Safe maintenance of industrial machinery: lockout/tagout procedures

Industrial machinery can store and release energy long after an operator presses the stop button. Rotating parts may coast, hydraulic systems can remain pressurised, suspended loads can descend, and electrical components may still carry a dangerous charge. Safe maintenance therefore depends on a controlled isolation process, commonly known as lockout/tagout or LOTO.

In Australia, the method must fit the equipment, the work environment and the applicable work health and safety (WHS) duties. A factory in Dandenong, a food-processing site in western Sydney, a workshop in Adelaide and a mine in the Pilbara may use different machinery and local procedures, but the core principle is consistent: isolate every hazardous energy source, prevent reconnection, verify zero energy and control the work until the machine is safe to return to service.

Why ordinary shutdown is not enough

Stopping a machine through its normal controls does not necessarily make it safe. A stop button may remove the control signal without disconnecting the power supply. A programmable logic controller can restart equipment after a fault reset, while an automated line may respond to a remote command from another machine. A person working inside a guarded area can be exposed before anyone realises the equipment has become active again.

Stored energy creates further risks. Pneumatic cylinders can move when trapped air is released, hydraulic rams can drop under gravity, flywheels can continue rotating and capacitors can retain an electrical charge. Springs, counterweights, elevated platforms, hot fluids and pressurised vessels all need consideration during a hazardous maintenance task.

A proper isolation procedure identifies the machine’s energy sources and controls them individually. Depending on the equipment, this may include electricity, gas, compressed air, hydraulics, steam, fuel, gravity, heat, mechanical motion and chemical energy. The aim is to prevent unexpected start-up and to ensure that energy cannot reach the person carrying out the work.

Australian duties and workplace expectations

Australian businesses must manage risks so far as is reasonably practicable under the WHS framework adopted in most states and territories. Victoria uses occupational health and safety legislation rather than the model WHS laws, although the practical expectation for machinery isolation is similar. Employers, officers, supervisors and workers each have duties that may apply to plant safety, information, training, supervision and consultation.

Relevant obligations can vary between jurisdictions, industries and equipment types. A business operating across Queensland, New South Wales and Victoria should check the requirements of each regulator rather than assuming one internal procedure automatically satisfies every location. Safe Work Australia model codes provide useful guidance, while regulators such as SafeWork NSW, WorkSafe Queensland and WorkSafe Victoria publish jurisdiction-specific material.

Machinery safety standards can support the risk assessment and design of isolation systems. The AS/NZS 4024 series addresses safety of machinery, including safeguarding and prevention of unexpected start-up. Electrical isolation must also be handled by competent people and, where required, licensed electrical workers under local rules. In mining, petroleum, construction and major infrastructure, additional site controls, permit systems and principal contractor requirements may apply.

A lock and danger tag are practical controls, not a substitute for risk management. The business still needs suitable plant design, guarding, emergency arrangements, training, maintenance planning and supervision. Workers should be consulted when isolation procedures are developed because operators and maintainers often understand access points, production pressures and equipment behaviour better than anyone else.

Build a machine-specific isolation procedure

Each machine should have a documented isolation procedure based on its actual construction and operating cycle. A generic instruction such as “turn off the main switch” is rarely sufficient for a complex production line. The procedure should identify every isolation point, explain the sequence, show photographs or diagrams where useful, and describe how stored energy will be released or restrained.

Begin with a pre-shutdown assessment. Confirm the planned task, affected workers, required tools, replacement parts and any permit conditions. Notify operators and other people who could be affected. Consider whether stopping one machine will create a hazard in connected equipment, such as a conveyor that feeds another line or an automated cell that shares a robot, interlock or compressed-air header.

The shutdown sequence should use the normal stopping controls before isolation points are operated. Then isolate each energy source and apply a personal lock and danger tag. Where several workers are involved, a group lockbox or multi-lock hasp can allow every person to apply an individual lock. No worker should rely solely on another person’s lock or on a supervisor’s assurance.

The procedure should state how to deal with isolation points that cannot accept a lock, equipment with multiple power feeds, battery-backed systems, remote controls and interconnected machinery. It should also identify special equipment such as variable-speed drives, photovoltaic supplies, stored hydraulic pressure and elevated components. A risk assessment should determine whether additional blocks, pins, chocks, restraints or engineered controls are required.

Verify zero energy before work starts

Verification is the step that turns an apparent shutdown into a demonstrated safe state. After locks and tags are fitted, release, restrain or otherwise control all stored energy. Bleed pneumatic and hydraulic pressure, discharge electrical components, lower or block raised parts, secure rotating equipment and allow hot surfaces or fluids to cool where necessary.

