Key Management and Group Locking in LOTOTO Maintenance

• Posted on 2 June 2026
• By Marit Krol
• Posted in Key management, Lockout-Tagout, LOTO
• 0

During maintenance, cleaning, fault-finding, setup, or repair, employees often need to work inside or near hazardous machine areas. The machine must not restart, move, release pressure, become energised, or expose workers to stored energy while work is being performed. This is the purpose of Lockout-Tagout (LOTO): isolating hazardous energy sources and preventing unexpected energisation, start-up, or release of stored energy. In many industrial environments, the preferred practical approach is LOTOTO: Lockout, Tagout, Tryout. The “tryout” step confirms that the isolation is effective before maintenance starts.

In the United States, OSHA standard 29 CFR 1910.147, the control of hazardous energy, requires an energy control programme with procedures, employee training, and periodic inspections where unexpected energisation, start-up, or release of stored energy could injure employees. In machinery safety, ISO 14118:2017, Safety of machinery: Prevention of unexpected start-up, is the key international standard for preventing unexpected machine start-up during human interventions in danger zones. It applies to different energy sources, including electrical, hydraulic, pneumatic, and stored energy. In practical maintenance work, however, the challenge is not only placing locks. It is controlling who holds the keys, who is protected by which lock, and when energy may safely be restored. That is where key management and group locking become essential parts of an effective LOTO or LOTOTO procedure.

What is key management in Lockout-Tagout?

Key management is the controlled handling of keys used for safety padlocks and lockout devices during maintenance. It defines where keys are kept, who may access them, how duplicate or master keys are controlled, and how key custody is documented. In a simple one-person LOTO procedure, key management may be straightforward. The authorised worker places a personal padlock on an energy-isolating device and keeps the key with them. The machine cannot be intentionally re-energised through that isolation point until the worker removes their own lock.

In complex maintenance, the situation changes. A machine may have several energy sources, such as electrical power, compressed air, hydraulic pressure, steam, fluids, stored mechanical energy, gravity, or heat. ISO 14118:2017 addresses prevention of unexpected start-up from multiple types of energy source, including power supply and stored energy. When several workers, trades, shifts, or contractors are involved, uncontrolled key handling can create serious risks. Good key management ensures that every person exposed to hazardous energy has direct, visible, and personal control over their own protection.

What is group locking in LOTO?

Group locking, also known as group lockout, is a LOTO method used when multiple authorised workers are involved in the same maintenance activity. Instead of every worker placing a personal lock on every enegry-isolating point, the relevant energy sources are isolated and locked by an authorised person or team. The keys for those isolation locks are then placed in a group lockout box. Each worker attaches their personal safety padlock to the group lockout box before starting work.

The principle is:

1. All relevant energy sources are identified and isolated
2. Padlocks are applied to the energy isolating devices
3. The keys for those padlocks are placed inside a group lockout box
4. Each authorised worker places a personal padlock on the group lockout box
5. The keys inside the box cannot be accessed until every personal lock has been removed

A typical group lockout box should support the following functions:

The importance of group locking during maintenance

Group locking is especially valuable where maintenance is too complex for a single-lock, single-worker approach. Typical examples include production-line shutdowns, machine overhauls, conveyor maintenance, robot-cell servicing, cleaning inside guarded areas, and work involving external contractors.

1. It perserves personal control

A central rule of effective LOTO is that a worker should not depend solely on someone else’s decision to remain safe. In group locking, each person adds their own personal padlock to the group lockout box. As long as that personal lock remains in place, the isolation keys cannot be removed from the box. This means the locked energy-isolating devices cannot be intentionally unlocked through the normal key-control process. The group lockout box therefore becomes a shared control point, while still preserving individual worker protection.

2. It simplifies multi-energy isolation

Large machines may require locks on several energy-isolating devices. Without group locking, every worker may need to apply a personal lock to every isolation point. That can become slow, confusing, and physically difficult, especially during shutdowns involving many workers. With group locking, the isolation locks secure the energy sources, and the keys are secured in the group lockout box. Workers then apply one personal lock to the box. This keeps the procedure manageable without removing the requirement for personal protection.

