Lockout/tagout (LOTO) is the practice of shutting down a machine, isolating every energy source that feeds it, locking those isolation points, and verifying zero energy before anyone services it. OSHA requires it under 29 CFR 1910.147 whenever servicing could expose workers to unexpected energization, startup, or release of stored energy.
The standard is short and specific, and it has sat on OSHA's ten-most-cited list for decades. That tells you plants keep failing at the same parts: machine-specific procedures that were never written, annual inspections that never happened, training that stopped at "put a lock on it." This post walks the standard section by section in plain language. It is an educational walkthrough, not legal advice; when a call is close, read the standard text and involve your safety professional.
What counts as hazardous energy?
Hazardous energy is any energy that can injure someone if it releases while they are inside, under, or working on equipment: electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and gravity. If it can move a part, pressurize a line, heat a surface, or shock a person, it must be controlled before servicing starts.
The kind that gets people hurt is stored energy. Opening the disconnect kills incoming electricity, but it does nothing about the charge in a capacitor bank, the pressure sitting in a hydraulic accumulator, the compressed air trapped between the valve and the cylinder, the tension in a loaded spring, or a raised platen waiting to come down. A machine can be electrically dead and still able to crush a hand. That is why the standard makes releasing or restraining stored energy its own step in the sequence, not a footnote.
Who does 1910.147 cover, and when does it apply?
The standard covers servicing and maintenance of machines and equipment in general industry where unexpected energization, startup, or release of stored energy could injure an employee. Servicing is broader than tear-downs: setting up, adjusting, inspecting, unjamming, lubricating, and cleaning all count. Normal production is a different regime. While the machine runs as intended, machine guarding protects the operator; the moment someone removes or bypasses a guard, or places any part of their body where the machine does its work, they are servicing it and lockout applies.
There is one narrow carve-out that plants routinely stretch too far. Minor tool changes and adjustments during normal production are exempt only when they are routine, repetitive, and integral to the use of the equipment, and only when the work is performed using alternative measures that provide effective protection. Every condition must hold. "We do it all the time" satisfies none of them by itself, and if the alternative protection amounts to hoping nobody presses start, the exception does not apply and full lockout does.
What must an energy control program include?
The standard requires an energy control program with three legs, and missing any one of them is a violation:
- Documented energy control procedures. Machine-specific, stating the energy types and magnitudes present, the steps to shut down, isolate, block, and secure the equipment, the steps for placing and removing devices, and the requirements for testing. A one-page policy that says "lock out equipment before servicing" is not a procedure.
- Training. Three defined levels, covered below.
- Periodic inspections. Each procedure must be inspected at least annually, with a certification to prove it. Also below.
The pattern in citations is telling: it is rarely the locks. It is the paperwork legs, procedures that do not exist for specific machines and inspections that never happened, that draw findings.
What are the six steps of lockout/tagout?
1910.147(d) prescribes the exact sequence for applying energy control. In order:
- Prepare for shutdown. Before touching anything, the authorized employee must know the types and magnitude of the energy on the machine, its hazards, and how to control it. Notify affected employees that the machine is coming down.
- Shut down the machine. Use the normal stopping procedure, orderly and per the operating instructions, not by pulling a breaker mid-cycle.
- Isolate every energy source. Operate the energy-isolating devices: the main disconnect, line valves, blocks. An emergency stop or a control-circuit button is not an energy-isolating device; it interrupts a signal, not the energy.
- Apply lockout or tagout devices. Each authorized employee attaches their own lock (or tag, where tagout is permitted) to each isolating device, holding it in the safe or off position.
- Control stored and residual energy. Bleed trapped pressure, drain lines, discharge capacitors, block elevated parts, release or restrain spring tension. If energy can re-accumulate, keep verifying isolation until servicing is complete.
- Verify isolation. Before work begins, try the start controls, test with a meter, watch the gauges. Prove the machine is dead, then return the controls to neutral. This try step is why experienced hands call the whole practice lock-tag-try.
Restoring the machine to service has its own sequence under 1910.147(e). Inspect the work area and confirm tools, blocks, and nonessential items are clear. Make sure employees are positioned safely away from the machine. Notify affected employees that it is coming back. Then remove the devices, and each lock comes off only at the hand of the employee who applied it. The standard allows a narrow exception when that employee is not on site, and only under a specific employer procedure that verifies they are away, makes reasonable efforts to contact them, and ensures they know their lock is gone before they return to work. Cutting a lock because someone went home and nobody followed that procedure is a violation, and a good way to kill the credibility of the whole program.
