Hazardous Energy Control and Lockout/Tagout

Why Hazardous Energy Control Matters

Hazardous energy control, usually referred to as Lockout/Tagout (LOTO), is one of the most heavily tested topics on the BCSP Associate Safety Professional (ASP) exam because it sits at the intersection of regulatory compliance, engineering controls, administrative controls, and human behavior. When OSHA promulgated 29 CFR 1910.147 in 1989, it estimated that compliance would prevent roughly 120 fatalities and about 50,000 injuries every year. Decades later, The Control of Hazardous Energy (Lockout/Tagout) remains consistently among OSHA's top ten most frequently cited standards, and failure to control energy during servicing and maintenance is a leading cause of amputations, crushing injuries, electrocutions, and fatalities in general industry.

The core problem is simple: machines and equipment store and transmit energy, and that energy does not care whether a worker's hand is inside the point of operation. A conveyor that restarts, a hydraulic press that drifts down under gravity, a steam line that is still pressurized, or a capacitor that discharges can injure or kill in a fraction of a second. LOTO exists to guarantee that the unexpected energization, start-up, or release of stored energy cannot occur while people are exposed.

For the ASP candidate, this topic also demonstrates a broader safety philosophy: identifying all energy sources, applying the hierarchy of controls, writing procedures, training people to defined roles, verifying that controls actually work, and auditing the program periodically.

What Hazardous Energy Control Is

Hazardous energy is any energy that can harm a person if it is released unexpectedly. The ASP exam expects you to recognize all of the common forms:

- Electrical (live circuits, capacitors, batteries, static)
- Mechanical (moving parts, rotating shafts, flywheels, blades)
- Hydraulic (pressurized fluid in cylinders and lines)
- Pneumatic (compressed air or gas)
- Chemical (reactive, corrosive, or flammable materials in process lines)
- Thermal (steam, hot surfaces, cryogenic cold)
- Gravitational / potential (raised loads, elevated machine members, counterweights)
- Stored or residual (compressed springs, accumulators, trapped pressure, rotating inertia)

A frequent exam trap is forgetting that de-energizing the primary source does not eliminate stored energy. A press ram held up by hydraulic pressure can fall when the pump is shut off; a spring-loaded mechanism can snap; a capacitor can hold a lethal charge after the breaker is opened. The standard explicitly requires that stored or residual energy be relieved, disconnected, restrained, or otherwise rendered safe.

Key Regulatory Framework

The primary standard is 29 CFR 1910.147, The Control of Hazardous Energy (Lockout/Tagout), which applies to general industry servicing and maintenance of machines and equipment where unexpected energization, start-up, or release of stored energy could cause injury. Know what it does not cover:

- Construction (covered by 29 CFR 1926, including 1926.417 for electrical circuits), agriculture, and maritime
- Installations under exclusive control of electric utilities for power generation, transmission, and distribution (1910.269)
- Exposure to electrical hazards from work on, near, or with conductors or equipment in electric utilization installations (covered by Subpart S, 1910.331 through 1910.335)
- Oil and gas well drilling and servicing
- Normal production operations, unless an employee must remove or bypass a guard or other safety device, or place any part of the body into the point of operation or a danger zone
- Hot tap operations on pressurized pipelines (gas, steam, water, petroleum) when continuity of service is essential, shutdown is impractical, documented procedures are followed, and special equipment provides proven effective protection
- Cord-and-plug connected equipment when exposure is controlled by unplugging and the plug remains under the exclusive control of the employee performing the work

The minor servicing exception is a classic exam question. Minor tool changes and adjustments, and other minor servicing activities that take place during normal production operations, are exempt from 1910.147 only if they are routine, repetitive, and integral to the use of the equipment for production, and the work is performed using alternative measures that provide effective protection (such as interlocked guards or control-reliable circuitry). If the task meets those conditions, machine guarding rules (1910.212) apply instead of LOTO.

