Summary
In short
- OSHA requires a written, machine specific energy control procedure for every machine that is serviced, unless all eight conditions of the documentation exception in 1910.147(c)(4)(i) are met at once.
- A general corporate lockout/tagout policy does not satisfy 1910.147(c)(4). Missing machine specific procedures are the most frequently cited paragraph in the standard.
- Control of hazardous energy ranked fourth on OSHA's list of most frequently cited standards for fiscal year 2025, and OSHA estimates compliance prevents roughly 120 fatalities and 50,000 injuries each year.
- The six step application sequence in 1910.147(d) must be performed in order: prepare for shutdown, shut down, isolate, apply devices, relieve stored energy, then verify isolation.
- Emergency stops, interlocks, push buttons and other control circuit devices are excluded from OSHA's definition of an energy isolating device and cannot be used to isolate energy during servicing.
- Outside the United States the UK under PUWER regulation 19 and Australia under the model WHS regulations state the duty as an outcome rather than a prescribed method, so a procedure written to the OSHA standard generally exceeds their documentation requirements.
What it is
What it is
A machine specific energy control procedure is the written document that records how one piece of equipment is shut down, isolated from every energy source, locked, verified de-energized and returned to service. OSHA requires one per machine under 29 CFR 1910.147(c)(4). A facility-wide lockout/tagout policy is a programme, not a procedure, and does not satisfy the requirement.
What is lockout/tagout?
Lockout/tagout is a safety procedure that isolates a machine from every source of hazardous energy and physically locks it in the off position before anyone services or maintains it. It prevents the machine from starting up, energizing or releasing stored energy while a worker is exposed. In the United States it is regulated under 29 CFR 1910.147.
What is an energy control procedure?
An energy control procedure is the written, machine specific document that sets out exactly how one piece of equipment is shut down, isolated, locked, verified de-energized and returned to service. OSHA requires one for each machine under 1910.147(c)(4).
When to use it
When to use it, and when not to
Scope errors run both ways. Some facilities write procedures for equipment the standard never covered, burning effort that should have gone to the machines that could actually kill someone. Others assume an exemption applies and leave a real gap. Both show up in audits, and the second one shows up in incident reports.
Use it for
- Employees service or maintain machines where unexpected energization, start-up, or release of stored energy could cause injury (a)(1)(i)
- Servicing happens during normal production and a worker must remove or bypass a guard or safety device (a)(2)(ii)(A)
- A worker must place any part of the body into the point of operation or an associated danger zone (a)(2)(ii)(B)
- The work is cleaning, unjamming, lubrication, setup, adjustment, inspection, or modification, all of which the standard defines as servicing (b)
- Another OSHA standard directs you to apply lockout, in which case this section's procedural and training requirements supplement it (a)(3)(ii)
Not for
- Construction, agriculture, shipyard, marine terminal, and longshoring work, which fall outside the scope (a)(1)(ii)
- Oil and gas well drilling and servicing, and electric utility generation, transmission, and distribution installations (a)(1)(ii)(C), (E)
- Cord-and-plug equipment where unplugging controls the hazard and the plug stays under the exclusive control of the person doing the work (a)(2)(iii)(A)
- Minor tool changes and adjustments that are routine, repetitive, and integral to production, provided alternative measures give effective protection
- Electrical work on utilization installations covered by Subpart S, which needs an energized work permit under NFPA 70E rather than this document
Standards
What it is built against
| Clause | Requirement | Where it lands |
|---|---|---|
| (c)(4)(ii)(A) | Specific statement of the procedure's intended use | Header, tasks covered |
| (c)(4)(ii)(B) | Steps for shutting down, isolating, blocking and securing | Procedure steps |
| (c)(4)(ii)(C) | Placement, removal and transfer of devices, and who is responsible | Procedure steps |
| (c)(4)(ii)(D) | Requirements for testing to verify effectiveness of energy control | Energy sources, verification method |
| (d)(1) | Authorized employee must know the type and magnitude of energy present | Energy sources, magnitude |
| (d)(3) | All energy isolating devices located and operated to isolate the machine | Energy sources, isolation point |
| (d)(5) | Stored and residual energy relieved, disconnected or restrained | Energy sources, stored energy |
| (d)(6) | Isolation verified before work begins | Procedure steps, verification |
| (e) | Release from lockout, area clearance and restart checks | Procedure steps, restoration |
| CSA Z460 cl.7.3.2.3 | Energy control procedure per machine, Canadian equivalent | Whole record |
What it does not cover
- Annual periodic inspection under (c)(6), which needs its own certification naming machine, date, employees and inspector. See MNT-056.
