Lockout tagout (isolation): the procedure, the law and the locks, Australian rules

Lockout tagout (LOTO) is the procedure for isolating plant from every energy source before anyone maintains, cleans or repairs it: switch it off at the isolation point, release stored energy, fit a personal lock and danger tag so nobody can turn it back on, then try to restart it to prove it is dead. Australian sites mostly call it isolation.

LOTO is the American term. The US regulator OSHA has a standard called the control of hazardous energy (lockout/tagout), 29 CFR 1910.147, and the acronym arrived here with the equipment manuals. On an Australian site you are more likely to hear “is it isolated?” or “where’s your lock?”. Same job. This is general information, not safety advice for a specific site, and the site’s own isolation procedure wins wherever it is stricter.

The lock out tag out procedure, step by step

These steps follow the lock-out process in the plant code of practice and the isolation steps in the electrical code (both covered in the next section), in the order a crew does them.

1. Plan the isolation. Identify every energy source and isolation point, from the plant’s isolation procedure if it has one. Tell the operators and anyone affected that the plant is coming down, and control entry to the area. A conveyor with three drives and a counterweighted take-up has at least four things to isolate, not one.
2. Shut down normally, then isolate. Normal stop first, then the isolation device: main isolator, breaker, valve. SafeWork SA’s isolation procedures page asks for whole current isolation, such as the main isolator, rather than control isolation, such as a stop button on the control panel. An e-stop is not an isolation.
3. Release or control stored energy. Bleed hydraulic and pneumatic pressure, lower or prop anything raised, release spring tension, let hot surfaces cool and capacitors discharge.
4. Lock and tag every isolation point. Each person working on the plant fits their own personal lock and signed danger tag to each isolation point, or to the group lockbox. Tag the machinery controls too.
5. Try it, and test for dead. Try to restart the plant from its normal controls without exposing anyone to risk. For electrical work, a competent person tests the parts are de-energised with a tester checked immediately before and after use. If anything moves or reads live, the isolation has failed.
6. Work, then restore in reverse. Re-test if you leave the area and come back. When the job is done: tools out, guards back on, people clear, each worker removes their own lock, operators told, plant restarted under control.

Step 5 gets skipped, usually by someone who is sure. The electrical code’s principle is “test for ‘dead’ before you touch”, and it says to assume every conductor is energised until proven otherwise, even when you believe the supply is isolated.

What Australian WHS law requires

No Australian regulation uses the words “lockout tagout”. The model WHS laws, which Safe Work Australia says have been implemented in all jurisdictions except Victoria, get there through plant and electrical duties. Victoria runs its own OHS laws.

Plant. In the Queensland Work Health and Safety Regulation 2011, which carries the model regulations, regulation 210 requires operator’s controls that can be “locked into the ‘off’ position to enable the disconnection of all motive power”. If plant has to run during maintenance or cleaning, the controls must be operable only by the person doing that work, or by someone authorised for the purpose. Regulation 208 says that if guarding is removed, the plant must not be able to restart, so far as is reasonably practicable, until the guarding is replaced. Regulation 207 requires plant not in use to be left in a state that does not create a risk.

Electrical. In the Commonwealth version of the model regulations, regulation 154 prohibits electrical work on energised equipment, 155 is the duty to determine whether equipment is energised, 156 says de-energised equipment must not be inadvertently re-energised, and 157 sets the narrow cases where energised work is allowed. SafeWork NSW lists 155 to 157 under the same headings in the NSW Work Health and Safety Regulation 2025. Queensland’s WHS Regulation leaves those numbers unused, so check Queensland’s electrical safety law there.

The detail is in two Safe Work Australia model codes of practice: Managing the risks of plant in the workplace (last updated November 2024) and Managing electrical risks in the workplace. Check with your regulator whether a code has legal effect where you work. The quotes here come from the Commonwealth versions on the Federal Register of Legislation: the plant code, section 4.5, and the electrical code, sections 5 and 6.

