Here is my verdict up front: if your shop's attitude is "it's just a quick adjustment, killing the power is too much trouble," your lockout/tagout program is paper. It exists in a binder, not on the floor.
Twenty years in American warehouses taught me that the accidents that keep me up at night are not the forklift ones. Forklifts are visible. The real killers show up during maintenance: a machine sitting there, looking dead, but still half alive. The conveyor's main motor is off, yet the air cylinders still hold pressure. The sorter's drive is down, but gravity is still pressing on the cartons stacked on the incline. A tech reaches in, and the nightmare starts.
Back in 2019 I was running a 320,000-square-foot distribution center in Fontana, California, with a cross-belt sorter that was pushing ten years old. My maintenance lead was a veteran in his fifties, the kind of guy who had seen everything. One day a sorter cart jammed. He figured it was "just a nudge" and reached into the track. The motor was off, but a pneumatic pusher next to it had never been bled. The rod fired and split the back of his hand open. A dozen stitches. He was lucky it missed the fingers. After that incident, I rebuilt the site's LOTO program from scratch. Everything below comes out of that rebuild.
Start by Listing Every Energy Source on One Card
The first step of LOTO is not buying locks. It is knowing exactly how many kinds of energy a machine carries. This is where most warehouse LOTO programs fail: people only think about electricity.
A real energy-source checklist has to walk through at least five categories.
Electricity is not just the main breaker. On conveyors, sorters, and cranes, the control cabinet often carries 480V power circuits alongside 24V control circuits. Kill the power and leave the controls live, and the controller is still awake. One stray output and an actuator moves. I learned this the hard way years ago on a roller conveyor: I pulled the power breaker but left the controls energized. A photo-eye got blocked by dust, the line jogged, and it nearly pulled a tech's hand into the roller gap. So after de-energizing, always try to start the machine. Hit the start button. Confirm it is truly dead before your hands go anywhere near it.
Pneumatics are the sneaky ones. Air receiver tanks and residual pressure in the lines stay charged after the power dies. Anywhere you have cylinders, pneumatic clamps, or blow-off air, the bleed valves get opened and the gauges read zero before the job starts.
Hydraulics show up on lift tables, dock levelers, and the tilt cylinders on counterbalance trucks. Hydraulic oil bleeds off slowly, and a loaded cylinder can creep downward. Servicing a lift table means the mechanical safety prop goes in. Relying on "the cylinder is holding it" is the same as doing nothing.
Gravity and stored spring energy get ignored most often. Cartons on gravity flow rack and chutes, pallets staged at the top of an incline, spring-return doors, tensioned belts. After the power and air are gone, these are still loaded. The fix is mechanical: blocks, pins, straps. Pin it or strap it.
What we did at the Fontana site: one "energy source card" per critical machine, taped inside the control cabinet door. The card lists every energy type, where each isolation point is, where each bleed point is, and how to verify zero energy. The tech reads the card on arrival. Nobody relies on memory.
Six Steps, in Order, Before a Hand Touches Anything
OSHA's 29 CFR 1910.147 is the standard that governs lockout/tagout. Check the current text on OSHA's website for the exact requirements; what follows is how I translated it into a floor procedure that actually gets followed.
Step one: notify. Tell everyone on shift the machine is going down for maintenance and nobody touches the start button. People skip this step, and then the tech is inside the machine while somebody on the radio asks "why is the line stopped" and hits start. That is how tragedies happen.
Step two: shut down normally. Use the normal shutdown sequence, not the breaker. Yanking the breaker is hard on drives and controllers and leaves fault codes you will be chasing after the repair.
Step three: isolate. Open every energy isolation point: disconnect switches, air supply valves, hydraulic dumps. Every isolation point has to accept a lock.
Step four: apply locks and tags. One personal lock per person, on the isolation point, with a tag carrying the person's name and the time. And hear this clearly: a tag is not a substitute for a lock. A tag is paper. Wind tears it, a hand rips it off. A lock is physical. The key is in your pocket, and nobody else can re-energize the machine. The worst shop I ever walked into shared one "maintenance lock" for the whole plant, with the key hanging on the cabinet door handle. That is not lockout. That is theater.
Step five: release stored energy. Bleed the air, discharge the caps, pin the gravity loads. Work through the energy card item by item.
Step six: verify. Try to start it. Confirm nothing moves, then return the controls to the off position and begin the repair. I have watched someone skip verification and discover they had locked out the wrong line's disconnect.
Group Lockout Is Where It Gets Messy
One tech on one machine is easy. Several techs on the same machine is where LOTO falls apart. The answer is group lockout: a multi-hole hasp on the isolation point, and every person hangs their own lock on it. Until every last lock comes off, nobody re-energizes. Your lock leaves when you leave. If you are still in there, your lock stays.
Shift change is the other trap. Day shift is halfway through a repair when night shift takes over. What happens to the locks? Our rule: no gap. The incoming tech hangs their lock first, then the outgoing tech removes theirs. There is never a window where the machine sits unlocked. It sounds fussy. After two weeks it becomes habit.
Contractors and visitors doing maintenance are the riskiest of all. The elevator service tech, the racking install crew, the fire system inspector: they do not know your equipment and they do not always respect LOTO. Our approach had three parts. First, one of our people acts as host, stays with them the whole time, and our host applies the lock on the isolation point. Second, every contractor signs a short LOTO briefing before entering: touch no equipment without finding the host first. Third, they are welcome to hang their own locks on our hasp too, for double protection. Never assume "they are professionals" and walk away. The accidents happen to confident professionals.
Training Should Not Be a Sign-In Sheet
LOTO training goes hollow fast: one hour of slides a year, everybody signs the attendance sheet, done. Ask anyone a month later and all they remember is "something about locks."
Training that works looks like this. A new hire's first week includes walking to a real machine and performing all six steps hands-on. Annual refresher is not slides; it is a floor spot-check. Point at a random machine and ask the tech to name its energy sources and isolation points. Cannot answer? Back to retraining. Keep records: who trained, when, whether the hands-on check was passed. When OSHA shows up, the records are what they read. Incomplete records mean the program does not exist. Check OSHA's website for the current recordkeeping requirements.
And once a year, audit the LOTO program itself with someone who does not do the daily maintenance: enough locks, accurate energy cards, nobody skipping steps to save time. People auditing their own work tend to look the other way. A fresh set of eyes changes everything.
Here is one thing you can do tomorrow: walk your floor, pick any conveyor or sorter, and ask the maintenance tech three questions. How many kinds of energy does this machine carry? Where are the isolation points? When was the last lock applied? If they cannot answer, your LOTO program is a paper program, and you should fix it now. Do not wait for the day somebody needs stitches.
