Before a diver goes into the water at an industrial facility, every energy source capable of moving or starting up has to be locked out, tagged and verified. Lockout-tagout — LOTO — is the procedure that guarantees this, and its central rule is that physical control rests with the diving team, not with a third party on the other end of a phone.
On the list of things that can kill a commercial diver, there is one that has nothing to do with diving itself: a machine starting up while they are working. A pump that kicks in, a gate that opens, a valve someone operates from a control room two hundred metres away. The diver does not see any of it coming, and cannot get out of the way.
The procedure that exists to prevent this is known internationally as LOTO —lockout-tagout — lockout-tagout — and in European practice as isolation. It is a procedure that is simple to explain and strict to follow, and in underwater work at industrial facilities it is probably the safety measure with the best ratio of effort to lives saved.
Why a diver is worse off than any other worker
The difference from work on land is one of degree, but it is enormous.
Primero, there is no pulling back. A worker who hears something start up moves away. A diver is attached to a umbilical, often inside a duct or next to a grille, and their movement is slow by definition.
Segundo, there is no warning. With reduced visibility and the noise of their own equipment, a nearby machine starting up may not be noticed until the water is already moving.
Third, and this is what people coming from other industries underestimate most: the suction. A flow through an intake or a grille generates a suction force you cannot swim against. It is not a matter of physical strength or reflexes. It is a trapping mechanism that acts within seconds, and one you do not get out of without outside help.
What energy sources have to be controlled
The word "electrical" in the title falls short. Before a dive at a facility, every source capable of producing movement or releasing force has to be identified and controlled.
La Electrical energy powers pumps, gate motors and submerged equipment. The hydraulic and pneumatic energy drive actuators that can hold pressure even when the system is stopped. The fluid pressure in pipes and circuits can release when a flange is opened. The severity acts on suspended loads and gates that can fall. The energy stored in springs, accumulators and counterweights releases when something gives way.
And one specific to this environment: the difference in water level. Two bodies of water at different levels separated by a gate hold an enormous amount of energy, and opening it, even partway, generates a flow capable of sweeping away anything in its path. On work at dams, locks and power stations, this is the energy that dominates.
How to do it properly
The sequence is always the same, and it allows no shortcuts.
Se identifican every source that affects the work area is identified, using the facility's drawings and the people who know it. This is the step where the surprises turn up: a backup supply, an interconnection with another circuit, a level-triggered automatic start.
Se isolates each source physically: open the disconnect switch, close and lock the valve, bleed off residual pressure, mechanically chock anything that could fall.
Se bloquea with a device that prevents it being switched back on, and it is tagged, etiqueta indicating who applied the lock, why, and since when. The padlock is not symbolic: it is what stops someone who does not know there are people in the water from restoring the service.
Se verifica. Try to start the equipment from its local control, check for absence of voltage where applicable, confirm the gate does not move. An isolation that has not been verified is not an isolation; it is an assumption.
And control is maintained throughout the whole job. Here is the point that separates a real procedure from a paper one: the diving team has to keep control of the lockout. When several teams are working at the same time, multiple-lock systems are used, where each one fits their own padlock and the energy cannot be restored until every one of them has been removed.
Coordinating with the facility
Diving at an industrial plant almost never happens in isolation. There is a facility owner, an operations manager, and often other contractors working at the same time. Isolation is the point where that coordination either holds or breaks down.
What works is a permit to work that sets out in writing what has been isolated, who did it, how it was verified and who is authorised to lift it; a briefing beforehand with the operations staff explaining that there will be people in the water; and established communication between the dive site and the control room throughout the operation.
What does not work is trusting a conversation. "It's already stopped" said over the phone is not an isolation, and accepting it as one is exactly the failure that shows up again and again in investigations of accidents of this kind.
Where it comes up most often
This procedure dominates work at facilities with water circuits. At hydroelectric and nuclear power stations, where there are gates, intakes and cooling circuits. At pumping stations and treatment plants. At desalination plants and at the water intakes of industrial facilities. At locks and port gates.
