Lockout Tagout (LOTO) JHA (Job Hazard Analysis / Activity Hazard Analysis)
Updated 2026-06-23
A Lockout Tagout (LOTO) JHA (Job Hazard Analysis / Activity Hazard Analysis) is the plan that keeps a machine, a circuit, or a pressurized system from coming alive while a worker has their hands inside it. Unexpected energization and the release of stored energy kill maintenance and construction workers every year, almost always because an energy source was missed, a lock was shared, or a system was assumed dead without being verified. This guide walks through building a Lockout Tagout (LOTO) JHA that names the stored-energy and unexpected-startup hazards and assigns the isolation, verification, and controlled-release steps that hold up in the field.
Why LOTO needs its own JHA
Energy on a construction or industrial site is not just electrical. A machine can store energy in hydraulic accumulators, compressed air, springs, suspended weights, steam, and thermal and chemical systems — and any of these can move, crush, cut, or burn a worker if released while the machine is being serviced. Lockout/tagout is the procedure that isolates every energy source, locks each one in a safe state, and verifies zero energy before work begins. The hazard it controls is uniquely unforgiving: the worker is deliberately inside the danger zone, relying entirely on the isolation holding.
A LOTO JHA forces the crew to map every energy source for the specific equipment — not just the obvious electrical disconnect — and to verify, not assume, that each is controlled.
Breaking LOTO into steps
The steps for a Lockout Tagout (LOTO) JHA follow the established energy-control sequence:
- Identify all energy sources for the equipment (electrical, hydraulic, pneumatic, mechanical, thermal, chemical)
- Notify affected workers that the equipment is going down
- Shut down the equipment using the normal procedure
- Isolate each energy source at its disconnect or valve
- Apply locks and tags — each worker applies their own lock
- Release or restrain stored energy (bleed pressure, block, discharge)
- Verify zero energy by attempting to start and testing
- Perform the work, then release under control
Each step carries a hazard if skipped, and the stored-energy release and the verification step are where missed energy becomes an incident.
The hazards step by step
Unexpected startup
If an energy source is not isolated and locked, the equipment can be started — by another worker, an automatic control, or a stored signal — while someone is inside it. The control is isolating every source at its disconnect or valve and locking each one so it cannot be re-energized. Each worker applies their own personal lock, so the equipment cannot be released until every worker is clear; a shared or supervisor-held lock defeats the protection.
Stored and residual energy
Even after the power is off, energy remains stored — hydraulic pressure in lines and accumulators, compressed air, springs under tension, raised components held by gravity, capacitors holding charge, and residual heat or chemicals. This stored energy can release with the same force as live operation. The controls are bleeding down pressure, discharging capacitors, blocking or lowering suspended parts, and relieving every form of stored energy before the work begins.
Failure to verify
The single most important step is verification: after isolating and releasing stored energy, the crew confirms zero energy by attempting to operate the controls and testing with the appropriate instrument. Skipping verification — assuming the lockout worked — is how missed energy sources cause injuries. The control is to try to start the equipment (with controls returned to off afterward) and test for zero energy before any contact.
Improper release and group LOTO
Re-energizing before everyone is clear, or confusion in a group lockout about who is still working, causes injuries during the release. The controls are confirming all workers are clear, removing locks only by the worker who applied them, and using a group lockout procedure with a lockbox where multiple workers or crews are involved.
