How to Run a Lockout/Tagout Verification Walkdown Before Maintenance

F2 how-to guide for maintenance supervisors and authorized employees

A lockout/tagout procedure can be complete on paper while the machine remains capable of unexpected movement, pressure release, or electrical energization. OSHA 29 CFR 1910.147 requires verification that isolation and de-energization have been accomplished before servicing begins, and this walkdown turns that requirement into a field decision.

The deliverable is not another signed form. It is a shared confirmation that the equipment, energy sources, isolation points, stored energy, workers, and restart conditions match the job plan before anyone enters the danger zone.

What you need before starting

Bring the current equipment-specific energy-control procedure, the work order, the isolation list, the line or electrical diagram, the authorized-employee roster, and the planned restoration sequence. The person leading the walkdown must be able to stop the job when the field condition does not match the written plan.

Use a route that follows the energy path rather than the order in which the form was completed. That choice matters because a form tends to group devices by label, while an exposure follows pressure, motion, gravity, electricity, heat, chemicals, or another source through the equipment. If the job involves several contractors, review the contractor interface review before mobilization before the walkdown begins.

Step 1: Define the maintenance boundary

Write down the exact equipment, subassembly, line, room, and task that the lockout must protect. Include adjacent equipment when its energy can cross the work boundary through a connected pipe, shaft, belt, control circuit, shared bus, pressure source, or gravity path.

Ask the maintenance lead to describe where the work starts and ends. The answer should identify the point at which a person could be exposed, not only the asset named on the work order. A common error is isolating a motor while leaving a connected actuator, elevated load, or upstream process capable of moving the part being serviced.

Step 2: Map every energy source

Walk the system and identify electrical, mechanical, hydraulic, pneumatic, chemical, thermal, gravitational, and stored energy. OSHA 29 CFR 1910.147 covers hazardous energy broadly, which means the review cannot stop at the main disconnect when another source can create the same exposure.

Use the equipment diagram as a prompt, then challenge it against the field. Ask which source could still move, pressurize, heat, fall, rotate, discharge, or start the equipment. NIOSH guidance on hazardous energy control emphasizes that maintenance injuries can occur across installation, servicing, repair, and adjustment, so the task sequence should determine the map rather than the job title.

Record the source, the isolation point, the release method, and the evidence that will prove zero energy. Where the diagram and the field disagree, stop the review and resolve the discrepancy before anyone applies a personal lock.

Step 3: Match each source to an isolation point

For every energy source, identify the device that actually interrupts transmission. A control button, software command, valve position indicator, or emergency stop may reduce activity without isolating the energy that can injure a person.

Ask the authorized employee to point to each device in the field and explain what it isolates. This creates two forms of evidence, physical location and technical understanding, which are stronger together than either one alone. The person who applies the lock should not have to infer the isolation point from a label that has never been checked.

Use the hierarchy of controls as a challenge to the plan when isolation is being replaced with distance, caution, or personal protective equipment. PPE may reduce residual exposure, but it does not prove that hazardous energy has been controlled.

Step 4: Confirm device identity and position

Compare the device tag, equipment identifier, location, and position with the energy-control procedure. A lock on the wrong disconnect is still a visible lock, which is why visual presence alone cannot establish protection.

Have the authorized employee trace the isolation from the equipment back to the source and then return to the equipment. The route should make sense in both directions. If a valve, breaker, blind, or disconnect cannot be identified without relying on memory, correct the identification before work starts.

Record discrepancies as conditions that block the job, not as minor housekeeping actions. James Reason’s work on latent failures is useful here because an incorrect label is created before the worker makes the final decision, yet it can shape that decision at the point of exposure.

Step 5: Apply locks and tags with clear ownership

Confirm who is authorized to apply the device, who is affected by the shutdown, and who controls the work group. Each personal lock should communicate ownership that remains clear during shift changes, contractor handoffs, and interruptions.

Ask the maintenance lead to explain what happens if the job runs beyond the planned shift. The answer should cover removal, transfer, notification, and reapplication without leaving a gap in protection. OSHA 29 CFR 1910.147 includes requirements for authorized employees, affected employees, group lockout, and shift or personnel changes because ownership can become unclear when the work outlasts the original plan.

If a contractor is involved, verify that the host and contractor procedures agree on device control, communication, and release. The contractor safety owner role should be visible before a shared isolation begins, not assigned after a disagreement.

