Lockout/Tagout Program Guide: Building a 1910.147-Compliant Energy Control Program (2026)

OSHA estimates that lockout/tagout failures cause roughly 120 fatalities and 50,000 injuries every year in the United States. The standard covering it, 29 CFR 1910.147, has been on the books since 1989, yet it consistently ranks among OSHA’s top 10 most-cited violations. The reason isn’t that employers don’t know LOTO exists. It’s that most programs are incomplete in the same predictable ways.

A working lockout tagout program has three parts: a written energy control program, machine-specific procedures where required, and documented annual inspections. Most sites have part one. Many skip part two for some equipment. Almost everyone struggles with part three.

What 1910.147 Actually Requires

The standard applies whenever employees perform servicing or maintenance on machines where unexpected energization or release of stored energy could cause injury. That covers far more than electrical work. Any machine with moving parts, stored hydraulic pressure, pneumatic lines, elevated components held by gravity, or residual thermal or chemical energy falls under 1910.147.

The written energy control program is mandatory. It must describe the scope and purpose of the program, the rules it applies to, and the enforcement procedures. But the program document is just the framework. The actual work happens at the machine level, and that’s where most employers fall short.

The standard requires machine-specific written procedures for equipment where the general exception doesn’t apply. The exception at 1910.147(c)(4)(i) lets you use a general procedure only when a machine has a single energy source that can be locked with one device, that device stays under the exclusive control of the authorized employee doing the work, no hazards are created to other employees, and the equipment has had no history of unexpected energization problems. All five conditions must be true. If any one of them fails, a machine-specific procedure is required.

That means most real industrial equipment needs its own written procedure. A conveyor with an electrical disconnect and a pneumatic supply line doesn’t meet the single-energy-source condition. A press with counterweighted tooling has a gravity energy source. Write the procedure.

Types of Energy: What Isolation Actually Means

The six energy types covered under 1910.147 each require a different isolation approach, and your machine-specific procedures need to address every one present on the equipment.

Electrical energy is the most familiar. Isolation means opening the disconnect, locking it in the open position, and verifying zero energy with a meter before touching anything. De-energizing at the control panel is not isolation. The disconnect must be locked.

Pneumatic and hydraulic energy requires more than closing a valve. Residual pressure stays in lines, cylinders, and accumulators after the supply is shut off. Isolation includes closing the supply valve, locking it, and then bleeding down the lines to verify zero pressure. Your procedure needs to document where the bleed ports are and what “bled down” looks like for that specific machine.

Gravity energy is stored in any elevated component, counterweight, or spring-loaded part that could move or drop when power is removed. Isolation means mechanically blocking or pinning the component so it physically cannot move, not just removing electrical power. A press with a ram that could drop under gravity requires a physical block, documented in the procedure.

Thermal energy comes from heated surfaces, steam lines, and process vessels with hot contents. Isolation requires both shutting off the heat source and allowing the equipment to cool to a safe temperature before contact. Your procedure should specify the acceptable surface temperature or cooldown time.

Chemical energy exists in any process equipment, vessels, or lines containing hazardous materials under pressure. Isolation requires closing and locking supply valves, then flushing or draining the system to remove residual material. This often requires coordination with process safety and may overlap with your confined space program.

The Six-Step Lockout Sequence

1910.147(d) lays out the procedure sequence. Your machine-specific procedures should map directly to these steps for each piece of equipment.

First, notify all affected employees that lockout is about to occur and what equipment will be taken out of service. Second, identify all energy sources on the equipment using the machine-specific procedure. Third, shut down the equipment using normal stopping procedures. Fourth, isolate the equipment from every energy source by operating the identified isolation points, meaning disconnects, valves, and mechanical blocks. Fifth, apply lockout devices to each isolation point, one lock per authorized employee, so the isolation points cannot be reactivated. Sixth, release, restrain, or otherwise render safe any stored or residual energy.

After those six steps, verify that isolation is complete. Test the controls to confirm the equipment won’t start. Verify zero energy with appropriate test equipment for electrical sources. Only then is the equipment safe to service.

Restoration reverses the sequence. Remove all tools and materials from the work area. Confirm all workers are clear. Remove energy-isolating devices. Notify affected employees. Restore energy sources. Verify safe operation.