Supporting standards and references you should recognize:

- ANSI/ASSP Z244.1, The Control of Hazardous Energy: Lockout, Tagout and Alternative Methods, a consensus standard that uses a risk assessment approach and permits engineered alternative methods for routine, repetitive tasks
- NFPA 70E, which defines an electrically safe work condition and requires testing for absence of voltage before working on electrical conductors
- 29 CFR 1910.333, which governs lockout and tagging of electrical circuits for employees working on or near exposed de-energized parts

Essential Definitions

Energy isolating device: A mechanical device that physically prevents the transmission or release of energy. Examples include a manually operated circuit breaker, a disconnect switch, a line valve, a block, or a similar device used to block or isolate energy. Push buttons, selector switches, and other control-circuit type devices are NOT energy isolating devices. This is tested repeatedly: an emergency stop button or an HMI stop command is a control, not an isolation.

Lockout: Placing a lockout device (a lock) on an energy isolating device in accordance with an established procedure so that the device and the equipment cannot be operated until the lockout device is removed.

Tagout: Placing a tagout device (a prominent warning tag) on an energy isolating device to indicate that the device and equipment may not be operated until the tag is removed. A tag is a warning only; it provides no physical restraint.

Capable of being locked out: An energy isolating device has a hasp or other means of attachment to which a lock can be affixed, or has a locking mechanism built in. Devices are also considered capable of being locked out if lockout can be achieved without dismantling, rebuilding, or replacing the device or permanently altering its energy control capability.

Authorized employee: A person who locks out or tags out machines or equipment to perform servicing or maintenance. An affected employee becomes authorized when their duties include servicing or maintenance.

Affected employee: An employee whose job requires operating or using a machine on which servicing is performed under lockout or tagout, or whose job requires working in an area where such servicing is being performed.

Other employee: Anyone who is or may be in an area where energy control procedures are used.

Servicing and/or maintenance: Constructing, installing, setting up, adjusting, inspecting, modifying, maintaining, and/or servicing machines or equipment, including lubricating, cleaning, unjamming, and making adjustments or tool changes where employees could be exposed to unexpected energization or release of hazardous energy.

Lockout Versus Tagout: The Hierarchy

OSHA strongly prefers lockout. The rules are:

1. If an energy isolating device is capable of being locked out, the employer must use lockout, unless the employer can demonstrate that a tagout program provides full employee protection equivalent to lockout.
2. If the device is not capable of being locked out, tagout may be used, but the tagout must be supplemented with at least one additional safety measure that provides a level of safety equivalent to lockout, such as removing an isolating circuit element, blocking a controlling switch, opening an extra disconnecting device, or removing a valve handle.
3. Whenever major replacement, repair, renovation, or modification of machines occurs, and whenever new machines are installed, energy isolating devices must be designed to accept a lockout device. (The standard's original compliance date for this requirement was January 2, 1990.)

Tagout limitations that must be covered in training: tags are only warning devices and do not provide the physical restraint of a lock; tags must never be removed without authorization of the person who applied them and never bypassed, ignored, or defeated; tags must be legible and understandable to all employees; tags and their attachment means must withstand the environment; tags may evoke a false sense of security; and tags must be securely attached so they cannot be inadvertently or accidentally detached.

Hardware Requirements for Devices

Lockout and tagout devices must be:

- Durable: capable of withstanding the environment for the maximum period of exposure; tags must not deteriorate or become illegible in wet, corrosive, or harsh conditions
- Standardized: by color, shape, or size within the facility; tags must also have standardized print and format
- Substantial: locks must prevent removal without excessive force or unusual techniques such as bolt cutters; tag attachments must be non-reusable, attachable by hand, self-locking, and non-releasable with a minimum unlocking strength of 50 pounds, equivalent to a one-piece all-environment-tolerant nylon cable tie
- Identifiable: the device must identify the employee who applied it
- Tags must warn against hazardous conditions with a legend such as Do Not Start, Do Not Open, Do Not Close, Do Not Energize, Do Not Operate
- LOTO devices must be singularly identified, used only for energy control, and not used for any other purpose (no using a LOTO lock on a toolbox)

The Written Energy Control Program

Employers must establish a program consisting of three parts: energy control procedures, employee training, and periodic inspections.

