Lockout/Tagout (LOTO) Procedures: A Complete Guide
A machine that restarts during maintenance does not give a second chance. The worker reaching into a die, clearing a jam, or servicing a conveyor is relying entirely on the assumption that the energy is gone and will stay gone. When that assumption fails, the injuries are catastrophic — amputations, crush injuries, electrocution. Lockout/tagout exists to make that assumption true every time, and OSHA citation data shows that most employers still get the program wrong.
Tracking LOTO procedures and inspections by hand? WhyTrace Plus documents energy control procedures, schedules annual periodic inspections, and links every gap back to a corrective action. Free to start.
What Is Lockout/Tagout (LOTO)?
Lockout/tagout (LOTO) is the set of practices that control hazardous energy so machines cannot start up, energize, or release stored energy while workers service or maintain them. "Lockout" means applying a physical lock to an energy-isolating device; "tagout" means attaching a warning tag where a lock cannot be used. OSHA governs LOTO under 29 CFR 1910.147, the Control of Hazardous Energy standard.
The hazardous energy LOTO controls is broader than electricity. A complete energy control program accounts for every source that can move, release, or harm:
| Energy type | Examples | Isolation method |
|---|---|---|
| Electrical | Motors, control panels, capacitors | Disconnect switch, breaker lockout |
| Mechanical | Flywheels, blades, springs under tension | Block, pin, restraint |
| Hydraulic | Presses, lifts, clamps | Valve lockout, pressure bleed-down |
| Pneumatic | Air cylinders, actuators | Valve lockout, line de-pressurization |
| Thermal | Steam lines, hot surfaces, ovens | Cool-down, valve isolation |
| Chemical | Process lines, reactive materials | Line blanking, valve lockout |
| Gravity / stored | Suspended loads, raised platforms | Mechanical block, lowering to rest |
LOTO matters because the standard works. According to OSHA, compliance with 1910.147 prevents an estimated 120 fatalities and 50,000 injuries each year. The standard ranked #4 on OSHA's Top 10 most cited standards in fiscal year 2025 with 2,177 citations — meaning the controls that prevent those injuries are also among the controls employers most often fail to put in place correctly.
What Does OSHA 1910.147 Require?
OSHA 1910.147 requires employers to establish a documented energy control program before any servicing or maintenance work begins on equipment where unexpected energization could cause injury. The standard breaks into three pillars: written procedures, employee training, and periodic inspection.
The core obligations under the standard:
A written energy control program — 1910.147(c)(1). You must establish a program that covers energy control procedures, employee training, and periodic inspections. This is the umbrella requirement; everything else hangs off it.
Machine-specific energy control procedures — 1910.147(c)(4). For each piece of equipment, you need documented, step-by-step procedures that state the scope, purpose, and means of isolating every energy source. A single generic LOTO procedure for an entire facility does not satisfy this requirement unless every machine genuinely meets the narrow exception criteria. Failure to develop and document machine-specific procedures is the single most common LOTO violation.
Protective devices — 1910.147(c)(5). Locks, tags, chains, and blocks must be provided by the employer, durable, standardized, and substantial enough to prevent removal without excessive force. Each authorized employee gets their own uniquely identified lock.
Energy control procedure sequence — 1910.147(d) and (e). The application and removal of controls follow a defined six-step sequence (covered below). Stored energy must be relieved or restrained, and isolation must be verified before work starts.
Training — 1910.147(c)(7). Authorized, affected, and other employees must be trained to the level their role requires, with retraining when jobs change, procedures change, or an inspection reveals a deficiency.
Periodic inspection — 1910.147(c)(6). Each energy control procedure must be inspected at least annually by an authorized employee who is not using the procedure being inspected.
The penalty structure gives the requirement weight. As of 2026, OSHA can fine up to $16,550 per serious violation and up to $165,514 per willful or repeated violation. A facility with several machines lacking written procedures can accumulate citations quickly.
How to Develop a LOTO Program (Step by Step)
Developing a LOTO program means moving from a facility-wide policy down to a documented procedure for each machine, then building the training and verification that keep those procedures honest. The work is sequential — skip a layer and the citations follow.
1. Inventory equipment and energy sources
Walk the floor and list every machine that gets serviced, maintained, or cleaned. For each one, identify every energy source — not just the obvious electrical disconnect, but residual hydraulic pressure, gravity loads, and capacitors that hold charge after power-down. This inventory is the foundation for everything that follows.
2. Write machine-specific procedures
For each machine, document the procedure required by 1910.147(c)(4): the specific energy-isolating devices, the sequence for shutting them down, how stored energy is released, and how isolation is verified. The procedure should name the locations precisely — "main disconnect on the north wall," not "the disconnect." Vague procedures fail inspections and fail workers.
3. Standardize hardware and assign locks
Issue uniquely identified locks to each authorized employee. Standardize colors, formats, and tag wording across the facility so a lock means the same thing in every department. Group lockout devices (lockout hasps, gang boxes) handle situations where multiple workers service one machine.
