Hazardous Energy Control and Lockout/Tagout

Overview
Hazardous Energy Control, commonly called Lockout/Tagout (LOTO), is one of the highest-yield topics in the BCSP Certified Safety Professional (CSP) exam domain of Advanced Application of Safety Principles. It sits at the intersection of regulatory compliance, machine safeguarding, electrical safety, risk assessment, and management systems. This guide explains why the topic matters, what the key concepts are, how an effective energy control program functions step by step, and how to approach exam questions on the subject with confidence.

Part 1: Why Hazardous Energy Control Is Important

1.1 The human toll
The unexpected energization or startup of machinery, or the release of stored energy during servicing and maintenance, is a leading cause of serious injury and death in industry. Typical outcomes include amputations, crushing injuries, electrocution, burns from steam or chemicals, and fatalities from being caught in moving parts. OSHA has historically estimated that compliance with its LOTO standard prevents roughly 120 fatalities and about 50,000 injuries each year in the United States. Workers injured in LOTO incidents often lose significant time from work, and many never fully recover.

1.2 Regulatory exposure
The Control of Hazardous Energy standard, 29 CFR 1910.147, consistently appears in OSHA's annual list of the ten most frequently cited standards. Common citations involve missing or inadequate machine-specific procedures, failure to conduct periodic inspections, lack of employee training, and failure to apply locks before servicing. Penalties can be substantial, and repeat or willful violations carry multiplied fines. For a safety professional, LOTO is therefore both an ethical and a business priority.

1.3 Why the exam emphasizes it
LOTO is an ideal exam topic because it requires the candidate to integrate several competencies: recognizing all forms of energy (not just electrical), understanding the hierarchy of controls and why administrative controls like LOTO are needed when engineering controls are not feasible, applying regulatory definitions precisely, and managing a written program with training, auditing, and documentation. Questions test both recall of specific rules and judgment in applying them to scenarios.

Part 2: What Hazardous Energy Control Is

2.1 Definition of hazardous energy
Hazardous energy is any energy source that could cause injury if released unexpectedly. The CSP candidate must be able to list and recognize all of the following forms:
- Electrical: line voltage, stored charge in capacitors, battery banks, static.
- Mechanical: rotating shafts, flywheels, blades, conveyor motion, and kinetic energy of moving parts.
- Hydraulic: pressurized fluid in cylinders, accumulators, and lines.
- Pneumatic: compressed air in receivers, lines, and actuators.
- Thermal: hot or cold surfaces, steam, cryogenic fluids.
- Chemical: process chemicals, reactive materials, pressurized gases in pipelines.
- Gravitational (potential): raised loads, counterweights, elevated platens, suspended parts that can fall.
- Stored or residual energy: springs under tension or compression, capacitors, accumulators, trapped pressure, thermal mass.
- Radiation and other energy sources in specialized facilities.
A recurring exam theme is that a single machine often has multiple energy sources, and each must be identified and controlled.

2.2 Key definitions from 29 CFR 1910.147
- Authorized employee: a person who locks out or tags out machines or equipment in order to perform servicing or maintenance. An affected employee becomes authorized when their duties include performing servicing.
- Affected employee: an employee whose job requires them to operate or use a machine on which servicing is being performed under LOTO, or whose job requires them to work in an area where such servicing is performed.
- Other employees: those who work in the area where LOTO procedures may be used; they must be instructed about the procedure and the prohibition on restarting locked-out equipment.
- Energy isolating device: a mechanical device that physically prevents the transmission or release of energy. Examples: manually operated circuit breaker, disconnect switch, line valve, block, slide gate, blank flange. Push buttons, selector switches, and other control-circuit devices are NOT energy isolating devices. This distinction is tested frequently.
- Lockout: the placement of a lockout device on an energy isolating device, in accordance with an established procedure, ensuring that the device and the equipment cannot be operated until the lockout device is removed.
- Tagout: the placement of a tagout device (a prominent warning device, such as a tag with a means of attachment) on an energy isolating device to indicate that the device and equipment may not be operated until the tag is removed. A tag is a warning, not a physical restraint.
- Capable of being locked out: an energy isolating device is capable of being locked out if it has a hasp or other means of attachment to which a lock can be affixed, or if it has a locking mechanism built into it. A device is also considered capable of being locked out if lockout can be achieved without dismantling, rebuilding, or replacing the energy isolating device or permanently altering its energy control capability.
- Servicing and/or maintenance: workplace activities such as constructing, installing, setting up, adjusting, inspecting, modifying, and maintaining or servicing machines, including lubrication, cleaning, unjamming, and making adjustments or tool changes, where the employee may be exposed to unexpected energization, startup, or release of stored energy.
- Normal production operations: the use of a machine to perform its intended production function. These are generally covered by machine guarding standards (Subpart O), not LOTO, unless the minor servicing exception does not apply.
- Energized: connected to an energy source or containing residual or stored energy.

