Lockout/Tagout Procedure: The 6 Steps and How LOTO Works
A clear lockout/tagout (LOTO) procedure — the six OSHA steps, energy isolation, verification, and why LOTO is essential before working on PLC-controlled machines.
Lockout/tagout (LOTO) is the formal procedure for isolating all hazardous energy sources on a machine or system before any maintenance, servicing, or repair work begins — and verifying that isolation is complete before anyone puts their hands in. It is defined and mandated in the United States by OSHA standard 29 CFR 1910.147, commonly called the Control of Hazardous Energy standard.
The procedure exists for a single reason: unexpected energization or release of stored energy kills and injures workers every year. Electrical shock, hydraulic line burst, pneumatic actuator stroke, or a conveyor suddenly starting under load are all preventable if energy is properly controlled before the work starts.
What Is Lockout/Tagout?
Lockout/tagout is a two-part control strategy:
- Lockout — a physical lock is applied to an energy-isolating device (a disconnect switch, a valve, a circuit breaker) in the de-energized or closed position so the machine cannot be started or energized until the lock is removed. Only the worker who applied the lock holds the key.
- Tagout — a standardized warning tag is attached to an energy-isolating device to identify who applied it, when, and why. Tagout is used when the energy-isolating device is not capable of accepting a lockout device.
OSHA 1910.147 establishes the overarching framework: it requires employers to develop a written energy control program, maintain machine-specific procedures for each piece of equipment, provide employee training, and audit compliance periodically.
The standard distinguishes between lockout (preferred, because it provides a physical barrier to re-energization) and tagout (acceptable only when the equipment design prevents lockout). A tag alone provides no physical restraint — it is a warning only. Whenever lockout is physically possible, it must be used.
Why Lockout/Tagout Matters: The Hazardous Energy Problem
OSHA estimates that failure to control hazardous energy accounts for roughly 10 percent of serious industrial accidents. The hazard is not limited to electricity. Any stored or flowing energy that can unexpectedly move, heat, pressurize, or electrify part of a machine creates a danger during servicing.
Modern automated equipment controlled by PLCs compounds the risk in several ways:
- A PLC output can activate a solenoid valve, motor starter, or servo drive while a technician is inside the machine envelope — even if the HMI shows the machine as stopped.
- Capacitors in drives and power supplies hold lethal voltage after the main disconnect is opened.
- Residual pneumatic or hydraulic pressure remains in cylinders, accumulators, and lines after isolation.
- Gravity-loaded axes (vertical robot joints, press slides, clamp cylinders) can move under their own weight the moment a brake or holding valve is de-energized.
None of those hazards go away because a PLC program issued a stop command. Only verified energy isolation eliminates them.
The 6 Steps of a Lockout/Tagout Procedure
OSHA 1910.147 outlines a sequence that must be followed in the order given. Machine-specific written procedures adapt these steps to the energy sources present on each piece of equipment.
Step 1: Prepare for Shutdown
Before touching any controls, identify all energy sources on the machine. This includes every electrical circuit, pneumatic supply, hydraulic circuit, steam or process fluid line, mechanical spring or counterweight, and gravity-loaded component. Consult the machine-specific LOTO procedure, the electrical panel schedule, and the pneumatic/hydraulic schematic.
Notify all affected employees — operators, supervisors, and anyone who uses or works near the machine — that it will be taken out of service and why.
Gather all required LOTO hardware: locks, hasps, tags, valve lockout devices, and any circuit breaker lockout clips needed for the specific equipment.
Step 2: Shut Down the Equipment
Bring the equipment to a normal, controlled stop using its standard shutdown sequence. This means using the machine's own stop controls — pushbuttons, the HMI, or the programmed shutdown routine — so that all moving parts reach a controlled rest position.
Do not attempt to isolate energy while the machine is under load, mid-cycle, or in a fault state that has not been cleared. A controlled stop reduces the likelihood of stored energy accumulating in an unpredictable state.
