Controls Safety and LOTO: What Every Plant Manager Needs to Know

Lockout/Tagout injuries cost manufacturers thousands of lost workdays each year. OSHA estimates that proper LOTO procedures prevent roughly 120 fatalities and 50,000 injuries annually. The standard is well-established and the violations are common — and the intersection of LOTO with modern control systems is something many plants haven't fully thought through.

When a PLC controls multiple energy sources simultaneously, when remote monitoring enables activation from outside the facility, and when modern drive systems store energy after power is removed, the traditional LOTO procedures may not account for the full hazard picture.

This article covers the relationship between control system design and LOTO safety — what plants should be thinking about when both engineering and procedure meet.

Why Control Systems Complicate LOTO

Traditional LOTO is straightforward: isolate the energy source, lock it in the de-energized position, verify zero energy. For a simple motor with a disconnect, that's three steps.

Modern automated systems introduce complexity on several fronts:

• Multiple energy sources per machine: A CNC cell or robotic workstation may have electrical, pneumatic, hydraulic, and stored mechanical energy — all managed or monitored through a PLC. Isolating each requires a separate procedure step.
• Stored energy in drives: Variable frequency drives (VFDs) contain capacitors that hold significant charge after the main power is disconnected. The DC bus may remain hazardous for 30 seconds to several minutes. Drive enclosures should be marked with stored energy warnings and discharge wait times.
• Remote activation capability: If your SCADA system or remote monitoring solution can send commands to field devices, a worker performing LOTO on that equipment is not safe from a software-initiated start command. LOTO procedures must address control system lockout, not just physical energy isolation.
• Networked control of multiple machines: A PLC may control equipment across a large area. "Locking out the panel" may not lock out all controlled devices if those devices have their own energy sources.

Control System Design for LOTO Safety

The best time to address LOTO is during the control system design phase — before the panel is built and the program is written. Several design practices improve LOTO compliance and reduce the risk of energy control failures:

Clear Energy Isolation Points

Every panel should have clearly labeled, accessible disconnect means for each energy source. Main circuit breakers, pneumatic isolation valves, and hydraulic lock-out ports should be designed into the panel and marked with the appropriate hazard information.

Lockable disconnects should use safety lockout hasps that accept multiple padlocks — allowing every worker on the task to apply their own lock, as required by OSHA.

This is the kind of detail we build into every panel from the start — clearly labeled isolation points, lockable disconnects, and safety-rated components are standard parts of our PLC programming and panel fabrication process, not something added after the fact at commissioning.

Safety Relays and Safety PLCs

For equipment with significant injury potential, safety-rated control components provide a layer of protection that standard automation components don't. Safety relays (Pilz, Schmersal, Allen-Bradley GuardMaster) and safety PLCs operate on a dual-channel redundant architecture that provides a reliable de-energized state even in the event of a single component failure.

Safety functions — E-stops, light curtains, gate interlocks — should be wired into safety-rated components with a SIL (Safety Integrity Level) rating appropriate to the hazard. This is separate from the LOTO procedure itself but complementary to it.

Controlling Remote Activation

If your control system has any remote access capability — even a basic remote HMI — your LOTO procedure must address how to ensure a remote command cannot activate equipment while a worker is present. This typically means a software-level lockout step that prevents commands from being issued to the equipment, in addition to physical energy isolation.

For higher-risk applications, physical remote access lockout points — a key switch or physical disconnect for the communication interface — provide a hardware-enforced barrier.

Documenting Machine-Specific LOTO Procedures

OSHA requires that energy control procedures be documented for each machine or piece of equipment that has multiple energy sources, or where leaving the machine energized is necessary for work. Generic LOTO procedures don't meet this requirement.

A complete machine-specific LOTO procedure documents:

• The types and magnitudes of hazardous energy present
• The specific steps to isolate each energy source, in sequence
• The location of each energy isolation point
• The method to verify zero energy state
• Any special considerations for stored energy, residual pressure, or gravity-loaded components

When a new automated system is commissioned, the commissioning team should produce a draft LOTO procedure as part of the documentation package. Controls engineers know the energy sources and isolation points better than anyone at that stage.

Periodic LOTO Audits

OSHA requires that energy control procedures be inspected at least annually to ensure they remain accurate and that employees are following them. For complex automated systems, this inspection should include:

• Verifying that each documented isolation point is still present and functional
• Confirming that stored energy warnings (particularly for VFDs) are posted and accurate
• Reviewing any changes to the control system that may have added new energy sources or changed isolation points
• Observing an authorized employee perform the procedure to confirm compliance

When a controls upgrade is performed — new PLC, new drives, expanded I/O — the LOTO procedure for affected equipment must be reviewed and updated before the equipment is returned to service.

The Bottom Line

LOTO compliance isn't separate from controls engineering — the two are directly connected. Control system design decisions affect the completeness and accuracy of LOTO procedures. The commissioning of a new system is the right time to document energy sources, design clear isolation points, and produce machine-specific procedures that actually match the equipment.

Retrofitting LOTO documentation after the fact is harder, more expensive, and more likely to have gaps. Building it in from the start costs very little and protects the people who work on your equipment every day.