2026-10-2012 min read

Lockout/Tagout on Industrial Sites: Specifying Locking Devices That Actually Hold

A padlock is only as good as the device it hangs on. How to specify lockable isolation points on South African sites, and the failures that keep recurring.

Every lockout procedure on a South African industrial site ends at the same place: a padlock, through a hole, in a piece of switchgear. Everything upstream of that moment — the permit, the briefing, the register of isolation points, the competent person's signature — is paperwork that depends on one physical fact. The device has to stay open.

That is a specification question, not a procedural one. A written lockout procedure cannot make a switch lockable. If the handle has no provision for a padlock, if the padlock secures the enclosure door rather than the mechanism, or if the switch can still be operated from the shaft behind a locked handle, then the procedure is describing a control that does not exist.

This article works through the locking side of isolation: what the law actually requires, what a locking arrangement has to do mechanically, how to specify one when you are building or refurbishing a board, and the failure modes that keep showing up during audits.

Isolation and lockout are two different requirements

It is worth separating these clearly, because equipment datasheets treat them separately and so should your specification.

Isolation is an electrical property of the open device. A device suitable for isolation satisfies the isolating-distance, leakage-current and impulse-withstand requirements across the open contacts, and indicates contact position positively — the handle shows OFF only if the contacts are genuinely open. This is a declaration the manufacturer makes, and the distinction between devices that make it and devices that do not is covered in detail in our guide to switch disconnectors, circuit breakers and isolators.

Lockout is a mechanical property of the operating mechanism. It is the ability to hold the device in the off position against anybody who tries to close it — deliberately, absently, or remotely. In the switchgear standards this appears as provision for locking in the off position, and it is a separate line on the datasheet from the isolation declaration.

A device can have one without the other. A plain load-break switch may accept three padlocks and still not be suitable as an isolation point, because the open gap is not guaranteed. A circuit breaker may be excellent at isolation and ship without any lock-off provision at all until you order the accessory. Both combinations are common, and both break a lockout procedure in different ways.

You need both properties at every point your procedures treat as a point of isolation. Specify them as two separate requirements, and check them off separately.

What the South African framework requires

Three instruments matter here, and they stack.

The Occupational Health and Safety Act places the general duty on the employer to provide and maintain a working environment that is safe. Everything below is a specific expression of that duty.

The Electrical Machinery Regulations made under that Act carry the electrical lockout obligation directly: machinery must be made safe before work is carried out on it, and the means of isolation secured so that it cannot be reconnected while that work is in progress. This is the regulation that turns "provision for locking" from a nice-to-have into equipment you must actually have installed. It also establishes who may do the work — a competent person, appropriately authorised for the voltage and the task.

SANS 10142-1 governs the fixed installation itself, including the requirement for accessible means of isolation and for switchgear to be installed so that it can be operated and secured safely. Where an alteration to the installation is involved — adding an isolation point, replacing a main switch, fitting a lockable escutcheon — the Electrical Installation Regulations make the altered work certifiable, and a Certificate of Compliance is required for it.

For machinery specifically, the supply disconnecting device is expected to be capable of being secured in the isolated position. The practical consequence for a machine builder or a panel shop is that the disconnector feeding each machine must accept a lock, be reachable without opening a live enclosure, and be identifiable as belonging to that machine and no other.

The wider compliance picture these sit inside — which standard governs what, and who signs for it — is set out in our overview of electrical safety standards in South African industrial facilities.

The safe isolation sequence, and where the lock sits in it

Lockout is one step in a sequence, and it only works in its place in that sequence. The widely used form of it runs:

Identify the circuit and every source feeding it, from an accurate single-line diagram and a register of isolation points.
Isolate at a device suitable for isolation, for every source.
Secure the isolation — the lock, applied by the person who will be doing the work, with the key in that person's possession.
Post the warning — the tag that tells anybody arriving at the device what is happening, who did it, and when.
Test for dead at the point of work, with an approved voltage indicator, after proving the indicator on a known source.
Apply additional precautions where the circuit can be re-energised from elsewhere, or where stored energy remains.

