Lockout/tagout (LOTO) is a safety procedure. It isolates and de-energizes hazardous energy sources before maintenance or repair work begins. Workers lock disconnects, breakers, or valves in the off position, then attach tags naming who controls each lock and why.
Every lockout/tagout procedure is built from P&IDs, tag registers, and isolation point lists. Those are engineering deliverables long before they become safety documents. Vista Projects has produced that information for complex industrial facilities since 1985. We are a multi-disciplinary engineering, system integration, and procurement firm in Calgary, Alberta. Our integrated engineering services run from design through operations.
A practical observation about LOTO: the hardware almost never fails. What fails is everything upstream of the padlock. The drawing that showed three isolation points when the equipment now has four. A lock on the wrong isolation point offers as much protection as no lock at all. Worse, the worker believes they are protected.
What Is Lockout/Tagout (LOTO)?
Lockout/tagout is a controlled process. You shut the equipment down and isolate it from every energy source that powers or moves it. You secure those isolation points with locks, then prove it cannot start before anyone reaches inside. Equipment that looks off is not necessarily off.
Maintenance fatalities follow a pattern. Someone else, somewhere else, restores power to a machine a worker is standing inside. The lock is the message.
The Canadian Centre for Occupational Health and Safety is precise about what counts. An energy-isolating device means a manually operated disconnect switch, a circuit breaker, a line valve, or a block. Push buttons, selector switches, and other circuit control devices are not energy-isolating devices. Stopping a machine at the control panel is not isolation.
Lockout Tagout Meaning: What the LOTO Acronym Covers, and What It Doesn’t
In industry, LOTO means lockout/tagout, the control of hazardous energy, and nothing else. You will also see lockout tagout, lock out tag out, and lockout-tagout. Canadian standards lean toward “control of hazardous energy” or “energy isolation,” which describes the activity more precisely.
The Types of Hazardous Energy Lockout/Tagout Controls
Electricity is the most commonly isolated source, and one of at least seven. The ones that get missed are rarely electrical.
| Energy type | Where it shows up | How it gets isolated |
| Electrical | Motors, MCCs, backfeed circuits | Lock the breaker, discharge capacitors, confirm no alternate feed |
| Mechanical | Shafts, flywheels, conveyors | Block, pin, or chock moving parts, release spring tension |
| Hydraulic | Presses, actuators, accumulators | Close and lock isolation valves, bleed pressure, discharge accumulators |
| Pneumatic | Cylinders, receivers, instrument air | Lock the air supply, vent lines to atmosphere |
| Thermal | Steam headers, fired heaters | Isolate and drain, allow full cool-down or warm-up |
| Chemical | Process piping, reactors, relief systems | Double block and bleed, install a blind, drain and purge |
| Gravitational | Suspended loads, counterweights | Lower to rest position or install a mechanical block |
The category that causes the most trouble hides inside every other row: stored energy. A de-energized capacitor bank still holds a charge. A conveyor stopped on an incline is holding a load that wants to move. Isolation cuts the supply of energy. It does nothing about the energy already inside the system.
In Alberta, pressure equipment also falls under the Safety Codes Act, administered by ABSA, alongside the OHS Code.
The Six Steps of a Lockout Tagout Procedure
A compliant lockout tagout procedure follows six steps in sequence:
- Prepare and notify. Identify every energy source feeding the equipment, and tell affected workers it is coming down.
- Shut down. Stop the equipment using its normal shutdown sequence. Never by pulling the disconnect on a running machine.
- Isolate. Operate every energy-isolating device that cuts the equipment off from those sources.
- Apply locks and tags. Each authorized worker applies their own lock and tag to every isolation point, or to a group lock box.
- Release stored energy. Bleed, drain, vent, block, or discharge residual pressure, charge, heat, tension, or suspended load.
- Verify zero energy. Attempt a normal start, confirm with instruments, then return controls to off.
Step six gets squeezed when the schedule tightens. It is the only step that tests whether the first five were done right. One disconnect on a pump is quick. A process unit needing multiple valve isolations, blinding, and purging is not. If a crew reports a complex isolation completed in minutes, that indicates a step was skipped.
Removing a Lockout/Tagout Is Also a Procedure
Restoration reverses the sequence, with failure modes of its own:
- Inspect the area, remove tools, and replace guards.
- Confirm all personnel are clear of the equipment.
- Each worker removes their own lock and tag, never someone else’s.
- Re-energize in a controlled order, notify affected workers, and restart normally.
