Lockout Tagout (LOTO): Isolating Plant Safely When Contractors Do the Work

In many buildings and depots, the people working on isolated plant are not the site's own staff. They are the HVAC technician, the lift mechanic, the electrician, and the cleaner clearing a jam, each relying on an isolation someone else may have set up. This guide is for the facilities manager and the operations lead who let contractors work on plant they do not own, and need the isolation to be right every time.

The examples come from a hospital plant room in property and facilities management and a parcel sorting depot in transport and logistics. They are illustrations, not customers.

What Is Lockout Tagout?

Lockout tagout, often shortened to LOTO, is a procedure for making sure plant cannot move, start, or release energy while someone is working on it. Safe Work Australia's plant code describes an isolation procedure as a set of predetermined steps to follow when workers maintain, repair, install, or clean plant, so that hazardous energy is isolated and the plant does not move or start up accidentally.¹ It calls the lock-out process the most effective isolation procedure.¹

The two halves do different jobs. The lock physically stops the isolator being switched back on. The tag tells everyone else why it is locked and who locked it.

What Is the Difference Between a Lock & a Tag?

A lock isolates and a tag informs. The plant code is direct about it: tags should only be used to give information to others at the workplace, a tag should not be used on its own as an isolation device, and only a lock is effective in isolating the energy source.¹

That rules out a habit common on older sites, where a "Do Not Operate" tag hung on a switch is treated as the isolation. A tag can be ignored, misread, or blown off. A padlock on a lockable isolator cannot be opened without a key.

Is Lockout Tagout a Legal Requirement in Australia?

The model laws do not use the phrase. They require the risks of plant to be managed, and set specific rules that a lock-out procedure helps meet. The person with management or control of plant at a workplace must manage the risks associated with that plant under the general risk management rules.² Regulation 210 requires that person to ensure the plant's operator's controls can be locked in the off position to disconnect all motive power. Where the need to run plant during maintenance or cleaning cannot be eliminated, the controls must allow it, and while the work goes on they must not be operable by anyone but the person doing it; only where someone else has to operate the plant may it be a person authorised for that purpose, and the plant must run in a way that eliminates the risk to the worker or, if that is not reasonably practicable, minimises it so far as is reasonably practicable.²

Electrical work has its own rules. Subject to the exceptions in that Division, the business carrying out the electrical work must ensure it is not done on equipment while it is energised, and that before the work the equipment is tested by a competent person to find out whether it is energised. A separate duty, that equipment de-energised for the work is not inadvertently re-energised while the work is carried out, is not limited in the same way to the business doing the work, so it reaches the business that controls the switchboard too.² Each of those is an offence, with the maximum penalty set in your own state's WHS laws.²

The step-by-step method comes from the codes of practice. Where a code has been approved, courts may rely on it in deciding what was reasonably practicable, so the code's method is the benchmark an isolation will be measured against.⁴

The model laws apply in every state and territory except Victoria, with some local variations.⁵ Victoria's OHS Regulations 2017 carry the same lockable-off rule for operator controls in regulation 101, and regulation 114 goes further: for electrical plant and plant exposed to an electrical hazard, an employer or self-employed person must ensure appropriate permit to work systems are provided so plant that is isolated but not physically disconnected from the electrical supply is not energised by mistake.⁶

The Lockout Procedure, Step by Step.

The plant code lists the lock-out process in eight steps.¹ Here is each one as it plays out when a contractor works on building or depot plant.

1. Shut down the machinery and equipment. Use the normal stop, and tell the people who rely on it first: the ward, the tenant, the shift manager.
2. Identify all energy sources and other hazards. Electrical supply is the obvious one. The pressurised chilled water, the spring, and the raised load are the ones that hurt people.
3. Identify all isolation points. Every switch, valve, and breaker that feeds the plant, including the one on the floor above that nobody has labelled.
4. Isolate all energy sources. Open the switches and close the valves at each point found.
5. Control or de-energise stored energy. Bleed pressure, lower or block raised parts, discharge capacitors.
6. Lock out every isolation point. Each worker's own padlock, on each point.
7. Tag the controls, energy sources, and other hazards. Name, company, date, and reason, so anyone who finds the lock knows who to call.
8. Test. Try to restart the plant from its normal controls, without exposing the tester or anyone else to risk.

