Lockout Tagout (LOTO): Definition

What Is Lockout Tagout?

Maintenance work on machinery carries specific, well-understood risks when equipment can be energized. A pump that starts unexpectedly while a technician is clearing a blockage. A hydraulic press that cycles while a worker's hands are inside the die space. A capacitor that discharges after the circuit breaker has been opened. A spring-loaded mechanism that releases when a retaining pin is removed. These are not hypothetical scenarios; they are the categories of incidents that LOTO is specifically designed to prevent, and they continue to occur in facilities where LOTO programs are absent, inadequate, or inconsistently followed.

The core principle of LOTO is straightforward: every energy source that could harm a worker must be physically isolated and confirmed de-energized before anyone enters the hazard zone, and must remain isolated until all workers are clear and all tools and materials have been removed. The procedure is enforced by hardware, not by human memory or verbal agreement. A locked isolation device cannot be restored by a second person, cannot be accidentally activated, and cannot be bypassed by a supervisor under production pressure unless the specific override procedure in the written program is followed.

LOTO applies whenever maintenance, servicing, or repair tasks require employees to remove machine guards, bypass safety devices, place any part of their body in a zone where unexpected equipment motion could cause injury, or work in contact with systems that contain hazardous energy. The scope is broader than most facilities initially assume: it includes clearing jams, adjusting tooling, replacing wear parts, and performing inspections that require opening access panels on energized systems.

Energy Types Covered by LOTO

A complete LOTO procedure must address every energy source associated with the equipment, not just the electrical supply. Complex machines often have multiple energy sources, and missing any one creates an uncontrolled hazard:

The Six Steps of a LOTO Procedure

Step 1: Prepare

Before any work begins, the authorized employee reviews the equipment-specific LOTO procedure for the machine. The procedure identifies all energy sources, all isolation points, the correct isolation devices, and the sequence for isolating them. For complex equipment with multiple energy types, preparation also includes gathering all required lockout hardware: the correct locks, hasps, tags, valve lockout devices, and any specific blanks or blocks required. Preparation prevents the most dangerous omission in LOTO practice: failing to identify and isolate a secondary energy source because it was not anticipated before work began.

Step 2: Notify

All affected employees, those who operate or work around the equipment in normal production, must be informed that a LOTO procedure is in effect and that the equipment will be taken out of service. This prevents an operator from attempting to start the machine during the maintenance window and ensures that production scheduling accounts for the downtime. Notification must be given before shutdown, not after.

Step 3: Shut down

The equipment is stopped using its normal operating procedure. LOTO isolation follows shutdown; it does not replace it. Running equipment is never directly isolated from energy while in motion: the machine must be brought to a controlled stop through its normal stopping sequence first. For equipment with long deceleration times (flywheels, large fans), the worker must wait until the machine has come to a complete stop before proceeding to isolation.

Step 4: Isolate

Every energy-isolating device identified in the equipment-specific procedure is moved to its de-energized, closed, or safe position. Circuit breakers are opened. Disconnect switches are pulled. Valves are closed. For each energy type, the isolation device must physically interrupt the energy flow pathway, not merely stop the equipment. A stop button or control switch does not constitute energy isolation: energy must be isolated at a point where it physically cannot reach the equipment.

Step 5: Lock and tag

Each authorized employee performing work on the equipment applies their own personal padlock to every energy isolation point, along with a warning tag identifying the worker and prohibiting operation. If multiple employees are working simultaneously, each applies their own lock. The equipment cannot be re-energized as long as any single lock remains in place. A lock must never be applied by one person and removed by another; the padlock is personal to the employee who attached it. If a lockout device cannot physically accommodate a padlock, a tagout device is applied and documented additional compensating measures are implemented.