4. Define the six-step application sequence
Every authorized employee follows the same sequence when applying controls:
- Prepare for shutdown — identify the energy sources and the magnitude of the hazard.
- Notify affected employees — tell everyone in the area that LOTO is about to begin.
- Shut down the equipment — using the normal stopping procedure.
- Isolate energy sources — operate the disconnects, valves, and isolating devices.
- Apply locks and tags — each authorized employee applies their own lock to each isolating device.
- Verify isolation — relieve or restrain stored energy, then attempt to start the equipment (return controls to neutral after testing) to confirm it stays dead.
5. Train every role
Build training around the three employee categories (covered in the next section) and document who was trained, on what, and when. Keep retraining triggers tied to changes — new equipment, revised procedures, or a deficiency found in periodic inspection.
6. Schedule and run annual inspections
Put each procedure's annual periodic inspection on a calendar with a named inspector and a documented outcome. The inspection is not optional, and it is among the most frequently cited subsections precisely because employers skip it or fail to document it.
Try WhyTrace Plus Free
When a periodic inspection turns up a deficient procedure or a worker deviating from the steps, that finding needs a root cause and a corrective action — not just a note in a binder. WhyTrace Plus turns each LOTO gap into a tracked investigation with a named owner and a verified close-out.
Authorized vs Affected Employees: Who Does What
OSHA defines three categories of employees in a LOTO program, and the distinction drives both training requirements and who is allowed to touch a lock. Confusing these roles is a common source of both injuries and citations.
| Employee category | Definition | What they may do | Training required |
|---|---|---|---|
| Authorized | The person who locks out or tags out machines to perform servicing or maintenance | Apply and remove their own locks, perform the full energy control procedure | Full training on hazard recognition, energy types, and procedures — 1910.147(c)(7)(i)(A) |
| Affected | Operates or works on/around equipment being serviced under LOTO | Must recognize when LOTO is in use; may NOT remove or bypass locks | Awareness of the purpose and use of energy control procedures — 1910.147(c)(7)(i)(B) |
| Other | Works in an area where energy control procedures may be used | Recognize LOTO and the prohibition against restarting or removing controls | General awareness — 1910.147(c)(7)(i)(C) |
The line that matters most on the shop floor is the one between authorized and affected. An operator who runs a press every day is an affected employee. The moment that operator performs servicing or maintenance that requires bypassing a guard or reaching into the point of operation, the role shifts — and authorized-level training and lockout become mandatory. Many incidents happen in exactly this transition, when an operator clears a jam "just for a second" without locking out, because no one defined the moment the role changed.
Two situations deserve specific attention:
One lock, one worker. Each authorized employee applies their own lock. The cardinal rule of LOTO is that the only person who removes a lock is the person who applied it. When a worker leaves the lock on at shift end, the standard provides a strict procedure for employer removal — verifying the worker is not on site, making all reasonable efforts to contact them, and informing them before they return.
Group lockout — 1910.147(f)(3). When a crew services one machine, group lockout procedures give each worker their own lock on a group device, so the equipment cannot be re-energized until every worker has removed their personal lock. No single person's removal releases the machine for everyone.
For the broader systems-thinking view of why "the operator took a shortcut" is rarely the real root cause, see Human Error and Systems Thinking.
What Periodic Inspections Require (and Why They Get Cited)
A periodic inspection is the annual review, required by 1910.147(c)(6), that confirms each energy control procedure is still adequate and that employees are following it correctly. OSHA requires at least one inspection per year for each procedure, performed by an authorized employee who is not using the procedure being inspected.
The inspection has specific content requirements that a quick walkthrough does not satisfy:
- Frequency — at least annually, for each energy control procedure, not one inspection covering the whole facility.
- Independent inspector — conducted by an authorized employee other than the one(s) using the procedure being inspected.
- Review with employees — for lockout, the inspector reviews each authorized employee's responsibilities under the procedure with that employee. For tagout, the review covers both authorized and affected employees, because tags warn rather than physically prevent.
- Documentation — the certification must identify the machine or equipment, the inspection date, the employees included, and the person performing the inspection.
- Correct deficiencies — any gap the inspection finds must be corrected, and the correction often triggers retraining under 1910.147(c)(7)(iii).
Periodic inspection ranks among the most commonly cited LOTO subsections for two reasons: employers either skip it entirely or run it without proper documentation. An inspection that happened but was never certified, in OSHA's view, did not happen. A binder full of identical, undated checklists tells an inspector the program is being treated as paperwork rather than verification.
The inspection is also the part of the program that exposes drift. Procedures written two years ago may no longer match a machine that has been modified. A worker may have developed a faster, undocumented way to isolate energy. The annual inspection is where you catch those gaps — but only if the finding flows into a corrective action with an owner and a due date, rather than dying in the inspection file. This is the same closed-loop discipline that governs effective corrective action management: a finding without a verified close-out is just a record of a problem you already knew about.
