LOTO Verification: How to Prove Zero Energy

OSHA states that proper control of hazardous energy prevents an estimated 120 fatalities and 50,000 injuries each year, according to its Control of Hazardous Energy guidance. This guide shows supervisors and EHS managers how to verify zero energy before maintenance starts, because a lock on a board is not proof that hazardous energy has been controlled.

Why LOTO verification fails even when locks are present

LOTO verification fails when the team treats the lock as the control instead of treating it as evidence that a control sequence was completed. OSHA 29 CFR 1910.147 requires energy control procedures for servicing and maintenance when unexpected energization, startup, or release of stored energy could injure workers.

The common trap is cultural, not only technical. Across 25+ years leading EHS at multinationals, Andreza Araujo has observed that serious incidents often occur in the gap between the procedure everyone can recite and the step nobody verifies under production pressure.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture appears in repeated operating decisions. For LOTO, the decision that matters is whether the supervisor accepts visible locks as enough, or requires physical proof that electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and gravitational energy can no longer hurt the maintenance worker.

Step 1: Define the exact maintenance scope

The maintenance scope defines which equipment, task boundary, and exposure points must be isolated before work begins. A vague work order such as repair pump is too weak, because the real exposure may include an agitator, a feed valve, a pressure leg, a nearby conveyor, or a stored-energy device connected to the same process.

What most LOTO checklists do not mention is that the first verification mistake happens before the first lock is installed. If the scope is wrong, the team can isolate the equipment named on the form while leaving an adjacent energy path open.

Ask the supervisor, mechanic, electrician, and operator to walk the job boundary together. The walk should identify the equipment ID, all access points, the reason for opening the machine, the expected duration, and any parallel work such as hot work, line breaking, confined space entry, or machine guarding removal.

This first step connects naturally with line break permit controls, because process equipment often carries pressure, chemicals, or residual product that a simple electrical lockout will not address.

Step 2: Identify every energy source before shutdown

Energy source identification means listing each hazardous energy that can reach the worker, not only the energy source that runs the machine. OSHA 1910.147 names hazardous energy broadly, and the practical list usually includes electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and stored gravitational energy.

The market minimizes this step because electrical isolation is visible and familiar. Stored energy is less visible, although it is often the energy that injures the worker after the main disconnect has been locked.

Build an energy map before shutdown. For each source, record the isolation point, release method, verification method, responsible authorized employee, and the field sign that confirms the energy is gone. A supervisor should refuse to start work when any source has no verification method.

One missing energy source is enough to defeat the whole lockout. The number is small, but the consequence is not, because the exposed worker only needs one unexpected movement or release to enter the SIF pathway.

Step 3: Shut down with the operator, not around the operator

Controlled shutdown reduces residual risk because the operator knows the normal sequence, abnormal alarms, bypasses, and process conditions that maintenance may not see. The authorized employee owns the LOTO procedure, but the operator often owns the operating reality.

During her tenure at PepsiCo South America, where the accident ratio fell 50% in six months, Andreza Araujo learned that safety improvement depended on operating routines, not slogans. Shutdown quality is one of those routines, since it decides whether energy is removed deliberately or merely interrupted.

Use the normal stop sequence unless the procedure says otherwise. Confirm that moving parts have stopped, pressure has stabilized, controls are in the expected position, and the operator understands that the equipment is now under maintenance control.

This step is also where production pressure appears. If a supervisor rushes shutdown to protect schedule, the team may carry hidden energy into the job and discover it only when a panel is opened, a coupling is loosened, or a valve is cracked.

Step 4: Isolate and lock each source under personal control

Isolation and locking must place each energy source under the control of authorized employees before servicing begins. OSHA 1910.147 requires lockout or tagout devices to hold energy-isolating devices in a safe position, with tags used under defined conditions.

The weak version of this step is a group board with locks but no shared understanding of what each lock controls. The stronger version is a lockout in which every authorized employee can point to the isolation point, name the energy source, and explain why that point protects the task.

For group LOTO, assign one authorized employee to coordinate overall job-associated control while every exposed worker maintains personal protection according to the site procedure. The coordinator should not become a substitute for individual understanding.

Document lock numbers, isolation points, and responsible people, but do not confuse the record with the control. The record supports accountability; the field state protects the worker.

Step 5: Release stored and residual energy

Stored-energy release is the step that converts isolation into zero-energy condition. OSHA 1910.147 requires stored or residual energy to be relieved, disconnected, restrained, or otherwise rendered safe before work begins.