The code adds a warning about step 8 that is easy to skip. If the plant does not start, the main power may be isolated, but that does not guarantee all stored energy has gone; hydraulic or pneumatic pressure, suspended weight, and compressed springs may need further steps to release safely.¹

Energy Sources Contractors Miss.

The plant code's list goes well beyond mains power: battery or capacitor banks, solar panels, fuels, heat, steam, fluids or gases under pressure such as water, air, steam, or hydraulic oil, stored energy such as compressed springs, gravity, and radiation.¹

In a building, three of those catch people out. Rooftop solar keeps generating when the main switch is off. A UPS battery bank in a comms room keeps circuits live through an outage. And a chilled water or fire services line can hold pressure long after its pump stops. In a depot, gravity is the one: a raised roller door, a dock plate, or a tilt tray on a sorter all move when a pin is pulled.

Locks, Hasps & the Group Lockbox.

The plant code names the hardware: switches with built-in locks, lock-out circuit breakers, fuses and valves, chains, safety lock-out jaws (also called hasps), and safety padlocks.¹ Where more than one person is working on the plant, each should be able to fit their own padlock, and another option the code gives is one padlock on the isolation point, with the keys locked in a box that each worker then locks separately, which suits plant with many isolation points.¹

The code also says each worker involved should have a lock, tag, and key for each isolation point, and that there should be no duplicate key for any lock except a master key kept in a secure place for emergency use.¹ A shared site padlock with the key on a hook in the plant room meets none of that.

How Is Electrical Isolation Different?

It adds consultation at the start, a test that the circuits are de-energised, and re-testing where needed. Safe Work Australia's electrical code sets the standard steps as consulting the person with management or control of the workplace about the timing of the work and notifying others affected, isolating, securing the isolation by locking it where practicable, tagging, testing to confirm the circuits are de-energised, and re-testing as necessary, for example when the worker returns after leaving the area.³

The same code says it is fundamental that the point of isolation is under the control of the person doing the work, that each person working on the same de-energised installation should apply their own personal lock, and that no-one should operate an isolator with a control mechanism attached.³ Isolation procedures should be developed in consultation with the relevant workers, and where they have a health and safety representative, that consultation must involve the representative.³

Can Someone Else Remove Your Lock?

Only by the person who applied it, by a supervisor after consulting them, or under a procedure set out in advance. The plant code says tags and locks should only be removed by the person who applied them, or by the supervisor after consulting the person who signed the tag. If that person is unavailable, their tag or lock may only be removed under a procedure management has approved.¹ The electrical code adds two rules for electrical isolations: where a signatory is unavailable and unable to return, measures must be put in place to manage the risks of removing their lock or tag, such as a thorough check that everyone is safe; and where work is unfinished at a change of shift, the last person replaces their danger tag or lock with a warning tag, and each person puts their own back on when work resumes.³

The case that tests this is the contractor who leaves site at 4pm with their lock still on the chiller and cannot be reached. Write the procedure before it happens: who tries to reach them, who confirms the plant is still safe to leave isolated or safe to restore, who signs off, and how the contractor is told before their next visit.

When the Person Isolating Is Not Your Employee.

