Lockout/tagout process flowchart (LOTO hazardous energy control)

What the lockout/tagout process flowchart (loto hazardous energy control) process is

Lockout/tagout is how hazardous energy is controlled while someone works on a machine. The trigger is servicing or maintenance work — setting up, adjusting, clearing a jam, changing a die, replacing a bearing — anywhere an unexpected start-up or a release of stored energy could reach the person doing it. The control is physical rather than procedural: each energy source is isolated at a device that can hold it off, a lock the worker owns holds that device in place, and the machine is proved dead before hands go near it. The chart below follows one servicing job end to end: the challenge over whether the task needs full lockout, the equipment-specific procedure and the energy sources it lists, the notification to the operators, an orderly shutdown, isolation, locks and tags, a group lockbox where a crew is working, the release of stored energy, the test-and-try verification, the servicing itself with its shift handover and test-run detours, then restoration — tools out, guards refitted, area cleared, locks removed by the people who applied them, operators told, machine re-energised.

This is the machine-side control of energy under one servicing job, not the systems around it. It is not electrical safe isolation, where an authorised person proves the instrument, proves the circuit dead at the point of work and proves the instrument again; that work is handed to the maintenance and electrician lane. It is not process-plant isolation planning either, where a scheme is drawn from the P&IDs, valves are spaded or double-block-and-bleed, and a certificate is withdrawn in reverse order. Nor is it a permit-to-work system: a permit decides which jobs need authorisation and who may issue, perform and isolate, while lockout/tagout decides how the machine is made safe once that decision is taken. The reference in the United States is OSHA 29 CFR 1910.147; in Great Britain, regulation 19 of PUWER 1998, isolation from sources of energy; and ISO 14118 covers what the machine designer should have built in. The template is a starting point to adapt under your own procedures, the regulations where you operate and competent-person review; it makes nobody compliant.

Four decisions carry the process. The minor servicing challenge sits first because that is where most programmes leak: the exception is narrow, it holds only where alternative measures genuinely protect the person, and it belongs in the authorised employee's lane rather than being settled by whoever is in a hurry. The energy source gate catches the machine with a second supply, a hydraulic accumulator or a suspended load that the written procedure never mentioned, and it loops back to the procedure rather than forward into the job. The zero energy check is the only step that proves the previous five worked, so a failure there returns to re-isolation and re-verification instead of being noted and passed. And the lock removal question sits in the supervisor's lane on purpose: the one case where a lock comes off without its owner is exactly the case that needs a written exception, a search for the person and a record, not a bolt cutter and a shrug.

What this flowchart covers

In this template

• Four swimlanes (Authorised employee, Affected employee / operator, Supervisor / LOTO coordinator and Maintenance / electrician) across six phases: plan and notify, shut down and isolate, lock and tag, verify zero energy, servicing, and release and restore
• A "Minor servicing during normal production?" challenge before anything else, so a routine, repetitive task that is integral to production and already covered by alternative measures ends at "Work under documented alternative measures" rather than taking a machine out of service
• The planning half most lockout charts skip: the supervisor issues the equipment-specific procedure, "Procedure lists every energy source?" sends an incomplete one back to be rewritten, and "Notify affected employees before shutdown" happens before a single isolator is touched
• Isolation drawn as a sequence rather than one box: "Shut down by the normal stopping procedure" in the operator's lane, "Operate every energy isolating device" in the authorised employee's, then "Release stored energy and block moving parts" in the maintenance lane
• Group working modelled properly, with "More than one worker on the job?" routing a crew through "Add a personal lock to the group lockbox", and "Shift or crew change before completion?" passing the job on without the isolation lapsing between two crews
• Verification and release as gates, not formalities: "Zero energy at the point of work?" loops back through re-isolation on a failure, "Machine must run to test or position?" re-applies the control sequence after a test run, and "Every lock removable by its owner?" routes an absent owner through a documented removal

When to use this template

• You are writing or rewriting a lockout/tagout procedure and need one picture of who isolates, who locks, who verifies and who authorises the release
• Your machine-specific energy control procedures are inconsistent, and you want the shared steps agreed before the equipment-by-equipment documents are rewritten
• A crew works on the same machine at once, so the group lockbox, the shift handover and the lock transfer need to be drawn rather than improvised on the day
• An inspector, insurer or customer auditor has asked how hazardous energy is controlled during servicing, and the answer today is a drawer of lock logs
• Contractors service your equipment and their lockout procedure has to meet yours at the machine, at the lockbox and at the release

How it works

1. Rename the lanes to your roles

   Replace Authorised employee, Affected employee / operator, Supervisor / LOTO coordinator and Maintenance / electrician with the roles you actually use. The distinction that has to survive the rename is between the people who apply locks and the people who operate the machine. On a small site one person may hold both roles, but never on the same job at the same time.

2. List the energy sources on your machine

   Walk the machine and write down every source: electrical supply, control power, pneumatics, hydraulics, steam, process fluids, gravity and suspended loads, springs, capacitors, residual heat and pressure. Name the isolating device for each one and where it is, and note which a control switch or interlock only appears to isolate. That list is what turns a generic chart into an equipment-specific procedure, and what the second decision tests.