This is where many programs are weakest because stored energy hides in springs, capacitors, elevated parts, hydraulic accumulators, pneumatic lines, trapped pressure, thermal surfaces, rotating flywheels, and suspended loads. A written LOTO procedure that does not name these conditions invites false confidence.

Use the release method written for the equipment, then verify the result in the field. Bleed pressure, block movement, discharge capacitors, lower elevated components, chock rotating elements, drain trapped product, and wait for thermal energy to fall below the exposure threshold when that is part of the hazard.

Andreza Araujo's Portuguese title A Ilusao da Conformidade, often translated as The Illusion of Compliance, fits this exact point. The form can be complete while the residual hazard remains alive.

Step 6: Perform a try-start or equivalent zero-energy test

A try-start or equivalent test proves that the equipment cannot energize from normal controls after isolation and locking. OSHA 1910.147 requires verification that isolation and de-energization have been accomplished before work starts.

The try-start is not a ceremonial button press. It must be designed around the actual hazard, which means the team may need a control-panel attempt, voltage test, pressure gauge check, mechanical movement test, or process-specific confirmation.

Return controls to the off or neutral position after the test. This detail matters because a successful try-start test can create a new startup condition if the control is left in an energized command position after locks are later removed.

When the task involves high-risk equipment, pair the try-start with critical control verification. The question is not whether the checklist was completed, but whether the barrier would actually stop the harmful event.

Step 7: Brief affected workers before opening the equipment

The pre-work briefing aligns authorized and affected employees before exposure begins. It confirms the task boundary, locked sources, stored-energy controls, verification results, communication channels, and stop conditions.

The briefing should not become another toolbox talk with generic language. In more than 250 cultural-transformation projects supported by Andreza Araujo's team, one repeated pattern appears: teams comply with the meeting ritual while skipping the specific conversation about what can still kill someone during this job.

Ask each exposed worker to answer three questions before opening the equipment. Which energy source could still hurt us, how do we know it is controlled, and what condition makes us stop? If the answers are vague, the job is not ready.

For machines where guarding has been removed or defeated for service, connect the briefing with machine guarding bypass risk, because the normal physical barrier may no longer protect the worker during maintenance.

Step 8: Control shift changes, interruptions, and reaccumulation

LOTO verification must continue when the job crosses shifts, pauses, or creates a possibility of energy reaccumulation. OSHA 1910.147 requires continued verification if stored energy could reaccumulate to a hazardous level.

The difficult point is that verification decays over time. A lock that was correct at 8 a.m. may not prove safe conditions at 3 p.m. after a contractor arrives, a valve leaks by, an accumulator recharges, or a new work crew enters the area.

Use a formal handover when the job pauses or changes crew. The outgoing authorized employee should show the isolation points, stored-energy controls, test results, open panels or lines, and pending hazards to the incoming authorized employee before responsibility transfers.

This step is closely related to permit-to-work handover failures, because the risk often enters through what the next crew assumes was verified by someone else.

Step 9: Remove LOTO only after people, tools, and guards are controlled

LOTO removal must confirm that the work area is clear, tools are removed, guards are restored when required, employees are positioned safely, and affected workers are notified. Removal is not an administrative ending; it is a controlled return of energy.

The final trap is impatience. Teams that verified carefully at the start sometimes rush restoration because production is waiting, the shift is ending, or the equipment owner is pressing for restart.

Use a restart checklist that covers personnel count, tool removal, guard restoration, process alignment, communication, and first energization. When an authorized employee who applied a device is unavailable, follow the documented exception procedure required by OSHA 1910.147 rather than improvising removal.

Record what changed during the job. If the work revealed a missing isolation point, unclear drawing, weak handover, or stored-energy surprise, update the procedure before the next maintenance task repeats the same exposure.

LOTO checklist versus LOTO verification

A checklist can help structure LOTO, although it cannot replace field proof. The strongest supervisors treat the checklist as a prompt for verification, because the worker does not need a perfect form after exposure; the worker needs the energy gone before hands enter the danger zone.

Every repeated maintenance task that skips zero-energy proof trains the crew to trust paperwork more than the machine state, and that habit becomes harder to break after months of successful shortcuts.

Conclusion

LOTO verification works when supervisors prove the absence of hazardous energy through scope definition, source mapping, stored-energy release, try-start testing, briefing, handover control, and disciplined restart.

If your operation wants LOTO to become a field-proven critical control rather than a lock board ritual, start by auditing one high-risk maintenance task this week, then request a safety culture diagnostic with Andreza Araujo to identify where procedure, supervision, and culture separate.