Key Takeaways
- Lockout/tagout ranked #4 on OSHA’s FY2025 list of most cited standards, with 2026 penalties of $16,550 per serious violation and $165,514 per willful or repeated violation (OSHA).
- A compliant LOTO procedure template must document scope, shutdown steps, energy isolation points, lock placement and verification, as required by 29 CFR 1910.147.
- Standard lockout fails for humanoid robots: cutting power to a dynamically balancing biped removes the active control that keeps it upright.
- The robot-specific fix is a 6-step controlled shutdown in which mechanical bracing engages BEFORE battery isolation, not after.
- NIOSH counted 41 robot-related workplace fatalities from 1992 to 2017, and 78% involved a robot striking the worker, exactly the hazard an uncontrolled fall creates.
A LOTO procedure template is the starting structure for the written, machine-specific energy control document required by OSHA 29 CFR 1910.147. The finished procedure tells an authorized employee how to shut equipment down, isolate every energy source, apply locks and tags, and verify a zero-energy state before service. Humanoid robots break that standard playbook in one critical way: cutting power to a machine that balances on two legs removes the very control system holding it upright, so the de-energizing step itself can create a struck-by hazard.
In this guide I walk through what every LOTO procedure template must contain, why generic templates fail for dynamically stable robots, and the 6-step alternative shutdown sequence I recommend instead. This article is spoke one of my broader robot safety documentation guide, which maps all the paperwork a robot deployment needs.
Table of Contents
What Is a LOTO Procedure and What Must It Contain?
Lockout/tagout was the fourth most frequently cited OSHA standard in FY2025, covering October 2024 through September 2025 (OSHA, 2025). The citation that drives many of those penalties is simple: no written, machine-specific energy control procedure. A template helps, but only if it captures the minimum elements 1910.147 demands.
Under 29 CFR 1910.147(c)(4), the written procedure must clearly outline, at minimum:
- Scope and intended use. Which machine, which servicing tasks, which employees are authorized.
- Shutdown steps. The specific sequence for shutting the equipment down without creating new hazards.
- Energy isolation steps. Every energy-isolating device, where it is, and how to operate it.
- Lock and tag placement. Who applies devices, where, and how responsibility transfers across shifts.
- Verification. How the authorized employee confirms a zero-energy state before work begins, typically by attempting a start and testing for residual energy.
One procedure per machine type is the working rule. A procedure written for a CNC mill does not cover a robot arm, and a procedure written for a robot arm does not cover a humanoid. The energy inventory is different in each case, and I cover why below.
Why Is LOTO One of OSHA’s Most Cited Violations?
LOTO sits at #4 on OSHA’s FY2025 Top 10, behind only fall protection, hazard communication and ladders (OSHA, 2025). It stays near the top year after year because energy control failures are easy to find during inspections and devastating when they cause an incident. Maintenance work concentrates exposure: hands inside machines, guards removed, interlocks bypassed.
The financial stakes rose again for 2026. Penalty amounts assessed after January 15, 2026 are listed below (OSHA, 2026).
| Violation Type | Maximum Penalty (2026) |
|---|---|
| Serious or other-than-serious | $16,550 per violation |
| Willful or repeated | $165,514 per violation |
| Failure to abate | $16,550 per day beyond the abatement date |
The citation is rarely the largest cost. The National Safety Council puts the average cost of a medically consulted work injury at $43,000, with work injuries costing the US economy $176.5 billion in 2023 (NSC Injury Facts, 2023). A single skipped lockout can outweigh years of procedure-writing effort.
Why Does Standard Lockout Fail for Humanoid Robots?
Standard LOTO assumes that removing energy makes a machine safe. For a humanoid robot the opposite can be true. A biped standing on two legs stays upright only because its control system continuously and actively balances it. Kill the battery and that software disappears, and a machine weighing as much as an adult human becomes an unsupported falling object. The lockout step itself creates the struck-by hazard it was meant to prevent.
The data shows why this matters. A NIOSH analysis identified 41 robot-related workplace fatalities in the US between 1992 and 2017, and the pattern of harm is striking.
Of the 41 robot-related fatalities NIOSH identified between 1992 and 2017, 78% involved a robot striking the worker, and 83% involved stationary robots (NIOSH; Layne, American Journal of Industrial Medicine, 2023).
Bipedal humanoids shift that risk profile, because unlike stationary machines they fall the moment they are de-energized. Standards bodies have recognized the gap. ISO is drafting ISO/WD 25785-1 specifically for dynamically stable mobile robots, machines with “actively controlled stability” that can become unstable in the absence of power (ISO, under development). Until it publishes, your written procedure has to bridge the gap. I track how the current standards landscape applies to bipeds in my overview of humanoid robot safety standards for 2026.