Energy control procedures must be documented in writing and must clearly outline the scope, purpose, authorization, rules, and techniques to be used, including: a statement of intended use; specific steps for shutting down, isolating, blocking, and securing the equipment; specific steps for placing, removing, and transferring LOTO devices and the responsibility for them; and requirements for testing the machine to verify the effectiveness of the energy controls.

A written procedure is not required for a specific machine only when all eight of the following conditions exist: (1) the machine has no potential for stored or residual energy or re-accumulation of stored energy after shutdown; (2) it has a single energy source that can be readily identified and isolated; (3) isolation and locking out that source completely de-energizes and deactivates the machine; (4) the machine is isolated and locked out during servicing; (5) a single lockout device achieves a locked-out condition; (6) the lockout device is under the exclusive control of the authorized employee performing the work; (7) the servicing does not create hazards for other employees; and (8) the employer has had no accidents involving unexpected activation or re-energization of that machine during servicing. Exam questions love to present a scenario that fails one of these conditions.

How It Works: The LOTO Sequence

The application sequence in 1910.147(d) must be followed in order:

1. Preparation for shutdown. The authorized employee must know the type and magnitude of the energy, the hazards it presents, and the method or means to control it. Identify every energy source, including secondary and stored sources, and locate all isolating devices.

2. Notification. Affected employees must be notified by the employer or authorized employee of the application and removal of LOTO devices, before the controls are applied and after they are removed.

3. Machine or equipment shutdown. Turn off or shut down using the established procedure and normal stopping controls, in an orderly manner that avoids creating additional hazards.

4. Machine or equipment isolation. Operate all energy isolating devices needed to isolate the machine from every energy source. This is the physical act of opening the disconnect, closing the valve, or pulling the breaker.

5. Lockout or tagout device application. Authorized employees affix devices to each energy isolating device. Lockout devices must hold the isolating device in the safe or off position. Tagout devices must be affixed in a manner that clearly indicates operation is prohibited; where a tag cannot be affixed directly to the isolating device, it must be located as close as safely possible in a position immediately obvious to anyone attempting to operate the device.

6. Stored energy. Following device application, all potentially hazardous stored or residual energy must be relieved, disconnected, restrained, or otherwise rendered safe. Methods include bleeding pressure, grounding capacitors, blocking elevated parts, releasing spring tension, and allowing rotating parts to come to a complete stop. If there is a possibility of re-accumulation to a hazardous level, verification of isolation must continue until servicing is complete or until the possibility no longer exists.

7. Verification of isolation. Before starting work, the authorized employee must verify that isolation and de-energization have actually been accomplished. This is the try step: attempt to start the machine with normal controls (after ensuring no one is exposed), test for absence of voltage with a meter, check pressure gauges, or observe that the equipment does not move. Then return the controls to the off position. Many practitioners call this Lock, Tag, Try or Lock, Tag, Clear, Try. Skipping verification is one of the most common root causes in LOTO fatality investigations and one of the most common exam distractors.

Release from LOTO

Before devices are removed and energy restored, the authorized employee must:

1. Inspect the work area to ensure nonessential items (tools, rags, parts) have been removed and machine components are operationally intact, including reinstalling guards.
2. Check that all employees have been safely positioned or removed from the area, and notify affected employees that LOTO devices are about to be removed.
3. Remove each device from each energy isolating device by the employee who applied it.

