Lockout tagout and electrically safe work condition field guide

Lockout/tagout, and why re-energization is what kills

Lockout/tagout is how you make sure the thing you are working on cannot turn back on while your hands are in it. You isolate every source of energy, you secure each isolation point with a lock and a tag, you release whatever energy is stored inside, and then you prove it is dead. Skip any one of those and the equipment is still capable of hurting you, no matter how confident you feel about the off switch.

The hazard LOTO controls is unexpected energization. A machine starts because someone on the other side of the building flipped a switch. A circuit comes back because a feeder you did not know about was still hot. A press cycles because the hydraulic accumulator still had pressure in it. OSHA estimates the standard prevents roughly 120 deaths and 50,000 injuries a year, and the deaths are the caught-in and the electrocution kind, the ones where the energy showed up at the moment a person assumed it could not.

On electrical work the assumption is the enemy. The breaker is off, so the panel is dead, so it is fine to reach in. That chain has three guesses in it and a body at the end. LOTO replaces the guesses with a lock you control and a meter reading you took yourself. Everything in this guide is built to get you to one state: the circuit is dead, it is going to stay dead, and you proved it.

Which standard does what: 1910.147, 1910.333, and NFPA 70E

Three documents get named around this work and they cover different ground. OSHA 1910.147, the control of hazardous energy, is the general lockout/tagout rule for servicing and maintenance: the written program, the equipment-specific procedures, the training, the locks and tags, and the periodic inspection. It covers all hazardous energy, not just electrical, and it is the rule an OSHA compliance officer opens first on a LOTO citation.

OSHA 1910.333 is the electrical-specific safe work practices rule. It sets the default that you work de-energized, and it carries its own requirements for locking and tagging the disconnecting means before work on or near exposed parts. Its lockout provisions overlap 1910.147 but are written for the electrical case, and where both apply you meet the stricter reading. The construction side has parallel rules in 1926 Subpart K.

NFPA 70E is the consensus standard for electrical safety in the workplace, and it gives the method: the process for establishing and verifying an electrically safe work condition, including the absence-of-voltage test that OSHA requires but does not spell out step by step. OSHA does not publish NFPA 70E, but it treats the standard as a recognized way to meet the electrical duty. The adopted edition and the site's own written program control the specifics, so confirm the clause before you cite it.

The energy is not just electrical

Open the disconnect and you have handled one source. LOTO exists because equipment usually has more than one, and the second one is the one that bites. The standard covers electrical, mechanical, hydraulic, pneumatic, thermal, chemical, and gravity energy, because any of them can move a part or carry a charge after the main switch is off.

Electrical work has its own stored charge. Capacitors hold voltage after the supply is gone, and a large drive, a power-factor capacitor bank, or a UPS can sit lethal for a while after you open the feeder. The capacitor is the classic one a new hand walks past, because it looks dead and reads dead on a non-contact tester right up until it discharges through them. You bleed it down and you verify it, you do not assume the time delay did it for you.

The mechanical sources travel with electrical equipment more than people expect. A motor-operated breaker has charging springs. A damper or a valve actuator has spring return. A suspended load, a counterweight, or a raised platform has gravity waiting on it. Hydraulic and pneumatic systems hold pressure in accumulators and lines after the pump or compressor stops. Releasing or blocking every one of those is part of the same procedure, and the equipment-specific lockout procedure is where each source for that machine is supposed to be listed so nobody has to remember them all.

What are the steps of lockout/tagout?

The sequence is the same every time, and the order matters because each step sets up the next. Identify every energy source feeding the equipment. Notify the affected people that it is going down. Shut the equipment down by its normal stop. Isolate it by opening the disconnecting means for each source. Lock and tag each isolation point. Release or block the stored energy. Then verify the absence of voltage by testing, which is the step that turns a de-energized circuit into an electrically safe work condition.

