Lockout/Tagout (LOTO): controlling hazardous energy, explained

Some of the most severe workplace injuries happen not during normal operation but during maintenance — when a machine starts up unexpectedly, or stored energy releases, while someone's hands are inside it. OSHA's Control of Hazardous Energy standard, universally known as Lockout/Tagout (LOTO, 29 CFR 1910.147), exists to prevent exactly this, and it is a perennial top-cited standard. This guide explains what LOTO is and what a compliant program requires.

What "hazardous energy" means

LOTO is about more than electricity. Hazardous energy includes electrical, but also mechanical, hydraulic, pneumatic, chemical, thermal and gravitational energy — anything that could move, energize or release while a machine is being serviced. The classic failure is assuming "I switched it off" is the same as "it is safe." A switched-off machine can still hold pressure in a hydraulic line, tension in a spring, or a raised load held only by gravity. LOTO is the disciplined process of making sure all energy sources are isolated and can't come back on.

When LOTO applies

The standard applies to servicing and maintenance where the unexpected startup or release of stored energy could injure someone — think clearing a jam, cleaning, adjusting, lubricating or repairing equipment, especially where a guard must be removed or a body part placed in a danger zone. There is a limited exception for minor tool changes and adjustments that are routine and integral to production, provided they are done with effective alternative protection. Normal production operation itself is generally outside LOTO's scope — it is the servicing that triggers it.

What a compliant program requires

OSHA expects several elements, and inspectors look for each:

A written energy-control program. The overarching document covering your energy-control procedures, employee training and periodic inspections.

Machine-specific procedures. For each piece of equipment, a documented procedure identifying its energy sources and the exact steps to shut down, isolate, lock out, verify zero energy, and safely restore it. Generic one-size procedures usually fail here.

Locks and tags. Standardized, durable lockout devices and tags that are used only for energy control and identify who applied them — one worker, one lock, one key, so a machine cannot be re-energized while anyone is still working on it.

Verification. The critical step people skip: after locking out, actually verify zero energy — try to start the machine, test with a meter, bleed the pressure — before work begins.

Training and periodic inspection. Authorized employees (who perform LOTO) and affected employees (who operate the equipment) must be trained for their roles, and the procedures must be inspected at least annually.

Group lockout and shift changes

Two situations cause real-world incidents. When multiple people work on one machine, group lockout ensures each worker applies their own lock, so the last person out is the one who removes the last lock. And at shift changes, a defined handoff must keep the equipment locked out continuously so protection is never dropped between crews. These are the details a solid procedure spells out and a good Job Hazard Analysis reinforces at the point of work.

Keeping it real

LOTO fails most often not because a program does not exist but because the machine-specific procedures are missing or generic, verification is skipped, or training lapses. Keeping current, equipment-specific procedures and up-to-date training records is the whole game — which is exactly the sort of living documentation a compliance system keeps ready, rather than a binder that ages out between audits.