Lock-Out Tag-Out (LOTO) Procedures: a Philippine Plant Template

Introduction to Lock-Out Tag-Out (LOTO) Procedures

To create a compliant LOTO procedure, write one per asset and run the seven-step lockout sequence on each machine, like a 480V Pump P-204B. Sign-off and an audit trail prove it was followed. In the Philippines the fine scales with the violation and with every day it continues, and it is set by the OSH law, not by the inspector.

Lock-Out Tag-Out (LOTO) procedures are a critical component of workplace safety in Philippine manufacturing plants, such as those found in the Calabarzon region. These procedures ensure that equipment is properly shut down and secured before maintenance or repair work begins, preventing unexpected startup and protecting workers from serious injury or even death. In the Philippines the requirement is statutory: RA 11058 and DOLE Department Order 198-18 make the Occupational Safety and Health Standards enforceable and require safe work procedures for hazardous work, which is what a written LOTO procedure is. WorkHive's logbook carries a LOTO field on the job record, so the isolation is dated and attributed rather than remembered.

Effective LOTO procedures involve a series of steps that must be followed in sequence to ensure equipment is safely secured. A sample equipment-specific LOTO procedure for a 480V Pump P-204B can serve as a template for other equipment. For instance, a maintenance planner at a plant in Batangas might use a LOTO procedure template to ensure that Pump P-204B is properly locked out before any maintenance work, on whichever shift the job lands. This helps prevent accidents and ensures compliance with DOLE OSHS regulations.

The consequences of not following LOTO procedures can be severe, resulting in costly fines and damage to a plant's reputation. In the Philippines, non-compliance with OSHS regulations carries a daily fine for as long as the violation stands, so the cost is a function of how long it goes unfixed. Moreover, a LOTO-related accident can have a significant impact on plant operations, causing delays and lost productivity. With a per-asset LOTO procedure and a dated record of each isolation, plant supervisors and shift in-charges in the Philippines can help prevent such incidents and maintain a safe working environment.

A written procedure is what lets a crew who did not plan the job isolate the machine the way the planner intended, and it is the only thing an inspector can read after the fact. The two halves work together: the procedure says what should happen, and the dated record says what did. A written per-asset template plus a dated record of who isolated what turns LOTO from something the crew remembers into something the plant can show.

What a LOTO procedure has to contain

A LOTO procedure is written per asset, not per plant. The point of writing it down is that the crew on the night shift, who did not plan the job, can isolate the machine the same way the planner intended, so it has to name the actual disconnect, the actual valve, and the energy that will still be in the machine after both are shut.

The LOTO procedure template should include essential elements such as equipment identification, preparation for lock-out, application of locks and tags, verification of zero-energy state, and restoration of equipment. For example, a sample equipment-specific LOTO procedure for Pump P-204B at a plant in Cabuyao, Laguna, can serve as a reference point for other plants. The template should also specify the roles and responsibilities of personnel involved in the LOTO process, including the shift in-charge and maintenance planner.

Every per-asset procedure names the same eight things: the asset and its tag number; every energy source it carries; the exact isolating device for each one; where the stored energy sits and how it is released; how zero energy is verified and with what instrument; who may authorise the isolation; who holds the locks; and the steps for putting it back. Write those and the sequence below is simply you walking your own document.

The template at the end of this article gives you that shape to copy. Tailor it per asset, and write it with the handover in mind: on a plant running around the clock the isolation is often applied by one crew and released by another, so the procedure has to make sense to someone who was not there when the lock went on.

The 7-Step Lockout Sequence

The order is the safety measure. Each step is only trustworthy because the ones before it were done, which is why verification comes last: it is the step that proves the other six worked. Run them in this order every time:

1. Prepare. Find every energy source the job will expose, not just the obvious one: electrical supply, hydraulics, compressed air, steam, process fluid, springs under tension, anything held up by gravity, anything still hot. Write them down before you touch the machine.
2. Notify. Tell operations and everyone who works on or near the machine that it is going down, and when they can expect it back.
3. Shut down. Stop the equipment the normal way, using its own controls, not by pulling its isolator.
4. Isolate. Operate each energy-isolating device you listed in step 1: open the disconnect, close and chain the valve, disconnect the line.
5. Lock and tag. Each person doing the work applies their own lock and their own tag, and only that person removes it. On a multi-trade job that means several locks on one hasp: the machine cannot start while any of them is still on.
6. Release stored energy. Bleed the lines, drain the casing, discharge the capacitors, block or lower the raised part, let it cool. Isolating a source does not empty what is already downstream of it, and this is what kills people who did everything else right.
7. Verify zero energy: last, and at the point of work. Try to start the machine with its normal control, then return the control to off. Then test: meter on the conductors, gauge reading zero, bleed valve open. Verification is a measurement, not an assumption.

Why the last two are in that order: if you verify before you release stored energy, your reading describes a machine that no longer exists by the time you open it. A pressurised accumulator, a charged drive capacitor or a suspended load is still live after a perfectly clean verification. Release first, verify second, and the reading you trust is the state you actually work in.

Preparation is a paperwork step, and doing it properly is what makes the rest possible. For Pump P-204B it means establishing, before anyone walks to the machine, that it has two energy sources and not one: the 480V supply at its disconnect, and the process water still standing in the casing and the suction line. A procedure that lists only the electrical supply will be followed exactly as written and will still leave a worker opening a flooded casing.