The authorised person should test the machine’s normal start controls from a safe position. This test should confirm that the equipment does not operate, but it must be planned carefully because some machinery can move in unexpected ways during testing. Controls should then be returned to the off position. A qualified person may need to use suitable test equipment to confirm the absence of electrical energy; electrical testing must be performed in accordance with local requirements.

“Try” is not the same as “test”. A silent motor does not prove that all power has been removed, and a pressure gauge reading zero may not confirm that a trapped section is safe. Verification should cover each identified energy source, including possible back-feed, gravity, residual pressure and stored motion. Where the machine design makes verification difficult, the risk assessment should specify an alternative engineered method.

If the work involves entering a danger zone, workers should maintain control of their personal locks throughout the task. Locks should be uniquely keyed, durable and identifiable. Danger tags should state the person’s name, contact details, date and relevant warning information. Tags do not prevent operation by themselves, so they must be used with effective physical isolation.

Manage group work, contractors and shift changes

Maintenance often involves several trades, contractors and production employees. Every person exposed to the hazard must understand the isolation arrangement and apply their own lock. A group lockbox can hold the keys to the primary isolation locks, allowing each worker to place a personal lock on the box before entering the hazardous area.

The person coordinating the job should keep an isolation register or equivalent record. It should identify the machinery, isolation points, workers, permits and status of the work. A pre-start briefing should cover the scope of the task, boundaries, residual hazards, communication methods and emergency arrangements. Contractors should receive site-specific information rather than being expected to follow an unfamiliar host procedure without explanation.

Shift changes need particular care. An incoming worker should apply their personal lock before the outgoing worker removes theirs, with a controlled handover confirming the machine’s condition and work status. If the work extends overnight, lighting, weather, access and security should be reviewed. A lock must never be removed casually because a shift has ended.

A missing worker or abandoned lock should be dealt with through a written emergency removal process authorised by the responsible manager. The process should include attempts to contact the person, confirmation that they are not exposed to the hazard, inspection of the work area and direct communication before the machine is restarted. Cutting a lock without investigation can expose a worker who is still inside the danger zone.

Restore machinery in a controlled way

Removing an isolation requires its own sequence. First confirm that maintenance is complete, tools and loose components have been removed, guards and safety devices are reinstalled, and people are clear of danger. Workers should account for everyone involved, remove their own locks and tags, and notify affected operators before energy is restored.

The responsible person should inspect the equipment and surrounding area, check that temporary restraints have been removed only when safe, and confirm that controls are in the correct starting position. Energy should be restored in a controlled manner. A test run may need to occur at reduced speed or from a safe location, with emergency-stop functions and guarding checked before normal production resumes.

Commissioning after maintenance can introduce new hazards. A replaced sensor may be misaligned, a guard interlock may have been bypassed during fault-finding, or a hydraulic connection may leak under pressure. The handback process should therefore include functional checks and communication with the operator. Any defect should be recorded and controlled rather than hidden to meet a production deadline.

Australian workplaces can strengthen these arrangements by using practical tools such as documented risk assessments, maintenance permits, competency records and incident reviews. OiRA may assist smaller organisations with structured risk assessment, while internal procedures can draw on machinery safety guidance and lessons from industry. In a busy Melbourne workshop or a remote Queensland site, clear local instructions are more likely to be followed when they reflect the actual plant and available resources.

Train people and test the system

LOTO training should explain the hazards of the machinery, the difference between stopping and isolating, the use of locks and tags, verification methods, group isolation and emergency removal. It should be practical rather than limited to an online module. Workers should demonstrate that they can find isolation points, apply devices, dissipate stored energy and confirm a safe state.

Different roles require different levels of competence. An operator may need to recognise when a machine must not be entered and report faults, while an electrician, fitter or engineer may perform detailed isolation and testing. Supervisors need to understand production pressures, permit boundaries and the consequences of bypassing controls. Contractors should be assessed before starting work and monitored during high-risk tasks.

Procedures should be reviewed after incidents, near misses, equipment changes, new automation, repeated isolation difficulties or changes in legislation. Periodic inspections can reveal missing labels, damaged lockout devices, inaccessible disconnectors and instructions that no longer match the plant. Drills or observed isolation tasks can test whether the written process works under real conditions.

Track useful indicators such as overdue procedure reviews, training completion, defects in isolation points and instances of unauthorised lock removal. A strong safety culture treats a worker’s refusal to enter an inadequately isolated machine as a valid safety decision, not an obstacle to production. Supervisors should reinforce that schedule pressure never justifies bypassing an isolation step.

Make machinery isolation a visible part of everyday work. Review your plant-specific procedures, identify every hazardous energy source, provide suitable personal lockout equipment and verify that workers can use it correctly before maintenance begins. Regularly check compliance across workshops, warehouses, processing plants and remote sites so that every person goes home safely after the job.