Failure to control hazardous energy during machine servicing and maintenance causes approximately 120 fatalities and 50,000 injuries annually in the United States. The unexpected startup of machinery or release of stored energy accounts for nearly 10% of serious workplace accidents in manufacturing. OSHA's Control of Hazardous Energy standard (29 CFR 1910.147), commonly known as Lockout/Tagout or LOTO, establishes requirements for controlling these deadly hazards. This comprehensive guide covers the regulatory requirements, energy control procedures, device specifications, training obligations, and compliance best practices that protect workers during servicing and maintenance activities.
Understanding Hazardous Energy
Hazardous energy exists in multiple forms, any of which can cause severe injury or death if unexpectedly released during servicing or maintenance. Effective lockout/tagout programs must identify and control all energy sources associated with equipment being serviced. Overlooking even one energy source can have fatal consequences.
The most obvious hazard is electrical energy, but mechanical, hydraulic, pneumatic, chemical, thermal, and gravitational energy sources are equally dangerous. A machine may have multiple energy sources that must all be isolated and controlled. Springs, elevated components, pressurized systems, and heated elements can all store energy that may be released unexpectedly.
Energy hazards exist even when equipment is "off." Capacitors retain electrical charge, hydraulic cylinders maintain pressure, springs store mechanical energy, and elevated components have gravitational potential energy. Proper LOTO procedures must address stored energy as well as active energy sources.
Electrical
Current flow and stored charge in electrical systems
Motors, circuits, capacitors, batteries, transformers
Mechanical
Motion, tension, and stored mechanical force
Springs, flywheels, rotating shafts, belts, chains
Hydraulic
Pressurized liquid in closed systems
Cylinders, presses, lifts, accumulators, pumps
Pneumatic
Compressed air and gas systems
Air cylinders, compressors, air tools, receivers
Chemical
Reactive substances and chemical processes
Corrosives, reactants, process chemicals, fuels
Thermal
Extreme heat or cold in equipment
Furnaces, steam lines, chillers, heated dies Stored Energy Kills
Many LOTO fatalities occur from stored energy that wasn't properly dissipated even though the primary energy source was isolated. A hydraulic press can crush a worker long after electrical power is disconnected if hydraulic pressure isn't released. A coiled spring can release violently. Elevated machine components can fall. Your energy control procedures must address both active and stored energy.
OSHA LOTO Standard Requirements
OSHA's Control of Hazardous Energy standard (29 CFR 1910.147) establishes minimum requirements for lockout/tagout programs. The standard applies to servicing and maintenance activities where unexpected energization or startup, or release of stored energy, could cause injury. It covers most manufacturing and industrial operations and has been one of OSHA's most frequently cited standards for decades.
The standard requires employers to establish a written energy control program consisting of energy control procedures, employee training, and periodic inspections. This isn't a suggestion—it's a legal requirement. Employers must develop, document, and utilize specific procedures for controlling hazardous energy, and these procedures must be tailored to the specific equipment and energy sources in their facility.
Understanding when the standard applies is crucial. LOTO is required for servicing and maintenance activities where workers may be exposed to hazardous energy. Normal production operations are generally excluded unless workers must remove or bypass guards or place any part of their body in the danger zone. Minor tool changes and adjustments that are routine, repetitive, and integral to production may be exempt if alternative safeguards provide effective protection.
LOTO Violation Statistics
#5 Most Cited OSHA Standard 2,400+ Annual Citations $15K Avg Penalty Per Violation $156K Max Willful Violation
Core Program Requirements
- Written energy control procedures: Documented, machine-specific procedures for each piece of equipment requiring LOTO.
- Employee training: Initial and ongoing training for authorized, affected, and other employees.
- Periodic inspections: Annual inspection of each energy control procedure by authorized employee.
- Lockout/tagout devices: Standardized, durable devices provided by the employer for energy isolation.
- Notification requirements: Affected employees must be notified before and after LOTO application/removal.
Lockout vs. Tagout
OSHA strongly prefers lockout over tagout. Tags are essentially warning devices—they can be ignored or removed. Locks physically prevent energy isolation devices from being operated. Tagout-only programs are permitted only when energy isolating devices are incapable of being locked out, and require additional protective measures. When given the choice, always choose lockout. Many employers have a "lockout-required" policy regardless of whether tagout would technically be permitted.
Energy Control Procedures
Energy control procedures are the heart of any LOTO program. These written, machine-specific documents detail exactly how to safely shut down equipment, isolate all energy sources, apply lockout/tagout devices, verify isolation, and restore equipment to service. Generic procedures that don't address specific equipment and energy sources don't meet OSHA requirements and don't protect workers.