- Training and communication under (c)(7), certified by name and date. See TRN-036.
- Group lockout under (f)(3), which needs a lockbox roster and a named primary authorized employee. See MNT-058.
- Lock removal when the applier is unavailable, which needs the documented exception under (e)(3). See MNT-059.
- Energized electrical work, which requires an NFPA 70E permit rather than this procedure.
The sequence
How the record runs
- 1
Prepare for shutdown(d)(1)
Record what the authorized employee must know before touching anything: the energy types present, their magnitudes, the hazards each presents, and the means of control. Note affected employees who must be told before controls go on, per (c)(9).
- 2
Shut down the equipment(d)(2)
Specify the normal shutdown method for this machine. The standard calls for an orderly shutdown that avoids creating a new or increased hazard. Abruptly dropping power to a loaded conveyor or a heated vessel can be more dangerous than a controlled stop.
- 3
Isolate every energy source(d)(3)
One line per isolating device, in the order they are operated, with the device identifier and location. Where the walk route matters, say so. A crew that isolates the main disconnect and misses the compressed air header has not isolated the machine.
- 4
Apply locks and tags(d)(4)
Each authorized employee affixes their own device. Devices must be singularly identified, used for nothing else, standardized within the facility by colour, shape or size, and must indicate who applied them (c)(5)(ii). Where a tag cannot attach to the device directly, it goes as close as safely possible and in a position obvious to anyone about to operate it.
- 5
Relieve stored energy(d)(5)
Name each stored energy source and the specific action that renders it safe: bleed the accumulator, block the ram, discharge the capacitor bank, chock the roll, allow the surface to cool below a stated temperature. Where energy can reaccumulate, (d)(5)(ii) requires verification of isolation to continue for the duration of the work.
- 6
Verify isolation(d)(6)
State the verification method for each source and who performs it. For electrical, that means testing with a meter proven live-dead-live, not observing an indicator lamp. For pneumatic and hydraulic, a gauge reading at zero. For mechanical, an attempted start with controls returned to the off position afterward. Verify de-energized written without a method is the wording inspectors flag most often in this section.
Filling it in
Filling it in well
The template has four sections. The first identifies the equipment, the second inventories energy, the third carries the mandated sequence and the fourth records coverage and sign-off. The middle steps are numbered because the regulation makes them a sequence: 1910.147(d) states the elements shall be done in the order given, and performing them out of order is itself a deviation.
Use the name operators actually say out loud, plus the asset or tag number from your CMMS, the physical location, and the revision number and date. Two failures recur. The procedure names the equipment by a model number nobody on the floor uses, so the wrong document gets pulled at three in the morning. Or the asset identifier does not reconcile to the maintenance system, so nobody can prove coverage is complete. If your procedure library and your asset register do not share a key, you cannot answer the first question an auditor will ask.
(c)(4)(ii)(A) requires a specific statement of what the procedure is for. Name the tasks it covers, belt replacement, die change, blade sharpening, jam clearing, and name the tasks it does not. Where a task is excluded because it qualifies as minor servicing, say which alternative protective measures apply. This is the paragraph that separates a procedure from a poster.
List every energy source, not just the electrical supply. The standard's definition covers electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and any other energy, and stored energy is where incidents concentrate. Record type and magnitude for each: 480 V three phase, 90 psi pneumatic, a 12-foot gravitational drop on a raised platen, residual steam at 150 psi. Magnitude isn't decorative detail. (d)(1) requires the authorized employee to know the type and magnitude of the energy before shutdown starts, and a procedure that says only "electrical" can't support that.
For each energy source, identify the isolating device, its physical location, its type, and its isolated position. The standard's definition of an energy isolating device is a mechanical device that physically prevents transmission or release of energy: a circuit breaker, a disconnect switch, a line valve, a block. It then states plainly that push buttons, selector switches, and other control circuit devices are not energy isolating devices.
