Many of the most severe industrial injuries happen when a machine that people thought was off starts up, or when stored energy is released during servicing. Energy control (lockout/tagout) prevents this during maintenance and clearing, and machine safeguarding prevents contact during normal operation.
This guide covers the types of hazardous energy, the elements of an energy control program, the lockout/tagout sequence step by step, lock versus tag and group lockout, the hierarchy of safeguards from fixed guards to presence-sensing devices, and how to measure the program. A worked audit of twelve machines at an illustrative plant shows how a good average can hide a concentrated risk.
Legal requirements differ by country and industry. US OSHA 29 CFR 1910.147 and ISO 14118 are used here as references. Check the rules that apply to you.
Before You Start
Why Energy Control Matters
Many of the most severe industrial injuries happen when a machine that people believed to be off starts up, or when stored energy is released while someone is working on it. These are not rare freak events. They are the predictable result of servicing, clearing jams, cleaning, and adjusting machines without controlling their energy. Lockout/tagout and machine safeguarding are consistently among the most frequently cited topics in OSHA inspections.
Severity Is High
Crushing, amputation, electrocution, and burns. Energy-related injuries are often severe or fatal.
The Risk Is Hidden
A stopped machine can still hold electrical, hydraulic, pneumatic, spring, gravity, and thermal energy.
It Happens in Routine Work
Jam clearing, cleaning, lubricating, and quick adjustments are where people are tempted to take shortcuts.
It Is Controllable
A written procedure, the right devices, trained people, and regular checks prevent this kind of event.
Know the Energy Sources
Hazardous energy is any energy that can cause harm if it is released or if the machine starts unexpectedly. A good procedure begins with a complete list for each machine.
| Energy type | Examples | How it is isolated or released |
|---|---|---|
| Electrical | Mains power, control circuits, capacitors, batteries | Disconnect, breaker, or plug; discharge capacitors; test for absence of voltage |
| Hydraulic | Presses, cylinders, accumulators | Close valves; bleed pressure; block the load |
| Pneumatic | Air cylinders, clamps, lines | Close and lock the supply valve; vent the lines; check gauges |
| Mechanical, kinetic | Flywheels, rotating shafts, coasting parts | Wait for stop; brake; verify standstill |
| Gravity and spring | Raised dies, suspended loads, compressed springs | Lower to the ground; block, pin, or restrain |
| Thermal | Hot surfaces, steam, molten material, cryogenics | Allow to cool; insulate; drain |
| Chemical and fluid | Process lines, reactive materials, pressurized fluids | Close and blank valves; drain and purge; test |
| Radiation and other | Lasers, X-ray, magnetic fields | Specific procedures from the equipment maker |
A stop button, emergency stop, or other control-circuit device is not an energy-isolating device. It tells the machine to stop. It does not make it safe to put your hands in.
The Energy Control Program
In US general industry, OSHA’s standard on the control of hazardous energy (29 CFR 1910.147) requires an energy control program with these elements. Other countries have equivalent rules and standards, such as ISO 14118 on preventing unexpected start-up. Check the requirements that apply to you.
| Element | What it is | A good test |
|---|---|---|
| Written procedures | A procedure for each machine or group of similar machines, listing the energy sources, how to isolate each, how to release stored energy, and how to verify | Could a trained person who has never used this machine isolate it correctly using only the procedure? |
| Devices | Locks, tags, hasps, and blocking devices, individually keyed and durable, that identify the person who applied them | Is there a lockable isolation point for every energy source, and are the devices at the machine? |
| Training | Authorized employees (who lock out), affected employees (who work with the machine), and others (who work nearby) | Can people explain why the stop button is not enough? |
| Periodic inspection | At least once a year, an authorized person other than the one using the procedure checks that it is being followed | Was each procedure inspected in the last 12 months, with a record? |
| Special cases | Group lockout, shift change, contractors, and testing or positioning the machine under power | Is each case written down, so that the lock-and-tag never has a gap? |
The Lockout/Tagout Sequence
The sequence is the same for most machines. The key points are that each worker puts on their own lock, that the stored energy is released, and that the machine is tested before anyone works on it.