Each procedure must identify the equipment, its location, the type and magnitude of energy sources, the location of energy isolating devices, and the specific steps for applying and removing lockout/tagout. The procedure should be detailed enough that a qualified authorized employee can safely perform the lockout without guessing or improvising.
Verification is a critical step that's often rushed or skipped. After applying locks and tags and dissipating stored energy, workers must verify that energy isolation is complete by attempting to start the equipment or using test equipment. This verification must occur before any servicing begins. Many LOTO injuries occur because workers assumed isolation was complete without verification.
Standard LOTO Sequence
1 Prepare for Shutdown 2 Notify Affected Employees 3 Equipment Shutdown 4 Isolate Energy Sources 5 Apply LOTO Devices 6 Release Stored Energy
Procedure Content Requirements
| Element | Description | Example |
|---|---|---|
| Equipment Identification | Specific machine name, number, location | "CNC Mill #3, Building A, Cell 7" |
| Energy Sources | All types and magnitudes of hazardous energy | "480V electrical, 3000 PSI hydraulic, pneumatic" |
| Isolation Devices | Location of each energy isolating device | "Main disconnect Panel B-7, hydraulic valve V-12" |
| Shutdown Sequence | Specific steps for normal machine shutdown | "Press STOP, wait for spindle stop, press E-STOP" |
| Stored Energy | Methods to dissipate or restrain stored energy | "Bleed hydraulic pressure at port P-3 until gauge reads 0" |
| Verification Method | How to confirm energy isolation is complete | "Attempt to start at control panel, verify no response" |
Restoring Equipment to Service
The procedure must also address safe removal of LOTO devices and restoration of equipment to normal operation:
- Inspect work area: Ensure tools and materials are removed, guards are reinstalled, and area is clear.
- Verify employee safety: Confirm all workers are safely positioned away from hazard zones.
- Notify affected employees: Inform workers that LOTO devices are being removed and equipment energized.
- Remove devices: Only the employee who applied a lock/tag may remove it (with limited exceptions).
- Reenergize equipment: Follow proper startup sequence and verify normal operation.
Never Skip Verification
Attempting to start equipment after applying LOTO is the critical verification step that confirms isolation is complete. This must be done every time, even on equipment that's been locked out hundreds of times before. Circumstances change—someone may have added an energy source, a disconnect may have failed, or a different circuit may power the equipment. Trust but verify.
Lockout/Tagout Devices
LOTO devices are the physical hardware that prevents energy isolating devices from being operated while servicing is performed. These devices must meet specific requirements: they must be durable enough to withstand the environment, standardized within the facility, substantial enough to prevent removal without excessive force or special tools, and capable of identifying the employee who applied them.
Locks are the primary lockout device. Each authorized employee should have their own lock with a unique key. Locks should be distinctive (not used for other purposes like toolboxes or lockers) and should have a means of identifying the employee who applied them. Many companies use colored locks, numbered locks, or locks with photo ID tags.
Tags serve as warning devices that communicate critical information: who applied the lockout, when, why, and contact information. Even when locks are used, tags provide valuable information. When tagout alone is used (where lockout isn't possible), tags must include specific warnings against removing the tag and energizing equipment.
Essential LOTO Devices
Safety Padlocks
Personal locks with unique keys for each authorized employee
Lockout Tags
Warning tags identifying who, when, and why lockout applied
Lockout Hasps
Multi-lock hasps for group lockout situations
Breaker Lockouts
Devices that secure circuit breakers in off position
Valve Lockouts
Gate valve, ball valve, and butterfly valve lockouts
Plug Lockouts
Devices that prevent plugs from being inserted
Lockout Stations
Organized storage for LOTO devices and procedures
Pneumatic Lockouts
Ball valve and quick-disconnect lockout devices
Device Requirements
| Requirement | Locks | Tags |
|---|---|---|
| Durability | Withstand environment without deterioration | Withstand environment for maximum expected exposure |
| Standardization | Uniform color, shape, or size within facility | Standardized print and format throughout facility |
| Substantiality | Cannot be removed without excessive force | Non-reusable, self-locking attachment means |
| Identification | Identify employee who applied the lock | Identify employee and include warnings |
| Exclusive Use | Used only for controlling hazardous energy | Used only for controlling hazardous energy |
One Employee, One Lock
Each employee performing servicing must apply their own personal lock. When multiple workers service the same equipment, each applies their own lock using a hasp or lockout station. This ensures no worker can be endangered by another worker's premature removal of a lock. The equipment cannot be reenergized until the last worker removes their lock, providing individual protection regardless of what other workers do.