Audit findings
Common audit findings
| Finding | Clause | What fixes it |
|---|---|---|
| A general LOTO policy exists but no machine specific procedures. The most cited paragraph in the standard. | (c)(4) | One procedure per asset, reconciled against the asset register, with the eight point justification recorded wherever the documentation exception is claimed. |
| Training delivered but not certified, or certification missing names and dates. | (c)(7)(iv) | A roster keyed to each authorized and affected employee with training dates, refreshed on the (c)(7)(iii) triggers. |
| Annual periodic inspection not performed, or performed but not certified. | (c)(6) | A certification naming machine, date, employees included and inspector. All four, since a partial record is still a finding. |
| Periodic inspection performed by the same employee who uses the procedure. | (c)(6)(i)(A) | Assign a different authorized employee. On small crews, cross assign between lines or shifts. |
| Stored energy step absent, or present but generic. | (d)(5) | Each stored source named with its specific relief action, and a stated control where energy can reaccumulate. |
| Verification written as an instruction to verify, with no method stated. | (d)(6) | A named test per energy source with the instrument or observable result, and who performs it. |
| Energy magnitude not recorded, sources listed by type only. | (d)(1) | Voltage, pressure, temperature or load recorded for every source in the inventory. |
| Group lockbox used in practice with no documented group procedure. | (f)(3) | Primary responsibility assigned by name, exposure status method defined, cross craft coordination described. |
| Contractor performs servicing with no exchange of energy control procedures. | (f)(2) | A documented two way exchange at mobilisation, retained with the contractor qualification file. |
| Procedure exists in an office binder but not at the point of use, or was not revised after a machine modification. | (c)(4)(i) | Procedure available at the equipment, revision triggered by management of change and retraining triggered alongside. |
Worked case
What happens when lockout/tagout procedures are missing
[object Object]
[object Object]
[object Object]
By jurisdiction
How the duty differs by jurisdiction
29 CFR 1910.147
ANSI/ASSP Z244.1-2024 (voluntary)
Prescriptive. Specifies procedure contents, application sequence, device standards, annual inspection and certification fields.
The procedure is the compliance artifact. Penalties reach $16,550 per serious violation and $165,514 for willful or repeat.
CSA Z460:20
Provincial OHS regulations
Standard referenced, provincially enforced. Lockout is primary; other methods permitted on risk assessment.
Same sequence, different vocabulary: authorized person and affected person. Check BC OHSR Part 10, Alberta OHS Code Part 15 or Ontario Reg. 851.
PUWER 1998 reg 19; Electricity at Work Regs 1989
Goal setting. Employers must provide suitable means to isolate equipment from all its sources of energy.
No mandated annual inspection or certification format. Weight falls on competence, proportionate to the risk of the task.
Model WHS Regs 2011 reg 208; AS/NZS 4024.1603:2019
Duty based. A PCBU must minimise risk so far as reasonably practicable; plant must have provision for a lockable isolating device.
Technical detail sits in the Australian Standards. Codes of practice are admissible in proceedings. Victoria runs its own OHS Act.
OSH Code, 2020; Central Rules 2026
In transition. The Code came into force 21 November 2025 and repealed the Factories Act, 1948.
Two tier: central rules plus state rules, with states still notifying through 2026. Confirm what your state has notified.
Machinery Regulation (EU) 2023/1230; EN ISO 14118
Design side. The duty to make equipment isolable falls largely on the manufacturer.
Your procedure inherits the isolation points the designer provided. Older machines leave the gap with the employer.
What is changing
What is changing
1910.147 was issued in 1989 and its core text has changed little since. Two developments are worth tracking if you are writing procedures for automated equipment.
OSHA has signalled a proposed rule to modernize the standard, addressing the use of control circuit type devices for energy isolation and hazardous energy control around robotics. The agency's stated rationale is that technology has advanced far enough since 1989 that such devices may be at least as safe as mechanical isolation in some circumstances. A notice of proposed rulemaking with a public comment period is the next step. Until a final rule issues, the current prohibition stands, and procedures should continue to specify mechanical isolating devices.
The 2024 edition of the consensus standard elevates alternative methods to a co-equal choice with lockout, selected on the basis of a documented risk assessment. Lockout remains mandatory where no risk assessment has been completed or where tasks and hazards are not fully understood. The practical trap for US employers is that Z244.1 is voluntary while 1910.147 is enforceable: a Z244.1-compliant alternative method can still draw a citation. Treat the consensus standard as design guidance, and the regulation as the compliance floor.
Definitions
Definitions and key terms
- Authorized employee
- A person who locks or tags out equipment in order to service or maintain it. An affected employee becomes authorized when their duties include that servicing.
