LOTO stands for lockout/tagout: the procedure for isolating a machine from its energy sources, locking and tagging the isolation points, and proving it can't restart or release stored energy before anyone services it. In the US the rule is OSHA 29 CFR 1910.147, and the standard is written for exactly one kind of work: servicing and maintenance.
What LOTO stands for
LOTO is short for lockout/tagout (also written lock out, tag out). OSHA's formal name for it is the control of hazardous energy.
The word "loto" means other things too. It's the hero of an old video game, a word for "heart" in Tongan, and flor de loto is the lotus flower. On a plant floor, though, LOTO always means the lockout procedure.
The problem it solves is simple. A machine that's switched off is not a safe machine. Someone can switch it back on. A capacitor can still be charged, a hydraulic line can still hold pressure, a raised ram can still fall. LOTO exists to make sure none of that happens while a person's hands are inside the guard.
Lockout vs tagout: not the same thing
The two halves of the name do different jobs.
- A lock physically holds an energy isolating device (a disconnect, a valve, a breaker) in the off position. Nobody can turn it back on without removing the lock, and only the person who fitted it has the key.
- A tag is a warning. It tells people not to operate the device and who to ask, but it doesn't stop anyone from doing it.
That's why OSHA treats them differently. If an isolating device can be locked, lockout is required, unless the employer can demonstrate that a tagout program gives full employee protection, equivalent to a lock. In practice that means locks go on wherever they physically can, and the tag goes on the lock so everyone knows whose it is.
One detail catches people out: push buttons, selector switches, and other control-circuit devices are not energy isolating devices. Pressing the stop button and hanging a tag on it isn't lockout. The isolation has to happen at the point where energy actually enters the machine.
The LOTO steps, in order
Ask five safety trainers how many steps there are and you'll hear six, seven, or eight. The difference is just how they're grouped. The sequence itself comes straight from OSHA 1910.147(d) and (e):
- Prepare. Before touching anything, the authorized employee identifies every type and magnitude of energy the machine uses, the hazards, and how to control each one. On a well-run site this is already written down in a machine-specific procedure.
- Notify. Tell the operators and anyone else working nearby (OSHA's "affected employees") that the machine is about to be shut down and locked out.
- Shut down. Stop the machine using its normal stopping procedure, so the shutdown itself doesn't create a hazard.
- Isolate. Operate every energy isolating device: the electrical disconnect, the air supply valve, the hydraulic isolation valve. Not just the obvious one.
- Apply locks and tags. Each authorized employee fits their own lock and tag to each isolation point.
- Release stored energy. Bleed off pressure, discharge capacitors, block or lower raised parts, let hot parts cool. If energy could build back up, keep checking until the work is done.
- Verify zero energy. Before starting work, try to start the machine. Press the start button and test the circuit. Then return the controls to off. This is the step that catches the isolator that turned out to feed a different machine.
- Do the work, then release. When the job is finished, remove tools, refit the guards, check that everyone is clear, tell the affected employees, and only then does each person remove their own lock.
Example: clearing a jam on a hydraulic press (illustrative, build yours from the machine's own procedure)
| Step | What it looks like on this press |
|---|---|
| Prepare | Procedure lists three sources: 415 V supply, hydraulic power unit, and the ram's own weight |
| Notify | Operator and line lead told the press is going down for a jam clearance |
| Shut down | Ram stopped at top of stroke, cycle switched off from the operator panel |
| Isolate | Main disconnect off; HPU isolation valve closed |
| Apply locks and tags | Technician's lock and tag on the disconnect and on the valve |
| Release stored energy | Accumulator bled to zero on the gauge; ram lowered onto blocks |
| Verify zero energy | Start button pressed, nothing moves; pressure gauge reads zero |
| Work and release | Jam cleared, guard refitted, area checked, locks removed by the person who fitted them |
The energy sources people forget
Electrical isolation is the step nobody skips. The injuries tend to come from everything else:
- Hydraulic. Accumulators and trapped pressure in cylinders hold energy long after the pump stops.
- Pneumatic. Air left in the lines and reservoirs downstream of a closed valve.
- Stored mechanical. Compressed springs, tensioned belts, flywheels still spinning down.