The middle of the sequence is where procedures quietly go wrong, because a machine that has stopped looks finished. It is not. A pump that has coasted to a halt is still connected to 480V, and “it stopped turning” is not a zero-energy verification: the only verification that counts is a try-start followed by an instrument reading at the point of work. Between those two comes the step that is easiest to skip and worst to skip: draining the casing, bleeding the line, discharging the drive. A deviation from the written plan is what an inspector finds, and what an incident investigation looks for first.

Releasing the isolation is its own procedure, not step 8. Before any lock comes off: the work is finished and tools are out of the machine, guards are back on, everyone is clear and has been told it is about to be re-energised. Then each worker removes their own lock: nobody removes a lock for an absent colleague, which is exactly the shortcut that gets someone killed on the shift after the one that applied it. If a lock genuinely has to be cut because its owner has gone home, that is a documented decision by the supervisor with the owner contacted first, not a pair of bolt cutters and a judgement call.

Sample Equipment-Specific LOTO Procedure

Here's a sample equipment-specific LOTO procedure for a 480V Pump P-204B, commonly found in plants like those in Calabarzon, such as the Laguna Technopark. This procedure is designed to ensure the safety of maintenance personnel, like those working at a facility that runs around the clock, where an isolation can outlive the crew that applied it. Copy the shape, not the values: the energy sources are what change from asset to asset.

The LOTO procedure for Pump P-204B involves isolating the energy sources, including the 480V electrical supply and any potential water pressure. The plant supervisor or shift in-charge must ensure that the maintenance planner has identified all potential energy sources and included them in the LOTO plan. An inspector reads the written procedure against what the crew actually does, which is why a procedure copied from another plant and never walked is worse than none: it documents a sequence nobody follows.

To perform LOTO on Pump P-204B, start by notifying the operations team and obtaining approval from the plant supervisor. Then, shut down the pump and isolate the electrical supply using a lockable disconnect switch. Next, drain any water from the pump and its associated piping. Then, and only then: verify: try-start from the local control, then meter the conductors at the motor terminals and confirm the drain runs dry. Record the isolation on the logbook entry for the job, with the permit number, so the record is dated and attributed rather than remembered.

When the work is done, the release runs in reverse and by person, not by machine: tools out, guards on, everyone clear and told, each worker pulls their own lock, then the disconnect is closed and the pump handed back to operations. On a round-the-clock plant the isolation will often outlive the crew that applied it: which is the whole reason the locks are personal and the record is written down.

Sign-off and the written record

An isolation nobody recorded is an isolation you cannot prove, and on a plant running three shifts it is also one the next crew cannot interpret. Two different things have to be true: the lock on the machine has to be physical and personal, and the fact of the isolation has to be written and dated.

What WorkHive records, precisely. The logbook entry for the job carries a deliberate LOTO field: a checkbox stating that energy isolation was applied, and an optional permit-to-work reference number beside it. Tick it and the entry shows a LOTO badge in the logbook list, carrying the permit number if you entered one. Because it sits on the entry it inherits the entry's date and the name of the worker who wrote it, and it is queryable: which matters more than it sounds: before that field existed an isolation could only be found by pattern-matching the free-text description, so it was accidental rather than deliberate, and could not be counted.

What it does not do, so you plan for it. It is one field on the job record, not a lockout workflow: it does not walk the crew through the seven steps, does not hold a supervisor's approval before work starts, and does not track individual locks on and off. Those stay on your permit-to-work paperwork and on the hasp itself. What the digital record adds is the part paper loses: a dated, attributed, searchable trail an inspector can read months later, which under RA 11058 and DO 198-18 is exactly the part you are asked to produce.

The LOTO procedure template

Here is the template itself. Copy it into your own document, fill one in per asset, and keep it where the crew doing the job can reach it: a procedure filed in the office is not a procedure.

• Asset and tag number — the name the crew uses, not the one on the purchase order.
• Energy sources — one line each: type, where it enters, and its magnitude (480V 3-phase; process water at line pressure; 6 bar instrument air).
• Isolating device for each source — the specific disconnect, valve or breaker, by its own tag, and where it is.
• Stored energy and how it is released — what stays in the machine after isolation, and the drain, bleed, discharge or blocking step that empties it.
• Verification method — what you try-start, what you measure, with which instrument, and what reading means dead.
• Who authorises and who holds the locks — by role, and how many locks the hasp must take.
• Release steps — the checks before re-energising, and who removes which lock.
• Revision date and who walked it — a procedure nobody has walked against the actual machine is a draft.

Two things make the difference between a template that gets used and one that gets filed. Write it against the actual machine rather than from memory: walk to the disconnect and read its tag, and keep it short enough that the crew reads it at the machine instead of nodding at it in the office.

Procedures go stale as machines change, so re-walk each one when the asset is modified and on a fixed interval otherwise, and date the revision. The isolations you recorded on logbook entries are what tell you which procedures are actually being used: an asset with a written procedure and no recorded isolations is either not being maintained or not being recorded, and both are worth knowing.

Implementing a LOTO programme costs three things: training time, the locks and tags themselves, and someone's hours to write the per-asset procedures. The third is the one plants underestimate and the one the template above is meant to cut: copy it, and the writing becomes filling in eight fields per asset rather than starting from a blank page.

Frequently asked questions

Sources

• Republic Act 11058 and DOLE Department Order 198-18: OSH compliance and administrative penalties.
• DOLE Occupational Safety and Health Standards (as amended): the standards RA 11058 and DO 198-18 make enforceable.
• ISO 45001: Occupational Health and Safety Management Systems: operational control (clause 8.1), under which a written isolation procedure sits.
• IIEE Code: Philippine Electrical Code
• ISO 14224: Petroleum, Petrochemical and Natural Gas Industries - Reliability, Availability and Maintainability (RAM) Data Exchange