Lockout tagout, or LOTO, is the safety procedure that shuts machinery down, physically disconnects every hazardous energy source, locks and tags each isolation point, and proves the equipment is at zero energy before any servicing or maintenance begins. It is governed in the United States by OSHA standard 29 CFR 1910.147, and the injuries it prevents include electrocution, burns, crushing, cutting and amputation.
Because it decides whether a machine can move while somebody’s hand is inside it, the sequence matters more than the paperwork. Below is how the procedure actually works, who is allowed to perform each step, and how the step counts you see in different training programs all describe the same underlying sequence.
Lockout means physically shutting off and disconnecting an energy source with a device that keeps it off, such as a padlocked disconnect switch.
Tagout means placing a warning sign on the isolation device that tells others why the equipment is closed down. Tags warn; locks protect.
Table of Contents
- What Is Lockout Tagout and Why Does It Matter?
- Who Can Perform Lockout Tagout?
- Lockout Tagout Procedure Explained Step by Step
- How to Prepare Before Shutting Down Equipment
- How to Shut Down, Isolate, Lock, and Tag Equipment
- How to Verify Zero Energy State
- How to Handle Stored Energy and Special Situations
- How to Restore Equipment After Maintenance
- What Records and Training Does an Employer Need?
- Lockout Tagout Procedure Explained for Common Workplace Hazards
- Frequently Asked Questions
- Where to Start
What Is Lockout Tagout and Why Does It Matter?
A machine that is switched off is not the same as a machine that is safe to work on. A stopped press still has a charged hydraulic accumulator, a cooling pump still has a flywheel coasting down, and a panel with the breaker open can still be back-fed from a second source. LOTO exists to close that gap between “off” and “safe.”
Federal estimates put uncontrolled hazardous energy at roughly 120 worker deaths and 50,000 injuries every year in the United States, and 1910.147 shows up year after year on OSHA’s list of most frequently cited standards. The injuries cluster in a small number of predictable situations: clearing a jam, cleaning inside a housing, replacing a component, removing a guard, or a minor adjustment where the operator assumes the machine is off.
The employer must run a written energy-control program whenever servicing or maintenance exposes workers to hazardous energy and the machine has an energy-isolating device. Two situations are excluded. Cord-and-plug equipment under the employee’s exclusive control does not require a formal LOTO program when the plug is pulled and kept under the employee’s control, and routine minor servicing adjustments performed by the operator are exempt. The second exemption is narrow: if the adjustment involves removing a guard, opening the housing, or reaching into the machine, it is no longer minor and the full procedure applies.
Lockout tagout procedure explained: the six steps at a glance
- Prepare, identify all energy sources, and notify affected employees.
- Shut the equipment down using normal stopping procedures.
- Physically isolate every energy source at its isolation point.
- Apply your own lock and tag to each isolation device.
- Release, block, bleed, ground or otherwise control stored and residual energy.
- Verify the zero energy state before work begins.
Who Can Perform Lockout Tagout?
Only a trained, authorized employee may apply or remove an energy-isolating device. Everyone else has defined boundaries: affected employees must operate and maintain the equipment but must never remove a device or restart the machine, and other employees need awareness of the program and nothing more.
| Category | What they do around the machine | Training level |
|---|---|---|
| Authorized employee | Performs LOTO, applies and removes personal locks, performs servicing and maintenance | Full procedural and hands-on device training, retrained when the procedure or energy system changes, and at least annually on this standard |
| Affected employee | Operates the machine or works in the area, must not remove devices or start the equipment | Instruction in the LOTO procedure and in why the restriction exists |
| Other employee | Has no operating or maintenance role in the area | Awareness: do not touch, bypass or remove locks and tags |
The employer carries the legal duty here. That means training and certifying authorized employees for each machine they will service, keeping the written procedures current, providing the devices, and enforcing the rule that only the employee who applied a lock may remove it. That last one is where programs break, because a supervisor who pulls a lock off to meet a production target is performing an unauthorized act, not a helpful one.