NFPA 70E lays this out as the process for establishing and verifying an electrically safe work condition, commonly cited at 120.5 in recent editions, with the absence-of-voltage test as its own step. The exact step numbering shifts between editions, so confirm it against the adopted edition. The principle does not move: you do not have a safe condition until you have tested for the absence of voltage, with everything before it being the setup that makes the test trustworthy.

The two ends of the sequence are where crews cut corners. At the front, they shut down without finding the second source. At the back, they lock and tag and then skip the meter, treating the lock as the proof. The lock keeps the source open. The meter proves there is no voltage. They are not the same thing, and the meter is the one that touches the question your body is actually asking.

Shut down and isolate: open the disconnect, not just the control

Shutting equipment down and isolating it are two different acts. The normal stop, the e-stop, the HOA switch, the control-power button: those turn the machine off. They do not isolate it. A control circuit can be energized while the machine is stopped, and a controller can re-close a contactor on its own. The disconnecting means is the device that actually breaks the circuit and that you can lock in the open position.

Open the disconnecting means for every source you identified, and confirm it open the way you can see. On a fused disconnect or a switch, that is the blades pulled clear. On a draw-out breaker, that is the breaker racked to the disconnected position where the stabs are out of the bus, not just tripped to off. A breaker handle in the off position is a position the breaker can leave on a fault or a mechanical failure; the racked-out or physically opened state is the one you trust.

This is where people lock the wrong thing. A pushbutton, a selector switch, or a PLC output is not a disconnecting means, and a lock on it secures nothing. Find the device that interrupts the energy and is built to be locked open. If the only thing within reach is a control device, you have not isolated the equipment yet, and the procedure for that machine should point you at the disconnect that does the job.

The lock and the tag: one worker, one lock, one key

The lock holds the disconnect open. The tag says who put it there and why, so nobody removes it and nobody re-energizes the circuit. They work together, and on electrical work you want both, because a tag alone is a warning while a lock is a barrier. A tag asks people not to operate the switch. A lock makes them unable to.

The rule that protects the worker is one person, one lock, one key. Every worker who is exposed puts their own lock on the isolation point, and keeps the only key to it. As long as your lock is on, the circuit cannot be restored, and you do not depend on anyone else's judgment about whether you are clear. The single key matters: a lock with a duplicate key in the foreman's truck is a lock the worker does not actually control.

The shortcut that gets people hurt is one lock for the crew, usually the lead's lock, with everyone else trusting it. Now one person's decision to pull their lock re-energizes a circuit four other people are still inside. When more than one worker is on the job, you do not share a lock. You use group lockout, where each worker still controls their own protection, which the group-lockout section covers.

What is the live-dead-live test?

The live-dead-live test is how you prove a circuit is actually dead, and it is the single step that keeps you alive when everything before it was done right and one thing was still wrong. You verify your voltage tester works on a known live source, you test the circuit you are about to touch and read zero, then you verify your tester still works on the known live source again. Live, dead, live. Same meter, all three readings, in that order.

The second live check is the part people skip and the reason the test exists. A meter can fail between the moment you proved it and the moment you read the dead circuit. If it died in your hand, the dead circuit and a truly faulted meter both read zero, and a broken meter is how a worker reaches into a hot panel believing they checked. Proving the meter again afterward, on a source you know is live, is what tells you the zero you read was real and not a dead instrument.

Do it with the right tool and the full reading. Use a rated meter, matched to the voltage and the measurement category of the system, not a non-contact proximity tester. The proximity pen is a screening tool to tell you something might be hot; it is not the proof that something is dead. NFPA 70E calls for testing each conductor, phase-to-phase and phase-to-ground, so a single open phase or a backfed leg does not hide behind one reading. Test every conductor you could contact, including the neutral and the ground where the system makes that meaningful. This is the step. Treat it that way.

Authorized, affected, and qualified: who does what

LOTO sorts people into roles, and the roles decide who touches the locks. The authorized employee is the one who applies the lockout and performs the servicing. The affected employee operates the equipment or works around it but does not do the servicing, and their job in the procedure is to be notified before it goes down and before it comes back. Everyone else on site is an other employee, who needs to know not to touch a locked-out device.

