Summary
In short
- Every authorised employee exposed must have their own personal lockout device on the group device or lockbox. One lock for a crew defeats the entire purpose.
- A primary authorised employee must be designated with responsibility for the set of employees working under the group arrangement, and the role must be held by a person rather than by a shift.
- Group lockout must afford protection equivalent to a personal lockout device. That is the test in the standard, and it is what any arrangement should be measured against.
- Shift handover is where group lockout most often fails, because continuity of protection has to survive people leaving with their locks still required.
- 1910.147(f)(4) requires specific procedures for shift or personnel changes to ensure continuity of protection, including orderly transfer of devices between departing and arriving employees.
- The count of locks on the box should match the count of people exposed at any moment. Where it does not, the record has stopped describing reality.
What it is
What it is
What is group lockout?
The arrangement used when servicing or maintenance is performed by more than one person, under which each authorised employee affixes their own personal lockout device to a group lockout device or lockbox, so that the equipment cannot be re-energised while any one of them remains exposed.
Who is the primary authorised employee?
The person who assumes overall responsibility for the group's exposure under 1910.147(f)(3)(ii). They ascertain the status of the isolation, and they are accountable for the set of employees working under the group arrangement. It is a named role, not a shared responsibility.
When to use it
When to use it, and when not to
Group lockout records the arrangement. It does not replace the machine-specific procedure the isolation is applied from.
Use it for
- Servicing or maintenance where more than one authorised employee will be exposed
- Work involving multiple crafts on one asset, where each craft is separately exposed
- Work spanning more than one shift where the isolation must remain in place
- Complex isolations with multiple energy sources where a lockbox holds the keys
- Contractor and site crews working together on the same equipment
Not for
- The machine-specific energy control procedure, which states which sources to isolate and how to verify
- The permit to work, which authorises the activity where one is required
- Individual lockout for a single authorised employee servicing alone
- Tagout-only arrangements, which have their own additional requirements where an isolating device cannot accept a lock
- The work order, which records the work rather than the isolation protecting it
Standards
What it is built against
Group lockout is one paragraph of the energy control standard, and nearly every requirement in it addresses the same risk: that one person's action removes another person's protection.
| Clause | Requirement | Where it lands |
|---|---|---|
| 1910.147(f)(3)(i) | Group lockout to afford protection equivalent to a personal lockout or tagout device | Group control |
| 1910.147(f)(3)(ii)(A) | Primary authorised employee designated with responsibility for the set of employees under the group device | Header |
| 1910.147(f)(3)(ii)(B) | Primary authorised employee ascertains the exposure status of individual group members | Group control |
| 1910.147(f)(3)(ii)(C) | Where more than one crew is involved, overall job-associated lockout control responsibility assigned | Group control |
| 1910.147(f)(3)(ii)(D) | Each authorised employee affixes a personal device to the group device when work begins, removing it when finished | Individual locks |
| 1910.147(f)(4) | Specific procedures for shift or personnel changes ensuring continuity of protection and orderly transfer | Shift handover |
| 1910.147(c)(4) | Machine-specific energy control procedure documenting scope, purpose, authorisation and enforcement | Header |
| 1910.147(e) | Release from lockout: equipment check, personnel clear, devices removed by the employee who applied them | Closure |
What it does not cover
- The machine-specific energy control procedure, which defines the isolation points, sequence and verification method.
- The permit to work, where the activity also requires authorisation such as confined space or hot work.
- Verification of isolation, which is a positive test performed and recorded as part of applying the procedure.
- The periodic inspection, which certifies annually that procedures including group arrangements are being followed.
- Training certification, which evidences that each authorised employee understands the group arrangement.
Filling it in
Filling it in well
The record has to answer one question at any moment: who is currently exposed, and does their protection depend only on themselves.
The standard requires a designated person with responsibility for the group. Where a shift changes, the role transfers to a named individual on the incoming shift and the record should show both the handover and the acceptance. A role assigned to a shift rather than a person is a role nobody holds at 3am.
The number of personal devices on the box should equal the number of people currently exposed. Someone who has finished removes their lock; someone joining adds theirs. Where the count and the crew diverge, either equipment can be energised on someone or a lock is holding an isolation nobody needs, and both are findings.
1910.147(f)(4) requires an orderly transfer between departing and arriving employees. In practice that means the departing person's device is removed and the arriving person's applied, with the isolation continuously maintained. Handovers where locks are left on for the next shift to inherit break the personal-control principle the arrangement exists for.
Release requires the equipment to be checked, the area cleared of personnel, and devices removed by the employee who applied them. Each person removing their own lock as they finish is the mechanism. Removal by anyone else is permitted only under the narrow exception in 1910.147(e)(3), with its own verification and notification steps.
