What is Lockout/Tagout (LOTO)? The Complete 6-Step Procedure

I was standing beside a packaging line in a food manufacturing plant when a maintenance technician reached into a conveyor roller assembly to clear a product jam. He hadn’t locked out the drive motor. He hadn’t even hit the emergency stop. Someone upstream restarted the line from a control panel thirty meters away. The rollers engaged and caught three of his fingers before the screaming brought people running. That technician lost two fingers permanently — and the entire incident, from jam to amputation, took less than four seconds. Four seconds that a single padlock would have prevented.

Lockout/Tagout — commonly called LOTO — is the systematic procedure for isolating machines and equipment from all energy sources before any maintenance, cleaning, servicing, or repair work begins. It exists because hazardous energy does not care about intentions, assumptions, or experience. Every year, failure to properly control hazardous energy causes approximately 120 fatalities and 50,000 injuries across US workplaces, according to OSHA enforcement data. This article breaks down what LOTO actually is, why it fails on real job sites, and walks through the complete 6-step procedure that every maintenance worker, operator, and supervisor must understand — not as theory, but as a non-negotiable survival protocol.

What Is Lockout/Tagout (LOTO) and Why Does It Matter?

Lockout/Tagout is a safety procedure that ensures dangerous machines and energy sources are properly shut down, isolated from all energy supplies, and rendered incapable of unexpected startup before any worker performs servicing or maintenance. LOTO uses physical lockout devices — padlocks, hasps, valve lockouts, circuit breaker locks — combined with warning tags to hold energy isolation points in a safe position. The procedure guarantees a verified zero energy state, meaning no stored, residual, or potential energy remains that could activate equipment or release hazardous forces.

The reason LOTO exists is blunt. Machines that appear “off” can kill without warning. The types of hazardous energy that LOTO controls go far beyond just electricity, and many maintenance workers have been injured or killed by energy sources they didn’t even consider present.

The following energy types must be identified and controlled during every LOTO application:

• Electrical energy: The most recognized hazard — motors, control circuits, capacitors, batteries, and energized busbars can deliver lethal shock or arc flash even when a machine appears de-energized.
• Mechanical energy: Rotating shafts, flywheels, spring-loaded mechanisms, gears, and belt drives can store kinetic energy that releases without warning when a guard is removed or a component shifts.
• Hydraulic energy: Pressurized fluid in cylinders, accumulators, and lines can cause sudden, violent movement of machine components — even after pumps are shut down.
• Pneumatic energy: Compressed air and gas systems retain pressure in lines, receivers, and actuators that can drive pistons, close valves, or propel debris at lethal velocity.
• Thermal energy: Hot surfaces, steam lines, molten materials, and cryogenic systems present burn and scalding hazards that persist long after a process stops.
• Chemical energy: Residual chemicals in pipelines, vessels, and reactors can react, combust, or release toxic fumes during maintenance if not properly drained, purged, and isolated.
• Gravitational energy: Elevated machine components, suspended loads, raised platforms, and counterweights can fall under gravity when restraints are released during servicing.

OSHA 29 CFR 1910.147 — The Control of Hazardous Energy requires employers to establish an energy control program with written, machine-specific LOTO procedures, employee training, and periodic inspections for all equipment where unexpected energization or release of stored energy could cause injury during servicing and maintenance.

Pro Tip: During a plant audit at a bottling facility in Central Europe, I found 14 machines that had identical generic LOTO procedures posted — the same template copied and pasted with only the machine name changed. Not one of those procedures identified the correct isolation points for its specific machine. OSHA requires machine-specific procedures. Generic templates are a compliance illusion — they look like paperwork got done, but they will not protect anyone when a hydraulic accumulator they failed to list dumps 3,000 PSI into a cylinder someone is working inside.

Who Needs LOTO Training? Authorized, Affected, and Other Employees

One of the most common breakdowns I encounter during audits is the failure to distinguish between the three categories of employees defined under OSHA’s LOTO standard. Companies train maintenance crews and assume the job is done. It is not. Every person who works near, operates, or could be affected by locked-out equipment needs role-appropriate training — and the responsibilities differ sharply.