Lock removal is where programs bend. A worker goes home with a lock still on the breaker. The legitimate route is documented: verified attempts to reach them, supervisor sign-off, and notification before their next shift. Alberta’s OHS Code contemplates transferring control of a personal lock to a supervisor. A note of caution: stranded locks removed with bolt cutters and no paperwork mean the program has stopped functioning.
Lockout vs. Tagout: Why the Lock Comes First
The hierarchy is the same across North America. Lock where you can, tag where you cannot, and when you can only tag, do more.
Lockout is physical. A padlock, hasp, or purpose-built device holds an energy-isolating device in the safe position. If a device accepts a lock, it must be locked.
Tagout is informational. A durable tag identifies who applied the lock, when, and why the equipment must stay down. Where a device cannot be locked, tagout is permitted alongside a safeguard providing equivalent protection. Removing a fuse or a valve handle, for example. A lock stops a hand. A tag only warns one.
Where equipment is replaced or newly installed, energy-isolating devices are expected to be lockable. That is a design requirement, not a maintenance one.
Who Is Involved in Energy Isolation
Three roles appear in nearly every hazardous energy control program, and confusing them is a common audit finding.
Authorized workers perform the isolation and the servicing work, and only they apply and remove locks. Affected workers operate the equipment or work nearby but do not isolate it. They must know when equipment is locked out and why. They must never restart it or remove a lock. Everyone else nearby needs one instruction. Recognize a lockout device, never touch it.
Outside contractors generate a disproportionate share of incidents. Host and contractor exchange energy control procedures, and each ensures their own people understand the other’s program. Group lockout works the same way at scale, with isolation keys held in a lock box that every authorized worker secures with a personal lock.
What Canadian and U.S. Lockout/Tagout Regulations Require
Hazardous energy control is regulated very differently on either side of the border. Operators working in both countries need both frameworks.
Canada: Provincial Codes and CSA Z460
Occupational health and safety in Canada sits with the provinces and territories. There is no single national LOTO rule. A company operating in Alberta, British Columbia, and Ontario complies with three separate frameworks. Similar in intent, different in detail.
- Alberta: OHS Code Part 15, “Managing the Control of Hazardous Energy”. Alberta is explicit about personal locks. Each worker secures each energy-isolating device with their own lock. The employer keeps a register of who holds one.
- British Columbia: OHS Regulation Part 10, “De-energization and Lockout”, covering shutdown for maintenance, lockout procedures, and access to enough personal locks.
- Ontario: No single dedicated LOTO regulation. Employers assemble requirements from the Occupational Health and Safety Act and Regulation 851, with construction and mining covered separately.
Bridging all of them is CSA Z460:20 (R2025), “Control of hazardous energy: Lockout and other methods.” It is a consensus standard, not law. Inspectors and courts treat it as the practical benchmark. Build a Canadian program against CSA Z460.
Penalties are set province by province and they are substantial, with Ontario’s the steepest. Amounts are revised periodically, so confirm current figures with the applicable regulator.
United States Comparison: OSHA 1910.147, the Federal Control of Hazardous Energy Standard
In the U.S., LOTO is governed by a single federal standard: 29 CFR 1910.147, “The Control of Hazardous Energy.” OSHA estimates that compliance prevents 120 fatalities and 50,000 injuries each year. Canada publishes no equivalent national dataset, because occupational health and safety is administered provincially.
The standard remains a fixture on OSHA’s most-cited list, and it covers general industry only. Construction, agriculture, maritime, and certain electrical work fall under separate rules. That trips up firms assuming one procedure covers every jobsite.
Two exceptions come up constantly, and both are narrower than sites assume. Minor servicing integral to production is exempt where alternative measures provide effective protection. Cord-and-plug equipment sits outside the full LOTO requirement where unplugging removes the hazard and the plug stays under the worker’s exclusive control.
Written LOTO Programs, Training, and Annual Inspections
A compliant program has three paper components, and all three are audit targets.
A written energy control program sets out scope, roles, the rules for applying and removing devices, and how the program is enforced.
Equipment-specific procedures are where programs live or die. A generic procedure that says “isolate all energy sources” is not a procedure. It is an intention, not an instruction. A usable one names each isolation point by tag number, in sequence, with a verification method. That engineering time, not the hardware, is where the cost sits.
Periodic inspection confirms procedures are still accurate and still being followed. CSA Z460 sets the expectation in Canada, and the U.S. equivalent, 29 CFR 1910.147, requires it at least annually. An authorized worker who does not use the procedure must perform it. Sites overlook that by having the maintenance lead audit their own work.