Step 3 is the one this article is about, but the sequence matters because the lock's job is narrow. The padlock does not prove the circuit is dead; the test for dead does that. The padlock's job is to keep it dead for the duration of the work. Teams that conflate the two tend to drop the test — the single most consequential shortcut in the whole sequence, and one of the conditions that turns a routine job into an arc flash incident.

What a locking arrangement has to do mechanically

Four things, and it is worth testing each one on a sample before standardising on a product across a site.

Hold the device off. The lock-off must act on the mechanism such that the contacts cannot be closed while it is fitted. Not on the knob's trim, not on a cover that can be unclipped, not on a handle that lifts off its shaft.

Lock in the off position only. On multi-position devices this is a real distinction. A changeover switch has two live positions and a centre off; a cam switch may have many. If the lock-off accessory will accept a padlock in a live position as readily as in off, it is an operational interlock, not a safety lockout, and it must not be the thing your isolation procedure relies on. For the isolation point itself, specify locking in the off position only. The behaviour of changeover devices in particular — and why their off position deserves attention — is covered in our piece on manual and automatic changeover switches.

Accept the padlocks you actually use. This means checking shackle diameter against the hole, and checking how many separate shackles the hasp or lock-off plate will take. Padlockable handles are typically rated for a small, specific number of shackles, and that number is a datasheet figure worth reading rather than assuming. If five trades will work on a line simultaneously and the handle takes fewer, you need either a different arrangement or a group lockout box: one lock on the device, its key secured in a box, and every worker's own padlock on the box.

Resist casual defeat. A lock-off that can be removed with a screwdriver, or bypassed by operating the mechanism directly, is theatre. Pay particular attention to door-mounted arrangements: where the device is operated through an extension shaft and escutcheon, the locking provision must act on the shaft or on the handle's engagement with it, so that the device cannot be turned at the mechanism once the escutcheon is locked. Equally, a padlock on the enclosure door is access control, not energy control — it keeps people out of the panel, and does nothing to prevent somebody rotating an unlocked handle on the outside of that same door.

Specifying for lockout at design time

Lockout is cheapest when it is decided alongside the switchgear, and most expensive when it is retrofitted to a board already in service.

One identified isolation point per item of plant. Each should be labelled with the equipment it isolates, in the same wording the register and the permit use. Ambiguous labelling causes the wrong device to be locked, which is worse than no lock at all because it produces confidence without protection.

Locking provision on the datasheet, not inferred from the picture. Confirm the lock-off accessory exists for the specific frame size you are ordering. Accessory availability is frame-dependent, and a locking kit that fits a 160 A frame may have no equivalent for the 630 A frame on the same single-line diagram.

Accessible without opening a live enclosure. If a worker has to open a door onto live busbars to reach a handle, the arrangement has defeated its own purpose. Door-mounted handles with extension shafts exist precisely for this, and the lockable escutcheon is the accessory that completes them.

Positive contact position indication at every isolation point, so that OFF on the handle is a statement about the contacts and not about the linkage.

Auxiliary contacts for status indication where the isolation point feeds something that needs to know. An auxiliary contact on the disconnector lets a control system, an SCADA display or a simple panel lamp report the actual position of the device — useful for confirming an isolation from a control room, though never a substitute for testing at the point of work.

Shrouds, phase barriers and terminal covers on the supply side of the isolation point. These are what make the locked-off device safe to work adjacent to: the incoming terminals stay live when the device is open, and on an unshrouded device they are exposed the moment the enclosure is opened.

Stored energy accounted for. Capacitor banks, variable-speed-drive DC links, UPS and battery systems, pneumatic accumulators and spring-loaded mechanisms all hold energy after the supply is locked off. Each needs its own isolation and discharge step in the procedure, with a defined wait time where one applies.

Every source, not just the obvious one. This is where backup supplies catch people out. A board fed by both the utility and a generator has two sources; a site with battery energy storage has a source that does not announce itself; and on a PV installation the array is a source that cannot be switched off at all — DC isolation on the string side is mandatory and the strings remain live in daylight regardless of what the AC side is doing. Our article on solar power distribution for industrial sites covers the DC-side isolation requirements in more detail.

Tags are information, locks are control

The "tagout" half of the phrase does real work, but not the work people sometimes expect of it.