Authorized vs. Affected Employees
OSHA's standard distinguishes between authorized employees, affected employees, and other employees. Each group has different responsibilities and training requirements. Understanding these distinctions is essential for proper program implementation and for ensuring the right people receive appropriate training.
Authorized employees are those who actually perform the lockout—they apply and remove locks, implement energy control procedures, and perform servicing on locked out equipment. These employees require the most comprehensive training and are responsible for protecting themselves and others during servicing activities.
Affected employees operate or use machines being serviced, or work in areas where servicing occurs. They don't perform lockout themselves but must understand the program, recognize when lockout is in use, and know not to attempt to operate locked out equipment. Their training focuses on recognition and awareness rather than implementation.
Authorized Authorized Employees
Personnel who implement lockout/tagout procedures and perform servicing on equipment.
- Apply and remove lockout/tagout devices
- Isolate energy sources per written procedures
- Verify energy isolation before servicing
- Perform servicing and maintenance tasks
- Restore equipment to normal operation
Affected Affected Employees
Personnel whose work operations are affected by lockout but who don't perform the lockout.
- Machine operators of equipment being serviced
- Workers in areas where lockout occurs
- Must be notified before lockout applied
- Must not attempt to restart equipment
- Must recognize lockout devices and their meaning
Employee Responsibilities
| Responsibility | Authorized | Affected |
|---|---|---|
| Apply LOTO devices | Required | Never |
| Remove LOTO devices | Own devices only | Never |
| Know energy control procedures | Full knowledge | General awareness |
| Verify energy isolation | Required | Not applicable |
| Recognize LOTO devices | Required | Required |
| Notify affected employees | Required | Receive notification |
Document Employee Authorization
Maintain records of which employees are authorized for which equipment. Not every maintenance worker needs to be authorized on every machine. Authorize employees based on their job duties, the equipment they work on, and their completed training. Review and update authorization lists regularly, especially when equipment changes or employees transfer.
Periodic Inspections
OSHA requires annual inspection of each energy control procedure to ensure it remains accurate and that employees are following it correctly. These periodic inspections verify that procedures reflect current equipment conditions and that authorized employees understand and properly implement the procedures. Inspections must be documented.
The inspection must be performed by an authorized employee who is not using the procedure being inspected—you can't inspect your own implementation. The inspector observes the energy control procedure being performed and reviews the procedure with authorized employees. For tagout-only programs, the inspection must also include review with affected employees.
The inspection must certify that the procedure is being followed correctly, that employees understand their responsibilities, and that the procedure continues to be adequate for the equipment. If deviations or deficiencies are found, corrective actions must be taken, which may include procedure revision, additional training, or disciplinary action.
Periodic Inspection Requirements
Inspector Requirements
- Must be an authorized employee
- Cannot inspect own work
- Knowledgeable about the procedure
- Trained in inspection requirements
Inspection Activities
- Observe actual lockout being performed
- Review procedure accuracy
- Interview authorized employees
- Verify employee understanding
Documentation Required
- Machine/equipment identification
- Date of inspection
- Employees included in inspection
- Name of inspector performing audit
Corrective Actions
- Update procedures if equipment changed
- Retrain employees with deficiencies
- Address shortcuts or deviations
- Document all corrective actions taken
Inspection Certification Form Elements
- Equipment identification: Machine name, number, location being inspected.
- Inspection date: When the periodic inspection was conducted.
- Employees inspected: Names of authorized (and affected, if tagout) employees included.
- Inspector identity: Name of authorized employee who performed the inspection.
- Findings and corrective actions: Any deficiencies noted and how they were addressed.
Each Procedure, Every Year
The inspection requirement is per procedure, not per facility. If you have 50 machines with LOTO procedures, all 50 must be inspected annually. This is one of the most commonly cited deficiencies—companies either don't inspect at all or only inspect a sample. Build periodic inspections into your maintenance schedule to ensure every procedure gets reviewed each year.
Training Requirements
OSHA mandates training for all employees whose work involves or is affected by energy control. Training must ensure employees have the knowledge and skills required for the safe application, use, and removal of energy controls. Different employee categories require different training content and depth.
Initial training must occur before employees are assigned duties involving energy control. Retraining is required whenever there's a change in job assignments, equipment, or procedures that presents new hazards, or whenever inspections reveal deficiencies in employee knowledge. Many companies provide annual refresher training even when not technically required.