Electricians will also know AS/NZS 4836:2023, Safe working on or near low-voltage and extra-low voltage electrical installations and equipment, which its publisher describes as a minimum set of procedures, safety requirements and recommendations for managing arc blast, arc flash, electric shock and electrocution.

Lock vs tag: a tag alone is not an isolation

Both codes say it flat out. The plant code: “only a lock is effective at isolating the energy source”, and tags are for “providing information to others at the workplace”. The electrical code: “A tag does not perform the isolation function.” A piece of cardboard on a switch is a request. A padlock through the isolator is a fact.

SafeWork SA says tags should be dated and signed, and a lock should carry a tag identifying who applied it. The electrical code says danger tags are not required with dedicated personal isolation locks, which is why many sites issue personal locks marked with the owner’s name or photo.

Stored energy: the part that bites after the switch is off

Isolating the supply does nothing about energy already in the plant. The plant code’s list of energy sources includes mains electricity, battery or capacitor banks, solar panels, fuels, heat, steam, pressurised fluids or gases, compressed springs, gravity and radiation, and it singles out hydraulic or pneumatic pressure, suspended weight and compressed springs as needing extra steps.

The plant code’s test is to try to reactivate the plant: “Failure to reactivate the plant means that the isolation procedure is effective and that all stored energies have dissipated.” A tipper body held up by its own cylinder has passed nothing.

Group isolation and lockboxes

A shutdown crew of 20 on plant with a dozen isolation points would need 240 personal locks. The plant code allows an alternative: “one padlock on the isolation point, with the keys locked in a box that has been locked separately by each worker”. The isolator locks every point, puts the keys in the lockbox, and each worker fits a personal lock to the box. No key comes out until the last personal lock is off.

The code adds two rules. No duplicate key for any lock, except a master key kept secure and used only in an emergency. And where several energy sources are isolated, one person holds the key to each lock-out device. Many sites also require each worker to check the isolation points, or witness the test, before locking onto the box. Your lock on the box is trust in someone else’s isolation, so look first.

Removing a lock, and the abandoned lock problem

Your lock, your key, and only you take it off. The electrical code says danger tags should only be removed by the signatories. SafeWork SA allows the supervisor after consulting the person who signed the tag, and otherwise only under a management-approved procedure.

Then there is the lock still on the isolator at 6am, owned by someone who is not on site. The electrical code says that where the signatory is unavailable and cannot return, measures must be put in place to manage the risks of removing it, giving a thorough investigation to confirm everyone is safe as its example. A typical site procedure:

1. Ring and message the owner. An abandoned lock is often just a forgotten one.
2. Confirm they are off site and nobody is in or on the plant.
3. The supervisor and a second person walk the plant and every isolation point.
4. An authorised person removes or cuts the lock and records who, when and why on the lock removal form.
5. Tell the owner before their next start, so they do not walk back in assuming their lock is still on.

Shift handover, contractors and the lock left on at end of swing

A personal lock protects one person for one stretch of work. It is not a way of holding plant down for the next shift. For unfinished work at a shift change, the electrical code says “the last person removes their danger tag or lock” and replaces it with a warning tag. When work resumes, the person in charge removes the warning tag and each worker fits their own lock again. Unfinished work must also be left safe, with the next crew told enough to carry on safely.

The FIFO version is the worker who flies out at the end of a swing with the key in their pocket. The plant cannot restart, which is the system working, but the next swing now has a removal procedure to run while the owner is on R&R and not answering. Build it into the swing change: personal locks off, warning tags or the group isolation in place, before the bus leaves.

Contractors bring more employers into it. A subbie’s electrician, a labour hire fitter and the host’s maintainer may all have locks on one box, and the principal contractor has to coordinate whose isolation rules apply. Settle it at the gate: the site induction says what a lock and tag means on this site and where the removal procedure is, and the subcontractor onboarding checklist is where the contractor’s own isolation procedure gets checked.

