Lockout/tagout
How to define isolation points, lock and unlock equipment, force-unlock when a lock can't be released normally, and what ends up on the LOTO Log.
LockLedger's lockout/tagout tracking is point-by-point: every energy source on a machine gets its own isolation point, and a lock can't go on until every one of them is verified. This is the same rule the immutable ledger enforces for everything else — it lives in the database, not just the screen.
Defining isolation points
Before a machine can be locked out with per-point tracking, an Admin or Manager defines its isolation points from the equipment's detail screen, using Add Isolation Point. Each point gets a label (e.g. "Main Disconnect") and an energy type — electrical, pneumatic, hydraulic, or whatever that machine actually has. A machine with no isolation points defined can still be locked; it just skips the checklist, since zero required points means zero to verify.
Locking equipment
Admin, Manager, and Tech can all apply a lock. Locking is all-or-nothing: every active isolation point on that equipment has to be checked off before the lock is applied — there's no partial lock. This is a hard database rule, not just a disabled button; the same check runs again when the lock is actually written, so it can't be bypassed by a slow network retry or a client that's out of sync.
Group lockout, per person
More than one tech can lock the same equipment at once — each one holds their own separate lock. The machine only comes free once every one of those locks is released. The only thing you can't do is hold two open locks yourself on the same equipment at the same time.
Releasing a lock
The Tech who applied a lock can release it themselves, and so can an Admin, or a Manager for a site they're assigned to. Like locking, releasing is all-or-nothing — every isolation point that's still open on that lock has to be marked released in the same action.
Force-unlocking
Sometimes the Tech who applied a lock isn't around to release it themselves. An Admin, or a Manager for that site, can force it open from the equipment screen's Force Unlock LOTO dialog — but only with a written reason. An empty reason is refused outright.
A force-release is marked as an override, not a verification
Because the person forcing the lock open has no first-hand knowledge the machine's energy sources were actually de-isolated — the Tech isn't there to confirm it — every point on a force-released lock is recorded as Override, never as Verified. The LOTO Log always shows honestly which locks were released the normal way and which were administratively forced, and that distinction, along with the written reason, is permanent.
Closing a ticket with an active lock
If you try to close a ticket while its equipment still has an active lock, LockLedger stops you with Equipment is still locked out and three choices: Unlock Equipment & Close Ticket, Keep Locked & Close Ticket (for a machine that's meant to stay down), or Cancel. It never closes a ticket on a locked machine silently.
The LOTO Log
Every lock and release, normal or forced, lands on the LOTO Log screen. A released lock can't be reopened, back-dated, or reattributed to someone else, and a lock record can't be deleted. The database refuses the change for every user and every app connection, not just the interface. Use Export PDF to hand an inspector a formatted record for any date range, with every isolation point and every override reason included.
Retiring a machine
A machine with any lockout history can't be deleted outright — that history is permanent by design. To take a machine out of service, mark it inactive from Admin Equipment instead. It disappears from equipment pickers everywhere else in the app but stays listed and editable in Admin Equipment, and can be reactivated later.
Open LOTO LogNot using LockLedger yet? Join the pilot
support@getlockledger.com