Lockout/tagout (LOTO) is a critical safety control for industrial servicing and maintenance. OSHA 29 CFR 1910.147 requires covered employers to establish an energy control program to address unexpected startup or release of stored energy during servicing and maintenance of machines and equipment. Written procedures, periodic inspections, employee training, and suitable energy-control hardware are program elements that must be checked against the actual machine, work scope, and site program.
This guide is source-aware planning information for reviewing LOTO permit quality. It highlights common documentation gaps such as incomplete energy source identification, procedure records that do not match the machine, missing periodic-inspection documentation, and unclear lock-removal controls. It is not a compliance determination, safe-work authorization, or substitute for current OSHA/state-plan review and qualified safety oversight.
Energy Source Identification: The Foundation
Every lockout procedure starts with identifying energy sources that could cause harm. OSHA describes hazardous energy in terms such as electrical, mechanical, hydraulic, pneumatic, chemical, thermal, gravitational, and any other energy that could injure workers. Missing a source - a gravity-loaded counterweight, a compressed spring, a capacitor bank, or residual pressure in a pneumatic line - can leave a procedure incomplete and unsafe.
The energy source survey should be conducted by someone who understands the machine's design and operation. Walk through every system: electrical supply (including control circuits and battery backups), hydraulic cylinders and accumulators, pneumatic lines and reservoirs, steam and hot water connections, compressed springs and counterweights, chemical feed lines, and thermal energy in heated vessels. Document each source, its magnitude, and the specific isolation point (disconnect, valve, block, bleeder).
Stored energy is a frequent survey gap. Shutting off the electrical supply does not remove the energy in a hydraulic accumulator, a pressurized air receiver, a heated oven, or a suspended load. Each stored energy source needs a site-approved dissipation or restraint step and a verification method appropriate to that energy type.
Complex machines with multiple energy sources may benefit from an energy source map: a diagram showing isolation points numbered to match the lockout sequence. Posting a durable map at the machine can help workers and reviewers compare the field layout with the written procedure, but the map still needs periodic review after equipment changes.
Electrical (line power, control circuits, capacitors, batteries)
Mechanical (springs, flywheels, counterweights, gravity)
Hydraulic (cylinders, accumulators, pressurized lines)
Pneumatic (air receivers, pressurized lines, air motors)
Thermal (steam, hot water, heated surfaces)
Chemical (process lines, feed systems, stored chemicals)
Lockout/Tagout Permit Manager
Create OSHA-compliant LOTO permits for equipment energy isolation. Track electrical, pneumatic, hydraulic, and thermal energy sources with lock assignments and zero-energy verification.
Written Procedures: What OSHA Requires
OSHA 1910.147(c)(4) requires documented procedures for covered machines or equipment unless the standard's limited exception criteria apply. Review the actual energy sources, lockout capability, stored-energy condition, and exclusive-control facts before treating a machine as eligible for a simplified procedure.
Each written procedure must include: a clear statement of the intended use of the procedure, the specific steps for shutting down the machine, the specific steps for isolating the machine from each energy source, the specific steps for applying lockout/tagout devices, the specific steps for verifying zero energy state (try-start or test), and the specific steps for restoring the machine to normal operation. The procedure must be specific to the machine, not a generic template.
The verification step is commonly skipped and should be documented clearly. A try-start or test may be appropriate under the site procedure after isolation and lock application, but the correct verification method depends on the energy type, equipment, instrumentation, and work controls. Failed, missing, or ambiguous verification needs correction before the record is treated as complete.
Procedures should be reviewed and updated when the machine is modified, energy sources are added or changed, or a periodic inspection reveals a deficiency. A procedure written before a hydraulic, pneumatic, electrical, or control-system change may no longer match the machine. Assign responsibility for procedure review to a specific role with a defined review schedule.
Group Lockout and Complex Operations
Group lockout applies when multiple authorized employees work on the same machine simultaneously. OSHA 1910.147(f)(3) requires that each authorized employee apply a personal lockout device to the group lockout device, group lockbox, or group lockout hasp. The fundamental principle: each worker controls their own lock. No worker removes another worker's lock. The last lock comes off only when the last worker has completed their task and verified the work area is clear.
The group lockout coordinator (primary authorized employee) is responsible for ensuring that all energy sources are properly isolated before anyone applies their personal lock to the group lockout point. The coordinator applies the first lock and verifies zero energy state. Other authorized employees then apply their personal locks. The coordinator ensures continuity of protection during shift changes by verifying that oncoming shift personnel apply their locks before outgoing personnel remove theirs.
Contractor lockout adds another layer of complexity. When outside contractors perform servicing on employer-owned equipment, OSHA requires the employer and contractor to inform each other of their respective LOTO procedures, and each must ensure that their employees comply. In practice, this means a pre-job meeting where the contractor's authorized employees are briefed on the specific machine's energy sources, isolation points, and the lockout sequence. The contractor's employees apply their own locks alongside the facility's locks.
Large-scale shutdowns (annual turnarounds, outages) may involve dozens of machines and many workers. These operations usually need a centralized coordination system: a lockout board or permit system that tracks every active lockout, the authorized employee responsible, and the current status. Paper-based systems can be hard to maintain at scale, while electronic systems still require site procedure review, access control, training, and field verification.
1. Coordinator isolates energy and verifies zero state
2. Each worker applies their OWN personal lock
3. No worker removes another worker's lock
4. Shift changes: incoming locks on BEFORE outgoing locks off
5. Last lock off only after final area clearance
Periodic Inspection Requirements
OSHA 1910.147(c)(6) requires an annual periodic inspection of the energy control procedure for each machine. The inspection must be performed by an authorized employee other than the one using the procedure. The purpose is to verify that the written procedure is still accurate, that authorized employees understand the procedure, and that the procedure is being followed correctly in practice.
The periodic inspection must include: a review of each employee's responsibilities under the procedure, a review of the specific procedure steps (ideally by observing the employee performing the lockout), and correction of any deviations or inadequacies identified during the review. The employer must certify that the inspection was performed by documenting the machine or equipment, the date, the employees included, and the inspector's identity.
The most common periodic inspection failure is treating it as a paperwork exercise. The inspector reviews the written procedure at a desk, signs the certification form, and files it. This catches errors in the documentation but misses errors in practice: an employee who skips the try-start, an employee who does not know about a recently added pneumatic cylinder, or an employee who uses a lock without a unique key. The inspection must include observation of the actual lockout being performed, with immediate correction of any deficiency.
Track inspection findings in a database or spreadsheet. Common findings that can indicate systemic problems include: employees not performing documented verification, written procedures that do not match the current machine configuration, employees not applying personal locks during group lockout, and lock-identification or key-control issues. Each finding should be routed to corrective action, retraining, or procedure revision under the employer program.