Lockout/tagout is the control of hazardous energy before and during servicing or maintenance. Its purpose is to prevent unexpected energization, startup, movement or energy release while people are exposed. Stopping a machine at its control panel, pressing an emergency stop, or opening a work order does not by itself establish a safe condition.
This article organizes the reasoning for maintenance, safety, engineering and planning professionals. It is not an energy-control procedure, training, job hazard analysis, work permit or authorization to perform an intervention. Every site must apply the law and standards of its jurisdiction, manufacturer instructions, its risk-management system, and procedures written and approved by people with the required competence and authority.
Which hazardous energies must be controlled?
The hazard is not limited to electricity. A stopped machine may retain pressure, suspended load, mechanical tension, heat, chemicals, vacuum or stored energy. Another process line may feed the equipment. A remote command, automatic sequence or shared utility can restore motion even when the local operator believes the machine is off.
- electrical energy: power, controls, auxiliary circuits, backfeed, capacitors and independent supplies;
- mechanical energy: rotation, inertia, springs, tensioned belts and parts that can move;
- hydraulic and pneumatic energy: pressure in accumulators, cylinders, hoses, lines and actuators;
- gravitational energy: loads, counterweights, tilted equipment, arms and raised components;
- thermal energy: surfaces, fluids, steam, heating and process inertia;
- chemical and process energy: reactants, flammables, pressurized fluids, vacuum and reactive material;
- interfaces: upstream and downstream equipment, automatic startup, distributed controls and third-party actions.
An energy map should connect each source to its energy-isolating device, dissipation or restraint method, verification method and accountable role. A generic list of energy types does not replace equipment-specific field identification.
The United States regulatory framework
For workplaces within its scope in the United States, OSHA 29 CFR 1910.147 establishes requirements for controlling hazardous energy during servicing and maintenance when unexpected energization, startup or release of stored energy could cause injury. It addresses an energy-control program, procedures, employee training, periodic inspection, application of control, release, group lockout, contractors and shift changes. The standard contains defined scope provisions and exceptions that must be read in the official text. This article does not replace that assessment.
Other OSHA provisions may apply to electrical work or sector-specific equipment. Company policy, collective agreements, state-plan requirements and consensus standards may also impose additional controls. The applicable requirements come from the work, equipment and jurisdiction, not from a generic document called LOTO.
Why the Brazilian NRs appear in the source material
The original Portuguese article was written for Brazil and therefore relies on the official NR-1, NR-10 and NR-12. Those regulations are Brazilian requirements within their respective scope. They do not govern a workplace merely because this English version cites them.
NR-1 provides the Brazilian occupational risk-management framework. NR-10 addresses safety in electrical installations and services. NR-12 addresses machinery and equipment, including authorization, isolation, energy discharge, locking of cut-off devices, signage and maintenance records. They offer useful source context and show why the procedure must be localized by jurisdiction rather than copied across countries.
Lockout and tagout perform different functions
A lockout device holds an energy-isolating device in a safe position and prevents operation until controlled removal. A tag communicates status, identity and warning under the applicable system. It does not provide the same physical restraint as a lock, blank, mechanical block or another suitable isolation device.
OSHA distinguishes lockout from tagout and sets additional requirements when tagout is used on equipment capable of being locked out. The exact determination belongs to the employer's compliant energy-control program. A tag attached to a start button should never be mistaken for isolation. Push buttons, selector switches, HMI commands, interlocks and emergency stops are control or protective functions, not automatically energy-isolating devices.
Stages of an equipment-specific lockout/tagout procedure
The following structure reflects the control logic, but it is not a field procedure. The actual document must identify equipment, isolating devices, people, instruments, sequence, exceptions, communication and acceptance criteria.
1. Prepare, define the boundary and authorize
Before shutdown, define the service scope, physical boundary, related equipment, workers, operating condition and required authorizations. Identify who coordinates the release, who performs each isolation, who verifies, who works within the boundary and who authorizes return to service.
Operations, maintenance, engineering, safety and outside employers must understand their interfaces. Simultaneous work can change the boundary. If another crew opens a line, moves a valve or energizes adjacent equipment, the energy-control plan must include that interaction.