Lockout Tagout Procedure Explained Step by Step
Step 1: Prepare and notify affected employees
Read the machine-specific procedure before touching anything, confirm which energy sources the procedure lists, and gather the devices and personal protective equipment you need. Tell the operators and affected employees that the equipment is going down, and tell them when it is expected to be released, so a conveyor operator or a line supervisor can clear people and product out of the area before you start.
Step 2: Shut down the equipment normally
Use the machine’s ordinary stopping routine. This step is easy to underrate, and skipping it is a real problem: a controlled stop lets the drive ramp down, lets a pump unload, and lets internal logic park moving parts. A controlled stop also puts the control circuit into a defined state, which makes the isolation step predictable.
Step 3: Isolate every energy source
Throw the disconnect, close the manual valve, uncouple the drive, close the process line, or apply a block to the gravity source. Follow the energy source list in the procedure, not just the one you can see. A stop button, an emergency stop, a VFD disable, a control valve or a solenoid does not count as isolation; those are control commands, and the energy path is still intact behind them.
Step 4: Apply your own lock and tag
Each authorized employee working on the equipment applies their own individually keyed padlock to every isolation device, then attaches a danger tag showing their name, the date and time, the reason for the lockout, and contact information. When a second worker needs protection, use a lockout hasp so several personal locks sit on the same isolation point, each with a key only its owner holds.
Step 5: Control stored and residual energy
Isolating a supply does not remove what is already stored. Bleed pressure to zero, block raised or suspended loads, ground stored electrical charge, discharge capacitors, and set controls to neutral so nothing regenerates on its own. This is the step most often treated as optional, and stored energy is what turns a careless fitting into an amputation.
Step 6: Verify the zero energy state
Prove the machine is dead before touching a guard. OSHA requires this at 29 CFR 1910.147(d)(6), and it is covered in detail further down. The short version: attempt a start, test with a properly rated instrument, and confirm that the attempt produced nothing.
Where the 5-, 7-, 8- and 9-step versions come from
Training providers split the same sequence differently, which is why you will see every count from five to nine. None of the shorter versions is missing a safety act; they merge or move steps, and two of them drop stored energy control, which is not an optional step.
| Count you will hear | How it maps to the OSHA sequence | What to watch |
|---|---|---|
| 5 steps | Combines shutdown and isolation into one, and folds stored energy control into isolation | Stored energy often disappears from the wording, which is the step you cannot lose |
| 6 steps | The standard sequence used here: prepare, shutdown, isolate, lock and tag, control stored energy, verify | Matches how 1910.147 lays out the energy-control phases |
| 7 steps | Splits preparation into notify employees and identify hazards, or splits lock from tag | Nothing added, just finer granularity |
| 8 steps | Adds an explicit return-to-service step at the end, or splits shutdown from preparation | Return to service is covered separately below |
| 9 steps | Opens with notify employees, splits prepare and shutdown, and closes with return to service | The longest common version; it starts with communication rather than paperwork |
So the answer to how many steps there are: the regulation describes phases, not a fixed number. Six is the cleanest way to teach it, and any sequence that includes prepare, shutdown, isolate, lock and tag, control stored energy, verify, and restore covers the same ground.
How to Prepare Before Shutting Down Equipment
Preparation is where most failures happen, and they usually happen because the procedure in the binder is generic. A copy-pasted template that names forty machines and identifies no actual isolation point is not a usable procedure, and auditors find this repeatedly in plants where the machines are all different ages.
Before you shut anything down, work through four things:
- Read the machine-specific procedure. It should list each energy source, its isolation point, and how to control stored energy for that specific machine. If it does not, treat that as a finding and report it before the job.
- Walk the energy sources physically. Electrical in, mechanical through the drive, hydraulic, pneumatic, thermal, chemical and gravitational, and anything the previous owner added during a retrofit.