Removal by someone other than the person who applied the device is permitted only under the employer's documented procedure, with specific training, and only when the employer: verifies that the authorized employee is not at the facility; makes all reasonable efforts to contact that employee to inform them the device has been removed; and ensures the employee knows the device was removed before they resume work at the facility. Exam scenario: a worker goes home and leaves a lock on the breaker. The correct answer is never simply to cut the lock; it is to follow the documented abandoned-lock procedure.

Testing or Positioning During Servicing

When devices must be temporarily removed to test or position the machine, the sequence is: clear the machine of tools and materials; remove employees from the machine area; remove the LOTO devices; energize and proceed with testing or positioning; then de-energize all systems and reapply energy control measures before continuing servicing. The full procedure starts over; shortcuts here are a classic distractor.

Group Lockout or Tagout

When a crew, craft, or department services equipment, the employer must use a procedure that affords each employee protection equivalent to a personal lockout device. Typically a primary authorized employee is responsible for a set number of employees, ascertains the exposure status of each, and coordinates the effort. A group lockout device such as a hasp or a lockbox holding the keys to the isolation locks is used, and each authorized employee affixes a personal lockout or tagout device when they begin work and removes it when they stop. No one's protection depends on another person's lock.

Shift or Personnel Changes

Specific procedures must ensure continuity of protection during shift changes, including an orderly transfer of LOTO devices between outgoing and incoming employees. The incoming worker applies their lock before the outgoing worker removes theirs, so the equipment is never unprotected.

Outside Personnel (Contractors)

Whenever outside servicing personnel work on site, the on-site employer and the outside employer must inform each other of their respective lockout or tagout procedures, and the on-site employer must ensure that its employees understand and comply with the restrictions of the outside employer's program.

Training and Communication

Training is role based:

- Authorized employees must receive training in recognizing applicable hazardous energy sources, the type and magnitude of energy available in the workplace, and the methods and means necessary for energy isolation and control.
- Affected employees must be instructed in the purpose and use of the energy control procedure.
- All other employees who may be in the area must be instructed about the procedure and the prohibition against attempting to restart or re-energize locked or tagged equipment.
- Where tagout is used, all employees must be trained in the limitations of tags listed earlier.

Retraining is required whenever there is a change in job assignment, a change in machines, equipment, or processes that presents a new hazard, a change in the energy control procedures, or whenever a periodic inspection or other evidence reveals deviations from or inadequacies in an employee's knowledge or use of the procedures. Training must be certified with the employee's name and dates of training.

Periodic Inspection

The employer must conduct a periodic inspection of each energy control procedure at least annually. Key exam details:

- The inspection must be performed by an authorized employee other than the one(s) using the procedure being inspected.
- It must be designed to correct any deviations or inadequacies identified.
- Where lockout is used, the inspection includes a review between the inspector and each authorized employee of that employee's responsibilities under the procedure.
- Where tagout is used, the review is between the inspector and each authorized and affected employee.
- The employer must certify the inspection, identifying the machine or equipment, the date of inspection, the employees included, and the person performing the inspection.

Alternative Methods and Risk Assessment

ANSI/ASSP Z244.1 recognizes that for some routine, repetitive, and integral tasks, traditional lockout is impractical and may drive noncompliance. It permits alternative methods based on a documented risk assessment, using engineered controls such as control-reliable safety circuits, trapped-key systems, safety-rated interlocks with monitored stop, and light curtains. OSHA accepts such methods only within the minor servicing exception and only when they provide effective protection. On the exam, remember that OSHA's 1910.147 does not broadly allow risk-based alternatives in place of LOTO for servicing and maintenance; ANSI Z244.1 does, and the question stem will usually signal which framework it is referencing.

