Reinforced isolation, standard or neutralization: how to choose the LOTO process

The principle: RI by default, justified alternatives

The logic of the 17975 is simple but stringent. The choice of process is not discretionary: it always starts from reinforced isolation and drops to a lower level only if the risk assessment demonstrates that it is not feasible. Every deviation must be written down, justified and compensated.

This overturns a common practice in Italian sites, where standard LOTO (a padlock on the isolation valve) is often the default. With the 17975, SI becomes a choice to be justified, not assumed.

The four processes in operational summary

RI — Reinforced isolation

What it is: locking the energy isolation device plus an additional physical separation. Examples: a blind flange after sectioning a steam line; removal of a section of piping; mechanical disconnection with a physical key kept outside the system.

When to apply it: always, except for documented obstacles. It is mandatory for high-risk operations (hazardous energies, toxic or high-pressure fluids, maintenance that directly exposes the operator).

What is needed: adequate devices (properly sized blind flanges, certified padlocks), additional time for application and removal, a written procedure indicating the physical point of separation.

SI — Standard isolation

What it is: classic LOTO. A padlock on the energy isolation device (electrical disconnector, shut-off valve) + a warning tag. No physical separation beyond the lock.

When to apply it: only if RI is technically impossible (e.g. a line with no flange available upstream) or if the activity is of limited risk and short duration, and compensatory measures are adopted.

Typical compensatory measures: double sectioning, instrumental verification of the absence of energy (reinforced Try-Out), the presence of a second operator, reduction of the exposure time.

N — Neutralization through control systems

What it is: isolation achieved through the machine's functional safety (safety doors, the PLC's safety logic, safety-rated software interlocks).

When to apply it: allowed only if the control system is safety-rated according to the applicable standards (e.g. EN ISO 13849-1, IEC 62061) with a performance level consistent with the operation's risk. It is often combined with SI for short activities (format change, reset) where a complete stop of the system is not feasible.

Limits: it does not replace LOTO for operations that directly expose the operator to residual energies. It must be validated and re-validated over time: a change to the safety PLC invalidates the previous analysis.

SP — Specific provisions

What it is: procedures dedicated to particular cases (plants that cannot be stopped, live work, activities on always-active systems).

When to apply it: only if documented in a specific signed procedure, with a dedicated risk assessment, targeted training of the operators involved and — often — specific PPE. It is not a shortcut: it is the formalized derogation.

Practical decision tree

A sequence of questions to ask yourself before each maintenance operation:

1. Can the energy be completely removed? If yes, proceed. If no, consider N or SP.
2. Is it possible to add a physical separation (blind flange, removal of a section, mechanical disconnection)? If yes → RI.
3. If not, is the activity's risk limited and are feasible compensatory measures available? If yes → SI with compensatory measures.
4. If physical isolation is not feasible but the safety system is rated and adequate to the risk? Consider N, possibly combined with SI.
5. In all other cases → SP with a dedicated, signed procedure.

Every decision must be recorded: who assessed it, on what basis, which compensatory measures were introduced.

Common errors in the choice

Assuming SI as the default. This is the most frequent error in sites that adapt pre-existing procedures. The 17975 reverses the burden: SI must be justified, not assumed.

Confusing neutralization with LOTO. Putting the machine into "emergency stop" is not an isolation. N is allowed only if the safety system is rated and validated, not because "the PLC blocks everything anyway".

Underestimating compensatory measures. When dropping from RI to SI, the standard requires concrete and traceable compensatory measures, not a generic note.

Failing to re-assess over time. A change to the plant, a new maintenance activity, an update to the safety system: all events that require reviewing the choice of process.

Documenting the choice

The 17975 does not only ask what you do, it asks why you do it that way. For each typical maintenance activity, a sheet must be produced reporting:

• the activity and the plant involved
• the risk assessment
• the chosen isolation process (RI / SI / N / SP)
• the justification for the choice (if not RI)
• the compensatory measures adopted
• the step-by-step operating procedure
• roles and signatures
• the review date

This sheet is the evidence that demonstrates to auditors — and, in the event of an accident, to investigators — that the choice of process was reasoned and not improvised.

The Eurosystem experience

In the pharmaceutical sites where we operate, we have seen that the shift from the "SI by default" practice to "RI by default" is the culturally most demanding change of the 17975. It requires reviewing existing procedures case by case, training maintenance staff on the new criterion and equipping yourself with the physical devices for the separations. SmartLOTO was designed to support this shift: it natively manages the sequence between the isolation device and any physical separation element, constraining the procedure in the release of the padlocks.