1910.147(c)(4)(i): A written procedure is required unless a single lockout device can achieve a complete de-energised state and the machine has no stored or residual energy. For virtually all industrial machines this means a machine-specific document. A generic “turn off, lock out, verify” instruction is not a procedure under the standard.

Many LOTO fatalities occur because a secondary stored energy source was not identified in the procedure. A machine may be electrically isolated but retain hydraulic pressure, spring tension in a die, a suspended ram, or thermal energy in a process line. Every energy source must be named and its isolation method specified.

1910.147(d)(5): Stored energy is one of the leading causes of LOTO-related fatalities. Bleed hydraulic lines, exhaust pneumatic lines to atmosphere, block suspended machine parts, discharge capacitors, drain steam lines. Each step must be in the written procedure with a verification method. Gravity-loaded parts must be physically blocked — not just lowered to a rest position.

1910.147(d)(6): Before work begins, verify that all energy sources are effectively isolated and de-energised. The standard method is to attempt to start the machine using its normal controls. A machine that starts when its start button is pressed after lockout has an isolation failure. This verification step must be in every procedure.

1910.147(c)(5)(i): Each authorised employee must have their own lock and key. A supervisor applying a single lock for all workers, or a shared key among workers, violates this requirement. The reason: if the supervisor removes their single lock believing work is complete, workers who are still inside are unprotected. Each person’s lock protects only that person.

1910.147(f)(3): Group lockout requires a hasp or lockbox so that each worker can apply their personal lock. A single “crew leader” lock does not protect individual workers — if the leader believes the job is done and removes their lock, workers still inside are exposed. The hasp must remain locked until the last worker removes their lock.

1910.147(f)(4): When work extends across shifts, the procedure must ensure continuity of protection. The outgoing employee removes their lock only after the oncoming employee applies theirs. A gap between shifts where no personal lock is on the equipment is a LOTO violation — and if the machine is inadvertently re-energised during that gap, anyone returning to work on it is unprotected.

1910.147(c)(3): Lockout is always preferred. Tagout may only be used when the energy isolating device cannot be locked. When tagout is used, additional measures must be implemented: removing an isolating circuit element, blocking a control switch, opening an extra disconnecting device, or removing a valve handle. A tag alone on a lockable device is a violation.

1910.147(c)(1): A written energy control programme is mandatory. It must address the scope and purpose of the programme, rules and techniques for shutting down and isolating equipment, placement and removal of lockout devices, requirements for testing to verify isolation, and the means to enforce compliance. A programme that merely references machine procedures without covering these elements is incomplete.

1910.147(c)(6)(i)(B): Annual certification is one of the most frequently cited LOTO violations. The audit must be conducted by an authorised employee other than the one using the procedure. It must verify that the procedure is adequate and that employees are following it. The written certification record must be kept and available for OSHA inspection.

1910.147(c)(6)(i)(A): The certification must include a review of the procedure conducted during equipment servicing and maintenance. This means the auditor must observe an authorised employee actually performing the procedure on the machine — not just sign off on the paper procedure. A paper-only audit does not satisfy the standard.

1910.147(d)(2): Before lockout, affected employees (those who operate or work near the equipment) must be notified that the equipment will be locked out. 1910.147(e)(3): Before the lockout is removed and power restored, affected employees must again be notified. This prevents an operator from attempting to start equipment while a lockout is being set up or while it is being removed.

Prior LOTO incidents are the strongest predictor of future events and indicate systemic programme failures. Every LOTO incident must be investigated for root cause — was it a procedure deficiency, training failure, or non-compliance? Corrective actions must be implemented and verified before normal LOTO work resumes. OSHA frequently re-inspects facilities with prior LOTO citations.

1910.147(c)(7)(i)(A): Authorised employees must understand the specific energy sources in the machines they service, the magnitude of each energy (voltage, pressure, temperature), and the exact isolation method for each. Generic LOTO training that does not cover machine-specific hazards does not meet this requirement. Training must be documented with a certification record.

1910.147(c)(7)(i)(B): Affected employees — machine operators and others who use equipment that may be locked out — must be trained in the purpose and use of LOTO. They must never attempt to restart, re-energise, or remove a lockout device applied by another employee. An operator who restarts a machine while a worker is still inside it causes a fatality.

1910.147(c)(7)(iii): Retraining is required whenever there is reason to believe an employee does not have the required knowledge or skills. Triggers include: a change in job assignment, new equipment or energy sources, new hazards identified in an audit, or observed non-compliance during an audit. An employee who fails an annual audit observation must be retrained before returning to LOTO duties.

1910.147(c)(7)(iv): The employer must certify that training has been accomplished. Records must include the employee name, date of training, and subject matter. Undocumented training is treated as no training in an OSHA inspection. Records must be produced immediately on request — not after a search. Electronic records are acceptable if they are readily accessible.

New equipment often introduces new energy sources, new isolation points, or new stored energy hazards that were not present in the original procedure. Using an old procedure on modified equipment has caused fatalities when an energy source not in the procedure energised the machine during maintenance. Procedures must be updated and workers trained before first use on any changed equipment.

1910.147(f)(2)(i): The host employer must inform outside contractors performing LOTO-covered work of the facility’s energy control procedures and inform them of any procedural requirements. The contractor’s programme must provide equivalent protection. A contractor using tags when the facility requires locks, or applying locks to different isolation points, creates a gap in protection for both contractor and host employees.

When equipment has multiple energy sources, the isolation sequence matters. Some machines must be de-energised in a specific order to prevent release of stored energy during shutdown. For example, a hydraulic press must have its electrical supply locked out before the hydraulic system is bled — energising sequence in reverse could move machine parts. Each isolation point must be numbered in the procedure.

1910.147(a)(2)(iii)(B): Cord-and-plug equipment is exempt from the full LOTO standard only if the plug is unplugged and the employee performing service has exclusive control over the plug — physically in their pocket or hands, or visible to them at all times. If the plug is left in an outlet, or another person could plug it in, the exemption does not apply and full LOTO procedures are required.

1910.147(e)(3): When the employee who applied the lock cannot be reached to remove it, a specific management procedure must be followed — not just cutting the lock. The procedure must include: management authorisation, verification the employee is not in or near the machine, steps to re-lock if needed, and a requirement to notify the employee before they next report for work. Cutting a lock without this procedure is a violation.