Lockout/tagout explained: the steps, why each one exists, and what a PLC technician must not assume

Lockout/tagout is a set of practices that keep equipment from starting up, or from releasing stored energy, while a person is servicing or maintaining it. The wider name for the whole idea is the control of hazardous energy. Lockout means fitting a physical lock to an energy-isolating device, such as a disconnect switch, a breaker or a valve, so that the device cannot be operated. Tagout means attaching a warning tag to the device to say it must not be operated.

The two are different in strength. A lock physically prevents the device from being moved. A tag is only a warning, and it cannot stop anyone who ignores it. For that reason a lock is the stronger control wherever the device can be locked, and tags alone are used only where a written procedure allows it.

The hazard is easy to underestimate. Most people picture a machine suddenly starting, but release of stored energy is just as dangerous: a raised load falling, a spring snapping back, a pressurised line moving a cylinder, or a drive holding charge after the power is removed.

A lockout is not complete until every source of energy that could hurt the person has been dealt with. Electrical isolation alone often is not enough.

Every site writes its own energy control procedures, and for most machines there is a machine-specific one. The sequence below is the general shape that most programs follow. Your procedure decides the exact steps, and you follow it.

1. Prepare. Find out what the machine is, what energy sources it has, who is affected, and which procedure applies.
2. Notify everyone affected that the machine is about to be shut down and locked out.
3. Shut the machine down using its normal stopping method.
4. Isolate every energy source with its energy-isolating device, such as opening a disconnect or closing a valve.
5. Apply your personal lock and tag to each isolating device.
6. Release or restrain any stored energy: vent, drain, bleed, block or discharge, as the procedure says.
7. Verify the isolation. Try to start the machine from its normal controls, which proves the lockout holds, then test at the point of work using the method the procedure requires, with a meter you have proved first.
8. Do the work.
9. Restore: clear tools and people, check the machine is ready, remove each lock and tag by the person who fitted it, tell everyone affected, and then re-energise.

The order matters. Verification comes after the stored energy has been released, because only then does a try-start or a zero-energy test prove what you think it does. Restoration is done in reverse, and by the same person who applied the lock.

Steps look like chores until you know the accident that created each one. Notification exists because someone has been hurt by a colleague who restarted a machine they did not know was being serviced. Personal locks exist so that equipment cannot be re-energised until the last person has finished, and so no one has to trust that a colleague remembered they were still inside.

Release of stored energy exists because a machine that is off is not a machine that is safe. Verification exists because mislabelled isolators and back-feeds from another supply make people believe a circuit is dead when it is not. A proved meter, one tested on a known source before and after, protects you against a faulty meter that shows zero when the circuit is live.

If anything does not match the procedure, stop and ask. A missing lock, a tag that looks old, a supply that is not on the drawing or an isolator that does not match its label are all reasons to pause. The system relies on a written procedure, a trained person, and a supervisor who backs a stop decision.

Controls work creates its own traps, because so many things feel like isolation when they are not.

• A stopped PLC is not isolation. The program stopping, or the PLC being in program mode, does not remove power from motors, valves or drives.
• An E-stop is not isolation. It is a control device that can fail, be bypassed or be reset by someone else. The thing that makes work safe is a physically opened, locked isolation device.
• A PLC output is not isolation. A software interlock or an output turned off can change if the logic changes, if an input is forced, or if a program is downloaded.
• There may be more than one source. Control power can come from a separate supply, and a panel can contain voltage from another cabinet or a customer system. Look at the drawings and test, instead of assuming that one disconnect covers the whole panel.
• Drives and power supplies can hold charge after the supply is removed. Follow the manufacturer's waiting time and verification method.
• Remote starts and network commands can restart equipment from elsewhere. A lockout has to defeat these as well, not only the local buttons.
• Forcing I/O or downloading a program while someone else is working on the machine can start motion without warning. Agree who is doing what before you touch the controller.

• Locking out and not verifying. A lock proves the switch cannot be moved. It does not prove the circuit is dead.
• Using a tag alone on a device that can be locked.
• Forgetting stored energy, or releasing it before isolating the supply.
• Skipping the procedure because it is a quick job. Most injuries happen on quick jobs.
• Removing someone else's lock. Each lock is removed by the person who put it on, and the procedure sets out what happens if that person is not on site.
• Missing an energy source because the machine-specific procedure was not read.

Rules on lockout/tagout come from law and from standards, and they differ by country and industry. In the United States the federal rule on the control of hazardous energy is OSHA 29 CFR 1910.147, with related requirements for electrical work in NFPA 70E. Other countries and sectors have their own, for example CSA Z460 in Canada and the ISO 14118 standard on prevention of unexpected start-up of machinery. These are named here so you can find them. This page does not interpret any of them and is not legal or compliance advice.

What applies to you is set by your employer's energy control program, which is written to the rules where you work. Follow that program, and ask your safety lead when anything is unclear.

The Industrial Safety track includes a free lockout/tagout lesson that walks through a conveyor belt change under lockout and has you sort the steps, including proving a meter before testing for zero energy. It also includes an E-stop lab that shows by wiring one why an E-stop is a control action and not isolation, and a later unit on electrical hazards.

None of it replaces training from your employer on your own equipment. Lockout/tagout and a qualified person are required for real equipment.