At all of them, the client usually has their own isolation system, with its own procedures and forms, and the diving contractor works within it. Knowing that system and being able to operate inside it is part of professional competence in inland and industrial work.
The failures that keep repeating
The ways isolation fails are few, and they repeat with a regularity that is almost instructive.
The first is fuente olvidada: the obvious source gets isolated and a backup supply, an interconnection with another circuit, or a level-triggered automatic start is left live. It is an identification failure, and it is countered with drawings, with the people who know the facility, and with a healthy scepticism toward "that doesn't reach this far".
The second is the verification that never happens. The lock goes on, the tag goes on, and nobody checks that the equipment really cannot start. It is the quickest step of all, and the one most often skipped when there is a rush.
The third is the lock someone else controls. The diver goes into the water trusting that someone at the plant has fitted a padlock that nobody on the diving team has actually seen. As long as physical control is not in the hands of the person whose life is on the line, the protection is theoretical.
The fourth is premature restoration: someone restores service because "they're finished now", without confirming that all personnel are out of the water. It is why removing a lock has a single person responsible for it and a mandatory check beforehand.
And the fifth, running through all of the others, is the shift change. Handovers are the moment when information gets lost: whoever comes on does not know what is locked out or why. A documented handover, with the status of every isolation written down, solves a problem that would otherwise reappear every twelve hours.
The electrical equipment the diver carries
There is a second dimension to electrical risk: the one the job itself introduces. Underwater lighting, cameras, powered tools and active heating systems are all powered equipment that goes into the water with the person.
The rules here are technical common sense: use only equipment designed and certified for submerged use, with the appropriate residual-current protection and up-to-date maintenance; check cables and connections before every use; and treat any damage to insulation as grounds for taking the equipment out of service immediately, not as something to keep an eye on.
When the job involves underwater welding or thermal cutting, controlling the current also involves specific connection, disconnection and surface-coordination procedures that are part of the training for those specialities.
A culture, not a form
Isolation works when everyone respects it even when it is inconvenient: when it delays the job, when the client is in a hurry, when it seems obvious that nothing is going to happen. That is exactly the moment it earns its keep.
Ultimate responsibility for the procedure existing and being followed rests with the organisation — with the superintendente who plans it, and the supervisor who directs the operation — but the diver has one tool they should never hesitate to use: not going into the water until they have seen the lock applied and verified. It is one of those calls nobody has ever regretted making.
Frequently asked questions
What does LOTO mean?
It stands for lockout-tagout. It means physically isolating an energy source, fitting a locking device that prevents it being switched back on and a tag identifying who locked it and why, then verifying afterwards that the equipment really cannot start. In Europe it is also known as isolation.
Why is it more critical in underwater work?
Because the diver cannot get out of the way. Faced with a pump starting up or a gate opening, someone on land steps back; a diver is tied to an umbilical, with reduced visibility and often inside the structure affected. On top of that, the suction generated by a flow can trap a person with a force you cannot swim against.
Is it enough for the plant operator to say it is stopped?
No. A piece of equipment being stopped does not mean it cannot start: it can, through an automatic control, a remote start, or because someone did not know there were people in the water. The procedure requires physical isolation, a padlock, a tag and verification, and it requires the diving team to take part in the check and keep control of the lock.
What energy sources need considering besides electrical?
All the ones capable of producing movement or releasing force: hydraulic and pneumatic, fluid pressure, gravity and suspended loads, energy stored in springs or accumulators, and differences in water level able to generate a flow when a gate opens. In underwater work, the hydraulic energy of a level difference is just as dangerous as electrical energy.
Who removes the lock when the job is finished?
Only whoever applied it, and only after confirming that all personnel are out of the water and clear of the hazard area. Removing someone else's lock is one of the most serious violations of this procedure. When several teams are involved, multiple-lock systems are used so the energy cannot be restored until everyone has removed their own.
Published 8 September 2026 · By Arthur More, professional saturation diver
Photo: oskay · CC BY via Openverse