Step 3: Isolate All Energy Sources
Operate every energy-isolating device for the machine to the de-energized position. Isolation means:
- Opening and racking out the main electrical disconnect or circuit breaker.
- Closing all pneumatic supply ball valves or lockable shutoff valves.
- Closing all hydraulic supply isolating valves.
- Closing all process fluid or steam isolation valves.
- Blocking gravity-loaded components with physical restraints (safety pins, blocks, stands).
Each isolating device must be operated individually. Isolation at the machine's main incoming disconnect does not automatically isolate a separately fed control circuit, a UPS-backed PLC rack, or a battery-backed servo drive.
Step 4: Apply Locks and Tags
Apply a personal padlock to every energy-isolating device in the isolated (safe) position. Each lock must be uniquely keyed — no two workers share a lock, and no master key exists outside of emergency procedures defined in the written program.
Attach a standardized lockout tag to each lock showing:
- The name of the authorized employee who applied it
- The date and time applied
- The reason for the lockout
- Contact information
Where multiple isolating devices are present (a machine with three separate electrical feeds, two pneumatic supplies, and a hydraulic unit), a hasp allows multiple padlocks to be applied simultaneously to a single lockout point.
Step 5: Release or Restrain Stored Energy
Applying a lock to the isolating device does not eliminate energy already stored in the system. All residual energy must be dissipated or restrained before the work begins:
- Electrical capacitors in variable frequency drives (VFDs), servo drives, and DC bus capacitors must be allowed to discharge. Manufacturers publish minimum wait times (commonly 5–10 minutes) and some equipment has bleed-down resistors, but always measure with a calibrated meter before touching anything.
- Pneumatic pressure trapped in cylinders, lines, and accumulators must be bled down by opening dump valves or actuating cylinders to their mechanical stop with controls disabled.
- Hydraulic pressure in accumulators and trapped in cylinders must be relieved through the circuit's drain or bleed port — never by loosening fittings under pressure.
- Mechanical springs under compression or tension must be restrained with pins, blocking fixtures, or other physical means before the associated component is disassembled.
- Gravity-loaded components (robot arms, press slides, elevated conveyor sections) must be blocked or pinned so they cannot drop under their own weight.
This step is often where LOTO failures occur. Workers assume the machine is safe once the disconnect is open but before stored energy has been discharged.
Step 6: Verify Zero Energy State
Verify that isolation is complete and all stored energy has been eliminated before work begins. Verification must be active, not assumed.
Verification actions include:
- Attempting to start the machine using its normal start controls — if isolation is correct, nothing should happen.
- Measuring voltage at the machine terminals with a calibrated, CAT-rated voltage tester. Measure phase-to-phase, phase-to-neutral, and phase-to-ground on every isolated circuit.
- Confirming zero pressure on pneumatic and hydraulic systems with gauges.
- Manually attempting to move gravity-loaded components to confirm blocking is effective.
Only after all checks confirm a zero-energy state is work authorized to begin.
Types of Hazardous Energy
Understanding what you are isolating is a prerequisite for writing an effective machine-specific LOTO procedure.
| Energy Type | Common Sources on Automated Equipment | Isolation Method |
|---|---|---|
| Electrical | Main power feed, control circuits, UPS, servo drives | Disconnect switch, circuit breaker lockout |
| Pneumatic | Air supply to cylinders, solenoid valves, air motors | Lockable ball valve + pressure bleed |
| Hydraulic | Cylinders, clamping circuits, accumulators | Isolation valve + accumulator bleed |
| Mechanical | Springs, counterweights, gravity-loaded axes | Physical blocking, pins, support stands |
| Thermal | Heated platens, ovens, steam lines, process heat | Isolation valve + cool-down period |
| Chemical / Process Fluid | Coolant lines, lubricant circuits, chemical dosing | Isolation valve + drain/purge |
On a typical PLC-controlled machine, electrical and pneumatic energy are the most common, but any accumulator-based hydraulic circuit or heated tooling adds additional isolation requirements.