- Gather devices and PPE. Your own padlock and key, tags, a lockout hasp for shared points, a calibrated tester, bleed valves and blocks where the procedure calls for them, and the eye and hand protection the task requires.
- Assess the area and coordinate. Clear product, guards and tooling from the access path, make sure no one is inside the machine, and confirm that contractors and other trades who are sharing the isolation point are accounted for.
How to Shut Down, Isolate, Lock, and Tag Equipment
Once shutdown is complete, work through the energy list methodically. The most common accident pattern is not missing an energy type; it is isolating one source out of three and assuming the others were handled by someone else.
| Energy type | How it is typically isolated | Typical device |
|---|---|---|
| Electrical | Open the disconnect switch or pull the circuit breaker to the off position; verify with a meter | Padlock and tag, breaker lockout |
| Mechanical | Uncouple the drive, lock out the motor, block the flywheel or rotating member | Padlock on the disconnect, shaft or coupling lock |
| Hydraulic | Close the manual valve at the source, not the control valve; relieve the accumulator | Valve lockout, hose cap lock, accumulator bleed |
| Pneumatic | Close the manual valve upstream of the valve or regulator that supplies the actuator; bleed the downstream side | Valve lockout, plug or vent |
| Thermal | Shut off and lock the steam, gas or heat source; allow or actively cool to a safe temperature | Valve lockout and tag stating temperature condition |
| Chemical | Close and lock the supply valve, install a line blind or double block and bleed, and flush | Valve lockout, spectacle blind or slip blind |
| Gravitational | Lower the load, block raised components, restrain suspended parts | Mechanical block, pin or strap |
Two details on the hardware. Every authorized employee on the job uses their own lock, and one worker holds one key, so a lock can only be removed by the person who applied it. Tags then carry the worker’s name, the date and time of application, the reason for the lockout and a contact, and a tag never substitutes for a lock unless a physical lock is genuinely impossible, which the standard treats as an exception rather than a shortcut.
How to Verify Zero Energy State
Verification is the step that separates a de-energized machine from a machine you believe is de-energized. A dark display, a stopped motor, a light that reads “off” and a PLC status bit are all signals, and none of them is proof, because each is downstream of the isolation you are trying to confirm. A control circuit can be energized from a separate feed, and a soft-start or drive can hold a capacitor charge long after the main breaker is open.
Verify in three passes:
- Try-start. Return the controls to neutral and attempt to start the machine with normal operating controls. Nothing should happen. Any response, including a partial rotation, a solenoid click or a fault light from an energized circuit, means you are not finished.
- Instrument test. Test for absence of voltage with a properly rated meter or tester, using a prove-test-prove sequence so you know the tester itself works. For stored electrical energy beyond the meter, use a rated discharge device.
- Walk-down. Confirm mechanical blocking, bled lines, grounded sources, neutral controls, drained accumulators and clear conditions, and confirm the machine is in a safe state for the specific task ahead.
Only when all three agree do you start the work. And if anything shifts during the job, a new worker arrives, or a guard comes off, you start the verification again rather than assuming the earlier result still holds.
How to Handle Stored Energy and Special Situations
Stored energy is the hazard that catches experienced people, because it is invisible in the machine’s normal state. A hydraulically powered clamp on an injection molding machine can still be sitting on accumulator pressure after the pump motor is locked out; a fixture lowered on a ratchet can still carry gravity; a charged pneumatic line can still move an actuator. In each of those cases, the fix is the same family of actions: bleed, block, ground, restrain, or release.
Other situations that need their own handling:
- Multiple energy sources on one job. Lock every one of them. Missed isolation points cluster in auxiliary systems, and a pneumatic line added during a retrofit is a common example.
- Tagout only. Permitted when a physical lock cannot be installed, such as on a valve inside a locked enclosure. It requires a written procedure, a tag with a clear warning, and follow-up action to get the device replaced.
