removes it only when they personally stop work on the job.
4. The isolations cannot be removed until the last personal lock is off the box.

One person must have overall responsibility for the group and for knowing who is covered. When several crews or contractors share the isolations, one person coordinates them all.

For a shift change, the off-going and on-coming workers transfer protection in an orderly way: the incoming worker fits their lock before the outgoing worker removes theirs, so the equipment is never left with no personal lock on it. Record the handover on the permit or isolation log.

Removing a lock someone else fitted

The rule is that only the person who fitted a lock removes it. A common real-world problem is a contractor who goes home with their key in their pocket. Cutting the lock to restart production is how people get killed: the owner may still be inside the machine.

Have a written, controlled procedure for the rare case where the owner is not available. US OSHA 1910.147, which many Malaysian sites follow, allows removal by someone else only under a documented procedure that requires the employer to:

• verify that the worker who fitted the lock is not at the facility;
• make all reasonable efforts to contact them and tell them the lock has been removed;
• make sure they know before they return to work.

In practice, also have a senior person physically check the equipment and the area, confirm with the permit issuer that the job is closed, and record who authorised the removal and why. Treat every forced removal as an incident to investigate.

Common LOTO mistakes

• Stop button instead of isolator. A control circuit, emergency stop or interlock is not an energy isolation.
• Tag only. A tag can be ignored or fall off; it does not hold the device. Use tags alone only where a lock truly cannot be fitted, with extra measures.
• No try-out, or a try-out on the wrong unit because labels are missing.
• Shared or master keys and locks used for other purposes such as lockers. LOTO locks should be individually identified and used only for isolation.
• Missing a second feed, standby supply or connected line.
• No equipment-specific procedure, so each person improvises the isolation points.
• Contractors outside the system, using their own locks without the site's knowledge.

Audit LOTO in the field, not in the file. The Energy Isolation (LOTO) lesson lets staff find the energy sources, lock, tag and try in a 3D plant scene before doing it for real, and the Electrical Safety lesson covers prove-dead and arc flash. Brief a different energy type each week as a toolbox talk.