CONTROWARE ELOTO
Notifications
Lockout Jobs
Overview
Where every lock sits, right now.
Every isolation point on this site, grouped by area. Colour is derived from the live DCS reading and each point's own verification and lock records — nothing here is tracked separately.
Plant floor
Isolation points
Equipment Lockout History
Team Performance
Program Health
How the score is builthover a component · click to open
Each part of the score
Biggest losses first · click one to see the records behind itProcedure gap check — against the written-procedure standard
Required elements follow 1910.147(c)(4)(ii) plus document control and periodic inspection; recommended ones are what the leading tools add. Completeness weights required checks double.
Corrective Actions
Only a site admin can manage the team, permissions, and the audit log.
Plant Data
The plant, its areas, and every machine that can be locked out. Set up once; everything else in ELOTO is built on it.
Uploads
Every upload is kept — never overwrittenPlant
The name shown on printed tags and permits.
Areas / units
Group equipment by plant area. The area's maintenance owner receives inspection findings for any equipment here that has no owner of its own.
Equipment & isolation points
Every machine that can be locked out and its electrical isolation points, as the plant sheet gives them. Each machine's seven-step procedure and every job are built from this.
Drawings
CAD layout and single-line diagram — the 3D twin and the SLD view are built from these.
Version history
Every upload is kept — never overwrittenLockout Procedures
One procedure for the whole site — the seven electrical isolation steps and the seven restore steps. Each machine adds only its one isolation point from the plant sheet. Read-only here: the placard print and the version history.
When on, a test run waits for an authorizer (not the person who requested it) before any lock comes off. Off by default — OSHA does not require it.
Photo check (step 5)
The office AI checks the step 5 photo before it is recorded.
Team & Permissions
Create accounts, assign roles, link each worker's personal lock tag, delegate permissions, disable access, or reset a password. A generated password is shown once — relay it to the person directly.
| Name | Role | Status | Contractor & certificates | Lock NFC Tag | Delegated permissions |
|---|
Audit Log
| Action | Actor | Detail | When |
|---|
NFC Scan Log
| Tag | Resolved As | Action | Result | Message | By | When |
|---|
Skills Matrix
Rate each person's level per competency. A skill tied to an energy type is a real gate: nobody can isolate or verify a point of that type without holding it.
| Person |
|---|
LOTO Training
OSHA 1910.147(c)(7)(iv) requires a certification carrying each employee's name and the dates of training. A record is the certified fact, so it is written once and never edited — a correction is a later record. The date of training is when it happened, not when it was typed in.
Who is trained
| Person | Trained as | Last trained | Expires | Retraining owed | Standing |
|---|
Record training
Retraining outstanding
1910.147(c)(7)(iii): a change of assignment, machine or process, a new hazard, or a periodic inspection that found a deviation. A failed inspection raises these on its own.
| Person | Reason | Due | Detail |
|---|
Training records
| Person | Trained as | Type | Date of training | Expires | Delivered by | Covering |
|---|
Periodic Inspections & Audits
OSHA 1910.147(c)(6): every procedure is inspected at least annually by someone other than the people who use it, watching an authorized employee perform it. Employee audits check what people know. Any "not OK" answer raises a corrective action.
Inspection queue
| Procedure | Equipment | Last inspected | Next due |
|---|
Periodic inspection
You inspect as an authorized employee other than the ones using this procedure (1910.147(c)(6)(i)(A)): not one of the employees observed or reviewed, and not working a job on this machine right now. Having used it before is fine.
1910.147(c)(6)(ii) certifies the employees included in the inspection, and (c)(6)(i)(C) wants each one's responsibilities reviewed with the inspector. The observed employee is always included.
Employee knowledge audit
Recent inspections & audits
| Kind | Subject | Inspector | Result | Findings | When |
|---|
Question banks & interval
OPC / DCS Integration
Connect to the plant's DCS or SCADA over OPC UA. Once enabled, every isolation point with a DCS Node ID (Settings → Plant Data) is read live and shown on each job step — and a PASS zero-energy verification is refused while the DCS still reports the point energized.
Not encrypted and no certificate check — fine on one PC for testing; use Sign & Encrypt with a real DCS.
With write-back on, each isolation point's "write node" is set TRUE when the job reaches LOCKED and FALSE at restore, so the DCS can interlock a start on "locked out by ELOTO". Equipment with request/acknowledge nodes needs the controller's maintenance-mode acknowledgement before any isolation step is logged.
Certificates
Needed for Sign and Sign & Encrypt: ELOTO and the OPC UA server each trust the other's certificate. ELOTO never trusts a server automatically.
- Download ELOTO's certificate and give it to the DCS administrator to trust on the OPC UA server.
- Choose Sign & Encrypt and press Test connection. The server's certificate appears below as waiting for approval.
- Compare its thumbprint with the one the DCS administrator reads on the server. Only if they match, press Trust.
- Test connection again, then save.
| Status | Server certificate | Thumbprint (SHA-1) | Valid until |
|---|
Connectivity History
| Result | Source | Message | When |
|---|
Writes to the DCS
| Result | Purpose | Node | Value | Job | When |
|---|
ERP Integration
Link to the ERP's asset register (SAP PM, Oracle EAM, …). Once enabled, every equipment with an ERP Asset ID (Settings → Plant Data) has its register name and status read live and shown beside the local record — never overwriting it.
Connectivity History
| Result | Source | Message | When |
|---|
WhatsApp Notifications
Lockout notifications and the read-only WhatsApp assistant, through Meta's official WhatsApp Cloud API. ELOTO keeps no WhatsApp secret: it queues each message, and the WhatsApp connector on this site's PC sends it with the token held in that PC's Keychain. Meta's webhook goes to the Cloudflare gateway, never to this server.
Send a test message
Assistant connectors
The WhatsApp assistant runs on one PC here and reaches ELOTO from that machine only. Each connector gets its own credential, shown once. Revoke it if the PC is lost or replaced.
| Connector name | Created by | Last used | Status |
|---|
Activity
| Direction | Who | Message | Status | When |
|---|
Connected Padlocks
Smart padlocks report LOCKED / UNLOCKED, battery and tamper to ELOTO's webhook, and can accept a remote UNLOCK for an approved emergency removal. Each padlock is assigned to one person; when they apply a lock in ELOTO the record is bound to their padlock, confirmed when it reports LOCKED, and flagged as a MISMATCH if it opens while the lock is still applied. Vendor-neutral: brand adapters (Master Lock Vault Enterprise, eGeeTouch, Digital Keys, Smartlox) map onto this contract once the padlock model is chosen.
POST JSON {"serial","event":"LOCKED|UNLOCKED|HEARTBEAT|BATTERY|TAMPER","battery","firmware","at"}; sign the raw body with HMAC-SHA256 of the secret in X-Lock-Signature: sha256=<hex>.
Padlock registry
| Serial | Label | Assigned to | State | Battery | Last seen | Holding |
|---|
Padlock events
| Serial | Event | Detail | When |
|---|
Workflow & Roles
Set once when the plant starts: who does each part of a lockout job. The safety steps themselves are the same for every site.
Contractors
OSHA 1910.147(f)(2): before outside personnel work here, this site and their employer give each other their lockout/tagout procedures, and this site’s own employees are briefed on the restrictions of the contractor’s program. One exchange per engagement — while a company has no current one, its people cannot lock on, hold a permit or isolate.
Sites
Each site (plant) has its own equipment, procedures, jobs, team, and integrations. Create a site here — you become its first admin — then switch into it from the sidebar. Add people to another site from that site's Team & Permissions by entering their existing email.
| Site | Your role |
|---|