How to Write a Lockout/Tagout Procedure

Back to Blog

What You Need Before Writing

You need accurate, current documentation of the machine: electrical drawings, P&IDs or pneumatic and hydraulic schematics, and the manufacturer's information, because the procedure is only as complete as your knowledge of the energy sources. You need to physically walk the machine, since drawings miss field changes and the real isolation points are on the equipment. And you need to work within the site's energy-control program under lockout/tagout, which sets the format and the review requirements the procedure must meet.

You also need to know who will use the procedure. It is written for an authorized employee who may not know this machine intimately, so it must be specific and unambiguous about which disconnect, which valve, and which verification, rather than assuming familiarity. Vague steps like isolate the machine are useless; the procedure names the exact devices.

Inventory Every Energy Source

Start by listing every form of hazardous energy the machine holds and where. Electrical energy at the main disconnect and at any control-power or secondary feeds. Pneumatic pressure in air lines and accumulators. Hydraulic pressure in rams and accumulators. Stored mechanical energy in springs, raised loads, or flywheels. Thermal energy in hot surfaces or fluids. Chemical or process energy where the machine connects to a live process. Missing a source here is the root of most serious LOTO incidents.

For each source, identify the specific isolating device that controls it and confirm it can be locked. A disconnect that accepts a lock, a valve with a lockable handle, a blind that can be inserted. Where a source has no lockable isolation, that is a finding to resolve before the procedure is usable, not a detail to gloss over. The inventory becomes the backbone of the procedure, and its completeness is the single most important quality of the document.

Distinguish energy that is isolated by locking a device from stored energy that remains after isolation. Opening a disconnect removes the electrical source, but a charged accumulator or a raised load still holds energy that must be separately released or restrained. The procedure must call out each stored-energy element explicitly and state how it is bled down, blocked, or restrained, because these are the sources that surprise workers who assumed isolation equals safe.

Define Isolation, Verification, and Restoration

Write the isolation steps in execution order: notify affected employees, shut down the machine normally, operate each isolating device to the safe position, apply a lock to each, and release or restrain each stored-energy element. Ordering matters because some machines must be shut down in a particular sequence, and applying locks before stored energy is released can leave a hazard trapped behind a locked device.

Make the verification step explicit and mandatory. After isolation and stored-energy release, the procedure directs the worker to verify the zero-energy state by attempting to operate the machine's normal controls with them safely positioned, by testing for absence of voltage where electrical, and by confirming pressure gauges read zero. This verification is the equivalent of test-before-touch and is what separates a machine that is proven safe from one that is merely switched off.

Finally, write the restoration steps as their own ordered sequence, because restoring is not simply reversing isolation. The procedure confirms the machine is clear of tools and people, checks that guards are replaced, removes each lock only by the worker who applied it, notifies affected employees, and re-energizes in a controlled order. A rushed or reversed restoration is a common source of startup incidents, so the restoration steps deserve the same care as the isolation steps.

Verifying the Procedure

The procedure is validated by walking it on the actual machine with a qualified person, confirming that every named device exists, is correctly identified, and reaches the state the procedure claims, and that the verification step genuinely proves zero energy. A tabletop review is not enough; the field walk catches the disconnect that was relabeled and the valve that isolates a different line than the drawing shows.

Once validated, the procedure is subject to the periodic inspection the standard requires, and any machine change should trigger a review through the site's management of change process. A procedure that matched the machine on the day it was written but not after a modification is worse than none, because it invites false confidence. Keeping it current is part of the program, not an afterthought.

Common Mistakes

The most serious mistake is an incomplete energy-source inventory that misses a secondary feed, an accumulator, or a stored mechanical load. The second is vague isolation steps that name no specific device. The third is a weak or absent verification step, leaving the worker to assume the machine is safe rather than proving it. The fourth is treating restoration as trivial and omitting the checks that prevent a startup injury.

A recurring process mistake is writing the procedure once and never revalidating it after machine changes. Because this is safety-critical work, the procedure must be reviewed and approved by qualified personnel, walked on the real equipment, and maintained under the site's energy-control program. This page describes the principles; the actual procedure lives inside that program and under that oversight.

Frequently Asked Questions