About Lockout/Tagout
Lockout/Tagout (LOTO) is a safety procedure that isolates and neutralizes hazardous energy sources on equipment before workers service or repair it, using a physical lock to hold an energy-isolating device in a safe position and a tag to identify who applied it and why. The lock prevents the energy source from being reactivated while the tag communicates the reason to anyone else near the equipment.
LOTO exists because equipment that looks switched off can still hold live electrical current, pressurized fluid, stored mechanical tension, or residual heat, any of which can injure a worker who assumes the machine is safe. This article covers how LOTO works, the OSHA rule behind it, the terms most often confused with it, and where it fits inside broader HSE compliance.
Getting LOTO wrong is one of the most consequential failure points in industrial safety. Unexpected startup or the release of stored energy during maintenance is a recognized hazard in manufacturing, utilities, and process industries. That risk is why LOTO sits among the most heavily enforced areas of US workplace safety regulation. A missed isolation step or a tag removed before work is complete can turn a routine repair into a fatality, with citations, halted production, and reputational consequences that follow.
How does LOTO work?
A LOTO procedure follows a defined sequence of six steps:
Notify affected workers that the equipment is about to be taken out of service.
Shut the equipment down through its normal stopping procedure.
Isolate the energy source at the energy-isolating device.
Apply a lock and tag to the isolating device.
Release or block any stored or residual energy.
Verify isolation by attempting to start the equipment before work begins.
Each worker exposed to the hazard applies their own personal lock, so the equipment cannot be reactivated until every individual has removed theirs at the end of the job.
Some sources present a seven-step version of this sequence instead of six, most often by splitting "identify every energy source on the equipment" into its own step before isolation, or by adding a final step confirming device removal once work is complete. The step count varies by training provider; the substance does not: notify, isolate, lock and tag, verify, and only then begin work. This is what separates LOTO from simply switching a machine off. The lock makes reactivation physically impossible for anyone but the worker who applied it, and the tag makes the reason visible to anyone who approaches in the meantime.
What is hazardous energy control?
Hazardous energy control is the broader safety principle LOTO puts into practice: the systematic identification and neutralization of every energy source that could unexpectedly harm a worker, including electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and gravitational energy. LOTO is the specific procedure used to control that energy during service and maintenance work. It also includes the upstream work that makes LOTO possible: identifying every energy source on a piece of equipment and documenting how each one is isolated before a lock is ever applied in the field. Without that groundwork, a lock and tag are only as reliable as the analysis behind them.
What does OSHA require for LOTO?
In the United States, LOTO is governed by OSHA's Control of Hazardous Energy standard, 29 CFR 1910.147, which requires employers to develop, document, and enforce energy control procedures for equipment capable of unexpected startup, energization, or the release of stored energy during servicing. The standard sets requirements for written procedures, employee training, periodic inspection, and standardized locks and tags, and it is consistently one of the most frequently cited standards in OSHA's annual enforcement data, a reflection of how often the procedure is documented on paper but not consistently followed on the floor. This regulatory context is cited here as background, not as a claim about any specific software's compliance status.
What is an energy-isolating device?
An energy-isolating device is the physical mechanism, such as a manually operated electrical disconnect switch, a line valve, or a circuit breaker, that a worker locks in a safe position to prevent an energy source from reaching a piece of equipment. It is the device the lock is physically applied to, not the lock itself. A valid energy-isolating device must be capable of being locked in the safe position independently of the equipment's normal operating controls, which is why a standard on/off switch usually does not qualify: it can be flipped back on by anyone, while an isolating device is built or adapted specifically to accept a lock. A LOTO procedure that identifies the wrong isolation point fails at the exact moment it is needed.
How does LOTO differ from a work permit?
A work permit is a broader authorization document confirming that specific conditions have been checked before higher-risk work, such as hot work, confined space entry, or excavation, is allowed to proceed; LOTO is one of the controls a work permit can require, not a substitute for it. A work permit answers whether it is safe to start a given job at all, covering hazards like fire risk, atmospheric conditions, or fall protection. LOTO answers a narrower question: has every hazardous energy source on this specific piece of equipment been isolated. A hot work permit for welding near a machine, for example, may also require that the machine be locked out, making LOTO a condition of the permit rather than a stand-in for it.
How does Management of Change relate to LOTO?