A tag communicates: this device is isolated, for this work, by this person, since this time, and do not operate. It is how somebody who arrives at a locked device without context learns what they are looking at. On a multi-shift job it is also how the next shift knows the isolation is still in force rather than abandoned.

What a tag cannot do is prevent operation. A tag on an unlocked handle relies entirely on everybody who passes reading it and complying. Tag-only isolation is therefore a fallback for the case where locking is genuinely impossible — not a convenience when the lock-off kit has not arrived. Where it is unavoidable, it needs compensating controls: a second person stationed at the device, removal of fuses or a withdrawable part so there is a physical break, or de-termination with the ends made safe.

The practical rule that avoids most arguments: one person, one lock, one key, and the person doing the work holds the key. Keyed-alike padlocks across a site, a spare key in the maintenance office, or a supervisor's master key all break the chain, because they mean somebody other than the worker can restore the supply. Personal padlocks should be uniquely keyed, individually identified, and removed only by the person who applied them.

Procurement checklist

Before signing off a board specification or a locking-device order:

Isolation declaration present on the datasheet for every device the procedures treat as an isolation point.
Provision for locking in the off position confirmed for the specific frame size, not assumed from the range.
Lock-off part number identified and ordered with the device, including quantity per board.
Padlock compatibility checked — shackle diameter against the hole, and number of shackles the arrangement accepts.
Multi-position devices verified to lock in off only, where they serve as isolation points.
Door-mounted arrangements specified with a lockable escutcheon acting on the shaft, not merely a lockable door.
Positive contact position indication specified at each isolation point.
Auxiliary contacts specified where status indication is required by the control system.
Shrouds and terminal covers specified for the supply side of each isolation point.
Labelling schedule agreed, using the same equipment names as the isolation register and the permit forms.
Group lockout hardware — hasps, lockout boxes, tag stock — included in the project scope rather than left to the site to improvise.
Stored-energy isolation points identified for drives, capacitor banks, battery systems and PV arrays.
Certificate of Compliance arranged where the work alters the fixed installation.

Three failures worth naming

Locking the door instead of the device. Found on almost every site audit. A padlock through the enclosure handle feels decisive and controls nothing about the switch position. It is access control. Energy control has to act on the mechanism of the isolating device itself.

Locking a handle that lifts off. On extension-shaft arrangements, a handle padlocked in the OFF position can sometimes be removed from the shaft entirely, leaving the shaft free to turn — or the device operable at the mechanism inside the panel. This is a question to put to the supplier in writing for the exact handle and shaft combination you are buying, and to test physically on the first unit before the rest of the boards are built.

Treating the lock as proof of dead. The lock holds a state; it does not establish one. Contacts can weld closed, most plausibly after a fault the device successfully withstood — which is also why a locked-off device that has recently interrupted a fault deserves inspection, as discussed in our notes on fault finding on industrial switchgear. Test for dead at the point of work, every time, with a proven indicator.

Behind all three sits a maintenance point: lock-off hardware is mechanical, and mechanical things seize, bend and go missing. Include the locking provision in the switchgear inspection routine — operate it, confirm it still blocks closure, confirm the padlock still fits — alongside the other checks in our switchgear maintenance best practices. Hardware that was correct at commissioning and has since been painted over, forced, or cannibalised for another panel is a lockout procedure that has quietly stopped working.

Getting it right at specification stage

A lockout programme is usually written by safety people and enabled or disabled by procurement decisions made months earlier. The devices either accept the locks, hold the mechanism, and sit where a person can reach them — or the written procedure becomes an aspiration. Getting this right costs very little at order time and is awkward and expensive to retrofit, which is the whole argument for treating it as part of the board specification rather than part of the site's housekeeping. How that specification comes together across a full installation is covered in our buyer's guide to industrial switchgear, and the physical disciplines that keep it sound are in our installation best practices.

GNTech supplies Telergon switch disconnectors, changeover switches, fuse switches and cam switches for South African industrial installations, together with the locking devices, handles and extension shafts, shrouds and barriers, and auxiliary contacts that make up a complete assembly. If you are specifying a board and want the isolation points, locking provisions and accessory part numbers checked against your single-line diagram before you order, get in touch — send us the drawing and we will work through the isolation schedule with you.