2.3 Scope, exclusions, and the relationship to other standards
The general industry standard 1910.147 covers servicing and maintenance of machines and equipment where unexpected energization could cause injury. Exam questions frequently probe what is not covered:
- Construction is covered under 29 CFR 1926 (for example, 1926.417 for electrical lockout and tagging of circuits), not 1910.147.
- Agriculture, maritime, and oil and gas well drilling and servicing are excluded.
- Electric utility generation, transmission, and distribution installations are covered by 1910.269.
- Work on exposed electrical conductors and electrical equipment as electrical hazards is covered by Subpart S, specifically 1910.333, which has its own lockout and tagging provisions; 1910.147 covers the non-electrical hazards of electrically powered equipment.
- Cord-and-plug connected equipment is exempt from 1910.147 if the equipment is unplugged and the plug remains under the exclusive control of the employee performing the work.
- Hot tap operations on pressurized pipelines (gas, steam, water, petroleum) are exempt if continuity of service is essential, shutdown is impractical, documented procedures are followed, and special equipment provides proven effective protection.
- Minor servicing exception: minor tool changes and adjustments, and other minor servicing activities that are routine, repetitive, and integral to production, are exempt if performed using alternative measures that provide effective protection (such as interlocked guards or control-reliable circuits). All three criteria must be met, and the alternative protection must be effective.

2.4 Consensus standards
- ANSI/ASSP Z244.1, The Control of Hazardous Energy: Lockout, Tagout and Alternative Methods. This standard is more comprehensive than the OSHA rule, emphasizes risk assessment, and formally recognizes alternative methods of energy control when a risk assessment demonstrates equivalent protection. Z244.1 is the benchmark for a best-practice program.
- NFPA 70E, Standard for Electrical Safety in the Workplace, which defines the electrically safe work condition and requires verification of absence of voltage with a properly rated meter that is tested before and after use (the live-dead-live test).
- ANSI B11 series machine safety standards, which address safeguarding and interface with LOTO.

Part 3: How an Energy Control Program Works

3.1 The three pillars of the program
OSHA requires an energy control program consisting of three elements:
1. Energy control procedures (documented, machine- or equipment-specific).
2. Employee training (authorized, affected, and other employees).
3. Periodic inspections (at least annually, of each procedure).
Candidates should memorize these three pillars; questions often ask which element is missing in a scenario.

3.2 Written energy control procedures
Procedures must be documented and must clearly and specifically outline:
- The scope, purpose, authorization, rules, and techniques to be used.
- The specific steps for shutting down, isolating, blocking, and securing the equipment.
- The specific steps for placing, removing, and transferring lockout or tagout devices, and the responsibility for them.
- Requirements for testing the machine to verify the effectiveness of the isolation.
The documentation requirement is waived only when all eight of the following conditions are met: the machine has no potential for stored or residual energy; it has a single energy source that can be readily identified and isolated; isolating that source completely de-energizes the machine; the machine is isolated and locked out during servicing; a single lockout device achieves a locked-out condition; the lockout device is under the exclusive control of the authorized employee; servicing does not create hazards for other employees; and the employer has had no accidents involving unexpected activation of that machine. If any condition fails, a written procedure is required.

3.3 The sequence of applying lockout/tagout
This step sequence is heavily tested. Learn it in order:
1. Prepare for shutdown. The authorized employee identifies the type and magnitude of energy, the hazards, and the method of control. Review the machine-specific procedure.
2. Notify affected employees that the equipment will be shut down and locked out.
3. Shut down the equipment using normal stopping procedures (for example, stop buttons) to avoid creating additional hazards.
4. Isolate the equipment from all energy sources by operating each energy isolating device (open disconnects, close valves, etc.).
5. Apply lockout or tagout devices to each energy isolating device. Each authorized employee applies their own personal lock.
6. Control stored and residual energy. Relieve, disconnect, restrain, or otherwise render safe all stored energy: bleed pressure, discharge capacitors, block or lower elevated parts, release spring tension, allow thermal equipment to cool, and dissipate or restrain any energy that could reaccumulate.
7. Verify isolation (often called try-out or test-before-touch). Attempt to start the equipment with the normal controls, confirm it does not operate, then return the controls to the off or neutral position. For electrical hazards, test for absence of voltage with a meter verified on a known live source. This verification step is the most frequently omitted step in real incidents and is a favorite exam question.
Only after all seven steps are complete is the equipment considered to be in a zero energy state and safe for servicing.