On a shared site, the isolation involves at least two businesses: the one that controls the plant and the one doing the work. Section 46 of the model WHS Act requires every person with a duty on the same matter to consult, co-operate, and co-ordinate with the others, so far as is reasonably practicable.⁷ Safe Work Australia's consultation code uses this exact setting as an example: before lift maintenance in a multi-tenanted office block, the property manager consults the maintenance contractor, the tenants, and the cleaning contractor so each knows of the work and what they need to do.⁸

Three things follow for the business that controls the plant. Maintenance and inspection of plant must be carried out by a competent person, so check the contractor is one before the work.² The plant code says a process should be in place for communicating with affected workers and other businesses so that restarting the plant after maintenance does not put anyone at risk.¹ And, as good practice rather than a rule, know and label the isolation points before the contractor arrives, not on the day.

A Worked Example: A Chiller Pump Swap in a Hospital Plant Room.

A mechanical contractor is booked to replace the chilled water pump on one of three chillers serving a hospital's theatres. An electrician from a second contractor will disconnect and reconnect the supply.

The facilities manager starts two weeks out. The pump's isolation sheet lists four points: the main switchboard breaker, a local isolator at the unit, and the chilled water supply and return valves. The theatres manager agrees a date when the other two chillers can carry the load. On the day, the electrician isolates at the switchboard and the local isolator, and the mechanical technician closes the two valves and bleeds the pressure from the pump section. Each fits his own padlock and tag to all four points, using a hasp where a point takes more than one lock, and the electrician then tests that the pump will not start. Both sign on to the permit at the plant room door.

At 2pm the electrician is called to another site before the reconnection. Under the hospital's procedure his locks stay on and the facilities manager confirms with him by phone that he will be back; he returns at 4pm, reconnects, and the two remove their own locks, technician first. The plant restarts only after the theatres manager has been told.

A Worked Example: Clearing a Jam on a Parcel Sorter.

At a parcel depot, a contract cleaner on the night shift sees a carton jammed under a tilt tray on the sorter. The quickest fix is to reach in. The depot's isolation procedure makes that a lock-out task: the sorter's section isolator has a lock point, every cleaner and maintainer carries a personal padlock and tag issued at their induction, and the shift supervisor confirms the section is isolated and the tray is pinned before anyone reaches in.

The plant code's list of tasks for which an isolation procedure should be followed includes cleaning, which is why this is the cleaner's job to lock out, not just the maintainer's.¹ The depot also decided that this one task belonged higher on the hierarchy: a jam-clearing tool now hangs at each section, so most jams are cleared from outside the guard without anyone reaching into the sorter; any jam the tool cannot reach is still a lock-out. Our guide to the hierarchy of controls explains why that change outranks any procedure.

What to Check Before a Contractor Isolates Anything.

• A written isolation procedure for that plant, with every isolation point listed and labelled on site.
• A personal lock, tag, and key for each worker, and a group lockbox where there are many points.
• A competent person doing the work, with the licences the job needs checked before the day, not at the gate.
• A permit for the job, naming the isolations and who applied them. Our guide to permit to work systems covers what a permit must show.
• A restart plan, saying who is told before the plant runs again and how the last lock comes off.

How ComplyFlow Supports Isolation Work.

ComplyFlow does not lock anything; the padlock does that. What it holds is the record around the isolation. A permit in ComplyFlow has a permit type, sites, an expiry, and a permit holder, with sections that each have a reviewer and questions, and it becomes active once reviewed and approved.⁹ Contractors sign in to an active permit from the Live Access dashboard, and an area supervisor can open the permit, see who is signed in, and confirm each sign-out, with an alert when someone signs out.¹⁰ Isolation questions, such as which points are locked and by whom, can be built into a permit's sections; the digital permits page shows how.

Walk One Isolation Before the Next Shutdown.

Pick the piece of plant your contractors isolate most often, take its isolation procedure, and walk it with the technician who does the work. Count the isolation points on paper and on the floor. Expect them to differ, and expect the missing one to be stored energy or a second supply.

Then fix the paperwork before the next job, and label the points so the next contractor does not have to search. To see isolations recorded on a permit that contractors sign on to and supervisors close out, book a demo and bring the plant your team worries about most.