- Group lockout. A primary authorized employee takes charge, isolates and verifies, then applies a personal lock to a group lockout box or hasp and locks it. Each worker then applies their own lock to the box, and the box stays locked until the last lock comes off.
- Shift changes. Locks transfer to the incoming crew person by person, in person, at the equipment. Continuity comes from the locks staying on, not from a paper handover, and the outgoing employee is the one who walks the new authorized employee through the isolation points.
- Contractors and multiple employers. Each employer’s authorized employees protect their own people. Where isolation is shared, every party applies a lock, and no one assumes another employer’s lock covers their worker.
How to Restore Equipment After Maintenance
Returning equipment to service is a procedure in its own right, and the moment of re-energization is when people get hurt reaching into a machine that was just cleared. Work in reverse order, in the same deliberate way you isolated.
- Confirm the work area is clear of people, tools, blocks, and loose parts, and that guards, covers and interlocks are back in place.
- Confirm every tool, part and measuring device is removed from the machine. Leave nothing taped or wedged inside.
- Inspect the equipment and any repaired or replaced component for correct installation, and check that controls and safety devices function properly.
- Have each authorized employee clear their area and remove their own personal lock, following your group lockout procedure if one is in use.
- Notify affected employees that the energy is about to be restored and that no one should be in the area.
- Restore the energy sources in the order the procedure specifies, then do a controlled test start with controls at neutral and everyone clear.
Devices are only removed by the person who applied them, except in the narrow case where the employer has a documented removal procedure and the employee is no longer on site, or the employer has taken specific steps to ensure the employee is not exposed to a hazard. A supervisor pulling a lock off to meet a schedule is not covered by that exception.
What Records and Training Does an Employer Need?
A defensible program comes down to four written things: a written energy-control program, machine-specific procedures, training records, and periodic inspection records. Investigators and auditors ask for all four, and verbal knowledge about a machine does not substitute for a document naming its isolation points.
Training has to fit the role. Authorized employees need hands-on practice on each machine they will service, retraining whenever a procedure changes, an energy system changes, or the employee has been away from the task, and at least annual participation in this standard. Affected employees need an explanation of the program and of why they may not remove a device. Other employees need the awareness briefing.
What a machine-specific procedure must contain
Name the machine and the area, list every energy source with its magnitude, identify each isolation point specifically enough that someone unfamiliar with the machine can find it, list the shutdown method, describe how to control stored and residual energy, and specify the verification method. One page per machine is normal. Describe how the machine is positioned before shutdown, since a conveyor or press has to be at a known position before isolating it.
What an annual periodic inspection covers
At least once a year, the employer inspects the energy-control procedure to confirm it is accurate and still used correctly. The inspection checks that the procedure lists all energy-isolating devices, that devices are actually being applied, that authorized employees understand and follow the procedure, and that only authorized employees are applying devices. Where the inspection finds a problem, it gets corrected. Use someone outside the immediate shift leadership where you can, since a supervisor who watches the same people daily tends to see what it always looks like.
For what it is worth to know the stakes: LOTO citations carry meaningful penalties, and a citation is far easier to prevent with current machine-specific procedures and a defensible training record than to argue after the fact.
Lockout Tagout Procedure Explained for Common Workplace Hazards
The same six steps apply everywhere, but what you are isolating changes by job. Here is what tends to be involved.
Electrical panel work
The disconnect switch or breaker is the isolation point, and the padlock goes on it, not on a panel cover or a selector switch. Verify with a rated meter using prove-test-prove, and check for back-feed from a second source such as a transformer feed or a control circuit tapped ahead of the disconnect. Test leads on conductors, using appropriate PPE and voltage-rated tools for the exposure.
