Lockout/Tagout Explained: 4 Isolation States Before Maintenance Starts

Maintenance risk often survives the moment someone turns a machine off. A motor can stop while stored electrical, hydraulic, pneumatic, thermal, gravitational, or chemical energy remains available to injure the person who opens the equipment.

Lockout/tagout, usually called LOTO, matters because it converts an intended shutdown into an evidenced isolation. The decisive question is not whether the equipment stopped. It is whether every relevant energy source has been identified, isolated, dissipated, and verified before work begins.

Lockout/tagout is a documented method for controlling hazardous energy during servicing and maintenance. Under OSHA 29 CFR 1910.147, the authorized employee applies an energy-control device, releases or restrains stored energy, and verifies isolation before starting work. The method protects people by proving the equipment cannot restart or release energy unexpectedly.

What does lockout/tagout control?

Lockout/tagout controls hazardous energy that could start equipment, move a component, pressurize a line, heat a surface, release a chemical, or allow a suspended load to fall. OSHA 29 CFR 1910.147 applies to servicing and maintenance where unexpected energization, start-up, or release of stored energy could cause injury.

The scope is broader than electrical power. A technician may isolate a disconnect and still face hydraulic pressure, compressed air, elevated temperature, rotating inertia, gravity, or a chemical reaction. The energy-control procedure must therefore describe the equipment, each energy source, each isolation point, and the verification method.

OSHA provides the regulatory baseline through its control of hazardous energy standard. The National Institute for Occupational Safety and Health also explains why unexpected start-up and stored energy remain serious maintenance hazards in its energy-control guidance.

4 isolation states every maintenance leader should separate

The four states below describe increasing evidence that hazardous energy is under control. Treating them as interchangeable creates false confidence, especially when a shutdown has been completed but isolation has not been tested.

1. Stopped equipment

Stopped equipment is no longer moving or producing its normal process output. This is an operating condition, not proof of isolation. A stop command, emergency stop, control-panel button, or software instruction may leave the energy path intact.

Use this state to begin the shutdown sequence, never to authorize exposure. The supervisor should ask what could restart the equipment and what energy could still move, fall, flow, heat, or discharge if a person opens the system.

2. De-energized equipment

De-energized equipment has had its primary energy sources disconnected or isolated. The disconnect, valve, breaker, blank, or other device is placed in the position intended to prevent transmission of energy.

De-energized does not automatically mean safe. Capacitors may retain charge, pressure may remain trapped between valves, and a raised component may still be supported by gravity rather than a positive restraint. The written procedure needs a specific step for each stored-energy hazard.

3. Locked and tagged equipment

Locked and tagged equipment has an energy-isolating device secured with a lock and identified with a tag that communicates ownership and the prohibition against operation. The lock makes restoration more difficult without deliberate removal. The tag makes the human responsibility visible.

OSHA distinguishes an energy-isolating device from a control-circuit device because a control button does not physically prevent energy transmission. That distinction is why a LOTO procedure should name the physical isolation point instead of accepting a generic instruction such as “turn the machine off.”

When more than one person is exposed, the group method must preserve individual protection. A group lockbox or equivalent arrangement can coordinate the job, but each exposed employee still needs a personal means of control under the employer’s procedure.

4. Verified zero-energy condition

Verified zero energy is the work authorization state. The authorized employee confirms that isolation is effective by testing for the expected condition and attempting a controlled start where the procedure requires it, then returning controls to the neutral or off position.

Verification must match the hazard. An electrical absence-of-voltage test may be necessary for electrical conductors, while a pressure gauge, drain, vent, visual confirmation, blocking device, or temperature check may be required for other sources. A single test cannot prove that every energy source is controlled.

HSE guidance on isolating plant and equipment reinforces the same practical principle. Isolation is not complete until the person doing the work can rely on a physical barrier and a check that demonstrates the barrier works.

How can a supervisor differentiate the four states?

A supervisor can differentiate the states by asking for evidence rather than accepting status words. “The pump is off” describes stopped equipment. “The breaker is open” describes one isolation action. “My lock is attached” describes ownership. “The start attempt failed and pressure was released” begins to demonstrate verified zero energy.

This distinction supports the same control logic used in hazardous-energy isolation verification. It also prevents a permit or job safety analysis from becoming a substitute for the physical barrier that maintenance requires.

When should LOTO work with a permit-to-work?

LOTO controls hazardous energy. A permit-to-work controls the authorization and coordination of a defined high-risk job. They answer different questions, so one should not silently replace the other.

A permit may identify simultaneous operations, competent personnel, rescue arrangements, line breaking, confined-space entry, or environmental conditions. LOTO should identify the energy sources and the physical devices that prevent unexpected release. The permit can reference the isolation certificate or procedure, while the isolation record provides evidence that the barrier was applied and tested.

For maintenance leaders, the practical test is simple. If the job exposes a person to hazardous energy, ask where the isolation is physically applied, who verifies it, and what evidence is retained. If the job also involves conflicting work groups or unusual conditions, add the permit-to-work controls rather than weakening the LOTO sequence.

Andreza Araujo's work on safety culture repeatedly connects compliance to operating decisions. As discussed in Safety Culture: From Theory to Practice, a procedure becomes part of culture only when leaders protect the conditions that allow people to follow it, including time to isolate, authority to stop, and clear ownership of the final verification.

What should happen before energy is restored?

Restoration is a separate control sequence, not the final casual step of maintenance. The authorized employee should confirm that tools and temporary restraints are removed as planned, guards are restored, people are clear, affected employees are notified, and each lock and tag is removed according to the procedure.

The person responsible for restoration must also consider handover. A shift change, contractor departure, or incomplete repair can make a correct isolation unsafe if the next work group cannot identify what remains open. The permit-to-work decision boundaries article provides a useful companion for that coordination problem.

Lockout/tagout is effective when the organization treats verification as a decision gate rather than a paperwork field. The equipment is not ready for maintenance because it stopped. It is ready when the relevant energy sources are isolated, stored energy is controlled, and the person exposed to the hazard has evidence that the barrier works.