Management of Change (MoC) is the structured process organizations use to evaluate and control the risk introduced whenever equipment, a process, or a procedure changes, and it is what keeps an existing LOTO procedure accurate once that equipment changes. When equipment is modified, replaced, or rewired, its energy sources and isolation points can change too, which means a LOTO procedure written before the change may no longer be correct. MoC governs changes to the operation; LOTO governs energy isolation during a specific task. The two intersect wherever a change affects how a machine is isolated, which is why a LOTO procedure reviewed only once, at installation, tends to drift out of date over the life of an asset.
Why LOTO matters
LOTO failures carry a direct financial cost on top of the safety risk, since workplace injury is expensive to any organization that experiences it. Estimates put the direct and indirect cost of workplace injury in the United States at roughly $176.5 billion a year, and workplace injury in Great Britain is estimated to cost over 40 million lost working days annually. LOTO failures sit among the most severe categories of preventable industrial injury, which is why safety teams track leading indicators such as total recordable incident rate and lost time injury frequency to confirm energy control procedures are actually working, not just documented on paper.
The business case extends past the safety team. A LOTO-related incident halts the affected line, triggers an investigation, invites regulatory scrutiny, and can raise insurance costs for years afterward. Organizations that keep LOTO procedures accurate and consistently followed reduce exposure to all of these outcomes at once: fewer incidents, faster audits, and less unplanned downtime traced back to a preventable safety event rather than equipment failure.
From LOTO to executed work
LOTO on its own is a procedure, not a system of record: a written energy control procedure and a physical lock and tag confirm that a specific worker isolated a specific machine for a specific task, but they do not track which equipment has an active LOTO procedure in the field or connect that event to the maintenance work order it was protecting. Turning a documented safety procedure into a governed, auditable operational record is where Enterprise Asset Management software supports LOTO.
Ultimo's HSE Suite includes Lockout/Tagout procedures as a named capability, alongside work permits, Incident Management, and Management of Change, inside the same software asset professionals already use for work order management. Ultimo's EHS Compliance capability extends that support into the industry-specific regulatory requirements that sit alongside HSE, and Ultimo's HSE Manager digital worker can scan incoming work requests for safety-relevant signals and draft an incident report, adding a layer of detection alongside manual reporting.
LOTO in Ultimo
For Ultimo customers, LOTO is a named capability inside the same Enterprise Asset Management software that plans and tracks the maintenance work it protects. That software sits within Ultimo's Intelligent Asset Management category, alongside the work order management and asset data maintenance already runs on. A maintenance planner scheduling equipment service and a safety professional confirming energy isolation work inside the same platform, rather than reconciling two disconnected systems.
None of this replaces the physical discipline LOTO requires: applying the lock, verifying isolation, training the workers who perform it. Ultimo houses that discipline alongside the work order it protects, inside Intelligent Asset Management, not "maintenance software" or "modern CMMS."
Frequently Asked Questions
Frequently asked questions
What does LOTO stand for?
LOTO stands for Lockout/Tagout, a safety procedure that isolates hazardous energy sources on equipment using a lock on the isolating device and a tag identifying the worker and the reason, so the equipment cannot be reactivated while someone is servicing it.
Is LOTO required by law in the United States?
Yes. OSHA's Control of Hazardous Energy standard, 29 CFR 1910.147, requires US employers to develop, document, train workers on, and periodically inspect energy control procedures for equipment capable of unexpected startup or release of stored energy during servicing.
How many steps are in a LOTO procedure: six or seven?
Both counts describe the same underlying process. A six-step version covers notify, shut down, isolate, lock and tag, release stored energy, and verify. A seven-step version usually splits "identify the energy source" into its own step first, or adds a final device-removal step. The step count differs by training provider; the required actions do not.
What is the difference between lockout and tagout?
Lockout is the physical act of applying a lock to an energy-isolating device so it cannot be operated. Tagout is the label placed on that lock identifying who applied it and why. Lockout provides physical prevention; tagout provides a warning where a lock alone cannot be applied.
Does a work permit replace the need for LOTO?
No. A work permit authorizes a job to proceed once specific conditions are confirmed, and it can require LOTO as one of those conditions, but it does not isolate hazardous energy on its own. LOTO confirms a specific piece of equipment's energy sources have been isolated.
How does Management of Change relate to LOTO?
Management of Change (MoC) is the process organizations use to review the safety impact of a change to equipment or a process. Since equipment changes can change energy sources or isolation points too, an MoC review helps keep the affected LOTO procedure accurate rather than letting it fall out of date.
Where does LOTO fit inside a broader safety program?
LOTO is one control within a wider HSE and EHS compliance program that also covers work permits, incident management, and industry-specific regulatory requirements, executed at the equipment level but reviewed as part of the organization's overall compliance posture.