The device or procedure used to prevent accidental startup of machinery and equipment is lockout/tagout (LOTO): a lockout device physically holds an energy-isolating point in the safe position, and a tagout device warns against re-energizing it. Neither works alone. Reliable prevention combines energy isolation, a personal lock and tag, stored-energy control, and verification that the machine will not start.
Accidental startup injures workers because the hazard arrives without warning. A conveyor, press, or pump that begins moving can pull a hand into a nip point or release stored hydraulic pressure in under a second. Prevention therefore targets every energy source, not just the start button.
How lockout and tagout interrupt the energy path
A machine stops only when energy stops reaching it. Lockout attacks the energy path at its source. A lockout device is a physical block that keeps an energy-isolating device in the off or closed position. Typical hardware includes padlocks, cable locks, lockout hasps, and circuit-breaker lockout clamps.
The lock matters because it transfers control from the machine operator to the person doing the work. An isolating switch that anyone can flip is not a safeguard. A padlock whose key sits in the maintenance worker's pocket is. The worker applies the lock, keeps the key, and removes the lock only after the work is finished.
Tagout works differently. A tagout device is a prominent warning tag attached to the isolating device. It says the equipment must not be operated. A tag is a warning, not a physical barrier. OSHA treats tagout as less protective than lockout because a tag can be ignored, removed, or overlooked, while a lock resists accidental or casual removal.
Stored energy defeats isolation. A machine can be electrically dead yet still dangerous. Springs stay compressed, flywheels keep spinning, hydraulic accumulators hold pressure, and gravity holds a raised load. Skilled procedures therefore include bleeding pressure, blocking parts, releasing springs, and letting motion stop before anyone reaches into the equipment.
Verification closes the loop. After isolating and locking, the authorized worker tries the normal start control to confirm the machine will not run. That step catches a mislabeled breaker or a second feed the worker missed. Only then does the work begin.
Quantified context: exposure, injuries, and enforcement numbers
Lockout failures concentrate in maintenance, sanitation, and jam clearing, not routine production. Workers reach into machines precisely when guards are open and interlocks are bypassed. That combination removes both the barrier and the control that would otherwise stop a restart.
OSHA's lockout/tagout standard, 29 CFR 1910.147, covers servicing and maintenance where unexpected energization or release of stored energy could injure workers. OSHA has estimated that compliance prevents roughly 120 fatalities and 50,000 injuries each year. Treat that figure as an agency estimate, not a clinical measurement.
Small employers are not exempt. The standard applies across general industry regardless of headcount. Training frequency is set by the employer's procedures and the standard's retraining triggers, not a fixed renewal date. Reassess whenever a worker's job changes, a new hazard appears, or an inspection shows the procedure is not being followed.
One counterintuitive detail: the start button is rarely the whole story. Many serious incidents involve a second energy source, such as a pneumatic line or a gravity-held load, that the worker never identified. Isolation failure often starts with an incomplete energy inventory, not a failed padlock.
Edge cases and failure points
Group lockout is a common weak point. When several trades work on one machine, each worker should apply a personal lock to a group lockbox or hasp. If one person applies a single lock for the whole crew, protection collapses when that person leaves.
Shift changes create gaps. A lock left in place across shifts can strand the machine, so workers sometimes remove locks early to restart production. Proper handoff requires the incoming authorized worker to apply a lock before the outgoing worker removes theirs.
Contractors and host employers share a classic blind spot. Outside workers may follow their own procedures while plant staff follow another. Both parties should agree in writing on who locks what, where the energy sources are, and how verification happens.
Lockout differs from machine guarding. A guard keeps hands out during normal operation; lockout protects during servicing, when guards are open and the machine cannot simply be switched off. Relying on an interlock during maintenance is a red flag.
Warning bullets for supervisors: Never remove another worker's lock except under a documented, controlled procedure. Never use a tag as a substitute for a lock when lockout is feasible. Never assume a breaker labeled "off" actually de-energizes the circuit you are touching. Never let production pressure shorten verification or stored-energy control. Never treat a single padlock as covering a whole crew.
Misconceptions that cause injuries
The most common misconception is that switching off the start control is enough. It is not. A machine can restart from a remote control, an automatic cycle, a jam-clearing sequence, or a second power feed. The energy source, not the button, is what must be controlled.
