A Lockout Tagout (LOTO) procedure is a mandated safety protocol designed to prevent the unexpected energization or startup of machinery and equipment during service or maintenance. When executed correctly, it creates a controlled “zero energy state” that functions as the single physical barrier between a maintenance worker and catastrophic injury or fatality. The procedure relies on a sequential framework of six non-negotiable steps: Preparation, Shutdown, Isolation, Lockout/Tagout Application, Stored Energy Release, and Verification. While the steps themselves are logical, the failure point is almost always found in the human assumptions made between those steps. This guide details the exact execution of each phase, addresses the most common compliance gaps found in industrial and commercial facilities, and provides a technical framework for establishing a fail-safe energy control program.
Table of Contents
What Constitutes a Complete Six-Step Lockout Tagout Procedure
A complete Lockout Tagout procedure, as defined by OSHA standard 29 CFR 1910.147 and reinforced by industry consensus standard ANSI/ASSP Z244.1, comprises six distinct and sequential actions. The process is designed not merely to turn equipment off, but to physically prevent the transmission or release of hazardous energy while work is being performed.
The six core steps are: 1. Preparation and Notification, 2. Controlled Equipment Shutdown, 3. Physical Energy Isolation, 4. Application of Lockout and Tagout Devices, 5. Release and Control of Stored Energy, and 6. Verification of Isolation. Deviation from this sequence, or the omission of a single step—particularly verification of isolation—renders the entire safety protocol ineffective and places workers in immediate danger of electrocution, crushing, amputation, or fatal fluid injection injuries.
Step 1: Preparation and Employee Notification
The first step is the most intellectually intensive phase of the procedure. It requires the authorized employee to conduct a comprehensive survey of the specific equipment to be serviced. This is not a review of the general area; it is a specific, task-based hazard analysis.
Identifying All Energy Sources and Magnitudes
Preparation begins with obtaining the machine-specific energy control procedure. If a written procedure does not exist for the specific piece of equipment, the authorized employee must develop one in real-time based on schematics and physical tracing. The survey must identify the type and magnitude of hazardous energy, which includes:
Electrical: Primary line voltage, secondary control circuits (often 120VAC or 24VDC fed from a separate panel), and stored capacitive energy in Variable Frequency Drives (VFDs) or servo amplifiers.
Hydraulic: System pressure in accumulators and lines, often exceeding 3,000 PSI.
Pneumatic: Compressed air in receivers, supply lines, and return springs.
Mechanical: Kinetic energy of flywheels or rotating blades, and potential energy from suspended loads, die sets in the raised position, or tensioned springs and counterweights.
Thermal: Hot surfaces, steam lines, or cryogenic materials that can cause burns upon contact even if the flow is stopped.
Chemical: Process fluids or gases within piping that are corrosive or toxic.
Notification of Affected and Other Employees
Before any switch is thrown, all affected employees—those who operate the equipment or work in the immediate area—must be notified of the impending shutdown. This notification must be clear and understood, detailing the expected duration of the outage and the specific equipment being taken offline. This step prevents a scenario where an operator, unaware of maintenance downstream, attempts a restart to troubleshoot a perceived malfunction.
Step 2: Controlled Equipment Shutdown
Shutdown is distinct from isolation. This step utilizes the equipment’s normal operating controls to bring the machinery to a complete stop in a manner that mitigates secondary hazards.
Sequence vs. Emergency Stop
While the instinct may be to hit the large red Emergency Stop (E-Stop) button, this is often a violation of proper LOTO procedure. The E-Stop is a safety device designed for imminent danger, not routine maintenance isolation. A controlled shutdown using the standard “Stop” or “Off” button ensures the machine cycles down without creating a process hazard. An abrupt E-Stop on a robotic cell or conveyor line can trap product in a pinch point, leave a robotic arm in an extended position storing potential energy, or interrupt a cooling cycle leading to thermal damage.
Transitioning to Zero Mechanical State
The shutdown phase concludes when all moving parts have reached a complete rest position. The authorized employee must ensure the operator interface displays a “Stopped” or “Ready” state before proceeding to the physical disconnection of energy sources.
Step 3: Physical Isolation from Energy Sources
Isolation is the physical act of disconnecting the equipment from its energy supply. This is the single most critical physical action in the entire procedure. It requires the operation of an energy-isolating device—a mechanical apparatus that physically prevents the transmission or release of energy.
Types of Acceptable Isolation Devices
Acceptable isolation methods include:
Manually operated electrical disconnect switches (not merely motor start/stop buttons).
Line valves with locking capability (ball valves, gate valves, or butterfly valves).
Removal of a circuit fuse block (spacer sled).
Blind flanges or line blanks for piping systems (for major service or confined space entry).
The Danger of Unlabeled or Misidentified Disconnects
A significant gap in many facility safety programs is the reliance on memory or outdated panel schedules. In older industrial facilities or renovated commercial spaces, multiple disconnect switches are often ganged together in a single enclosure with no external labeling. Isolating the wrong disconnect while working on a live machine is a well-documented precursor to arc flash events and electrocution.
Table 1: Hazardous Energy Types and Corresponding Isolation Methods
| Energy Type | Common Source | Required Isolation Method | Common Failure Mode |
|---|---|---|---|
| Electrical (Primary) | Main Feeder, Bus Plug | Open and Lock Disconnect Switch; Remove Fuses | Failure to test for absence of voltage; Control power still live. |
| Electrical (Stored) | Capacitors, VFD DC Bus | Wait for bleed-down per mfr spec; Use voltage-rated grounding stick | Rushing the verification; DC bus voltage >50V remains lethal. |
| Hydraulic Pressure | Accumulators, Cylinders | Close and Lock Isolation Valve; Bleed valve to tank | Assuming the valve sealed; Slow leak repressurizes line. |
| Pneumatic Pressure | Air Receiver, Supply Line | Close and Lock Ball Valve; Vent downstream pressure | Disconnecting coupler under load (hose whip). |
| Mechanical Potential | Raised Die, Tension Spring | Install mechanical blocks, pins, or safety props | Gravity; Block failure due to undersized or homemade wedges. |
| Gravity/Fluid Flow | Process Pipes, Chutes | Close Valve; Install Blind Flange (Line Break) | Incomplete drain; Residual liquid or granular material release. |
Step 4: Application of Lockout and Tagout Devices
This step moves the procedure from a controlled state to a restrained state. The authorized employee affixes a personal lock and an identifying tag to each energy-isolating device identified in Step 3.
The Principle of One Employee, One Lock, One Key
The lock used must be uniquely keyed—different from all other locks in the facility or on the individual’s keyring. The key must remain in the exclusive possession and control of the authorized employee performing the work. The use of combination locks, shared locks, or master-keyed locks for LOTO applications is strictly prohibited by OSHA compliance standards as it breaks the chain of individual accountability.
Tag Specifications and Required Information
The tag is a communication device, not a barrier. It must be constructed of non-conductive, non-tear material suitable for the environment (e.g., polyester for washdown areas, heavy-duty plastic for oily machine shops). The tag must be filled out legibly and contain, at minimum:
Name of Authorized Employee.
Date of Lockout.
Department or Contact Information.
Reason for Lockout (e.g., “Servicing Conveyor Belt #4”).
Note: A tag without a lock provides zero physical protection and constitutes a “Tagout-Only” scenario, which is only permissible under extremely rare and specific conditions where the equipment is not capable of being locked.
Step 5: Release and Control of Stored Energy
This is the “invisible” step where most residual risk resides. Even with the main power disconnect locked open, energy may remain trapped within the system components. This step requires the authorized employee to physically manipulate the equipment to render it inert.
Verifying Zero Mechanical Potential
Springs: Tensioned springs in brakes or counterbalance mechanisms must be physically blocked in the expanded/relaxed position or the tension must be released via adjustment screws.
Gravity: Raised components (rams, platens, overhead doors) must be lowered to a rest position or secured with a rated mechanical safety prop or block. Never rely solely on hydraulic check valves to hold a load.
Flywheels: Large rotating masses must be allowed to coast to a complete stop. Some machines may have a mechanical brake that engages upon shutdown, but the brake itself may require service and be the source of stored energy.
Verifying Zero Electrical Potential (The “Live-Dead-Live” Test)
Electrical work requires a specific protocol beyond flipping the disconnect. The authorized employee must:
Test the Meter: Verify the voltage tester (multimeter or non-contact voltage tester) is functioning correctly on a known live source of similar voltage.
Test the Circuit: Test the de-energized circuit conductors (Phase-to-Phase and Phase-to-Ground) to confirm zero voltage is present.
Test the Meter Again: Re-verify the meter is still functioning on the known live source.
Failure to perform this three-point test is a leading cause of electrical shock from back-fed circuits or charged capacitors.
Step 6: Verification of Isolation (The “Try-Out” Step)
Verification is the definitive proof that the preceding five steps were executed correctly. It is not optional. It is the moment the authorized employee confirms the energy isolation was effective.
The Attempt to Restart Protocol
After clearing all tools and personnel from the equipment area, the authorized employee must physically go to the normal operating controls and attempt to start, jog, or cycle the machine. The employee must observe that the machine does not respond in any way—no lights illuminate, no motors hum, no hydraulic lines stiffen, no valves shift.
Resetting Controls to Off
A critical but frequently overlooked sub-step is returning all operator controls to the “Off” or “Neutral” position immediately after the failed start attempt. Leaving a selector switch in the “Start” or “Run” position creates a hazard for uncontrolled startup when the energy is eventually restored and the lock removed.
Table 2: Common LOTO Pitfalls and Corrective Actions
| Observed Pitfall | Immediate Consequence | Required Corrective Action |
|---|---|---|
| One Lock, Multiple Workers | Removal of lock by one person while another is still inside the machine. | Mandate use of a Group Lockout Box with each worker applying their personal lock. |
| Skipping Verification | Failure to discover that a disconnect switch mechanism is broken internally (blades still closed). | Implement a strict “Try-Out” policy with supervisory spot checks. |
| Ignoring Control Circuits | Working on a 480V motor while the 120V control circuit (fed from lighting panel) is still live. | Review electrical schematics; identify all sources of power entering the enclosure. |
| Flammable/Combustible Atmospheres | Use of standard steel locks and hasps in areas with vapor risk (spark hazard). | Specify non-sparking lockout devices (brass or plastic-coated shackles) for classified areas. |
| Shift Change Handoff | Incoming shift removes previous shift’s lock without proper transfer of knowledge. | Implement a formal shift transfer log with physical lock exchange at the machine. |
Alternative Protective Measures: When Standard LOTO Does Not Apply
There are specific operational exceptions where a full six-step LOTO procedure is either infeasible or would introduce greater hazard. These exceptions are narrowly defined under OSHA’s “Minor Servicing” exclusion and “Alternative Protective Measures.”
Minor Tool Changes and Adjustments
The minor servicing exception applies only to routine, repetitive tasks that are integral to the production process and occur during normal production operations. This includes tasks like clearing a minor jam on a conveyor with the use of a tool (where the employee does not break the plane of a barrier guard) or adjusting a guide rail. If an employee must remove a guard, place any part of their body into the point of operation, or bypass a safety interlock, the exception does not apply and full LOTO is required.
Cord and Plug Connected Equipment
For equipment supplied by a single flexible cord and plug, the act of unplugging the equipment while the plug remains under the exclusive control of the employee performing the work constitutes effective isolation. The plug must be within arm’s reach and visible at all times. If the employee leaves the area, even for a restroom break, the plug must be physically locked out using a plug-locking device or the equipment must be considered re-energized upon return.
Hardware Selection: Engineering the Human-Machine Barrier
The integrity of a LOTO program is only as strong as the physical devices used. Environmental factors—temperature extremes, chemical washdowns, dust, and impact—degrade hardware over time.
Lock Body and Shackle Specifications
Shackle: Must be hardened steel to resist cutting with standard bolt cutters. Shackle diameter should be as large as the isolation point allows to minimize play and prevent accidental removal.
Body: Non-conductive materials (reinforced nylon, Xenoy) are preferred for electrical isolation tasks. Metal body locks are acceptable for valve isolation but pose a conductive hazard in electrical panels.
Key Retention: Locks must be designed so the key cannot be removed while the shackle is open. This ensures the lock is properly secured before the employee can walk away with the key.
Device Compatibility and Standardization
One of the most significant efficiency gaps in LOTO programs is the mismatch between the lockout device and the energy-isolating point. A standard padlock will not fit through a small valve handle hole, and a 1-inch shackle is useless on a large breaker tie-bar. Facilities must audit their equipment and stock specific device types:
Gate Valve Covers: Completely encapsulate the valve handle.
Ball Valve Lockouts: Clamp around the valve stem, preventing rotation.
Circuit Breaker Lockouts: Clamp-on devices or pin-in/pin-out mechanisms for specific breaker models.
Plug Lockouts: Encase the plug prongs to prevent re-connection.
Developing a Sustainable Safety Culture Around Isolation
The six-step procedure is the framework, but the structure holding it up is the facility’s safety culture. In organizations with mature safety programs, LOTO is viewed not as a production delay, but as a non-negotiable precondition of work.
Training Requirements: Authorized vs. Affected vs. Other
Authorized Employees: Require in-depth training on energy types, written procedures, and hands-on demonstration of device application. Retraining must occur at least annually and whenever procedures change or new equipment is installed.
Affected Employees: Those who operate the equipment or work nearby. They must understand the purpose of LOTO and be trained never to attempt to remove a lock or tag or restart locked-out equipment.
Other Employees: General awareness of LOTO devices so they recognize the tags and do not interfere.
Periodic Inspections (The Annual Audit)
OSHA 1910.147 requires the employer to conduct a periodic inspection of the energy control procedure at least annually. This is not a paper audit of the binder; it is a live observation by an authorized person not involved in the specific lockout being observed. The reviewer must verify that the employee understands their responsibilities and is correctly applying the six steps. This inspection must be certified in writing.
The Role of Lockout Services in Legacy Infrastructure
For facilities with legacy equipment, faded schematics, or multiple electrical service additions over decades, establishing a compliant LOTO program can be daunting. The first step is often a facility-wide hazardous energy audit to map and label all isolation points. This includes identifying secondary voltage sources that may bypass the main disconnect. Once identification is complete, specific written procedures can be generated for complex or multi-energy-source machinery, ensuring that employees have clear, pictorial guidance for every step of isolation.
Frequently Asked Questions About Lockout Tagout Procedures
What is the difference between Lockout and Tagout?
Lockout is the physical restraint of an energy-isolating device using a lock that requires a key to open. Tagout is the placement of a warning tag on the device. The lock provides the physical barrier; the tag provides communication. OSHA generally requires both lockout and tagout; a tag alone is not sufficient protection unless the equipment is incapable of being locked and the employer implements additional administrative controls.
What is the 6-step isolation process for electrical work?
For electrical work specifically, the process follows the same six steps but emphasizes specific electrical hazards: 1) Preparation (identify voltage and arc flash boundary), 2) Shutdown, 3) Physical Isolation (open disconnect, rack out breaker), 4) Lock/Tag, 5) Release Stored Energy (discharge capacitors, verify absence of induced voltage), and 6) Verification via Live-Dead-Live testing.
What is the 7-step LOTO procedure sometimes referenced in training?
Some training materials expand the standard six steps to seven by separating “Notification” as a distinct step or by adding “Equipment Restart” as a final step after work is complete and the lock is removed. The core process remains the same regardless of whether it is presented in six, seven, or eight steps.
When can a Lockout Tagout lock be removed by someone else?
A lock must only be removed by the authorized employee who applied it. The only exception is a strict, documented “Lock Removal” procedure where the employer and supervisor have made every reasonable effort to contact the absent employee and the supervisor has verified the employee is not on site and the equipment is safe to re-energize. This exception is for emergencies only (e.g., employee leaves lock and goes on vacation).