Common LOTO Mistakes and How to Avoid Them
The failures behind LOTO citations are consistent enough across industries to list directly. Most map straight to a missing or weak part of the program.
| Mistake | Why it happens | Fix |
|---|---|---|
| Generic, facility-wide procedure | Easier to write one document than many | Write machine-specific procedures per 1910.147(c)(4) |
| Skipped or undocumented annual inspection | Operational pressure, no calendar | Schedule each inspection with a named inspector and certification |
| Treating operators as never "authorized" | Role transition during jam-clearing ignored | Define the moment servicing begins; train and equip operators |
| Removing someone else's lock | Shift change, missing worker | Follow the strict employer lock-removal procedure |
| Shallow root cause after a LOTO incident | "Worker didn't follow procedure" closes the file | Investigate why the procedure was bypassable or unclear |
| Stored energy not released | Focus only on the electrical disconnect | Account for hydraulic, pneumatic, gravity, and capacitor energy |
| No retraining after a deficiency | Inspection finding never closed the loop | Tie retraining to inspection results, procedure changes, and new equipment |
The most damaging mistake is the last conceptual one: stopping the investigation at "the worker took a shortcut." When a LOTO incident or near-miss happens, the procedure that allowed the shortcut, the production pressure that rewarded it, and the training gap that left the role transition undefined are all part of the cause. A 5 Whys analysis on a LOTO near-miss almost always reaches the program, not just the person.
For how a structured investigation method applies to safety incidents under OSHA expectations, see the OSHA Incident Investigation guide.
Frequently Asked Questions
Q. What is the difference between lockout and tagout?
Lockout uses a physical lock to hold an energy-isolating device in the safe position, so the machine cannot be re-energized. Tagout attaches a warning tag to that device when a lock cannot be applied. OSHA treats lockout as the more protective method; when only tagout is used, the standard requires additional means to provide protection equivalent to lockout, and tagout training must reach affected employees as well as authorized ones.
Q. How often are LOTO periodic inspections required?
At least once per year for each energy control procedure, under 29 CFR 1910.147(c)(6). The inspection must be performed by an authorized employee who is not using the procedure being inspected, and it must be certified with the machine, date, employees involved, and inspector recorded. A single annual inspection covering an entire facility does not meet the requirement — each procedure needs its own review.
Q. Who is allowed to remove a lockout device?
Only the authorized employee who applied the lock may remove it. The single exception is when that employee is not available; in that case, the employer may remove the lock only after following a strict procedure — verifying the employee is not in the facility, making all reasonable efforts to contact them, and ensuring they are informed before resuming work. This rule has no flexibility, because a lock that anyone can remove protects no one.
Q. When does an operator become an "authorized" employee?
The moment an operator performs servicing or maintenance that requires bypassing a guard, reaching into the point of operation, or otherwise placing a body part where unexpected energization could cause injury. Clearing a jam, removing a guard to clean, or freeing a stuck part typically crosses this line. At that point the operator needs authorized-level training and must lock out — running through it informally is where many serious injuries occur.
Q. Does LOTO apply to cord-and-plug equipment?
Often no. OSHA exempts work on cord-and-plug connected equipment when the hazard is controlled by unplugging the equipment and the plug stays under the exclusive control of the employee doing the work. If the worker cannot see and control the plug at all times, that exemption does not apply and full LOTO is required.
Key Takeaways
- LOTO is governed by OSHA 29 CFR 1910.147 and, when followed, prevents an estimated 120 fatalities and 50,000 injuries each year. It ranked #4 on OSHA's FY2025 Top 10 most cited standards with 2,177 citations.
- The standard requires three pillars: a written energy control program, machine-specific procedures (the most cited gap, under 1910.147(c)(4)), and at least one periodic inspection per year per procedure.
- Authorized employees apply and remove their own locks; affected employees must recognize LOTO but never touch a lock. The dangerous transition is when an operator starts servicing work and the role silently shifts to authorized.
- Annual periodic inspections must be independent, documented, and reviewed with employees — and they get cited most often because employers skip them or fail to certify them.
- The most damaging LOTO failure is closing an investigation at "the worker took a shortcut." Treat every LOTO finding as a root cause question about the procedure, the production pressure, and the training gap — then close the loop with a tracked corrective action.
Related Resources
| Resource | Description | Best For |
|---|---|---|
| Try WhyTrace Plus Free | AI-assisted RCA and corrective action tracking for LOTO findings | Turning inspection gaps into closed-loop corrective actions |
| OSHA Incident Investigation Guide | Step-by-step investigation aligned with OSHA expectations | EHS managers investigating LOTO incidents and near-misses |
| Corrective Action (CAPA) Management | Closed-loop tracking from finding to verified effectiveness | Closing periodic-inspection deficiencies on time |
For frontline safety programs that turn near-miss observations — including LOTO shortcuts — into structured 4M reports, see the near-miss and hazard reporting workflow in AnzenPost Plus and the AI-assisted KY and risk assessment approach in AnzenAI. For preserving the energy-control know-how of experienced maintenance technicians before they retire, see capturing tacit maintenance knowledge with know-howAI.