3.4 Release from lockout/tagout (restoring to service)
Before removing devices:
1. Inspect the work area to ensure non-essential items (tools, rags) have been removed and the equipment components are operationally intact; reinstall guards.
2. Check that all employees are safely positioned or removed from the area.
3. Notify affected employees that devices are being removed and equipment is being re-energized.
4. Remove the lockout/tagout devices. Each device must be removed by the employee who applied it.
5. Re-energize the equipment and verify proper operation.

3.5 Removal of a lock by someone other than the person who applied it
Only permitted under the employer's established procedure, which must include: verifying the authorized employee is not at the facility; making all reasonable efforts to contact the employee; and ensuring the employee is informed the lock has been removed before they resume work at the facility. The equivalent protection, documentation, and management approval requirements make this a common scenario question. Cutting a lock without following this procedure is never acceptable.

3.6 Lockout versus tagout: which to use
- If an energy isolating device is capable of being locked out, the employer must use lockout, unless the employer can demonstrate that tagout provides full employee protection equivalent to lockout.
- If the device is not capable of being locked out, tagout may be used, but the employer must take additional measures to provide a level of safety equivalent to lockout, such as removing an isolating circuit element, blocking a control switch, opening an extra disconnecting device, or removing a valve handle.
- Equipment installed, replaced, or undergoing major repair, renovation, or modification after January 2, 1990 must be designed to accept a lockout device.
- Tags are warning devices only; they do not provide physical restraint, may evoke a false sense of security, and must be legible and understandable to all employees. Tag attachments must be non-reusable, self-locking, and have a minimum unlocking strength of 50 pounds (roughly equivalent to a one-piece nylon cable tie).

3.7 Requirements for lockout and tagout devices
Devices must be:
- Singularly identified and the only devices used for controlling energy (not used for other purposes such as toolbox locks).
- Durable: capable of withstanding the environment (weather, wet, corrosive conditions) and tags must not deteriorate or become illegible.
- Standardized within the facility by color, shape, or size; tag print and format must also be standardized.
- Substantial: locks must prevent removal without excessive force or unusual techniques such as bolt cutters; tags must prevent inadvertent or accidental removal.
- Identifiable: they must indicate the identity of the employee who applied them.
- Tags must warn against hazardous conditions with legends such as Do Not Start, Do Not Open, Do Not Close, Do Not Energize, Do Not Operate.

3.8 Training requirements
- Authorized employees must be trained in the recognition of applicable hazardous energy sources, the type and magnitude of energy in the workplace, and the methods and means necessary for energy isolation and control.
- Affected employees must be instructed in the purpose and use of the energy control procedure.
- Other employees must be instructed about the procedure and the prohibition against attempting to restart or re-energize locked-out or tagged-out equipment.
- When tagout is used, all employees must be trained on the limitations of tags.
- Retraining is required when there is a change in job assignment, a change in machines, equipment, or processes that presents a new hazard, a change in the energy control procedures, or whenever a periodic inspection or other evidence reveals deviations or inadequacies in employee knowledge or use of the procedures.
- The employer must certify that training has been completed and is kept up to date; the certification must contain each employee's name and the dates of training.

3.9 Periodic inspections
- Must be conducted at least annually for each energy control procedure.
- Performed by an authorized employee other than the one(s) utilizing the procedure being inspected.
- Must include a review between the inspector and each authorized employee of that employee's responsibilities under the procedure (for lockout). Where tagout is used, the review must include affected employees as well.
- Designed to correct any deviations or inadequacies identified.
- Must be certified, identifying the machine or equipment, the date, the employees included, and the person performing the inspection.
A frequent distractor is an inspection performed by the same person who performs the lockout, or by an unqualified supervisor; neither meets the requirement.

3.10 Special situations
Group lockout. When servicing is performed by a crew, craft, or department, each authorized employee must have a level of protection equivalent to a personal lock. The typical approach uses a lock box or group lockbox: a primary authorized employee isolates the equipment and places the isolation keys in a box, and each member of the group then attaches a personal lock to the box. Equipment cannot be re-energized until every personal lock is removed. Multi-lock hasps are used when several employees must lock a single isolating device. Exam questions often ask about the primary authorized employee's responsibility for overall coordination and for verifying continued isolation.

Shift or personnel changes. The employer must ensure the continuity of lockout protection during shift changes, including an orderly transfer of devices between outgoing and incoming employees. Equipment must never be left unprotected while locks are exchanged; the incoming employee applies their lock before the outgoing employee removes theirs.