3. It improves visibility during shutdowns

A group lockout box gives supervisors, maintenance coordinators, and authorised employees a clear visual indication of who is still working. If personal locks remain on the box, the job is not complete. This is particularly important during shift changes, contractor work, or phased maintenance where mechanical, electrical, cleaning, and inspection teams may work at different times.

4. It reduces the risk of premature re-energisation

Premature re-energisation is one of the major hazards during maintenance. A group lockout box helps prevent this by ensuring that isolation keys remain inaccessible until all personal locks have been removed. This supports the same safety logic as LOTOTO: lock the energy source, tag the isolation point, and try out the system before anyone starts work.

How key management should work in a group LOTOTO procedure

A group locking process should be documented in the site’s energy control procedure. The exact steps depend on the machine, energy sources, company procedure, and applicable jurisdiction, but the following structure is commonly used.

Step 1: Identify all hazardous energy sources

Before work begins, the authorised person or team identifies all energy sources that must be isolated. This may include electrical supply, compressed air, hydraulic pressure, steam, fluids, stored mechanical energy, gravity, heat, and residual pressure. The procedure should also define how stored or residual energy is released, restrained, blocked, discharged, or otherwise made safe.

Step 2: Shut down and isolate the equipment

The machine is shut down according to the approved procedure. Energy-isolating devices are operated to disconnect or block the energy sources. Each energy-isolating point must be suitable for lockout. Where equipment is designed for safe maintenance, isolation points should be clear, accessible, and identifiable.

Step 3: Apply safety padlocks

Safety padlocks are applied to the energy-isolating devices. These are the locks that physically prevent the energy-isolating devices from being operated. The keys for these isolation locks should not be kept in a pocket, on a desk, or in an uncontrolled key cabinet. They should be placed in the group lockout box.

Step 4: Apply tags

Tags provide a clear warning that the equipment is locked out and must not be operated. A tag should identify the lockout status, the responsible person or team, and relevant procedural information. A tag is not a physical energy-isolation device by itself. It supports communication and warning, but the lock provides the physical restraint.

Step 5: Secure the keys in the group lockout box

Once all isolation keys are inside the group lockout box, the box is closed. From this point, the keys cannot be accessed unless the personal locks on the box are removed. This is the critical key-management function: the energy-isolation keys are separated from individual possession and protected by the collective personal locks of the workers.

Step 6: Each authorised worker applies a personal lock

Every authorised worker involved in the maintenance task applies their own personal safety padlock to the group lockout box before starting work. This step should not be delegated. The personal lock represents the worker’s individual protection.

Step 7: Try out and verify the isolation

This is the additional “TO” in LOTOTO: Tryout. Before work starts, the authorised person or team verifies that the machine is isolated and cannot start or release hazardous energy. Verification may include:

Verification is not optional in a LOTOTO process. A lock on its own does not prove that the machine is safe; it only secures the isolation state. The tryout confirms that the isolation is effective before people enter or work near the hazard zone.

Step 8: Control changes during the job

During longer jobs, key management must remain active. The procedure should define how to handle:

Step 9: Remove personal locks (only when work is complete)

Each worker removes their own personal lock only after they have completed their work and are clear of the danger zone. The isolation keys remain trapped inside the group lockout box until the last personal lock is removed. Only then can authorised personnel retrieve the keys, remove the isolation locks, and restore energy according to the approved procedure.

When should you consider getting products to facilitate a group lock out?

Group lockout products are most relevant when maintenance involves multiple people, multiple energy sources, or multiple work groups.

A group lockout box is typically appropriate when:

Conclusion: Key control is not administration, it is part of the safety function

During maintenance, the question is not only whether a machine has been locked out. The more important question is whether every exposed person has reliable control over the lockout state. Good key management ensures that safety padlocks for isolation lockouts cannot be accessed prematurely or by the wrong person. Group locking extends that principle to complex maintenance work involving multiple workers, energy sources, shifts, and contractors.

A group lockout box is therefore more than a storage container. Used correctly, it is the central control point that connects the enrgy isolation procedure with each worker's personal protection. For maintenance teams, machine builders, safety managers, and contractors, the safest approach is to define group locking in the written LOTO procedure, select suitable lockout devices, train authorised employees, and verify isolation through a LOTOTO procedure before work begins.

Bonus: A practical checklist for safe key management and group LOTOTO

Use this checklist when reviewing a maintenance LOTO or LOTOTO setup: