Lockout/tagout (LOTO) protects workers while servicing or maintaining equipment from two hazards: the machine starting up unexpectedly, or stored energy being suddenly released. OSHA's rule for it is the Control of Hazardous Energy standard, 29 CFR 1910.147, and it requires every covered employer to have an energy control program with three parts: written procedures, employee training, and periodic inspections.
It's also one of the standards OSHA cites most. On OSHA's preliminary Top 10 most frequently cited standards for FY2026 (October 1, 2025 through August 31, 2026), lockout/tagout comes in third, behind Fall Protection general requirements (1926.501) and Hazard Communication (1910.1200). You can have a lock on every disconnect in the building and still get cited for a procedure nobody wrote down, training nobody certified, or an energy control procedure that went more than a year without its periodic inspection. OSHA has estimated that following the standard prevents about 120 deaths and 50,000 injuries a year.
Below, we walk through who the standard applies to, what each part of the program has to include, the order for putting locks on and taking them off, and where good programs usually come up short.
Lockout tagout is a way of isolating hazardous energy and keeping it isolated until the servicing or maintenance work is done. The standard defines energy sources broadly: electrical, mechanical, hydraulic, pneumatic, chemical, thermal, or other energy. In practice, that includes gravitational energy, along with stored and residual energy. Think compressed springs, charged capacitors, pressurized lines, hydraulic accumulators, and anything that can drop or roll under its own weight.
You'll need three definitions from 1910.147 to make sense of the rest:
• Energy isolating device: a mechanical device that physically stops energy from being transmitted or released, like a manually operated circuit breaker, a disconnect switch, a line valve, or a block. Push buttons, selector switches, and other control circuit type devices don't qualify. Neither does an emergency stop button.
• Lockout device: a device, such as a key or combination lock, that uses a positive means to hold an energy isolating device in the safe position so the equipment can't be energized.
• Tagout device: a prominent warning device, such as a tag and its means of attachment, fastened to an energy isolating device to show the equipment must not be operated until the tag is removed. A tag warns. It doesn't physically stop anyone.
29 CFR 1910.147 applies to servicing and maintenance of machines and equipment in general industry where unexpected energization, start up, or release of stored energy could hurt employees. Several settings are carved out. The standard excludes:
• Construction and agriculture employment
• Maritime employment covered by 29 CFR Parts 1915, 1917, and 1918
• Installations under the exclusive control of electric utilities for power generation, transmission, and distribution (addressed by 29 CFR 1910.269)
• Exposure to electrical hazards from work on, near, or with conductors or equipment in electric utilization installations, which is covered by the electrical safety-related work practices in Subpart S (29 CFR 1910.333)
• Oil and gas well drilling and servicing
Construction has its own rules for de-energizing and tagging circuits, including 29 CFR 1926.417 (lockout and tagging of circuits). If your company does both general industry and construction work, one program can satisfy 1910.147 and the construction rules, as long as it meets the requirements of both. Check your program against each set of rules rather than assuming it covers them.
Many safety teams also lean on two voluntary consensus standards when they build a program. ANSI/ASSP Z244.1 covers control of hazardous energy, and NFPA 70E covers electrical safety in the workplace. Neither one is an OSHA regulation, but both are common benchmarks. If you're in a State Plan state, check your state's version of the rule as well. It has to be at least as effective as the federal standard, and the details can differ.
• Cord-and-plug equipment: the standard doesn't apply when unplugging the equipment controls the hazard and the plug stays under the exclusive control of the person doing the servicing. If someone else could plug it back in, the exception is off the table.
• Hot tap operations on pressurized pipelines carrying gas, steam, water, or petroleum products are exempt only when continuity of service is essential, shutting down isn't practical, and documented procedures and special equipment provide proven, effective protection.
Normal production operations generally fall outside the standard. Servicing during production is covered only if an employee has to remove or bypass a guard or other safety device, or put any part of their body into the point of operation (the area where work is actually performed on the material) or into an associated danger zone that exists during the machine's operating cycle. The wording matters: the danger zone is tied to the machine's operating cycle, not to production operations in general.
