In 2023, hazardous energy killed 190 workers — most of them during routine servicing on a machine everyone assumed was off. Lockout/tagout is the one procedure that stands between a maintenance technician and the unexpected startup that ends a shift in an amputation or a fatality, and OSHA estimates that done properly it prevents 120 deaths and 50,000 injuries every year. Yet 1910.147 ranked number four on OSHA's Top 10 most-cited standards in FY2025 with 2,177 citations, and nearly every one traces to the same failures: missing written procedures, inadequate training, and skipped annual inspections. The irony is that these are documentation failures, not safety failures — the program often exists on paper but cannot prove itself. This guide covers how a digital CMMS turns a binder-based LOTO program into a living, audit-ready system. Start a free Oxmaint trial to digitize energy control procedures and track every inspection and training record, or book a demo to see LOTO authorization and audit documentation built for OSHA.
Manufacturing · EHS · OSHA 1910.147
Manufacturing LOTO Program with Digital CMMS
Energy control procedure library, authorization tracking, periodic inspection compliance, and training records — how manufacturers modernize lockout/tagout from a paper binder into a living digital program that proves OSHA 1910.147 compliance on demand.
-
190
workers killed by hazardous energy in 2023
-
#4
on OSHA's FY2025 Top 10, with 2,177 citations
-
120 / 50K
fatalities and injuries prevented yearly by proper LOTO
-
$165K
per willful violation — stacked per machine, per employee
The Three Pillars
What an Energy Control Program Actually Requires
OSHA 1910.147(c)(1) does not ask for locks and tags — it requires a program resting on three legs. Remove any one and the program fails inspection, no matter how disciplined the shop floor is. This is the structure a CMMS has to hold together.
-
1
Written Procedures
§(c)(4)A documented, machine-specific energy control procedure for every piece of equipment — identifying each energy source, isolation point, lockout device, and verification step. Generic procedures do not satisfy the standard.
-
2
Employee Training
§(c)(7)Role-specific training for authorized, affected, and other employees — certified with each employee's name and training dates, kept up to date, and retriggered whenever a machine, process, or procedure changes.
-
3
Periodic Inspections
§(c)(6)An annual inspection of every procedure, by an authorized employee other than the one using it, including a review with each authorized employee — certified with the machine, date, employees, and inspector.
The Non-Negotiable Order
The 6-Step Lockout Sequence
Every energy isolation follows the same six steps, in order, every time. Step 5 — the tryout — is the single most important step and the one most frequently skipped. Miss it and you are trusting that you isolated the right device, that it works, and that no stored energy remains. Those assumptions kill workers when they are wrong.
-
1
Prepare & Notify
The authorized employee identifies all energy sources from the machine-specific procedure and notifies affected employees before shutdown. -
2
Shut Down
Turn off the machine using its normal stopping procedure — an orderly shutdown, not an emergency stop. -
3
Isolate
Operate every energy-isolating device — breaker, valve, disconnect — to cut the machine off from all its energy sources. -
4
Lock & Tag
Each authorized employee applies their own personal lock and tag to each isolating device. No sharing — one worker, one lock, one key. -
5
Verify — the Tryout
Most skipped · most cited Release stored energy, then attempt to restart the machine to confirm zero-energy state. Return controls to neutral. This step proves the isolation actually worked. -
6
Service, Then Restore
Perform the work. To restore, inspect the area, clear all employees, and remove each lock — only by the worker who applied it — then notify affected employees.
Seven Ways to Get Hurt
The Energy Types Every Procedure Must Address
The standard covers seven categories of hazardous energy. Each needs its own isolation method, lockout device, and verification step in the machine-specific procedure — and it is the stored and residual energy, not just the live supply, that catches people.
-
Electrical
Live circuits and stored charge in capacitors -
Mechanical
Springs, flywheels, and moving parts under load -
Hydraulic
Pressurized fluid in lines, rams, and accumulators -
Pneumatic
Compressed air stored in tanks and cylinders -
Chemical
Reactive or pressurized process chemicals -
Thermal
Hot surfaces, steam, and residual process heat -
Gravitational
Suspended loads and raised equipment that can drop -
All Seven, Per Machine
Every procedure must map each source present on that specific equipment
Who Gets Trained on What
Three Employee Roles, Three Training Levels
Training is not one-size-fits-all. OSHA defines three employee categories by their relationship to the locked-out machine, each with different required content — and a CMMS assigns the right level to the right person.
-
Authorized
Performs the Lockout
The technician who applies locks and services the machine. Must know how to recognize every hazardous energy source, its type and magnitude, and the methods to isolate and control it. -
Affected
Operates the Machine
The operator whose equipment is being serviced. Must recognize when LOTO is in use, understand its purpose, and never attempt to start locked-out equipment. -
Other
Works in the Area
Anyone working where LOTO is used. Must be instructed on the procedure and the absolute prohibition against removing or bypassing a lockout device.
