LOTO Verification: 7 Checks Before Restart

OSHA 29 CFR 1910.147 treats verification as a required part of controlling hazardous energy, because a locked switch can still leave gravity, pressure, heat, or stored electricity in the system, and hot work permit controls and ATEX zone controls depend on the same proof mindset. This guide shows how an EHS manager can turn LOTO verification into a repeatable restart barrier rather than a signed Pre-Task Risk Assessment form, the same discipline required in working at height rescue planning.

Why LOTO verification fails when it becomes paperwork

LOTO verification fails when the team treats the lock as proof of zero energy, although the standard requires the authorized employee to verify isolation before service or maintenance begins. OSHA 29 CFR 1910.147(d)(6) is clear on that point, and the practical reason is simple enough: the lock controls an energy-isolating device, while the hazard may remain inside a cylinder, capacitor, suspended load, thermal surface, or trapped line.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture is not what the organization declares but what the system repeats when nobody is watching. In LOTO, that means a procedure whose final field says verified is weaker than a routine in which the mechanic, operator, and supervisor can describe how each energy source was proven safe.

The useful question for the EHS manager is not whether the site has a lockout/tagout program. The useful question is whether a 320-employee plant can prove, at 2 a.m. during corrective maintenance, that verification still happens when production pressure is high and the usual supervisor is not on shift.

1. Map every hazardous energy source before choosing the lock point

Every effective LOTO verification starts with an energy map, because electrical isolation alone does not control pneumatic, hydraulic, chemical, thermal, mechanical, gravitational, and residual energy. OSHA's Control of Hazardous Energy standard applies when unexpected startup or energy release can injure employees during servicing or maintenance.

The common failure is a one-line procedure that says isolate main disconnect, which may be adequate for a small motor but weak for a packaging line with compressed air, heated sealing jaws, elevated tooling, and stored spring force. In that situation, the risk matrix often hides the real exposure because the team scores the task after choosing the control, not before identifying all energy paths.

Build the map at equipment level, not department level. The authorized employee should name each source, normal state, isolation point, dissipation method, verification method, and restart condition, since those fields force the procedure to describe the hazard instead of merely naming the device.

2. Separate isolation from dissipation

Isolation disconnects the energy source, while dissipation removes or restrains the energy already stored in the equipment. OSHA 1910.147(d)(5) requires stored or residual energy to be relieved, disconnected, restrained, or otherwise rendered safe before work proceeds.

Across 25+ years leading EHS at multinationals, Andreza Araujo has seen that many serious maintenance exposures come from this gap between isolation and dissipation. A valve is closed, yet pressure remains in the line; power is disconnected, yet a capacitor is still charged; a conveyor is stopped, yet gravity still acts on the suspended part.

Write the procedure so the verification action matches the stored-energy mechanism. Bleed down pressure and read the gauge, block elevated components and try controlled movement, discharge electrical storage using the approved method, and wait for thermal energy to reach a safe range before hands enter the danger zone.

3. Use a try-start test only when it proves the right thing

A try-start test is useful only when it confirms that the controlled energy cannot start the equipment from the normal operating interface. It does not prove that every hazardous energy source was controlled, which is why it should sit inside a broader verification sequence.

The trap most safety programs miss is false confidence. An operator presses start, the machine does not move, and the team assumes zero energy, although the test may only prove that control power is absent while pneumatic pressure or gravity remains available.

Require the authorized employee to state what the try-start test proves and what it does not prove. After the test, return controls to the neutral or off position, document the result, and continue with source-specific verification for pressure, motion, temperature, and stored mechanical energy.

4. Verify group LOTO through individual accountability

Group LOTO needs one accountable lockout structure and individual protection for every exposed person. When several mechanics, contractors, operators, and cleaners work on the same asset, the verification risk increases because each person may assume someone else confirmed the hazardous energy state.

In more than 250 cultural-transformation projects supported by Andreza Araujo's team, the weak point is often handover language. People say maintenance has the lock, operations cleared the line, or the contractor checked it, which sounds organized but hides who personally verified the condition before exposure.

Use a lock box or equivalent group-control method only with a named primary authorized employee, a visible verification log, and a rule that each exposed person attaches personal protection after understanding what has been verified. If the task crosses shifts, require a physical walkdown rather than a desk transfer.

5. Make restart a controlled step, not the end of maintenance

Restart is part of the LOTO procedure because OSHA 1910.147(e) requires actions before lockout or tagout devices are removed and energy is restored. The area must be checked, tools removed, machine components operationally intact, and affected employees notified before reenergization.

The operational mistake is treating restart as a production event instead of a safety event. A maintenance team can verify isolation well at the beginning and still create exposure at the end when guards are not restored, temporary blocks remain in place, or a person is still inside the line of fire.

Create a restart checklist that requires area sweep, guard restoration, employee positioning, notification, controlled reenergization, and first-cycle observation. The first cycle matters because it is the moment where hidden misalignment, trapped material, and incomplete restoration become visible.

6. Audit verification quality, not training attendance

Training attendance does not prove LOTO competence, because verification quality can only be seen in how the authorized employee performs the procedure on real equipment. ISO 45001:2018 clause 8.1 expects operational controls to match risks and changes, which makes field verification a better indicator than classroom completion.

25+ years of multinational EHS experience led Andreza Araujo to a practical conclusion: if the supervisor only audits signatures, the organization will optimize signatures. The audit has to watch the energy map, isolation sequence, dissipation action, verification proof, and restart discipline.

Score each observation against five questions: did the employee identify all energy sources, did the isolation point match the procedure, was stored energy dissipated, did the verification method prove the intended condition, and was restart controlled. These answers also improve leading indicators because they measure barrier quality before injury occurs.

7. Investigate every verification miss as a system warning

A verification miss is a precursor event, not a minor administrative defect. If a team discovers pressure after lockout, a missing isolation point, or an unnotified affected employee before restart, the site has received evidence of a barrier weakness before the injury.

James Reason's Swiss Cheese Model helps explain why the answer cannot stop at retrain the mechanic. The miss may involve outdated procedures, poor equipment labeling, weak contractor onboarding, unclear shift handover, missing gauges, or a supervisor who rewards speed more visibly than control.

Treat the miss with the same seriousness used in an RCA that avoids the operator error trap. Capture the failed barrier, correct the equipment-specific procedure, update labels or isolation hardware, and verify the correction during the next planned maintenance job.

Each month without LOTO verification audits allows small restart deviations to become normal work, while the organization believes the written program is protecting people.

Comparison: paperwork LOTO vs verified energy control

Conclusion

LOTO verification protects people when the site proves zero hazardous energy in the field, controls stored energy, and treats restart as a safety-critical step rather than a paperwork closeout.

During the PepsiCo South America tenure, where the accident ratio fell 50% in six months, Andreza Araujo learned that sustainable improvement comes from practical routines whose evidence survives production pressure. If your operation needs to move from compliance records to real safety capability, start with a field audit of the LOTO verification routine and talk to ACS Global Ventures through Andreza Araujo.