A simple Lockout Tagout (LOTO) JHA structure
| Step | Hazard | Control | Standard |
|---|---|---|---|
| Identify energy | Missed source | Map all energy types for the specific equipment | OSHA 1910.147(c) |
| Isolate | Unexpected startup | Disconnect/valve each source, isolate fully | OSHA 1910.147(d) |
| Lock and tag | Re-energization | Each worker applies own lock and tag | OSHA 1910.147(d)(4) |
| Release stored energy | Residual energy | Bleed pressure, block, discharge, lower loads | OSHA 1910.147(d)(5) |
| Verify | Assumed-dead error | Try to start, test for zero energy before contact | OSHA 1910.147(d)(6) |
| Release LOTO | Injury during restart | Confirm all clear, own-lock removal, group lockbox | OSHA 1910.147(e) |
Verification and the personal lock
Two principles make LOTO work. The first is verification — the procedure is not complete when the locks are on; it is complete when zero energy is confirmed by testing. Every LOTO JHA should make verification an explicit, non-skippable step. The second is the personal lock: each worker applies their own lock to the isolation point, and only that worker removes it. This is what guarantees the equipment cannot come alive while anyone is still exposed. A LOTO JHA that allows a shared lock or a supervisor to clear another worker's lock has a hole in it big enough to kill someone. These two principles — verify, and one worker one lock — are the heart of the plan.
From the field: what actually goes wrong
In fourteen years across federal, heavy civil, and industrial projects, the LOTO incidents I have seen come down to two failures: a missed energy source and a missing verification. The missed source is usually a non-electrical one — the crew locks out the electrical disconnect and forgets the hydraulic accumulator still holding pressure, or the pneumatic line still charged, or the component suspended by gravity that drops when a bolt comes out. Electrical lockout gets the attention; the stored mechanical and fluid energy is what surprises the crew. Mapping every energy type for the specific equipment, not just the power, is what closes that gap.
The verification failure is more cultural: a crew that has done a lockout a hundred times stops testing for zero energy because it has always worked, and the one time a source was missed, the machine moves with hands inside it. On the projects I have run, the discipline that prevents this is treating verification as a hard stop — try the controls, test the circuit, confirm zero energy, every time, no exceptions. And the personal lock has to be exactly that: I have seen near-misses where one worker cleared a coworker's lock to "save time" and nearly released the equipment with the coworker still inside. One worker, one lock, removed only by the person who applied it. The JHA that maps all energy, demands verification, and enforces the personal lock is the one that keeps the worker safe inside the machine.
The bottom line
A strong Lockout Tagout (LOTO) JHA maps every energy source — not just electrical — isolates and locks each one, releases stored energy, and verifies zero energy before contact, with each worker holding their own lock. The worker is deliberately inside the danger zone, trusting the isolation. The JHA that verifies rather than assumes, and gives every worker their own lock, is the one that keeps the machine dead until the work is done.
Frequently asked questions
What energy sources does lockout/tagout control?
Lockout/tagout controls every form of hazardous energy, not just electrical — including hydraulic and pneumatic pressure, springs under tension, suspended components held by gravity, steam and thermal energy, and chemical energy. A common LOTO failure is locking out the electrical disconnect while missing a stored mechanical or fluid source.
Why is verification the most important LOTO step?
The procedure is not complete when the locks are on; it is complete when zero energy is confirmed by attempting to operate the controls and testing with the appropriate instrument. Skipping verification — assuming the lockout worked — is how a missed energy source injures the worker who is relying on the isolation.
Can one worker remove another worker's lock?
No. Each worker applies their own personal lock, and only that worker removes it. This guarantees the equipment cannot be re-energized while anyone is still exposed; a shared lock or a supervisor clearing someone else's lock defeats the entire protection.
How does group lockout work?
Where multiple workers or crews are involved, a group lockout procedure uses a lockbox: the isolation points are locked, the keys are placed in a lockbox, and each worker applies a personal lock to the box. The equipment cannot be released until every worker has removed their lock.
Related JHAs
- Electrical Work JHA — energized-equipment work and verified de-energization
- Heavy Equipment Operation JHA — servicing equipment with stored energy
- Confined Space Entry JHA — isolating energy before entry
- Mechanical Pipe Installation JHA — isolating pressurized piping systems
Written by Mustafa Tok, CSP, ASP, CHST — OSHA Authorized Outreach Trainer with 14+ years of international construction safety experience across federal, heavy civil, and industrial projects.