The practical rule that generic templates miss: physical support must be engaged before energy isolation. Power down a braced robot and nothing moves. Power down a free-standing one and gravity takes over.
What Does an OSHA-Compliant Alternative Energy Control Procedure Look Like?
OSHA 29 CFR 1910.147 requires an energy control procedure that actually protects workers. When cutting power itself creates a new hazard, as it does with a balancing biped, the documented procedure has to address that hazard and deliver equivalent protection. That is what the controlled shutdown below does: not a shortcut, but a documented hazard-driven re-sequencing. The justification belongs in your risk assessment, which is why I pair this procedure with my ISO 12100 risk assessment template for robots.
Here is the 6-step controlled shutdown I recommend for humanoid platforms:
- Pre-maintenance notification. Notify affected employees that servicing is starting and the robot is coming out of operation.
- Controlled motion to service pose. Use the manufacturer’s service mode to command the robot into its designated maintenance posture, typically crouched, seated or docked, while power and balance control are still active.
- Engage mechanical bracing. Attach the gantry hook, service stand or support frame and confirm it bears the load. This happens BEFORE any energy isolation.
- Battery isolation. Operate the battery disconnect and isolate any external supply, then address residual sources such as capacitors per the manufacturer’s bleed-down time.
- Apply lockout and tag. Each authorized employee applies a personal lock and tag to the isolation point or lockable cover.
- Verify zero energy. Attempt a controlled start, test for stored electrical energy, and physically confirm limbs are supported and cannot drop.
Document the sequence exactly as performed, name the service pose, and reference the bracing hardware by part number. An auditor should be able to follow the paper to the physical robot without guessing.
If you would rather not build this document from a blank page, my Robot Safety Documentation Toolkit includes an editable Word LOTO procedure template. The 6-step controlled shutdown, the energy-source inventory table and the re-energizing checklist are already structured for you.
Which Energy Sources Does a Humanoid Robot Hold?
29 CFR 1910.147 covers all hazardous energy, not just electricity (OSHA). A humanoid robot is unusually dense with energy types for its size, and your loto procedure template needs a row for each one. This inventory table is the heart of the document.
| Energy Source | Where It Lives | Isolation Method | Verification |
|---|---|---|---|
| Electrical (battery) | Onboard battery pack, charging port | Battery disconnect or pack removal; unplug charger; lock the disconnect or cover | Attempted start fails; voltage check at service port reads zero |
| Stored electrical (capacitors) | Motor drives, power electronics | Wait the manufacturer’s bleed-down time after disconnect | Voltage measurement across drive terminals before touching conductors |
| Gravitational | Raised arms, torso mass, anything the robot is holding | Service pose plus mechanical bracing engaged before power-down; remove payload | Physically confirm limbs rest on supports and cannot drop when nudged |
| Kinetic / spring | Tensioned actuators, series-elastic elements, parallel springs | Move joints to neutral positions in service pose; block or pin spring-loaded joints | Manually flex each joint; no stored tension releases |
| Pneumatic | Grippers, end effectors on some platforms | Close and lock the supply valve; vent trapped air downstream | Pressure gauge reads zero; gripper does not actuate on command |
| Thermal | Motors, drives, battery pack after operation | Mandatory cool-down period after the shift ends | Surface temperature check before handling actuators or the pack |
Gravitational energy is the row generic templates always miss, and on a biped it is the row that matters most. The bracing requirement in step 3 of the shutdown sequence exists to control exactly this line of the table.
How Do You Re-Energize Safely?
Restoring energy causes its own incidents, which is why 1910.147 requires a defined release-from-lockout sequence (OSHA). For a humanoid the ordering rule inverts again: the robot must regain active balance control before the mechanical bracing comes off. Remove the bracing first and you have recreated the falling hazard in reverse.
My 5-step re-energizing sequence:
- Inspect the work area. Tools removed, covers reinstalled, the robot mechanically complete and the payload area clear.
- Clear and notify personnel. Confirm everyone is outside the robot’s envelope and tell affected employees that power is returning.
- Remove locks and tags. Each authorized employee removes only their own device, per the standard.
- Restore power in the braced pose. Reconnect the battery and let the controller boot, run self-checks and activate balance control while the robot is still supported.
- Remove mechanical bracing LAST. Only after the control system confirms active stability does the support frame come off, followed by a supervised return to operation.