A second misconception is that tagout equals lockout. A tag warns; it does not block. OSHA permits tagout only when a lockout device cannot be applied, and it requires additional means to limit exposure. A tag alone should never be described as preventing startup.
A third misconception is that lockout is only for electricians. Mechanics, sanitation staff, operators who clear jams, and outside contractors all face unexpected startup. The relevant question is whether a person's body or tools enter a danger zone during servicing.
A professional caveat: a perfectly written LOTO procedure can still fail if the energy inventory is wrong. Procedures are only as good as the identification of every feed, including control circuits, gravity, thermal energy, and residual pressure.
Comparison of startup-prevention measures
| Measure | How it prevents startup | Strength | Main limitation |
|---|---|---|---|
| Lockout device | Physically holds the isolating point off | Strong; resists casual removal | Requires correct energy identification |
| Tagout device | Warns against re-energizing | Moderate; visible reminder | Can be ignored or removed |
| Machine guard or interlock | Keeps hands out; stops normal cycle | Strong during routine operation | Bypassed or open during maintenance |
| Emergency stop | Cuts power when pressed | Fast response to an event | Not a substitute for isolation |
| Start-warning alarm | Alerts before restart | Useful secondary warning | Does not physically prevent startup |
| Administrative permit | Documents who does what | Coordinates multiple workers | Depends on human compliance |
The table shows the core point: physical prevention outranks warnings. Lockout is the primary control. Tags, alarms, and permits support it but do not replace it.
Timeline of a safe lockout sequence
| Step | Action | What goes wrong if skipped |
|---|---|---|
| 1. Prepare | Review the procedure and energy inventory | Missed energy source |
| 2. Notify | Tell affected workers the machine will stop | Surprise restart attempts |
| 3. Shut down | Use the normal stop sequence | Abrupt stop leaves stored energy |
| 4. Isolate | Open or close every energy-isolating device | Live feed remains |
| 5. Lock and tag | Apply personal lock and tag to each device | Anyone can re-energize |
| 6. Release stored energy | Bleed, block, drain, and let motion stop | Residual pressure or gravity load |
| 7. Verify | Try the start control; confirm no motion | Hidden second feed goes unnoticed |
| 8. Restore | Remove locks and tags only after work ends | Premature restart |
The sequence is not linear busywork. Each step closes a specific failure path. Verification is the last chance to catch a mistake before a person enters the danger zone.
Practical actions and thresholds
Start with the energy inventory. Walk the machine and list every source: electrical, pneumatic, hydraulic, steam, thermal, gravitational, and stored mechanical. A source that is not on the list cannot be locked.
Write machine-specific procedures rather than generic ones. Each procedure should name the isolating devices, their locations, the lockout points, and the verification steps. Generic language is a red flag during audits because it cannot guide a worker at a specific panel.
Train by role. Authorized workers apply locks and perform verification. Affected workers need to recognize lockout and avoid removing devices. Other workers need awareness of the tag system. Training should be documented and refreshed when procedures or hazards change.
Audit the practice, not just the paperwork. Periodic inspections should watch a real lockout happen, check that every energy source was isolated, and confirm that locks were applied to the correct devices.
Set clear upgrade thresholds. Replace any procedure that relies on tagout where a lockout device can be installed. Rebuild any crew practice that uses one lock for multiple workers. Fix any panel whose energy sources are unlabeled or unclear.
Limitations and what this cannot settle
No article can certify a specific machine as safe. Compliance depends on the actual installation, the energy sources present, the procedures in use, and the training of the people involved. Local codes, consensus standards, and site-specific engineering judgments can add requirements beyond the federal rule.
Numbers in this article describe typical exposure and enforcement context, not outcomes for any single facility. OSHA's injury-prevention estimate is an agency figure, and actual incident rates vary widely by industry and work practice.
Regulations and standards change. Confirm the current edition of the applicable standard and any state plan requirements before relying on a procedure.
This article is general educational information about machinery safety, not a diagnosis, treatment plan, engineering certification, or legal opinion. It does not promise any outcome. For decisions about a specific machine, procedure, or workplace, consult a qualified safety professional, engineer, or local regulatory authority. If someone is in immediate danger from machinery, stop work and contact local emergency services.