The following three employee categories each carry specific LOTO responsibilities that must be clearly understood and documented:

• Authorized employees are the workers who actually perform the lockout. They physically attach their own lock and tag to energy isolation devices, verify zero energy state, and perform the servicing or maintenance work. Every authorized employee must apply their own individual lock — no exceptions, no shared locks, no supervisor applying a lock “on behalf of” a crew.
• Affected employees are operators or production workers whose jobs require them to use or work near machines that are being locked out. They must recognize when LOTO is applied, understand what it means, and know they are prohibited from attempting to restart or re-energize locked-out equipment under any circumstances.
• Other employees are workers in the general area who may encounter locked-out equipment but do not operate or service it. They need awareness-level training so they understand that locks and tags are not to be removed, bypassed, or ignored.

Employee Category	Who They Are	LOTO Responsibility	Training Level
Authorized	Maintenance technicians, electricians, millwrights	Apply personal lock and tag, perform isolation, verify zero energy, execute servicing	Full procedural training + annual retraining
Affected	Machine operators, production workers	Recognize LOTO application, do not re-energize	Awareness training on purpose and prohibitions
Other	Cleaning staff, visitors, adjacent workers	Do not touch locks, tags, or isolated equipment	Basic awareness of lock/tag meaning

Pro Tip: I once investigated an incident where a contract cleaner removed a lockout tag from an electrical panel because, in her words, “I thought someone forgot it there.” She had never received even basic LOTO awareness training. The electrician working inside the panel downstream survived only because the breaker had a lock that held — the tag alone would not have saved him. Train everyone. Not just your maintenance crews.

The 6-Step Lockout/Tagout Procedure — A Field Walkthrough

This is the core of every LOTO application. The six steps are sequential — each one depends on the one before it. Skipping, rushing, or reordering any step creates the exact gap through which fatal energy releases occur. I have walked through this procedure thousands of times across refineries, manufacturing plants, power stations, and chemical facilities. The steps are identical everywhere. The discipline to follow them correctly every single time is what separates safe sites from body counts.

Step 1: Preparation — Know What You’re Locking Out

Before touching any isolation device, the authorized employee must identify every type and magnitude of hazardous energy the machine uses, stores, or could release. This is the thinking step — and it is the one most often skipped by experienced technicians who assume they “already know this machine.”

Preparation requires gathering the following information before any physical action begins:

• Machine-specific LOTO procedure: Locate and review the written, equipment-specific procedure — not a generic template, not memory, not “what we did last time.”
• All energy sources: Identify every type of energy connected to the machine — electrical, mechanical, hydraulic, pneumatic, thermal, chemical, gravitational. Machines with multiple energy types require multiple isolation points.
• All isolation points: Determine the exact location of every energy isolation device — breakers, disconnects, valves, blinds, blocks. Complex equipment may have isolation points in different rooms, on different floors, or in separate utility corridors.
• Stored energy hazards: Identify where residual energy may remain after isolation — capacitors, springs, pressurized lines, elevated components, thermal mass.
• Personnel coordination: Identify all affected employees who must be notified before shutdown. On multi-craft jobs, determine how many authorized workers will apply locks and how group lockout will be managed.

I learned this lesson the hard way on an ammonia refrigeration system at a cold storage facility. The maintenance team locked out the compressor motor but missed the liquid receiver valve — ammonia under pressure in the line between the receiver and the evaporator. When they broke the flange, anhydrous ammonia vented directly into the mechanical room. Two workers went to hospital with chemical burns to the airways. The compressor was locked out perfectly. The preparation was not.

Step 2: Shutdown — Stop the Machine Using Normal Procedures

Once preparation is complete, the machine must be shut down using its normal operating shutdown procedure. This step belongs to the machine operator or the authorized employee — whoever is trained and authorized to perform a controlled shutdown of that specific equipment.

