Lockout tagout (LOTO): what it is, the steps, and what OSHA 1910.147 requires

What is lockout tagout? Lockout vs tagout

LOTO is short for lockout/tagout, also written lock out tag out. It is named after the two kinds of device that hold a machine safe. 29 CFR 1910.147(b) defines lockout as placing a lockout device, such as a keyed or combination padlock, on an energy isolating device so that the device and the machine it controls cannot be operated until the lock comes off. Tagout is placing a tagout device, a prominent warning tag with a secure attachment, on the same kind of point to show that it may not be operated until the tag is removed.

The difference matters on the floor. A lock is physical: nobody can close the disconnect without cutting it off. A tag is only a message. 29 CFR 1910.147(c)(7)(ii)(A) makes the point in the training rules: tags are warning devices and do not give the physical restraint a lock gives, and 1910.147(c)(7)(ii)(E) adds that a tag can give a false sense of security.

An energy isolating device is the thing that actually cuts the energy: a manually operated circuit breaker, a disconnect switch, a line valve, a block. Under 1910.147(b), push buttons, selector switches and other control circuit devices are not energy isolating devices. An emergency stop or a guard interlock stops the machine through the control circuit. It does not isolate it, and a lock on an e-stop is not a lockout.

Types of hazardous energy LOTO controls

1910.147(b) defines an energy source as any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal or other energy. The standard also treats a machine as energized if it still holds residual or stored energy after it is disconnected. Appendix A, OSHA's non-mandatory sample procedure, lists the stored energy to look for: charged capacitors, compressed springs, raised parts of the machine, flywheels still turning, hydraulic systems, and pressure held in air, gas, steam or water lines.

Stored energy is where lockouts fail. The power is off, the machine looks dead, and an accumulator, a spring or a raised platen still holds enough energy to injure. 29 CFR 1910.147(d)(5)(i) requires all potentially hazardous stored or residual energy to be relieved, disconnected, restrained or otherwise made safe after the locks go on. Where it can build up again, as with a slowly leaking valve upstream of a cylinder, 1910.147(d)(5)(ii) requires the check to continue until the work is done.

Removing locks and restarting the machine

Taking a machine out of lockout has its own sequence under 29 CFR 1910.147(e). First the work area is inspected so tools, rags and loose parts are gone and the machine is operationally intact, 1910.147(e)(1). Then the area is checked so that every person is clear or safely positioned, 1910.147(e)(2)(i). Each lock or tag is removed by the person who put it on, 1910.147(e)(3). After the devices are off and before the machine starts, affected employees are told, 1910.147(e)(2)(ii).

The common floor problem is the lock left on by someone who has gone home. The exception to 1910.147(e)(3) allows a lock to be removed under the employer's direction only through a specific written procedure, with training, that gives equivalent safety. It must at least include verifying the person who applied it is not at the facility, 1910.147(e)(3)(i), making all reasonable efforts to contact them, 1910.147(e)(3)(ii), and making sure they know before they start work again, 1910.147(e)(3)(iii). Bolt cutters and a supervisor's say-so are not that procedure.

Some jobs need power for a moment during the work, to jog a conveyor into position or test a sensor. 1910.147(f)(1) gives the order for that: clear tools and materials, get people out of the area, remove the locks as in paragraph (e)(3), energize and test or position, then de-energize and reapply the full lockout from paragraph (d) before work continues. The test run is a short restart, not a pause in the lockout.

Group lockout: when a crew works on one machine

When a crew, craft or department services a machine together, 29 CFR 1910.147(f)(3)(i) requires a group procedure that protects each person as well as their own personal lock would. 1910.147(f)(3)(ii) sets out what it must include.

• One authorized employee holds primary responsibility for the people working under the group lock, 1910.147(f)(3)(ii)(A). The standard gives an operations lock as an example of a group device.
• That person can check the exposure status of each member of the group, 1910.147(f)(3)(ii)(B).
• When more than one crew or department is involved, one authorized employee coordinates the whole job and keeps protection continuous, 1910.147(f)(3)(ii)(C).
• Each authorized employee puts a personal lock or tag on the group lockout device, group lockbox or similar when they start, and takes it off when they stop working on the machine, 1910.147(f)(3)(ii)(D).