There's one narrow exception. Minor tool changes and adjustments, and other minor servicing activities that are routine, repetitive, and integral to using the equipment for production aren't covered by 1910.147, but only if the work is done using alternative measures that provide effective protection. "It'll just take a second" isn't an alternative measure. Reaching into a die area to clear a jam, with nothing else protecting the worker, is servicing, and it's covered.
The standard sorts people into three groups, each with its own responsibilities and training:
• Authorized employees are the people who lock or tag out machines or equipment to service or maintain them. Only the authorized employees doing the servicing can apply lockout or tagout devices.
• Affected employees operate or use the machine being serviced, or work in the area where the servicing happens. They have to be told before lockout devices go on and after they come off.
• Other employees work in areas where energy control procedures may be used. They need to know the procedures exist and that they should never try to restart or re-energize equipment that's locked or tagged out.
Section (c)(1) requires a program made up of energy control procedures, employee training, and periodic inspections, so that machines are isolated and made inoperative before anyone services or maintains them where unexpected energization could cause injury. You need all three. A binder full of procedures with no training records isn't a complete program, and neither is a stack of training records with no inspections behind it.
If an energy isolating device can be locked out, you have to use lockout unless you can show that your tagout program provides full employee protection, meaning safety equivalent to lockout. Getting there usually takes extra steps, like removing an isolating circuit element, blocking a controlling switch, opening an extra disconnecting device, or pulling a valve handle. If the device can't be locked out, tagout is allowed.
Since January 2, 1990, any time a machine is replaced, gets a major repair, renovation, or modification, or new equipment goes in, its energy isolating devices have to be designed to accept a lockout device. This is where a management of change (MOC) program earns its keep. When equipment modifications and purchases go through MOC review, lockout-capable isolation gets written into the spec and checked before startup, instead of discovered missing after the install. A new install is the easiest time to get rid of isolation points that can only be tagged.
Procedures have to be developed, documented, and used to control potentially hazardous energy. Under (c)(4)(ii), each one must clearly and specifically outline the scope, purpose, authorization, rules, and techniques to be used for the control of hazardous energy, and the means to enforce compliance, including at least:
1. A specific statement of the intended use of the procedure
2. Specific procedural steps for shutting down, isolating, blocking, and securing machines or equipment
3. Specific steps for placing, removing, and transferring lockout or tagout devices, and who is responsible for them
4. Specific requirements for testing the machine to determine and verify the effectiveness of lockout devices, tagout devices, and other energy control measures
Good procedures go further than that. They name the real isolation points (for example, "Disconnect DS-14, Line valve V-203"), list every energy source by type and magnitude, and include photos or labels that match what technicians actually see on the equipment. To get started, download our free Lockout Tagout (LOTO) Energy Control Procedure Template.
Not every machine needs its own document. One procedure can cover a group of similar machines when they share the same energy sources, magnitudes, and isolation points, as long as it adequately addresses each machine's energy control requirements.
An employer can skip writing down a procedure for a specific machine only when all eight of these conditions are true:
1. The machine has no potential for stored or residual energy or reaccumulation of stored energy after shutdown that could endanger employees.
2. The machine has a single energy source that can be readily identified and isolated.
3. Isolating and locking out that source completely deenergizes and deactivates the machine.
4. The machine is isolated from that source and locked out during servicing or maintenance.
5. A single lockout device achieves the locked-out condition.
6. The lockout device is under the exclusive control of the authorized employee performing the servicing.
7. The servicing does not create hazards for other employees.
8. The employer, in using this exception, has had no accidents involving unexpected activation or reenergization of the machine during servicing or maintenance.
If even one condition isn't met, write the procedure. And remember, this exception only covers the paperwork. Lockout, training, and inspections still apply.
First, let affected employees know that lockout or tagout devices are about to go on, as (c)(9) requires. Then follow the sequence in Section (d):
1. Prepare for shutdown. The authorized employee needs to know what type of energy is involved and how much, what hazards it poses, and how to control it.
2. Shut down the machine using that machine's established procedure, so the shutdown doesn't create new hazards of its own.
3. Isolate the equipment. Find and operate every energy isolating device needed to isolate or cut the machine off from its energy sources.
4. Apply lockout or tagout devices. Lockout devices are applied to each energy isolating device so it's physically held in a safe or off position. Tagout devices don't hold anything in place. A tag is affixed to the energy isolating device to warn that the device and the equipment it controls must not be operated. If a tag can't be attached directly to the energy isolating device, place it as close as safely possible to the energy isolating device, in a position that will be immediately obvious to anyone attempting to operate it.
5. Control stored energy. Relieve, disconnect, restrain, or otherwise make safe any hazardous stored or residual energy. If it could build back up, keep checking isolation until the work is done.
6. Verify isolation. Before work starts, the authorized employee confirms the machine is isolated and deenergized. Many programs call this the "try" step: make sure everyone is clear, try the normal operating controls to confirm the machine won't start, and then put the controls back to neutral or off. A failed start alone doesn't confirm zero energy, so verify with the right test equipment too, such as a properly rated voltage tester (volt meter) on electrical circuits, and gauges or bleed points to confirm stored pressure is gone.
Section (e) sets the requirements for releasing equipment from lockout or tagout. Most EHS teams know them as a five-step sequence:
1. Inspect. Inspect the machine and work area to make sure nonessential items have been removed and machine components are operationally intact.
2. Check. Check the work area to make sure all employees are safely positioned or out of the area.
3. Remove. Each lockout or tagout device has to be removed by the employee who applied it.
4. Notify. After the devices have been removed and before the machine is started, notify affected employees that the devices have been removed.
5. Restore. Reenergize the equipment and return it to service.
There's one exception to the removal step, for when the authorized employee who applied the device isn't available. In that case the employer can direct removal, but only through a specific procedure and training that have been developed, documented, and built into the program. At a minimum, the employer has to verify the employee isn't at the facility, make all reasonable efforts to reach them, and make sure they know the device was removed before they come back to work at the facility.
The employer has to supply the locks, tags, chains, wedges, key blocks, adapter pins, self-locking fasteners, and other hardware. These devices must be singularly identified and used only for energy control, nothing else. They also have to meet four requirements, which apply a little differently to locks and tags:
|
Requirement |
Lockout Devices (locks) |
Tagout Devices (tags) |
|
Durable |
Able to hold up in their environment for the maximum period they're expected to be exposed. |
Same as locks, plus tags can't deteriorate or become unreadable in wet, damp, or corrosive conditions. |
|
Standardized |
Standardized within the facility by at least one of these criteria: color, shape, or size. |
Same as locks, plus a standard print and format. |
|
Substantial |
Strong enough that removing them takes excessive force or unusual techniques, like bolt cutters or other metal cutting tools. |
Strong enough to prevent accidental removal. Attachments must be non-reusable, attachable by hand, self-locking, and non-releasable, with a minimum unlocking strength of no less than 50 pounds. A one-piece, all-environment-tolerant nylon cable tie fits that general design. |
|
Identifiable |
Each device has to show who applied it. |
Each tag has to show who applied it, plus a warning such as Do Not Start, Do Not Open, Do Not Close, Do Not Energize, or Do Not Operate. |
1910.147 doesn't set a fixed annual retraining interval. Plenty of employers train annually anyway, and for good reasons. Their LOTO program may require it, they may see enough operational change that an annual cycle covers their retraining obligations, or it may simply be easier than tracking every individual retraining trigger. What the standard itself requires is initial training, so employees understand the purpose and function of the program and have the knowledge and skills to safely apply, use, and remove energy controls. What they learn depends on their role:
• Authorized employees: how to recognize the hazardous energy sources that apply, the type and magnitude of energy in the workplace, and the methods and means needed to isolate and control it.
• Affected employees: the purpose and use of the energy control procedure.
• Other employees: that the procedure exists, and that they must not try to restart or reenergize locked or tagged out equipment.
Where tagout is used, everyone also has to be trained on what tags can't do. Tags are warning devices and provide no physical restraint. They must never be removed without authorization or bypassed. They have to be legible and understandable to everyone in the area, made of materials that hold up in the environment, and securely attached. And they can give people a false sense of security.
Retraining is required when certain events happen, whatever your training schedule says. Authorized and affected employees need it whenever their job assignment changes, when a change in machines, equipment, or processes brings a new hazard, or when the energy control procedures change. They also need it any time a periodic inspection shows, or the employer has reason to believe, that there are deviations from or inadequacies in an employee's knowledge or use of the procedures.
The employer has to certify that training has been done and is kept up to date, with each employee's name and training dates. An annual program works well when it's built to cover the changes that happened during the year. The letter of the law and the spirit of it meet in the same place: when a trigger event happens between scheduled sessions, retrain the affected employees then, rather than waiting for the next one.
Under (c)(6), the employer has to inspect energy control procedures at least annually to confirm the procedures and the standard's requirements are being followed. The inspection itself has specific rules:
• It has to be done by an authorized employee other than the one(s) using the procedure being inspected.
• It has to be set up to correct any deviations or inadequacies it finds.
• Observation: the inspector watches employees using the procedure. A representative sample of the authorized employees who use it is enough.
• Responsibility review: for lockout, the inspector reviews with each authorized employee what that employee is responsible for under the procedure. For tagout, the review includes each authorized and affected employee, and covers both their responsibilities and the tagout training elements. The review can be done as a group. Individual meetings with every employee aren't required.
• The employer has to certify each inspection, listing the machine or equipment, the date, the employees included, and who did the inspection.
Reviewing paperwork at a desk doesn't meet the intent. The inspector should watch the procedure being done and compare it to what's written. Deficiencies can turn up in two places. One is how workers carry out the procedure, which feeds back into retraining. The other, and arguably the more important, is the procedure itself. If an employee correctly follows a procedure that doesn't bring the equipment to a zero energy state, the procedure has to be fixed, or the inspection hasn't done its job. Our free Lockout Tagout (LOTO) Inspection Form can help you structure and document it.
Section (f) covers the situations where one person and one lock isn't enough:
• Testing or positioning: when devices have to come off for a short time to test or position equipment, go in this order: clear tools and materials, get employees out of the way, remove devices following the release requirements, energize and test, then deenergize and put controls back on before servicing continues.
• Outside personnel (contractors): the on-site employer and the outside employer have to tell each other about their lockout or tagout procedures. The on-site employer also has to make sure its own people understand and follow the restrictions of the contractor's program.
• Group lockout: one authorized employee takes primary responsibility for the group of employees protected by a group device, such as a lock box. Each authorized employee puts a personal lockout or tagout device on the group mechanism when they start work and takes it off when they're done. When more than one crew, craft, or department is involved, one authorized employee is put in charge of coordinating all of it.
• Shift or personnel changes: there have to be specific procedures that keep lockout or tagout protection continuous, including an orderly transfer of protection between outgoing and incoming employees. Devices aren't handed off. The oncoming shift applies its own locks or tags before the off-going shift removes theirs.
Even programs that look solid on paper tend to break down in a few familiar spots:
• Using control circuit devices as isolation. Stop buttons, emergency stop buttons (e-stops), selector switches, and PLC interlocks aren't energy isolating devices. A normal stop button is often part of the shutdown step in a LOTO procedure, and an e-stop halts the machine without letting the cycle finish, but neither one isolates energy.
• Skipping verification. Skip the try-and-test step and a mislabeled disconnect won't get caught until someone is already inside the machine.
• Ignoring stored energy. Gravity-loaded parts, springs, accumulators, and capacitors are still dangerous after the main disconnect is open.
• Procedures that are too generic. A procedure that doesn't name the actual isolation points won't meet the "clearly and specifically" requirement. That doesn't mean every machine needs its own document. OSHA allows a single procedure for a group of similar machines when they have the same energy sources, magnitudes, and isolation points. The gap is a procedure so general it doesn't match the equipment in front of the technician.
• Self-inspection. The periodic inspection has to be done by an authorized employee who isn't one of the employees using the procedure being inspected. The person who wrote the procedure can inspect it, as long as they don't use it. An inspection with no certification record is also hard to defend.