Retraining is mandatory whenever a job assignment changes, a machine or process changes to present a new hazard, a procedure changes, or a periodic inspection reveals a knowledge gap. Sign up for Oxmaint to auto-flag retraining the moment a machine or procedure changes.
Where Citations Come From
The Failures That Draw a Citation
OSHA compliance officers ask for records first. The most common LOTO citations are documentation gaps — the program existed but could not prove it. Each of these is preventable with a digital system.
| Common Violation | Reference | Why It Happens |
|---|---|---|
| Periodic inspection not done or documented | §(c)(6) | No annual certification on file, or done by the same person using it |
| Tryout / verification skipped | §(d)(6) | Workers skip the restart-attempt step to save time |
| No formal energy control program | §(c)(1) | Locks and tags used without a written program behind them |
| Missing machine-specific procedures | §(c)(4) | Generic procedures used instead of per-equipment documentation |
| Inadequate or undocumented training | §(c)(7) | No certification with employee names and training dates |
The Binder Cannot Prove It
A Paper Program Is a Citation Waiting to Be Written
When an OSHA officer arrives, the question is never whether you meant to comply — it is whether you can produce the machine-specific procedure, the training certification, and the annual inspection record for the exact machine in front of them. With penalties reaching $165,514 per willful violation, stacked per machine and per employee, a program that lives in a filing cabinet is exposure. One that lives in a CMMS answers in seconds.
Oxmaint for LOTO
How Oxmaint Digitizes the Whole LOTO Lifecycle
-
Procedure Library
Machine-Specific, Per Energy Type
A documented energy control procedure for every machine — each energy source, isolation point, lockout device, and verification step captured from pre-built templates for all seven energy categories.
-
Authorization Tracking
Only Trained Workers Get the Job
Every worker's authorization and training status is live. If someone lacks valid LOTO training for a task, the system blocks the assignment before the work order is ever issued.
-
Group & Shift Lockout
Every Lock Tracked to Its Owner
Group lockout with a designated primary authorized employee and individual lock tracking — the machine cannot clear until every lock is removed, and shift handoffs are logged so protection never gaps.
-
Inspection Scheduling
Annual Certifications, Never Missed
Every procedure's annual inspection fires as a recurring work order, assigned to an authorized employee other than the user, and certified with the four required data points automatically captured.
-
Training Records
Certified and Retriggered on Change
Training certifications with names and dates are kept current, and retraining is auto-flagged the moment a machine, process, or procedure changes — or an inspection reveals a gap.
-
Audit-Ready Export
Every Record in Seconds
Procedures, authorizations, inspection certifications, and training logs assembled into an audit package for any machine on demand — the documented evidence an OSHA investigation asks for.
Frequently Asked
LOTO Program Questions
How often must LOTO procedures be inspected?
OSHA 1910.147(c)(6) requires an inspection of every energy control procedure at least annually, performed by an authorized employee other than the one using it, including a review with each authorized employee. The certification must identify the machine, the date, the employees included, and the inspector. Procedures used less often than annually are inspected when used. Book a demo to see annual inspections scheduled and certified automatically.
What is the tryout step and why does it matter so much?
The tryout is step five of the lockout sequence under §(d)(6): after applying locks and releasing stored energy, the authorized employee attempts to restart the machine to confirm a true zero-energy state, then returns controls to neutral. It is the single most important step because it verifies the isolation actually worked — and it is the one most frequently skipped and cited. Without it, you are trusting assumptions that kill workers when wrong.
Do we need a separate procedure for every machine?
Yes. OSHA 1910.147(c)(4) requires documented, machine-specific energy control procedures — a generic procedure does not satisfy the standard. Each must state the intended use, the steps to shut down, isolate, block, and secure the equipment, and the verification method for every energy source present on that machine. Sign up for Oxmaint to build machine-specific procedures from energy-type templates.
How does a CMMS handle group lockout and shift changes?
Under §(f)(3), a primary authorized employee coordinates group lockout, each crew member applies a personal lock to a group box or hasp, and the machine cannot re-energize until every lock is removed. For shift changes under §(f)(4), the outgoing worker cannot remove their lock until the incoming worker applies theirs. A CMMS tracks each lock to its owner and logs the handoff so protection never gaps — and blocks an untrained incoming worker from taking over. Book a demo to see group and shift lockout tracked digitally.
Procedure · Train · Inspect
The Machine Everyone Thought Was Off Is the One That Kills
Every missing procedure, uncertified inspection, and undocumented training record is both a citation waiting to happen and a worker exposed to hazardous energy. Oxmaint gives manufacturing EHS and maintenance teams one platform to build machine-specific energy control procedures, track authorization and training, schedule and certify annual inspections, and produce audit-ready LOTO documentation on demand.