A common way to run it is a lockbox. This example is illustrative. A conveyor drive needs three isolation points: the motor disconnect, the air supply and a pin in the take-up. The lead authorized employee locks all three points with group locks and drops the three keys in the lockbox. Two mechanics and an electrician each put a personal lock on the box. Count the locks twice: 3 group locks on the points plus 3 personal locks on the box is 6 locks in use; the other way, 3 isolation points and 3 people, 3 + 3 = 6. The box cannot open until the last person has finished and taken their own lock off.

Contractors bring their own program. Under 1910.147(f)(2), the plant and the outside employer tell each other about their lockout procedures, and the plant makes sure its own people understand and follow the restrictions of the contractor's program.

The energy control program and written procedures

A hazardous energy control program is the set of three things 29 CFR 1910.147(c)(1) requires an employer to establish: energy control procedures, employee training, and periodic inspections. Together they make sure every machine is isolated and made inoperative before anyone services it.

The procedures must be developed, documented and used, 1910.147(c)(4)(i). 1910.147(c)(4)(ii) says what each one must contain:

• A specific statement of what the procedure is for, 1910.147(c)(4)(ii)(A).
• The steps for shutting down, isolating, blocking and securing the machine, 1910.147(c)(4)(ii)(B).
• The steps for placing, removing and transferring locks and tags, and who is responsible for them, 1910.147(c)(4)(ii)(C).
• How to test the machine to verify the locks, tags and other controls work, 1910.147(c)(4)(ii)(D).

The note to 1910.147(c)(4)(i) lets an employer skip documenting the procedure for a machine only when all eight of its conditions hold, among them a single energy source that is easy to identify and isolate, no stored or residual energy, a single lock that achieves lockout under the exclusive control of the person doing the work, and no past accidents from unexpected activation of that machine. Most production machines fail at least one of those, so most need their own written procedure. The free lockout tagout procedure template is laid out for one machine: an energy table with each isolation point numbered against a photo, the steps from shutdown to restart, the authorized employees and the review record.

Who may lock out matters as much as how. Only the authorized employees doing the servicing perform lockout or tagout, 1910.147(c)(8). The definitions in 1910.147(b) separate authorized employees, who lock out machines to service them, from affected employees, who operate the machine or work in the area where it is serviced. The training rules in 1910.147(c)(7)(i)(C) add everyone else whose work may take them into that area.

LeanSuite runs written procedures on a phone or tablet: Lockout/Tagout (LOTO) requires a photo of each applied lock at the correct isolation point before the next step opens, only opens a procedure for someone with a valid Authorized Employee certification for that machine, shows every active lockout on a live floor map with who holds each lock and for how long, and gives each procedure an owner and a review date with an alert before it lapses.

Lockout tagout training and retraining

29 CFR 1910.147(c)(7)(i) requires training so that employees understand the purpose and function of the program and have the knowledge and skills to apply, use and remove the controls safely. The depth depends on the role.

Retraining is required for authorized and affected employees when their job assignment changes, when a machine, piece of equipment or process changes in a way that brings a new hazard, or when the procedure changes, 1910.147(c)(7)(iii)(A). It is also required when a periodic inspection shows, or the employer has reason to believe, that someone's knowledge or use of the procedure has gaps, 1910.147(c)(7)(iii)(B). The employer certifies that training is done and kept up to date, with each employee's name and training dates, 1910.147(c)(7)(iv). A training matrix with expiry dates is the usual way to see who is authorized on which machine.

Common lockout tagout mistakes

• Locking the e-stop or the selector switch. Control devices are not energy isolating devices under 1910.147(b). Lock the disconnect, the valve or the block.
• Skipping the verify step because the machine looks off. 1910.147(d)(6) requires proof before work starts, and the try is the only test that tells off from dead.
• Forgetting stored energy. Air left in a cylinder, a raised elevator, a charged accumulator. 1910.147(d)(5)(i) requires each one to be released or restrained.
• One generic procedure for every machine. Most machines fail the eight conditions in the note to 1910.147(c)(4)(i) and need their own written procedure.
• A procedure that no longer matches the machine. A new air drop or a moved disconnect makes the sheet wrong. The annual inspection under 1910.147(c)(6) is where it gets caught, and a change to the procedure triggers retraining under 1910.147(c)(7)(iii)(A).
• Removing someone else's lock. Only the person who applied a lock removes it, 1910.147(e)(3), unless the written exception procedure is followed in full.
• Treating jam clearing as minor servicing. If the guard comes off or a hand goes into the danger zone, it is covered by 1910.147(a)(2)(ii).
• Using LOTO locks for other jobs. Lockout devices are for energy control only, 1910.147(c)(5)(ii).