The line that matters is that only an authorized employee locks out, and only the authorized employee who applied a given lock removes it. An affected employee who restarts equipment because they thought the work was done is exactly the failure the role structure is built to stop. Affected does not mean uninformed; it means told, both times.

Electrical work adds the qualified person. A qualified person is trained and knowledgeable in the construction and operation of the electrical equipment and the hazards involved, and it is a qualified person who establishes and verifies the electrically safe work condition, opens the gear, and runs the absence-of-voltage test. Being authorized for LOTO is not the same as being qualified for the electrical exposure during isolation and verification. The work that puts a person at energized parts is qualified-person work, and the site program defines who has earned that designation.

Group lockout, the lockbox, and the hasp

When more than one worker is exposed, group lockout keeps the one-person-one-lock rule intact for everyone. The simple version is a hasp: a multi-hole clamp on the disconnect that takes several locks, so each worker hangs their own and the disconnect cannot close until the last one comes off. Good for a small crew on a single isolation point.

When the job has many isolation points, you use a group lockbox. The crew locks out every disconnect, drops the keys for those locks into a box, and then each worker puts a personal lock on the box. Now no isolation key can come out until every worker has removed their own lock from the box, which means every disconnect stays locked open while a single person is still working. OSHA requires each authorized employee to affix a personal device to the group mechanism, so each worker controls their own protection rather than trusting a primary-authorized-employee's lock to cover them.

The discipline is that you put your lock on the box when you start and you pull it when you personally stop, not when the shift ends or when someone says the job is done. A lockbox with a worker's lock still on it means a worker is still exposed somewhere in the system. That is the whole point of the box, and it only works if people lock on and lock off honestly.

Shift change and continuity of lockout

A lockout has to survive a shift change without ever leaving the equipment unprotected. The hazard is the gap: the off-going crew pulls their locks, and for a moment the disconnect is closeable before the on-coming crew applies theirs. The procedure has to make sure the protection is continuous, with the incoming worker's lock on before the outgoing worker's lock comes off.

On a group lockbox this is clean, because the incoming worker adds their personal lock to the box and the outgoing worker removes theirs, and the box never opens. On individual locks it takes a deliberate handoff at the isolation point, lock-on before lock-off, with the change documented so the record shows who is protected at any moment. The site's energy-control procedure should spell out exactly how the transfer happens, because an unwritten handoff is where the gap opens.

The rule under it does not bend: no period exists where the equipment could be re-energized while someone is still working on it. If you cannot hand the lockout over cleanly, you re-establish it from the start on the new shift rather than leaving a window.

Can you remove someone else's lock?

No. The default rule is firm: each lock is removed by the worker who applied it. You do not cut another person's lock to keep the job moving, you do not pull it because you are sure they are gone, and a supervisor does not have a master key that makes it acceptable. The lock means a person believed they were protected by it, and removing it puts the burden of that belief on whoever cut it.

There is one narrow exception, and it is built to be hard to use. When the authorized employee who applied the lock is genuinely not available to remove it, OSHA allows the employer to remove it under a documented procedure that is part of the written energy-control program. That procedure has to verify the employee is not at the facility, make all reasonable efforts to contact them, and ensure they are informed that their lock was removed before they return to work. It is a last resort with a paper trail, not a routine.

The reason for the strictness is the worst case it prevents. A lock removed while its owner is still inside the equipment, gone for lunch, or unreachable, and the equipment re-energizes onto them. The exception exists so a forgotten lock on an empty machine does not shut a plant down, not so a crew can clear a colleague's lock on a Friday. Before any lock comes off under the exception, someone confirms the person and the machine are actually clear.

When a device cannot be locked: tagout-only

Lockout is the preferred method, and tagout-only is the fallback for the case where a disconnecting means physically cannot accept a lock. Some older switches and devices were never built with a way to lock them open. Where one of those is the isolation point, a tag goes on instead, and the rules around it get tighter, not looser, because a tag is a warning and not a barrier.

