Lockout tagout procedure for multi-energy systems explained
From the gas trains on Curtis Island to the LNG plant modules being staged for offshore projects off Western Australia, Australian process facilities rarely run on a single energy source. A typical pump skid might combine 415-volt motors, instrument air at seven bar, hydraulic actuators, trace heating, and residual process chemicals all within touching distance. When maintenance teams open up equipment like that, a single lock and a single tag are not enough. A proper lockout tagout procedure for multi-energy systems requires a disciplined, step-by-step approach that catches every point where stored or supplied energy could re-enter the work zone.
Across the Pilbara, the Hunter Valley, and the Gladstone industrial corridors, regulators acting under the model Work Health and Safety laws expect duty holders to identify every energy hazard and bring each one to a verifiable zero-energy state. Resources such as Safe Work Australia's general guarding guidance and the state-based codes of practice set the expectation, but the gap between reading the rule and running a clean shutdown on a live plant is where most near misses occur. The framework below walks through the key steps a maintenance crew should follow when more than one form of energy is present, and the points where Australian sites most often get caught out.
Recognising where multi-energy risks actually live
Most operators can recite the obvious hazards: a motor, a pressured line, a charged capacitor. Multi-energy incidents happen because the less obvious sources get missed. In a typical seawater reverse osmosis train on a Pilbara dewatering site, for instance, the obvious risk is the 690-volt drive, but a service technician working beside it might also be exposed to residual pressure in the high-pressure pump casing, stored hydraulic energy in the actuator on the adjacent isolation valve, the suspended mass of a closed-bolt sample probe waiting to drop once a guard is removed, and clean-in-place chemicals still coating internal surfaces.
Engineers heading into a Gladstone LNG fractionation unit face a similar list, with the addition of cryogenic temperatures, hydrocarbon inventory, and instrument air that keeps control valves fail-closed. A useful exercise before any permit to work is written is to walk the physical boundary of the job with the isolations diagram open, and write down every energy vector — supplied, stored, or generated. This list becomes the basis of the lockout tagout procedure for multi-energy systems, and skipping any line item is where the procedure falls apart.
When teams train on realistic plant replicas, the habit of asking "what else could move this, heat this, or release this?" becomes second nature. Site safety leads often borrow from international exchange programmes to benchmark how other high-hazard jurisdictions structure their isolation discipline, an approach now being trialled in several Pilbara operations during planned shutdown season.
Preparing the job and mapping every energy source
Preparation is the longest and most underestimated phase. The authorised person supervising the isolation should hold a current set of single-line electrical drawings, piping and instrumentation diagrams, hydraulic schematics, and a list of all stored-energy devices. On a Hunter Valley wash plant, that might include counterweight springs on conveyor drift switches, accumulators on steering circuits, and the natural gas line feeding the burner on the dryer drum. Each item is plotted on the isolation list with its energy type, magnitude, location, and the proposed isolation device.
Plots on their own are not enough. Physical walkdowns must confirm the device actually exists where the drawing says it does, that it locks in the correct direction, and that no bypass path remains in service. Australian standards treat walkdown verification as mandatory because field conditions often differ from issued revisions. This walkdown also identifies job-specific personal protective equipment, the tools required to test-dead each source, and any temporary bonding points needed for static dissipation before the work begins. If a crew cannot confidently answer each of those questions, the job is not ready to start.
Telling people what is about to happen
Communication is a step that paperwork-driven sites can treat as a tick-box. In multi-energy work, a missed notification is the first thing the regulator will ask about in the post-incident review. Workers in the affected zone, the adjacent operating area, the control room, and any overlapping contractor crews must all be told which equipment is being isolated, when, for how long, and what to do if they see a lock being tampered with, or need to leave their own key in a group lock box.
Shift change is the moment this communication most often collapses on remote Australian sites, where fly-in fly-out crews hand over to the next panel during a long isolation. A written handover between outgoing and incoming authorised persons, with a signed check that all locks are accounted for, keeps the boundary intact. Signage at the equipment itself — not just on the master lock box — tells anyone approaching later that the unit is under instruction and must not be re-energised.
Isolating each energy source in the right order
The order of isolation matters as much as the act itself. The accepted sequence is to first isolate supplied energy sources — open the upstream electrical breaker, close the root process valve, vent the instrument air header — then deal with stored energy by bleeding accumulators, draining lines, allowing cool-down periods, and pinning up moving masses. Reversing the order, or skipping directly to lock placement, is the classic root cause of multi-energy incidents on brownfield units.
