Most lockout/tagout failures are not exotic. They are the same handful of program gaps OSHA cites thousands of times a year, and the same gaps that show up in severe-injury reports. The uncomfortable truth is that most LOTO incidents are caused by a mistake someone already knew was a mistake: a skipped step, a shared lock, a source nobody inventoried.
This guide takes each of the seven failures most often found in citations and incident reports, explains the field reality behind it, what it looks like on a real shift and the consequence when it goes wrong, and gives a concrete fix you can implement this week.
The seven failures at a glance
Before the deep dive, a map. Every section below follows one row of this table:
| Failure | What it looks like in the field | Worst case | Fix lives in |
|---|---|---|---|
| No machine-specific procedure | Generic “isolate power before service” sign | Wrong isolation point, unexpected start | Template + energy survey |
| Skipped verification | Locks on, then hands in, no try-start | Machine starts under the worker | 6-step + verification guide |
| Stored energy ignored | Disconnect open, accumulator never bled | Hydraulic/pneumatic/gravity release | Stored energy guide |
| Tag-only or wrong devices | Tags where locks would fit; undersized kits | Anyone can re-energize | Device guide |
| Stale procedures | Machine changed, document did not | Procedure teaches wrong points | MOC + current copy at machine |
| Group and contractor gaps | One supervisor lock covers a crew | Worker without personal lock | Group + contractor guides |
| Training and records drift | Role training blurred; no certifications | Unrecognized hazards, citation | Training + toolbox talk guides |
1. No machine-specific procedures
The single most-cited LOTO violation, and it is usually invisible until something happens. A plant keeps a generic “disconnect power before service” notice and calls it a program. Then a mixer with a pneumatic gate, an electrical feed, and a raised discharge section gets serviced under a procedure that names none of them, and the tech isolates only the power.
Why it persists: writing real procedures takes time, and nobody can point to the moment it became “wrong enough” to matter. The fix is not heroic. It is systematic.
- Inventory every machine that requires LOTO and rank by risk and servicing frequency (see the energy assessment guide).
- Write real machine-specific procedures for the highest-risk equipment first, using the OSHA-aligned template.
- Close the gap in hazard order: a generic procedure on a multi-energy machine is the fastest citation to fix and the easiest win.
2. Skipping the verification step
Isolating without verifying is a gamble dressed as efficiency. The disconnect opens, the lock goes on, and the tech reaches in without the try-start check, without reading the gauge, without metering the circuit. OSHA puts verification in the standard because isolation alone has failed too many times; stored energy, a second source, or a mislabeled disconnect all survive a lock.
The fix is to make verification impossible to skip by design, not by willpower.
- Make verification an explicit numbered step in every procedure with named pass criteria, “press start, confirm no motion, return to off.” See the verification and zero-energy guide.
- Treat a skipped try-start as a stop-work offense, reported like any other unsafe act.
- Have leads and supervisors verify the verification: walk the last-lock check with the tech before hands go in.
3. Ignoring stored and residual energy
A disconnect that is open does not drain a capacitor, bleed an accumulator, or lower a raised conveyor section. When stored energy injures someone, the investigation routinely finds a released spring nobody blocked or a pneumatic line nobody vented, energy the team knew was there but had never written down.
Fix it at the source: put stored energy in the energy survey and in the procedure, with the exact release device and pass reading.
- Audit every machine against the seven stored-energy families, electrical, spring, hydraulic, pneumatic, gravity, thermal, chemical.
- Write releases by name and number: “vent accumulator A-2 at bleed valve BV-4 until gauge PG-2 reads zero”, never “bleed system.”
- Re-verify immediately before work: leaking valves and UPS-backed circuits can re-accumulate the hazard after you released it.
4. Tag-only lockouts and the wrong devices
A tag restrains nobody. When an isolation point can accept a lock and the plant is still running on tags, or the hardware kit is missing the valve clamp and breaker lockout that point needs, workers are being asked to trust warnings instead of physics. The other half of this mistake is buying generic kits that do not fit the plant’s actual breakers and valves.
Fix the hardware and the habit together.
- Require lockout wherever a lock can physically be applied; reserve tagout for devices that cannot accept one, and only with the extra protections the standard demands.