- Gravity. A raised ram, a lifted platen, a counterweight. If it can fall, block it.
- Thermal. Hot dies, ovens, steam lines.
- Chemical. Process lines that need to be drained, purged, or blanked.
This is where the "4 types of LOTO" searches come from. There's no official list of four. Count the energy sources on your own machine and that's the number you need to control.
Who can apply and remove a lock
OSHA splits people into two groups:
- Authorized employees lock out machines in order to service or maintain them. They need full training on the energy sources and procedures.
- Affected employees operate the machine or work in the area. They need to know what lockout is and that they must never try to restart locked-out equipment.
The removal rule is strict: each lock is removed by the person who put it on. If that person has gone home with the key still on the machine, the employer can only remove it under a documented procedure. That procedure has to verify the person isn't on site, make every reasonable effort to reach them, and make sure they're told before they start their next shift.
Two situations make this harder in maintenance than anywhere else:
- Group lockout. When a mechanical fitter, an electrician, and a contractor all work on the same line, each person attaches their own lock, usually to a group lock box or a multi-lock hasp. The machine can't be restarted until the last lock comes off.
- Shift changes. A long repair that runs past the end of a shift needs a specific handover so protection never lapses. The incoming crew's locks go on before the outgoing crew's come off.
OSHA also requires the energy control procedure itself to be inspected at least once a year, by an authorized employee who isn't one of the people using that procedure.
LOTO, JSA and permit to work
These three often show up on the same job, and each does something different:
| What it does | When | |
|---|---|---|
| Job safety analysis (JSA) | Works out the hazards and controls, step by step, for a task | When the job is planned |
| Permit to work | Formally authorizes a specific high-risk job to start, today | Before the work begins |
| LOTO | Physically isolates the machine's energy while people work on it | For the whole duration of the work |
The JSA usually lists lockout as one of its controls, the permit checks that the lockout is actually in place, and the locks themselves do the protecting.
Outside the US, the same idea goes by different names. Canada's standard is CSA Z460, which treats lockout as the primary method for controlling hazardous energy. The UK's HSE refers to safe isolation. ISO 14118 covers the machine-design side, building in features that prevent unexpected start-up in the first place.
Why LOTO breaks down in maintenance
Lockout/tagout is the third most cited OSHA standard on the agency's preliminary list for fiscal year 2026, and it's been in the top ten for years. Most of those plants have a LOTO program on paper. The failures tend to look like this:
The procedure is generic, not machine-specific. "Isolate all energy sources" is written on a laminated card for the whole plant. The technician at the press still has to work out where the hydraulic isolation valve is, and whether there's a second supply.
Isolation points aren't documented per asset. The person who knew that the conveyor has a second disconnect behind the panel retired last year. Nobody wrote it down against the machine.
Group lockouts lose track at shift change. Three crafts, two shifts, one lock box, and a whiteboard. At 6 a.m., nobody is sure whose lock is still on and why.
The work order and the lockout never meet. The job lives on a work order. The lockout lives in a lock box and a paper log. The work order gets closed when the repair is done, but whether the locks came off properly, and who verified zero energy, isn't recorded anywhere the next technician will look.
Where LOTO connects to maintenance software
LOTO is a physical control. No software replaces a padlock or the act of trying the start button. But the jobs that need lockout are the same jobs that live as work orders and preventive maintenance tasks in a CMMS, and that's where the machine-specific part belongs.
In MachDatum, each job type carries its own checklist and instructions, and a preventive maintenance plan's checklist goes out on every work order the plan generates. So the isolation steps for a specific machine can sit on the work order the technician is already holding: isolate the main disconnect, close the HPU valve, bleed the accumulator, try-start. Ticking them off leaves a record of who did each step and when. When an isolation point changes, updating the checklist means every future work order on that machine carries the new step.
It's the same principle behind the breakdown maintenance process, where making the machine safe is step one, and behind routine checks like fire safety inspections. A safety step only works if it's in front of the person doing the work, at the moment they do it.
If your lockout steps live on a laminated card and your jobs live in a spreadsheet, see how MachDatum CMMS handles work orders and checklists.