Step 6: Release or restrain stored energy

Identify energy that remains after the primary source is isolated. Bleed pressure, discharge capacitors, block suspended parts, drain trapped fluids, secure springs, cool hot surfaces, and control any movement that could occur because of gravity or tension.

Ask what changes when the stored-energy control is removed, damaged, or bypassed. A lockout is incomplete when the team can name the disconnect but cannot explain how residual energy is neutralized or restrained.

Use an observable condition for each source. A pressure gauge at zero may support the decision, but it may not be sufficient if the gauge can be blocked, isolated, or damaged. Pair the reading with a drain, vent, block, restraint, or other physical confirmation whose failure mode has been considered.

Step 7: Verify isolation at the point of work

Test the equipment using the method defined by the procedure, then return controls to the neutral or off position. Verification should demonstrate that the machine cannot start or move through the expected control path and that the test itself does not create a new exposure.

Ask the person performing the task to describe what the test proves and what it does not prove. A failed start command does not verify every energy source, especially when a second feed, stored pressure, remote control, or mechanical connection remains possible.

For electrical work, use an appropriately rated test instrument and follow the site’s electrical safety requirements. For mechanical or process energy, use the defined release and try method. NIOSH’s hazardous-energy guidance supports this discipline because injury prevention depends on disabling and verifying the energy source before servicing, not on trusting the device position.

Step 8: Test worker understanding before entry

Ask each person entering the boundary to state the task, the controlled energy, the remaining exposure, the personal lock rule, and the condition that requires a stop. This is a short conversation, yet it reveals whether the isolation is understood by the people who will rely on it.

Do not treat a signature as proof of comprehension. The stronger test is whether the worker can connect the lockout point to the hazard and explain how protection will be maintained if the plan changes.

When the answer is uncertain, correct the plan or pause the work. Andreza Araújo’s Make The Difference: Be a Leader in Health & Safety treats leadership as an operating discipline, and in a lockout review that discipline appears when a supervisor values a clear stop over a fast signature.

Step 9: Check changes, interfaces, and temporary conditions

Review simultaneous work, temporary power, bypassed safeguards, line opening, testing, repositioning, production restart pressure, and any change to the original sequence. A lockout that was correct at 7 a.m. may not protect the same task after another crew changes the system.

Ask who owns each interface and what evidence will show that the condition remains controlled. The answer should identify a person, a physical condition, and a time for rechecking it. If the work changes from isolation to testing or positioning, stop and use the procedure that governs that temporary state instead of informally removing a lock.

The decision should also appear in the shift handover. A handover that says “LOTO complete” is weak evidence; one that identifies the isolated equipment, open boundaries, temporary controls, and next verification gives the incoming supervisor a usable picture.

Step 10: Release the job only after the evidence agrees

Compare the field findings with the procedure, the isolation list, the work order, and the worker explanation. Release the job only when all four tell the same story about what is isolated, what remains exposed, and who can stop the work.

Use one of three decisions. Start when the controls are verified, correct the plan when a discrepancy can be resolved before exposure, or stop and escalate when the control is unavailable or the energy path is uncertain.

Capture the verification record in a way that supports later review without turning the record into the control itself. The purpose of documentation is to preserve the decision and its evidence, while the protection still depends on the physical isolation and the people who maintain it.

LOTO walkdown: paper completion versus field verification

What to do when the walkdown fails

A failed walkdown is not an administrative inconvenience. It is evidence that the work plan and the physical system disagree. Keep the equipment in a safe state, identify the unresolved energy path, assign the technical owner, and define the evidence required to reopen the job.

Do not solve an isolation gap with a reminder to be careful. If the source cannot be identified, the device cannot be verified, stored energy cannot be controlled, or the crew cannot explain the boundary, the supervisor should stop the release decision until the condition is corrected.

Conclusion: release maintenance only when the field agrees

A LOTO verification walkdown works when it confirms the complete energy path, not when it produces another signature. The supervisor’s central decision is simple to state, although reaching it requires physical evidence, technical understanding, and the authority to pause work when those elements do not agree.

Andreza Araújo’s work connects engineering, creativity, and care because safety controls must protect real people under real operating pressure. If your maintenance system needs a stronger verification routine, talk to Andreza Araújo’s team about making the decision visible before exposure begins.