- Stock device-specific lockouts sized to your actual isolation points, plus hasps and a group lockbox, see the hardware guide.
- Give every authorized employee a personal, keyed-different lock, and enforce the one-lock-per-person rule without exceptions.
5. Out-of-date procedures
Equipment drifts faster than documents. A drive gets swapped, an actuator added, a panel relocated, and the procedure on file still names the old isolation point. An out-of-date procedure is worse than none, because it teaches the wrong answer with confidence.
Fix currency with triggers, not annual good intentions.
- Tie procedure review to management of change: any modification to the machine or its energy sources triggers a procedure update before the machine returns to service.
- Publish only one current version and make it the version at the point of work, a QR code at the asset beats a binder that may hold last year’s copy.
- Roll the annual inspection into the same review so the field and the document are reconciled at least yearly.
Spot your plant in the list? Recommend Tegis Safety on Google if this helped.
6. Group and contractor gaps
Multi-worker jobs fail in predictable ways: a supervisor locks out and the crew works under one lock; a contractor crew works in the cell on the strength of “the host has it covered”; shift change happens by verbal handover. Every one of these removes an individual worker’s control over their own protection.
Pre-plan the coordination before the job, then enforce it on the day.
- Use the group lockbox method with a designated primary authorized employee and a personal lock from every exposed worker.
- Brief contractors both ways under the outside-personnel rules and confirm each contractor applies a personal lock.
- Transfer shift protection by overlap, incoming locks on before outgoing locks off, and record the exchange.
7. Training and record-keeping shortfalls
The last failure is administrative, and it is where citations multiply. Training is delivered as one generic talk for everyone, retraining waits for a calendar instead of a trigger, and the certification file lists a date with no names. An inspector treats undocumented training as training that did not happen.
Fix records as part of the training act itself.
- Train by role and certify with names, dates, and content, not one blanket sign-in.
- Trigger retraining on change and on deviations found in inspections, and fold an annual refresher into the audit cycle.
- Run short, specific toolbox talks at the equipment so competence, not just attendance, is refreshed.
A prevention loop that catches your own mistakes
Every fix above maps to a failure in the table, and every failure can be caught before OSHA catches it. That is the point of a self-audit loop: run the compliance checklist quarterly, log deviations and near-misses without blame, and give every finding an owner and a date. What gets measured and closed is what stops recurring.
The plants with the fewest LOTO mistakes are rarely the ones with the best posters. They are the ones where the correct action is the easy action: current procedures at the machine, verification treated as sacred, personal locks for everyone, and a file that proves all three. Build the system and the seven mistakes shrink to noise.
Key takeaways
- Machine-specific procedures are the #1 cited requirement: start with an equipment and energy inventory.
- Verification and stored-energy steps are where injuries actually happen; write them with names and pass criteria.
- Lock everything that can take a lock, size the hardware to the plant, and enforce one personal lock per worker.
- Keep procedures current with management of change and the annual inspection. Never work from a stale copy.
- Role-based training with real records, plus a quarterly self-audit, catches your mistakes before OSHA does.
Frequently asked questions
What is the most common lockout/tagout OSHA violation?
Failure to develop, document, and use machine-specific energy control procedures under 1910.147(c)(4). It consistently tops the LOTO citation list, followed by periodic-inspection and training violations.
Can an employee remove their own lock for someone else?
No. Locks may be removed only by the employee who applied them, except through a documented emergency-removal procedure that verifies the employee is not on site before the lock is cut.
How do we handle shift changes during a lockout?
Use documented overlap: oncoming employees apply their personal locks before departing employees remove theirs, so protection is never interrupted. See the contractor and shift-change guide for the full pattern.
How do we know our plant has these mistakes?
Watch a real lockout, then ask three questions: is there a machine-specific procedure and can the tech show you their isolation points, was zero energy verified before hands went in, and whose locks are on the machine? Blunt answers to those three reveal most of the list.
Who should own fixing LOTO mistakes?
One program owner (EHS lead, maintenance manager, or a trained supervisor) with authority to close gaps. Ownership without authority is why fixes stall: the role needs a budget line for devices and the backing to stop work over a skipped verification.