Audit findings
Common audit findings
Group lockout findings cluster on the personal device requirement and on shift changes.
| Finding | Clause | What fixes it |
|---|---|---|
| Single lock applied for the whole crew. | 1910.147(f)(3)(ii)(D) | Each exposed employee affixes their own device; anything else is not equivalent protection. |
| No primary authorised employee designated, or the role assigned to a shift rather than a person. | 1910.147(f)(3)(ii)(A) | Name the individual and re-name on handover, with acceptance recorded. |
| Locks left on across a shift change rather than transferred. | 1910.147(f)(4) | Transfer devices between departing and arriving employees with continuous isolation. |
| Lock count does not match the number of people exposed. | 1910.147(f)(3)(ii)(B) | Reconcile at each change; the primary authorised employee must ascertain exposure status. |
| Multiple crews with no overall lockout control responsibility assigned. | 1910.147(f)(3)(ii)(C) | Assign job-associated control where crews from different trades are involved. |
| Lock removed by someone other than the applier without following the exception procedure. | 1910.147(e)(3) | Follow the specific verification and notification steps; this exception is narrow. |
| Group arrangement applied without the machine-specific procedure. | 1910.147(c)(4) | The group record manages people; the procedure defines the isolation. |
| Contractor employees working under site locks with no personal devices. | 1910.147(f)(2) | Contractors exposed apply their own locks; exchange energy control information both ways. |
| Stored energy not relieved before the group began work. | 1910.147(d)(5) | Relieve and verify; group arrangements do not change the isolation sequence. |
| No record of who was exposed at any given time, so closure cannot be verified. | 1910.147(e)(1) | Maintain a live list; closure requires knowing everyone is clear. |
Worked case
Case in point: the lock that stayed on overnight
A packing line overhaul ran across two shifts. The day crew applied six personal locks to the lockbox and worked until 6pm. Rather than removing them for the night crew to apply their own, the outgoing supervisor left the locks in place, reasoning that the isolation stayed intact and the equipment stayed safe overnight.
The night crew arrived, found the box locked, and worked under the day crew's locks. At 2am one of them needed to move a guard that required a further isolation point. The primary authorised employee for the night shift had not been designated, the day supervisor was at home, and the crew's protection depended on locks belonging to people who were asleep and who believed the job was finished.
Nothing happened. The isolation held and the work completed. But for eight hours the arrangement had failed the equivalence test, because no person working on the machine had personal control over the energy isolating them from it.
Definitions
Definitions and key terms
- Group lockout device
- A lockbox or comparable mechanism holding the keys to the isolation, to which each exposed employee applies a personal device.
- Primary authorised employee
- The designated individual with responsibility for the set of employees working under the group arrangement.
- Personal lockout device
- An individual's own lock, uniquely identifiable and removable only by them except under the narrow standard exception.
- Equivalent protection
- The test in 1910.147(f)(3)(i): the group arrangement must protect each person as a personal device would.
- Orderly transfer
- The handover of lockout devices between departing and arriving employees so isolation and personal protection are both continuous.
- Job-associated control
- Overall lockout responsibility assigned where more than one crew, craft or department is involved.
- Stored energy
- Residual energy in springs, hydraulics, capacitors, suspended loads and pressure that must be relieved and verified.
- Release sequence
- Equipment check, personnel clear, devices removed by their owners, then re-energisation.
FAQ
Frequently asked questions
Can a supervisor lock out on behalf of a crew?+
No. Each authorised employee exposed must affix a personal lockout device, because the arrangement must afford protection equivalent to individual lockout. A supervisor's lock means the crew's protection can be removed by someone who is not exposed and may believe the job is finished, which is the exact situation the requirement exists to prevent.
What happens at shift change?+
1910.147(f)(4) requires specific procedures ensuring continuity of protection, including orderly transfer between departing and arriving employees. In practice the outgoing person removes their device as the incoming person applies theirs, with the isolation maintained throughout. Locks left on for the next shift keep the equipment isolated and leave the people working on it without personal control.
Who removes a lock if someone has gone home with the key?+
Only under the specific exception at 1910.147(e)(3), which requires a documented procedure including verifying the employee is not at the facility, making all reasonable efforts to contact them, and ensuring they are informed before resuming work. It is deliberately onerous, and a site using it routinely has a handover problem rather than a key problem.
Do contractors apply their own locks?+
Yes, where they are exposed. 1910.147(f)(2) requires host and contract employers to exchange energy control information in both directions, and contractor employees working on the isolated equipment need their own personal devices on the group arrangement rather than relying on site locks.
How many people can work under one lockbox?+
The standard sets no limit. The practical constraint is whether the primary authorised employee can ascertain the exposure status of everyone under it, which becomes difficult with large or dispersed crews. Where it does, splitting into multiple groups with their own primary authorised employees is better than a box nobody can reconcile.
The agents
What the agents do with it
The record manages people rather than energy. What fails is the lock count that stopped matching the crew, and the shift change where protection was inherited instead of transferred.
Holds the group record against the asset and its machine-specific procedure, tracks locks against exposed people, and blocks closure while any remain applied.
Requires a named primary authorised employee at each handover and records the acceptance, so the role is never held by a shift.
Brings contractor personnel into the same lock count and records the two-way energy control information exchange before work starts.
Watches for group arrangements spanning shifts and flags where locks have persisted across a handover without transfer.
This template lives in KnowMaintain — asset maintenance. Work orders, planned maintenance, calibration, reliability and shutdowns.
Meet KnowMaintain→Sources
Sources
- 29 CFR 1910.147(f)(3), group lockout or tagout, OSHA
- 29 CFR 1910.147(f)(4), shift or personnel changes, OSHA
- 29 CFR 1910.147(e), release from lockout or tagout, OSHA
- 29 CFR 1910.147(c)(4), energy control procedures, OSHA
- CSA Z460, control of hazardous energy (Canada)