2. Identify every source and isolation point
Use current drawings, diagrams, asset records, field inspection and knowledge from people who operate and maintain the equipment. Confirm main and auxiliary supplies, backfeed, pressures, gravity movement, stored energy and potential reaccumulation. Each source needs an energy-isolating device and a defined verification method.
Identification from memory is fragile. Design changes, temporary connections and field drift may make a previous map incomplete. A mismatch between the document and installation is a stop condition, not an item to correct after the job.
3. Notify affected employees and shut down in an orderly manner
Affected employees need to know which equipment will be removed from service and why. Shutdown follows the operating sequence to avoid creating pressure surge, spill, trapped material, loss of cooling or dropped load.
Orderly shutdown prepares isolation. It does not replace it. A stopped status on the control system does not prove separation from energy.
4. Physically isolate energy sources
Place each identified energy-isolating device in the safe position under the site's approved procedure. Electrical, process, hydraulic, pneumatic and mechanical isolations must be performed by people whose qualification and authorization match the applicable law and company rules.
The boundary needs to prevent energy from both directions when backfeed is possible. A control valve, relay, software command or interlock should not be assumed to provide physical separation without a technical basis.
5. Apply lockout or tagout devices under the approved system
Authorized employees apply devices to the energy-isolating points according to the procedure. Identification must remain legible and linked to the responsible person and job. Group work needs primary responsibility and protection for every authorized employee that is equivalent to personal application.
Shared keys without governance, unidentified locks, loose tags and informal removal break control and traceability. A digital work order does not correct a poorly applied physical device.
6. Relieve, disconnect, restrain or otherwise render stored energy safe
Energy may remain after isolation. The procedure defines how pressure is relieved, parts are blocked or restrained, capacitors and accumulators are handled, motion stops and heat or reaction is controlled. If stored energy can reaccumulate, verification must continue until servicing is complete or the possibility no longer exists.
Hydraulic or pneumatic support alone should not be presumed to hold a raised or articulated component. The restraint needs an engineered basis, suitable capacity and approved installation points.
7. Verify isolation and deenergization
Before work, an authorized employee verifies that isolation and deenergization have been accomplished. Verification is specific to the energy and uses approved methods, instruments and criteria. A control-panel indication, photograph, visible switch position or checked box is not enough when it does not test the hazardous condition.
Verification may include an attempt to operate controls followed by returning them to the neutral or off position, but one try-start does not prove every energy is controlled. Electrical absence-of-voltage testing and other technical checks remain subject to the applicable electrical rules and qualified-person requirements.
8. Perform the work and control changes
Work begins only after the site's release requirements are satisfied. The crew maintains the boundary and controls tools, parts, people and scope. If a field condition requires opening another system, moving a component, testing with energy or expanding access, work stops and returns to risk assessment, procedure and authorization.
Testing or positioning with energy is not an informal pause in LOTO. OSHA provides a controlled sequence for the limited removal of devices for testing or positioning, followed by deenergization and reapplication before further servicing. The site procedure must govern the exact steps and ensure that people are clear of the equipment.
9. Inspect, remove devices under control and return to service
Before removing devices, inspect the work area and equipment. Components must be operationally intact, nonessential items removed, and employees safely positioned. Lockout or tagout devices are removed by the employee who applied them unless the employer uses the narrow, specifically controlled exception allowed by the standard. Absence of the lock owner is never informal permission to cut a lock.
Affected employees are notified before startup. Energy is restored in a controlled sequence and the equipment goes through the site's acceptance and release criteria. A successful start does not automatically close the work order if guarding, documentation or safety conditions remain incomplete.