Step 6: Verify de-energization

Before any work begins, the authorized employee performs a positive test to confirm that all energy has been removed and all stored energy has been released or restrained. For electrical systems, a voltage meter is used to verify zero voltage at every point that could be contacted. For hydraulic systems, a pressure gauge confirms zero pressure. For pneumatic systems, air is bled and zero pressure is confirmed. For mechanical stored energy, blocking devices are in place and verified. Verification is not optional and cannot be replaced by confidence that the procedure was followed correctly. It is the final, physical confirmation that the isolation is effective before anyone enters the hazard zone.

Release from LOTO

The release procedure is the reverse of lockout and is equally controlled. Before locks are removed: all tools, test equipment, and materials are cleared from the work area; all workers are accounted for and confirmed to be out of the hazard zone; any machine guards or covers removed during work are replaced; and affected employees are notified that LOTO will be lifted. Only then does each authorized employee remove their own lock from each isolation point. Re-energization follows the normal equipment startup sequence.

A critical rule: only the employee who applied a lock may remove it. If an employee leaves the facility with their lock still in place, a documented override procedure must be followed, typically involving verification that the employee is not present in the hazard zone and supervisor-level authorization before the lock is cut. This rule exists because removing another person's lock is one of the most dangerous actions possible in a LOTO program.

Lockout vs. Tagout: When Each Applies

OSHA's clear preference is lockout, and the standard requires lockout whenever the energy-isolating device can accommodate a lock. Tagout alone is permitted only when the energy-isolating device is not capable of being locked out, a situation that should become increasingly rare in modern facilities that specify lockable isolation devices at design. When tagout is used in place of lockout, OSHA requires that the employer document the specific reason why lockout is not feasible and implement additional compensating measures to achieve equivalent protection. These measures may include removing an isolating circuit element, blocking a controlling switch, opening an extra circuit or fitting, or removing a valve handle.

A tag alone provides zero mechanical protection. A tag can be removed, ignored, or overlooked. It communicates but does not prevent. The OSHA standard acknowledges this: tagout programs "provide employees a level of protection less than that provided by the lockout program" and must be supplemented accordingly.

Group Lockout and the Lockbox System

When multiple workers are servicing the same equipment simultaneously, individual lockout at each isolation point becomes impractical as the number of workers grows. Two systems address this.

Group hasp: A hasp is a device with multiple holes, applied to a single isolation point. Each authorized employee clips their individual lock to the hasp. The hasp cannot be removed until all individual locks have been removed, preventing any single worker from restoring energy while others are still present. This approach works well when two to five workers are involved.

Lockbox: For larger maintenance events involving many workers across multiple isolation points, a primary authorized employee applies one lock to each isolation point and places all keys in a lockbox. Each worker then applies their individual lock to the lockbox, not to the isolation points directly. The isolation points remain secured by the primary locks until the lockbox is opened, which requires all individual workers to remove their locks first. This approach scales to any number of workers without multiplying hardware at each isolation point.

LOTO Exceptions: Minor Servicing and Cord-and-Plug Equipment

OSHA 29 CFR 1910.147 includes two narrow exceptions that are frequently misunderstood and sometimes improperly applied to justify bypassing LOTO.

Minor servicing exception: Routine, repetitive, integral work performed during normal production operations is exempt if it is performed with alternative effective protection (such as machine guards that provide equivalent protection and are designed for this purpose), the work is minor in scope, and it does not expose the employee to the unexpected energization of the machine. Clearing a jam by using a tool while standing outside the machine's hazard zone with guards in place may qualify. Reaching inside a machine to clear a jam with guards removed does not. This exception is specific, narrow, and does not permit employees to bypass LOTO for any maintenance task that exposes them to moving parts or stored energy.

Cord-and-plug exception: Cord-and-plug connected equipment is exempt if unplugging the cord is the only means required to de-energize the equipment, the plug remains under the exclusive control of the authorized employee (kept in their possession, not accessible to others), and there is no stored energy. If the cord could be plugged back in by another person, or if the equipment has capacitors, pressurized components, or other stored energy, full LOTO applies.