Where Lockout/Tagout Programs Actually Fail: The Isolation Data Chain
Most LOTO guidance covers locks, tags, and steps. Few address the question underneath it. How does anyone know where the isolation points are?
The answer is a chain of information, and it has five links.
- The drawing. A P&ID or single-line diagram is where isolation points are first identified. A wrong drawing means everything downstream inherits the error.
- The isolation point list. Someone reads the drawing and lists the devices to be operated.
- The tag number. Every valve, breaker, and disconnect carries a unique identifier tying the drawing to the physical asset.
- The written procedure. It references those tag numbers in sequence.
- The field label. What the worker reads on the valve body or panel door.
A lockout is only as trustworthy as the weakest link in that chain. Break any one of them and the procedure still looks complete. It just points somewhere wrong.
Here is how it breaks. A brownfield tie-in adds a bypass line with its own block valve. The as-built drawings are updated late, and the isolation point list is never regenerated. The procedure still lists three isolation points. There are now four. A millwright locks out three valves and opens the pump casing. He finds the fourth line still under pressure.
Nobody in that sequence was careless. The procedure was followed exactly. The information was wrong.
Why Management of Change Is an Isolation Safety Control
Management of change gets filed under process safety and treated as an administrative burden. It is the mechanism that keeps the isolation data chain intact. Every modification has to propagate through all five links, or the chain breaks quietly where the change happened.
The drawing, the isolation list, the procedure, and the label register are four documents kept by four groups. Updating one does not update the others.
A data-centric architecture treats the isolation point as tagged data with a single authoritative value. Change it once and every downstream consumer reflects the change.
Vista Projects builds this foundation into how projects are executed, not as a documentation exercise afterward. Our system integration and asset information management work targets that problem. As a certified AVEVA System Integration Partner, we keep tag-level information accurate from design through operations.
Talk to Vista Projects About Your Project’s Data Foundation
Your isolation procedures are only as current as your last drawing update. That gap is worth measuring before it finds you.
- Owner-controlled data. A digital execution architecture means the asset information belongs to you, usable on day one of operations.
- Tag-level accuracy from design forward. Isolation points, equipment tags, and P&ID data maintained as data, not drawing artifacts, across four decades of capital projects run out of Calgary, Alberta.
Start a conversation with our team
Lockout/Tagout (LOTO) Frequently Asked Questions
When is lockout/tagout required?
LOTO is required for servicing or maintenance where unexpected start-up, energization, or release of stored energy would injure a worker. That covers repairs, cleaning, unjamming, tool changes, and any task putting a body part inside a hazard zone. Narrow exceptions exist for minor servicing with alternative protection, and for cord-and-plug equipment under the worker’s exclusive control.
What is the difference between lockout/tagout and an electrically safe work condition?
Lockout/tagout is the broader procedure for isolating any form of hazardous energy. An electrically safe work condition is a stricter state used for electrical work under CSA Z462 in Canada, and its U.S. equivalent NFPA 70E. It adds steps beyond LOTO, most importantly testing each conductor to verify the absence of voltage and assessing arc flash risk. Every electrically safe work condition includes lockout. Not every lockout produces one.
What happens if a lockout/tagout procedure is not followed?
The immediate risk is unexpected energization or start-up during servicing. That causes crushing, amputation, electrocution, burns, and fatalities. Regulatory consequences are serious on both sides of the border. Penalties are set by each province in Canada, and by OSHA in the U.S. Incidents also trigger work stoppages and investigations.
The Takeaway: Lockout/Tagout Is an Information Problem
Lockout/tagout is among the most thoroughly documented procedures in industry, and it still generates fatalities every year. The gap is rarely a hardware or training problem. It is an information problem. Procedures get built on drawings that no longer match the facility.
If you are building or auditing a program, work the chain backward. Start with what the worker reads in the field. Confirm it matches the procedure, the procedure matches the isolation point list, and the list matches a current drawing. Wherever that trace breaks is where your next incident is waiting.
Vista Projects works with facility owners across Canada on exactly that problem. Engineering services are delivered under the oversight of appropriate regulatory bodies, including APEGA in Alberta and equivalent provincial regulators where applicable. Our truth-based engineering approach keeps asset information accurate from engineering through operations.
This article is educational and does not replace the regulations in your jurisdiction, a qualified safety professional’s assessment, or your site’s own energy control program.