Machine-Specific Procedure Requirements

A valid machine-specific procedure must document the equipment name and location, the date the procedure was written and by whom, the types and magnitudes of energy present, the steps to shut down and isolate each energy source, the specific location of each isolation point (circuit breaker panel, disconnect switch, pneumatic supply valve, etc.), the type and magnitude of energy at each point, and the steps to release stored energy.

Who approves the procedure matters. Most citations involve procedures written once and never reviewed, or procedures that don’t match the actual equipment because the equipment was modified after the procedure was written. Assign ownership. When a machine is modified, the procedure gets updated before service resumes.

The format doesn’t matter as much as the specificity. A checklist format works. A narrative format works. What doesn’t work is a procedure that says “locate the main disconnect” without telling the technician where the disconnect is, what size lock fits it, or which panel it’s in.

Authorized vs. Affected Employees

These two categories get conflated, and that’s a problem because the training requirements are different.

Authorized employees are the people who actually apply and remove lockout devices. They need full training: the purpose and content of the written program, recognition of the types and magnitude of hazardous energy on their equipment, the methods for isolation and control, and the specifics of every procedure they’re authorized to use. This isn’t a one-time classroom session. Authorized employees need to demonstrate they can execute the procedure on the actual equipment.

Affected employees are workers who operate equipment that gets locked out, or who work nearby when lockout is in effect. They need to understand why lockout is performed, how to recognize that a machine is locked out, and that they must never attempt to restart or re-energize a machine under lockout. They don’t need to know the mechanical details of every procedure.

The training records need to reflect this distinction. An affected employee who becomes an authorized employee needs the full authorized training on record before they start applying locks.

Group Lockout: One Lock Per Worker

When more than one authorized employee works on the same piece of equipment, 1910.147(f)(3) requires a group lockout procedure. The mechanics are straightforward: a hasp (a multi-hole device) goes on the isolation point, and every worker applies their own personal lock to the hasp. The machine stays locked out until every person has removed their own lock.

The mistake is having a crew lead apply one lock for the entire group. That one person can remove the lock while other workers are still on the machine. Group lockout exists precisely to prevent that scenario. Every worker, every lock.

For large jobs with multiple isolation points, a lockout box is often the practical solution. The authorized employees each hold a key in the box, the main locks go on the isolation points, and the box can’t be opened until all workers return their keys. The box itself should be locked with individual personal padlocks from each crew member.

Contractor Lockout Coordination

When outside contractors perform maintenance on your equipment, you don’t get to hand them the procedure and walk away. 1910.147(f)(2) requires that the host employer and the outside employer inform each other of their respective lockout procedures and make sure their programs are compatible.

In practice, that means a pre-job meeting to review the machine-specific procedure with contractor personnel, confirmation that the contractor’s program meets 1910.147 requirements, and a clear agreement on who applies the first lockout device (typically the host employer’s authorized employee, who then transfers control to the contractor). It also means the host employer verifies that contractor employees are actually trained and that they have locks that fit the isolation points.

If the contractor’s program requires tagout only and your program requires lockout, your higher-protection standard applies on your equipment.

Periodic Inspections

This is the part most programs skip, and it’s the one OSHA catches most often during inspections.

1910.147(c)(6) requires an annual inspection of each energy control procedure. The inspection must be conducted by an authorized employee other than the one who uses the procedure. It must include a review of the procedure with each authorized employee covered by that procedure. For lockout procedures, the review must be a hands-on walkthrough of the procedure at the equipment.

The certification record must include the date of the inspection, the machine or equipment involved, the names of the employees included in the review, and the name of the inspector. That’s four data points per procedure per year. If you have 40 machines with specific procedures, you have 40 inspection records to produce when OSHA walks in.

The most common citation isn’t that inspections never happened. It’s that the same person who uses the procedure also conducted the inspection, which the standard prohibits. Assign a second authorized employee, or a safety professional, as the inspector for each procedure. Build it into the annual safety calendar.

The penalty for a willful violation of 1910.147 runs up to $16,131 per violation as of 2026 OSHA penalty adjustments, with repeat violations carrying the same ceiling. A facility with 20 machines missing annual inspection records and 10 machines missing required procedures is looking at potential combined exposure in six figures before OSHA starts counting the more serious egregious citation categories. The periodic inspection requirement is the one most programs skip. It’s also the one with the paper trail that makes citations straightforward for compliance officers to document.

Build the inspection calendar before anything else. The procedures can be written in phases. The inspections have to keep pace.