• Treating the training calendar as the only trigger. Annual training is fine, and plenty of strong programs use it. The gap is when the scheduled session becomes the only time retraining happens. A new machine, a revised procedure, or a bad inspection result still means retraining at that point, no matter how recently the last session was.
• Stretching the minor servicing exception to cover tasks that aren't routine, repetitive, and integral, or that don't have effective alternative protection.
• Contractor handoffs where neither employer has checked the other's procedures.
No software puts a lock on a disconnect, and buying it won't make a site compliant. What it can do is keep the procedures, permits, training records, and inspection records the standard requires in one place, so you spot the gaps before an inspector does. Here's where EHS Insight fits into a LOTO program:
• Permitted Work: Work Permits are commonly used for lockout/tagout work. A permit can go through up to three configured approval levels, stays active for the length of the operation, and is closed and kept for reporting once the work is finished. A Safety Reviews grid links JSAs, SOPs, and other supporting documents to the permit, and a site setting lets you attach the specific asset being serviced. You can assign permits to internal users or to vendor workers through the Vendor Portal, which makes contractor coordination easier.
• Document Control: keep energy control procedures in a Standard Operating Procedure document library, with access to earlier versions and an optional approval workflow of up to three levels before a document is published.
• Training Management: assign LOTO training requirements by audience with recurring due dates, record completions, and use One-Off Training Assignments for remedial or incident-based retraining that falls outside the regular schedule. Training Forecast reports show which requirements are set to expire in the next 30, 60, and 90 days.
• Audit Management: build a Question Set for your annual periodic inspection (our LOTO Inspection Form is a good starting point), create mandatory or discretionary CAPAs straight from findings, and connect the Compliance Tasks module to schedule recurring inspections with automatic task creation, assignment, and reminders.
• Job Safety Analysis: document lockout/tagout verification as a control measure within job steps, then review the JSA in a Safety Meeting that permanently references the version reviewed that day.
See how a lockout/tagout permit moves from request to closeout in a 20-minute EHS Insight demo. Book your demo
Lockout uses a lock or similar device to physically hold an energy isolating device in the safe position. Tagout uses a warning tag, which doesn't physically stop anyone. Under 29 CFR 1910.147, if a device can be locked out, employers have to use lockout unless they can show tagout provides full employee protection equivalent to lockout.
Not by a fixed rule. OSHA's lockout/tagout standard doesn't set an annual retraining interval. Retraining is required when an employee's job assignment changes, when new equipment or processes bring a new hazard, when energy control procedures change, or when an inspection or other information shows deviations or gaps in an employee's knowledge. Many employers train annually because their LOTO program requires it or because it's the simplest way to keep up with change, and that works as long as retraining still happens when one of those events occurs. Energy control procedures do have to be inspected at least annually.
At least once a year. The inspection has to be done by an authorized employee other than the ones using the procedure. It includes observing a representative sample of employees using the procedure and reviewing responsibilities with each authorized employee (and each affected employee when tagout is used), which can be done as a group. It has to be certified with the machine, date, employees included, and inspector named.
No. One procedure can cover multiple machines when it adequately addresses each machine's energy control requirements, for example a group of similar machines with the same energy sources, magnitudes, and isolation points. A machine can skip a documented procedure entirely only if all eight conditions in 1910.147(c)(4)(i) are met: no stored or residual energy, a single readily identified energy source, complete deenergization by isolating it, lockout during servicing, a single lockout device, exclusive control by the authorized employee, no hazards created for others, and no prior accidents from unexpected activation during servicing. If even one condition isn't met, the machine has to be covered by a documented procedure.
Only the employee who applied it. If that person isn't available, the employer can remove the device only under a documented procedure that verifies the employee isn't at the facility, makes all reasonable efforts to contact them, and makes sure they know about the removal before they return to work.
No. 29 CFR 1910.147 excludes construction, agriculture, and certain maritime work, as well as electric utility generation, transmission, and distribution installations and oil and gas well drilling and servicing. Construction circuits fall under other rules, including 29 CFR 1926.417.
For cord-and-plug connected equipment, yes, as long as unplugging controls the hazard and the plug stays under the exclusive control of the employee doing the servicing. If anyone else could plug it back in, the full lockout tagout requirements apply.