The eight steps of a lockout are always the same and always in the same order. This is not bureaucracy: each step is where it is because the accident happens when that particular step is missing. Skipping verification does not save time; it shifts the risk to the moment someone reaches in.
This guide walks through the eight steps one by one, with what usually goes wrong at each. For the equipment —padlocks, devices for each isolation point, group lock boxes— see the LOTO lockout and tagging guide; and for choosing the padlock, the guide to body material, shackle and key system.
Why the order is not negotiable
The procedure moves from the general to the specific and ends where it began: identify, notify, shut down, isolate, lock out, dissipate, verify and remove. Each step leaves the machine in a known state before moving on to the next.
Changing the order breaks that chain. Locking out before isolating leaves the padlock on a point that is still supplying energy. Verifying before dissipating gives a reassuring reading on a circuit that still holds pressure. And removing the locks before checking that the area is clear restores energy with someone still inside.
Steps 1 and 2: preparation and notification
Preparation means knowing, before touching anything, how many energy sources the equipment has, where the isolation point for each one is and which device is needed to lock it. This is not improvised in front of the machine: it is written once, per machine, and consulted.
A useful written procedure fits on one page and answers four questions: which sources there are, where each one is cut off, what locks them and how to check that they are at zero. If the document does not allow someone else to carry out the lockout without asking, it is not finished.
Notification is the step most often forgotten because it seems trivial. Informing whoever operates the machine and whoever depends on it prevents two things: someone trying to restart it, and the shutdown taking a downstream process by surprise.
Steps 3 and 4: shutdown and isolation
The machine is shut down using its normal stopping procedure, not by cutting the power abruptly. A sudden stop can leave the equipment in an unstable position —a shaft mid-stroke, a suspended load— that complicates everything that follows.
Isolation means operating every isolation point identified during preparation: disconnectors, circuit breakers, valves, compressed air couplings. Be literal with the inventory here. Electrical energy is the one everyone remembers; pneumatic, hydraulic and gravitational energy are the ones left off the list.
Step 5: lockout and tagging
On each isolation point already isolated, the lockout device is fitted, closed with the personal padlock, and the tag is attached. Three details make the difference between a real lockout and an apparent one.
One padlock per person. If three operators work on the machine, there are three padlocks. A lockout hasp takes several on the same point, and the point is not released until the last one comes off.
The key is never left in the lock. It goes in the pocket of whoever fitted the padlock. A closed padlock with the key hanging next to it protects no one.
The tag says who and why. Name, date and reason. Without that, anyone arriving at the panel has to start asking around, and that friction is what pushes people to skip the procedure.
Step 6: dissipating residual energy
Isolating cuts off the supply; it does not empty what is already inside. An isolated machine can still hold compressed air in its cylinders, pressure in the hydraulic circuit, a charged capacitor, a flywheel spinning by inertia, a compressed spring or a raised load held up only by the pressure that has just been cut off.
That is why this step is about bleeding, discharging, supporting and waiting: bleed the pneumatic and hydraulic lines, discharge the capacitors, chock or lower suspended loads, mechanically block anything that could move under gravity and let anything hot cool down.
Step 7: verification, the step most often skipped
Verification has two halves, and both are needed. The first is trying to start the machine with the normal controls: if it does not start, the isolation works. Once this is done, the controls are returned to the stop position.
The second is checking with an instrument for the absence of energy at the point where the work will be done: a voltage tester on the electrical circuit, a pressure gauge on the pneumatic or hydraulic one. And the tester is checked before and afterwards against a known source, because a faulty tester indicates absence of voltage just as convincingly as a genuinely dead circuit.
It is the step most often omitted because the previous seven create a feeling of safety. It is exactly the other way round: it is the only one that proves it.
Step 8: removal
Removal is done in reverse order and with one rule that admits no exceptions: each operator removes their own padlock. First, they check that the tools are out, the guards are back in place and no one is left in the area.
When the last padlock comes off, the person in charge restarts the machine and announces that it is available again. That notice closes the cycle opened in step 2.
The eight steps at a glance
| Step | What is done | Common failure |
|---|---|---|
| 1. Preparation | Inventory sources, isolation points and devices | Doing it from memory, in front of the machine |
| 2. Notification | Inform operators and supervisors | Skipping it because it seems trivial |
| 3. Shutdown | Stop using the normal procedure | Cutting power abruptly and leaving unstable loads |
| 4. Isolation | Operate every isolation point | Isolating only the electrical energy |
| 5. Lockout and tagging | Device, personal padlock and tag | A shared padlock; the key left in the lock |
| 6. Residual energy | Bleed, discharge, support, cool | Confusing isolating with emptying |
| 7. Verification | Start attempt + instrument reading | Skipping it, or not checking the tester |
| 8. Removal | Each person removes their own, then restart | Removing someone else's padlock |
The eight steps are applied in this order. The failures in the third column are what turn a lockout into a box-ticking exercise.
Group work and shift changes
When several people are involved or the work spans a shift change, individual lockout is not enough. The usual solution is the group lock box: the keys to the padlocks isolating the machine are kept inside, and each operator closes the box with their own padlock. No one can retrieve the keys while a single padlock remains in place.
At a shift change, the incoming operator fits their padlock before the outgoing one removes theirs. The point is never left unlocked, not even for a second.
Lockout hasp
Group lock box
Lockout stationWhen someone else's padlock has to be removed
It happens: someone leaves with the key in their pocket and the line stays down. Having a master key to resolve it is reasonable; what cannot happen is for it to be used out of habit.
Exceptional removal requires, at the very least, three things in writing: who is authorised to decide it, what checks must be made beforehand —confirming that the person is not on site and that the area is clear— and how they are informed on their return. Without that procedure, the master key turns the personal padlock into an ornament.
Summary
The order protects: identify, notify, shut down, isolate, lock out, dissipate, verify and remove. Each step leaves the machine in a known state before the next.
The two steps most often omitted are the dissipation of residual energy and verification, and they are precisely the ones that separate a machine that appears stopped from a machine that is demonstrably de-energised.
The padlock is personal and so is the key. Anything that erodes that principle —shared padlocks, keys hanging next to the lock, master keys without a procedure— hollows the system out from within, even if the locks keep being fitted.