Learn Automation with MINATA #08: Energy Isolation: Seven Lockout and Tagout Steps Before Machine Repair
Learn Automation with MINATA #08: Energy Isolation — Seven Lockout and Tagout Steps Before Machine Repair
Pressing STOP, closing the HMI or turning the control switch to OFF only stops the machine in logic. None of it guarantees that the supply is separated, that the air is exhausted, that a suspended load is supported, or that a spring has released its force. In maintenance, the danger usually lives in the gap between "the machine is standing still" and "every hazardous energy is under control".
Lockout/tagout (LOTO) is the system of energy control that prevents unexpected start-up, or the release of stored energy, while someone is working on the machine.
This article explains the thinking and the structure behind a LOTO procedure. It does not replace the machine-specific procedure, the training of authorised employees, or the legal and standard requirements at the site.
Why a stop button is not an isolation point
Pushbuttons, selector switches, the HMI and interlocks all belong to the control circuit. A PLC fault, a welded contact, an action from another station or a restart command can change an output. OSHA 1910.333 states that control circuit devices such as pushbuttons, selector switches and interlocks shall not be used as the sole means for de-energising equipment.
An energy-isolating device has to physically prevent energy from reaching the machine: a lockable disconnect, an isolation valve, a mechanical block or pin, or another suitable device. Hanging a tag on the START button does not turn that button into an isolation point.
Start from the machine's energy map
A machine-specific procedure has to state the type of energy, its magnitude, where the isolation point is, how residual energy is dealt with, and how the isolation is verified. Walking around the machine with the electrical, pneumatic and mechanical drawings usually finds more sources than looking at the main panel does.
| Energy source | Example in an automated machine | What the procedure must define |
|---|
| Electrical | Main supply, UPS, back-feed, DC-link | Disconnect and isolate, lock, verify absence of voltage |
| Pneumatic | Receiver, valve branch, cylinder holding a load | Lock the supply valve, exhaust, watch for re-pressurisation |
| Hydraulic | Accumulator, cylinder, load on an axis | Isolate, bleed down, block against mechanical drop |
| Mechanical | Compressed spring, flywheel, rotating shaft | Release, block, restrain, or move to a safe position |
| Gravity | Lift table, die, gripper | Lower it, or use a designed pin or stand |
| Thermal / chemical | Heaters, steam, pressurised fluid | Isolate, cool, drain, and verify the condition |
OSHA 1910.147 covers not only electrical energy but mechanical, hydraulic, pneumatic, chemical, thermal and other sources. Where energy can re-accumulate, verification has to continue for as long as the hazard exists.
Seven steps of a controlled isolation
The exact sequence follows the site and machine procedure, but the core structure is:
1. Prepare
Establish the scope of work, every energy source, the isolation points, the authorised employee, the affected employees and the production state. Read the drawings, the LOTO sheet and the modification history; do not assume an old label is still correct after a rebuild.
2. Notify and shut down normally
Tell the affected employees, complete the shutdown in the order the operating instructions give, and move mechanisms to a position that reduces residual energy where the procedure allows it. Stopping in the right order avoids creating a new suspended load, trapped pressure or a jammed product.
3. Isolate each source
Operate every isolation device that was identified. A panel whose main disconnect is OFF may still carry a UPS, a 24 VDC feed from another cabinet, a shielded communication line or an auxiliary back-feed. A closed valve can still hold pressure on the machine side.
4. Apply personal locks and tags
The authorised employee applies the lockout and tagout devices as the procedure requires. The lock holds the isolation device in the safe position; the tag says who is in control and warns against operation. Everyone taking part must be protected under a system of individual accountability — a shared verbal message is not lock control.
5. Release or restrain stored energy
Exhaust air and pressure, allow capacitors to discharge according to the manufacturer's instructions, block loads, release springs, or restrain mechanisms with a designed device. OSHA requires stored energy that could cause harm to be relieved, disconnected, restrained or otherwise rendered safe.
6. Verify the isolation
Before work starts, the authorised employee verifies that isolation and de-energisation are effective. That can include attempting a start command as the procedure directs and then returning the control to a safe state, measuring to confirm the absence of voltage, checking pressure gauges, exhaust valves or the state of a mechanical block. Do not use one single indication for every source.
7. Do the work and keep control
On long jobs, across shift changes or with several crews, accountability and lock status have to be maintained through the group LOTO and shift-transfer procedure. Where pressure or energy can re-accumulate, monitoring continues; the first verification does not cover the whole shift.
Verify "no energy" source by source
What matters is proving that each hazard is controlled well enough for the work to be done, not simply seeing every indicator at zero.
- Electrical: confirm the equipment cannot start, and use suitable test equipment on the parts that will be contacted; watch for induced voltage and back-feed.
- Pneumatic and hydraulic: check pressure, the exhaust path, valve positions and whether pressure can return; a failed gauge is not evidence on its own.
- Gravity: confirm the load is lowered or blocked by an approved load-bearing element; do not rely on a control valve or a brake.
- Mechanical: wait for rotating parts to come to rest, restrain springs and counterweights, and check the transmission area.
Case: replacing a sensor on a vertical cylinder
The machine is at STOP and the control supply is off, but the cylinder is still holding a fixture above. Locking only the electrical disconnect leaves the load free to drop when a hose is removed or a valve leaks. The energy map has to include electrical, pneumatic and gravitational energy; the procedure has to name the isolation and exhaust valve, how the load is blocked, how pressure is verified, and the condition under which the block is removed afterwards.
This case shows that LOTO is not "a set of red locks". It is an energy model of the machine, turned into isolation points and verification evidence.
Restoring the machine is also a hazardous phase
Before energy is restored:
- Check the work is complete and that tools and foreign objects have been removed.
- Refit the guards and return the controls to the proper state.
- Confirm everyone has left the hazard area or is in a safe position.
- Remove locks and tags under the correct authority and procedure; never remove another person's lock.
- Notify the affected employees before restart.
- Restore energy in sequence and run a controlled functional check.
OSHA requires the machine area to be inspected before LOTO devices are removed, employees to be safely positioned, and affected employees to be notified. Where the employee who applied a lock is absent, the documented exception procedure applies — not a verbal decision on the floor.
Five common weaknesses in a procedure
- Listing electrical supply only, and leaving out air, gravity and stored energy.
- Using STOP, the HMI or an interlock as the isolation point.
- Isolation-point labels that no longer match the drawings or the equipment after a rebuild.
- Locks applied, but no step that verifies the isolation is effective.
- No rule for group LOTO, shift change, contractors, or energy that can re-accumulate.
A good procedure is specific enough that a trained person can identify the right point, the right method and the right evidence. The programme around it also needs training, periodic inspection and an update whenever the machine or the task changes.
Checklist for reviewing a machine's LOTO sheet
- Every type and magnitude of energy is identified.
- Each source has a numbered isolation point, shown on a drawing or a photograph.
- Residual energy has a defined way to be released, restrained or blocked.
- Each source has its own means of verification.
- The authorised and affected roles, and the way they are notified, are defined.
- Rules exist for several people, several crews, shift change and contractors.
- There is a sequence for removing locks and restoring the machine.
- The sheet is reviewed after a rebuild, or whenever a difference is found on the floor.
The core of LOTO is the control held by the person doing the work, and the evidence that hazardous energy cannot reach them. Locks, tags, drawings and verification have to form one system; with a link missing, a machine that is "stopped" is still not a machine that is safe to maintain.
Public references
- OSHA, 1910.147 — The control of hazardous energy (lockout/tagout): https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.147
- OSHA, 1910.333 — Selection and use of work practices.
View all MINATA technical articles