Each isolation point gets both a physical lock and a tag that identifies the person, the date, the reason, and a contact number. Where the same source feeds multiple work groups, group lock boxes and individual worker locks ensure no one can re-energise the system until every lock is returned. Australian sites have largely standardised on colour-coded tags by discipline — electrical, mechanical, process, instrument — so a visual sweep of the isolation boundary shows whether each required control has been applied.
A persistent trap on ageing equipment in places like the Newcastle steelworks or the Whyalla smelter is an undocumented standby generator or uninterruptible power supply feed that backs up a control system. These are easy to miss on the original electrical drawing because they were installed later. A skilled verifier will meter every conductor — including neutral and earth — at the point of work before declaring an electrical source dead.
Energy type | Common source examples | Primary isolation device | Verification method | Common Australian site mistake Electrical | 415 V motor, 690 V variable frequency drive, UPS feed, battery bank | Lockable breaker or disconnect | Live-line voltage indicator on every conductor and return path | Missing UPS or standby generator feed after later modifications Hydraulic | Actuator accumulators, hydrostatic drives | Lockable valve in closed position with bleed open | Calibrated gauge confirms zero cylinder pressure | Forgetting the accumulator pre-charge that re-pressurises the line Pneumatic | Instrument air header, spring-return actuators | Lockable root valve, vent downstream | Pressure gauge at the actuator reads atmosphere | Leaving a regulator charged upstream of the lock point Thermal | Steam tracer lines, fired heater coils, cryogenic LNG piping | Lockable block valves with drain and vent | Contact thermometer or thermal imaging probe | Re-pressurising before the line has fully cooled Chemical | Process inventories, cleaning solutions, neutralising agents | Double block and bleed, spectacle blanks | Sample draw and pH or conductivity check at the work point | Residue trapped in dead legs and sample lines Mechanical | Counterweights, spring-loaded guards, suspended loads | Mechanical props, pins, or chains to fix the mass | Manual attempt to move after pinning | Hydraulic failure re-energising a propped mass
Verifying the zero-energy state before work begins
Verification is the one step where shortcuts have the most severe consequences, so it deserves its own treatment. The multi-energy lockout tagout procedure requires the verifier to attempt to operate the equipment through its normal start sequence using the local controls, and then to attempt to operate it again through any remote or back-up controls. Doing one without the other leaves residual paths wide open.
After controls testing, the verifier physically tests the isolation points. That means a voltage indicator on every phase and the appropriate return path, a calibrated gauge on depressurised lines, a thermometer on thermal sources, and a sample point draw on chemical systems where build-up could remain. Personal locks are then applied by every individual entering the work zone, attached through a group lock box or directly to each isolation device as the procedure requires. Workers carry the key; supervisors hold no override authority that bypasses personal locks.
In higher-risk settings, an independent verifier — separate from the person who applied the controls — performs the test-dead checks. This is a control many Australian operators borrow from major-hazard UK practice, and it is the focus of courses such as the authorised person training developed for live-plant training environments. Putting a second pair of trained eyes on the verification step is widely credited with catching the small mistakes that escalate into near misses during complex shutdowns.
Bringing the plant back safely when work ends
Restoration is its own procedure rather than the simple reverse of isolation. Workers must be cleared from the equipment, tools removed, guards refitted, and any temporary bonds or earths lifted. Only the authorised person removes the group lock, and only after every individual lock has been returned and the lock box integrity has been confirmed. Re-energisation follows the original supply sequence — control air first, then process lines, then motive power last — so that any unexpected movement happens in a deliberate, observable order.
A post-job review closes the loop. The team records anything that did not match the documented isolation list: a valve that was found in a different position, an unmarked electrical termination, a chemical sample point that still held residue. These findings feed the management-of-change process and the next iteration of the isolation procedure. Over time, this cycle tightens the lockout tagout procedure for multi-energy systems into a site-specific, well-rehearsed routine.
Practical recommendations for site leaders
- Treat each isolation list as a single source of truth, and version-control it against the latest drawing revisions before signing a permit.
- Require a second person, independent of the isolator, to verify zero-energy at every source during the first hour of any multi-energy job.
- Standardise coloured tags and lock bodies by discipline across the whole facility, so a boundary walk-down reveals missing controls at a glance.
- Schedule a short stand-down talk at every shift handover during long isolations, and record attendance as part of the permit record.
- Run multi-energy isolation drills on a replica plant at least once a year, so the muscle memory matches the procedure.
Strengthen your isolation programme by speaking with the team at HCF CATCH about booking a place on the upcoming multi-energy lockout tagout course, or arrange a site tour of the live-process-plant training centre to see the procedure in action before your next major shutdown.