What is the difference between lockout and tagout?
A lock physically holds the isolating device in the safe position. A tag is a warning label, nothing more: it restrains nothing, it can be ignored, and it can fall off. The standard is honest about this. Under 1910.147(c)(2) and (c)(3), if an energy-isolating device is capable of being locked out, the employer must use lockout, unless it can demonstrate that its tagout program provides protection equivalent to a lock. That is a deliberately high bar. Tag-only programs belong on the shrinking set of older equipment with no lockable isolation point, and the standard pushes even that set toward zero: when equipment is replaced or gets a major rebuild, the new energy-isolating devices must be designed to accept a lock.
How does group lockout work?
When a crew services one machine, every worker still gets personal protection. 1910.147(f)(3) requires group lockout to provide each employee protection comparable to a personal lock, with primary responsibility vested in one authorized employee for the whole crew. The common pattern is a lockbox: the responsible authorized employee isolates the machine, locks each isolation point, and drops those keys into a lockbox. Every member of the crew then puts a personal lock on the box. Nobody can reach the keys until the last personal lock comes off. Eight workers, eight locks, one box, zero shortcuts.
Shifts change in the middle of long jobs, and the standard anticipates it: 1910.147(f)(4) requires an orderly transfer of lockout or tagout devices between off-going and on-coming employees so protection never lapses. In practice, the day-shift mechanic's lock does not come off until the night-shift mechanic's lock is on. If your shift handover for an open lockout is a verbal "she knows about it," the continuity the standard demands is not there.
How often does OSHA require lockout/tagout inspections?
At least annually, for every energy control procedure. Under 1910.147(c)(6), the periodic inspection must be performed by an authorized employee other than the one(s) using the procedure being inspected, must correct any deviations or inadequacies found, and must be certified. The certification must identify the machine or equipment, the date of the inspection, the employees included, and the person who performed it.
This is the requirement that quietly fails in most plants. The procedure was written once, the machine has been modified twice since, and nobody can produce this year's certification for it. Skipped periodic inspections and missing machine-specific procedures are classic citation drivers under this standard, and both are easy to check yourself: does every machine have its own procedure, and can you put your hands on the current year's inspection certification for each one? A serious internal safety audit asks exactly those two questions.
Who needs lockout/tagout training?
Everyone in the building, at one of three levels defined by 1910.147(c)(7):
- Authorized employees perform the lockout and the servicing. They must be trained to recognize hazardous energy sources, to know the types and magnitudes of energy present, and to know the methods for isolating and controlling it.
- Affected employees operate or work on the equipment being serviced. They must be trained on the purpose and use of the procedure, so they recognize an applied lockout and never attempt a restart.
- Other employees work in the area. They must know what the locks and tags mean and that removing, bypassing, or restarting locked-out equipment is prohibited.
Retraining is required when jobs, machines, or procedures change, and whenever the periodic inspection reveals employees deviating from the procedure. Between formal sessions, short refreshers do real work: lockout is a natural subject for toolbox talks and any servicing task you cover in a job safety analysis should name the specific lockout procedure it triggers, not just note "LOTO required."
What do the numbers say about lockout/tagout?
The standard has one of the clearest cost-benefit records in workplace safety:
- Lockout/tagout (1910.147) was the 4th most-cited OSHA standard in FY2025 per OSHA's top-10 list and it has appeared in the top 10 for decades. Machine guarding (1910.212), its normal-production counterpart, ranked 10th the same year.
- OSHA estimates that compliance with the standard prevents about 120 fatalities and 50,000 injuries each year.
- The full standard text is public and readable in one sitting: 29 CFR 1910.147, The control of hazardous energy (lockout/tagout).
Read those together and the picture is uncomfortable: the fix is well understood, it demonstrably works, and plants still get cited for it every year, mostly on the record-shaped requirements, machine-specific procedures and annual inspection certifications, rather than on the locks themselves.
That record-keeping gap is fixable. In most plants, lockout procedures, periodic inspection certifications, and training records live in binders, which is exactly why they go stale and go missing. Harmony is an AI-native layer that connects machines, software, and paperwork into one operational layer, with no rip-and-replace: paper logs, checklists, and forms become structured data captured on tablets at the station, searchable and auditable, which is the working core of connected worker technology. AI search returns cited answers from your own SOPs and records, so "show me this year's periodic inspection for press 3" becomes a ten-second query instead of a binder hunt. CLS made the same move for production logging, replacing paper with real-time operational intelligence. Harmony is not a safety-compliance product; it makes the records the standard already requires findable when the inspector, or the next mechanic, asks for them.