The shutdown must follow these principles without exception:

• Orderly shutdown only: Use the machine’s normal stop sequence — control panel, HMI, stop button, or whatever the standard operating procedure specifies. Never pull a disconnect or trip a breaker as the primary shutdown method while the machine is running under load, as this can damage equipment and create additional hazards.
• Notify all affected employees: Before initiating shutdown, inform every operator and affected worker in the area that the machine is being shut down for maintenance and will be locked out.
• Confirm the machine has stopped: Visually and audibly verify that all moving parts have come to a complete stop, all process cycles have completed, and the machine is in a safe resting state before proceeding to isolation.

Step 3: Isolation — Physically Disconnect All Energy Sources

After the machine is shut down, the authorized employee physically operates every energy isolation device to disconnect the machine from its energy sources. Isolation means a physical break — not a software command, not a control signal, not a “stop” button.

The difference between shutdown and isolation is the difference between asking a machine to stop and physically preventing it from starting. The following devices accomplish true energy isolation:

• Electrical disconnects and circuit breakers: Open and verify the disconnect is in the OFF position. For hardwired equipment, this may require pulling fuses or opening knife switches.
• Manual valves: Close and secure valves on hydraulic, pneumatic, steam, chemical, and fuel supply lines. Use only valves rated as energy isolation devices — control valves and solenoid valves are NOT acceptable isolation points because they can fail or be overridden.
• Line blinds and blanks: On high-hazard piping (toxic, flammable, high-pressure), install spectacle blinds or slip blinds to provide positive physical isolation beyond valve closure.
• Mechanical blocks and pins: Insert physical blocks, pins, or restraints to prevent movement of elevated components, spring-loaded mechanisms, or gravity-fall hazards.

Critical distinction: A “stop” button, an e-stop, a VFD drive disable, or a PLC software command is NOT energy isolation. These are control circuit functions — they tell the machine to stop, but they do not physically disconnect it from its energy supply. A software glitch, a relay failure, or a crossed wire can re-energize a machine that was only “stopped” but never isolated. I have personally witnessed this happen on a CNC machining center where a PLC fault restarted a spindle that had been “stopped” through the HMI. The operator had his hand inside the tool changer.

Step 4: Apply Lockout/Tagout Devices — Your Lock, Your Life

With all energy sources isolated, the authorized employee applies their personal padlock and tag to each energy isolation device. This is the step that gives the procedure its name — and the rules are absolute.

Every lock application must follow these non-negotiable requirements:

• One worker, one lock, one key: Each authorized employee applies their own individually keyed padlock. No two workers share the same lock or key. The worker who applies the lock is the only person authorized to remove it.
• Lock must hold the isolation device in the safe position: The padlock must physically prevent the energy isolation device from being moved to the “on” or “open” position. If the lock can be applied without actually preventing device operation, the lockout device is wrong — get the correct one.
• Tag must identify the worker, date, and purpose: Every lock is accompanied by a durable, standardized tag that identifies who applied it, when it was applied, the equipment being serviced, and contact information. Tags warn — locks protect. Both are required.
• Multi-person jobs require multi-lock hasps: When multiple authorized employees work on the same equipment, a lockout hasp allows each worker to apply their individual lock to the same isolation point. The device cannot be re-energized until every lock is removed by its owner.
• Lockout devices must be substantial enough to prevent removal without force: Cable locks, valve lockouts, breaker locks, plug locks, and gate valve covers must be durable, standardized, and designated exclusively for energy control. Do not use general-purpose padlocks, combination locks, or zip ties.

Pro Tip: On a pipeline maintenance project in the Gulf, I watched a supervisor try to apply one lock “for the whole crew” to save time. Six workers, one lock, one key hanging on the supervisor’s belt — while he walked to a different work area. I stopped the job. If that supervisor had been struck by a vehicle, had a medical emergency, or simply forgot he had the key, six workers inside a pipe rack would have had zero personal control over their own energy isolation. One worker, one lock. Always.

