Summary
In short
- Verification is a required step, not a formality. Attempt to operate the equipment, confirm zero energy, and return controls to the off position.
- All energy sources means all: electrical, hydraulic, pneumatic, mechanical, thermal, chemical, gravitational and stored energy in springs, capacitors and accumulators.
- Stored and residual energy must be relieved, disconnected, restrained or otherwise rendered safe, and this is where isolation records most often stop short.
- Group lockout must give each person protection equivalent to a personal lock. A single lead lock without a mechanism guaranteeing individual protection does not.
- Shift change and personnel change need continuity of protection, which is the specific point at which group arrangements fail.
- Machine-specific procedures are required where a machine has more than one energy source or where a generic procedure would not adequately control it.
What it is
What it is
What is an energy isolation permit?
Authorisation controlling the isolation of energy sources for servicing or maintenance, recording every source identified, the isolation applied and verified, how stored and residual energy was relieved, and who is working under the isolation.
Why is group lockout treated separately?
Because a single lock applied by a lead person protects the group only if the arrangement guarantees each individual's personal protection. Under 1910.147(f)(3), group lockout must afford each authorised employee a level of protection equivalent to a personal lockout device, which usually means a group lock box with each person's own lock on it.
When to use it
When to use it, and when not to
This authorises isolation for a specific job. Machine procedures and training sit separately.
Use it for
- Servicing or maintenance where unexpected energisation or release of stored energy could cause injury
- Work requiring guard removal or bypass of a safety device
- Group work where several people or trades work under one isolation
- Work spanning shifts, where protection has to persist across handover
- Contractor work performed under site isolation arrangements
Not for
- Machine-specific energy control procedures, which state how each machine is isolated
- Line breaking, which verifies the condition at the point of opening
- The electrical work permit, where work will be performed energized
- Energy control training records under 1910.147(c)(7)
- The periodic inspection under 1910.147(c)(6), which certifies the procedures are followed
Standards
What it is built against
Energy control is prescriptively regulated with specific requirements for verification, stored energy and group work.
| Clause | Requirement | Where it lands |
|---|---|---|
| 1910.147(c)(4) | Machine-specific procedures where more than one energy source exists or generic control is inadequate | Gate 1 Energy sources |
| 1910.147(d)(2) | Orderly shutdown to avoid additional hazard from the shutdown itself | Gate 1 Energy sources |
| 1910.147(d)(4) | Lockout devices applied by authorised employees, holding the isolating device in the safe position | Gate 2 Lock and verify |
| 1910.147(d)(5) | Stored or residual energy relieved, disconnected, restrained or otherwise rendered safe | Gate 2 Lock and verify |
| 1910.147(d)(6) | Verification that isolation and de-energisation have been accomplished before work begins | Gate 2 Lock and verify |
| 1910.147(f)(3) | Group lockout affording each authorised employee protection equivalent to a personal lockout device | Gate 3 Group control |
| 1910.147(f)(4) | Shift or personnel changes with continuity of lockout protection | Workers under this isolation |
| 1910.147(e) | Release sequence: equipment check, personnel clear, devices removed by those who applied them | Closure |
What it does not cover
- Machine-specific energy control procedures, stating how each machine is isolated.
- Line breaking, verifying the condition at the point of opening.
- The electrical work permit, where work will be performed energized.
- Energy control training records under 1910.147(c)(7).
- The periodic inspection, certifying that procedures are followed.
Filling it in
Filling it in well
Find every source, verify rather than assume, and make group protection individual.
Electrical supplies including secondary feeds and control circuits, hydraulic and pneumatic pressure, mechanical motion, thermal, chemical, gravitational, and energy stored in springs, capacitors, accumulators and raised loads. The machine-specific procedure should list them, and where it does not, that is a finding rather than a reason to proceed from memory.
Press start, operate the control, test for absence of voltage where electrical, confirm gauges read zero, and check that gravitational and spring energy is restrained. Then return controls to off. This is a required step and it is what finds the wrong isolator and the supply nobody documented.
A group lock box with each person's personal lock on it means no one source can be re-energised while any individual's lock remains. A single lead lock, without an equivalent mechanism, protects the lead person and gives everybody else a procedure. The requirement is protection equivalent to a personal lockout device for each authorised employee.
Handover is where group arrangements fail: the outgoing lead removes their lock, the incoming lead applies theirs, and there is a moment between. The procedure needs to specify how protection persists without interruption, and it needs to work at three in the morning with a different set of people.