Conveyors and presses
Isolate the motor at the disconnect, then verify. Because gravity and stored motion matter here, confirm the belt, rollers and flywheel are blocked or at rest, and that elevated sections are supported. A control-circuit-only “stop” leaves a foot pedal or a pull-cord stop live, so those are part of the isolation check. Clearing a jam is the single most common LOTO fatality scenario, and the line being restarted from a control panel away from the work is the recurring mechanism.
Pumps, hydraulics and pneumatics
Close and lock the manual valve at the energy source, not the control valve, since a control valve can fail open. Bleed pressure downstream and relieve accumulators, and allow trapped pressure to read zero on a gauge before any fitting is loosened. For pneumatics, close the upstream valve and vent the downstream side so a check valve or regulator cannot hold pressure. For a pump, confirm suction and discharge are both controlled, and be aware that a reverse-flow path can keep a line pressurized.
Heating and cooling systems
Isolate and lock the energy source for the burner, boiler or chiller, including gas, steam or high-voltage supply as applicable, and confirm burners have purged and are in a safe state. A cooling system holding refrigerant needs a lockable valve at the source and a line blind or verified isolation before a line is opened, because residual pressure and stored chemical energy remain after the compressor stops. The tag should state the temperature or pressure condition where the crew needs to know the exact state.
Powered industrial trucks and mobile equipment
Mobile equipment is treated differently: the trained, authorized operator performing the service does the work rather than applying a lock. A lift truck, scissor lift or powered pallet jack that needs servicing is parked, lowered, key removed and the battery or ignition isolated by the person doing the work.
Frequently Asked Questions
How many steps are in a lockout tagout procedure?
The regulation describes phases rather than a fixed count. Six is the most common way to teach it: prepare, shut down, isolate, apply locks and tags, control stored energy, and verify the zero energy state. Five, seven, eight and nine step versions all describe the same sequence with steps merged or split. Check that any version you are taught still includes stored energy control and verification.
What is the difference between lockout and tagout?
Lockout uses a physical device, usually a padlock, to keep an energy-isolating device in the safe position. Tagout attaches a warning sign so others know the equipment is closed down. Tags warn, locks protect. Tagout alone is permitted only where a physical lock cannot be installed, and it needs a written procedure plus follow-up to correct the equipment.
Can someone else remove a lock that I applied?
Only the employee who applied a lock may remove it. The narrow exception applies when the employer has a documented removal procedure and the employee is no longer on site, or when the employer has taken specific steps to establish the employee will not be exposed. A supervisor removing a lock so production can restart is not covered and puts the original employee at risk.
Does a control switch or emergency stop count as energy isolation?
No. Stop buttons, emergency stops, VFD disables, control valves and solenoid valves are control commands, not isolation, because the energy path behind them stays intact and the source can be re-energized remotely or by another supply. Isolation requires a physical break in the energy supply at a device that can be locked.
How often is LOTO training required?
Affected and other employees need instruction and awareness at the point they are assigned to the role. Authorized employees need hands-on training on each machine they service, retraining whenever a procedure, an energy system or their duties change, whenever a deviation occurs, and at least annual participation covering the requirements of the standard. Keep a training record for each authorized employee.
When is LOTO not required?
Cord-and-plug equipment under the exclusive control of the employee is exempt when the plug is disconnected and kept under that employee’s control, and routine minor servicing adjustments by the operator are exempt. The minor-adjustment exemption is narrow: if the work involves removing a guard, opening the housing, or placing any part of the body into the danger zone, the full procedure applies.
Where to Start
If you run a small team, the first move is to write one real machine-specific procedure for the machine that has caused the most trouble, walk it with the operators, and confirm that everyone who works on it can name the isolation points. If you run a multi-machine facility, audit a sample of machines against their procedures and find out how many procedures actually match the equipment in front of them.
Whichever you are, the sequence does not change: prepare, notify, shut down, isolate, lock and tag, control stored energy, verify, and do the work. Updated for 2026, and written to be read by the person standing in front of the machine rather than the person sitting at a desk.