How isolation fits with a permit to work

On most sites isolation sits inside a permit to work. The permit lists the isolation points, the issuer checks the locks and the test before signing, and the permit is not closed until the isolations are removed or recorded as remaining. The JSA for the job puts “isolate, lock and tag, test for dead” at the top of its controls. The permit guide has a free permit workbook.

Where Humanz fits

Humanz does not touch the locks. It carries the paperwork and the people around them. Your admin builds the isolation record, the lock removal form or the shift handover as a custom form: mandatory questions so “stored energy released” cannot be left blank, photo capture of the locked and tagged isolation points, and multiple signatures for the isolator, the workers and the supervisor. Crews complete it on their phones at the plant, offline if the signal drops, and every submission is timestamped and stored against the job and the worker.

Tickets and competencies sit on each worker’s profile with expiry alerts, and compliance rules set per client and site stop a shift booking someone whose required ticket is missing or expired. Employees, labour hire and subcontractors sit on one roster under the same rules, so when a lock is still on the isolator at 6am, the roster shows whether its owner is on shift today or two days into R&R. Job messages keep their history, so “who confirmed the locks came off at swing change” is a search. The civil and construction page shows how prestarts, inductions and credentials connect on site.

Humanz does not isolate plant, test for dead, manage lock hardware or connect to lockboxes. It does not use AI, does not track anyone’s location, and does not give safety or legal advice. A competent person at the plant does the isolation. Humanz keeps the record and the roster honest.

Frequently asked questions

What is lockout tagout?

Lockout tagout is a procedure for isolating plant from all its energy sources before maintenance, cleaning or repair, and locking the isolation points so the plant cannot be restarted while people work on it. Each worker fits a personal lock and danger tag, stored energy is released, and the isolation is tested by trying to restart the plant. In Australia it is usually just called isolation.

What is the difference between lockout and tagout?

Lockout puts a padlock on the isolation point so the plant physically cannot be re-energised, while tagout attaches a tag telling others who is working on the plant and why. Australia’s model codes of practice say a tag on its own is not an isolation, because only a lock is effective at isolating the energy source.

Is lockout tagout a legal requirement in Australia?

The term is not in Australian law, but the duty is. The model WHS Regulations require plant controls that lock in the off position to disconnect all motive power, controls only the maintainer can operate during maintenance, and plant that cannot restart while guarding is off. For electrical work they prohibit work on energised equipment except in limited cases and require that de-energised equipment is not inadvertently re-energised.

What is the difference between isolation and lockout?

Isolation disconnects plant from its energy sources at the isolation point, and lockout secures that isolation with a padlock so nobody can undo it while work is under way. Isolation is the whole procedure, from identifying the energy sources to testing that the plant cannot start, and lockout is one step inside it. An isolator switched off but not locked can be switched back on by anyone who walks past.

Who can remove a personal danger lock?

Only the person who fitted it, as a rule. The electrical code of practice says danger tags should only be removed by their signatories, and regulator guidance allows a supervisor to remove one only after consulting that person or under a management-approved procedure. If the owner cannot return, the site must manage the risk first, normally by confirming they are off site and checking nobody is in or on the plant.

What is a group isolation lockbox?

A group isolation lockbox lets a large crew share one set of isolation locks. An authorised isolator locks every isolation point and puts the keys in a box, then each worker fits their own personal lock to the box, so the keys cannot come out until every worker has removed their lock. The plant code of practice describes the method and says there should be no duplicate keys except a master key kept secure for emergencies.

What is an out of service tag?

An out of service tag marks equipment that is faulty, damaged or unsafe and must not be used until it is repaired. It is fixed to the equipment’s operating control or power isolator and states the reason the equipment is out of service. Under the electrical code of practice it should only be removed by a competent person once the defect is fixed, and it is a warning about the equipment, not a personal isolation protecting someone working on it.