Audit findings
Common audit findings
Isolation findings concentrate on verification and on group arrangements.
| Finding | Clause | What fixes it |
|---|---|---|
| Isolation applied but not verified before work began. | 1910.147(d)(6) | Attempt to operate; verification is the step that finds the wrong isolator. |
| Stored and residual energy not relieved or restrained. | 1910.147(d)(5) | Springs, accumulators, capacitors and raised loads all retain energy after isolation. |
| Group lockout by a single lead lock with no individual protection. | 1910.147(f)(3) | Each person requires protection equivalent to a personal lockout device. |
| Secondary supplies or control circuits not identified. | 1910.147(c)(4) | Machine-specific procedures should list every source; memory is not a source list. |
| No continuity of protection across shift change. | 1910.147(f)(4) | Handover is where group arrangements break; specify how protection persists. |
| Controls not returned to the off position after verification. | 1910.147(d)(6) | Otherwise the equipment starts when isolation is removed. |
| Lockout device removed by someone other than the person who applied it. | 1910.147(e)(3) | Removal by the applier, with a specific documented exception procedure only. |
| Contractors working under site isolation without information exchange. | 1910.147(f)(2) | Exchange in both directions before work begins. |
| Tagout used where lockout is achievable. | 1910.147(c)(3) | Tagout requires full employee protection and additional measures; lockout is preferred. |
| Periodic inspection reviewing paperwork rather than observing an isolation. | 1910.147(c)(6) | Watch it performed; that is what the inspection is for. |
Worked case
Case in point: the second supply
A conveyor drive was isolated at its local isolator, locked and tagged, and work began on the gearbox. The machine had a secondary supply feeding a small auxiliary drive on the same shaft assembly, installed during a modification some years earlier and fed from a different panel.
The machine-specific procedure listed one energy source, because it had been written before the modification and never revised. The technician followed it correctly.
Verification would have found this. Attempting to operate the equipment after isolation would have shown that part of the assembly still moved, which is precisely what that step exists to reveal. It was not performed, because the isolator was locked and everything looked right.
Definitions
Definitions and key terms
- Energy isolating device
- A mechanical device that physically prevents transmission or release of energy, such as a breaker, valve or disconnect.
- Verification
- Confirming that isolation and de-energisation have been accomplished, typically by attempting to operate the equipment.
- Stored energy
- Energy remaining after isolation, in springs, capacitors, accumulators, raised loads, pressure or heat.
- Group lockout
- An arrangement for multiple workers, requiring each to have protection equivalent to a personal lockout device.
- Group lock box
- A box holding the keys to the isolation locks, secured by each worker's personal lock.
- Authorised employee
- A person who locks out or tags out equipment to perform servicing or maintenance.
- Continuity of protection
- Maintaining lockout across shift and personnel changes without any interval of unprotected exposure.
- Machine-specific procedure
- Documented energy control steps for a particular machine, required where multiple sources exist.
FAQ
Frequently asked questions
Why is verification so important?+
Because it is the only step that tests the actual state rather than the documented one. Every other control depends on the source list being complete, and source lists go out of date whenever a machine is modified. Attempting to operate the equipment finds the wrong isolator, the second supply nobody documented, the valve that has not seated and the capacitor still holding charge.
What does group lockout require?+
That each authorised employee has protection equivalent to a personal lockout device. In practice that means a group lock box: the isolation keys go inside, and every person working applies their own lock to the box. A single lead lock, without such a mechanism, protects the lead person and gives everyone else a procedure to rely on.
What about shift changes?+
Continuity of protection is required, and handover is where group arrangements typically fail. The outgoing lead removes their lock and the incoming lead applies theirs, leaving a moment where protection depends on nobody starting anything. The procedure has to specify how protection persists without interruption, and it has to work with a different set of people at night.
What is most often missed in the source list?+
Stored energy and secondary supplies. Springs, accumulators, capacitors, raised loads, thermal energy and residual pressure all persist after the main isolation. Secondary supplies and control circuits added during modifications are frequently absent from procedures written before the modification, and the person isolating cannot isolate a source the procedure does not mention.
Is tagout acceptable instead of lockout?+
Only where an energy isolating device is not capable of being locked out, or where the tagout programme provides full employee protection with additional measures. Lockout is the default because a tag is a warning device with no physical restraint, and where tagout is used the training must cover that limitation explicitly.
The agents
What the agents do with it
The permit controls isolation for a job. What fails is verification nobody performed and a group lock protecting one person.
Requires verification as a gate before work begins, and holds group lock box arrangements so each worker's protection is individual.
Keeps machine-specific source lists current through modification, which is where secondary supplies enter unrecorded.
Records authorised, affected and other employee training, and fires retraining on procedure and machine changes.
Tracks isolations spanning shifts and flags handover points where continuity of protection is at risk.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Sources
Sources
- 29 CFR 1910.147, control of hazardous energy, OSHA
- 29 CFR 1910.147(f)(3) and (f)(4), group lockout and shift changes, OSHA
- CSA Z460, control of hazardous energy (Canada)
- 29 CFR 1910.147(c)(6), periodic inspection, OSHA
- ISO 14118, prevention of unexpected start-up