Common LOTO Failures and Their Consequences

Most LOTO-related injuries share a small number of root causes, and understanding them is essential for any facility that takes LOTO seriously:

• Failure to isolate all energy sources: A technician de-energizes the main electrical circuit but fails to depressurize a hydraulic accumulator. When a fitting is opened, pressurized fluid releases and causes injury. Equipment-specific procedures that explicitly list every energy source are the primary defense against this failure.
• Skipping verification: An employee isolates the circuit breaker and assumes de-energization is complete without testing. A second feeder circuit that was not identified in the procedure maintains voltage at the work point. Verification with a meter is not optional and must occur at the actual work location, not just at the isolation device.
• Removing another employee's lock: Under production pressure, a supervisor removes a technician's lock to restart equipment, unaware that the technician has returned to the work area. This is both a legal violation and a potentially fatal action. Locks are personal; no exception justifies removal by another person outside of the documented override procedure.
• Informal "quick task" bypassing: "It only takes a minute" is the most common rationalization for skipping LOTO, and it is present in the incident report of nearly every serious LOTO-related injury. The duration of the task does not change the severity of the energy hazard. LOTO applies to any task that exposes a worker to a hazardous energy source, regardless of how brief the exposure might be.

LOTO Program Requirements Under OSHA 29 CFR 1910.147

OSHA's hazardous energy control standard requires employers to develop and maintain a written energy control program covering:

• Written equipment-specific procedures for every machine or equipment where employees may be exposed to hazardous energy during maintenance. Generic LOTO procedures that cover a machine type rather than a specific machine are only acceptable when the employer can demonstrate that the equipment is similar in type, has the same magnitude and type of energy, and has identical isolation points.
• Training for all authorized employees (those who perform LOTO) and affected employees (those who work near locked-out equipment). Authorized employee training must cover recognition of hazardous energy sources, the type and magnitude of energy, and the methods and means required for energy isolation and control. Retraining is required whenever there is reason to believe a worker does not have the required knowledge or skills.
• Annual inspection of each energy control procedure, conducted by an authorized employee other than the one using the procedure, to verify that the procedure remains adequate and that employees understand and follow it correctly. The inspection must be certified in writing with the date, machine or equipment covered, employee names, and the inspector's identity.

Effective maintenance procedures, including equipment-specific LOTO procedures, can be stored and linked to assets in a CMMS, where they appear automatically on work orders requiring LOTO. This ensures technicians have the correct, current procedure at the point of work, not a generic printout from a shared folder.

LOTO and Planned Maintenance

LOTO is most visibly associated with emergency corrective maintenance because unplanned repairs are more likely to be performed under time pressure, which is when procedural shortcuts are most tempting. But LOTO is equally required for preventive maintenance tasks that access hazard zones, and planned maintenance actually creates better conditions for LOTO compliance: procedures can be reviewed in advance, hardware can be staged, and the task can be scheduled without the pressure of a production stoppage already in progress.

LOTO compliance is a workplace safety responsibility that sits squarely with the maintenance manager. Incidents caused by LOTO failure are among the most legally and ethically serious in industrial workplaces. A rigorous standard operating procedure for each piece of equipment, supported by training, hardware availability, and consistent enforcement, is not optional overhead: it is the minimum operating standard for any facility where people perform maintenance on energized equipment.

Frequently Asked Questions

The Bottom Line

Lockout tagout is enforced by hardware, not by habit. The value of LOTO is precisely that it removes human judgment and production pressure from the question of whether a machine is safe to work on. If the lock is in place and the key is in the technician's pocket, the machine cannot be started, regardless of what anyone else in the facility decides to do. That mechanical guarantee is what makes LOTO effective where verbal instructions, trust, and good intentions consistently fail.

An effective LOTO program requires equipment-specific written procedures for every machine in scope, trained and competent authorized employees, annual procedure inspections, hardware available at or near each machine, and consistent enforcement that treats every LOTO bypass as a serious safety event. When LOTO is integrated into the maintenance inspection process and built into the work order workflow, it becomes part of how maintenance work is done rather than an additional step that gets skipped when time is short.