OSHA treats tagout as a lesser control and requires extra means to make up the difference. If the energy-isolating device can be locked, it has to be locked; tagout-only is permitted where the device cannot accept a lock or where the employer can demonstrate the tagout program gives protection equivalent to lockout. When tagout stands alone, you add an additional safeguard that provides a level of safety equivalent to a lock, such as removing a fuse, opening an extra disconnect, blocking a control switch, or removing a valve handle, so the circuit cannot be restored by the single act the tag is warning against.

The honest field position is that a missing lock provision on modern gear is usually a reason to use a different isolation point, not a reason to live with tagout. Look upstream for a device you can lock. Tagout-only is for the case where there is genuinely no lockable isolation point, and even then it carries an extra layer.

The energized moment: arc flash during isolation and verification

There is a window in every electrical lockout where the worker is exposed to live parts, and it is the part people forget when they think of LOTO as the safe alternative to working hot. Operating the disconnect, racking a breaker, and running the absence-of-voltage test all happen while the equipment is still energized or potentially energized. You are not in an electrically safe work condition yet; you are in the act of establishing one, and the shock and arc-flash hazards are fully present.

So the PPE for that window is the PPE for energized work, not for the dead circuit you are about to create. Operating gear and testing for absence of voltage put you inside the arc-flash boundary and the shock approach boundaries, which means arc-rated clothing matched to the incident energy and the right voltage-rated gloves for the test. The arc-flash study and the gear label tell you the energy and the boundary for that specific equipment, and the arc-flash field guide covers how that number is set and what the label has to carry.

Once the absence of voltage is verified and the condition is established, the arc-flash hazard from that source is gone, which is the entire reason de-energizing is the default. The trap is gearing down for the test as if the circuit were already dead. The test is the most dangerous moment of the job, because it is the one where you deliberately put a meter on something to find out whether it can kill you.

Backfeed and alternate sources: the hidden re-energization

The source you opened is not always the only source, and the one you missed is the one that kills, because you already proved the obvious feed dead and stopped looking. Backfeed is voltage arriving on a circuit from somewhere other than the supply you locked out, and on a modern building there are more paths for it than there used to be.

The usual suspects are a standby generator that can pick up the load through a transfer switch, a UPS that keeps a panel alive after the utility feed is open, and photovoltaic that pushes power back into a circuit any time the sun is on it, sometimes from the load side where you do not expect a source at all. Add control-power transformers that feed a control circuit from a different supply, a second utility feed or a tie breaker on a double-ended substation, and capacitor banks holding charge, and the list of things that can re-energize a dead-looking circuit gets long.

The defense is the same two steps that govern the whole procedure. Identify every source on the front end, using the one-line diagram and a real field walk-down, not just the panel schedule. Then test for absence of voltage on the conductors you will actually touch, phase-to-phase and phase-to-ground, because that test catches a backfed leg that no amount of opening the main supply would have. A circuit fed from two directions is dead only when both directions are open and the meter confirms it.

Temporary power, generators, and LOTO

Construction temporary power gets worked on live more than almost any other system, because it is temporary and the crew is moving fast, and 277 or 480 V on a temp feeder is exactly as lethal as it is on a permanent one. The temporary label changes nothing about the physics. Before you work on a temp panel, feeder, or device, you isolate it, lock and tag the disconnect, release any stored energy, and verify it dead, the same as anywhere else.

Generators make the backfeed problem concrete on a temp site. A genset feeding the system through a transfer switch can re-energize conductors after the utility or the other source is open, and an improperly connected portable generator can put voltage onto a circuit a worker thinks is isolated. Know what feeds what, lock out the source that actually controls the circuit, and do not assume a dead tool means a dead circuit, because someone can restore a temp feeder you are standing in if it is not locked. The temporary power field guide covers how the temp system is built and bonded, including the generator cases.

The thing to carry from this onto a jobsite is that GFCI protection is for the people using the tools, not for the person working on the wiring. A GFCI catches a ground fault to protect a worker holding a drill. It does nothing for the line-to-line contact you make reaching into a live panel. Lock it out, verify it dead, then open it up.