Anything that went wrong during servicing, including the close calls where nobody was hurt, belongs in your incident records. I cover how to capture those events in my near-miss report form for robot operations, because OSHA notes that investigating near misses lets employers identify the corrective actions that prevent future incidents (OSHA).
How Do I Document and Post the Procedure?
A LOTO procedure that lives in a binder nobody opens fails its purpose. 1910.147 also requires a periodic inspection of each energy control procedure at least annually, performed by an authorized employee not using the procedure being inspected, plus training records for authorized and affected employees (OSHA).
My documentation checklist for each humanoid platform:
- Post the procedure at the point of use, laminated at the service station, with the 6-step shutdown and the energy inventory table on one page.
- Reference your risk assessment. The alternative procedure’s justification, that standard lockout creates a fall hazard, should trace back to a documented hazard analysis.
- Log every annual inspection with date, inspector, employees included and any deviations corrected.
- Version-control the document. When the manufacturer changes the service pose or bracing hardware, the procedure changes the same week.
- Keep training records current for every authorized employee, including hands-on practice of the bracing step.
These records do not stand alone. They slot into the full document set I describe in my robot safety documentation guide, alongside the risk assessment and incident reporting forms.
Every document in that checklist, including the editable Word LOTO procedure template with the controlled shutdown sequence built in, ships inside my Robot Safety Documentation Toolkit, so you can adapt it to your robot instead of drafting from zero.
Frequently Asked Questions
Is a generic LOTO procedure template enough for a humanoid robot?
No. Generic templates assume de-energizing makes the machine safe, but a powered-off biped loses the active control keeping it upright and becomes a falling hazard. A humanoid procedure must add a service pose, mechanical bracing before isolation, and a gravitational energy row in the inventory table.
Does OSHA allow deviating from the standard lockout sequence?
29 CFR 1910.147 requires an energy control procedure that actually protects workers. When the standard lockout sequence itself creates a new hazard, the written procedure has to address that hazard and deliver equivalent protection. Document the justification in your risk assessment and have a qualified safety engineer review the resulting procedure before anyone uses it.
How expensive is getting robot LOTO wrong?
OSHA’s 2026 maximums are $16,550 per serious violation and $165,514 per willful or repeated one (OSHA, 2026). The injury itself costs more: the National Safety Council reports an average of $43,000 per medically consulted work injury and $1,460,000 per workplace death (2023 data).
Who is allowed to perform lockout/tagout on a robot?
Only authorized employees who have been trained on that specific procedure, including the controlled shutdown and bracing steps. Affected employees who operate or work near the robot need awareness training, and each authorized employee applies and removes a personal lock, exactly as 29 CFR 1910.147 requires for any machine.
How often should I review a robot LOTO procedure?
At least annually, through the periodic inspection 1910.147 requires, and immediately after any change to the robot, its service pose, its bracing hardware or its servicing tasks. With humanoid platforms receiving frequent software and hardware updates, I treat every manufacturer service bulletin as a trigger to re-check the procedure.
Where to go next: this procedure is one of six documents every humanoid deployment needs. I map all of them, in the order auditors expect, in the Robot Safety Documentation Guide 2026.
This article is for informational purposes only and does not constitute legal, regulatory or professional safety advice. Have your energy control procedure reviewed by a qualified safety engineer.
Sources
- OSHA, 29 CFR 1910.147, The control of hazardous energy (lockout/tagout): https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.147
- OSHA, Control of Hazardous Energy topic page: https://www.osha.gov/control-hazardous-energy
- OSHA, Top 10 most frequently cited standards, FY2025: https://www.osha.gov/top10citedstandards
- OSHA, civil penalty amounts, 2026: https://www.osha.gov/penalties
- OSHA, incident investigation and near misses: https://www.osha.gov/incident-investigation
- NIOSH/CDC, Robotics in the Workplace: An Overview: https://www.cdc.gov/niosh/robotics/about/index.html
- Layne LA, Robot-related fatalities at work in the United States, 1992-2017, American Journal of Industrial Medicine, 2023: https://onlinelibrary.wiley.com/doi/10.1002/ajim.23470
- National Safety Council, Injury Facts, Work Injury Costs: https://injuryfacts.nsc.org/work/costs/work-injury-costs/
- ISO/WD 25785-1, dynamically stable industrial mobile robots (under development): https://www.iso.org/standard/91469.html
Ulrich Baldauf is the founder of There’s A Robot For That, covering humanoid robotics for manufacturing and industrial operations. He has tracked the humanoid robot sector since 2024, with a focus on safety standards (ISO 10218, EU Machinery Regulation 2023/1230) and what deployments mean for operations and EHS teams. Connect on LinkedIn: linkedin.com/in/ubaldauf