Step 5: Control Stored and Residual Energy

Even after all energy sources are isolated and locked out, hazardous energy can remain stored in the machine or connected systems. This is the step that catches experienced workers off guard — because they isolate correctly but forget that energy does not always leave when the supply is cut.

The following stored energy sources must be addressed before any work begins on the machine:

• Electrical capacitors: Discharge or ground capacitors in drives, power supplies, and control circuits. Capacitors can hold lethal voltage long after main power is disconnected.
• Hydraulic and pneumatic pressure: Bleed, vent, or drain pressurized lines, cylinders, and accumulators to zero pressure. Verify with a calibrated pressure gauge — do not rely on position indicators or operator memory.
• Springs and counterweights: Block, pin, or release spring-loaded mechanisms and counterweights to a safe resting position. Gravity does not respect lockout.
• Thermal energy: Allow hot surfaces, steam systems, or heated materials to cool to a safe temperature, or implement thermal barriers and warning controls. Document expected cool-down times in the machine-specific procedure.
• Elevated components: Lower suspended loads, raised dies, lifted platforms, and boom arms to their lowest safe position, or mechanically block them against gravity fall.
• Process residuals: Drain, purge, or flush piping and vessels containing hazardous chemicals, flammable liquids, or reactive materials. Verify atmosphere if confined space entry is involved.

I once audited a plastics injection molding operation where the maintenance team locked out the hydraulic pump motor flawlessly — textbook isolation. But the accumulator on the clamp circuit still held 2,200 PSI. When the technician loosened a fitting on the clamp cylinder, the stored hydraulic pressure drove the clamp forward with enough force to crush a car door. He was not in the pinch point by sheer luck. The energy was isolated at the source. It was not dissipated at the point of work.

Step 6: Verify Isolation — Prove Zero Energy State

This is the most critical step — and the most frequently skipped. Verification is the moment of truth. Everything before this step is preparation. This step proves it worked.

Verification must be performed in the following sequence without shortcuts:

• Attempt to start the machine: Return to the operator control station and attempt a normal start using the start button, switch, or HMI. The machine must not respond. If it starts, stop immediately — the isolation has failed and the entire procedure must be restarted from Step 1.
• Test with calibrated instruments: Use a voltage tester, multimeter, or proving unit to confirm zero voltage at the point of work — not just at the disconnect. For hydraulic and pneumatic systems, check pressure gauges at the work location. For thermal energy, verify temperature.
• Visually confirm physical isolation: Walk the isolation points and visually confirm every lock is in place, every valve is closed, every blind is installed, and every block or pin is secure.
• Return controls to neutral: After verification, return all start switches and controls to the OFF or neutral position to prevent confusion when locks are eventually removed.

OSHA 1910.147(d)(6): “Before starting work on machines or equipment that have been locked out or tagged out, the authorized employee shall verify that isolation and de-energization of the machine or equipment have been accomplished.” Verification is not optional. It is not a “best practice.” It is a regulatory requirement and the last line of defense before a worker puts their body in the line of fire.

LOTO Removal — Restoring Equipment to Service Safely

The procedure for removing lockout devices and restoring energy is just as critical as the application. Rushed re-energization has caused serious incidents — including fatalities where workers were still inside equipment when power was restored.

The following sequence must be completed in order before any lock is removed:

1. Inspect the work area: Confirm all tools, materials, parts, and cleaning supplies have been removed from inside and around the machine. Account for every item brought to the job.
2. Verify all guards and safety devices are reinstalled: Check that every machine guard, interlock, safety gate, and protective cover is back in its operating position and functioning correctly.
3. Account for all personnel: Physically confirm that every worker is clear of the machine, out of pinch points, away from moving parts, and in a safe location. A head count is mandatory — do not rely on visual scanning alone.
4. Notify all affected employees: Inform every operator and affected worker that locks are being removed and the machine is about to be re-energized.
5. Remove your own lock — and only your own: Each authorized employee removes only their personal lock and tag. No one else removes your lock. Period.
6. Re-energize in controlled sequence: Restore energy sources in the correct sequence per the machine-specific procedure. The first restart should be monitored by qualified personnel watching for abnormal sounds, vibrations, leaks, or faults.

