A lockout/tagout procedure is a short document with a long tail of citations. Every line traces back to a paragraph of 29 CFR 1910.147, and auditors read it that way — line by line. The good news: the standard itself tells you exactly what to write. Here's the structure, the sneaky energy sources that trip up first drafts, and the operating rules your crew has to actually follow.
Paragraph (c)(4)(ii) lists four things, and they're the whole outline: a statement of intended use; the shutdown, isolation, blocking and securing steps; the steps for placing, removing and transferring lockout devices and who's responsible; and the requirements for testing that the isolation worked. A procedure that answers those four questions for one machine is usually a single page: an energy table, the six-step sequence, a restart sequence, signatures.
The standard does allow an exception — a machine with a single energy source, fully de-energized by one lockout device, with no stored energy, can share a generic procedure with similar machines. Most industrial equipment collects three or more energy types, so machine-specific procedures end up being the norm anyway.
This is where procedures live or die. Walk the machine with its manual and follow every line into the frame:
Then ask the question that catches what the first draft missed: a minute after everything is switched off, what still moves, still holds pressure, still carries a charge, or is still hot? Whatever answers is stored energy, and stored energy is what paragraph (d)(5) exists for.
Paragraph (d) fixes the order, and the order matters:
Notification brackets the whole sequence: affected employees hear about the lockout before it goes on and again before it comes off (c)(9).
Paragraph (e) is the mirror image: inspect the work area for tools and reinstated guards, confirm every person is clear, notify the affected employees, then remove the locks. Each device comes off only by the employee who put it on (e)(3) — the lone exception is a documented procedure for a worker who has left the site, and it requires verifying they're gone, reasonable attempts to reach them, and telling them before they return. In group lockout, a primary authorized employee controls the group mechanism and removes it last (f)(3); shift changes transfer responsibility in an orderly, documented handoff (f)(4); outside crews mean the two employers brief each other on their procedures (f)(2).
| Device rule | Cite | Reading |
|---|---|---|
| Only for energy control | (c)(5)(ii) | A lock borrowed to lock a toolbox isn't a lockout device |
| Standardized | (c)(5)(ii) | One of color, shape, or size consistent site-wide |
| Durable | (c)(5)(ii) | Survives the environment — weather, wet, corrosive |
| Substantial | (c)(5)(ii) | Locks resist without excessive force; tag attachments one-piece and self-locking at 50 lb minimum |
| Identifiable | (c)(5)(ii) | Shows who applied it |
Tags alone are a special case: allowed only where a lock can't physically go, and then the tag needs full employee protection (c)(3) — attached where the lock would be, with extra measures backing it up. The reason is blunt: anyone can tear a tag off; nobody cuts a lock by accident.
At least once a year, each energy control procedure gets reviewed (c)(6) by an authorized employee who doesn't use that procedure themselves. The reviewer watches a real or demonstrated lockout, corrects deviations on the spot, and confirms each authorized employee knows their part. Then the employer certifies it — machine, date, employees included, inspector — which is why the sign-off block on the printed procedure has a row for it. That certification line is frequently the first thing an OSHA compliance officer asks to see after an incident, and it's the cheapest line on the page.
To draft one for a specific machine, the lockout tagout procedure builder assembles all of this from your machine name and energy sources. For the surrounding program — the building-level tasks and safety rounds — the facility maintenance checklist generator covers the rest of the binder, and the OSHA incident rate calculator handles the TRIR and DART numbers your safety record already implies.
Energy table, six-step shutdown, restart sequence, annual inspection block — organized around 29 CFR 1910.147 and ready to print. Free, nothing uploaded.
Lockout Tagout Builder →One page per machine: the energy sources you walked and verified, the six steps in order, the restart checks, and the signature rows. Write it from the machine, not from another machine's procedure, review it annually, and it stays one page. This guide describes the federal standard — it's general information, not legal advice for your site, so confirm specifics against the current standard and your state plan.
Per 1910.147(c)(4)(ii): a statement of the procedure's intended use; the steps for shutting down, isolating, blocking and securing the machine; the steps for placing, removing and transferring lockout devices and who is responsible for them; and the requirements for testing that the isolation actually worked. In practice that means an energy source table, the six-step shutdown sequence, a restart sequence, and a dated sign-off block.
Walk the machine with its manual and drawings and follow every line that enters the frame: electrical (often more than one feed — controls on a separate circuit), air, hydraulic, steam or hot oil, gravity from suspended parts, springs and flywheels for stored mechanical energy, and process chemicals. Then ask what still moves or carries energy a minute after everything is switched off — that question finds the sources the first draft misses.
Under 1910.147(c)(7), an authorized employee is the one who locks out the machine to perform service or maintenance — they get the full training on recognition of hazardous energy sources and the methods of isolation. An affected employee operates the machine or works near it during its normal use; they need to know the purpose of the energy control program and never remove a lock. Everyone else needs awareness-level training.