| Step | Common failure | How to prevent it |
|---|---|---|
| Prepare | The worker does not know all the energy sources | A written, machine-specific procedure with photos of the isolation points |
| Isolate | One source is missed, such as an air line or a second power feed | A complete energy list; labeled isolation points |
| Lock and tag | One lock for a team, or a tag with no lock | Personal locks for everyone; the group procedure written down |
| Release stored energy | Hydraulic pressure, a raised die, or a spring still holds energy | Bleed, block, and restrain; check the gauges |
| Verify | The machine is assumed to be off | Try to start it, with people clear, then return controls to off; test for voltage when it applies |
| Remove and restore | A lock is removed by someone else, or the area is not checked | Only the person who applied the lock removes it; a clear-the-area check; a defined process for the lost-key case |
Lock, Tag, and Group Lockout
- A lock holds the isolation device in the safe position. A tag is a warning. A tag alone does not prevent anyone from operating the device, so it is a weaker control. Where a device can be locked, lock it; use a tag alone only where a lock is not possible, and only with additional measures that give the same level of protection.
- Each worker uses their own lock. Every person exposed puts their own lock and tag on the isolation point, normally through a lockbox or a multi-lock hasp for group work. Nobody depends on someone else to keep them safe.
- Shift change. Make a written handover so the protection is continuous: the incoming person puts their lock on before the outgoing person takes theirs off.
- Contractors. Exchange procedures. Both parties must know each other’s programs, and contractors must lock out too.
- Testing under power. Some tasks, such as testing or positioning, need the machine energized for a short time. Have a written step for temporary clearing, re-energizing, and returning to lockout.
Machine Safeguarding: Preventing Contact in Normal Operation
Lockout covers servicing and maintenance. Safeguarding covers normal operation, where the machine is running and people are working near it. The standard approach is to remove the hazard through design if possible, and otherwise to separate people from it.
| Safeguard | How it works | Typical use | Watch out for |
|---|---|---|---|
| Fixed guards | A barrier that can only be removed with tools | Rotating shafts, belts, gears, and chains | Removed for access and not replaced |
| Interlocked guards | A guard that stops the machine when it is opened and keeps it from starting until it is closed | Doors and covers that need frequent access | Bypassed or defeated; interlock not tested |
| Presence-sensing devices | Light curtains and area scanners that stop the machine when a person enters the zone | Press loading and robot cells | Safety distance too short; stopping time not verified |
| Two-hand controls | Both hands on separate controls to start the cycle | Operator is at a fixed station | Protect only the operator, not others; can be tied down |
| Distance and awareness | Barriers, floor marking, and warnings | Supplementary protection | Relying on signs for a serious hazard |
- Design it out. The best control is a machine with no accessible hazard: enclosed, with the point of operation out of reach, and with servicing points that can be reached from outside the danger area.
- Check the safety system, not just the guard. Interlocks, light curtains, and emergency stops are only protective if they work. Test them on a schedule, and record the results.
- Control the bypass. A person who has to bypass a guard to do the job is telling you the job needs redesigning. Make any necessary bypass an authorized, controlled, and temporary procedure.
- Minor servicing. In the US, routine and minor tasks that are part of normal production, such as clearing a minor jam, may be exempt from lockout only if the work is covered by other effective protection. Do not treat this exception as a loophole. A well-designed interlock with access that has the same level of protection as lockout is better than a procedure that relies on people taking a risk.
Worked Example: Auditing Energy Control at Riverside Plant
Riverside Plant, an illustrative 140-employee metal fabrication and assembly plant, found in its annual audit that lockout devices and procedures were missing at machines that needed them (see the Safety Audits guide). The safety coordinator and a maintenance technician then checked all 12 machines against three questions: is there a written procedure, are the devices there and adequate, and was a periodic inspection done in the last 12 months? All data are illustrative.
| Check | Result | Share |
|---|---|---|
| Written, machine-specific procedure | 10 of 12 | 83% |
| Devices available and adequate | 9 of 12 | 75% |
| Periodic inspection in the last 12 months | 7 of 12 | 58% |
| All three | 7 of 12 | 58% |
What the check found. The two saws and the palletizer had no lockable disconnect at the machine, so people were isolating them by switching off the control panel. The parts washer and the packaging machine had no procedure at all: both are used by temporary staff. Five machines had no inspection in the last year, and three of them (both saws and the palletizer) are the machines that also had no devices.