- Affected employee
- Someone whose job requires them to operate the equipment being serviced or work in the area. They do not apply locks but must be notified before and after.
- Energy isolating device
- A mechanical device that physically prevents transmission or release of energy: a breaker, disconnect switch, line valve or block. Push buttons and selector switches are excluded.
- Energy source
- Any source of electrical, mechanical, hydraulic, pneumatic, chemical, thermal or other energy, including stored and residual energy.
- Capable of being locked out
- An isolating device with a hasp or built in locking mechanism, or one lockable without dismantling or permanently altering it.
- Lockout device
- A device using a positive means such as a keyed or combination lock to hold an isolating device in a safe position.
- Tagout device
- A prominent warning device fastened to an isolating device. It warns; it does not physically restrain.
- Servicing and maintenance
- Constructing, installing, setting up, adjusting, inspecting, modifying and maintaining equipment, including lubrication, cleaning and unjamming. Sanitation falls inside this.
FAQ
Frequently asked questions
Do we need a written procedure for every machine?+
Nearly always. The exception in (c)(4)(i) requires all eight conditions at once, and the first, no potential for stored, residual or reaccumulating energy, rules out most powered equipment. Where you rely on it, document the justification rather than leaving the record empty.
Who can perform the annual periodic inspection?+
An authorized employee other than the one using the procedure being inspected. The inspection includes a review with each authorized employee of their responsibilities under that procedure.
How often must lockout/tagout training be repeated?+
There is no fixed calendar interval. Retraining is triggered by a change in job assignment, a change in machines or processes presenting a new hazard, a change in the procedures, or an inspection revealing gaps in knowledge.
Does an emergency stop count as energy isolation?+
No. E-stops, interlocks and safety rated control functions are control circuit devices, excluded from the definition of an energy isolating device in 1910.147(b). They protect during production, not during servicing.
What are the six steps of lockout/tagout?+
Prepare for shutdown by identifying energy types and magnitudes; shut down in an orderly way; isolate every source at its isolating device; apply lockout or tagout devices; relieve all stored and residual energy; verify isolation before work begins. The order is mandated by 1910.147(d).
Who is allowed to remove a lock or tag?+
The person who applied it. The only exception, under (e)(3), applies when that employee is unavailable and requires a documented removal procedure including verification they have left site, reasonable efforts to contact them, and ensuring they know before returning to work.
Does lockout/tagout apply to sanitation work?+
Yes. Cleaning is named directly in the definition of servicing and maintenance in 1910.147(b), alongside lubrication and unjamming. Performing sanitation on a different shift or through an agency does not change the obligation.
Is lockout/tagout required by law?+
Yes, in every major industrial jurisdiction. Mandatory in the US under 29 CFR 1910.147, enforced provincially in Canada with CSA Z460:20 as reference, required in the UK under PUWER regulation 19 and in Australia under the model WHS regulations.
The agents
What the agents do with it
Nine of the ten findings above are not failures of safety knowledge. They are failures of follow-through: a procedure that never got revised, an inspection that slipped past its window, a training record with a gap. That is coordination work, and it is what the agents take off your team.
Holds the procedure library keyed to your asset register, flags assets with no current procedure, and schedules the annual periodic inspection with the four required certification fields captured on completion.
Watches work orders and asset changes. When equipment is modified, it opens a procedure revision task and links it to the change, closing the gap that produces stale procedures.
Maintains the authorized and affected employee roster with training certification by name and date, and triggers retraining when a procedure revision or job change occurs.
Coordinates the three, aggregates coverage and completion into one view, and holds every write for your approval before it touches a record.
This template lives in KnowMaintain — asset maintenance. Work orders, planned maintenance, calibration, reliability and shutdowns.
Meet KnowMaintain→Sources
Sources
- 29 CFR 1910.147, Control of hazardous energy (lockout/tagout)
- Top 10 Most Frequently Cited Standards, FY2025, OSHA
- CSA Z460:20, Control of Hazardous Energy, Lockout and Other Methods
- ANSI/ASSP Z244.1-2024, Lockout, Tagout and Alternative Methods
- PUWER 1998 reg 19, Health and Safety Executive (UK)
- Model WHS Regulations and Code of Practice, Safe Work Australia
- Occupational Safety, Health and Working Conditions Code, 2020 (India)