Locks, Tags, and Devices
Effective LOTO relies on the right hardware for each application.
Personal padlocks should be keyed differently from every other lock in the plant. Some programs issue color-coded locks by trade (electricians, mechanics, instrumentation) to make applied locks immediately identifiable.
Lockout hasps are essential when multiple energy-isolating devices must be locked simultaneously, or when group LOTO requires multiple workers to each apply their own lock to a single point. A hasp cannot be removed until all padlocks are removed, ensuring no single person can re-energize before everyone is clear.
Tags must meet OSHA requirements for durability, standardization, and legibility. Tags are not optional when locks are applied — they provide the identification and communication function that a lock alone cannot.
Device-specific lockout hardware includes:
- Circuit breaker lockout clips (handle-clamp style, sized to fit the specific breaker model)
- Pneumatic valve lockout covers (fit over ball valve handles to prevent reopening)
- Hydraulic valve lockouts
- Plug lockouts for 120V/240V receptacles
- Cable lockout devices for awkwardly positioned isolating handles
Every plant's LOTO program should maintain an inventory of device hardware that covers every isolation point on every machine. Missing hardware is a common audit finding.
Group Lockout Procedures
When more than one employee works on an isolated machine simultaneously, group lockout procedures apply. OSHA 1910.147 requires that each authorized employee applies their own personal lock to a group lockout hasp or lockout box before work begins. No individual can remove a lock belonging to another worker.
A designated lead authorized employee takes responsibility for:
- Verifying all isolation steps are complete before the group begins work.
- Controlling the group lockout box (a keyed box that holds the machine lock's key, with each worker applying their own lock to the box).
- Confirming that all workers are clear before any lock is removed.
On complex machines with multiple work crews (electrical, mechanical, instrumentation), the procedure must account for each crew's lock being independently applied and independently removed. The machine cannot be re-energized until every last lock is off.
Shift transfers require explicit lock exchange procedures — the outgoing shift cannot simply remove their locks and leave the incoming shift unprotected. The incoming worker applies their own lock before the outgoing worker removes theirs, so the machine is never unprotected during the handover.
The Controls Perspective: Why De-Energizing the PLC Output Is Not Enough
This is the most common misconception in PLC-controlled machine environments, and it is the one most likely to result in a serious injury.
Turning off a PLC output does not isolate the energy source. Consider what actually happens when an output bit is reset to zero:
- The PLC output module drops its signal voltage to the associated terminal.
- The relay or solid-state device on that output opens its contact.
- The downstream device (motor starter coil, solenoid valve, servo enable) loses its command signal.
What does not happen: the 480V supply to the motor starter is still present at the line-side terminals. The pneumatic supply pressure is still present upstream of the solenoid valve. Any downstream component can be re-energized immediately by the PLC itself (if a program bug, watchdog restart, or communications failure causes an unexpected output transition), by a wiring fault, or by another technician at the HMI who does not know the machine is being serviced.
The electrical isolation must happen at the energy-isolating device — the main disconnect, the circuit breaker — not at the output card.
Capacitor and VFD DC-Bus Discharge
Variable frequency drives and servo amplifiers present a specific hazard that often surprises technicians. The DC bus inside a VFD stores energy in large electrolytic capacitors. After the main disconnect is opened, this bus remains at voltages commonly between 400V and 800V DC. Manufacturers specify minimum discharge times (often five minutes, sometimes longer) and may include a "safe to touch" indicator light — but that indicator relies on the drive's own circuitry and should not be trusted without a meter measurement.
Before working on any drive, measure DC bus voltage between the documented test points with a CAT III or CAT IV rated meter. Do not rely on indicator lights alone. For drives with large bus capacitance (common in high-horsepower machinery), discharge times can exceed ten minutes.
Stored Pneumatic and Hydraulic Energy on Automated Machines
A typical machine tool or assembly machine will have pneumatic cylinders and circuit branches that retain pressure after the main supply valve is closed. Cylinders holding workpieces, clamps, or tooling may remain pressurized and capable of forceful actuation.
