Lockout/tagout (LOTO) is the most critical safety procedure in industrial maintenance. OSHA 29 CFR 1910.147 requires employers to establish an energy control program that prevents the unexpected startup or release of stored energy during servicing and maintenance of machines and equipment. The standard is not optional and it is not vague: it requires written procedures for each machine, annual inspections, employee training, and specific hardware (locks, tags, hasps, and energy-isolating devices).
Despite the clarity of the standard, LOTO violations consistently rank among OSHA's top 10 most-cited standards. The most common failures are incomplete energy source identification, inadequate written procedures, failure to perform annual periodic inspections, and unauthorized removal of locks. Each of these failures represents a scenario where a worker could be injured or killed by unexpected energy release. This guide covers the key elements of a compliant LOTO program and the quality checks that prevent gaps.
Energy Source Identification: The Foundation
Every lockout procedure starts with identifying all energy sources that could cause harm. OSHA defines hazardous energy as electrical, mechanical, hydraulic, pneumatic, chemical, thermal, gravitational, and any other energy that could injure workers. The critical word is "all." Missing a single energy source — a gravity-loaded counterweight, a compressed spring, a capacitor bank, residual pressure in a pneumatic line — negates the entire procedure.
The energy source survey should be conducted by someone who understands the machine's design and operation. Walk through every system: electrical supply (including control circuits and battery backups), hydraulic cylinders and accumulators, pneumatic lines and reservoirs, steam and hot water connections, compressed springs and counterweights, chemical feed lines, and thermal energy in heated vessels. Document each source, its magnitude, and the specific isolation point (disconnect, valve, block, bleeder).
Stored energy is where most surveys fail. Shutting off the electrical supply does not zero the energy in a hydraulic accumulator, a pressurized air receiver, a heated oven, or a suspended load. Each stored energy source requires a specific dissipation step: bleed the hydraulic accumulator to zero pressure, drain the air receiver, allow the oven to cool below the burn threshold, lower the suspended load to a resting position or mechanically block it. The written procedure must list each stored energy source and the method to verify zero energy state.
Complex machines with multiple energy sources benefit from an energy source map: a diagram showing every isolation point, numbered to match the lockout sequence. The map should be laminated and posted at the machine. For machines with 10 or more energy isolation points, the map is not just helpful — it is necessary to ensure no point is missed under time pressure or shift changes.
Electrical (line power, control circuits, capacitors, batteries)
Mechanical (springs, flywheels, counterweights, gravity)
Hydraulic (cylinders, accumulators, pressurized lines)
Pneumatic (air receivers, pressurized lines, air motors)
Thermal (steam, hot water, heated surfaces)
Chemical (process lines, feed systems, stored chemicals)
Lockout/Tagout Permit Manager
Create OSHA-compliant LOTO permits for equipment energy isolation. Track electrical, pneumatic, hydraulic, and thermal energy sources with lock assignments and zero-energy verification.
Written Procedures: What OSHA Requires
OSHA 1910.147(c)(4) requires documented procedures for each machine or piece of equipment that has lockout capability, unless the machine has no stored energy, has a single energy source that can be readily identified and isolated, is completely de-energized by a single lockout device, and the lockout device is under the exclusive control of the authorized employee. If any of these conditions is not met, a written procedure is required. In practice, this means nearly every machine in an industrial facility needs a written LOTO procedure.
Each written procedure must include: a clear statement of the intended use of the procedure, the specific steps for shutting down the machine, the specific steps for isolating the machine from each energy source, the specific steps for applying lockout/tagout devices, the specific steps for verifying zero energy state (try-start or test), and the specific steps for restoring the machine to normal operation. The procedure must be specific to the machine, not a generic template.
The verification step (try-start) is the most commonly skipped and one of the most important. After all energy sources are isolated and all locks are applied, the authorized employee must attempt to start the machine using the normal operating controls. If the machine does not start, the energy isolation is verified. If it does start, the lockout is incomplete and must be corrected before any work begins. The try-start must be done after returning all operating controls to the off or neutral position.
Procedures must be reviewed and updated whenever the machine is modified, energy sources are added or changed, or a periodic inspection reveals a deficiency. A procedure written in 2015 for a machine that has since had a hydraulic system added is incomplete and non-compliant. Assign responsibility for procedure review to a specific person (typically the maintenance supervisor or safety manager) with a defined review schedule.
Group Lockout and Complex Operations
Group lockout applies when multiple authorized employees work on the same machine simultaneously. OSHA 1910.147(f)(3) requires that each authorized employee apply a personal lockout device to the group lockout device, group lockbox, or group lockout hasp. The fundamental principle: each worker controls their own lock. No worker removes another worker's lock. The last lock comes off only when the last worker has completed their task and verified the work area is clear.
The group lockout coordinator (primary authorized employee) is responsible for ensuring that all energy sources are properly isolated before anyone applies their personal lock to the group lockout point. The coordinator applies the first lock and verifies zero energy state. Other authorized employees then apply their personal locks. The coordinator ensures continuity of protection during shift changes by verifying that oncoming shift personnel apply their locks before outgoing personnel remove theirs.
Contractor lockout adds another layer of complexity. When outside contractors perform servicing on employer-owned equipment, OSHA requires the employer and contractor to inform each other of their respective LOTO procedures, and each must ensure that their employees comply. In practice, this means a pre-job meeting where the contractor's authorized employees are briefed on the specific machine's energy sources, isolation points, and the lockout sequence. The contractor's employees apply their own locks alongside the facility's locks.
Large-scale shutdowns (annual turnarounds, outages) may involve dozens of machines and hundreds of workers. These operations require a centralized lockout coordination system: a lockout board or permit system that tracks every active lockout, the authorized employee responsible, and the current status. Paper-based systems work but are error-prone at scale. Many facilities use electronic lockout management systems that provide real-time tracking and prevent lock removal without proper authorization.
1. Coordinator isolates energy and verifies zero state
2. Each worker applies their OWN personal lock
3. No worker removes another worker's lock
4. Shift changes: incoming locks on BEFORE outgoing locks off
5. Last lock off only after final area clearance
Periodic Inspection Requirements
OSHA 1910.147(c)(6) requires an annual periodic inspection of the energy control procedure for each machine. The inspection must be performed by an authorized employee other than the one using the procedure. The purpose is to verify that the written procedure is still accurate, that authorized employees understand the procedure, and that the procedure is being followed correctly in practice.
The periodic inspection must include: a review of each employee's responsibilities under the procedure, a review of the specific procedure steps (ideally by observing the employee performing the lockout), and correction of any deviations or inadequacies identified during the review. The employer must certify that the inspection was performed by documenting the machine or equipment, the date, the employees included, and the inspector's identity.
The most common periodic inspection failure is treating it as a paperwork exercise. The inspector reviews the written procedure at a desk, signs the certification form, and files it. This catches errors in the documentation but misses errors in practice: an employee who skips the try-start, an employee who does not know about a recently added pneumatic cylinder, or an employee who uses a lock without a unique key. The inspection must include observation of the actual lockout being performed, with immediate correction of any deficiency.
Track inspection findings in a database or spreadsheet. Common findings that indicate systemic problems include: employees not performing try-start verification (most common), written procedures that do not match the current machine configuration, employees not applying personal locks during group lockout (using only the group lock), and locks that are not uniquely keyed (master-keyed or shared locks). Each finding requires corrective action, retraining, or procedure revision.