Work order, JHA, permit, procedure and record are not synonyms
| Document or control | Question answered | What it does not replace |
|---|---|---|
| Maintenance work order | What work will be performed, on which object, with which operations, resources and history? | It does not authorize exposure or prove isolation. |
| JHA, JSA or task risk assessment | Which hazards, scenarios and controls apply to the conditions of this job? | It does not apply a lock or replace the technical procedure. |
| Work permit | Is the activity released for the defined area, period, conditions and responsibilities? | It does not replace qualification, physical isolation or verification. |
| Energy-control procedure | Who does what, in which sequence, at which points, using which methods and contingencies? | It does not prove that field execution followed the plan. |
| Lockout/tagout record | Which sources and points were controlled, by whom, when and in which state? | It does not replace physical devices or field verification. |
A maintenance work order organizes execution and history. Risk assessment, permits and the energy-control procedure enter according to the hazard, jurisdiction and site system. A complete form still fails if no one confirms the actual installation.
Worked multi-energy case: conveyor with pneumatic diverter
This case is hypothetical and demonstrates reasoning only. It is not an authorization, field checklist or list of isolation points for another machine.
Job: replace the drive-pulley bearing on conveyor TC-204 and inspect its pneumatic diverter. The work requires guard removal, access near the belt and entry into the actuator area.
Boundary: TC-204, the upstream feeder, power panel, control circuit, pneumatic assembly, take-up counterweight and retained material. Operations, mechanical maintenance, electrical maintenance and safety participate under site rules.
| Source or condition | Possible effect | Control to be defined by the procedure | Expected verification |
|---|---|---|---|
| Motor electrical supply | Startup and belt movement | Energy-isolating point and prevention of reenergization identified in drawings and field, handled by an authorized employee | Electrical condition verified with the approved method and instruments |
| Auxiliary circuit and remote controls | Unexpected command or false state indication | Independent supplies and automatic logic included in the boundary, without relying only on the HMI | Inability to command hazardous motion within the defined condition |
| Diverter compressed air | Sudden actuator movement | Supply isolation, residual-pressure control and mechanical restraint when required | Pressure and position checked against procedure criteria |
| Counterweight and belt tension | Weight descent or belt displacement | Engineered mechanical restraint at defined points and capacity | Stability confirmed before access |
| Rotating-element inertia | Movement after shutdown | Defined condition for complete stop | Absence of motion confirmed |
| Retained material and upstream feeder | Falling material, pressure on parts or renewed feed | Material removal or containment and coordination with the upstream source | Work zone protected against feed and displacement |
How the case moves through governance
Maintenance planning prepares the work order with the technical object, scope, operations and resources, while release follows the site's safety system. The assessment shows that locking only the TC-204 motor would leave compressed air, counterweight, auxiliary control and upstream feed outside the boundary.
Operations performs the orderly shutdown and notifies affected employees. Authorized people isolate energy within their assigned responsibilities. Devices and identification are applied under the procedure. Pneumatic energy is controlled, the gravitational element receives engineered restraint, and retained material is addressed before access.
Verification is not one start attempt. Each source receives a coherent check. Electrical condition follows applicable electrical rules. Pressure, position, movement, load and interfaces use approved methods. A mismatch between drawing and field stops the release.
During disassembly, the crew finds shaft wear outside the scope. The discovery does not authorize expanded work. Engineering, operations and safety reassess boundary, time, resources and controls. The work order may be revised, but the physical energy-control state remains governed by the procedure and authorization.
Before return, the team confirms assembly, guards, tools, people, devices, records and outstanding conditions. Device removal and reenergization follow assigned responsibilities. Startup uses acceptance criteria. The final maintenance record documents the job, parts, as-left condition and responsible people.
Group lockout, outside employers and shift changes
For work covered by OSHA in the United States, group lockout/tagout must provide each authorized employee protection equivalent to personal application. A primary authorized employee coordinates the group, and each employee applies and removes a personal device to the group mechanism when beginning and ending work.
When servicing continues across shifts, specific procedures must provide for orderly transfer and continuity of protection. No one should silently enter or leave the protected group, and there can be no gap between outgoing and incoming responsibility.
When outside employers are involved, the on-site employer and outside employer inform each other of their respective lockout or tagout procedures under the OSHA provision. The site still needs operational coordination. A contract and orientation record do not resolve differences about isolation point, device, authority or release.