| Priority | Action | Level of control | Owner and date |
|---|---|---|---|
| 1 (this week) | Fit lockable disconnects and a lockout kit at Saw 1, Saw 2, and the palletizer; tag the machines out of service until it is done | Engineering | Maintenance lead, 5 days |
| 2 (this month) | Write machine-specific procedures with photos for the parts washer and the packaging machine, and train the people who use them | Administrative | Safety coordinator, 30 days |
| 3 (this quarter) | Complete the periodic inspections that are overdue, and schedule them all through the year | Administrative | Safety coordinator, 90 days |
| 4 (next review) | For the press and the packaging machine, assess adding interlocked access so that routine jam clearing no longer needs a full lockout | Engineering | Engineering manager, next committee review |
Measuring the Program
| Indicator | How | Target |
|---|---|---|
| Machines with a current written procedure | Machines with a procedure ÷ machines that need one | 100% |
| Machines with adequate devices at point of use | Checked on the audit | 100% |
| Periodic inspections done on time | Inspections in the last 12 months ÷ machines | 100% |
| Authorized employees with current training | Trained ÷ authorized | 100% |
| Lockout-related near misses and findings | Reports of unexpected start-up, bypassed locks, and audit findings | Falling; reports rising is a good sign |
| Overdue actions from inspections | Open past the due date | Zero for critical items |
The Lockout/Tagout Procedure and Audit Sheet keeps the inventory, the machine procedures, and the annual inspections, and calculates the coverage figures above.
Common Mistakes
Stop Button as Isolation
Treating a control-circuit device as an energy-isolating device.
Tags Without Locks
Relying on a warning where a lock is practical.
Forgotten Stored Energy
Isolating the power but not the hydraulic pressure, air, or spring.
Generic Procedures
One paper for every machine, which does not name the real isolation points.
No Verification
Skipping the try step because the machine looks off.
Bypassed Safeguards
Interlocks and guards defeated to save time, with no one asking why.
Self-Assessment Questions
- Do we have a complete list of energy sources for every machine, with a lockable isolation point for each?
- Does every machine that needs one have a written, machine-specific procedure that people use?
- Does every worker use their own lock, including contractors and at shift change?
- Do we verify zero energy before work begins and release all stored energy?
- Do we inspect each procedure at least once a year and record it?
- Are interlocks, light curtains, and emergency stops tested on a schedule, and do we ask why a safeguard is bypassed?
Energy Control and Machine Safety (Lockout/Tagout): Frequently Asked Questions
What is lockout/tagout?
A set of practices that keeps a machine from starting or releasing stored energy while someone is servicing it. Lockout puts a lock on each energy-isolating device in the safe position. Tagout adds a warning tag. The sequence is to prepare, shut down, isolate, lock and tag, release stored energy, and verify that the machine is at zero energy before work starts.
Is an emergency stop button enough?
No. An emergency stop or other control-circuit device tells the machine to stop, but it can be restarted by a fault, a command, or someone else, and it does not remove stored energy. Servicing needs the energy source isolated and locked, and the isolation verified.
What is the difference between lockout and tagout?
A lock physically prevents the isolation device from being operated, and a tag is only a warning. Where a device can be locked, locking is the stronger control. A tag alone is used only where a lock is not possible and must give the same level of protection by other means.
How often must lockout procedures be inspected?
In US general industry, 29 CFR 1910.147 requires that each energy control procedure is inspected at least once a year, by an authorized person other than the one using it, to check that it is being followed and is adequate. Check the current rules that apply to you.
What is the difference between lockout and machine guarding?
Lockout protects people during servicing and maintenance by isolating all energy. Machine guarding protects people during normal operation, with fixed guards, interlocks, light curtains, and similar safeguards. A complete program needs both.
Sources and Further Reading
- US Occupational Safety and Health Administration, 29 CFR 1910.147, The control of hazardous energy (lockout/tagout), and OSHA 3120, Control of Hazardous Energy (Lockout/Tagout).
- US Occupational Safety and Health Administration, 29 CFR 1910 Subpart O, Machinery and Machine Guarding, including 1910.212, General requirements for all machines.
- ISO 14118, Safety of machinery: prevention of unexpected start-up; ISO 12100, Safety of machinery: general principles for design, risk assessment and risk reduction (check current editions).
- ANSI/ASSP Z244.1, Control of Hazardous Energy: Lockout, Tagout and Alternative Methods; ANSI B11 series on machine safeguarding.
- National Institute for Occupational Safety and Health, publications on the control of hazardous energy and machine guarding.