OSHA 1910.147 LOTO Program Elements
A padlock on a disconnect is only the visible piece of what OSHA 1910.147 actually requires. The Control of Hazardous Energy standard frames lockout/tagout as a documented program with several mandatory parts, and safety leads need to know all of them to know whether their program would survive an audit or an incident review. This page lays out the required elements of a 1910.147 energy-control program so a maintenance or controls team can check their own against the standard's structure.
OSHA 1910.147 LOTO Program Elements in one line: An OSHA 1910.147 lockout/tagout program requires a written energy-control program, machine-specific energy-control procedures, lockout and tagout devices that are durable and identifiable, defined roles for authorized and affected employees, training for each role, and periodic inspections at least annually to confirm the procedures are followed. The program controls all forms of hazardous energy, not just electrical, so stored mechanical, hydraulic, pneumatic, and thermal energy are all in scope.
The Written Program and Machine-Specific Procedures
At the top of the standard sits the written energy-control program, the document that states the site's policy, the roles, and the requirement for procedures, training, and inspection. Below it sit the machine-specific energy-control procedures, one for each piece of equipment, spelling out exactly which energy sources exist, how to isolate each, how to verify isolation, and how to restore service. A generic procedure is only acceptable in the narrow conditions the standard allows; most equipment needs its own.
The machine-specific procedure is where hazardous energy beyond electrical is captured. A single machine can hold electrical energy at a disconnect, pneumatic pressure in an accumulator, hydraulic pressure in a ram, and stored mechanical energy in a spring, and the procedure must address every one. This is why the establishing steps overlap with the electrical practice covered under lockout/tagout, but extend well past the electrical disconnect.
Devices, Roles, and Training
The program requires lockout and tagout devices that are durable, standardized, substantial, and identifiable, so a lock clearly belongs to the program and to a specific worker. Tagout is permitted only where lockout is not possible, and then only with additional protection, because a tag warns but does not physically prevent re-energization the way a lock does. The devices are the physical enforcement of the procedure.
The standard defines roles. Authorized employees are those who lock out equipment to perform servicing; affected employees are those who operate or work around the equipment being locked out; and other employees may simply need awareness. Each role has a different training requirement, with authorized employees trained in the energy-control procedures and the hazards, and affected employees trained to recognize a lockout and not to attempt to restart locked-out equipment.
Training is tied to the role and refreshed when procedures change, when equipment changes, or when an inspection reveals a gap in a worker's practice. The retraining trigger matters because a procedure that has drifted from the equipment, or a worker whose habits have slipped, is exactly the failure mode the training requirement is meant to catch before an incident does.
Periodic Inspection and Keeping the Program Live
The element that keeps the program honest is the periodic inspection, required at least annually, in which a qualified person reviews each energy-control procedure and the practice of the authorized employees who use it. The inspection confirms the procedure still matches the equipment and that workers are applying it correctly, and it is documented, identifying the equipment, the date, the employees, and the inspector. A program without current inspections is a program that has stopped verifying itself.
Inspections frequently reveal that equipment changed but its procedure did not, which links lockout directly to the site's management of change process. Any modification that adds an energy source or moves a disconnect should update the machine-specific procedure, and the inspection is the backstop that catches changes the change process missed. On covered process sites, this whole discipline sits inside the broader PSM framework.
Because lockout is applied and removed constantly, visibility into when equipment is isolated is operationally valuable. A monitoring platform such as Merobix that trends equipment status can show operations when a machine is down for maintenance versus tripped, complementing the physical lockout records without ever replacing them. The locks and the written procedures remain the enforcement; the monitoring adds operational context around them.
Frequently Asked Questions
How often must a LOTO program be inspected under 1910.147?
At least annually. A qualified person, not the same authorized employee who uses the procedure, reviews each energy-control procedure and the practice of the authorized employees applying it, confirming the procedure still matches the equipment and is being followed. The inspection is documented with the equipment, date, employees, and inspector. Sites may inspect more often based on their risk, but annual is the standard's minimum requirement.
Does 1910.147 cover only electrical energy?
No. The standard controls all forms of hazardous energy: electrical, but also stored mechanical energy in springs, hydraulic and pneumatic pressure, and thermal energy. A single machine's energy-control procedure must address every source it holds. This is why the standard requires machine-specific procedures rather than a generic electrical lockout, since a machine safe electrically can still injure a worker through stored pressure or spring energy that was never released.
When is tagout allowed instead of lockout?
Only where the energy-isolating device cannot accept a lock, and then the tagout must provide protection equivalent to lockout through additional means, such as removing a circuit element or blocking a valve. A tag warns but does not physically prevent re-energization, so lockout is always preferred when the device can be locked. New equipment is generally required to be designed to accept a lock, narrowing the situations where tagout alone applies.
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.