Common Program Failures Seen in Incidents

- Relying on a stop button or E-stop instead of an energy isolating device
- Failure to identify secondary energy sources (a second electrical feed, pneumatic supply to a clamp, a backup pump)
- Failure to relieve stored energy such as elevated parts or trapped pressure
- Skipping the verification (try) step
- Removing another worker's lock or using a tag when a lock was feasible
- Treating an unjamming task as production rather than servicing
- Inadequate group lockout where one lock protects many workers
- No annual periodic inspection or no certification records
- Contractors and host employer not coordinating procedures

Exam Tips: Answering Questions on Hazardous Energy Control and Lockout/Tagout

1. Watch for the control-versus-isolation trap. If an answer choice involves a push button, selector switch, E-stop, PLC command, or any control circuit device as the means of isolation, it is wrong. Only a mechanical energy isolating device (disconnect, breaker, valve, block) counts.

2. Remember that lockout is preferred over tagout. If the device can be locked, lock it. Tagout is acceptable only when the device cannot be locked or when the employer demonstrates full employee protection, and it must be supplemented with an additional measure. An answer that uses tags on a lockable disconnect because it is faster or cheaper is a distractor.

3. Know the sequence cold. Prepare, notify, shut down, isolate, apply devices, release stored energy, verify. Questions often ask what comes immediately after a given step, or which step was omitted in a scenario. Verification is always the last step before work begins, and release of stored energy comes after device application.

4. Memorize the numbers. Periodic inspections are at least annual. Tag attachments require a minimum unlocking strength of 50 pounds. The written-procedure exception requires all eight conditions. New or modified equipment since 1990 must be lockable.

5. Distinguish the three employee roles. Authorized employees apply locks and need the most detailed training. Affected employees operate or work near the equipment and must know the purpose of the procedure but do not apply locks. Other employees only need to know not to interfere. Questions will describe a person and ask which training applies, or ask who must be included in the periodic inspection review (authorized for lockout; authorized and affected for tagout).

6. Recognize the exceptions precisely. Cord-and-plug equipment is exempt only if the plug is under the exclusive control of the worker; if the plug is 40 feet away in another room, it is not exempt. Minor servicing must be routine, repetitive, and integral to production and use effective alternative protection. Hot taps require all listed conditions. Normal production is exempt unless guards are bypassed or body parts enter the danger zone.

7. Never choose an answer that removes someone else's lock casually. The only acceptable answer involves the employer's documented procedure: verify the person is not on site, make all reasonable efforts to contact them, and inform them before they return to work.

8. In group lockout scenarios, every exposed worker needs a personal device. An answer where the supervisor's single lock protects the whole crew is wrong. Look for the lockbox or hasp with each worker's personal lock.

9. Do not forget stored energy. When a question describes a shut-down and locked-out hydraulic press, elevated conveyor, or capacitor bank and asks what hazard remains, the answer is stored or residual energy, and the control is bleeding, blocking, grounding, or restraining.

10. Separate OSHA from ANSI. If the question references risk assessment and alternative methods for routine tasks, it is pointing to ANSI/ASSP Z244.1. If it references the minimum legal requirement, periodic inspections, or specific employee roles, it is 29 CFR 1910.147. If it references an electrically safe work condition or absence-of-voltage testing, it is NFPA 70E or Subpart S.

11. Use the hierarchy of controls when the question asks for the best long-term fix. Designing out the need for frequent access (engineering) ranks above procedures (administrative). But when the question asks what is required during servicing today, the answer is applying LOTO per the procedure, not redesigning the machine.

12. Read for the word that changes everything. Terms such as unexpected, exclusive control, capable of being locked out, full employee protection, authorized, affected, annually, and other than (as in the inspector being someone other than the user) are often the single detail that separates the correct answer from a near-miss distractor.

Summary

Hazardous energy control is about guaranteeing, not hoping, that equipment cannot start or release energy while people are exposed. For the ASP exam, master the definitions in 1910.147, the preference for lockout over tagout, the ordered sequence of shutdown, isolation, device application, stored energy release, and verification, the orderly release and restart process, group and shift-change rules, role-based training, the annual periodic inspection and its certification, and the narrow exceptions. Pair that regulatory knowledge with the practical understanding of energy types and stored energy, and you will be able to work through scenario-based questions with confidence.