The written energy-control program and procedures

A lock and a meter are the field tools; the written program is what makes them a system instead of one careful worker's habit. OSHA 1910.147 requires an employer whose people service equipment where unexpected energization could injure them to have a written energy-control program, and the program has three legs: documented procedures, training, and periodic inspection.

The equipment-specific procedure is the part that earns its keep on the floor. For each machine or system, it lists the energy sources, the isolation points, the steps to shut down and isolate, the means to release stored energy, and how to verify the isolation, so the worker is not reconstructing all of that from memory at the disconnect. A generic one-page LOTO policy is not an equipment-specific procedure, and the difference is exactly what an inspector looks for after an incident.

Training and inspection close the loop. Authorized employees are trained to apply the procedure, affected employees are trained to recognize a lockout and stay clear, and the program is inspected periodically, commonly at least annually, to confirm the procedures are still accurate and still being followed. The inspection is also where stale procedures get caught: a machine got modified, a source got added, and the written steps never followed it. The most common LOTO citations are the predictable ones, missing written procedures, thin training, and the skipped periodic inspection.

Contractor coordination on multi-employer sites

When more than one employer works on the same equipment, the locks have to be coordinated or someone gets cleared by a crew that did not know they were there. OSHA requires the on-site employer and any outside contractor to inform each other of their respective lockout procedures, and each crew has to understand and respect the other's program. The host does not assume the contractor's locks cover the host's people, and the contractor does not assume the host cleared the equipment for them.

On the floor this means a worker from one company never relies on a lock applied by another. Each exposed worker applies their own lock, often onto a shared group mechanism so every employer's people are independently protected, and the two programs are reconciled before the work starts, not discovered at the disconnect. A common point of failure is a contractor brought in for a quick job who works under the host's lockout without applying their own, and is then exposed when the host's authorized employee clears it.

The fix is boring and it works. Walk the isolation with both parties, confirm whose procedure governs, and make sure every individual at risk has a personal lock in place. The coordination is a planning conversation, and the time to have it is in the pre-job, where the cost of getting it wrong is a question instead of an injury.

The 24/7 facility and the no-shutdown tension

Critical facilities create the hardest LOTO problem on purpose: a data center, a hospital, or a continuous-process plant is built so the load never drops, which is the opposite of what de-energizing a circuit requires. The pressure to work hot is structural, not lazy, and that is exactly why the discipline has to be tighter, not looser, in the buildings where the temptation is strongest.

The default in NFPA 70E still holds, even here. Energized work is allowed only under narrow justifications, when de-energizing would introduce a greater hazard or is genuinely infeasible because of the equipment design, and it runs under an energized electrical work permit with the hazard assessed and the controls in place. A redundant, concurrently maintainable design is what lets a facility de-energize one path at a time and lock it out while the load rides on the other path, which turns most no-shutdown jobs back into normal lockouts on a single branch.

Two facility-specific wrinkles sit on top of the lockout. The emergency power off system can re-energize or de-energize parts of the room in ways that interact with a lockout, so the EPO scheme and the lockout boundaries have to be understood together, not in isolation. And selective coordination and the live parts that stay energized to keep the rest of the room up mean a worker can be inside locked-out gear that sits next to gear that is fully alive. The arc-flash and shock hazards from the adjacent live equipment do not go away because your branch is dead, and the energized moment during isolation and verification is sharper where the available fault current is high.

What to document

The record is what proves the sequence happened and what a reviewer reads after an incident or before a restart. The point is to tie each step to an action and a check, so the lockout can be reconstructed by someone who was not there. Write the lockout down and the record stands for the work after an incident; on a group job it is also how you know who is still protected and who has cleared.

Capture the equipment, the energy sources that were identified, the isolation points that were locked and tagged, the stored energy that was released, the absence-of-voltage verification, who is protected, and the authorized employee and time. The verification line is the one that matters most: that the meter was proven live, read dead phase-to-phase and phase-to-ground, and was proven live again. The table below maps the sequence to the action and the verification that backs it.