LOTO Phase	Key Action	Critical Check
Preparation	Identify all energy sources	Machine-specific procedure reviewed
Shutdown	Normal operating stop	All moving parts confirmed stopped
Isolation	Physical energy disconnection	All isolation devices operated
Lock & Tag	Personal lock on each device	One worker, one lock, one key
Stored Energy	Dissipate/restrain residual energy	Pressure, voltage, position verified at zero
Verification	Try-start + instrument testing	Machine confirmed dead at work location
Removal	Personnel clear, locks removed by owners	Head count + controlled re-energization

Common LOTO Failures That Kill — What I’ve Seen Go Wrong

Every LOTO fatality I have investigated traces back to one of a handful of repeated failures. The procedure itself is not complicated. The discipline to follow it without exception — under production pressure, during night shifts, when “it’s a quick fix,” when the supervisor says “just get it done” — is where the system breaks down.

The following failures are the ones I encounter most frequently during incident investigations and compliance audits:

• “I’ll only be a minute” syndrome: The most lethal LOTO failure. A worker decides the job is too quick, too simple, or too routine to justify “going through the whole procedure.” Minor tasks — clearing jams, adjusting sensors, replacing belts — account for a disproportionate share of LOTO fatalities precisely because workers underestimate the risk on short-duration jobs.
• Failure to identify all energy sources: Complex machines often have multiple energy types and isolation points in different locations. Missing one — a secondary pneumatic supply, a gravity-loaded counterweight, a capacitor bank in a remote panel — negates every other step.
• Using the wrong isolation point: Control circuit devices (e-stops, VFD disables, PLC stops) are not energy isolation. I have found padlocks on e-stop buttons, on HMI touch screens, and on selector switches — none of which physically disconnect energy. A lock on a stop button is a false sense of security.
• Shared or supervisor-applied locks: One lock for multiple workers eliminates individual control. If the lock owner is incapacitated, unreachable, or removes the lock prematurely, every worker on the job loses protection simultaneously.
• Skipping verification: Workers isolate and lock out correctly, then assume the machine is dead without testing. Verification catches wiring errors, valve leaks, failed disconnects, and procedures that missed an energy source. Without it, the first test is the worker’s body.
• Tag-only systems where locks are feasible: Tags warn. Locks prevent. OSHA permits tagout-only when lockout is physically impossible — and imposes additional, stringent safeguards. Using tags alone when locks could be applied is both a regulatory violation and a death gamble.
• Lock removal by unauthorized personnel: Supervisors, shift leads, or other workers removing someone else’s lock — because the shift ended, the worker went home, or “we need to start production.” Every lock removal by someone other than its owner is a potential fatality.

OSHA’s most-cited LOTO violations consistently include: failure to develop machine-specific procedures, failure to train affected employees, failure to conduct periodic inspections, and failure to use lockout devices when tagout alone is insufficient. These are not edge cases — they are the norm in non-compliant facilities.

Group Lockout/Tagout — When Multiple Workers Service the Same Equipment

Complex maintenance tasks, shutdowns, and turnaround projects often require multiple authorized employees to work on the same equipment simultaneously. Group lockout adds coordination complexity — and if managed poorly, it creates gaps where individual workers lose control over their own safety.

Group lockout must follow these essential requirements to maintain individual protection within a team structure:

• Primary authorized employee: One designated individual is responsible for coordinating the group lockout — applying the primary lock to each energy isolation device, performing verification, and managing the group lockout box or hasp system. This person must be identified before work begins and must have the authority and competence to manage the procedure.
• Individual locks on a group lockbox or hasp: Each authorized worker applies their personal padlock to a group lockbox that secures the primary key, or to a multi-lock hasp at each isolation point. No worker begins until their lock is on. No worker’s lock is removed by anyone other than themselves.
• Shift transfer procedures: When a job extends across shifts, the outgoing crew must not remove their locks until the incoming crew has applied theirs. The window between “old shift off, new shift not yet on” is where fatalities occur. Overlap is mandatory.
• Contractor integration: On multi-employer sites, contractors must either participate in the host employer’s group lockout system or apply their own locks to the same isolation points. Never assume contractors are covered by “the client’s locks.”