Exceptions require exact scope and stronger governance
OSHA 1910.147 contains scope exclusions and narrowly framed exceptions, including certain cord-and-plug situations, minor servicing under defined conditions, and hot-tap operations that meet all specified criteria. These provisions should never be reduced to convenient labels such as quick adjustment or production necessity. The employer must determine that every condition in the official text is met and that other applicable requirements are satisfied.
The standard also allows removal of a device by someone other than the employee who applied it only under a specific employer-directed procedure and training. It requires verification that the employee is not at the facility, reasonable efforts to contact that person, and ensuring that the employee knows about removal before resuming work. This is an exception, not a routine release method.
Outside the United States, these OSHA provisions do not create an exemption from local law. Every organization must evaluate the task against the legislation, regulator, standards, competence requirements and approved procedure of the actual jurisdiction.
What digital records can and cannot do
A system can improve traceability, availability and review of maintenance records. It can carry work-order text, operations and documents, organize resources and sequence, and return confirmations, technical notes, images, PDFs and measurements when applicable. It cannot turn digital evidence into a physical energy barrier.
PM Run operates in this planning, execution and record layer over SAP PM. It should not be presented as a documented lockout/tagout system. A checklist, photograph, signature or mobile status never replaces an energy-isolating device, stored-energy control, verification, qualification or authorization. Site-specific energy control remains governed by competent people and the approved procedure.
Audit questions for the energy-control process
- Does the energy map match the current installation?
- Does every source have an identifiable and suitable isolation point?
- Are control, emergency stop and interlock functions distinguished from isolation?
- Are stored energy and possible reaccumulation controlled and verified?
- Are training, qualification, authorization and responsibility current for each action?
- Do contractors and site teams share the same boundary and release rules?
- Does shift transfer maintain protection without a gap?
- Do energized testing and exceptional removal have formal governance?
- Does the record show what happened without becoming the sole proof of safety?
- Do findings and near misses update procedure, risk assessment and training?
A maintenance checklist can support preparation and closeout, but its safety items must come from the site procedure. Maintenance planning must treat isolations, releases, contractors and changes as real constraints rather than administrative attachments.
Official references
- OSHA, 29 CFR 1910.147, United States regulation for the control of hazardous energy within its scope.
- Brazilian Ministry of Labor and Employment, NR-1, Brazilian occupational risk-management context.
- Brazilian Ministry of Labor and Employment, NR-10, Brazilian electrical-safety context.
- Brazilian Ministry of Labor and Employment, NR-12, Brazilian machinery-safety context.
Frequently asked questions
What is lockout/tagout?
It is the process of identifying, isolating and controlling hazardous energy, applying lockout or tagout devices under the approved system, addressing stored energy and verifying the safe condition before servicing.
Is LOTO required in the United States?
OSHA 29 CFR 1910.147 establishes requirements within its scope for servicing and maintenance in which unexpected energization, startup or energy release could injure employees. The employer must assess the official scope and other applicable provisions.
Is a tag without a lock enough?
It must not be assumed to be enough. OSHA distinguishes lockout from tagout and imposes additional conditions when tagout is used on equipment capable of being locked out. The employer's compliant program determines the method.
Does an emergency stop replace lockout?
No. An emergency stop is a control and protective function. It does not prove isolation of all energy sources or prevent stored pressure, gravity, backfeed or reenergization by definition.
Does a work order authorize servicing?
No. The work order organizes scope, object, operations and history. Work begins only after the applicable risk controls, isolation, verification, permits and authorization are complete.
How does shift change work?
For work covered by OSHA, the procedure must provide an orderly transfer and continuous protection between outgoing and incoming employees. Site roles and devices must make that transfer explicit.
Who may remove a lockout device?
Normally the employee who applied it. OSHA permits another employee to remove it only under a narrow, employer-directed procedure with specific safeguards. Absence never authorizes informal removal.
Can an application control LOTO?
A documented system may support planning and records within its approved scope. It never replaces physical isolation, stored-energy control, verification, training or authorization. PM Run should not be presented as a lockout/tagout system.
To organize approved maintenance work, resources and records after safety and engineering define the method, see PM Run planning and mobility over SAP PM. The safe condition continues to depend on physical controls and site governance.