Outside personnel and contractors. The host employer and the outside employer must inform each other of their respective lockout/tagout procedures, and the host must ensure its employees understand and comply with the contractor's program where applicable. The host remains responsible for the safety of its own employees.

Testing or positioning during servicing. When devices must be temporarily removed to test or position the equipment, a specific sequence applies: clear tools and materials, remove employees from the area, remove the devices, energize and test, then de-energize and reapply lockout before continuing the servicing. This is sometimes called the temporary removal provision.

Energy re-accumulation. If there is a possibility of re-accumulation of stored energy to a hazardous level (for example, pressure building behind a closed valve or capacitors recharging), verification of isolation must be continued until servicing is complete or until the possibility no longer exists.

Alternative methods (ANSI/ASSP Z244.1). When a documented risk assessment demonstrates that full LOTO is not feasible for routine tasks and that an alternative method provides effective protection, techniques such as control-reliable safety circuits, interlocked guards with guard locking, safety-rated monitoring, and remotely controlled isolation may be used. OSHA will accept such alternatives only within the minor servicing exception; the CSP should know the difference between what OSHA permits and what the consensus standard recommends.

3.11 Common program failures identified in incident investigations
- Failing to identify all energy sources (especially gravity and stored pneumatic or hydraulic energy).
- Locking out a control device (push button or PLC stop) rather than an energy isolating device.
- Skipping the verification or try-out step.
- Relying on another person's lock instead of applying a personal lock.
- Poorly managed shift changes and group lockout.
- Generic procedures not specific to the machine, and missing annual inspections.
- Removing guards during production and claiming the minor servicing exception when the task is not routine, repetitive, and integral to production.

Part 4: Exam Tips: Answering Questions on Hazardous Energy Control and Lockout/Tagout

Tip 1: Know the distinction between an energy isolating device and a control device. If an answer choice involves using a stop button, emergency stop, selector switch, or a PLC command as the point of lockout, it is wrong. Lockout must be applied to a physical isolating device such as a disconnect, breaker, or valve.

Tip 2: Always look for stored or residual energy. Scenario questions frequently describe a machine that was electrically disconnected but still injured someone. The correct answer typically involves gravity, trapped hydraulic or pneumatic pressure, springs, capacitors, or thermal energy. If a question asks what step was missed, consider whether stored energy was relieved and whether isolation was verified.

Tip 3: Memorize the seven-step application sequence and the release sequence. Questions ask what comes immediately after a given step. Remember: prepare, notify, shut down, isolate, apply devices, control stored energy, verify. For release: inspect area, position employees, notify, remove devices, re-energize.

Tip 4: Verification is the most tested single step. If a question asks for the most important or most frequently omitted step, or the step that confirms a zero energy state, the answer is verifying isolation by attempting to start the equipment and testing for absence of energy.

Tip 5: Lockout is the default; tagout is the exception. When a device can be locked, lockout must be used unless equivalent protection is demonstrated. When tagout is used, additional measures are required and tags must have a 50-pound attachment strength. Any answer that treats a tag as physically preventing operation is incorrect.

Tip 6: Know the roles. Authorized employees apply locks and perform servicing. Affected employees operate the equipment or work in the area and are notified but do not apply locks. Other employees are instructed never to restart locked-out equipment. The periodic inspector must be an authorized employee who is not using the procedure being inspected.

Tip 7: Remember the key numbers and dates. Periodic inspection: at least annually. Tag attachment strength: 50 pounds minimum. Equipment installed or substantially modified after January 2, 1990 must accept a lockout device. Training certification must include names and dates. Eight conditions permit omitting a written procedure.

Tip 8: Understand the exceptions precisely. Cord-and-plug equipment is exempt only if the plug is under the exclusive control of the person doing the work. The minor servicing exception requires the task to be routine, repetitive, and integral to production AND alternative effective protection. Hot taps require documented procedures and proven protection. Construction and utilities fall under other standards. Questions often present an exception with one condition missing; the correct response is that LOTO still applies.

Tip 9: Group lockout and shift change questions hinge on continuity. The right answer never leaves equipment unprotected, never relies on a coworker's lock, and never allows a supervisor to remove someone else's lock without following the formal removal procedure (verify absence, attempt contact, inform before return).

Tip 10: Apply the hierarchy of controls. LOTO is an administrative control supplemented by physical devices. When a question asks for the best long-term solution to a repetitive servicing exposure, engineering controls (interlocked guards, guard locking, designing the hazard out) rank above procedures. However, when the question is specifically about servicing or maintenance with exposure to unexpected energization, LOTO is the required answer.