The LOTO procedure must identify every branch of the pneumatic circuit that can trap pressure and specify the action required to bleed each one. On machines with proportional valves and zone isolation, this often means manually actuating dump valves in sequence.
Hydraulic accumulators are designed to store energy — that is their function. They will maintain pressure after the pump is stopped and the circuit is isolated at the pump outlet. Every accumulator in the circuit must have an individual isolation valve and bleed point documented in the machine-specific procedure.
Verifying Zero Energy at the Panel
Panel entry — opening the main electrical enclosure to access terminals, wiring, or control components — demands the same rigorous verification as any other LOTO-covered task, even for what seems like minor work.
The verification sequence at the panel:
- Open the main disconnect and apply a circuit breaker lockout clip or a disconnect handle lock.
- Attempt to start the machine from its normal start control — no response confirms the disconnect is effective.
- Open the panel door. Measure voltage at the load-side terminals of the disconnect with a calibrated tester. Verify all three phases read zero volts phase-to-phase and phase-to-ground.
- If any control transformer, UPS, or separately fed circuit is present, measure those circuits independently.
- For panels with VFDs, wait the manufacturer-specified discharge time and then measure DC bus voltage before touching internal components.
Do not assume that a zero-reading on one phase means all phases are de-energized. Measure each phase individually. An open fuse or blown phase can make two phases read zero while the third remains live.
For panels containing safety relay modules or safety PLCs, verify that the safety relay is in the de-energized state and that its output contacts are open — these circuits are sometimes fed from separate control power that is not interrupted by the main disconnect.
Internal Links
Before performing LOTO work on control panels containing safety circuits, understanding how those circuits behave under de-energization is essential. The e-stop safety circuit in PLC ladder logic article covers how emergency stop circuits are wired and why they must be treated as energy sources in their own right during maintenance. For broader context on safety system design, functional safety basics explains the engineering framework that LOTO procedures support. If your plant work includes panel opening tasks near energized busbars, review what is arc flash for the separate electrical safety hazard that exists even during brief panel access.
Proper energy isolation also depends on machine guarding design — physical machine guarding and interlocks define the boundaries that LOTO protects during defeat.
Frequently Asked Questions
What are the steps of lockout/tagout?
The six steps of a lockout/tagout procedure are: (1) prepare for shutdown by identifying all energy sources and notifying affected employees; (2) shut down the equipment using its normal controls; (3) isolate all energy sources at their isolating devices; (4) apply personal padlocks and tags to every isolating device; (5) release or restrain all stored energy (electrical, pneumatic, hydraulic, mechanical); and (6) verify the zero-energy state by attempting to start the machine and measuring with appropriate instruments before work begins.
What is the difference between lockout and tagout?
Lockout uses a physical padlock to hold an energy-isolating device in the de-energized position so it cannot be re-energized. Tagout attaches a warning tag to an isolating device but provides no physical restraint. OSHA 1910.147 requires lockout wherever the equipment design allows it. Tagout alone is only acceptable when a machine cannot be locked out — for example, when an isolating device has no hasp or lock point. Because a tag provides only a warning and can be removed by anyone, lockout is always the preferred method.
What are the types of hazardous energy covered by LOTO?
OSHA 1910.147 covers all forms of hazardous energy: electrical (the most common), pneumatic, hydraulic, mechanical (springs, gravity loads, counterweights), thermal (heat, steam, process fluids), and chemical energy. A machine-specific LOTO procedure must identify and specify the isolation method for every energy type present on that particular machine.
Why isn't turning off the PLC enough to make a machine safe?
Turning off a PLC output removes the command signal to a device but does not remove the supply voltage or pressure that powers it. The electrical energy source is still present at the motor starter or solenoid, ready to re-energize if the PLC restarts unexpectedly, if a program fault clears, or if another operator sends a start command. True isolation requires operating the energy-isolating device (the disconnect switch, the supply valve) at the source and applying a physical lock — not commanding a stop through the control system.