During a major turnaround at a gas processing plant, I managed a group lockout involving 23 authorized workers across three contractors on a single compressor train. We used a centralized lockbox system with a master hasp — and every morning’s toolbox talk started with a head count and lock verification. On day four, one contractor’s worker had been reassigned to a different unit but his lock was still on the box. We tracked him down, confirmed he was no longer working on the compressor, and had him remove his lock in person. That lock could have been “cleaned up” by a supervisor. Instead, the system worked exactly as designed — because removing someone else’s lock was simply not an option.

Periodic Inspections — The Audit That Keeps LOTO Alive

Written procedures and initial training are not enough. OSHA requires periodic inspections of the energy control program at least annually to verify that procedures and employee understanding remain effective. In practice, I have found that periodic inspections are the most neglected element of LOTO compliance — companies write procedures, train once, and never audit again until an incident forces them to.

An effective LOTO periodic inspection must include the following elements to meet both regulatory and operational standards:

• Annual minimum frequency: Each machine-specific procedure must be inspected at least once per year. High-risk or frequently serviced equipment should be inspected more often.
• Conducted by a qualified person: The inspector must be an authorized employee other than the one(s) using the procedure being inspected. Fresh eyes catch procedural drift that routine makes invisible.
• Direct observation of procedure application: The inspection must include watching authorized employees actually perform the LOTO procedure — not just reviewing paperwork or asking interview questions. Document what was observed, what was correct, and what deviated from the written procedure.
• Review of employee understanding: The inspector must verify through observation and discussion that authorized and affected employees understand their roles, responsibilities, and the specific energy sources and isolation points for the equipment.
• Certification documentation: Each inspection must be documented with the machine or equipment identified, the date, the employees included, and the inspector’s identity. This certification record must be maintained and available for regulatory review.

Pro Tip: During periodic inspections at a pharmaceutical manufacturing site, I discovered that six out of eight machine-specific procedures had never been updated since the original equipment installation — despite three major machine modifications over five years. Pneumatic lines had been added, electrical panels relocated, and interlocks reconfigured. The written procedures no longer matched the physical machines. Workers were following muscle memory, not the documented procedure. Annual inspections are your mechanism to catch this drift before it kills someone.

Conclusion

Lockout/Tagout is not a bureaucratic exercise. It is not a training module to check off and forget. It is the single procedure that stands between a worker’s body and the full force of uncontrolled energy — electrical, mechanical, hydraulic, pneumatic, chemical, thermal, gravitational. The six steps exist because every shortcut, every assumption, and every “quick fix” that bypasses even one of them has a body count behind it. Preparation, shutdown, isolation, lock and tag application, stored energy control, and verification — these steps are sequential, mandatory, and non-negotiable. Every time.

The failures I have investigated over a decade share one common thread: someone decided the procedure did not apply to them in that moment. The job was too quick. The machine was “obviously off.” The shift was almost over. Production pressure overrode safety discipline. Every one of those rationalizations ended in injury, amputation, or death. LOTO works perfectly when it is followed completely. It fails catastrophically when even one step is skipped — because hazardous energy does not negotiate, does not forgive, and does not wait.

If you are a supervisor, your job is to make lockout/tagout non-optional — not through posters and slogans, but through enforced procedure, proper equipment, adequate training, and the moral courage to stop production when LOTO is not applied correctly. If you are a worker, your lock is not a piece of hardware. It is the only physical guarantee that you will go home with the same body you arrived with. Apply it. Verify it. Never let anyone remove it for you.