Tip 11: Distinguish OSHA requirements from ANSI Z244.1 best practice. If the question references risk assessment, alternative methods, or a more comprehensive hazardous energy control program, think Z244.1. If it references minimum legal compliance, think 1910.147. If it involves absence-of-voltage testing or an electrically safe work condition, think NFPA 70E and 1910.333.

Tip 12: Read for the word unexpected. The standard applies where there is a potential for unexpected energization, startup, or release. Questions sometimes describe a worker who intentionally energizes a machine for testing; the proper approach is the temporary removal sequence, not an argument that LOTO does not apply.

Tip 13: Watch for the most comprehensive or the first-action choice. CSP questions favor answers that reflect a systems approach: a machine-specific written procedure, an energy survey identifying all sources, training for all three employee groups, and annual audits. When asked what to do first in a scenario, the answer is usually to stop work and secure the hazard before investigating or retraining.

Part 5: Practice Questions with Explanations

Question 1. A maintenance technician opens the electrical disconnect to a hydraulic press, applies a lock, and begins replacing a die. The ram suddenly descends and crushes his hand. Which program element most likely failed?
A. Notification of affected employees
B. Control of stored or residual energy
C. Standardization of lockout devices
D. Annual periodic inspection
Answer: B. The electrical source was isolated, but stored hydraulic pressure and gravitational energy in the raised ram were not relieved or blocked. Every energy source and stored energy must be controlled and isolation verified.

Question 2. Which of the following is an energy isolating device under 29 CFR 1910.147?
A. Emergency stop button
B. Programmable logic controller stop command
C. Manually operated circuit breaker
D. Selector switch in the off position
Answer: C. Only devices that physically prevent transmission or release of energy qualify. Push buttons, selector switches, and control circuit devices are specifically excluded.

Question 3. An authorized employee has left the facility for the day with a personal lock still applied. The night supervisor needs the machine. What is the correct action?
A. Cut the lock and note it in the log
B. Follow the employer's documented lock removal procedure, including verifying the employee is not on site, making reasonable attempts to contact them, and informing them before they return to work
C. Have the next shift apply a second lock and remove the first
D. Wait until the employee returns the next morning in all circumstances
Answer: B. Removal by someone other than the applying employee is permitted only under a specific documented procedure with those elements.

Question 4. How often must each energy control procedure be inspected, and by whom?
A. Quarterly, by the safety manager
B. Annually, by an authorized employee not using the procedure being inspected
C. Annually, by the authorized employee who performs the lockout
D. Every three years, by a third-party auditor
Answer: B. The periodic inspection must occur at least annually and be performed by an authorized employee other than those utilizing the procedure, with certification of the inspection.

Question 5. A production operator routinely clears minor jams from a packaging machine several times per shift by opening an interlocked guard that stops all hazardous motion and prevents restart until closed. Is LOTO required?
A. Yes, LOTO is always required when guards are opened
B. No, if the task is routine, repetitive, and integral to production and the interlock provides effective alternative protection, the minor servicing exception applies
C. No, because operators are affected employees and cannot perform lockout
D. Yes, because packaging machinery is specifically listed in the standard
Answer: B. This is the minor servicing exception. All three criteria must be met and the alternative measure must provide effective protection; the interlocked guard with restart prevention satisfies that condition.

Question 6. Under what condition may tagout be used on an energy isolating device that is capable of being locked out?
A. Whenever locks are unavailable
B. Only when the employer demonstrates that the tagout program provides full employee protection equivalent to lockout
C. When the servicing will last less than one hour
D. When the equipment was installed before 1990
Answer: B. Lockout is the default for lockable devices. Tagout may substitute only with demonstrated equivalent protection and additional measures.

Question 7. During a group lockout using a lockbox, what is the responsibility of the primary authorized employee?
A. To apply the only lock needed for the entire crew
B. To coordinate the lockout, verify isolation, and ensure each crew member attaches a personal lock to the lockbox before beginning work
C. To sign the periodic inspection certification
D. To hold all personal keys for the crew
Answer: B. Group lockout must provide each authorized employee protection equivalent to a personal lock, coordinated by a primary authorized employee.

Summary
Hazardous energy control is about anticipating every way a machine can hurt someone while it is being serviced and making the release of that energy impossible rather than merely unlikely. For the CSP exam, master the definitions, the seven-step application sequence, the release sequence, the lockout-over-tagout rule, the three program pillars (procedures, training, periodic inspections), the key exceptions, and the special cases of group lockout, shift change, contractors, and temporary removal for testing. Combine that knowledge with the exam tips above, especially recognizing stored energy and the critical verification step, and you will be well prepared to answer any LOTO question the exam presents.