Common mistakes

• Skipping the absence-of-voltage test, or trusting a non-contact proximity tester as the proof a circuit is dead.
• One lock for the whole crew instead of a personal lock and a single key per exposed worker.
• Forgetting stored energy: a charged capacitor, charging springs, hydraulic or pneumatic pressure, or a suspended load.
• Missing a second feed or a backfeed source: a generator, a UPS, photovoltaic, a tie breaker, or a control-power transformer.
• Locking a pushbutton, selector switch, or control device instead of an actual disconnecting means.
• Removing another worker's lock to keep the job moving instead of going through the documented exception.
• Using tagout with no lock where the device could have been locked or another lockable point existed upstream.
• Gearing down for the absence-of-voltage test as if the circuit were already dead, when that test is the energized moment.
• Re-energizing without a walk-down or without notifying the affected employees first.

Field checklist

Standards and references

OSHA 1910.147, the control of hazardous energy, is the general lockout/tagout rule for servicing and maintenance, and it carries the written energy-control program, the equipment-specific procedures, the training, the lock and tag requirements, the only-the-applier-removes rule and its narrow exception, the group-lockout provisions, and the periodic inspection. It applies to all hazardous energy, not just electrical. The construction sector has parallel requirements in 29 CFR 1926 Subpart K.

OSHA 1910.333 is the electrical-specific safe work practices rule, setting the de-energized default and the lockout and tagging of disconnecting means for work on or near exposed parts; its lockout provisions overlap 1910.147 and apply to the electrical case. NFPA 70E, the Standard for Electrical Safety in the Workplace, gives the method for establishing and verifying an electrically safe work condition, commonly laid out at 120.5 in recent editions, with the test for absence of voltage as its own step requiring testing phase-to-phase and phase-to-ground. The exact section numbers shift between code cycles, so confirm them against the adopted edition and any local amendments before citing them.

OSHA makes the duty enforceable; it does not publish NFPA 70E but recognizes it as a means of meeting the electrical safety obligation. Equipment listings and manufacturer instructions govern the gear itself, and the employer's written energy-control program and the equipment-specific procedures control the specifics on a given machine. Cite the rule that controls the point: 1910.147 for the energy-control program, 1910.333 for electrical safe work practices, NFPA 70E for the safe-work-condition method, and the site program and adopted editions where they apply.

Units, terms, and abbreviations

Lockout/tagout carries a vocabulary that reads differently across a written program, a tag, and the standards, and the same idea shows up under more than one name. The terms below are the ones that travel across the whole subject.

LOTO

Lockout/tagout, isolating and securing energy sources so equipment cannot be re-energized while someone is servicing it

Hazardous energy

Any energy that can injure on release: electrical, mechanical, hydraulic, pneumatic, thermal, chemical, or gravity

Electrically safe work condition (ESWC)

A state where a circuit is de-energized, locked and tagged, tested to verify the absence of voltage, and grounded where required

Authorized employee

The worker who applies the lockout and performs the servicing on the equipment

Affected employee

A worker who operates or works near the equipment but does not perform the servicing, and who must be notified

Qualified person

A person trained in the construction and operation of the electrical equipment and its hazards, who establishes and verifies the safe work condition

Live-dead-live

Proving a voltage tester on a known live source, testing the circuit dead, then proving the tester again to confirm it did not fail

Backfeed

Voltage arriving on a circuit from a source other than the supply that was opened, such as a generator, UPS, or photovoltaic

Group lockbox

A box holding the isolation keys, with each exposed worker's personal lock on it, so no key comes out until all workers are clear

Related tools

Calculators and readiness checks for this work

Compare your options

FAQ

People also ask

• What is incident energy in an arc-flash study?
• Does construction temporary power need GFCI?
• What are the arc flash PPE categories?
• What is arc energy reduction?
• What do you do if someone is being shocked?