Training Requirements by Employee Category
Authorized Employees Recognition of hazardous energy sources, type and magnitude of energy, methods and means to isolate and control energy, purpose and use of procedures, LOTO device selection and use, verification requirements Initial + retraining when needed + annual refresher recommended Affected Employees Purpose and use of energy control procedures, prohibition against attempting to restart locked out equipment, how to recognize when lockout is in use, notification requirements Initial + retraining when duties change Other Employees General awareness of lockout program, prohibition against removing LOTO devices or energizing locked out equipment, recognition of devices Initial awareness training
Training Topics for Authorized Employees
- Energy source recognition: How to identify all types of hazardous energy associated with equipment.
- Energy isolation methods: How to isolate and control each type of energy source.
- Procedure implementation: Step-by-step implementation of written energy control procedures.
- Device selection and use: Proper selection, application, and removal of LOTO devices.
- Verification requirements: How to verify that energy isolation is complete and effective.
- Stored energy: Methods for releasing, restraining, or otherwise rendering stored energy safe.
- Limitations of tagout: Additional safety measures when tagout is used without lockout.
Document All Training
Maintain records of all LOTO training, including dates, trainer names, topics covered, and employees who attended. Certification of employee training is required by OSHA and will be requested during inspections. Include training records in employee files and maintain a master training matrix showing all employees and their current training status.
Special Situations
Several situations require special attention and procedures beyond the standard LOTO process: group lockout operations, shift changes during lockout, contractor work, and removal of someone else's lock. OSHA's standard addresses these situations, and your program must include procedures for handling them safely.
Group lockout occurs when multiple employees perform servicing on equipment that requires more than one person. Each worker must apply their own personal lock—a single lock for the group doesn't provide adequate protection. Group lockout procedures must ensure every worker is protected and every worker has positive control over the energy state.
Group Lockout Procedures
- Primary authorized employee: Designate one person with overall responsibility for the group lockout.
- Individual protection: Each authorized employee applies their own personal lock.
- Lockbox or hasp: Use multi-lock hasps or lockboxes to accommodate multiple locks.
- Coordination: All workers must coordinate lock application and removal.
Contractor Coordination
Host Employer Responsibilities
Inform contractors about energy control procedures, equipment, and hazards they may encounter. Coordinate LOTO activities between your employees and contractor employees.
Contractor Responsibilities
Inform host employer about their LOTO procedures. Ensure contractor employees follow host procedures or equivalent measures providing same protection.
Procedure Communication
Exchange information about each other's LOTO programs before work begins. Identify any differences and resolve potential conflicts.
Ongoing Coordination
Maintain communication throughout the project. Coordinate any changes to lockout status and ensure mutual understanding at all times.
Lock Removal by Someone Other Than the Applicator
OSHA requires that the employee who applied a lock must be the one to remove it. However, the standard permits removal by someone else under specific conditions when the employee who applied the lock is not available:
- Verify absence: Confirm that the employee who applied the lock is not available at the facility.
- Make reasonable effort: Attempt to contact the employee before removing their lock.
- Ensure safety: Verify that removal will not endanger the absent employee or others.
- Notify employee: Inform the employee that their lock was removed before they return to work.
Lockout/tagout is not just a compliance requirement—it's the difference between a worker going home safely or not going home at all. Every shortcut, every skipped step, every "just this once" is a gamble with someone's life.
— Manufacturing Safety Director
Building an Effective LOTO Program
An effective lockout/tagout program requires more than written procedures and purchased locks. It requires commitment from management, buy-in from workers, consistent enforcement, and continuous improvement. The program must become part of your operational culture, not just a binder on a shelf that gets dusted off for OSHA inspections.
Start by conducting a comprehensive survey of all equipment requiring LOTO. Develop machine-specific procedures for each piece of equipment, identifying all energy sources and isolation points. Provide adequate LOTO devices for all authorized employees and all isolation points. Train all employees appropriate to their roles. Then inspect, inspect, inspect—and take corrective action when deficiencies are found.
The consequences of inadequate LOTO are severe: worker fatalities, life-altering injuries, OSHA citations, increased insurance costs, and legal liability. But beyond compliance and cost, LOTO is fundamentally about protecting the people who make your operation run. A strong LOTO program demonstrates your commitment to sending every worker home safely at the end of every shift. First Underwriters can help evaluate your energy control program as part of our comprehensive manufacturing risk management approach.