3. Decide what counts as minor servicing

   Write down the tasks you intend to run under the minor servicing exception and the alternative measures that protect the person doing each one. The exception covers work that is routine, repetitive and integral to production, and it collapses the moment somebody has to reach past a guard into the danger zone. Anything you cannot defend in writing goes down the full lockout branch, and the list is worth reviewing whenever the tooling changes.

4. Set the verification method

   State how zero energy is proved on each machine and by whom: a test instrument on the conductors, a gauge reading zero, a deliberate attempt to start with the controls returned to off afterwards. Record where the check is made, which is at the point of work rather than at the panel, and what happens on equipment where energy can build back up while the job runs, such as an accumulator recharging or a load that creeps.

5. Write your group lockout and handover rules

   Decide when a job becomes a group lockout, who holds primary responsibility for the crew, and what each person locks onto: a group lockout device, a lockbox or a comparable mechanism. Then write the shift change rule, so protection passes from one crew to the next without the isolation lapsing in between and without anyone standing behind a supervisor's single lock instead of their own.

6. Agree the lock removal exception

   The default is that a lock is removed by the person who applied it. Write the one exception down: how you confirm that person has left the site, how you try to reach them, who may authorise the removal, how it is recorded, and how the person is told before they return to the job. Then train the people who might one day have to use it, so the procedure is not read for the first time with a production line waiting.

7. Walk it against a real job

   Take two or three recent servicing jobs, including one that ran across a shift change and one that needed the machine energised for a test, and trace them through the chart. Any step people describe that is not drawn, or drawn but skipped in practice, is the finding worth fixing before the chart becomes the procedure and the basis of the periodic inspection.

Frequently asked questions

What are the steps in a lockout/tagout process?

The job is challenged first: is this minor servicing during normal production under alternative measures, or full lockout? If it does, the supervisor issues the equipment-specific procedure, checked against the machine until it lists every energy source. Affected employees are notified, the operator shuts the machine down by its normal stopping procedure, and the authorised employee operates every energy isolating device and locks and tags it. Where a crew is working, each member adds a personal lock to the lockbox. Stored energy is released, moving parts blocked, then the machine is tested and an attempt made to start it to confirm zero energy. The servicing runs, with a handover path for a shift change and a re-apply path if the machine must be energised to test. Afterwards tools come out, guards go back, each lock is removed by whoever applied it, and the machine is re-energised.

What is the difference between lockout and tagout?

A lock physically holds an energy isolating device in the safe position, so the machine cannot be re-energised while it is on. A tag is a warning on the same device: it tells people not to operate it, but restrains nothing. That is why they are not interchangeable. Under OSHA 29 CFR 1910.147, if an energy isolating device is capable of being locked out the employer's energy control programme must use lockout, unless the employer can demonstrate that a tagout system will provide full employee protection. Tagout survives mainly on older isolators that cannot accept a lock, and carries extra obligations: additional measures such as removing an isolating circuit element or a valve handle, tags attached so they cannot come off accidentally, and training on the limitations of a tag. The standard also expects isolating devices on new or modified equipment to be designed to accept a lock.

Who is an authorised employee and who is an affected employee?

The two terms come from OSHA 29 CFR 1910.147 and are worth using precisely, because training and notification differ. An authorised employee is a person who locks out or tags out machines or equipment in order to perform servicing or maintenance on that machine or equipment: their locks go on the isolators and they verify zero energy. An affected employee is an employee whose job requires them to operate or use a machine on which servicing or maintenance is being performed under lockout or tagout: the operators and line staff who cannot run the machine while it is locked. A third group, described in the standard as all other employees, work in the area and need only know never to attempt to restart equipment that is locked or tagged. That is why this chart keeps the first two in separate lanes, and why notification appears twice: before the controls go on and after they come off.

How do you verify zero energy, and why does the try step matter?

Verification proves that everything before it worked, and it is done where hands will go rather than at the isolator. The method follows the energy: a test instrument on the conductors for an electrical supply, a gauge reading zero for pneumatics or hydraulics, a visual check that a blocked or chocked component cannot move, a temperature check where heat is the hazard. The try step is the second half. With the isolation applied and stored energy released, the authorised employee operates the normal start controls to confirm nothing runs, then returns every control to off. Skipping that reset is the classic failure: the machine starts by itself the moment isolation is lifted, sometimes hours later and with somebody else beside it. Where energy can build back up, verification has to be repeated or maintained for the duration of the job.

What does an inspector expect a lockout/tagout programme to contain?

More than locks. Under OSHA 29 CFR 1910.147 the programme has three parts: documented procedures, training, and periodic inspection. The procedures are machine-specific and set out the scope, purpose, authorisation and techniques for controlling hazardous energy. The standard allows a narrow exception for simple equipment meeting a set of conditions, among them a single energy source that fully de-energises the machine, no stored energy hazard, and one lock under the authorised employee's control. Training differs by role for authorised, affected and other employees. The periodic inspection is carried out at least annually by an authorised employee other than the one using the procedure inspected, and includes a review with each authorised employee of their responsibilities. Where outside servicing personnel work on site, the two employers inform each other of their procedures.